4 ms·
That still doesn’t explain why you can’t even start typing until that check proceeds. You could condition the outbound request from being processed until that’s
by vlovich123 7mo ago
That still doesn’t explain why you can’t even start typing until that check proceeds. You could condition the outbound request from being processed until that’s the case. But preventing from typing seems like it’s just worse UX and the problem will fail to appear in any metrics you can track because you have no way of measuring “how quickly would the user have submitted their request without all this other stuff in the way”.
Said another way, if done in the background the user wouldn’t even notice unless they typed and submitted their query before the check completed. In the realistic scenario this would complete before they even submit their request.
- p-e-w 7mo agoMany cloud products now continuously send themselves the input you type while you are typing it, to squeeze the maximum possible amount of data from your interactions. I don’t know whether ChatGPT is one of those products, but if it is, that behavior might be a side effect of blocking the input pipeline until verification completes. It might be that they want to get every single one of your keystrokes, but only after checking that you’re not a bot.
- davidkunz 7mo agoIt's still possible to let users already type from the beginning, just delay sending the characters until checks are complete. Hold them in memory until then.
- miyuru 7mo agoInstagram was uploading the images while the user were adding post details, back in 2012! https://news.ycombinator.com/item?id=3913919 https://news.ycombinator.com/item?id=3913919 No one seem to use or care about their own product anymore. Only uses dashboard and metrics, which does not explain the full situation.
- AlecSchueler 7mo agoThat makes total sense from a UX perspective though, the ChatGPT thing does not.
- scottyah 7mo agothere were a lot of helpdesk chats doing the same, so you could see users typing messages, then deleting words, etc before hitting send.
- Imustaskforhelp 7mo agoThis was actually one of the reasons why Instagram felt smooth. Another thing but Facebook/Instagram have also detected if a person uploads an image and then deletes it and recognizes that they are insecure, and in case of TEENAGE girls, actually then have it as their profile (that they are insecure) and show them beauty products.... I really like telling this example because people in real life/even online get so shocked, I mean they know facebook is bad but they don't know this bad. [Also a bit offtopic, but I really like how the item?id=3913919 the 391 came twice :-) , its a good item id ]
- andai 7mo agoI wondered if ChatGPT streams my message to the GPU while I type it, because the response comes weirdly fast after I submit th message. But I don't know much about how this stuff works.
- aabhay 7mo agoLikely prefix caching among many other things
- mort96 7mo agoI just checked the network inspector, the only thing it does per key press is to generate an autocomplete list. It doesn't seem too hard to wait with the autocomplete generation until after whichever checks you run pass.
- mike_hearn 7mo agoI developed the first version of Google's equivalent of this (albeit theirs actually computes a constantly rotating key from the environment, it doesn't just hard-code it in the program!). The reason it has to block until it's loaded is that otherwise the signal being missing doesn't imply automation. The user might have just typed before it loaded. If you know a legit user will always deliver the data, you can use the absence of it to infer something about what's happening on the client. You can obviously track metrics like "key event occurred before bot detection script did" without using it as an automation signal, just for monitoring.
- fc417fc802 7mo agoThat doesn't make sense. The server would wait to process anything until after you received the signal. If it doesn't arrive within a reasonable period of time that tells you something, the same as right now. If you mean that you can infer client side tampering with the page contents you could still do that - permit typing but don't permit the submit action on the client. The user presses enter but nothing happens until the check is complete. There you go, now you can tell if the page was tampered with (not that it makes much difference tbh).
- mike_hearn 7mo agoThe typing actions have to be observed by JavaScript. It's not different to any other JS blocking page load because it's needed for the site to work, that's just how the web works.
- federicosimoni 7mo ago[flagged]
- deadbabe 7mo agoRemember you’re talking to a vibe coder who just stares at code being printed out by AI.
- mcmcmc 7mo agoThat’s a big assumption. It’s a brand new account, might be a bot. PR/astroturfing is a great use case for agentic AI
- dncornholio 7mo agoYou cannot know what verifications they use. I could argue the disabled textbox is some sort part of the verification process. Humans will click on it while bots won't.
- root_axis 7mo agoSeems like a trivially simple verification to defeat.
- YetAnotherNick 7mo agoYou can defeat all client side verification by definition if you know what verification is run.
- QEDCTrL 7mo agoSounds like anti-distillation to me. But, know what? Meh.
- mcmcmc 7mo agoI’d be inclined to agree with the “meh” if their entire product weren’t built off pirated content
- matchagaucho 7mo agoKeyboard response feels 10x slower in ChatGPT Projects (possibly for reasons other than react state).
- m3kw9 7mo agoBecause the way they have the server architecture setup and how it loads the screen. You don’t even want all the bots hitting servers