Curated free-to-use space photography - <AUTHOR> http://peek.space/ <comment><USER2> Here we have a "curator" saying these photos are from "Source: NASA", but with no additional details provided. No original source or URL, no captions, no detail on cropping or manipulation, just a collection of "the best ones" he's found somewhere on the Internet. Nice to look at but lacking all context.

<comment><USER3> I agree, I would like better attribution, and possibly some context. The photos are beautiful, but with some information about what I am looking at, it would be much more interesting.

</comment></comment><comment><USER4> I'm in Germany where you can't give up your "Urheberrecht" (literal: Creator's right, equivalent to copyright) so technically NASA's (or other US government agencies) photos are copyrighted here—even if they're public domain in the US. Anybody ever looked into that?

<comment><USER5> If the person you pay to worry about that kind of stuff is worried about the risk of NASA suing you, you should probably get a better worrier. Or is there something here I'm missing?

<comment><USER6> It's not the risk of NASA suing you but the risk of the original creator suing you. As copyright can't be transferred under German law, it was never transferred to NASA in the first place from Germany's point of view. Unlikely, but might happen.

<comment><USER7> That seems really unlikely to me unless the photographer in question was a German citizen, or the photo was taken in Germany. Otherwise they would not have standing in Germany. It would come down to international copyright agreements like ACTA and I don't think those allow each nation to spread their own copyright laws over the entire globe.

But really vinceguidry is right here: the risk calculation for copyright is not just what the law says, but what is the practical likelihood of being sued under the law. This is true across the board; it's how a million blogs get away with using copyrighted photos on their blog posts.

<comment><USER6> No, the relevant law is the one where a work is published. For this you don't need to spread law around the globe. There are known cases where a work was already in public domain in the country of creation but not in Germany and the heirs successfully sued in German court.

Yes, in this case the chance of getting sued is pretty small, but it's there. See for example the US government's own statement:

> Copyright laws differ internationally. While a U.S. government work is not > protectable under U.S. copyright laws, the work may be protected under the > copyright laws of other jurisdictions when used in these jurisdictions. The > U.S. government may assert copyright outside of the United States for U.S. > government works.

[http://www.usa.gov/copyright.shtml#Exceptions](http://www.usa.gov/copyright.shtml#Exceptions)

Many German blogs stopped using copyrighted photos (at least much less use such photos than blogs in other countries do) because you are actually at risk of being sued. Some people lost quite a lot of money for doing this.

<comment><USER5> So, let's say you're in Germany running a blog. You've made a few questionable image choices and now the people owning the images decides they want to be a dick and come after you for royalties. What's your exposure here? Is it something where all you need to do is take the infringing content down and that's the end of it? Or are you potentially on the hook for monetary damages going all the way back to where you first published the images?

Don't tell me that that's a question for a lawyer, because you should know about the risks regularly taken in your industry that can produce outsized penalties. You don't become a surgeon without the understanding that surgical malpractice could ruin your career, even though it almost never happens. If you don't know, you're just being naive.

Even if you did potentially have that liability, what's the likelihood that they'll actually exercise it? Sure, the US Government will want to retain as many rights as they can, but realistically they don't really give a shit unless you make them give a shit. If your clients are putting space images up in the service of saying that the US is horrible and should be boycotted or whatever, absolutely you'll have poked a hornet's nest and they're going to assign a bureaucrat the job of making your life hell.

But if you use the damn gifts you were given in the spirit in which they're given, do you really need to let fear guide your choices here?

<comment><USER6> These cases are usually settled for a few hundred Euro, which is what a court would set anyway. As there have been quite a few trials of this kind the sums are pretty well established.

That is well known in the German blogging scene. For example, "Marions Kochbuch" is a website with cooking photos that some people say only exists to serve notices to unsuspecting bloggers that use their photos. Every few weeks a new case of someone who didn't know makes rounds in the German-speaking internet scence.

Personally I would use US government photos on my website (but not random other photos found on the web). But I know that I'd take a small risk with that. The US lawmakers specifically wanted to preserve rights abroad, who knows whether the government will actually start to enforce it:

> The prohibition on copyright protection for United States Government works > is not intended to have any effect on protection of these works abroad. > Works of the governments of most other countries are copyrighted. There are > no valid policy reasons for denying such protection to United States > Government works in foreign countries, or for precluding the Government from > making licenses for the use of its works abroad.

[http://en.wikisource.org/wiki/Copyright_Law_Revision_(House_...](http://en.wikisource.org/wiki/Copyright_Law_Revision_\(House_Report_No._94-1476\))

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> In case someone is interested, one of the most beautiful photos in this collection (parachute over the clouds) is by Bill Ingalls and is licensed under Creative Commons Non Commercial license. (so you aren't completely _free_ to use it)

[https://www.flickr.com/photos/nasahqphoto/16604583049/](https://www.flickr.com/photos/nasahqphoto/16604583049/)

It shows Soyuz TMA-14M bringing back astronauts from ISS.

</comment><comment><USER9> While attempting to view some of the full-sized images, I got an error message from Unicorn saying "No servers are available to service your request. Might I suggest using a static file host of some kind for the full sized images?

</comment><comment><USER10> Not a fan of the rounded corners/edges, but the photos are more than beautiful enough to make up for it.

</comment><comment><USER11> Another one: unsplash.com

<comment><USER12> I don't think that this is a photo:

[http://peek.space/art/peek-space-img-24/](http://peek.space/art/peek-space- img-24/)

<comment><USER13> Indeed, its an "Artist concept of Ganymede and Jupiter"[1], which only further highlights the pointlessness of having an collection of space images without any metadata.

