Show HN: Fortress – a stealth Chromium so your agents stop getting blocked

https://github.com/tiliondev/fortress

by arhamshahrier • 15 days ago

43 50 15 days ago

github.com

newaccountman22• 15 days ago

odd name; shouldn't it be named after something that stealthily infiltrates fortresses?

LoganDark3• 15 days ago

Trojan Horse probably wouldn't make a very good name for a browser.

ButlerianJihad2• 15 days ago

Since my grade-school mascot/team was "The Trojans" and my adopted hometown is firmly rooted in pre-Christian Greek culture and mythology, I am currently studying the Trojan War, and I may observe that "Trojan" is an extremely perspicacious brand-name for condoms, more than the average guy would expect.

ArmanLuthra• 15 days ago

fellow contributor on this.

we thought of it the other way round: your automation is the fortress, and every bot-detector trying to fingerprint it is the siege.

also most good burglar names were taken on PyPI

arhamshahrier• 15 days ago

in my defence, i did lobby hard for "GuyWhoWavesYouThroughTheGate"

BLKNSLVR2• 15 days ago

Algae

TrevorFSmith• 15 days ago

Is it ethical to scrape when a site has explicitly blocked bots? I know a fair number of people who run small sites who are already considering closing them down because the bots are relentlessly hammering their sites and driving up hosting costs.

LoganDark3• 15 days ago

It's most definitely unethical.

cr125rider• 15 days ago

I think it really depends on how the bot is run. If the bot is replacing me navigating there manually, absolutely. If it’s sucking up content to rip off and make someone else billions of dollars, no.

fooqux• 15 days ago

Why do you feel entitled to navigate to a website you neither own nor pay for via a method the owner expressly forbids?

est• 15 days ago

Is it ethical to scrape when a site has explicitly blocked bots

Ethical? ppl get jailed in China for this. "Breaching computer systems" is a felony.

yogorenapan• 15 days ago

I know for a fact companies in China do this. One paid me directly for work in this space, and in another, I found my own OSS project in their artifact cache while working there.

I've only ever gotten in trouble in the UK

lemagedurage• 15 days ago

Use cases range from sending 100s of requests per second just to bring a website down to doing a montly request to a municipality's endpoint to get a local dashboard of when trash is picked up. I don't think you can pass a single judgement of automating web requests in general.

maxglute• 15 days ago

I suppose it's like trying to enforce no picture rule in public.

xena• 15 days ago

Things like this make me wish that we have to pass ethics courses to work in tech.

m12k• 15 days ago

Reminds me of this old joke: No ethically trained software engineer would ever write a destroyBaghdad function - they’d write a destroyCity function to which you could pass Baghdad as a parameter.

csnover• 15 days ago

Man, this sucks. I doubt there’s anything that I can say to get people to stop doing things like this, but the eventual outcome here isn’t going to be freedom for you to scrape sites that are trying to avoid being DDoSed by bots, but instead that we all end up in a world where device attestation is required to do practically anything online. And for what?

xnx• 15 days ago

Bot detectors flag automation by reading the browser fingerprint; Fortress corrects that fingerprint inside Chromium's C++, so the browser presents as an ordinary Chrome install.

This does not seem like it would work against anything but the most basic bot protection.

dclaw2• 15 days ago

This is really unacceptable folks. There are those of us that have to keep these sites up, and it's seriously been a few years of nightmare scrapers and botnets, and stupid things like this that you are trying to legitimize that will make this worse. If a site doesn't want you, you should go away. There's a reason for it. Not every website is backed by a billion/trillion dollar company with the resources to absorb things.

deckar012• 15 days ago

Making a network request from a script is not abuse, consuming excess bandwidth is. Scrapers already spoof browser reputation and cycle IPs while abusing bandwidth. Recently I wanted to convert the results of an Autotrader filter into a table so I could supplement it with data they don’t track (towing capacity). It was two pages of results, but requesting it from a script was aggressively blocked by browser fingerprinting. I had to port it to JS and run it in my browser console manually to get the data out, wasting my time.

transcriptase• 15 days ago

That’s the point. For every legitimate though ultimately unimportant use case like yours there are a thousand others who would scrape the results 86,400 times a day to either try to sell or mirror and plaster with their own ads.

dclaw2• 15 days ago

It's not just excess bandwidth. It's cpu cycles, poor site coding, database issues. Like I said, not everything is backed by a huge company that has the money/hardware/engineering resources to absorb the load.

tadfisher2• 15 days ago

Why did you need it from a script? Right click -> Save Page As... is still a thing and works quite well in my experience, even with complex React SPAs.

coldbrewed2• 15 days ago

CDN security SWE here. I have functionally zero interest in what individual people do in terms of automation. I automated my gym's class signup forum during COVID so I get the validity of the use case. You want to work around the mitigations to do the same? Go with my blessings.

The killer is that everything that works for individuals trying to get through the day and make the web a bit smoother is immediately used by industrial crawlers strip mining the Internet, and you can't block one without blocking the other. A future where the web is only accessible via device attestation is extremely dystopian but so is an Internet where every drop of content goes into an LLM training set.

Things like this is why all of the worthwhile content is going to drain into balkanized spaces, and we're all the poorer for it.

codedokode• 15 days ago

Sites that are backed by a billion dollar company typically have better antibot protection, and lot of expertise in this.

Also, patched browsers have existed since long ago, although they were not open-source.

arendtio• 15 days ago

And those bot protection mechanisms and ad-enforcement layers that terrorize humans are okay or what? Yes, I accept that many pages don't want me there and just don't use them anymore, but it sucks.

I am not saying that forks like this are a good idea, but I have enough frustration with said techniques that I sympathize with the effort.

CivBase• 15 days ago

Unconscionable.

BLKNSLVR2• 15 days ago

Does Anubis still work? (against this?)

RandomGerm4n• 15 days ago

I think that instead of trying to prevent web scraping, websites should try to make it easier so that it generates less traffic. As long as any user is allowed to view the website, there will always be a way to scrape it anyway. If there were simply a monthly updated torrent available on a standardized subpage, such as example.com/scrape, scraping would be much less harmful.

Avery29• 15 days ago

For agent/browser automation, getting blocked is only one part of the problem. The other hard part is knowing whether the page you got back is the real page, a degraded version, or some silent challenge page.

il-b• 15 days ago

The authors are proud of facilitating the theft of intellectual property. Disgusting.

phoghed• 15 days ago

Did you rage equally against the machine when wget --mirror came out?

zombot• 15 days ago

Is it possible to give negative stars to a GitHub repo? This one would be a prime candidate for that feature.

Show HN: Fortress – a stealth Chromium so your agents stop getting blocked

Related Stories