upvote
Turnstile is no longer effective. Anyone with a budget uses a real headless chrome instance and gets around it. You only need the spendy chrome instances to get the initial cookie, then you pass that to your workers and they scrape.

It’s really starting to suck. The worst part is these are coming from consumer vpn providers that we can’t just block (lots of real users paying real money on our service are vpn users) or they come from big residential isps. The whole residential relay thing is a hard adversary, since it’s spread across so many real users paying ips that you can’t whackamole it. I’d say 1% of residential ips are participating in a botnet (there’s prob some real numbers out there if I cared to look).

This is just going to push everyone harder into walled gardens. Web input biggest inbound but our content is our mote, we are going to have to turn off non logged in content viewing, which will have real business impacts.

reply
I run a few private MMO servers, we have a website with a support forum, in order to post, you need to register, log in, fill in account data, then create a thread, each of these pages is protected by Turnstile as well as a general bot check for the website, we frequently get automated spam from RMT (real-money trade) services for the OG game. Turnstile is maybe effective against simple bots that just try to call curl/requests/whatever but if you have bots that use a browser driver it's completely useless.
reply
I did this for alyph.ai, but was recently flooded with so many browser-using, Turnstile-defeating bots from Taiwan that I had to completely turn off sign ups. It's not fun anymore.

Not even third party login worked (Google, Linkedin, ...) to curb this.

They were logging in, scraping the client API for vulnerabilities/possibilities and then spammed erotic dog poems to Claude Fable until the $5 welcome credit got drained.

Fun New World.

reply
remove free signups

$5 minimum to sign up

reply
Since there were a couple upvotes, here's one I saved and Google-translated:

  <story-record> 
  
  ## Phase O. This round is a key advancement in the long-term, solidified daily storyline: the two enter Zhou Zhiyi's apartment for the first time under the guise of "non-purposeful" activities, and the soup-making incident becomes a new variable in their relationship. The task is to let this soup ferment naturally, without ending it or revealing anything. 

  ## Phase [Reflections on Life] 

  1. Vibrant: Wu San and Wu Si appear as living beings with distinct personalities; Wu San is a drama queen, and Wu Si is slow to warm up; Zhou Zhiyi's apartment retains traces of his real life (a rhinoceros beetle insulated box, vinyl records, Pokémon, and a doghouse). 

  2. Cognitive Barrier: Shen Liran's "disbelief that he can make soup" and "wanting to kidnap a dog" are information revealed through her words and actions, which Zhou Zhiyi can perceive; however, he
... [some more gibberish] ...

  Then Wu San saw Shen Liran. 

  This dog's opportunism was on full display. Abandoning her father, she turned her short legs and charged towards the backless dress, her front paws gripping the hem, head tilted back, a precisely calculated whimper escaping her throat. Zhou Zhiyi stood in the entryway changing his shoes, coldly observing the performance, thinking, "She's been fooled, fooled. I just fed her a treat this morning; she's a master of disguise." 

  Sure enough. He counted to two, and Shen Liran had already squatted down, oblivious to the hem of her coat dragging on the floor. She ran her hands into her long, brown fur coat, her voice sweet enough to make candied fruit: "Oh my, you're so soft to touch! Did you miss me? Even your dad isn't as good at being affectionate."

  "Three seconds." Zhou Zhiyi hung their leashes back on the wall. "I said you wouldn't last three seconds, and you didn't even last three seconds. You squatted down before she pounced on you; that's a false start."
Interestingly, in the markdown, which was Chinese mostly, "Phase" and <story-record> were in English.
reply
not yet, but I think something like this would be a next step
reply
[flagged]
reply