Skip to content

Commit d3b72e3

Browse files
XeXe
committed
fix(config): deprecate the report_as field for challenges
This was a bad idea when it was added and it is irresponsible to continue to have it. It causes more UX problems than it fixes with slight of hand. Closes: #1310 Closes: #1307 Signed-off-by: Xe Iaso <me@xeiaso.net>
1 parent 1f9c227 commit d3b72e3

21 files changed

Lines changed: 26 additions & 42 deletions

File tree

‎data/botPolicies.yaml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,7 @@ bots:
5050
# user_agent_regex: (?i:bot|crawler)
5151
# action: CHALLENGE
5252
# challenge:
53-
# difficulty: 16 # impossible
54-
# report_as: 4 # lie to the operator
53+
# difficulty: 16 # impossible
5554
# algorithm: slow # intentionally waste CPU cycles and time
5655

5756
# Requires a subscription to Thoth to use, see
@@ -249,7 +248,6 @@ thresholds:
249248
# https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh
250249
algorithm: metarefresh
251250
difficulty: 1
252-
report_as: 1
253251
# For clients that are browser-like but have either gained points from custom rules or
254252
# report as a standard browser.
255253
- name: moderate-suspicion
@@ -262,7 +260,6 @@ thresholds:
262260
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
263261
algorithm: fast
264262
difficulty: 2 # two leading zeros, very fast for most clients
265-
report_as: 2
266263
- name: mild-proof-of-work
267264
expression:
268265
all:
@@ -273,7 +270,6 @@ thresholds:
273270
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
274271
algorithm: fast
275272
difficulty: 4
276-
report_as: 4
277273
# For clients that are browser like and have gained many points from custom rules
278274
- name: extreme-suspicion
279275
expression: weight >= 30
@@ -282,4 +278,3 @@ thresholds:
282278
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
283279
algorithm: fast
284280
difficulty: 6
285-
report_as: 6

‎data/meta/default-config.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@
3535
# action: CHALLENGE
3636
# challenge:
3737
# difficulty: 16 # impossible
38-
# report_as: 4 # lie to the operator
3938
# algorithm: slow # intentionally waste CPU cycles and time
4039

4140
# Requires a subscription to Thoth to use, see

‎docs/docs/CHANGELOG.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
2525
- Stabilize the CVE-2025-24369 regression test by always submitting an invalid proof instead of relying on random POW failures.
2626
- Add Polish locale ([#1292](https://github.com/TecharoHQ/anubis/pull/1309))
2727

28+
### Deprecate `report_as` in challenge configuration
29+
30+
Previously Anubis let you lie to users about the difficulty of a challenge to interfere with operators of malicious scrapers as a psyops attack:
31+
32+
```yaml
33+
bots:
34+
# Punish any bot with "bot" in the user-agent string
35+
# This is known to have a high false-positive rate, use at your own risk
36+
- name: generic-bot-catchall
37+
user_agent_regex: (?i:bot|crawler)
38+
action: CHALLENGE
39+
challenge:
40+
difficulty: 16 # impossible
41+
report_as: 4 # lie to the operator
42+
algorithm: slow # intentionally waste CPU cycles and time
43+
```
44+
45+
This has turned out to be a bad idea and has been removed.
46+
47+
If you are using this setting, you will get a warning in your logs. To remove this warning, remove this setting from your policy file.
48+
2849
### Logging customization
2950
3051
Anubis now supports the ability to log to multiple backends ("sinks"). This allows you to have Anubis [log to a file](./admin/policies.mdx#file-sink) instead of just logging to standard out. You can also customize the [logging level](./admin/policies.mdx#log-levels) in the policy file:

‎docs/docs/admin/configuration/challenges/metarefresh.mdx‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ To use it in your Anubis configuration:
1212
action: CHALLENGE
1313
challenge:
1414
difficulty: 1 # Number of seconds to wait before refreshing the page
15-
report_as: 4 # Unused by this challenge method
1615
algorithm: metarefresh # Specify a non-JS challenge method
1716
```
1817

‎docs/docs/admin/configuration/challenges/preact.mdx‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ To use it in your Anubis configuration:
1212
action: CHALLENGE
1313
challenge:
1414
difficulty: 1 # Number of seconds to wait before refreshing the page
15-
report_as: 4 # Unused by this challenge method
1615
algorithm: preact
1716
```
1817

