I noticed you started another rewrite of Iocaine for version 4.x. May I ask about plans for version four compared to version three?

I wrote a bit about the plans over on my blog. The major changes in a nutshell are:

• Nam-Shub of Enki elevated to “default script” status
  • It also becomes a module library, and will be available in both Roto and Lua
• Roto upgraded from 0.9 to 0.13 (bringing a whole lot of nice language features, more performance, and less code I need to write)
• Half the dependencies axed.
• Plugins for Caddy, nginx, and Apache, embedding iocaine.
• Much, much, much better error reporting (see an example of an error here)
• Throttling & rate limiting

How well does Iocaine integrate with OpenRC? I don’t use SystemD much, as I tend to run Artix.

Pretty well, I think? There’s an OpenRC init script in the repo. I haven’t tested it myself, I currently use systemd on Linux, and NetBSD’s init system or dinit on NetBSD. The only systemd-specific thing in iocaine is that it notifies systemd when it finished starting up - and that’s going to go away in iocaine 4, because I’m cutting dependencies, and this tiny thing isn’t worth a dependency.

FWIW, while iocaine does generate copious amounts of garbage, it is never going to poison LLM training data: it’s trivial to filter iocaine-generated garbage out pre-training. The garbage is there for two reasons:

1. To serve the crawlers something.
2. To poison the crawling queue.

Not the models, the crawling queue. Place an identifiable substring into every generated URL, and you can catch any crawler that works off of a queue collected by cheaper crawlers.

It’s not really a poisoning tool - it originally started with that goal, but that goal has changed a loooong time ago -, it’s more bot detection & mitigation nowadays, the garbage is just one of the tools it achieves this goal with.

But while I’m here, I’d like to mention Alun Jones’ fakejpeg (or my rust port): a library that can help you generate structurally legit-ish JPEGs, files that most decoders will happily display, but with entirely random content. Generating them is very cheap. How effective it is in poisoning? I don’t know. But I find great delight in looking at the random noise.

It simply wouldn’t. To poison models that way, you need a huge amount of such subtly wrong code. Preparing intentionally bad code at sych scale is impractical.

It’s easier to show clear garbage. That won’t poison the model, but it gives them more work, and denies them access to good code, so they’ll train on slop.

They’re doing a good job of sabotaging themselves, they don’t need our help - not more than simply not serving the crawlers.

If it false positives you, I’d like to fix that (I am the author of iocaine that Codeberg uses). What browser are you on, and what’s its user-agent?

AFAIK, Codeberg does tell you atop the gibberish how to contact them in case if false positive, and they usually contact me if they can’t address it on their own.

Way back when, my Dad always told me to have at least three copies of everything, because one backup is no backup. So I have a 1TB Storage Box at Hetzner (€4/month, in a different datacenter than my VPSes) I push backups to with Restic. I also backup to a local machine (also with restic), and to my Dad’s NAS (you guessed, with restic), and to my old Debian server until I decommission it (also with restic).

All legs have different retention settings, based on how much space I have at a particular backup site.

Check their docs, mostly.

If all your services support binding to a unix socket, I’d bind them to /run/<servicename>.sock or similar, and set up a reverse proxy that hits /run/$servicename.sock when serving $servicename.devicename.lan. If the service can’t bind to a unix socket, you can probably socat it or similar, and keep using the generic reverse proxy. Then, all your router has to do is route port 80 to your Debian machine.

I’m running Tang on a VPS, outside of my homelab. Servers in my homelab set up networking and a dedicated WireGuard tunnel to the VPS from initrd, to be able to talk to Tang, to help unlock the filesystem. The WireGuard tunnel is only allowed from my home ISP’s ASN. So if anyone picks up all my equipment from my homelab and walks away with them, they will not be able to boot them up, unless they connect from my ISP’s ASN (good luck), or know the passphrase.

Additionally, some of my homelab computers that support TPM also have a TPM pin, so walking away with the disk only, and connecting from my ISP’s ASN would still not be enough. This is rather pointless, anyone who walks away with the disk only will likely take the entire computer instead. But it was fun setting it up.

In the not so distant future, I’ll update this setup to use Shamir Secret Sharing more, where I’ll have three pins: my VPS (via Wireguard), a small computer somewhere else in my apartment, and a third at a neighbour (+ TPM on supporting computers).