[1]:[http://www.nasa.gov/press/2015/march/nasa-s-hubble- observati...](http://www.nasa.gov/press/2015/march/nasa-s-hubble-observations- suggest-underground-ocean-on-jupiters-largest-moon)

</comment></comment></comment><comment><USER14> Holy crap, some of these images are beyond beautiful.</comment>


Obama campaign strikes special deal with Google - <AUTHOR> http://www.politico.com/news/stories/0611/57084.html

<comment><USER2> Regardless of party, this is just not a good thing to have one of the parties up in arms about. Congressional investigations are not fun and it looks bad when you are involved in a patent auction that the government get to screen the bidders.</comment>


Write Tracking for Nim (Part 2) - <AUTHOR> https://nim-lang.org/araq/writetracking_2.html <comment><USER2> Very interesting to see this being added to the language. Definitely hits closer to the definition I would expect from "noSideEffects". Are there any plans for moving forward and hopefully out of the "experimental" phase?

</comment><comment><USER3> sorry for the ignorant question, how's nim optimizer going to benefit from write tracking? I suspect it has something to do with cursor inference (borrow checking)?</comment>


Rice University Says Middle-Class And Low-Income Students Won't Have To Pay - <AUTHOR> https://www.npr.org/2018/09/18/649160232/rice-university-says-middle-class-students-wont-have-to-pay-tuition <comment><USER2> I wonder what the distribution of parental income is of the students at Rice that they can offer such generous grants. Even with a household income between $130-200k, they're offering at least half off tuition. An income of $200k+ is well over the 90th percentile of households.

<comment><USER3> Roman Mars talked about this with another Ivy League where they offered free tuition. It ended up affecting a single digit amount of students.

<comment><USER4> Rice is not an Ivy League school. It is an academically great institution though!

<comment><USER5> Not technically but it's tuition surely is reaching those heights.

</comment></comment></comment></comment><comment><USER6> Why does seemingly every university rolling out these sorts of plans set hard cutoffs instead using a simple equation for doling out aid? Under the current plan, if your family makes $130,000/year, you go for free. But if you make $130,001/year, you pay thousands? It's so absurd.

<comment><USER7> Give $2 to non-profit or political campaign. Your income is $129,999. Better?

This sort of horse trading happens everyday in our tax system.

<comment><USER6> No, that's asinine and not better at all since it doesn't address the problem.

</comment></comment></comment><comment><USER8> When there are reports about these programs, they only talk about income. The Rice site doesn't mention this either, but do they only look at income and not savings that families might have?

<comment><USER9> They include assets but not retirement funds.

[https://financialaid.rice.edu/rice-investment- faqs](https://financialaid.rice.edu/rice-investment-faqs)

</comment></comment><comment><USER10> Kudos to Rice for this one.

FWIW, I took a game programming MOOC from Rice. (I knew nothing of game programming going in.) It turned out to be a great experience, I really enjoyed it.

Thanks, Rice!

</comment><comment><USER11> Besides access to education, is there much that can lift the quality of life for generations than meaningfully transferable education to a career path.

Having access to meaningful, transferable and applicable education (one that can be equally applied without a huge saddle of student debt) is a life changer, less so for those who already enjoy privilege and access to opportunity.

</comment><comment><USER12> A huge problem I find with financial aid policy at many educational institutions, from elementary school all the way to university, is that the aid is often cut off at a specific threshold. For instance, if you are making $149,999 a year, you might qualify for $20k financial aid. But if you are making $150,000, you get none. So the two families with nearly identical situations are given grossly different treatment.

I don't understand why it's not a continuous scale that just approaches zero at a certain point, rather than these hard cut-offs.

edit: just saw that someone else made a similar comment. Mine is referring to education in general and not the article specifically, and in fact I have personally run into this situation. It seems that educational institutions would be by definition smarter about how they handle this.

<comment><USER13> Well you could make it a ratio of:

[your income]/[maxincome] * [MaxFinancialAid]

But then you would end up with situations where people can borrow $500 which is useless. So they just allow it up to 150k and then make it a hard cut off as they feel that anybody who makes that much should absolutely be able to pay, and the administration costs of loaning < 10k could be a waste of time lets say.

<comment><USER12> But $500 is still a lot to a family who's margins are very tight. Or $2000 for a family that is closer to the threshold.

<comment><USER13> Nobody would administer a loan for $500 though, the juice isn't worth the squeeze for financial institutions

</comment></comment></comment></comment><comment><USER14> This is interesting, and I think it may explain why so many members of my own family growing up (and now) have gone to University of California schools.

This article from the NYTimes really drove it home: Top Colleges are Cheaper Than You Think (Unless You're Rich).

[https://www.nytimes.com/interactive/2018/06/05/opinion/colum...](https://www.nytimes.com/interactive/2018/06/05/opinion/columnists/what- college-really-costs.html)

The data is very interesting. They analysis breaks down family income into different socioeconomic categories, poor, lower-middle, middle, upper-middle, affluent, and very affluent.

Well, it turns out the analysis is largely correct - there is substantial reduction in costs for all but the last two categories, "affluent" and "very affluent."

But look at the graph - it's fascinating. There's a meaningful break for every income, but very little difference between what the "Affluent" (family income $186k) and "Very Affluent" ($246k a year).

If you look at the graph, there's a big drop in what you pay below affluent, but "affluent" and "very affluent" pay roughly the same amount.

