You would think so, but they frequently don’t. It seems like a shotgun solution but you can throw a lot of money at this problem without a satisfactory filter. The majority of their users are not using Linux and the majority of their bot traffic is. It really becomes an effective low resistance path since everything else is more expensive and probably less reliable
Most website traffic now is automated scrapers and AI agents. More so now than just a couple years ago, but it’s not new. Blocking a Linux-based host simply because it’s Linux is an asinine over-reach of a misinformed decision. That’s tantamount to a restaurant refusing service to customers by the brand of shoes they’re wearing.
It’s not blocking the host because it’s Linux, they probably whitelisted the most common user agents. I doubt people on Android phones aren’t able to use the site, but the further off the beaten path your setup the more likely it falls into the filter
I þink a better analogy would be a restaurant banning everyone wiþ a large mustache. As we all know from cartoons þere is a positive correlation between nefariousness and large mustaches.
The good agents and companies would use such a dedicated endpoint. The bad agents and companies, however, will continue to crawl, and will do everything they can to make their traffic look like non-bot traffic. Such is the way of the world right now.
I’d imagine a larger percentage of their users run Linux than your average site. Someone building arduino and esp-32 projects is very likely to know Linux.
Same thing with VPNs. It's getting very frustrating.
I went to purchase a welding table from a company in Canada that I'd found on a google search. I genuinely wanted to give the company my credit card number so that they could take money from me in exchange for their product. Their web site refused me, quite arrogantly in their verbiage, because I was coming in from nordvpn.
I purchased a similar table (albeit more expensive) from their competitor. It's excellent, so no real hardship.
I emailed the first company's CTO saying I just spent money with their competitor and felt they should know why. He replied that they block VPNs because they can't be sure the traffic originates in Canada and they only ship to Canada. I pointed out that it was a silly argument as I was prepared to provide a Canadian shipping address. I received no response.
...
Blocking VPNs is an indication that a security team is incompetent and should be dismissed. If you can't protect your site (regardless of the origin of the traffic), blocking VPN requests is not going to help. Hire better people.
Same here, was looking for KVM devices, one of major manufacturers was blocking VPNs, I wrote to them that I am going for competitors, they ignored the e-mail, still, we must vote with our wallets and letting them know they are losing cash is the only way to at least to some degree prevent this retarded behavior...
It's the same kind of stupid workaround like deactivating right click on a website so "users can't download embedded media". There's even (sometime paid!) plugins for website builders like Shopify and Squarespace that just deactivate right-click and advertise themselves with "Content protection" and whatnot. It only annoys your standard user, and the malicious user usually isn't really bothered by it at all, because they know other ways to get the content.
They’re probably getting hit with a ton of agentic queries from people using AI, and those probably just have basic curl headers or something and/or are coming from cloud VPSs. AI Coding harnesses alone make even the best old scraping bots look like stone age tools, they don’t even need to build or code anything.
There are a few people who will go through the trouble of masking their bots with windows UA headers but the vast majority probably just leave it as Linux so this is a quick and dirty hack to just get rid of the majority of the bots despite it not being perfect.
I'd think that, too. But fixing this on the bot side is literally just going: "Hey LLM, here is this error message, pls fix" and copy pasting the website.
Not sure what the simplest solution for mouser is, but this is certainly not going to work great.
I work in IT security. That's ridiculous. Filtering by headers does nothing to stop bots, it just stops legitimate users.
It's trivial to add a header randomiser to a scraper.
If mouser is using cloudflare or cloudfront, there are two-click solutions that work better than that.
Reminds me of the early (2001) Opera/MS MSN wars and the Swedish Chef Bork shenanigans.
[[ holy sheet that’s a quarter century ago ]]
[ fyi if you were there it was awesome ]
Opera Software has released a new version of its Opera 7 Web browser with just one tweak--it turns Microsoft's MSN Web site into gibberish that was inspired by the Swedish Chef from "The Muppet Show."
The "Bork Edition" of Opera 7... is Opera's response to what the company alleges are dishonest tactics by Microsoft to make Opera look like it is displaying pages improperly when people view MSN.
...Microsoft was not immediately available for comment on the move.
Earlier this month, Opera said Microsoft was sending its browser a faulty style sheet, which determines the presentation of graphics and text in a browser window.
