4 ms·

I liked the idea when they just showed images of words that an OCR couldn't read accurately. But now all this damn clicking of hydrants, crossing, traffic ligh

I liked the idea when they just showed images of words that an OCR couldn't read accurately. But now all this damn clicking of hydrants, crossing, traffic lights, store fronts, vehicles etc. etc. is becoming really irritating. And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google.

hombre_fatal 8y ago
> I liked the idea when they just showed images of words that an OCR couldn't read accurately. Like I said, popular spamming software like Xrumer could crack those captchas ten years ago. > And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google. Can you pitch alternatives, though? For example, an attacker can still spoof IP addresses in 2019 and create volumetric attacks that you certainly cannot endure without someone's help upstream (i.e. centralization). No need to bother with spoofing though since you can rent a botnet for peanuts. Attackers have decentralized attacks but there is increasingly only centralized defense.
- fro0116 8y ago
  In my mind the answer is in building decentralized apps/services. A DDoS on a static site cached on just about any CDN that runs logic exclusively on the client is much harder to pull off successfully because it's so much cheaper (practically free?) to mitigate, and doesn't affect any existing users who would already have the necessary resources cached locally.
  - hombre_fatal 8y ago
    I thought that until my sites behind AWS' CloudFront were repeatedly DDoSed and I saw my bill. AWS did let me report these DDoSes and they would reimburse me, but it felt wayyy too precarious and I ended up switching to Cloudflare (free). And I think that should worry us all. Also, only the most trivial sites can be 100% cached. And those are the sites who need Recaptcha the least (or need a server to get a challenge from). Abuse is not a simple issue to solve.

hombre_fatal 8y ago

> I liked the idea when they just showed images of words that an OCR couldn't read accurately. Like I said, popular spamming software like Xrumer could crack those captchas ten years ago. > And no, I disagree that we have no option but to rely on "centralised" services like cloudfare or Google. Can you pitch alternatives, though? For example, an attacker can still spoof IP addresses in 2019 and create volumetric attacks that you certainly cannot endure without someone's help upstream (i.e. centralization). No need to bother with spoofing though since you can rent a botnet for peanuts. Attackers have decentralized attacks but there is increasingly only centralized defense.

fro0116 8y ago
In my mind the answer is in building decentralized apps/services. A DDoS on a static site cached on just about any CDN that runs logic exclusively on the client is much harder to pull off successfully because it's so much cheaper (practically free?) to mitigate, and doesn't affect any existing users who would already have the necessary resources cached locally.
- hombre_fatal 8y ago
  I thought that until my sites behind AWS' CloudFront were repeatedly DDoSed and I saw my bill. AWS did let me report these DDoSes and they would reimburse me, but it felt wayyy too precarious and I ended up switching to Cloudflare (free). And I think that should worry us all. Also, only the most trivial sites can be 100% cached. And those are the sites who need Recaptcha the least (or need a server to get a challenge from). Abuse is not a simple issue to solve.