Hacker Newsnew | past | comments | ask | show | jobs | submit | MintsJohn's commentslogin

I tried codeberg, used it a year, then early this year in all their wisdom codeberg decided to show adverserial random text instead of my repo, reporteldly to mess up llm training to user agents they weren't sure were human.

Codeberg had one job, serve my repo, it didn't do that, when brought up, I was told it was a feature not a bug, they could maybe whitelist me but that wasn't my problem, it was that random people got totally blocked or from accessing the repo. I moved back to github.


Is your complaint about Anubis? I see the "checking if you are human" kind of text too when going to codeberg, but it is usually only a second or two. It is because I run a bit of obfuscation and resistance to browser finger printing.

But you find seeing the text for a couple of seconds too annoying to use codeberg? Maybe it is more than 2 seconds for you?

Everyone has their views on what is acceptable in the world and what they will put up with. Just, to my point of view, I think codeberg is trying to fight the good fight in keeping llms from crawling their website.


Codeberg has some extra "anti-scraping" measures than just Anubis which, judging from the community issues[0] sometimes ends up with false positives that cause people to get garbage (example issue[1], potential page with the garbage i found from Google[2]).

Interestingly, someone mentioned that you may get the garbage when searching Codeberg using Google's `site:codeberg.org`

[0] https://codeberg.org/Codeberg/Community/issues

[1] https://codeberg.org/Codeberg/Community/issues/2603

[2] https://codeberg.org/Codeberg-e.V./requests/!~codeberger~!.g...


It’s not Anubis as others have pointed out, they have more going on that blocks you sometimes.

With that said I never used code berg because of Anubis. Something about anime girls popping up turns off any desire to use the product.


I believe they're referencing iocaine[0], which I believe I've seen on codeberg before. I may be wrong though.

[0]: https://iocaine.madhouse-project.org/


[0] Gives me HTTP 418


A rare event you see a wild "HTTP I'm a little Teapot"


Interesting. Well, for information about the project: https://lib.rs/crates/iocaine

The site linked is excluded from the wayback machine.


> only a second or two

If only we had research on the effect of a second or two's effect on user experience.

I wouldn't have a problem with it if it was on expensive endpoints like search or deep history dives, where it matters for server load. But it's every single page, out of some strange sense of righteousness.


ridiculous to call it righteousness when it's allowing the servers to stay functioning


No, the issue is when i visited i got a page of senseless drivel (maybe https://lib.rs/crates/iocaine) with the message i was a bot. There was no way around it except "contact support" as the message said the fix, to solve it myself, was to not be a bot.

https://news.ycombinator.com/item?id=48845668 explains it better than i did.

I accessed through mobile, maybe got a bad ip, i don't don't know. But i never could access my repo, and incidently a day before when i tried to share some markdown file in the repo, they told me it wasn't there (i thought it was a them problem then, as i didn't see it).

So that experience and the way it was handled totally ruined my trust. If randomly people can't even access the repo, and that is "working as intended", what's the use to host it there.


Ah! Thank you for the more in depth explanation. I was not aware that codeberg had such a system. As others pointed out, it is probably iocaine.


Also, Anubis is cute!


They explicitly explained that the problem was not "they find seeing the text for a couple seconds too annoying to use codeberg". Codeberg offered to remove that for them so they'd never see it again. So idk why you're asking about that. Whatever the problem is, it must be something other than that, since that problem doesn't even exist.

The problem is blocking or speed-bumping users in general, everyone else besides themselves.

They didn't put things on a public hosting site for them to be hidden or obfuscated or even to have a tiny friction inserted between a user and that user discovering their stuff, or following a link to something.

Saying "2 seconds" as though that makes it insignificant is completely missing the point. 0.2 seconds, if it's 0.2 more than some other path is the same as a total block. Having a link to something do anything at all other than instantly provide that thing is outrageous and unacceptable, if you care about the experience you want to present to your users or audience.

(Still, I'd say codeberg was at least among the best options if you want someone else to host it for you. The bad job of providing a bad experience for legit users while trying to block AI scrapers can be true at the same time as no one else is doing any better without some other worse strings attached like github.)


Seeing the Anubis weeb interstitial is super annoying.


Agreed. I installed the NoPow add-on and that worked (in Firefox).


Sounds like a feature. I didn't think Codeberg would have the balls to do something like it. I think I'm sold.


codeberg's one job gets interfered with by freeloaders hammering expensive views (like git blame) inconsiderately.


You’re so right. I have a public-facing Forgejo server. Before configuring Anubis, scrapers were sending it about 600K requests per day. Copying and pasting from my blog post about it:

* For every Git commit, fetch the version of every file in the repository at that commit.