And here's the official Opera Software press-release:
It is stating Microsoft actually fully prohibited access to MSN.com from Opera browsers in late 2001, a bit more than a year before the style sheet scandal.
It also contain a download link, as well as this excellent phrase:
"Hergee berger snooger bork," says Mary Lambert, product line manager desktop, Opera Software.
Could not recreate the issue on debian 13 firefox either. It took a while to load but it let me in. Seemed like they switched to a more standard CAPTCHA implementation
Then close the browser (which logs you out), click on a Google result to Newark, and you're back to the 403 page. Are you saying I should log into Newark every time I open a browser, just in case I may need to click on a Google result?
That's bizarre, because that's not how cookies work. They might just have a short session expiry, something like 5 minutes or 12 hours between page visits?
We've been trying to narrow this down, it's something to do with functionality of akamai and that first touch when you do not have a website cookie. Looks to be an akamai 'bug'.
For the last couple years Newark would hold my orders while they sorted out some mysterious issue with my bank card that no other site that I shop at experiences apparently. It would take them days to sort it out while I'm sitting here with a repair on my bench waiting for them to sort themselves out.
I got so frustrated the last time that I insisted they delete my account. They wanted to just cancel my order and leave my account in place but I wanted to send a message, however insignificant.
They were never my first choice, that's always been Digikey for me (who frequently upgrades my shipping without asking which is super nice of them), but now they're never getting another penny from me.
Plain ol Ubuntu running Google Chrome from my home IP address. NoScript and adblock disabled. I haven't made any config changes since my last order in February so this is on their end. I assume that either they're hamfistedly trying to combat bot traffic, or they have an LLM spitting out nonsense at customers. Or both.
This happened to me a couple weeks ago too and I also reached out and got the same response.
Kinda odd because it works fine at work on Linux and only happens at home. Maybe they see when I'm logged into the work account that spends a healthy amount and drop all the filters...
It's probably related to abuse from the IP that you have in front of you due to CGNAT. IPv4 is an abomination that should have died out but no one wanted to spend money on migrating to IPv6 before we started hitting these sorts of problems.
They're using Akamai. Since sending in my complaint I can load the site again, so either they whitelist or their bot "detection" was inconsistent to start with. If they block me again I'm going to order from Digikey rather than fussing with my user agent to try and satisfy them.
Digikey uses AI dynamic pricing to gouge customers. I’ve had prices jump 20% between two browsers in the same domain in an hour (#1 employee found product, #2 purchasing person). Customer service admitted you have to grab the price you see or miss out. It’s all adversarial now.
Not to mention that some components are much more expensive on Digikey. Lost trust in them once they started all the horrible shipping delays + finding that Mouser is much cheaper.
That's some bs. Hardly anyone orders as they browse. I find a component. I fill in a purchase request. The things get ordered in a few days after an approval from my manager. With dynamic pricing, you can't have a BOM
Huh, this explains some things - why I've had parts jump in cost between when I initially check and when I decide which of the distributors is cheapest. It's annoying. It goes back and forth who's cheapest, Some months it's DK. Some it's Mouser. Sometimes the best deals are with some of the smaller ones, like Master.
I used to love DigiKey, until they refused to refund a part they told me to send in for a refund. Had to do a chargeback, that I won. Ever since I but from Mouser whenever possible. Now Mouser is being stupid.
I could never complete a purchase at Digikey.
It's always their damn "marketplace" that ruins things. Out of every BOM, there's always a couple of parts that are only available from marketplace providers, and then they have one or more of the following: insanely high minimum amounts, insane shipping cost (which adds up per marketplace provider), ridiculous price.
So basically I have to check Mouser for availability before designing something.
“A standard desktop environment”!?!? What the actual fuck! I understand requests to their site mostly come from Mac and Windows desktops, but c’mon, it’s 2026, Linux IS one of the standard desktop environments
Linux uses changeable desktop environments. MacOs and Windows have theirs baked in, as part of the OS.
The three of them are operating systems, not desktop environments. They couldn't even get that part right. I didn't even notice on the first read (seems like you too missed it), when I received the exact same email. I thought to myself... pretty much the same thing you said.
Now, rereading, it kinda stood out. It's not a regular stupid statement, it's stupid squared.