Here's the thing - that's true at publics as well as privates, but top publics max out at about half the rate of a private (the only one considered here is university of Virginia, UC schools are left off, not sure why). In other words, even if you pay full freight, there's a limiting factor to total costs. The pattern of what various economic groups pay as a percentage of max is the same for UVA and more expensive privates like the ivies, it's just that the whole thing is compressed into a 0-30K/year range instead of a 0-75k/range.

I think that this upper limit appeals immensely to people in the "affluent" but not "very affluent" category. Because they'll be paying "full costs", but are still limited in resources compared to the "very affluent" group, the actual upper limit ends up mattering a great deal.

I grew up in that economic band (affluent but not very affluent), and want to be sure I'm clear on this, "Affluent" as defined here is most definitely not an oppressive place to be from. Actually, it's harder now, in my day (grew up in the 1970s), the equivalent of affluent had no trouble buying a pleasant 3-4 br house in nice if unfashionable part of San Francisco (now: no)

But it does mean 3 kids at an ivy may be cost prohibitive, even for an "Affluent" family. UC schools (or UVA or others), on the other hand, have an upper limit (we were all in state) that makes it more possible. In short, state schools work as equalizers between the affluent and very affluent.

</comment><comment><USER15> Why is financial aid tied to family income? Why isn't it granted in order of merit?

Under the current system, if the most meritorious student's family makes over $130K, he/she is saddled with debt, regardless of how good he/she is.

<comment><USER16> It should be pretty self-evident why financial aid is tied to family income: to equalize opportunity.

<comment><USER15> No - this isn't equal opportunity, it's equal outcome. The outcome mandated is college admission.

True equal opportunity would grant aid on a merit system. Unless your argument is that familial wealth impacts merit, which I'd like to see evidence of, it's the fairer way to administer aid.

<comment><USER17> > Unless your argument is that familial wealth impacts merit, which I'd like > to see evidence of, it's the fairer way to administer aid.

There's just assloads of studies showing high correlations between familial wealth and pretty much every measure of academic success we have ("merit", in your parlance).

I mean just searching "wealth impact test scores" on Google returns like 20 results that'll give you the evidence you're looking for.

<comment><USER15> Ah, so you routinely do not hire the _best_ candidate for a job at your company? Mind you, "Best" doesn't necessarily mean code-ninja, just the overall best-fit (behavioral, experience, academic, ...) - you know what we all call "merit".

Or are you saying your definition of "best" includes familial fiances of the applicant? Why doesn't [https://www.headlightlabs.com/](https://www.headlightlabs.com/) include applicant's finances as a parameter?

<comment><USER17> It seems like you're more interested in arguing semantics and defending your viewpoint than having an actual discussion, so I'll leave you to it.

Definitely feel free to point me to the studies showing familial wealth has no effect on whatever "merit" might mean to you, though. I've shown you how to find plenty to the contrary.</comment></comment></comment></comment></comment></comment>


Why Having Projects Can Improve Your Life - <AUTHOR> http://sirdg.com/2011/01/why-having-projects-can-improve-your-life/

<comment><USER2> Nice. I've always thought the same, however I put it down to 'focus'. Having focus in life for different goals, really makes you work for it.

</comment><comment><USER3> I totally agree. I started working on a side project 2 months back and I feel great. It even increased my productivity at my day job.</comment>


10 Mac Apps I Can't Live Without - <AUTHOR> http://carsonified.com/blog/work-smarter/10-mac-apps-i-cant-live-without/

<comment><USER2> Instead of using 'Witch' to command+tab between windows and apps, I actually find the built-in method of switching far easier to use: Command+Tab switches applications, Command+` switches windows within an app. And bundled with my probably favorite OS X shortcut to un-minimize windows[1], I don't see a need for added utilities.

[1] If you Command+Tab into an application that's minimized, it won't be restored, unless: Command+Tab into the minimized application, and while holding down Command, press Option, and then let go of Command; your window will spring back to life. This sounds and feels awkward at first, but quickly becomes second nature. (I use my left hand thumb+ring finger to Command+Tab, then I just move ring finger from Tab to Option, and let go of Command)

<comment><USER3> It's really a shame that OS X doesn't have a consistent shortcut for switching tabs. It's ctrl+tab for Safari but not Terminal. – edit: scrap that, only true for at least those using German keyboard layouts, not everyone using US keyboard layouts (and others?)

(Cool thing, though, for all these commands is that you can simply switch direction by throwing in shift.)

<comment><USER2> It does have a consistent shortcut: Command+{ and Command+}. Works in every app that has tabs.

<comment><USER3> Sorry, I'm using a German keyboard. Didn't actually think of that – the German keyboard layout seems to get you inconsistent shortcuts.

(Now I know why the terminal has those weird command+Ö and command+Ä shortcuts, Ö and Ä are presumably where { and } are when you use the US keyboard layout. Those pesky umlauts. By the way, { and } are alt+8 and alt+9 – also where the normal brackets are when using shift – on a German keyboard. Oh, and command+Ö or command+Ä totally don't work in Safari. You have to use ctrl+tab.)

<comment><USER4> My friend is using a German keyboard on his MBP. He is thinking about buying a wired Apple English keyboard and exchange all the key caps with the MBP and then use English keyboard. Not sure if this will work, but then the keys will be white instead of the default black ...

</comment></comment></comment></comment></comment><comment><USER5> > If the original title begins with a number or number + gratuitous adjective, > we'd appreciate it if you'd crop it. E.g. translate "10 Ways To Do X" to > "How To Do X," and "14 Amazing Ys" to "Ys." Exception: when the number is > meaningful, e.g. "The 5 Platonic Solids."

