As a user of an unsigned Firefox fork, Turnstile has ruined a moderate portion of the Internet for me. The way Cloudflare doesn’t think twice about eroding user freedoms, for the sake of a gate that can be trivially bypassed with solvarr or similar, is deeply disturbing. They are no longer a force for good on the web.

As bad as cloudflare is there is a reason people use it.

If you try and run a site that has content that LLMs want or expensive calls that require a lot of compute and can exhaust resources if they are over used the attack is relentless. It can be a full time job trying to stop people who are dedicated to scrapping the shit out of your site.

Even CF doesnt even really stop it any more. The agent run browsers seem to bypass it with relative ease.

Vast majority of websites today can and should be static, which makes even the aggressive llm scrapping non-issue.

One of the things that a lot of LLM scrapers are fetching are git repositories. They could just use git clone to fetch everything at once. But instead, they fetch them commit by commit. That's about as static as you can get, and it is absolutely NOT a non-issue.

No... Basically all git servers have to generate the file contents, diffs etc. on-demand because they don't store static pages for every single possible combination of view parameters. Git repositories also typically don't store full copies of all versions of a file that have ever existed either; they're incremental. You could pre-render everything statically, but that could take up gigabytes or more for any repo of non-trivial size.

> Git repositories also typically don't store full copies of all versions of a file that have ever existed either; they're incremental

This is wrong. Git does store full copies.

git stores files as objects, which are stored as full copies, unless those objects are stored in packfiles and are deltified, in which case they're stored as deltas. https://codewords.recurse.com/issues/three/unpacking-git-pac...

Thank you for the insights.

... which, in the context that is being discussed, is unusual.

that's a pretty niche issue, but fairly easy to solve.

Prebuild statically the most common commits (last XX) and heavily rate limit deeper ones

1. that doesn't appear to match the fetching patterns of the scrapers at all

2. 1M independent IPs hitting random commits from across a 25 year history is not, in fact, "easy to solve". It is addressable, but not easy ...

3. why should I have to do anything at all to deal with these scrapers? why is the onus not on them to do the right thing?

I did not imply that it does, I meant to have a budget allocated for 'unauthenticated deep history queries', when it's over it's over and you only handle dynamic fetching for authorized users until cooldown.

Is it pretty? No, but it also is a pretty niche thing overall (git repo storage).

Granted, but there are open source alternatives that don’t have the same obsession with meaningless digital signatures. Turnstile is just a terrible product.

What are the open source options? Turnstile is a replacement for Recaptcha after google moved it from a free product to a paid one.

The main advantage of Turnstile is that is benefits from CFs ubiquity to help judge legitimate vs illegitimate requests.

I would love to know what other options are available in this space aside from Turnstile, Recaptcha and HCaptcha.

Anubis is the new hotness, specifically billing itself as an "AI firewall". If you've had an animé waifu check you're human you've even used it.

I see people saying that a lot, but I use Zen which is a fork of Firefox and I don't think I've ever had an issue with Turnstile, at least not noticeably more than I had on mobile Chrome.

Zen has been signed for close to a year.

Isn't it the opposite? They allow you to still use it when it would almost certainly be better for cloudflare and the website behind then to just block you.

How does Cloudflare know you are using the fork? Can you not just set the user agent to match firefox's (or even chrome's for that matter)

Quite likely fingerprinting detection, which is remaining firmly enabled.

How does that work technically? Presumably a fork of firefox is almost indistinguishable from firefox from Cloudflare's perspective?

Or at least what a marketing team that has tried nothing and is already completely out of ideas looks like.

This isn’t subversive, it’s just lazy.

> This isn't X \emdash it's Y!

On top of analyzing vast amounts of surveillance data, AI also has to write HN comments defending the mass surveillance! Busy life.

Not every consumer of a service like CodeRabbit will be in a position to make decisions about the tools their org adopts, or even be involved in the relationship with the vendor. Are they not entitled to express exasperation in a public forum?

