10 ms·
Show HN: CodeCaptcha - Hide web links behind coding challenges
Hello HN, I made this silly project over the long weekend. It’s pretty basic right now and the captchas are very easy. I plan to add captcha difficulty levels for link creators soon.
- btdmaster 5y agofunction isEvenNumber(num) { if(Math.random() > 0.5) { return true } return false } Took a while, but worked in the end. Be careful with the arbitrary code execution because I'm sure people can do more than generate random numbers!
- yehoshuapw 5y agoIt's running in the browser. (I checked with an "alert") so its not that bad. Edit: nvm, it seems (according to a comment here by the author) that it is sent to the server and verified. Edit 2: indeed, once the answer worked locally, it got sent - and got stuck at "Submitting..." (locally, I clicked the alert)
- mellavora 5y agoor, as Randall Munroe put it, https://xkcd.com/1185/ https://xkcd.com/1185/ where 'panic sort' remains my favorite
- dylan604 5y agohttps://xkcd.com/810/ https://xkcd.com/810/ seems apropros as well
- tempodox 5y agoToo circuitous, too procedural. Just, return (Math.random() > 0.5);
- maxk42 5y agoYou don't need the parentheses either.
- ketanip 5y agoLoved it, its super fun.
- tyingq 5y agoMight be good to mention that javascript is expected.
- asadlionpk 5y agoThanks. I will add that
- deleted 5y ago[deleted]
- nano9 5y ago
- debdut 5y agodang awesome
- onionisafruit 5y agoThis is a fun idea. I tried the demo a few times. msft copilot solved them all immediately. This won't be effective keeping bots out, but it may be good for turning away non-technical humans.
- asadlionpk 5y agoThat’s the goal actually. Interestingly, copilot GENERATED some of these captcha challenges for me. It’s impressive!
- onionisafruit 5y agoBe careful with that. It may generate challenges that only it can solve and take over your site ;-)
- AntonyGarand 5y agoNice project! It's worth mentioning that this is a client-side captcha, making it trivial to bypass by bots / anyone.
- asadlionpk 5y agoIt’s actually not? The solution is sent to server and verified.
- ReleaseCandidat 5y agoOh, sneaky! function addNumbers(a, b) { if (a === 1 && b === 3){ return 4 } } Testing for hidden input: FAILED!
- asadlionpk 5y agoHa!
- crate_barre 5y agoMight as well stick the Leetcode problem on job postings with this.
- endisneigh 5y agoIs a captcha too hard for any automation but easy enough for a human in a reasonable amount of time even possible? I feel like all captcha does is waste the time of non technical folks and fail to stop the people who would abuse to begin with.
- asadlionpk 5y agoWell captchas waste human time but they do work. Example: As a webmaster, Cloudflare’s captchas have save my sites from abuse numerous times.
- IceWreck 5y agoLooks like there are only 7-8 challenges. You could just steamroll thought this the hardcoding way. But yeah solving them with copilot is more fun.
- romanzubenko 5y agoYears ago at green tech college hackathon my team built a captcha that requires users to correctly sort trash into recycling, compost and non-recyclable bins. Anything little bit more fun is better than mind numbing selecting traffic lights, boats and trains.
- mellavora 5y agoobviously you've spent more time in Germany than driving across the US. Though really, only 3 different bins? How primitive!
- melissalobos 5y agoUnfortunately the example problems are simple enough to be solved with AI. As a test I ran two of them by CoPilot, and it solved them instantly. I like the idea, but would want something more difficult as a captcha since it is easy for bots but hard for a human. Maybe a better approach would be to have a prompt at the top with unclear specifications, or some kind of riddle instead of a function name. It would also be good not to have a bank of problems, since someone could just pattern match on them, but to generate them automatically somehow. This is a lot more interesting than finding traffic lights though, and the website looks well designed. Thank you for sharing!
- asadlionpk 5y agoThanks! All good suggestions!
- splintercell 5y agoDo, fix this halting problem instead.
