You just solve it as per the blog post, because it’s trivial to solve, as your browser is literally doing so in a slow language on a potentially slow CPU. It’s only solving 5 digits of the hash by default.
If a phone running JavaScript in the browser has to be able to solve it you can’t just crank up the complexity. Real humans will only wait tens of seconds, if that, before giving up.
It will obviously depend heavily on the type of bot crawling, but that is not hard coordination for harvesting data for LLM’s, as they will already have strategies to prevent nodes all crawling the same thing - a simple valkey cache can store a solved JWT.
The author demonstrated that the challenge can be solved in 17ms however, and that is only necessary once every 7 days per site. They need less than a second of compute time, per site, to be able to send unlimited requests 365 days a year.
The deterrent might work temporarily until the challenge pattern is recognised, but there’s no actual protection here, just obscurity. The downside is real however for the user on an old phone that must wait 30 seconds, or like the blogger, a user of a text browser not running JavaScript. The very need to support an old phone is what defeats this approach based on compute power, as it’s always a trivial amount for the data center.
You might consider something like the friendly elec CM3588 for a DIY option with openmediavault or freenas. I have a big old box currently with spinning metal, but am looking at this as an option now that there are some larger m.2 drives available.
OpenWRT has a package called mwan3 that in tandem with dnsmasq can allow you set the IP addresses associated with a DNS entry to a particular VPN/country.
Finding a unicorn country where everything works and all traffic is routed is getting increasingly difficult. For example, if a US news site didn’t want to implement GDPR, it geolocates all users outside the US and blocks them, whilst other US services start to require ID/age verification to post content for non-US users so accessing both easily requires switching location.
I suspect we will see more services and technology to be able to deal with this complex cat and mouse game of destinations (websites/services) and origin counties. You can typically get by with a few rules/countries today, but I think that is getting harder.
CDN’s may pose a problem if the DNS resolves to a shared IP address, so IPv6 can help, but many VPN’s do not support it. For some services we may just have to accept there is no easy way to use them unless tools improve (e.g. the browser/application auto-selecting from multiple interfaces)
Banks also charge for cash services, many business accounts may just include it in the price, but someone has to physically count, collate and move around the cash, often with security. There are costs for running a computer system, and costs for using cash that businesses have always paid. Some small businesses definitely do not understand that, but cashless can be cheaper and safer depending on your country and quality of banking services.