<http://ycombinator.com/newsguidelines.html>

It's okay to downmod me for getting too meta. Just thought I'd throw that out there.

</comment><comment><USER6> I would add MultiClutch to the list [http://wcrawford.org/2008/02/28/everytime-i-think-about- you-...](http://wcrawford.org/2008/02/28/everytime-i-think-about-you-i-touch- my-cell/). It allows you to define custom gestures for any application. I was thinking of switching to jitouch <http://www.jitouch.com/>. Anyone know how they compare?

<comment><USER7> I haven't tried MultiClutch, but from what I can find on the web, it looks like it lets you re-define what the built-in gestures do. This is fairly useful, although it has the downside that apps that are designed with the multitouch gestures in mind lose that functionality.

jitouch doesn't change any of the built-in gestures; it just adds a bunch of new ones, and lets you configure those. I find this to work quite well, because many of the gestures (both the standard ones and the jitouch ones) are very intuitive defaults. (eg. the pinch zooming and the rotating. Re-defining these seems like a kludge.) Now that jitouch lets you define character-based gestures, such as drawing an S with two fingers to perform the equivalent of cmd-S (Save), you can get your touchpad to do a lot of stuff without needing to resort to esoteric gestures.

<comment><USER8> BetterTouch is a good too, it's pretty active development as well.

</comment></comment></comment><comment><USER9> Pixelmator. It's amazing, it's like Photoshop only $600 cheaper and I think it even has a better user interface. Can't live without it.

<comment><USER10> I'm a fan of Acorn myself, but the suitable-for-most-uses Photoshop alternatives that have cropped up over the past few years are great.

</comment></comment><comment><USER11> These sort of lists always kind of amaze me. I don't think I use 10 mac apps total. Chrome, iTerm, Mail, iCal, Adium, Twitterrific, iTunes, uh...Unix? I guess that last one is kind of a multi-parter, but still.

Are the apps in the article addressing problems that don't really exist, or will I just put up with anything?

</comment><comment><USER12> I'm a big fan of Sequel Pro (mentioned in the comments), and use it daily.

<http://www.sequelpro.com/>

I'm waiting for a high quality MongoDB GUI to take its place though ;)

</comment><comment><USER13> As I posted at the OP:

My essentials: \- SizeUp + Cinch \- TextMate \- Quicksilver \- iStat menus \- TextExpander \- The Unarchiver \- Growl \- Perian \- Movist

Also, for webdevs: \- WebKit nightly \- ImageOptim \- Colors.app \- Transmit \- xScope \- CSSEdit \- Sequel Pro \- Changes.app \- Reggy \- GitX

<comment><USER10> Curious, any particular reason for colors.app vs Digital Color Meter?

<comment><USER13> The Custom Formats. Colors.app can both input and output color values in multiple formats (Hex, RGBA, HSL... you can even create your own), making much easier working with colors between Photoshop and CSS.

It's basically a nice interface for the system color picker.

I discovered this app not long ago in one of the comments in the following article; which covers other little gems too, definitely worth reading if you're into front-end design:

[http://www.macstories.net/reviews/spot-color-use-mac-os-x- co...](http://www.macstories.net/reviews/spot-color-use-mac-os-x-color-picker- as-a-standalone-app/)

(sorry about the delay, it's hard to keep track of conversations here! :)

</comment></comment></comment><comment><USER14> There's an iphone simulator that comes as part of newer versions of xcode that's a much better environment for testing how web pages will work on the iphone. Things like touch events and the semi weird float behavior didn't work in iphoney last time I tried (admittedly 2007).

</comment><comment><USER15> There's a 25% discount for Path Finder right now. The discount code is LADRUPAL and it will work until the end of April, 2010. Read more about the deal at <http://knurl.us/url/66zpaut>

</comment><comment><USER16> Yup, I use just about all of those. Also: <http://blog.tlrobinson.net/post/360281269/installation-log>

</comment><comment><USER17> > Caffeine – When activated stops your Mac going to sleep! Great for > presentations or watching your "on demand" TV shows.

Seriously, you need an app for that?!

<comment><USER18> Seriously - I do! It's great. I can leave my preference settings alone and conserve my power & screen life with a single click on the mac bar. Plus you gotta love the little coffee cup that switches between empty and full. :)</comment></comment>


Ask HN: Once and for All - <AUTHOR> If you could research 'controversial' topics, what would they be? Things that are always debated but can be proven with data (let's assume the data is out there). Ex: global warming <comment><USER2> Ah! Just got into the life after death topic... what is our life on Earth about. And really this is controversial. It started when I read this book just last weekend, hasn't slept much since that, try to gather information and I'm getting mind-blown at every step. The book is Journey of Souls ([https://www.amazon.com/Journey-Souls-Studies-Between- Lives/d...](https://www.amazon.com/Journey-Souls-Studies-Between- Lives/dp/1567184855/ref=asap_bc?ie=UTF8))

There is a good summary on Youtube: [https://www.youtube.com/watch?v=Lzwle9gjC2E](https://www.youtube.com/watch?v=Lzwle9gjC2E)

<comment><AUTHOR> honestly, I don't think there is any data on that. unless someone has come back from the dead.

also this can take several definitions! depends on how you want to define the _measure_ or maybe the research itself is finding that meter stick itself

</comment></comment><comment><USER3> The data might be out there but it doesn't mean less informed people will ever agree with you and no amount of data or reasoning can ever change their minds.

A better question would be, in this context, why research 'controversial' topics? If it's in hopes of persuading people to your point of view it seems like it'll be a futile effort.