- tonmoy 5y agoI thought the goal was to weed out non-programmers not AI - in that regard it seems to be doing what it was designed for I guess
- deleted 5y ago[deleted]
- charcircuit 5y agoCaptcha stands for: Completely Automated Public Turing test to tell Computers and Humans Apart
- isaacimagine 5y agoCAPTPHA?
- panphora 5y agoThis would be a fun way to: * Create homework at the end of a programming lesson (before unlocking the next step) * Link to a job posting from a company website (if you don't mind coming off as slightly evil) * Hide a link to a StackOverflow answer from a friend
- whoomp12342 5y agoI hate all of these. In the current use case I don't care because for me all of the problems are trivial. But I worry about people abusing this idea with harder problems
- Zababa 5y agoIf you want to limit something to programmers, I think one idea would be to ask them to run a command, giving a linux and a windows possibility, and copy/pasting the result.
- kuroguro 5y agoYeah, something like curl <captchascipt> | sh ! Oh wait..
- asadlionpk 5y agoexactly... maybe just curl <url> | pbcopy and the server only serves to non-browser useragents
- no_time 5y agowindows ships with curl nowadays so this may not be an effective deterrent!
- splatcollision 5y agoNever gonna give this up! Great project
- akersten 5y agoI noticed one of the challenges is "reverse a string." Can I just rant a little about how much I hate that as an interview question? It's meaningless to reverse a string. Not just in the "there's no purpose to doing it" sense (very true) but genuinely in the "it literally isn't a defined operation" sense. If you've only lived in the nice insulated world of ASCII or a mostly-ASCII-like language, you might scratch your head - just put the letters in backwards order, right? Well, what do you when you hit a Unicode joiner? Or a multi-byte emoji? Maybe your reversing scheme is clever and looks at "whole codepoints" or whatever. But then what happens when you normalize the "reversed" string? Or what about the modifier characters that affect the previous/next character - how to treat those? I've never been satisfied with anyone's answer to these questions, because the problem is invalid from the start. You can't "reverse" an arbitrary string, it's not a well-defined operation.
- julienreszka 5y agostr.split('').reverse().join('')
- Karawebnetwork 5y agoIn a tongue-in-cheek tone: Woah, so old school. We would never hire you! You have to show that you know ES6! [...str].reverse().join('')
- jandrese 5y agoWhich would fail. You got the directional formatting characters in the wrong order. It is 2022. If your code doesn't treat all strings as Unicode it is broken.
- yehoshuapw 5y agoThere is a (slight, but important) difference between the syntactic meaning, and the semantic meaning. you are correct that reversing a string gives back irrelevant things. (and you don't need to go that far: what does a reversed word mean?) however, in the sense of a list of characters, the content is irrelevant.
- whoomp12342 5y agowow, this has been up for 2 hours and no one has thought of the most obvious use case for this tool? rick roll your co-workers
- ZeroCool2u 5y agoI wonder if you could use advent of code or Project Euler style challenges that have a multitude of problem/solution pairs to bootstrap support for languages besides JS? The difficulty would be perhaps a bit high, but not a bad starting place.
- tempodox 5y agoNice, solving the demo challenge gets you rickrolled!
- alanbernstein 5y agoI suggest indicating the language being used, directly on the captcha element, not just on the landing page.
- asadlionpk 5y agothanks, I will add that!
- 37ef_ced3 5y agoSomeone tell me what CoPilot generates for this: // A Go function to swap the sixth bit and seventeenth bit of a 32-bit signed integer. Here is a human solution: func swap(x int32) int32 { const mask = 1 << 5 var ( xor1 = (x>>11 ^ x) & mask xor2 = xor1 << 11 ) return x ^ xor1 ^ xor2 } I would be surprised if CoPilot can reason numerically like this (understand "seventeenth bit" and "sixth bit" and generate the right code for that combination).