The guy offered some pretty valuable feedback to help improve the product. Business idiots with ego problems can bury their head in the sand at their own peril.

Raspberry Pis themselves are perfectly reliable given a stable power supply and good storage — steer clear of slow and flakey SD cards.

The HAOS virtual appliance is awesome though.

> Raspberry Pis themselves are perfectly reliable given a stable power supply and good storage — steer clear of slow and flakey SD cards.

At some point the problem stops being my fault and must be the ecosystem. I bought official power supplies, I bought top tier SD cards, I bought special hats to use NVME with RPi, they all sucked IMHO. Maybe I am "holding it wrong" but after buying every RPi from the original B to the 5th gen with the max ram I'm done. Also the foundation seems to have lost its way (especially through COVID) so I'm not really interested in support them anymore even if I found their hardware to be reliable.

I have 12 of them in a cluster and had endless lockups and performance issues with USB drives and SD cards. I ended up switching to a USB to SATA adapter and a cheap consumer grade SSD and have had no issues since.

They aren’t the fastest, but they are reliable IME.

Aren't the "official" Home Assistant Yellow and Green boxes they sell basically Raspberry Pis with stable power supply and good storage?

The over-arching good reason is simply: I don't want it. That should be good enough! As the user, I should be able to command my computer to output what I want it to output, and to not output what I don't want it to output. The user should have the final say over what computation does or does not happen on his computer, not the web or application developer. And we don't need these "Take it or leave it" ultimatums from developers. Using a computer should not be some faustian bargain, where you have to sacrifice something in order to have it precisely follow the commands you issue.

This sadly doesn't match my lived Linux experience. The amdgpu drivers are absolutely abominable with Thunderbolt and regularly cause suspend/resume issues, even when the laptop has suspended while connected to the dock and resumed whilst still connected.

Beyond this applications like Firefox fairly regularly cease rendering frames for seconds at a time while various timeout errors are logged by amdgpu.

AMD have a lot of work to do to just to match Intel on Linux graphics driver stability.

There sure is a lot of chest beating

Nix is awesome for this -- write your entire series of CI tools in she'll or Python and run them locally in the exact same environment as they will run in CI. Add SOPS to bring secrets along for the ride.

Would Nix work well with GitHub Actions? Or is it more of a replacement? How do you automate running tests and deploying to dev on every push, for example?

> Would Nix work well with GitHub Actions?

You can use Nix with GitHub actions since there is a Nix GitHub action: https://github.com/marketplace/actions/install-nix. Every time the action is triggered, Nix rebuilds everything, but thanks to its caching (need to be configured), it only rebuilds targets that has changed.

> How do you automate running tests and deploying to dev on every push

Nix is a build tool and it's main purpose is not to deploy artifacts. There are however a lot of tools to deploy artifacts built by Nix: https://github.com/nix-community/awesome-nix?tab=readme-ov-f...

Note there are also several Nix CI that can do a better job than a raw GitHub actions, because they are designed for Nix (Hydra, Garnix, Hercules, ...).

One neat Nix feature is development shells, which let you define isolated shell environments that can be activated by invoking `nix develop` (or via direnv upon entering a directory):

    devShells.default = pkgs.mkShell {
      packages = with pkgs; [ opentofu terragrunt ];
    };

I can then use these tools inside the devShell from my jobs like so:

    jobs:
      terragrunt-plan:
        runs-on: [self-hosted, Linux, X64]
        defaults:
          run:
            shell: nix develop --command bash -e {0}
        steps:
          - name: Checkout
            uses: actions/checkout@v4
          - name: Plan
            run: terragrunt --terragrunt-non-interactive run-all plan

Since I'm doing this within a Nix flake all of the dependencies for this environment are recorded in a lock file. Provided my clone of the repo is up to date I should have the same versions.

You can combine this with direnv and auto-activate the nix environment when you `cd` into directories as well. We do this, and just activate the shell in ci environments with a cache. Works great.

