Forest @forestjohnson@pixie.town

@davepolaschek @joel

Sorry about the docker-only config example. It also supports a json file for config. You just need to be able to compile the go code for OpenBSD; that shouldn't be too hard.

I bet Anubis might be easier to use for now as its more popular and mine is more of a work-in-progress / hack. I made my own because I wanted this as a "captcha" before LLMs and Anubis existed, and also because I wanted to use a memory-hard hash function like Scrypt or Argon because I figured that would inflict a lot more pain on bots in the situation where the bot operators eventually decided to bite the bullet and just solve the PoW challenge.

@davepolaschek For a demo of the pow-bot-deterrent-rp, see one of the source code files on that repo, like:

https://git.sequentialread.com/forest/pow-bot-deterrent-rp/src/branch/main/disallowbots.gotemplate.html

Still has some issues on privacy browsers which don't allow WebAssembly. Anubis doesn't have the same issue because it uses SHA256 via WebCrypto for now.

I've been working on an email-based alternative for browsers that don't do webworkers / web assembly but still in the proof of concept stage.

@davepolaschek

https://git.sequentialread.com/forest/pow-bot-deterrent-rp

https://anubis.techaro.lol/

@notplants

@notplants Well, having a group is not magic and someone still has to fix the bug and figure out why it happened. But having more users than just one person helps a lot, I think. And of course, having multiple people working on hosting it helps a ton.

@stefano So is everyone else?..

Anyone operating a public git forge server has known about this for a long time... Anubis or pow-bot-deterrent have become a requirement.

Also, fuck cloudflare

@Violinknitter I know this fellow is missing a fin, but jeez.

Clearly this whole automatic fish detection system needs work.

@vkc Would you feel better about it if there was also an option to log in via SSH?

@jwildeboer I was arguing that

because being able to directly accept a TCP connection is still step one for a lot of use cases,

All the work that went into making the network and devices faster doesn't help all that much; what good is a fast network if no one can connect to each other in the first place?

We can make great "local first" apps, but since everyone is still in "NAT jail", we still need servers. Having a server helps a ton, even if you're trying to build an app that's offline-only most of the time.

For apps that don't need to be able to accept connections; yes the unhosted idea works great. But I care about federation, publishing, etc, I think they are really important and worth designing for.

@jwildeboer what did we learn?

As far as I know, people still aren't likely to fully ditch email, the https/web stack is still the only game in town, IPv6 is still always 10 years away, etc... I don't think any of the fundamentals have changed since then.

@jwildeboer I suppose my password manager is an example of this type of web app though.

It's definitely really great for password managers. There's no publishing involved, there's no incoming connections from other users or anything.

@jwildeboer I also read the unhosted page that you linked back in 2010.

I really liked the idea, but after thinking about it for a while and doing some research about how the relevant protocols work, I'm convinced that it's just not worth it.

It would work if the apps and the protocols were designed for it but for example, if you want to do email or publishing, It starts to go off the rails fast.

I think we already have the software to solve this problem, simple things which already work with the rest of the world. They're compatible, using the same protocols.

I'm focused on:

* the usability of the software, both for Admins and users
* the economic/social organization around the operation of the software
* seizing the right moments (unrest) to pull entire groups of people out of platforms at once. Where they wouldn't normally be able to leave because all of thier friends are there