“As if openclaw and android had a baby”, and that’s a recommendation, not a warning? WTF.

I’m using a setup similar to what you had in mind: I have a small €4/month VPS as my front, with scrapers taken care of by iocaine (it both blocks them, and firewalls the worst off automatically). That’s over 90% of the HTTP(s) traffic never making it past the VPS, greatly reducing the traffic into my home network. My actual servers are behind a WireGuard tunnel.

It does not protect against a non-HTTP DDoS, but that wasn’t part of my threat model to begin with. My VPS provider (Hetzner) has DDoS protection even for €4/month servers - that doesn’t include the scraper DDoS, but includes other kinds - I have luckily not been a victim of any, so no idea whether it works reliably.

Against the scrapers, a VPS + bot defense + Wireguard works like a charm. Can recommend.

Depends on what kind of DDoS OP wants to defend against. Defending against an AI crawler DDoS is entirely possible with a tiny VPS. I’ve been doing that for the past ~1.5 years on a €4/month CX23 Hetzner VPS.

I wouldn’t contribute back, and would switch to (or write) an alternative ASAP.

There are cases where I have to use AI-tainted dependencies (though, none of the AI-tainted dependencies I currently use across my projects are fully vibe coded, they’re merely tainted), but if I have to patch one? That’s gonna be a fork or rewrite, and there’s no chance in hell I’m contributing back.

It can stop them nowadays, by firewalling some of the crawlers off. The reason it doesn’t stop them by default is because it serves them poisoned URLs, which it can later identify if the crawlers come back riding a headless Chrome. But once they do that, and hit a poisoned URL, there’s little reason to let them wander in an endless maze further: serve one request, and block the IP.

I’ve been running that on my own infra, and my daily number of requests went down from ~50+ million to… 2 million.

I wonder too, why they didn’t, because they’re happily crawling domains that never had anything but junk on them. To me, that suggests they have no idea they’re trapped. Not at crawling time at least.

Yes, it does have a cost. It has a far smaller cost than serving the real thing. It also allows me to firewall them off and stop serving them, even if they come at me with real browsers. That’s a very definitive win: I saved CPU time, I saved RAM, I saved network bandwidth, and I stopped them from accessing my stuff. How is that not a win?

The Daily Mail (vomit) alone publishes 1,500 articles a day. How many do you plan on publishing?

I have an automatically generated infinite maze. It produces roughly a million unique pages each day. It used to produce ~60 million pages / day, but a few months ago I decided to firewall some of the crawlers off instead of serving them garbage.

And I run niche sites. A site with more lucrative traffic than mine (eg, Codeberg, who uses the same software I do) likely generates a lot more garbage.

There was also a paper, commissioned by Anthropic, I believe, that concluded that only 250 malicious pages they fail to remove from the training set is enough to poison even the largest model. Now, I do not trust anything Anthropic says. But even if we’d need a billion pages to poison a model… I alone served that much in the past year.

Unless a significant portion of the internet does this, and we’re talking hundreds of millions of pages, the only cost here is to you.

Fun twist: no! There’s a very neat trick you can do when you serve the crawlers poison: you can hide an identifier in the URLs you serve them, and you can then identify that id when they come back riding on the back of remote controlled chromes. By serving them garbage, you can overload their queue with poisoned ones, which helps you block crawlers that you wouldn’t otherwise be able to block.

Generating and serving garbage is incredibly cheap (cheaper than serving a file from a filesystem on SSD, in most cases), and once you have requests landing on poisoned URLs, you can firewall them off for a day or so, and reduce your costs even more.

We may not be able to poison the models, but we can poison their crawling queues. I have a year’s worth of data to support that. They still haven’t caught on.

Scriptability has been a thing since 2.2.0, released on 2025-06-16, but the built-in script appeared in 3.0 (2025-11-14).

Around here. In the default configuration, it is using the built-in handler. The script can be replaced with something like Nam-Shub of Enki (used by pretty much everything I host, and by Codeberg too, for example).

I’m very late to the party, but: no, iocaine does not expect you to detect the bots. It used to, but it does its own detection for quite a while now (you can replace the detection mechanism, though).