* See git blame for every file at every commit.

* Attempt to download the archive of each repo at every commit.

* Run every possible pull request search filter combination.

* Run every possible issue search filter combination.

* Fetch each of those URLs at random from some residential IP in Brazil that had not ever accessed my server before.

Afterward, it dropped to several hundred. Expect anti-attack features to keep getting stranger and more visible as scraper get still more aggressive.


This matches my experience of running a public mediawiki server. The bots (mostly Facebook/Meta) will for every single change fetch every single page again, over and over.

I can’t tell if it’s incompetence or malice.


What do you use to monitor this? I don't really keep a close enough eye on my services to know what the traffic is doing (and haven't had any issues) but maybe I should start


I just tailed the web logs for a bit and saw that it was wild. For fun, I fed 10 minutes of logs into an AI and it picked up a lot of signal I didn't catch at first glance, like clients claiming to be MSIE 7 on Android 3 and such. I added some reject rules to the webserver in front of Forgejo but that only made a dent in the traffic, alas.


That's crazy. So 600,000 someones are absolutely starved for data.

Or one someone with too much money and too little sense misplaced a decimal point in their ScraPy setup?


I think it was the latter.

And the cruel irony is that these are FOSS Git repos I'm publicly sharing. I'd've been fine with them cloning the repo and analyzing away to their heart's content. That's not the way their scraper's wired, though.


Couldn't they just rate limit them? Are they literally using a new IP for every request?


There are indeed scrapers which use tens of thousands of distinct IPs, and so rate limiting them isn't a solution.


We used to call this snow shoeing.


In my experience, yes. At the peak of a scraper flood I was dealing with, I'd say about 90% of the traffic was from a unique IP. I'd never seen anything quite like that before.


That's the reason I left as well. I complained, was told I need to drop the attitude, or leave.

so I left.

must be harder than I think running a src forge


Today it appears you have two options 1) Anubis or similar 2) Accept that 90-95% of your traffic is LLM scrapers fetching every file for every commit for every repo etc etc. There's some comments above with specific lists.


I built bot detection into the web framework I wrote. It's blocking well over >90% of the abuse.

The secret 3rd option is write some code.


Glm5.1 is fantastic for me. But that could be how I use it, I don't ask it to build entire apps or entire features, instead asking it to build piecemeal functionality. For that it compares very well to chatgpt 5.4 (I haven't extensively tried 5.5, it might be better, might be same). I have given deepseekv4 pro a try but not much more than a try, as it performed subpar on 4 tasks in a row (missing the obvious/intended path, generating subpar slightly buggy code to make things work the not obvious way) , I gave up on it.

Glm5.1 for me was a bit of a llama3.1 moment (first open model i could chat with that was usable in manging my inputs the intended way) for code, the first open model that was actually usable.


I've never asked LLMs to build a whole app without detailed directions. I've done giving it a general data flow, structs and methods..etc

Are frontier models capable of building something only with general directions now?


Since about Jan of this year, yes


Of course the devil is in the details. What you say and the skills needed make sense. It's unfortunately also the easiest aspects to dismiss either under pressure as there is often little immediate payoff, or because it's simply the hard part.

My experience with llms in general is that sadly, they're mostly good bullshitters. (current google search is the epitome of worthlessness, the AI summary so hard tries to make things balanced, that it just dreams up and exaggerates pros en cons for most queries). In a same way platforms like perplexity are worthless, they seem utterly unable to assign the proper value to sources they gather.

Of course that doesn't stop me from using llms where they're useful; it's nice to be able to give the architecture for a solution and let the llm fill the gaps than to code the entire thing by hand. And code-completion in general is a beautiful thing (sadly not a thing where much focus is on these days, most is on getting the llm create complete solutions while i would be delighted by even better code completion)

Still all in all, the more i see llms used (or the more i see (what i assume) well willing people copy/paste llm generated responses in favor of handwritten responses) on so much of the internet, resulting in a huge decline of factualness and reproducibility (in he sense, that original sources get obscured), but an increase of nice full sntences and proper grammar, the more i'm inclined to belief that in the foreseeable future llm's aren't a net positive.

(in a way it's also a perfect storm, the last decade education unprioritised teaching skills that would matter especially for dealing with AI and started to educate for use of tools instead of educate general principles. The product of education became labourers for a specific job instead of higher abstract level reasoning in a general area of expertise)


Google's "AI overviews" are one of the worst LLM-powered features on the market today, they're genuinely damaging the reputation of the whole industry.

Meanwhile I've started using ChatGPT GPT-5 search as my default search engine! A year ago I would have laugher at the idea: https://simonwillison.net/2025/Sep/6/research-goblin/

And Google themselves have an "AI mode" which is a different league of quality from "AI overviews", I wrote about that one here: https://simonwillison.net/2025/Sep/7/ai-mode/

This is new. AI search tools almost universally sucked until OpenAI's release of o3 in April this year.


