this post was submitted on 23 Jan 2025
923 points (97.7% liked)

Technology

60942 readers
5638 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
923
Developer Creates Infinite Maze That Traps AI Training Bots (www.404media.co)
submitted 1 day ago by kororon@lemmy.cafe to c/technology@lemmy.world
128 comments fedilink hide all child comments
 

A pseudonymous coder has created and released an open source “tar pit” to indefinitely trap AI training web crawlers in an infinitely, randomly-generating series of pages to waste their time and computing power. The program, called Nepenthes after the genus of carnivorous pitcher plants which trap and consume their prey, can be deployed by webpage owners to protect their own content from being scraped or can be deployed “offensively” as a honeypot trap to waste AI companies’ resources.

“It's less like flypaper and more an infinite maze holding a minotaur, except the crawler is the minotaur that cannot get out. The typical web crawler doesn't appear to have a lot of logic. It downloads a URL, and if it sees links to other URLs, it downloads those too. Nepenthes generates random links that always point back to itself - the crawler downloads those new links. Nepenthes happily just returns more and more lists of links pointing back to itself,” Aaron B, the creator of Nepenthes, told 404 Media.

you are viewing a single comment's thread
view the rest of the comments
[–] renzev@lemmy.world 34 points 1 day ago (1 children)

This reminds me of that one time a guy figured out how to make "gzip bombs" that bricked automated vuln scanners.

[–] GreenKnight23@lemmy.world 33 points 1 day ago (1 children)

I had a scanner that was relentless smashing a server at work and configured one of those.

evidently it was one of our customers. it filled their storage up and increased their storage costs by like 500%.

they complained that we purposefully sabotaged their scans. when I told them I spent two weeks tracking down and confirmed their scan were causing performance issues on our infrastructure I had every right to protect the experience of all our users.

I also reminded them they were effectively DDOSing our services which I could file a request to investigate with cyber crimes division of the FBI.

they shut up, paid their bill, and didn't renew their measly $2k mrr account with us when their contract ended.

bitch ass small companies are always the biggest pita.

[–] dubyakay@lemmy.ca 2 points 20 hours ago (1 children)

DDoS? Where was the distribution part?

[–] GreenKnight23@lemmy.world 12 points 18 hours ago* (last edited 18 hours ago) (1 children)

effectively

For all practical purposes; in effect.

[–] Filetternavn@lemmy.blahaj.zone 10 points 18 hours ago* (last edited 18 hours ago) (1 children)

I believe the commenter was implying that DoS would be a more accurate description, since it does not seem as if the "attack" was distributed, but it is a nitpick nonetheless. We don't have the context to understand if multiple servers were involved that distributed the load

[–] JackbyDev@programming.dev 8 points 17 hours ago (2 children)

I see DDoS and DoS used interchangeably. I think because DDoS became a somewhat mainstream term (at least in online gamer communities) and is pronounced verbally (dee doss). Idk, just what I've seen.

Like people calling roguelites roguelikes or third person shooters FPSes

[–] renzev@lemmy.world 2 points 14 hours ago

Yes in casual conversation I always say "DDoS" regardless of whether or not it's distributed because "DoS" makes people think of the operating system.

[–] blockheadjt@sh.itjust.works 1 points 17 hours ago (1 children)

Dee doss? I always say dee dee oh es.