3 ms·

ReCAPTCHA doesn't prevent the kind of spam that makes internet services completely unusable (i.e. DDoS botnets), it prevents form submition spam.

gbear605 7y ago
To be fair, spamming a user-submitted content site (for example, a blog with comments) is just as bad as a DDoS; either one makes the site unusable.
- luckylion 7y ago
  Most forum or blog comment spam I've seen was trivial to detect, even without access to the server. Isn't written in the right language? Very likely spam. Contains a link and little text? Very likely spam. If you have access to the server's information, it gets even better. Origin makes it much easier to identify likely spam, previous interactions with the site and their speed ("hits the page and 1s later submits a comment") provide more info. Sure, all of that can be worked around, but that makes it more complicated and increases the cost for the attacker. If they spend money on faking actual user interaction with your blog, routing all requests through a residential IP in your country etc pp, they are likely spending as much or more than they would on a recaptcha solving service.
  - mcv 7y ago
    I'd much rather have a service where I can submit a comment to check if it's meaningful or likely spam, than to force my users to waste time and share data with Google that they don't want to. If clearly spam, block it, if clearly okay, allow it. If unsure, leave it for a moderator. It might even train users to write better comments if badly written ones need to wait for moderation.
    - vkou 7y ago
      As if that's not a complete privacy nightmare. I'm sure either the NSA, or an ad-tech agency would love to get a firehose feed of this sort of data, while providing you with a YES-SPAM/NO-SPAM service. Also, anyone who mentions <something the service wants to censor> can be, of course, blackholed as spam. ;)
      - mcv 7y ago
        As long as it's a public forum, I don't see the issue. It's going to be public anyway, and they could easily scrape it if they want to. The submission itself should be done by the site, so the user remains anonymous.
        vkou 7y ago
        There's a lot of information that can improve spam classification, that is not publicly queryable. Any spam detection engine that asks for that information will outperform ones that don't.
deleted 7y ago
[deleted]

gbear605 7y ago

To be fair, spamming a user-submitted content site (for example, a blog with comments) is just as bad as a DDoS; either one makes the site unusable.

luckylion 7y ago
Most forum or blog comment spam I've seen was trivial to detect, even without access to the server. Isn't written in the right language? Very likely spam. Contains a link and little text? Very likely spam. If you have access to the server's information, it gets even better. Origin makes it much easier to identify likely spam, previous interactions with the site and their speed ("hits the page and 1s later submits a comment") provide more info. Sure, all of that can be worked around, but that makes it more complicated and increases the cost for the attacker. If they spend money on faking actual user interaction with your blog, routing all requests through a residential IP in your country etc pp, they are likely spending as much or more than they would on a recaptcha solving service.
- mcv 7y ago
  I'd much rather have a service where I can submit a comment to check if it's meaningful or likely spam, than to force my users to waste time and share data with Google that they don't want to. If clearly spam, block it, if clearly okay, allow it. If unsure, leave it for a moderator. It might even train users to write better comments if badly written ones need to wait for moderation.
  - vkou 7y ago
    As if that's not a complete privacy nightmare. I'm sure either the NSA, or an ad-tech agency would love to get a firehose feed of this sort of data, while providing you with a YES-SPAM/NO-SPAM service. Also, anyone who mentions <something the service wants to censor> can be, of course, blackholed as spam. ;)
    - mcv 7y ago
      As long as it's a public forum, I don't see the issue. It's going to be public anyway, and they could easily scrape it if they want to. The submission itself should be done by the site, so the user remains anonymous.
      - vkou 7y ago
        There's a lot of information that can improve spam classification, that is not publicly queryable. Any spam detection engine that asks for that information will outperform ones that don't.

deleted 7y ago

[deleted]