Re: Anubis check stuck?

On 2026-08-17 09:58, Jonathan Wakely via Gcc wrote:
> On Sun, 16 Aug 2026, 23:12 Mark Wielaard, <[email protected]> wrote:
> 
>> Hi Jonathan,
>>
>> On Fri, Aug 14, 2026 at 09:29:43PM +0100, Jonathan Wakely wrote:
>>> On Thu, 6 Aug 2026, 20:13 Mark Wielaard, <[email protected]> wrote:
>>>> I assume you are seeing this with gitweb because it is making too many
>>>> requests. Have you tried cgit? https://sourceware.org/cgit/ That
>>>> should be more efficient and hopefully doesn't get you rate limited
>>>> that quickly.
>>>
>>> I've been unable to access any cgit links for at least a week, I get the
>>> 429 error every single time.
>>
>> That is not good. There are regular attacks now, but there should be
>> some time to get through. The issue is that we are now regularly see
>> scrapers that do 1K+ hits/sec all from different ip addresses. Often
>> these addresses do only one hit ever. This makes rate-limiting (what
>> the 429 from the nginx frontend is) a bit challenging. What Frank came
>> up with was an allow list of ips that are never rate-limited. If you
>> logged in from an ip into bugzilla, or through a git clone over ssh,
>> or just doing an ssh gcc.gnu.org alive in the last 90 days it would
>> authenticate the ip address (there is a small delay, the list is only
>> updated once an hour) and you should go right through.
> 
> 
> I can't login to bugzilla, because I get the nginx 429 error.
> 
> 
> We should add
>> authentication through patchwork and wiki. And add some way to
>> manually authenticate an ip address. If nothing works please email
>> admin-requests@ to get yours added.
>>
> 
> I forgot to say that the problems I was having were on my mobile phone,
> because I was in holiday until yesterday. I don't have a fixed IP on my
> phone (especially not when using data roaming abroad). I couldn't ssh to
> the server, because I was just trying to browse web pages on my phone (and
> didn't have any ssh keys with me on holiday).
> 
> Now that I'm back home it works fine from my usual static IP.
> 

I have sort of the same issue.
On my computer at work, we are using a proxy solution that prevents me from
knowing what endpoint IP that is going to be used. As a result, I think
I end up coming for different IPs for most of my accesses and either hit
the Anubis check and/or the 429 error.
After a few refreshes, I usually get access, but it gets really frustrating
when you try to post comments on bugzilla etc. Keep in mind that this when
I am logged in!
As the 429 error is suppose to lower the amount of traffic to the services,
it's somewhat counterproductive when users will have to send, not 1
request, but maybe 10-20 to get the resource they seek. Maybe this is
still a gain overall, but, to me, it feels like we are heading on the
wrong path if we want to help our users.

In a parallel thread, it was mentioned that devs could use VPN to by-pass
the restriction. While this might work for a home computer, I doubt that
most big corporations will allow you to add a VPN that they do not control.
For me, this is something I simply cannot do.

Just my 2 cents in the discussion.

Kind regards,
Torbjörn