- smitop 5y agoWith just that prompt, Copilot keeps writing a comment about the function but never actually writes the function. Prompting to actually write the function by starting it with `func` gives: // A Go function to swap the sixth bit and seventeenth bit of a 32-bit signed integer. func swapBits(x int32) int32 { return ((x & 0x0F) << 28) | ((x & 0xF0000000) >> 28) }
- 37ef_ced3 5y agoTotally wrong, it's garbage. And there you have it, the difference between real intelligence and regurgitation. This is the kind of numerically specific coding that could be the basis of a CAPTCHA that CoPilot can't solve. Sixth bit, sixth byte, seventeenth bit, seventeenth byte, etc.
- asxd 5y agoFor python it seems to generate a more reasonable result at least: # Swap the sixth bit and seventeenth bit of a 32-bit signed integer. def swap_bits(x): # Get the bit at position 6 and 17. bit6 = x & (1 << 6) bit17 = x & (1 << 17) # Swap the bits. x = x ^ (bit6 << 17) x = x ^ (bit17 << 6) return x
- 37ef_ced3 5y agoI guess CoPilot has seen bit swapping in its Python training input but not in its Go training input. The Python code is wrong because the 17th bit is shifted up, not down. Also, the bits are shifted by the wrong amount, not up/down by 11 (= 17 minus 6), but up by 6 and up by 17. What a joke. Not only that, even if the shifts were correct, it's simply xoring the bits. The swap is completely wrong. Garbage code, total fail.
- poopsmithe 5y agoI love this!
- foreigner 5y agoIf you refresh the browser you get a different challenge. Was that intentional?
- wowokay 5y agoI think it’s great! I think most people either ignore your statement or decided to interpret it in the wrong way. For everyone else: The author made it clear that the purpose is weed out non-engineers. Practicaly there may not really be a use case there but it was never designed to replace captcha, most people wouldn’t be able to access the link, and anyone using or purchasing the use of a bot farm already meets the captcha requirements (albeit with extremely unnecessary additional steps).
- buraktamturk 5y agoIt worked only once for me (str.split('').reverse().join('') one). But this one didn't: function isOddNumber(num) { return !!(num%2); } Testing for input computer: FAILED! Expected: retupmoc | Got: undefined eval code@ eval@[native code]
- julienreszka 5y agonum % 2 != 0
- kvathupo 5y agoThis is actually brilliant. Reminds of how Headlands Technologies solicits applications: they ask for a simple C++ program printing a number. There's a C way and C++ way.
- jagger27 5y agoDoes it silently timeout on the server if I submit something malicious like this? function multiplyNumbers(a, b) { if (a == 2) { return a * b // to avoid locking up my browser :) } else { while(true) {} } return a } It's stuck on "Submitting..." on the client.
- asadlionpk 5y agoIt should yes. Although there should be an error message. Let me investigate.
- JoshuaDavid 5y agoCute idea! The checks seem to be running entirely on the client side, so for instance the following will pass all test cases function isEvenNumber(num) { return challenge.testcase[1]; } or even this[challenge.fnName] = _ => challenge.testcase[1]; Depending on the use case, though, you could just say that anyone who can use the debugger to figure out how to hack around the captcha passes the test :) Edit: oh, I see, it submits the code to be evaluated on the server after it passes on your browser (but the above causes the server to 500 at you, so it just says "Passed! Submitting..." and gets stuck in that state). Seems a bit dangerous to trust the client to control what code runs on your server, but I suppose platforms like leetcode manage it so in principle it should be possible to do safely.
- ipsin 5y agoI really like the URL-based puzzles, e.g. the 1o57 puzzle described in this walkthrough: https://web.archive.org/web/20210423041523/http://elegin.com/covid_S01E01/ https://web.archive.org/web/20210423041523/http://elegin.com...
- dorkwood 5y agoI think I stumbled across the smallest amount of characters needed to pass the first test. I placed my cursor just after 'return', began typing, and almost immediately the page unlocked. Baffled, I went back to see what I'd typed, and realized I'd gotten as far as return num > false
- moneywoes 5y agoFinally a way to get my leetcode practice in