8 ms·
Just because you can technically crack them doesn't mean they're useless. There's a significant amount of time, skill and effort that went into the solution fr
by noprocrasted 2y ago
Just because you can technically crack them doesn't mean they're useless.
There's a significant amount of time, skill and effort that went into the solution from this post, and the end result doesn't generalize well (you'd have to start all over for a different kind of captcha).
The vast majority of spammers would not be able to replicate this; those who do would either make money legitimately, or focus their skills on juicier targets (if you have AI/ML skills and want to do nefarious things there are other options that pay much better than spamming).
Such captchas still work well at raising the cost of successful spamming above the expected payoff from said spam.
- deleted 2y ago[deleted]
- fragmede 2y ago> there are other options that pay much better than spamming Are there? Say you've got a felony record and can't get a legit AI/ML job at eg OpenAI/anywhere. What would you do instead? most of the options I can think of involve getting paid for doing things that are basically spam if you zoom out enough.
- noprocrasted 2y agoThere's plenty of mischief potential with "deepfakes".
- andrewflnr 2y agoHow many people are there like that, and how much damage are they collectively likely to do? If you're a random spammer, how hard will it be to hire that person? Again, not aiming for impossibility, just reducing the damage.
- TravisPeacock 2y agoI've been working for myself for over a decade doing random projects for clients while also doing my own thing. My resume looks awful and the job market is trash. If be willing to take a job as a jr developer and work my way up (or a sys admin). I used to run one of the world's largest ebook piracy websites but want to put that life behind me. Recently work came across my desk to create tens of thousands of accounts on a well respected website so they could more easily scrape it. I just want a traditional job, but I also want to support my family and $4000 for a months work
- supriyo-biswas 2y agoIf I were you, I'd probably try looking at companies working in the web scraping and reverse engineering fields, who might even appreciate the skills even if they were acquired in a, let's just say, "different" way.
- noprocrasted 2y agoThere's nothing immoral about scraping a website. Best of luck to you!
- mmsc 2y agoThe secret is knowing that companies actually want people like you, with the real world blackhat experience, because you know how the game works in practise not just theory.
- benreesman 2y agoI’ve got no criminal charges of any kind and I’d still want to know about any way to work without getting flagged as a known enemy of the Cartel. I’m lucky that some people still want chops no matter the thought crime, I’m very grateful such excellent employers exist (love you guys). But you’re never sure you’ll line up two such in a row, this isn’t the IBM until company casket and company funeral days. Makes life “interesting” even for a risk-taker.
- reaperman 2y agoSo, I do this type of AI development for solving CAPTCHAs. I can't get any real jobs that pay me for my more advanced skills. My primary sins were going to a second/third-tier university and some performance concerns in a portion of my previous roles due to divorce and burn-out. I make $80k/year in government IT, and $30-150k/year as the "AI" guy in a small 2-5 person group that offers a CAPTCHA-breaking API. The spammers aren't the ones replicating this. They just pay B2B rates (combo of SaaS + Consulting, depending on client needs) to help them remove the roadblocks.
- blackjackfoe 2y agoIs your company hiring? :)
- benreesman 2y agoIf there were a totally 100% aboveboard way to do this in a net transfer of utility from Tessier-Ashopool SA to the typical web surfer I would be a superfan.
- HeckFeck 2y agoWhy do you do this? While I can appreciate the technical achievement, you know most users of forums and imageboards don’t want any AI content at all.
- KomoD 2y ago> Why do you do this? Money, obviously. I'd also do it for $30-150k/year > you know most users of forums and imageboards don’t want any AI content at all. He's not creating or posting any "AI content"?
- HeckFeck 2y agoOkay, but you know his actions are enabling more AI content and spam to proliferate? I hardly think he is making that much money just because legitimate users don't want to fill in a captcha.
- delfinom 2y ago>he vast majority of spammers would not be able to replicate this; Eh? They just need to buy their software from someone that can. I would say many of the malware and spamware isn't created by every individual deploying it, but instead vendors that got good at it and decide to make revenue by licensing out their software to other bad actors.
- hamilyon2 2y agoCaptchas are now useful to distinguish well-intentioned bots (they stop whenever they see captcha) from malicious ones, which solve them, but still behave a lot like bots. Well-intentional bots are first-class citizens
- brookst 2y agoWouldn’t a well-intentioned bot follow robots.txt anyway?
- hamilyon2 2y agoCurl and libcurl doesn't. Wget doesn't, I think.
- account42 2y agoCURL isn't a bot, it's a tool. It can be part of a bot (which may or may not respect robots.txt) but it can also just act as a user agent directly for a human operator in which case it SHOULD just do what asked. Chrome doesn't follow robots.txt either for the same reason.
- lostlogin 2y agoDo you complete the circle and do the good bot bad bot classification with a mod bot?
- atomicnumber3 2y agoThe watershed of "good enough at programming to just get a real job" vs "can code enough to be really annoying to businesses, but not enough to hack it as a dev" is a lot more on the annoying side than you'd think. I say this with the chagrin of someone who works on a cool software product that is also coincidentally really well-shaped to make people want to abuse it.
- TZubiri 2y agoInteresting, subtle difference but I always thought of captchas as having computational difficulty, but that's clearly not the point as you say. The cost is not compute but developer time. If you manage crack it at 1mhz per captcha or 1ghz or 1000ghz, it makes no difference, as the bottleneck is the network identifier (ip address/block) While still a type of PoW, these economics are different than offline mechanisms like password hashing or crypto. Where a 1ghz cost is still significantly different than 1mhz.