<comment><USER2> Or because some people have personal believes, or simply cannot comprehend some phenomenons - by studying the topics you would 'demystify' them and explain them in a cartesian way to the general public

</comment></comment><comment><USER4> Edit: I missed the "but can be proven with data" part of the OP. I'm not sure if any of the questions I ask here can be proven with data, I have no idea how to tackle any of these questions to begin with. Regardless, I think it's very interesting so I'll leave it here, especially because of the other post mentioning life after death.

Consciousness and everything related to it. Lucid dreams, the effect that different drugs have on consciousness, ranging from coffee to hallucinogenics, the space of human qualia.

Would it possible to add a new dimension to our conscious experience, for example, our best model of human color space is CIELAB, it has three dimensions, L, meaning lightness, A, where negative values indicate green while positive values indicate magenta and B, where negative values indicate blue and positive values indicate yellow, what if we could add another dimension to our color-space?

What would it take to measure qualia/conscious experiences, or, are they really "private" as Daniel Dennet claims?[1]. What would it mean for a human if we could "engineer" their consciousness.

What is the role of consciousness within the human brain?

Are non-humans conscious? Or, does consciousness exist outside of humans? Are dogs conscious? What about worms? Ants? Bacteria? Viruses? What about the USA? ([https://www.physicalism.com/](https://www.physicalism.com/))

How can you objectively determine that "something" is conscious?

Was consciousness "recruited" by evolution? Just like how electricity was "recruited" by evolution, meaning it was naturally occurring before, but manifests itself in a far more complex way, being one part of a gigantically complex biological machine?

Is it possible to "share" or "conjoin" multiple consciousnesses? What are the ethical implications of something like this? Should judges be allowed to go "inside the heads" of victims, the defendant and witnesses?

I could go on for a while. I think the implications of finding answers to some of these questions would be unimaginable. I don't think any of this is feasible within the coming few hundred years, but perhaps we'll make some progress.

[1] private; that is, all interpersonal comparisons of qualia are systematically impossible.

<comment><AUTHOR> although all very ... thought provoking ;) questions, like you said, finding data on these would be a feat

i think there are several topics out there than can be tackled with data. we're just too lazy (or the data is extremely hard to find)

</comment></comment><comment><USER5> The link between intelligence and genetics, and the genetic manipulation required to enhance it.

<comment><AUTHOR> hmm, interesting. you mean if there are any genetic markers that show intelligence? also (this is probably more important), how do you measure intelligence in this case?

<comment><USER5> IQ, there has been some controversial research that pops up from time to time. It gets really controversial once race is added to the mix.

<comment><AUTHOR> yeah I was going to say IQ but based on simple readings, there's better ways maybe?

also, could always use all of the meter sticks and see if there is a trend there. the more the meter sticks the better</comment></comment></comment></comment>


Judge shuts door on attempt to get a new trial for Ross Ulbricht - <AUTHOR> https://arstechnica.com/tech-policy/2018/02/judge-shuts-door-on-attempt-to-get-a-new-trial-for-ross-ulbricht/?comments=1 <comment><USER2> Ulbricht's trial seemed like a show trial to me. He may actually have done what the government alleges, but the weird, unlikey presence of _2_ federal agents performing their own crimes with Silk Road's assets calls the whole thing into question. Reasonable doubt, and all that, eh?

[https://motherboard.vice.com/en_us/article/8q845p/dea- agent-...](https://motherboard.vice.com/en_us/article/8q845p/dea-agent-who- faked-a-murder-and-took-bitcoins-from-silk-road-explains-himself)

[https://www.nytimes.com/2015/03/31/nyregion/silk-road- case-f...](https://www.nytimes.com/2015/03/31/nyregion/silk-road-case-federal- agents-charges.html)</comment>


Image to HTML Converter (clever, but useless) - <AUTHOR> http://neil.fraser.name/software/img2html/

<comment><USER2> would be great, except there's already Canvas <http://en.wikipedia.org/wiki/Canvas_%28HTML_element%29>

</comment><comment><AUTHOR> "View Source" was good for today's laugh.</comment>


Ockham's razor aka Law of Parsimony - <AUTHOR> https://en.wikipedia.org/wiki/Occam%27s_razor <comment><AUTHOR> If you need to choose between multiple solutions, the simplest one should be considered first because it will be easier to test it (falsifiabilty criterion).</comment>


Never-Ending Niches - <AUTHOR> https://stratechery.com/2020/never-ending-niches/ <comment><USER2> I think that, while he is right that the upper-right corner of his chart is tending towards infinity, it is only a tendency or trend and not the current position. Maybe, eventually, we will actually hit the bottom and make most of that content free forever for everybody, but right now we are still racing towards the bottom.

At the end, he says that geography follows business models, but that's not right at all; geography is the thing that doesn't change much, and business models are the things that change a lot.</comment>


Anti-capitalist thinker Immanuel Wallerstein dies at age of 88 - <AUTHOR> https://en.mehrnews.com/news/149571/Famous-anti-capitalist-thinker-Immanuel-Wallerstein-dies-at-age <comment><AUTHOR> A less established though more complete and descriptive source is this blog entry:

RIP Immanuel Wallerstein — "This is the end; this is the beginning"

[https://economicsociology.org/2019/09/01/rip-immanuel- waller...](https://economicsociology.org/2019/09/01/rip-immanuel-wallerstein- this-is-the-end-this-is-the-beginning/)

<comment><AUTHOR> And a recent (2017) KPFA interview with Immanuel Wallerstein, audio:

[https://archives.kpfa.org/data/20170412-Wed1200.mp3](https://archives.kpfa.org/data/20170412-Wed1200.mp3)

[https://kpfa.org/episode/against-the-grain- april-12-2017/](https://kpfa.org/episode/against-the-grain-april-12-2017/)</comment></comment>


Ask HN: where do you host your most critical email addresses? - <AUTHOR>

Our support email setup is, I suspect, fairly typical. A main inbound address (a) keeps a copy, and (b) forwards the email to our helpdesk.
We turn off spam filtering on that address, because we absolutely, positively must ensure any email sent there makes it to our helpdesk. Any filtering/re-routing we do is done within the helpdesk system.
After our first round of evaluations, we chose Rackspace, and initially it seemed good... near-instant delivery and forwarding, quick support, modest pricing.
But during live usage, after auditing our "kept copy" archives with what got forwarded to our helpdesk we found that Rackspace does NOT reliably forward all email. (Even with spam filtering 'off', they still scan everything and if their filter says it's spam they do NOT forward it to your helpdesk. Worse, Rackspace also fails to mention the critical facts that 'off is not off' and 'forward only happens sometimes' on ANY of the configuration screens.)
Does anyone have a recommendation for a hosted email system that is reliable, responsive, and has the ability to ensure everything does in fact get forwarded properly? <comment><USER2> Self administred DigitalOcean VM. However, I'd be interested in hearing what others are doing as well</comment>


SEC Approves Overstock.com S-3 Filing to Issue Shares Using Bitcoin Blockchain - <AUTHOR> https://bitcoinmagazine.com/articles/sec-approves-overstock-com-s-filing-to-issue-shares-using-bitcoin-blockchain-1449539558 <comment><USER2> "The t0 platform is built utilizing colored coin technology, which allows for fractions of bitcoin to be used to track ownership of many assets besides bitcoin. For example, a colored coin could be used as a token to prove that an individual owns shares of Overstock. This technology is built on top of the Bitcoin blockchain and is secured by the distributed public ledger."

Sorry, I don't understand a thing about bitcoin*, but doesn't this mean that the company is free-riding on the distributed structure? Yeah, I get that anyone who trades bitcoins consumes a share of the network's processing power (and pays for it), so is overstock's system just a variant of this process? And how can a developer independently change how the blockchain works?</comment>


Yep and OpenTable join to increase user experience  - <AUTHOR> http://bits.blogs.nytimes.com/2010/06/03/yelp-and-opentable-join-forces/?ref=technology

<comment><USER2> "join to increase user experience"? While I'm sure it will the headline makes it sounds like they are doing some sort of humanitarian project. The NYTimes headline is much better</comment>


Ask HN: How do you manage all your online passwords? - <AUTHOR> <comment><AUTHOR> I believe we all have many online accounts - I, for example have an online bank account, credit cards, paypal, twitter, amazon, ebay, facebook, gmail, various forums, skype, apple id, even hacker news, and many, many more...

Using the same password for all your accounts isn't really possible because of different site limitations, not to mention the security risk you're taking. So I wonder how you manage all these passwords and keep track of them all safely...

<comment><USER2> [http://lastpass.com](http://lastpass.com) with google authenticator ([https://en.wikipedia.org/wiki/Google_Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator)).</comment></comment>


Color matters - <AUTHOR> http://mediazeal.com/colorthemes.html <comment><USER2> That seems like a clever way to get web design clients -- a new definition of "color scheme". :)

For other schemes, I recall having fun with Adobe's color scheme generator Flash applet:

<http://kuler.adobe.com/></comment>


The Climate Renegade - <AUTHOR> https://www.vox.com/the-highlight/2019/5/24/18273198/climate-change-russ-george-unilateral-geoengineering <comment><USER2> The world was outraged at one man dumping 100 tons of iron sulfate into the ocean? Where was the outrage at dumping 9.575 billion tons of CO2 going into the atmosphere that year [1]? Where was the outrage at Exxon spending $12,970,000 on lobbying that year [2]?

The problem is the idea of one person geoengineering the climate. But we've been doing that unintentionally for decades already at an enormous scale. What would the response have been if a dump with the same material had happened, by accident, with no intentions of any climate impact? I think the world would be better off with climate vigilantes doing what they can to fix the climate than everyone passively waiting for world governments to act and behaving in incredibly confined nearly useless ways (like putting your plastic bottles in the recycling container).

[1] [https://www.co2.earth/global-co2-emissions](https://www.co2.earth/global- co2-emissions)

[2] [https://www.opensecrets.org/lobby/clientsum.php?id=D00000012...](https://www.opensecrets.org/lobby/clientsum.php?id=D000000129&year=2012)

<comment><USER3> > I think the world would be better off with climate vigilantes doing what > they can to fix the climate.

I don't think I agree on that point. A small group of people with good intentions can do a lot of damage. See, for instance, all the attempts to introduce X alien species to a new environment to help with problem Y, and it turns out X likes its home a little too much.

I absolutely agree with your first paragraph though, and the crux of your point.

</comment></comment><comment><AUTHOR> There's also [https://psmag.com/social-justice/battlefield-earth-can- anyon...](https://psmag.com/social-justice/battlefield-earth-can-anyone-stop- man-will-try-just-anything-fix-climate-78957).

</comment><comment><USER4> How is this any different from artificially putting nitrates into soil for crop fertilization?</comment>


Facebook SDK 3.0 Beta for iOS - <AUTHOR> https://developers.facebook.com/blog/post/2012/07/11/facebook-sdk-3-0-beta-for-ios/

<comment><USER2> Interesting strategy. They're pulling out profile, place, friends views into an SDK. Looks like they are going to try to be THE profile view, place view, and friend view for each App on your phone.

