7 ms·

I've been thinking about this a lot lately. Where is our compensation? It's our time and brain power training Google's AI that will one day be sold back to us.

I've been thinking about this a lot lately. Where is our compensation? It's our time and brain power training Google's AI that will one day be sold back to us. I'm really not into this.

bonestamp2 8y ago
> Where is our compensation? When you search for an address on google maps, that little tiny house number on the house was once a captcha image and now google knows that number so it can take you to the exact location on a map when you search for that number. Everyone helps train the machine so when they want something from the machine then the machine is better at finding what they asked for. That seems pretty democratic to me.
lallinuo 8y ago
You might be interested what https://hcaptcha.com https://hcaptcha.com is doing.
- foxhop 8y ago
  Wow thanks for this, I added myself to the waiting list. If you use my referral URL I get a bump in the queue: https://hcaptcha.com/?r=29d830be7540 https://hcaptcha.com/?r=29d830be7540
  - pbhjpbhj 8y ago
    Can we get a hcaptcha pyramid scheme going, https://hCaptcha.com/?r=d6064d5f22b7 https://hCaptcha.com/?r=d6064d5f22b7 ...?
- hombre_fatal 8y ago
  I don't really understand the case where you'd use this. First, it seems tacky scrounging for peanuts from the users' captcha work. Or it's like a product/services website showing Adsense ads. It's a cheapening message to send. Second, since you make more money from more captcha volume, you're incentivized to maximize your use of captcha which is at odds with every complaint in this comments section about captcha. Most sites only use captcha to gate low-volume actions like register/login (e.g. HN). They created their own Ethereum token too which always puts a bad taste in my mouth these days. Finally, it doesn't address the upstream complaint that someone else is profiting off the user's "work" rather than the user. Though I don't find that complaint very reasonable. And a tiny fraction of a cent sounds about right. The truth is that users benefit from anti-abuse systems. The number of bots that HN's recaptcha on register/login has stopped is worth that tiny fraction of a cent to most users.
  - bonestamp2 8y ago
    > it doesn't address the upstream complaint that someone else is profiting off the user's "work" rather than the user If it means no/fewer ads to support a site then the user benefits because they don't have to pay real money to keep the site up.
  - amirhirsch 8y ago
    Is it somehow less tacky to give that value away to Google for free? Sites can set the difficulty level necessary for their application. Some are under continual targeted attack, others are mainly keeping out rogue automated spambots from their comments section. The user is typically getting a free service, a better site experience due to less bot traffic, or both. I think sharing the value of their work with the website is a fair deal. As for using blockchain tech for ledger functions, that is all under the hood: websites can cash out to dollars as they prefer. (disclosure: work on bot detection at hCaptcha.com)
    - hombre_fatal 8y ago
      > Is it somehow less tacky to give that value away to Google for free? Yes, mainly because we're talking about fractions of cents. Also, it's not for free; the website and its users get a good anti-abuse measure in return. There's a big difference between something that cannot make money and something that makes pennies for the site. But, to be fair, 99.9% of users aren't going to notice the difference in captcha branding either way unlike my example of a banner ad on a retail site. My main reaction is that the UX incentive to minimize user exposure to captchas seems to work against the primary pull of using hcaptcha in the first place. Though one site I can think of that has a captcha behind every action (every post) is 4chan. Maybe you can get them on hcaptcha one day. It would at least help you test your tagging system against vandalism. :)
      - r32a_ 8y ago
        Google's entire business model is leveraging of fractions of a cent on a mass scale
mda 8y ago
So you want compensation because your data is used along with millions of others to train an algorithm to distinguish if a bot or a real human to provide a service to you? Nice.
- wolco 8y ago
  Yes if the data is of value. They don't give this data out publicly. Open source the data or pay.
- ummonk 8y ago
  It isn’t to train their bot detection algorithm. It is to train their other efforts (e.g. self driving cars, mapping, etc.)
human 8y ago
Are you kidding? Your compensation is all the free apps you get (Gmail, Maps, etc.) You’ll rarely see a Captcha for a paid product once they have your cc info.
- jammygit 8y ago
  I get most of my captchas while attempting to access products I've paid for already (very few at purchase time).
  - udfalkso 8y ago
    Imagine if those sites had to build their own captcha service instead. How much more expensive would they be?
    - gcb0 8y ago
      wonder if someone is collecting actual data instead of listening to udfalkso, the google sales rep here. maybe to save them a few $ from bots and spam (bandwidth and storage is very cheap today) they might be losing new users by the thousands (and traffic acquisition is far more expensive than the formers)
    - JohnFen 8y ago
      Or they could just use one of the many free CAPTCHA applications that are around.
      - hombre_fatal 8y ago
