CAPTCHAs are over (in ticketing)

> it's obviously preferable to get paid for the entire tour on the day it's announced

it's only obvious to "private equity" type people.

There is energy in the concerts - and a lot of people go to live shows for that. Otherwise, one would listen to the recording / watch music videos instead - it is cheaper and the seats are nicer too.

If the seats are half-empty, or only full of people who are ready to pay exorbitant prices, that energy is reduced... people like concerts less, and eventually those concerts are not sold out anymore.

So giving up (or even worse, cooperating) to scalpers is like selling your business to private equity - you get some money, they get some money, and your customers/fans are f*d.

Well yes, the concert is funded by city, and they wanted everyone to have a chance at attending, no matter what their income was. Not everything needs to be sold.

The problem there was not having enough security - it's like store giving out free popcorn, and someone comes and steals the whole cart. In the physical world, there would be someone standing next to the cart watching that people take reasonable amounts. In the digital world, nothing was done, so thieves stole a lot.

Not sure what the best solution was to be there... I like the idea of giving people few days to sign up, then randomly choosing who gets to go. Of course this has its own problems - for example you want to allow groups, but this can be abused. Identity verification helps with that, but this makes ticket checking much slower....

This sounds so truthy and yet so lacking in specifics.

Any examples come to mind?

On proof of work, the situation is actually really bad in more fields than just ticketing. As noted in the article, proof of work isn’t about distinguishing between computers and people, it’s about making things expensive for everyone. Put bluntly, it’s rate limiting. Unfortunately, it’s bad rate limiting: it only works if there’s a level playing field. The trouble is that, when the value of a target is high enough, people figure out ways of cheating.

This can be illustrated with Bitcoin mining. It uses SHA-256 hashing, and at first, mining was done on CPUs. But it turns out you can implement SHA-256 on GPUs, and it’s waaaay more power-efficient/fast; and so CPU mining rapidly became unviable. Then came FPGAs maybe (can’t remember if this was really a separate stage, or rapidly passed) and ultimately ASICs, all making it faster and more power-efficient.

The best Bitcoin mining rigs are more than four million times as power-efficient as any web browser in my powerful four-year-old laptop.

So that’s Bitcoin. Now how about these online bot prevention things, which must rely on only being able to use CPUs, doing proof-of-work?

They use SHA-256. Yes, the algorithm that Bitcoin has rendered useless for proving work on a CPU. Anubis and ALTCHA say they use SHA-256, and a glance at Friendly Captcha’s worker source includes familiar magic numbers.

So you know what comes next: if these things become valuable enough targets, people offload the solving to GPUs and ASICs. And once you have a power level difference factor of a few thousand or million, you can’t fix it by adjusting problem difficulty. No, current proof of work schemes are bad rate limiting, and they’ll need to rethink everything completely if they become popular.

I just don’t get why they didn’t at least start with something like Argon2d, which would at least stave off the evil day. Did they learn nothing from cryptocurrency? SHA-256 is almost the worst choice imaginable for a proof of work scheme, because of how much effort has already gone into undermining it.

I genuinely believe these bot prevention things would be approximately as effective, at least for now (and their choice of SHA-256 shows this is all they care about) if their script replaced the proof of work with a simple busy loop of similar duration, told the server it had done so, and the server trusted it. In their present form, I imagine someone who knows what they’re doing with hooking stuff in a headless browser, and writing code for a GPU or an ASIC, could effectively bypass any one of these services in less than a day, reducing the cost by a factor of thousands or millions.

You're attributing to avg consumer a much higher degree of both tech-savviness and market power than is realistic.