upvote

points

by aeyes7 hours ago |
comments
upvoteby its-summertime4 hours ago|
next
[-]
For those with difficulty accessing:

- - -

From: Anthony Hurtado <[redacted since hn has no scrape protection]>

vpk_read_packet() divides vpk->last_block_size and (par->block_align - vpk->last_block_size) by par->ch_layout.nb_channels without checking for zero.

While vpk_read_header() validates nb_channels > 0, the codec parameters may become zero through format probing misidentification (VPK probe score is 2/3 of AVPROBE_SCORE_MAX) or codec parameter reset, causing SIGFPE.

Fix by:

- Checking nb_channels != 0 before division in vpk_read_packet

- Returning EOF for empty last blocks (last_block_size == 0)

- Validating block_count > 0 in vpk_read_header

- Validating last_block_size <= block_align in vpk_read_header

Found by fuzzing with libFuzzer + AddressSanitizer. Reproduces with 10 distinct inputs.

[patch redacted for brevity]

reply
upvoteby timpera4 hours ago|
parent|
[-]
Thank you! I gave up after more than 2 whole minutes of waiting on a high-end smartphone. I'm not sure this keeps bots out, but it definitely keeps users out…
reply
upvoteby 1 hours ago|
parent|
[-]
deleted
reply
upvoteby semiquaver6 hours ago|
prev|
next
[-]
Oddly enough I can’t access that site, it just heats up my phone solving hashes. Gave up after about a minute and anubis had only made it less than halfway through.

I doubt the real bots have any trouble bypassing it.

reply
upvoteby inventor77773 hours ago|
parent|
next
[-]
It's puzzling how mild the reactions are to Anubis compared to the people reacting to seeing one singular Cloudflare captcha checkbox. I'd much rather a checkbox than a brief CPU-intensive hashing session.
reply
upvoteby tredre31 hours ago|
parent|
next
[-]
Anubis is usually less obtrusive than that, though. This is the longest anubis challenge I've ever had, to the point of being absurd. Hopefully they have a genuine reason for having set the difficulty so high.
reply
upvoteby da_chicken3 hours ago|
parent|
prev|
next
[-]
I think when people are complaining about Captcha they're complaining about yet another "pick 6-20 pictures of traffic lights/school busses/stairs/stop signs/bicycles."
reply
upvoteby inventor77771 hours ago|
parent|
next
[-]
Not in this case. I wish I could find the actual post, but I recall reading a post on HN recently where a majority of the commenters were claiming that when they even see a Cloudflare verification checkbox that they leave the website.

This makes no sense to me as in my experience, you click the checkbox and then it verifies you without extra steps.

reply
upvoteby mapontosevenths3 hours ago|
parent|
prev|
[-]
If they want to train an AI they should pay for it like everyone else. Modern bots have zero problems solving these, it's just free training for them.
reply
upvoteby da_chicken2 hours ago|
parent|
[-]
> If they want to train an AI they should pay for it like everyone else.

They're paying for electricity and taking data without paying for it. It seems to me that they're paying for it exactly the same way everyone else in AI did.

reply
upvoteby blarg11 hours ago|
parent|
prev|
[-]
> rather a checkbox than a brief CPU-intensive hashing session.

oh is that why my raspberry pi 5 can't browse websites anymore without freezing for a minute.

reply
upvoteby post-it6 hours ago|
parent|
prev|
next
[-]
It also took insanely long on my iPhone 16. "Made with heart in Canada" but configured poorly.
reply
upvoteby kurtoid3 hours ago|
parent|
prev|
next
[-]
their anubis difficulty is wayyy to high; 6 is overkill
reply
upvoteby bartread6 hours ago|
parent|
prev|
next
[-]
Yeah, it's painful.

I get this crap when browsing on desktop a lot as well, principally because I stubbornly use Firefox as my main browser, and I habitually use a VPN when I connect my laptop to unsecured or even secured-but-accessible-to-large-numbers-of-people WiFi networks.

Like, seriously, bot detection "specialists", fuck off: I'm not a bot but your bot detection software IS shit, and I DO resent your shit software draining my battery and getting in my way. Learn to do your jobs properly, will you?

And don't come crying to me about how the problem you're trying to solve is "hard". I don't care: you chose it, you chose to considerably worsen the web browsing experience of millions of people globally, nobody made you. So go and find a different job if you're incapable of doing the one you have.

And if it's so "hard" why does your entire solution seem to be predicated on anyone's a bot if they're not running Chrome, or they are running an adblocker, or they appear to be from an unusual country that doesn't match their system language? Seriously, is this the level of sophistication you hacks operate at? To solve your "hard" problem?

You are extremely lame. Get out of my way.

reply
upvoteby 8bitsrule4 minutes ago|
parent|
next
[-]
It's indeed very annoying.

I've only seen 1 or 2 that know what they're doing. One's at lemmy.world ... just hovering over it is verified ...

reply
upvoteby Georgelemental5 hours ago|
parent|
prev|
next
[-]
> And don't come crying to me about how the problem you're trying to solve is "hard". I don't care: you chose it, you chose to considerably worsen the web browsing experience of millions of people globally, nobody made you.

Unfortunately, if you let all the bots in, they overwhelm your servers, and then nobody can access the website.

reply
upvoteby aystatic5 hours ago|
parent|
[-]
Not if you use a decentralized peer-to-peer Git forge like https://radicle.network. If one node goes down, users can still access the same issues/PRs from another endpoint.
reply
upvoteby a2ff6eeb05 hours ago|
parent|
prev|
next
[-]
I assume you're offering to pay for the increased server costs?

I had some git hosting up for a while, and was serving hundreds of qps and several terabytes per month. I can only imagine want significant sites are serving.

reply
upvoteby 3 hours ago|
parent|
prev|
[-]
deleted
reply
upvoteby demibabs6 hours ago|
parent|
prev|
next
[-]
Yeah, is it trying to mine bitcoin or something? Anubis usually takes a second but here I waited a minute and got 20% through on a modern phone.
reply
upvoteby bulder6 hours ago|
parent|
[-]
Presumably they've configured it to use a higher difficulty challenge due to high rates of scraping on their bugtracker
reply
upvoteby myng1113 hours ago|
parent|
[-]
Difficulty 6 which some parts of FFmpeg use, is about the highest difficulty you can assign with the default Anubis config. For me personally I only serve that difficulty if I'm near certain the user is a bot. Serving it to everyone sure is a choice.
reply
upvoteby gguingff5 hours ago|
parent|
prev|
next
[-]
happy to report my bots have no trouble with anubis or any other pow mechanism, little bit of deno and i'm right through.
reply
upvoteby LoganDark1 hours ago|
parent|
[-]
The point is to deter bots that are scraping thousands to millions of websites in parallel, not user agents.
reply
upvoteby hiccuphippo6 hours ago|
parent|
prev|
[-]
Took less than a minute in my 5 year old xiaomi phone. It did take way longer than other Anubis sites I've seen.
reply
upvoteby yorwba6 hours ago|
prev|
next
[-]
A patch was submitted, but apparently not merged. That was also my experience trying to submit a patch for https://trac.ffmpeg.org/ticket/8738 . Somebody on the bug tracker took note, but was apparently unable to effect a merge in the intervening years.

Maybe now that ffmpeg is using Forgejo, the ball won't be dropped like this as often. Or there'll just be a five-digit number of open pull requests instead.

reply
upvoteby theowaway1 hours ago|
prev|
[-]
what the fuck is that anime catgirl bollocks
reply