It might actually be in Googles best interest to damage the interest in LLMS by showing those crappy AI Mode stuff, because it materially impacts their business model.

The perception of LLMs in the gen pop is what matters, not in the eyes of techies.


This is what finetuning has been all about since stable diffusion 1.5 and especially SDXL. And even something StabilityAI base models excelled at in the open weights category. (Midjourney has always been the champion, but proprietary)

Sadly with SAI going effectively bankrupt things changed, their rushed 3.0 model was broken beyond repair and the later 3.5 just unfinished or something (the api version is remarkably better), gens full of errors and artifacts even though the good ones looked great. It turned out hard to finetune as well.

In the mean time flux got released, but that model can be fried (as in one concept trained in) but not finetuned (this krea flux is not based on the open weights flux). Add to that that as models got bigger training/finetuning now costs an arm and a leg, so here we are, a year after flux got released a good finetune is celebrated as the next new thing :)


Agreed. From the article:

> Model builders have been mostly focused on correctness, not aesthetics. Researchers have been overly focused on the extra fingers problem.

While that might be true for the foundational models - the author seems to be neglecting the tens of thousands of custom LoRAs to customize the look of an image.

> Users fight the “AI Look” with heavy prompting and even fine-tuning

IMHO it is significantly easier to fix an aesthetic issue than an adherence issue. You can take a poor quality image, use ESRGAN upscalers, img2img using it as a ControlNet, run it through a different model, add LoRAs, etc.

I have done some nominal tests with Krea but mostly around adherence. I'd be curious to know if they've reduced the omnipresent bokeh / shallow depth of field given that it is Flux based.


> Model builders have been mostly focused on correctness, not aesthetics. Researchers have been overly focused on the extra fingers problem.

> While that might be true for the foundational models

Its possibly true [0] of the models from the big public general AI vendors (OpenAI, Google), its defintely not true of MJ (which, if it has an aesthetic bias to what the article describes as “the AI look” it is largely because that was a popular actively sought and prompted for look in early AI image gen to avoid the flatness bias of early models and MJ leaned very hard into biasing toward what was popular aesthetically in that and other areas as it developed. Heck, lots of SD finetunes actively sought to reproduce MJ aesthetics for a while.)

[0] but I doubt it, and I think they have also been actively targeting aesthetics as well as correctness, and the post even hints at at least part of how that reinforced the “AI look” — the focus on aesthetics meant more reliance on the LAION Aesthetics dataset to tune the models understanding of what looked good, transferring the biases of that dataset into models that were trying to focus on aesthetics.


Definitely. It's been a while since I used midjourney, but I imagine that style (and sheer speed) are probably the last remaining use cases of MJ today.


It is not just a fine-tune.


Interesting notion, I notice the same with image models, less stylistic more blandness on the latest generation. Only MJ seems to have style as a feature.


I tried it with rust, it's so bad it's simply not usable, it hallucinates methods and even the syntax is wrong at some points (it especially can't get error types correct or seems). Gpt4 doesn't handle rust perfect either, but the code it produces is good enough to only need some touch-ups, it can explain and fix wrong use of (we all known) libraries and even gets async code. But it's especially great for boilerplate, saves so must typing.

I was hoping openai/gpt4 would see some healthy competition, but Gemini doesn't seem to be it. Of course, the rust language might be an edge case.


I'm more and more thinking a government issued digital identity (like https://privacybydesign.foundation/irma-en/) that can be used to proof you're human (and other details of you want) but that can't be tracked back to an individual, but again optionally, can be used to create (multiple) online persona's is the way forward. I used to think of these things as dystopian, but fake content by fake persons is a bigger issue. Of course real persons could create persona's for such a bot, but a (personal and/or community based) blacklist mechanism based on the root account (the real human that created the persona) would go a long way.


No worries, you're not alone. I can see it has decent (not great imho) production values, but it's not for me. It's slow and uninteresting, I'm level 2/3 and facing unbeatable level 5 enemies (a hag in a swamp, some tiny island after a swamp or some underground minotaurs). I know I should find entertainment in doing other things in the game, but I'm 10 hours in already, and progress is agonizingly slow. All I got is that I've bug in my eye I want to get out of it, somehow all my companions have it as well, and there's a refugee camp that's being evicted by more druids. I have no idea what the overarching story is, I just go from little set piece to new little set piece (which feel rather artificial), but it's not very interesting and my characters feel as weak as when I started the game. I have fond memories of bg1 and bg2, played them into early morning cause I wanted to know what was next. But now, I just don't care, I just feel lost and like making no progress at all.