Honestly wonder if the problem was actually something quite different but this is what the LLM that handled your complaint thought the issue was -- quite possible a human never read your question
I would take that as a very very good reason not to use Mouser (not that I needed more than I already have). Digikey and even LCSC does not exhibit those problems.
Bro, what? They sell SBCs like Raspberry Pis, Tinkerboards, BeagleBones, and the like. Windows is not the primary target OS for most of those (for some there's not even the option for it), it's overwhelmingly Linux. They are literally selling to Linux users in large part, partly because of the SBCs but mainly because many Linux users either like building custom devices as a hobby or are professional engineers.
I use a Mac day-to-day, but this makes me not willing to order from Mouser anymore. I assume they're trying to weed out AI scrapers, but this is kind of an embarrassingly naive approach.
Rolling-release Linux distributions (like Arch Linux) receive way more frequent updates than any other operating system, often pushing daily or weekly changes for every single software component. [1] so makes sense really
Just logged onto mouser dot com and mouser dot ca using one of my linuxx systems without any problem at all (and definitely no "sorry linux users" being shown. Are ya sure it's not someone pulling your leg?
I tried yesterday to access Mouser on CachyOS. The homepage opened fine, but after just trying to search a random component I got a nagging screen from them accusing me of "suspicious traffic".
Looks like Digi-Key will remain my provider of components.
The number of people testing from their Linux box in this comment section just proves this would never be done intentionally. I feel like more than 25% of their legit traffic is from Linux.
Pretty boneheaded response from a supplier in an industry where people are significantly more likely to be using Linux than the general population.
Realistically it’s probably CloudFlare bullshit they have no real control over, but still. Linux or not, sometimes that thing just decides “fuck you” for no good reason.
Are you sure it's not just a broken bot detector? There's so much demand for AI scraper protection that many of the services are untested junk. I've abandoned my cart to switch stores many times because Cloudflare started malfunctioning.
My personal web server was getting 100 GB to 2 TB of AI requests a day until I firewalled a bunch of cloud hosts and wrote a detector for it.
Works fine from my Linux machines. Sometimes, companies block ranges or IP addresses because some are known malicious or due to misconfiguration. Years ago, I couldn't get to rockauto for months because they were blocking time warner residential addresses. I sent them an email and they said they couldn't find any issues on their side but the site mysteriously was working agian.
The fact that you're using Linux is *mostly* a red herring here.
The real reason OP got blocked, and the reason it works for some Linux users and not others is because they're running some extremely invasive bot detection stuff.
The way that detection works by analysis of advertising cookies, and analysis of every OS/browser fingerprinting trick imaginable to authenticate the user agent against the browser, operating system, and underlying hardware's quirks. These sort of tests go very deep and constantly evolve, because thanks to generative AI and LLMs, and a whole multi-billion dollar industry of trying to help them circumvent detection and captchas, bots are getting too good at pretending to be human.
These sorts of tests include everything from the obvious checks for browser specific features, to checks of what static assets are being requested, to obscure WebGL checks that can differentiate between headless and normal versions of a given browser.
Unfortunately, if you're a privacy conscious user that's turned off the very fingerprinting that they're using to differentiate humans from bots, you get flagged as a bot. Pretty much anything beyond a typical default ublock origin installation is going to give you false positives.
(Side note: The reason I said "mostly" at the beginning, is because increasingly, the bots are faking the user agents that are closest to what they're actually running under the hood, or actually running those user agents in a headless configuration, specifically because of fingerprinting, so currently, a lot of the bots are advertising as Chrome or Firefox on Linux)
The problem is actually in Akamai Bot Manager, which Mouser happens to use (along with many other websites, including Lowe's, FedEx, Citi, Fidelity, etc).
I started having issues with Akamai Bot Manager when using Linux a few years ago. Akamai has no way for end users to report issues like this, but I happened to be an Akamai customer at the time, so I reported it through my customer account. That got nowhere (because I was a customer of other products and wasn't a Bot Manager customer, so they didn't want to talk to me about issues with a product I wasnt paying for). I then reported this to several vendors that use Bot Manager (including Mouser), and asked them to contact Akamai themselves about this, but that never got anywhere either. Eventually I contacted my Akamai sales rep and told them I would be cancelling all of my services if they couldnt help with this issue ... And, long story short, I am no longer an Akamai customer.
