5 ms·

Can anyone recommend a minimally invasive, accessible capture mechanism that would perhaps still cut out X% of non-targeted bot spam for some possibly small but

Can anyone recommend a minimally invasive, accessible capture mechanism that would perhaps still cut out X% of non-targeted bot spam for some possibly small but nonzero X? I do not want to expose users to recaptcha 3 TOS or any other opt in monitoring. I was considering some form of completely unanalysed input such as non standard element based checkbox as a low pass filter.

yorick 7y ago
You may want to consider running some proof-of-work in the browser, that would be costly to run for bots.
- silasdavis 7y ago
  That's not a bad idea. I'd be concerned about being accused of/blocked for crypto-jacking. That said, I'd like to see a proof-of-work based captcha that donates any earnings to charity as cryptocurrency. I came across hashcash.io before, previous discussion: https://news.ycombinator.com/item?id=7944540 https://news.ycombinator.com/item?id=7944540 Alternatively I could write something dead simple from scratch that looks for sha collisions to burn a few cycles. Would this be less dubious?
- ForHackernews 7y ago
  All that does is further penalize the victims of botnets by driving up their electricity bills. It won't hurt the spammers who run the botnets.
  - taffer 7y ago
    This is only true if we assume that spammers are not already saturating the resources of their victims. And even then, it's better than penalizing blind or deaf people.
bordplate 7y ago
Can't remember where I saw this, but someone else talked about creating a field in the form, hidden by CSS, that if filled in would just discard that submission. Should work for most automated bots that aren't specifically targeting you.
- namanyayg 7y ago
  This is known as the honeypot technique, it's quite old and I'd say that most spam bots go defeat it easily enough already.
electrograv 7y ago
<pflenker>’s top level post makes a good point here, suggesting that because untargeted bots are your biggest concern, even the simplest custom challenges tend to work quite well (e.g. “enter the number 123 in the last box”) — with ”custom” being the key here! Because: Until large strides are made in artificial general intelligence [1], simple little challenges that are creatively designed will be very difficult for a single general-purpose AI system to crack 100% automatically. In contrast, if your site is targeted with actual human engineers trying to crack your anti-bot system, there’s a good chance they’ll succeed no matter how strong your system [2]. In the case of such targeted attacks, presumably your company will be so important and successful that you’ll be able to afford similarly expensive resources to defend from such attacks. [1] Don’t get me wrong, I’m not doubting that sufficiently general AI is coming that can easily solve such challenges. But for now, to get your startup off the ground, this is apparently an effective short term solution that is very easy to implement. [2] Human-operated “sign up farms” are definitely a thing, in addition to actual human-operated spam / advertising / propaganda farms (imagine a typical “call center”-style office hired to do this).

yorick 7y ago

You may want to consider running some proof-of-work in the browser, that would be costly to run for bots.

silasdavis 7y ago
That's not a bad idea. I'd be concerned about being accused of/blocked for crypto-jacking. That said, I'd like to see a proof-of-work based captcha that donates any earnings to charity as cryptocurrency. I came across hashcash.io before, previous discussion: https://news.ycombinator.com/item?id=7944540 https://news.ycombinator.com/item?id=7944540 Alternatively I could write something dead simple from scratch that looks for sha collisions to burn a few cycles. Would this be less dubious?
ForHackernews 7y ago
All that does is further penalize the victims of botnets by driving up their electricity bills. It won't hurt the spammers who run the botnets.
- taffer 7y ago
  This is only true if we assume that spammers are not already saturating the resources of their victims. And even then, it's better than penalizing blind or deaf people.

bordplate 7y ago

Can't remember where I saw this, but someone else talked about creating a field in the form, hidden by CSS, that if filled in would just discard that submission. Should work for most automated bots that aren't specifically targeting you.

namanyayg 7y ago
This is known as the honeypot technique, it's quite old and I'd say that most spam bots go defeat it easily enough already.

electrograv 7y ago

<pflenker>’s top level post makes a good point here, suggesting that because untargeted bots are your biggest concern, even the simplest custom challenges tend to work quite well (e.g. “enter the number 123 in the last box”) — with ”custom” being the key here! Because: Until large strides are made in artificial general intelligence [1], simple little challenges that are creatively designed will be very difficult for a single general-purpose AI system to crack 100% automatically. In contrast, if your site is targeted with actual human engineers trying to crack your anti-bot system, there’s a good chance they’ll succeed no matter how strong your system [2]. In the case of such targeted attacks, presumably your company will be so important and successful that you’ll be able to afford similarly expensive resources to defend from such attacks. [1] Don’t get me wrong, I’m not doubting that sufficiently general AI is coming that can easily solve such challenges. But for now, to get your startup off the ground, this is apparently an effective short term solution that is very easy to implement. [2] Human-operated “sign up farms” are definitely a thing, in addition to actual human-operated spam / advertising / propaganda farms (imagine a typical “call center”-style office hired to do this).