[object Object]

My motivation to use Ansible is fueled by disdain for manual non-scriptable configuration. I’ve had to use Windows for a couple years lately, and the absence of programmatic access to many things annoyed me to no end.

Now, I get up in the morning and look to the east. I salute the sun and thank the fate for the chance to do proper configuration again. I don’t wade through dialogs for hours anymore. I don’t lose track of things that I’ve changed somewhere sometime. I’ll learn what the hell the difference between dconf and gsettings is, just to use one of them for all my desktop settings forever. I will have this config for years to come, and I will put more things in it bit by bit.

Now, if Ansible’s config language wasn’t a naive reinvention of Lisp, that would be great.

This here is the implementation of sha256 in the slow language JavaScript:

const msgUint8 = new TextEncoder().encode(message);
const hashBuffer = await window.crypto.subtle.digest("SHA-256", msgUint8);
const hashHex = new Uint8Array(hashBuffer).toHex();

You imagined that JS had to have that done from scratch, with sticks and mud? Every OS has cryptographic facilities, and every major browser supplies an API to that.

As for using it to filter out bots, Anubis does in fact get it a bit wrong. You have to incur this cost at every webpage hit, not once a week. So you can’t just put Anubis in front of the site, you need to have the JS on every page, and if the challenge is not solved until the next hit, then you pop up the full page saying ‘nuh-uh’, and probably make the browser do a harder challenge and also check a bunch of heuristics like go-away does.

It’s still debatable whether it will stop bots who would just have to crank sha256 24/7 in between page downloads, but it does add cost that bot owners have to eat.

I mean, I thought it was long dead. It’s twenty-five years old, and the web has changed quite a bit in that time. No one uses Perl anymore, for starters. I used Open Web Analytics, Webalizer, or somesuch by 2008 or so. I remember Webalizer being snappy as heck.

I tinkered with log analysis myself back then, peeping into the source of AWStats and others. Learned that a humongous regexp with like two hundred alternative matches for the user-agent string was way faster than trying to match them individually — which of course makes sense seeing as regexps work as state-machines in a sort of a very specialized VM. My first attempts, in comparison, were laughably naive and slow. Ah, what a time.

Sure enough, working on a high-traffic site taught me that it’s way more efficient to prepare data for reading at the moment of change instead of when it’s being read — which translates to analyzing visits on the fly and writing to an optimized database like ElasticSearch.

Awstats

I thought I recognized it. Hell of a blast from the past, haven’t seen it in fifteen years at least.

The deterrent might work temporarily until the challenge pattern is recognised, but there’s no actual protection here, just obscurity.

Anubis uses a proof-of-work challenge to ensure that clients are using a modern browser and are able to calculate SHA-256 checksums. Anubis has a customizable difficulty for this proof-of-work challenge, but defaults to 5 leading zeroes.

Please tell me how you’re gonna un-obscure a proof-of-work challenge requiring calculation of hashes.

And since the challenge is adjustable, you can make it take as long as you want.

Use Ansible or some such solution like Puppet, Salt or Chef, just like the big boys do. If you don’t have a unified editable config for your machines, you don’t really have a homelab, you just have a pile of hardware instead.

What are you gonna be improving in fifty-year-old classics?

Not only we had compilers to z-code for a long time, but in fact first third-party languages for the z-machine were better than Infocom’s own, which was discovered from their leaked code. So I’d guess reversing the bytecode wasn’t a problem either for a while now.

Considering that afaik they were shipped in Z-code, the game code was already visible to any Z-machine implementation and to whoever wanted to fiddle with raw Z-code.