LLM bots are the easiest to spot. Rate limit them to 16kb/s and 1 request every 5 seconds. Give them a friendly multilingual WCAG status 429 page that says to slow down or status 444 and drop them into nftables ipsets if they continue to be aggressive. Ask your favorite LLM how to set this up. If your LLM gets session paused, ask Gemini or Grok. Tell it if you are behind a CDN. Enable logging of ssl curves, ciphers, etc... Show your LLM some examples from your access logs.
show comments
blakesterz
What I still don't understand is who is doing it? I assume it's not the big companies like OpenAI or Google or Anthropic, right? So there are a bunch of small things out there doing the scraping and then they sell it to the big places? Or are these just smaller AI models doing the scraping and using it for themselves? Is there an underground ecosystem where people buy and sell this stuff? I understand why it's valuable to the AI companies I'm curious about how all this work, the economics of it all.
show comments
jdw64
These days, AI attacks are indiscriminately targeting personal websites, and they've become far too severe. They even come in disguised through referrer spam[1], so they're tricky to block. In my opinion, I suspect such scraped data is being used to classify and train AI models.
It's a canonical DOI on what was a download server. It says exactly which file is being requested. (I chose a random recent one.) At the very most, they should serve a static page with a bibtex entry, and a few other metadata fields, and a link to the PDF and whatever other formats are available.
Instead, we get piles of captchas, login-gate spam about how they're "open access" now and have some initiative to be LLM friendly.
Getting back to the problem of people doing stuff that requires access to library materials: What sort of server-side cost multiplier do you suppose this ACM page has vs. just serving a few S3-compatible URLs that point to a few mirrors? (Or, got forbid, Anna's Archive / libgen, since ACM is open access, and those sites would be doing nothing wrong by mirroring ACM content.)
show comments
pfdietz
So these bots are going to get the Aaron Swartz treatment, right?
RIGHT?
benjismith
Get with the times, university libraries.
"Open Access" means supporting users. Now your users are also bots, and the people that deploy those bots. You need to be able to serve those users too.
tacocataco
I wonder if Internet 2: The sequel is infested as well.
In what world is 11k searches a lot? The story here is that AI bots are exposing University Libraries bad setups. I haven't heard any institution here in northern europe having any trouble.
LLM bots are the easiest to spot. Rate limit them to 16kb/s and 1 request every 5 seconds. Give them a friendly multilingual WCAG status 429 page that says to slow down or status 444 and drop them into nftables ipsets if they continue to be aggressive. Ask your favorite LLM how to set this up. If your LLM gets session paused, ask Gemini or Grok. Tell it if you are behind a CDN. Enable logging of ssl curves, ciphers, etc... Show your LLM some examples from your access logs.
What I still don't understand is who is doing it? I assume it's not the big companies like OpenAI or Google or Anthropic, right? So there are a bunch of small things out there doing the scraping and then they sell it to the big places? Or are these just smaller AI models doing the scraping and using it for themselves? Is there an underground ecosystem where people buy and sell this stuff? I understand why it's valuable to the AI companies I'm curious about how all this work, the economics of it all.
These days, AI attacks are indiscriminately targeting personal websites, and they've become far too severe. They even come in disguised through referrer spam[1], so they're tricky to block. In my opinion, I suspect such scraped data is being used to classify and train AI models.
[1]https://www.makonea.com/en-US/casual/scraping-bots-are-destr...
11 THOUSAND searches in one day? What's the problem?
If anything, libraries should be becoming more AI friendly, not less. Instead, we get this sort of bullshit from the ACM:
https://dl.acm.org/doi/10.1145/3832783.3834511
It's a canonical DOI on what was a download server. It says exactly which file is being requested. (I chose a random recent one.) At the very most, they should serve a static page with a bibtex entry, and a few other metadata fields, and a link to the PDF and whatever other formats are available.
Instead, we get piles of captchas, login-gate spam about how they're "open access" now and have some initiative to be LLM friendly.
Getting back to the problem of people doing stuff that requires access to library materials: What sort of server-side cost multiplier do you suppose this ACM page has vs. just serving a few S3-compatible URLs that point to a few mirrors? (Or, got forbid, Anna's Archive / libgen, since ACM is open access, and those sites would be doing nothing wrong by mirroring ACM content.)
So these bots are going to get the Aaron Swartz treatment, right?
RIGHT?
Get with the times, university libraries.
"Open Access" means supporting users. Now your users are also bots, and the people that deploy those bots. You need to be able to serve those users too.
I wonder if Internet 2: The sequel is infested as well.
https://en.wikipedia.org/wiki/Internet2
In what world is 11k searches a lot? The story here is that AI bots are exposing University Libraries bad setups. I haven't heard any institution here in northern europe having any trouble.