I haven't tried Firefox + AdBlocker in a while but I always had the idea that in a very Mechanical Turk way I had to earn my few cents worth income for the machine before I was allowed to have no ads and live outside of the Google Empire.
hCaptcha now runs on fifteen percent of the internet
331–340 of 380 posts
Re: hCaptcha now runs on fifteen percent of the internet
#332Earlier quoted context omitted.
Why can't they just allow automated user agents? I should be able to scrape websites if I want to. Why do user agents have to be browsers?
This doesn't mix well with the ad-based compensation model. Sadly, there still doesn't seem to be much in the way of micropayment infrastructure.
> there still doesn't seem to be much in the way of micropayment infrastructure.
Anti Money Laundering regulation killed it: KYC doesn't scale down to micropayment levels.
If you want to fix the web, you have to roll back the AML/KYC insanity. Until that happens, the web will stay broken, because paying with attention (ads) is magically exempt from the AML/KYC insanity, whereas paying with money or anything money-equivalent (fungible and transferable) is not.
Re: hCaptcha now runs on fifteen percent of the internet
#333Earlier quoted context omitted.
This doesn't mix well with the ad-based compensation model. Sadly, there still doesn't seem to be much in the way of micropayment infrastructure.
That's a feature if you ask me. The whole point of scraping websites is to get the data I want while discarding noise like interface chrome and advertising directly to the garbage. If they'd like me to pay for access, they should return HTTP 402 Payment Required instead of letting me download the page for free. Perhaps they could also rate limit the network connection to prevent denial of service. Why straight up blo…
> they should return HTTP 402 Payment Required
That's illegal.
They must first return HTTP 418 Know Your Customer Required.
Re: hCaptcha now runs on fifteen percent of the internet
#334Earlier quoted context omitted.
If it should have been destroyed what is the reason you think it hasn't been? People aren't adding captchas to websites for fun, it is clearly solving a problem for them. So what do you propose instead?
It's solving a problem for THEM at OUR (the users') expense. We should fight this more heavily just like we do ads and tracking and hopefully this practice will at least stop expanding. The amount of sites now showing captchas is crazy. Or introduce a law where they have to pay us for using up our 'brain time'.
A law that they have to pay you for using their free service?
Re: hCaptcha now runs on fifteen percent of the internet
#335I see there's several "captcha solving services" (Google the term, I don't want to link any) that charge in the $1's per 1000 solves. This makes me wonder how effective captchas really are. Do they just raise the bar high enough so only spammers actually making money attack the more lucrative sites? Can anyone talk about their experience running a (large) service with a spam problem where adding a captcha helped? How…
A classic case where captcha is essential is ddos attacks. By sheer volume, they are not able to bypass captcha, as they can't solve captcha at million qps. Rate limiting doesn't work under ddos as ddos attack can overwhelm rate limiting itself and also there are still many proxies that simple ip base rate limiting will cause large collateral damage. Captcha is a very effective tool for ddos protection.
For spam/abuse, captcha is mainly about raising the cost of attack, not about eliminating completely, while still minimizing the collateral damage. Captcha is never meant to be a protection against any targeted narrow scoped attacks anyway.
If the attack is small enough that attackers can pay captcha solving service, it's not big enough to matter.
Captcha is here to stay. It is fundamentally a technical mean to deal with the tragedy of commons, and thus won't disappear anytime soon.
Re: hCaptcha now runs on fifteen percent of the internet
#336I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…
> it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time As much as I agree with your dislike of captchas, I don't think this is true at scale (unless universal online identities existed, which could and should include anonymous identifiers by design). When you need to accept information from anonymous users (comments, votes, forms, registrations), there's no way…
> unless universal online identities existed, which could and should include anonymous identifiers by design
Yes but no. Anonymized identifiers can be deanonymized. They should utilize zero-knowledge proofs in such a way that they can prove "yes, I have an identity verified by entity X (and Y and Z) (based on passport/phone number/...)", without disclosing any of those details.
It could, optionally, yield an identifier unique to each requester and unlinkable to others unless an explicit proof of the link is provided. Though if this is included, there has to be some mechanism to avoid huge ad networks sharing the same "requester entity".
This is a solved problem. All that's left is politics, implementation and alignment.
Re: hCaptcha now runs on fifteen percent of the internet
#337I dislike the widespread use of captcha regardless of provider. I realize anything connected to the internet will be subject to automated abuse, and it's impossible to run some types of services without taking some steps to defend against it, but it seems to me there's usually a way to handle that without invading the user's privacy or wasting their time. The exact details will vary based on the type of service, of c…
[deleted]
Re: hCaptcha now runs on fifteen percent of the internet
#338Earlier quoted context omitted.
I built an alternative[0] that takes a proof of work approach. As a site owner you set the difficulty that makes sense for you: so perhaps you would want 20 seconds of computation before you can submit. The nice thing is that this can happen entirely in the background while the user fills in the form. Also with multiple requests from the same IP in a short timespan, the difficulty increases. There are downsides to to…
proof of work really doesn't work well in practice. spammers have huge farms of compute, often on residential ips, and legit users are accessing the service from a device that is often power-constrained (like a phone). you end up either hugely penalizing legitimate users, or having to employ many of the standard antispam techniques (IP/ISP reputation, captcha, rate limiting etc) on top, so the proof of work adds a lo…
It's a bit like locking your bike. That doesn't work against targeted attacks, but the presumptive thief is more likely to choose another bike that has a smaller or no lock.
The arms race is bad for everyone, in both examples, but the underlying problem is a fundamental one of misaligned incentives.
Re: hCaptcha now runs on fifteen percent of the internet
#339Please die a screaming death. All of you captcha services.
I hate you.
Re: hCaptcha now runs on fifteen percent of the internet
#340Earlier quoted context omitted.
I'm about as anti-Google as it comes, but I didn't even mind the first incarnation of reCaptcha as a concept. You prove that you're human, and you also help transcribe books so that they're more accessible/searchable! Sure, it's in Google's interest in that it improves Google Books, but it at least seems like a symbiotic exchange (to, e.g. humanity in general.) Contrast that with today's form of reCaptcha where you i…
It is forced labour (to a very light degree, but still). It is additionally resource-theft, when recaptcha-protected sites are used for business purposes. You are stealing valuable business time (possibly very valuable business time, if the person in question is a high-paid role like a CEO or surgeon) to power your pet "spot the crosswalk" project.
Yeah, I certainly don't disagree. I was just trying to use 'forced labor' in a literal sense rather than try to imply any of the awful things that usually come to mind...