</comment><comment><USER3> Are they using this SDK in the Facebook iOS app? If so the ratings don't speak too highly of the SDK. If not why not?

<comment><USER4> I recently wrote a blog post about the Facebook iOS app that may answer some of your question: [http://www.cocoacontrols.com/posts/2012/07/06/a-primer-on- hy...](http://www.cocoacontrols.com/posts/2012/07/06/a-primer-on-hybrid-apps- for-ios)

As for the rest of it, I'm guessing the answer is "maybe, but not in the currently available version of Facebook for iOS."

</comment></comment><comment><USER5> I'm happy to see that many occurrences of the word "native."</comment>


Massive SQL injection attack making the rounds—694K URLs so far - <AUTHOR> http://arstechnica.com/security/news/2011/03/massive-sql-injection-attack-making-the-rounds694k-urls-so-far.ars <comment><USER2> If you're worried about SQL injection in your applications there are several steps you can take.

Firstly, you should periodically scan your app. Both Burp Suite[1] and Netsparker[2] have free versions of their excellent tools. Burp Suite Pro comes with a very capable scanner and is about $250 (£175). Netsparker Community Edition is a fairly good automated scanner, but it doesn't cover all forms of SQL injection and the full version is quite expensive.

Running Wordpress? Head to Sucuri[3] and get your wordpress scanned. If you haven't upgraded already, now's the time.

Once you've done that, things vary according to your language and platform. Generally OWASP[4] is the font of (almost) all knowledge. You can test the app but if you wrote it you're probably more familiar with the code, so looking at how you handle user-supplied input and applying consistent changes where needed is probably your best bet. If you get really stuck, there are plenty of security geeks on HN, or alternatively you can drop me an email (address in my profile) and I'll see if I can answer your question. Alternatively if you're in London, come to DC4420[5] next month, there's going to be about 200-300 security geeks there, many of whom would be happy to help with specific questions in exchange for a beer. I'll be one of them.

[1] - <http://www.portswigger.net/>

[2] - <http://www.mavitunasecurity.com/>

[3] - <http://www.sucuri.net/>

[4] - [http://www.owasp.org/index.php/SQL_Injection_Prevention_Chea...](http://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet)

[5] - <http://www.dc4420.org/>

</comment><comment><USER3> These attacks are against MS SQL servers, more specifically XD Link Manager, and seems to be coming from Russian IPs: [http://forums.asp.net/p/1667041/4360932.aspx/1?Re+LizaMoon+a...](http://forums.asp.net/p/1667041/4360932.aspx/1?Re+LizaMoon+actack+who+know+about+this+)

<comment><USER4> No, they're against everyone:

 _The attack appears to be indiscriminate in its targets, with compromised machines running ASP, ASP.NET, ColdFusion, JSP, and PHP, and no doubt others._

RTFA.

And linking to random n00bs chatting in the asp.net forums is not evidence. Obviously they're only going to be talking about MS.

<comment><USER5> Unnecessarily harsh IMO. You can run all of those with an MSSQL backend FYI.

</comment></comment></comment><comment><USER6> Been watching this sucker for weeks.... it's pretty persistent but pretty dumb - keeps hitting servers that don't actually have any SQL or other backend storage at all... so I just let it hammer away (I figure if it's wasting it's time on me, it's not hurting someone else)

<comment><USER7> how/where are you watching it?

<comment><USER8> presumably looking for ur.php in the logs I would imagine.

      SQL injections following this pattern appear to have been happening off and on for six or more months now. The domain name hosting the JavaScript changes each time, but the file name—ur.php—and the style of injection remain consistent. The actions of the scripts have been similar too; pop-up windows and malware downloads. Previous efforts were on a much smaller scale, however: hundreds of compromised URLs instead of hundreds of thousands. In these earlier cases, the attacks originated from IP addresses in eastern Europe and Russia.

</comment></comment></comment><comment><USER9> [http://www.google.com/#q=%22%3Cscript+src%3Dhttp://lizamoon....](http://www.google.com/#q=%22%3Cscript+src%3Dhttp://lizamoon.com/ur.php%22&hl=en&prmd=ivns&ei=JrSVTbf4N_PRiALKlsjuCA&start=300&sa=N&bav=on.2,or.r_gc.r_pw.&fp=fd1a2cf87d4138e7) Page 31 of about 631,000 results

vs

[http://www.google.com/#q=%22%3Cscript+src%3Dhttp://lizamoon....](http://www.google.com/#q=%22%3Cscript+src%3Dhttp://lizamoon.com/ur.php%22&hl=en&prmd=ivns&ei=37GVTfq2ObHPiAKL14mdCQ&start=990&sa=N&bav=on.2,or.r_gc.r_pw.&fp=fd1a2cf87d4138e7) Page 41 of 403 results

"The "number of results" count that Google gives when you search is clearly fabricated." <http://blog.xkcd.com/2011/02/04/trochee-chart/>

If you click to include omitted results, the number of results stays at 631k when you get to the last page they will show you.. (1000 results max) Though I don't think it would be hard to imagine that the actual number is far fewer.

Edited several times.. I don't post often...

</comment><comment><USER10> I've seen a spike in my error log the past 2 weeks of SQL injection tries on my login/signup pages.

Seems they were going after low hanging fruit based on my logs and the syntax they were using.

</comment><comment><USER11> 1\. Don't hand-write boilerplate SQL but use a library (CLSQL, JPA) where possible.