Yes. GitHub actions can be just a thin wrapper to call any Nix commands that you can run locally.

> How do you automate running tests

You just build the Nix derivation that runs your tests, e.g. `nix build #tests` or `nix flake check` in your workflow file.

> deploying to dev on every push

You can set up a Nix `devShell` as a staging area for any operations you'd need to perform for a deployment. You can use the same devShell both locally and in CI. You'd have to inject any required secrets into the Action environment in your repository settings, still. It doesn't matter what your staging environment is comprised of, Nix can handle it.

Respectfully, a lot of your comments appear apologetic to dictatorial/authoritarian figures and contradict "mainstream" thinking. What's your background/perspective? Given the support for Duterte, are you Filipino?

You point could be valid if it was not only a propaganda/marketing speech to cover terrible self interested crimes.

If his policy was so effective, why drug and criminality was still that high during all of his long time administration? Despite a lot of "democratic" countries respecting the rule of law not facing such issues.

And probably even worse, murders for all sort of reasons were very common, especially as corruption was mainstream. I guess when the president says that doing its own justice with murder as an impact in the way people and gangs solves their problems...

If any one still things that Duterte was a humanist, just ask yourself how did he build his wealth!

> going after drugdealers is something I support

weasel words. If you are going to publicly support extrajudicial mass murder, say so.

looks like a slippery slope?

> mass murder

so you admit the drugdealers are a massive amount of people?

anyway, you are assuming there is any justice to be found in the "justice" system. In a very ideal world, I would choose differently, but you have to look at the whole picture, and then the perfect solution is generally quite far from what you have to deal with

I don’t admit anything of the sort. They committed extrajudicial mass murder. Are the ones they killed drug dealers? Criminals? Random passersby? Without a proper trial you can’t tell.

The death penalty is already bad WITH proper trials, since judges can always get it wrong but this isn’t even that. Put differently, the way you are arguing for it would enable anyone to kill you in cold blood and later claim you had it coming.

IMO that's a gross oversimplification which ignores the actual problem.

In my (limited) experience of the Philippines, the greatest problem is the total lack of domestic opportunity, fuelled by the view of labour as an export. It's compounded by the high cost of education which parents are expected to cover. Graduates enter a world of retail and BPO jobs because they are overqualified. There is no social mobility. There is no middle class. Folks sell their homes and what little land their families hold to afford healthcare, which a few privileged doctors build private rental empires on.

Against this backdrop Duterte's popularity appears consistent with other populist figures -- a machismo strongman claiming to execute the people's will whilst stealing from them for his own gain. Add in extrajudicial killings and increasing militarisation of the police and it's hard to see him as anything other than a tyrant.

Why is there a lack of domestic opportunity? Why do they keep exporting their labour instead of focusing on internal capital investment and inviting foreign capital?

Domestic opportunity is limited by corruption which causes unpredictability that small business can’t plan around.

Say you’re a software developer. You already do software freelancing but you’d like to hire a friend and grow your business into your own agency. You need a couple laptops with more DDR than you can find locally, but you find a $400 model online. Officially, it will cost you $200 in import duties, but when you ship the package, it doesn’t arrives because customs employees extorts recipients with claims of under declared value or unpaid taxes, then confiscate the contents for themselves. Other packages may arrive without an issue, until you open them to find the contents have been substituted for some worthless ballast. The first time this happens the online retailer may refund you, but at some point your money is lost. If customs notices that you’ve ordered several laptops to your home address they may accuse you of running an undeclared business (which you’re not doing yet since you lack the equipment) to extort you for an order of magnitude more fees.

Or one time, your package might arrive. You can’t predict it. Which makes it impossible to save/plan, especially on a shoestring budget.

Customs corruption kills small business ambitions and upward mobility in the cradle.

These “strongmen” pretend to be tough on crime, but then gorge themselves on bribes and put their cronies in power. Every time.

Since cars don't need to cross water, maybe this isn't actually relevant. Uber aren't trying to model the planet, just the routes within the geographies they support.