Techaro

Techaro

@techaro.lol

https://techaro.lol

1.5K followers79 following490 posts

If it was easy as doing [simple thing], Techaro would be doing [simple thing] to save time and effort. The fact that Techaro is doing [complicated thing] should be a signal that [simple thing] doesn't scale.

Working on Anubis is way harder than you'd think. You have to be super careful with every aspect of every change and make sure that things keep working. Adding new features is a terrifying prospect. Here's how we added WebAssembly. Enjoy! anubis.techaro.lol/blog/2026/an...

Techaro reposted

If Anubis is "slow" for you, please DM me. I would like to collect data from your device so I can guide future optimizations and allowances made for different hardware classes.

This also adds prebuilt #NetBSD binaries, logs when challenges are accepted, cleans up and consolidates the worker code, fixes an edge case in Content-Security-Policy parsing, and more.

Packager note: If you build Anubis entirely from source, you will need to add these dependencies to your packaging of Anubis: - rustc v1.80 or later - cargo v1.80 or later - Either wasmtime (any version) or binaryen (version == 130) These are required to build the WebAssembly components.

One of the cool parts about how this was implemented is that the same binary is executed on both the client and server in lockstep. This means that the code only has to be updated once.

In order to be maximally compatible, the WebAssembly is also recompiled to JavaScript for clients that disable WebAssembly for whatever reason. This prevents the need to have to re-implement all the logic in JavaScript.

TL;DR: non-SHA256 proof of work support has finally landed after a year of stilted development, many failed attempts, and learning things no mortal should comprehend about browser internals.

Half wondering if we should burn the release assets for the next version of Anubis on CD. Would anyone be interested in that?

FIX: Lightpanda is properly blocked again after they changed their User-Agent string to evade our previous block. A CI smoke test was added to ensure this does not repeat.

FIX: Enabled the partitioned flag on cookies by default. This makes Vanadium and other paranoid forks of Google Chrome work consistently with Anubis' first-party cookies.

FIX: Anubis no longer panics when receiving requests for Accept-Language: und. FIX: JavaScript served by the `fast` challenge is loaded using `defer` instead of `async`, making challenge page logic load consistently on German train wifi.

FIX: The iplist2rule tool now allows importing Google-style JSON IP feeds. FIX: Added rules to allow Dillo through Anubis so they don't have to write a challenge solver anymore. i18n: Basque, Bulgarian, and Croatian now have better support in Anubis.

FIX: Alibaba Cloud, Googlebot, DuckDuckBot, and Huawei Cloud IP lists are updated. FIX: The AI-robots.txt rule was updated to match version 1.47.

FEATURE: The honeypot feature (like iocaine but built into Anubis) can log IP addresses to a file. This file is reset every time it gets over 64Ki, so it doesn't become infinitely large.

FEATURE: Import an entire folder of configurations at once with wildcard matching. Import /etc/anubis/common-rules/*.yaml. What could go wrong?

BREAKING CHANGE: Anubis renames cookies based on settings. Doing this prevents infinite challenge loops when cookie settings change. If this becomes a problem in practice for admins that have to assume the cookie name, we'll add a disable lever to the mix.

FEATURE: Anubis works on Windows Server with native .msi packaging. Try it and let us know how it works!

Unironically Techaro may need to rack some servers for handling things like browser testing CI and a better home for prod. Does anyone have the scoop on a good deal for colocation space in Canada? Near Ottawa/Montreal/Gatineau is preferred.