        Off the shelf spam software like Xrumer[0] has been cracking those captchas for 10+ years. Recaptcha isn't obnoxious for fun, it's obnoxious because this is the state of the arms race right now. There's also the challenge of creating a captcha that allows blind people in. [0]: https://en.wikipedia.org/wiki/XRumer https://en.wikipedia.org/wiki/XRumer
    - foxylad 8y ago
      It's actually not that hard, assuming you control your form generation. Bots usually fill in fields using the actual field name - not the label the user sees. So provide a field labelled "Age" but named "email", and simply check it contains digits. If it's got an email address in it, it's a bot. Labels can also be obfuscated with javascript, replacing the raw HTML "Email" with "Age"on page load. Getting this right will require the bot to parse both HTML and JS, and we can force them to handle CSS too. Add a "zip" field, and hide it with complex CSS rules. If it contains a zip code, it's a bot. If you're really paranoid, randomise combinations of distinguishable fields (name, email, phone, age and hidden fields) every time you generate the form, so even if a bot herder manually maps names to fields one time, it'll fail the next. At this stage it'll be cheaper for the bot herder to use Mechanical Turk, after which even Google's captcha is compromised.
whatshisface 8y ago
Your compensation is that you get to use the website, and the website's compensation for putting up a gate for their users is that they get to keep the bots out.
tyrust 8y ago
reCAPTCHA provides protections to site owners for free. By using reCAPTCHA, site owners pass the cost of said protection on to their users. disclaimer: work for google, nothing related to reCAPTCHA though. opinions are my own, etc.
hamburga 8y ago
Gavin Newsom, the governor of CA, spoke about this in his State of the State yesterday: https://www.sacbee.com/news/politics-government/capitol-alert/article226162205.html https://www.sacbee.com/news/politics-government/capitol-aler... This book offers one set of proposals for "Data as Labor", inspired by Jaron Lanier: http://radicalmarkets.com/chapters/data-as-labor/ http://radicalmarkets.com/chapters/data-as-labor/ And there's going to be a lot of discussion of the idea at the RadicalxChange conference in March (https://radicalxchange.org/ https://radicalxchange.org/), including with Jaron himself as well as the book authors. (Disclosure: I do the conference website as a volunteer).
gingerbread-man 8y ago
Because Google can extract value from captchas, it makes world-class captchas and bot detection AI available to every webmaster for free. I don't know what that level of service would otherwise cost, but it almost certainly wouldn't be affordable for low-traffic blogs and the like, which would end up vulnerable using weaker captchas or trying to roll their own. Everywhere else the cost would just get passed on to users. I don't love the compromise of paying for things with my data or by training Google's AI, but it's hard to say users aren't getting anything out of it. That said, I do miss the old reCaptcha.
- JohnFen 8y ago
  > it almost certainly wouldn't be affordable for low-traffic blogs and the like Very few low-traffic blogs that I see use (or need) CAPTCHAs. I know that the ones I run don't. > I don't love the compromise of paying for things with my data or by training Google's AI, but it's hard to say users aren't getting anything out of it. I don't think they are getting much, if anything out of it -- aside from being increasingly punished for defending themselves against being spied on by Google.
  - jopsen 8y ago
    My personal blog has a spam filter for comments.. it's either that or captcha.. or sign in with Google/Facebook.
    - johannes1234321 8y ago
      Often a trivial non-standard thing like "what's the name of the author" works well enough. Especially outside the English language. Spammers won't spend the time to bother adopting their scripts for that. If this somple thing comes from a popular WordPress plugin the equation for the spammer changes, of course.
      - hombre_fatal 8y ago
        There's certainly a period of time where that solution is sufficient as it stops the lowest level of drive-by <form> spam. But it also sucks the first day you get an attacker who solves it once and then spams you thousands of times. Modern spam tools are pretty impressive these days and minimize the targeted work the human spammer needs to do in these cases. In the early 2000s, you could set a custom question and then assume no attacker is going to manually code for your little blog. But even in 2008 I was using spam software (out of curiosity) where you could import a massive blog list, and it would pause spamjobs with failed comment submissions, let you pencil in a value for this unknown field, and then click resume. You could also choose other actions for that field like "prompt me each time" and sit at your computer multiplexing your labor across hundreds of blogs. And that was pretty polished ten years ago.
davesque 8y ago
1e-10 cents.
amsvie 8y ago
20% of these companies could be considered public property because it is public which has been feeding the algorithms training data. A dividend on this could probably provide for a basic income.
wwweston 8y ago
Google's services, of course. Is it worth it?
dragonwriter 8y ago
> I've been thinking about this a lot lately. Where is our compensation? You give Google training for ML models. Google gives the site provider the service of excluding bots from submitting the form. The site provider gives you whatever was provided by the form you were trying to submit. No one is uncompensated.