That there seemingly is no great story shouldn't be that much an issue to me, it doesn't always matter to me, but with the battles not being engaging, character progress nonexistent, exploring not being exciting nor rewarding, there's just nothing that makes me want to come back. Now i do have a great dislike for open-world games, and it seems bg3 just has all the elements that makes me dislike it, too much make your own adventure. I don't recall the earlier baldurs gate games being this way.


I was getting stuck on some of these things too. Ended up having to explore more of the map to find stuff that was more manageable as well as checking YouTube for some tips on how to play.

Sure maybe they could have included a little more education on how stuff works in game, but it’s not too bad.

What has me most entertained about the game is that your choices and dialogue options have real impacts on your path through the game. Unlike most games that feel like they are on rails.


There's quite a few hosted SDXL platforms (mage.space, leonardo.ai, novel.ai, tensor.art, invoke.ai to name a few) and most consumers do not have the GPUs needed to run those models, only enthusiasts do.

It's always baffled me that stability didn't offer a competitive UI platform to use their models with, clipdrop is just bad quality and very bare-bones, and dreamstudio is pricey and still lacks most features. So this move to a new licensing strategy doesn't surprise me, it actually is somewhat comforting, as i expecting them to just stop releasing further trained models (e.g sdxl1.1 and up), and only offer those on their services (of course, that can still happen) cause how else were they going to monetize the consumers (i know they (planned to) offer custom trained/finetuned models to big corps, but that doesn't monetize consumers).

However, as most releases by stability these days, it has this feeling of close-but-no-cigar, and the recent LCM lora's might be a little slower, but these actually offer 1024^2 resolution, work with any existing lora's and finetunes (so they are usable for iterative development, unlike this turbo model, cause well, it's a different model, can't iterate on it then expect sdxl (with lora's, to a lesser extend also without) to generate a similar image) and support cfg-scale (and therefor negative prompts / prompt weighting). I suppose there's some niche market where you need all the speed you can get, but unless there's a giant leap in (temporal) consistency, that will remain niche, i don't see the mentioned real-time 3d "skinning" neither the video img-to-img (frame-to-frame) gimmicks take off with current quality and lack of flexibility. It's good research, optimizations have lots of value, but it needs quality as well.

Their recent video model is quite bad as well, especially compared to pika and runway gen-2, but well, but as with the the dalle-3 comparison one can say those are closed source and stability's offering is open.

Then we have the 3d model, close sourced, worse than luma's genie unfortunately.

The music model is nothing like suno's chirp (which might be multiple models, bark and a music model) used together), and the less said about their llm offerings the better.

Bottom line, stability needs a killer model again, they started strong with stable diffusion 1.5, took a wrong turn with 2.0 (kind of recovered by 2.1, but the damage was done), and while SDXL is't bad in a vacuum, neither was it the leap ahead that put it in front of competition like midjourney at the time, and Dalle-3 a little later, and now even a relatively small model like pixart-alpha, also opensource, can offer similar quality to what sdxl offers (with a lot of caveats, as it has been trained on so few images it just doesn't have info on many concepts). And more worrying, there's no hint of something better in the stability's pipeline. But maybe image-gen is as best as stability can get it, and they think they can make an impact pivoting in another direction or multiple directiobs, but currently, it feels a master-of-none situation.


Well, this just goes to show not all elderly are the same. My relatives would love more remotes and hate more strange non physical interfaces. Controlling lights with voice commands vs a (eventually on a remote) button, button wins 100% of the time.

The biggest hurdle seems to be discoverability. A physical remote makes sense, and doesn't change. Buttons have a singular function and context doesn't matter. Apps are different beasts, navigate up/down/forward/backward (thus context (what did you do before, now doing x does y, but otherwise z)) is just met with glazy eyes. Going back and front just makes no sense, why sometimes you need to go to a menu and other times it's a shortcut button, makes no sense, especially when summoning the menu needs special navigation. To add insult to injury, every now and then apps get an overhaul, and suddenly navigation and buttons changed/looked different.

Now when i say apps, i do mean apps on phones/tvs. The windows UI works for them because the basics are the same for all programs, using word or outlook, menu items have text like "send" "save" and while it takes time, functionality is discoverable. But for tv apps the logic is "click up or down until the icon you want has a different hue, then press a button on the remote to do stuff, but only when the screen shows x,not when it shows z". It's too much functionality condensed in too little UI. I'm constantly baffled by design choices for apps that are supposed to be used by everyone, I'm sure it looks nice to designers and devs, but have they even tried showing their brand new TV interface (these are the worst offenders) to an elderly and gave them simple tasks?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: