Hacker News: arbol

A WebSocket upgrade bypassed our Lambda Edge

arbol — Mon, 02 Nov 2026 10:12:25 +0000

Article URL: https://prosopo.io/blog/cloudfront-websocket-lambda-edge-bypass/

Comments URL: https://news.ycombinator.com/item?id=50334977

Points: 1

# Comments: 1

New comment by arbol in "Why is this fingerprinting script creating bioweapons?"

arbol — Sat, 31 Oct 2026 07:43:19 +0000

Claude just ignores all of these decoy methods

New comment by arbol in "Why is this fingerprinting script creating bioweapons?"

arbol — Wed, 28 Oct 2026 22:40:20 +0000

This stuff doesn't work. The agents read the AST and just ignore dead code. Even replacing all your function names at build time with decoys makes the agent see the juxtaposition.

You need evil context as well as evil names, and then you need to run the evil code! Not an appropriate defense on client sites.

To stop deobfuscation at scale, you're better off serving so many bundles that mass scraping can't scale, as they cannot reliably deobfuscate your code. This forces them into the browser and it's behavioural analysis from this point onwards.

New comment by arbol in "Ask HN: Why hasn't AI replaced Tax filing software"

arbol — Sat, 17 Oct 2026 20:57:10 +0000

It identified mistakes in previous years' submissions which I now have to rectify.

New comment by arbol in "Ask HN: Why hasn't AI replaced Tax filing software"

arbol — Thu, 08 Oct 2026 20:21:12 +0000

I used Claude to automate my tax this year instead of my accountant and it was more accurate

New comment by arbol in "An update on Wayback Machine access"

arbol — Wed, 16 Sep 2026 19:04:00 +0000

How much is eye watering expensive roughly?

New comment by arbol in "Understanding the recent DDoS attack against Read the Docs"

arbol — Mon, 14 Sep 2026 12:26:56 +0000

Yep curl cffi accurately spoofs JA4 for chrome. You need to detect client side as well.

New comment by arbol in "Chrome again exempts Google from user site data settings"

arbol — Sun, 06 Sep 2026 12:29:38 +0000

It's to protect against scrapers that aren't running JavaScript. Makes it more costly for them.

New comment by arbol in "Should every web page expose an AI-friendly JSON representation?"

arbol — Wed, 02 Sep 2026 22:49:15 +0000

This is already happening and it absolutely does let llms understand the page better. Search for JSON-LD

New comment by arbol in "Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form"

arbol — Wed, 02 Sep 2026 22:15:50 +0000

If you're getting hundreds of thousands of spam submissions then you probably need to pay for bot protection.

New comment by arbol in "Ask HN: How do you protect self-hosted websites from LLM scrapers?"

arbol — Thu, 27 Aug 2026 09:53:36 +0000

Why do you expect a high level of abuse? Blocking CIDRs of major cloud providers will stop the genuine ChatGPT/Claude traffic. For the other scrapers masquerading as them, just block the agents' user agents.

If you want the LLMs to refuse to scrape your site you could inject lots of encoded trigger words but this would probably affect your SEO score :)

New comment by arbol in "Fastmail Down for Anyone Else?"

arbol — Tue, 25 Aug 2026 19:01:59 +0000

UI says: "Could not connect to server."

Console: https://ams.api.fastmail.com/auth/login net::ERR_ADDRESS_UNREACHABLE

Fastmail Down for Anyone Else?

arbol — Tue, 25 Aug 2026 19:01:59 +0000

Article URL: https://app.fastmail.com/

Comments URL: https://news.ycombinator.com/item?id=49438935

Points: 2

# Comments: 3

New comment by arbol in "Help me build a better bot blocker"

arbol — Wed, 12 Aug 2026 08:03:29 +0000

> I'd like to increase bot traffic to around 100k hits per day to help test the filters. Any suggestions on how?

Start publishing content that AI crawlers want to read and you'll get absolutely hammered. Your site is pretty bare bones so maybe get an AI to rewrite it with more content, using SEO best practices and with AI agent parsing in mind.

New comment by arbol in "Residential Proxies Are a National Security Threat"

arbol — Mon, 03 Aug 2026 20:43:06 +0000

It's not enough to use latency alone as the other commentor said. You need to look for repeat behaviour at scale. It's ML model time once these basic signals fail you.

New comment by arbol in "How the FSF sysadmins block botnets with reaction"

arbol — Wed, 22 Jul 2026 16:02:08 +0000

Prosopo could cut out a lot of the residential proxy nonsense for you. We integrate with lambda@Edge / cloudfront workers / server side and perform analytics to detect residential proxy networks - at far less cost than DD or HUMAN.

New comment by arbol in "If you solve this CAPTCHA, you are not welcome here"

arbol — Wed, 22 Jul 2026 15:57:59 +0000

> The checks can be bypassed by hitting the Escape key five times.

New comment by arbol in "Monetization Gateway: Charge for any resource behind Cloudflare via x402"

arbol — Wed, 08 Jul 2026 11:16:36 +0000

If you're on a proxy network then you're detectable by TLS handshake timings, for example. You are right though that agent mouse and touch behaviour is almost inseperable from human data these days. So you need to use a combination of techniques in order to detect automation. At Prosopo we check TLS timings, SIMD performance, page similarity, fingerprint proofs, agent honey pots, JS inconsistencies. Rate limiting is surprisingly effective as an initial deterrant. There is no magic single thing that works for all clients, it's a case of learning distinct bot operators' behaviours.

New comment by arbol in "A martian rock has lots of carbon on it, and it's not clear why"

arbol — Sat, 04 Jul 2026 15:40:32 +0000

They talk about bringing these samples back to earth but don't mention how. Have they already planned how to get perseverance and its samples back?

New comment by arbol in "Malware developers added nuclear and biological weapons text to to their spyware"

arbol — Mon, 22 Jun 2026 13:59:58 +0000

It works both ways... We use prompts hidden in our bot detection system that are unreadable to humans but trigger additional payloads.