I've been thinking about this a lot lately. Where is our compensation? It's our time and brain power training Google's AI that will one day be sold back to us. I'm really not into this.

bonestamp2 8y ago

> Where is our compensation? When you search for an address on google maps, that little tiny house number on the house was once a captcha image and now google knows that number so it can take you to the exact location on a map when you search for that number. Everyone helps train the machine so when they want something from the machine then the machine is better at finding what they asked for. That seems pretty democratic to me.

lallinuo 8y ago

You might be interested what https://hcaptcha.com https://hcaptcha.com is doing.

foxhop 8y ago
Wow thanks for this, I added myself to the waiting list. If you use my referral URL I get a bump in the queue: https://hcaptcha.com/?r=29d830be7540 https://hcaptcha.com/?r=29d830be7540
- pbhjpbhj 8y ago
  Can we get a hcaptcha pyramid scheme going, https://hCaptcha.com/?r=d6064d5f22b7 https://hCaptcha.com/?r=d6064d5f22b7 ...?
hombre_fatal 8y ago
I don't really understand the case where you'd use this. First, it seems tacky scrounging for peanuts from the users' captcha work. Or it's like a product/services website showing Adsense ads. It's a cheapening message to send. Second, since you make more money from more captcha volume, you're incentivized to maximize your use of captcha which is at odds with every complaint in this comments section about captcha. Most sites only use captcha to gate low-volume actions like register/login (e.g. HN). They created their own Ethereum token too which always puts a bad taste in my mouth these days. Finally, it doesn't address the upstream complaint that someone else is profiting off the user's "work" rather than the user. Though I don't find that complaint very reasonable. And a tiny fraction of a cent sounds about right. The truth is that users benefit from anti-abuse systems. The number of bots that HN's recaptcha on register/login has stopped is worth that tiny fraction of a cent to most users.
- bonestamp2 8y ago
  > it doesn't address the upstream complaint that someone else is profiting off the user's "work" rather than the user If it means no/fewer ads to support a site then the user benefits because they don't have to pay real money to keep the site up.
- amirhirsch 8y ago
  Is it somehow less tacky to give that value away to Google for free? Sites can set the difficulty level necessary for their application. Some are under continual targeted attack, others are mainly keeping out rogue automated spambots from their comments section. The user is typically getting a free service, a better site experience due to less bot traffic, or both. I think sharing the value of their work with the website is a fair deal. As for using blockchain tech for ledger functions, that is all under the hood: websites can cash out to dollars as they prefer. (disclosure: work on bot detection at hCaptcha.com)
  - hombre_fatal 8y ago
    > Is it somehow less tacky to give that value away to Google for free? Yes, mainly because we're talking about fractions of cents. Also, it's not for free; the website and its users get a good anti-abuse measure in return. There's a big difference between something that cannot make money and something that makes pennies for the site. But, to be fair, 99.9% of users aren't going to notice the difference in captcha branding either way unlike my example of a banner ad on a retail site. My main reaction is that the UX incentive to minimize user exposure to captchas seems to work against the primary pull of using hcaptcha in the first place. Though one site I can think of that has a captcha behind every action (every post) is 4chan. Maybe you can get them on hcaptcha one day. It would at least help you test your tagging system against vandalism. :)
    - r32a_ 8y ago
      Google's entire business model is leveraging of fractions of a cent on a mass scale

mda 8y ago

So you want compensation because your data is used along with millions of others to train an algorithm to distinguish if a bot or a real human to provide a service to you? Nice.

wolco 8y ago
Yes if the data is of value. They don't give this data out publicly. Open source the data or pay.
ummonk 8y ago
It isn’t to train their bot detection algorithm. It is to train their other efforts (e.g. self driving cars, mapping, etc.)

human 8y ago

Are you kidding? Your compensation is all the free apps you get (Gmail, Maps, etc.) You’ll rarely see a Captcha for a paid product once they have your cc info.