‎docs/docs/admin/configuration/thresholds.mdx‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@ thresholds:
4141
challenge:
4242
algorithm: metarefresh
4343
difficulty: 1
44-
report_as: 1
4544
4645
- name: moderate-suspicion
4746
expression:
@@ -52,15 +51,13 @@ thresholds:
5251
challenge:
5352
algorithm: fast
5453
difficulty: 2
55-
report_as: 2
5654
5755
- name: extreme-suspicion
5856
expression: weight >= 20
5957
action: CHALLENGE
6058
challenge:
6159
algorithm: fast
6260
difficulty: 4
63-
report_as: 4
6461
```
6562

6663
This defines a suite of 4 thresholds:

‎docs/docs/admin/policies.mdx‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,6 @@ This rule has been known to have a high false positive rate in testing. Please u
8484
action: CHALLENGE
8585
challenge:
8686
difficulty: 16 # impossible
87-
report_as: 4 # lie to the operator
8887
algorithm: slow # intentionally waste CPU cycles and time
8988
```
9089

@@ -93,7 +92,6 @@ Challenges can be configured with these settings:
9392
| Key | Example | Description |
9493
| :----------- | :------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------- |
9594
| `difficulty` | `4` | The challenge difficulty (number of leading zeros) for proof-of-work. See [Why does Anubis use Proof-of-Work?](/docs/design/why-proof-of-work) for more details. |
96-
| `report_as` | `4` | What difficulty the UI should report to the user. Useful for messing with industrial-scale scraping efforts. |
9795
| `algorithm` | `"fast"` | The challenge method to use. See [the list of challenge methods](./configuration/challenges/) for more information. |
9896

9997
### Remote IP based filtering

‎docs/manifest/cfg/anubis/botPolicies.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,6 @@ bots:
4949
# action: CHALLENGE
5050
# challenge:
5151
# difficulty: 16 # impossible
52-
# report_as: 4 # lie to the operator
5352
# algorithm: slow # intentionally waste CPU cycles and time
5453

5554
- name: rss-feed-blog
@@ -105,7 +104,6 @@ thresholds:
105104
# https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh
106105
algorithm: metarefresh
107106
difficulty: 1
108-
report_as: 1
109107
# For clients that are browser-like but have either gained points from custom rules or
110108
# report as a standard browser.
111109
- name: moderate-suspicion
@@ -122,7 +120,6 @@ thresholds:
122120
# challenge data, and forwards that to the client.
123121
algorithm: preact
124122
difficulty: 1
125-
report_as: 1
126123
- name: mild-proof-of-work
127124
expression:
128125
all:
@@ -133,7 +130,6 @@ thresholds:
133130
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
134131
algorithm: fast
135132
difficulty: 2 # two leading zeros, very fast for most clients
136-
report_as: 2
137133
# For clients that are browser like and have gained many points from custom rules
138134
- name: extreme-suspicion
139135
expression: weight >= 30
@@ -142,7 +138,6 @@ thresholds:
142138
# https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work
143139
algorithm: fast
144140
difficulty: 4
145-
report_as: 4
146141

147142
dnsbl: false
148143

‎lib/anubis.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -167,8 +167,8 @@ func (s *Server) hydrateChallengeRule(rule *policy.Bot, chall *challenge.Challen
167167
if rule.Challenge.Difficulty == 0 {
168168
rule.Challenge.Difficulty = chall.Difficulty
169169
}
170-
if rule.Challenge.ReportAs == 0 {
171-
rule.Challenge.ReportAs = chall.Difficulty
170+
if rule.Challenge.ReportAs != 0 {
171+
s.logger.Warn("[DEPRECATION] the report_as field in this bot rule is deprecated, see https://github.com/TecharoHQ/anubis/issues/1310 for more information", "bot_name", rule.Name, "difficulty", rule.Challenge.Difficulty, "report_as", rule.Challenge.ReportAs)
172172
}
173173
if rule.Challenge.Algorithm == "" {
174174
rule.Challenge.Algorithm = chall.Method
@@ -648,7 +648,6 @@ func (s *Server) check(r *http.Request, lg *slog.Logger) (policy.CheckResult, *p
648648
return cr("default/allow", config.RuleAllow, weight), &policy.Bot{
649649
Challenge: &config.ChallengeRules{
650650
Difficulty: s.policy.DefaultDifficulty,
651-
ReportAs: s.policy.DefaultDifficulty,
652651
Algorithm: config.DefaultAlgorithm,
653652
},
654653
Rules: &checker.List{},

‎lib/anubis_test.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -464,10 +464,6 @@ func TestCheckDefaultDifficultyMatchesPolicy(t *testing.T) {
464464
if bot.Challenge.Difficulty != i {
465465
t.Errorf("Challenge.Difficulty is wrong, wanted %d, got: %d", i, bot.Challenge.Difficulty)
466466
}
467-
468-
if bot.Challenge.ReportAs != i {
469-
t.Errorf("Challenge.ReportAs is wrong, wanted %d, got: %d", i, bot.Challenge.ReportAs)
470-
}
471467
})
472468
}
473469
}

0 commit comments

Comments
 (0)