More Open Source Security episodes
Published 5 Jan 2026
Duration: 33:37
Anubis is a web application firewall that uses challenging puzzles to prevent bot abuse, but has encountered issues with unintended user blocking and balancing accessibility and security.
Josh chats with Xe Iaso, the creator of Anubis the web AI firewall. We discuss how Anubis is tackling bots and scrapers. The discussion around the scr...
Anubis is a web application firewall designed to prevent bot abuse by presenting users with computationally expensive challenges that are easy for humans to solve but difficult for bots due to their lack of JavaScript execution or time constraints. Originally developed as a personal project to secure a Git server from automated attacks, it has since been adopted by the United Nations and is under consideration by educational institutions. The system works by sending challenges to browsers, which return results to the server, effectively blocking scrapers and bots that fail to complete them. However, a bug related to odd-numbered CPU cores on certain devices inadvertently blocked legitimate users.
Anubis evaluates trustworthiness using a "request weight" system, a concept inspired by the ancient Egyptian idea of weighing souls. The tool faces the challenge of balancing effective bot deterrence with maintaining user accessibility. Its development has also prompted discussions around open source sustainability, potential monetization models, and the broader impact of automation on online abuse.
21 Sept 2026 The curl summer of Bliss with Daniel and Stefan
"Explored open-source security challenges, highlighting curl's 'Summer of Bliss' initiative to reduce maintainer burnout, the impact of AI-generated vulnerability reports, and the need for human expertise in security management, while advocating for sustainable practices in open-source development."
14 Sept 2026 CRA vulnerability reporting with Daniel Thompson
"Cyber Resilience Act imposes strict vulnerability reporting rules on manufacturers, raising concerns over inefficiency, ethical disclosures, and industry compliance challenges."
31 Aug 2026 Sovereign Tech Agency with Erik Moller
"Explores the Sovereign Tech Agency's efforts to sustain open-source software as critical infrastructure, emphasizing public investment, digital sovereignty, and strategic funding for projects like *curl* and AI security."
17 Aug 2026 Maintaining EOL Open Source with Commonhaus and HeroDevs
"Explores open-source maintenance challenges, solutions for solo maintainers, and the role of organizations like Common House and HeroDevs in sustaining projects through financial, legal, and administrative support, emphasizing governance, dependency management, and enterprise-community collaboration to ensure long-term sustainability."
10 Aug 2026 Cleanup, Speedup, Levelup open source at e18e
"E18e enhances JavaScript by reducing dependencies, optimizing tools, and improving security, as seen in its work with Storybook, while promoting cleaner code and community collaboration."