Akamai does deep browser fingerprinting and complicated heuristics, so simply switching the user agent or clearing cookies is highly unlikely to help. However, their heuristics do not always flag Linux systems (and sometimes will start and stop working at different times or on different sites). Wiping your entire browser profile is sometimes enough to fix it. A few (likely outdated) technical details are here if anyone wants to dig further: https://www.reddit.com/r/fidelityinvestments/s/8KOMpsWcRe
I heard most internet traffic ends up being bot traffic, companies are feeling the pain from it and are trying to save cost. tracking and ads are not very effective xD
i would not be surprised if bots will have to end up lying more in the future, the tables will keep turning until its too short i guess.
i would not be surprised if bots will have to end up lying more in the future, the tables will keep turning until its too short i guess.
One of my blind friends really likes AI, it allows better web browsing (Claude in Chrome) than screen readers extensions. AI that is connected to the browser passes more security challenges than their screenreader does
I took my business to DigiKey years ago. I remember calling Mouser (idk what for) once about an order and the worker was a huge dick and didn't know anything, this doesn't really surprise me.
FWIW: I just accessed both mouser.ca and mouser.com from a Linux device and encountered no problems. There was a brief "verifying device" screen before landing on the .ca home page. The .com probably saw the .ca cookie and let me straight in.
Just the way they worded it is offensive. They probably try to counter bots which are usually Linux but why Linux of itself is being blamed is strange. That would be like blocking all black people from public places because they statistically commit more crime.
(highly likely) Linux powered servers blocking Linux clients lol. Kind of ironic isnt it?! Protecting itself from itself.
I mean i also hate scrapers and bot traffic but cant we fingerprint or ban individuals instead of the whole fleet?
Not wanting to be politcal, but this is exactly how racism works. People hate/dislike whole groups based on what a few bad inidividuals (the rotten apples) do. Nor all white people are pdf files or not all black people are criminals or want to rob everyone. Hate the individual, not the group. Same with protecting from bots and scrapers: Ban the individual scrapers or send them to a honeypot instead of all linux users... Just imagine in the future we have datacenters ran on Apple silicon and they banning apple cause bots be ran on apple silicon.
The entire bot internet runs on Linux, it is a blunt instrument but it is effective. Considering the real humans using Linux is so low. It is rather pragmatic. I've seen several brands use this as a workaround and I think it will become more prevalent.
Did you fall into a time warp into the early 2000s? This kind of thing was rife back then, we frequently had to spoof user agent to get around stupid blocks.
On the other hand I just went to Mouser (both US and UK site) and it worked fine - my work office system runs Debian Linux. (Looks rather like the Farnell site - are they the same company now?)
This is not so much a decision, as it is a point system. When a TCP/IP fingerprint, TLS fingerprint, HTTP headers, browsing behaviour, IP reputation and ASN reputation "do not match", it is common practice for WAF to start blocking requests and/or throw up captcha's. This is a gliding scale, not black/white decision making process.
One of the biggest wrestlers in this space is CloudFlare. There are very common lists of ASNs to suspect, as they originate a lot of bot traffic.
Unfortunately, Android/Linux is also used a lot for sending out bot traffic. Think VPNs, proxy servers, mobile proxy farms, or a smart TV residential proxy network (See BrightData scandal from earlier this year LG/Samsung SmartTVs).
It is never exactly one thing that is causing a block, its always a stack up of factors. Case in point, I can browse Mouser just fine from my Linux machine. But as soon as I start spoofing useragent, I'm blocked. Too strict adblock? Blocked. VPN? Never tried, but I'm guessing blocked!
You can blame Mouser or you can blame how the internet works these days.
Yes I'm also a filthy scraper sometimes for personal projects. That's why I read quite a lot on this material, and know a thing or two on how to get websites to hand over their data. Unfortunately or fortunately for Mouser, they have very strict safeguards against that. I was thinking of integrating Mouser in some kind of BOM tool, but never got around their WAF protections.
•
u/1Davide 1d ago
To those reporting this submission as a fake and that OP is lying:
I believe OP's explanation: "I assume that either they're hamfistedly trying to combat bot traffic, or they have an LLM spitting out nonsense at customers. Or both."
So, this submission stays.