jammygit 8y ago
I get most of my captchas while attempting to access products I've paid for already (very few at purchase time).
- udfalkso 8y ago
  Imagine if those sites had to build their own captcha service instead. How much more expensive would they be?
  - gcb0 8y ago
    wonder if someone is collecting actual data instead of listening to udfalkso, the google sales rep here. maybe to save them a few $ from bots and spam (bandwidth and storage is very cheap today) they might be losing new users by the thousands (and traffic acquisition is far more expensive than the formers)
  - JohnFen 8y ago
    Or they could just use one of the many free CAPTCHA applications that are around.
    - hombre_fatal 8y ago
      Off the shelf spam software like Xrumer[0] has been cracking those captchas for 10+ years. Recaptcha isn't obnoxious for fun, it's obnoxious because this is the state of the arms race right now. There's also the challenge of creating a captcha that allows blind people in. [0]: https://en.wikipedia.org/wiki/XRumer https://en.wikipedia.org/wiki/XRumer
  - foxylad 8y ago
    It's actually not that hard, assuming you control your form generation. Bots usually fill in fields using the actual field name - not the label the user sees. So provide a field labelled "Age" but named "email", and simply check it contains digits. If it's got an email address in it, it's a bot. Labels can also be obfuscated with javascript, replacing the raw HTML "Email" with "Age"on page load. Getting this right will require the bot to parse both HTML and JS, and we can force them to handle CSS too. Add a "zip" field, and hide it with complex CSS rules. If it contains a zip code, it's a bot. If you're really paranoid, randomise combinations of distinguishable fields (name, email, phone, age and hidden fields) every time you generate the form, so even if a bot herder manually maps names to fields one time, it'll fail the next. At this stage it'll be cheaper for the bot herder to use Mechanical Turk, after which even Google's captcha is compromised.

whatshisface 8y ago

Your compensation is that you get to use the website, and the website's compensation for putting up a gate for their users is that they get to keep the bots out.

tyrust 8y ago

reCAPTCHA provides protections to site owners for free. By using reCAPTCHA, site owners pass the cost of said protection on to their users. disclaimer: work for google, nothing related to reCAPTCHA though. opinions are my own, etc.

hamburga 8y ago

Gavin Newsom, the governor of CA, spoke about this in his State of the State yesterday: https://www.sacbee.com/news/politics-government/capitol-alert/article226162205.html https://www.sacbee.com/news/politics-government/capitol-aler... This book offers one set of proposals for "Data as Labor", inspired by Jaron Lanier: http://radicalmarkets.com/chapters/data-as-labor/ http://radicalmarkets.com/chapters/data-as-labor/ And there's going to be a lot of discussion of the idea at the RadicalxChange conference in March (https://radicalxchange.org/ https://radicalxchange.org/), including with Jaron himself as well as the book authors. (Disclosure: I do the conference website as a volunteer).

gingerbread-man 8y ago

Because Google can extract value from captchas, it makes world-class captchas and bot detection AI available to every webmaster for free. I don't know what that level of service would otherwise cost, but it almost certainly wouldn't be affordable for low-traffic blogs and the like, which would end up vulnerable using weaker captchas or trying to roll their own. Everywhere else the cost would just get passed on to users. I don't love the compromise of paying for things with my data or by training Google's AI, but it's hard to say users aren't getting anything out of it. That said, I do miss the old reCaptcha.

JohnFen 8y ago
> it almost certainly wouldn't be affordable for low-traffic blogs and the like Very few low-traffic blogs that I see use (or need) CAPTCHAs. I know that the ones I run don't. > I don't love the compromise of paying for things with my data or by training Google's AI, but it's hard to say users aren't getting anything out of it. I don't think they are getting much, if anything out of it -- aside from being increasingly punished for defending themselves against being spied on by Google.
- jopsen 8y ago
  My personal blog has a spam filter for comments.. it's either that or captcha.. or sign in with Google/Facebook.
  - johannes1234321 8y ago
    Often a trivial non-standard thing like "what's the name of the author" works well enough. Especially outside the English language. Spammers won't spend the time to bother adopting their scripts for that. If this somple thing comes from a popular WordPress plugin the equation for the spammer changes, of course.
    - hombre_fatal 8y ago
      There's certainly a period of time where that solution is sufficient as it stops the lowest level of drive-by <form> spam. But it also sucks the first day you get an attacker who solves it once and then spams you thousands of times. Modern spam tools are pretty impressive these days and minimize the targeted work the human spammer needs to do in these cases. In the early 2000s, you could set a custom question and then assume no attacker is going to manually code for your little blog. But even in 2008 I was using spam software (out of curiosity) where you could import a massive blog list, and it would pause spamjobs with failed comment submissions, let you pencil in a value for this unknown field, and then click resume. You could also choose other actions for that field like "prompt me each time" and sit at your computer multiplexing your labor across hundreds of blogs. And that was pretty polished ten years ago.

davesque 8y ago

1e-10 cents.

amsvie 8y ago

20% of these companies could be considered public property because it is public which has been feeding the algorithms training data. A dividend on this could probably provide for a basic income.

wwweston 8y ago

Google's services, of course. Is it worth it?

dragonwriter 8y ago

> I've been thinking about this a lot lately. Where is our compensation? You give Google training for ML models. Google gives the site provider the service of excluding bots from submitting the form. The site provider gives you whatever was provided by the form you were trying to submit. No one is uncompensated.