2\. Use parameterized queries rather than pasting strings together.

3\. There is no step 3. Seriously, it's not hard.

</comment><comment><USER12> It sounds more like cross site scripting to me than SQL injection. In SQL injection you try to coax a database engine into performing a previously unintended action by carefully crafting content that is part of a query.

If this attack works by storing the data in the original (intended) field and just happens to bypass the JavaScript filters then it's XSS and not injection.

</comment><comment><USER13> Hmm, "indiscriminate SQL injection attack" seems like a paradoxical concept to me.

<comment><USER14> It's fairly easy to find the low-hanging SQLi vulns on a site automatically, but automatically exploiting them is tough. How do you know where you are in the query, what table/fields to modify/insert into, etc? I'd love to take this apart and figure out how it works.

</comment></comment><comment><USER15> April fools?

</comment><comment><USER16> Any info on what exactly the exploit does and which databases are targeted? I'm impressed that an indiscriminate injection attack is so successful on a wide range of websites.

<comment><USER17> Exactly. I'd like to know how to check my personal site and some of our sites at work to see if they are vulnerable or not.

<comment><USER15> Do they use prepared statements? If not, they are almost certainly vulnerable.

<comment><USER15> Look I am not trying to start a flamewar here, but if his code is developed without knowledge of sql injections then they are almost certainly vulnerable.

It is almost impossible to fuck up prepared statements, so although they take longer to write it is a good way to secure a website.</comment></comment></comment></comment>


Google accused of YouTube 'free ride' - <AUTHOR> http://www.ft.com/cms/s/2/8f5d6128-4400-11df-9235-00144feab49a.html?ftcamp=rss

<comment><USER2> These people operate on some sort of bizarre moon logic. Youtube doesn't "eat up your ISP's bandwidth", your _customers_ eat up your ISP's bandwidth by _using Youtube_.

If electricity usage followed the same argument as they give, power plants would be at fault for their electricity being used.

Of course, your customers can't always easily be extorted for hundreds of millions of dollars, while (they think) Google can.

<comment><USER3> Problem is that ISPs hate it when you actually use bandwidth.

I got an email from my ISP - BT, to say that I'd used 80GB of transfer for March, and that if I went to 100GB, I'd have my speed capped for the next 30 days. This is on their (and I quote) "UNLIMITED" plan. bleurgg

<comment><USER4> Years ago, I saw lots of "unlimited" cell phone plan commercials in London, every single one being subject to "fair use". How come it's that common in the UK? I think there are close to none "fair use" plans in e.g. Germany. Why the local differences?

<comment><USER3> I think "unlimited" is just a word that gets people to buy something. It's not economical to actually offer something with unlimited anything. Even if you buy a dedicated server with "unlimited" transfer, it'll be limited by the connection speed - eg 10mbps uplink "unlimited bandwidth" works out at less than 5TB total transfer per month.

Same with the magic word "free". You'll often see that used such as "free mobile phone (small print: when you sign up to a contract at £19/month)" etc.

Are there _true_ unlimited plans in Germany that aren't subject to _any_ limits then?

<comment><USER5> This is what at&t/apple does with their 'unlimited' iphone subscription. It might be unlimited but they try their best to stop you from using any actual bandwidth (tethering etc.)

Google has had to take a lot shit lately from non free speech and non free market ideologies.

</comment></comment></comment></comment></comment><comment><USER6> "Some European telecoms groups fear Google will reduce them to "dumb pipes"" : yes Google, PLEASE do us that favor. Telecom's business should be to transport bits from point A to point B, nothing more, nothing less.

</comment><comment><USER7> News Flash: telecom company whines "Our customers pay us every month to allow them to connect to YouTube, but YouTube is owned by Google, who is rich, and Google isn't paying us anything on top of what our customers pay us. Boo hoo hoo!"

</comment><comment><USER8> I believe this is more related to some of the peering relationships Google currently has. While it was a good idea to peer with Google in the past to benefit your customers, right now they are probably upset that their free peering arrangements are putting quite a bit of stress on their networks and it is quite understandable to want to start charging some money.

<comment><USER9> This is quite a good argument. If they have entered into a peering agreement then Google is freeloading off their services. However, an agreement is an agreement and the telco can't just pussy out because it's turned sour for them

<comment><USER10> Then they should cancel the peering agreement and pay transit charges to reach Google...and also reduce the quality of service that the customer receives when watching Youtube. Most peering agreements are relatively informal anyway.

For the larger providers reaching Google through transit routes, such transit would jeopardise other peering relationships which rely on traffic being balanced.

</comment></comment></comment><comment><USER11> Aren't the telecoms hitching a free ride? I mean we all upload our videos to YouTube and Google so graciously hosts them for us, but the telecoms get to charge fees to their customers who want to watch these videos. Google should ask for some compensation for providing the content the telecoms need in order to sell their services.

Here are some quotes that have been changed to reflect the same logic applied the other way:

"These guys _[telecoms]_ are using the content and they don't pay anybody."

"Let's see the development of digital society in terms of the winners and the victims. And today, there is a winner who _are the telecoms_. There are victims that are content providers, and to a certain extent, _YouTube_. We cannot accept this."

*Bolded items have been changed.

Honestly, that's the same logic being used in the opposite direction. I could do this with almost every quote in that story.

</comment><comment><USER12> I read the paper version of this and the other articles on the page had a similar bizarro-world quality to them. It took some time to see some logic to the ISP POV, which I think the article doesn't do justice.

Forget for a moment any notion of fairness or the traditional arrangement of customer > ISP > Internet as a whole. Take a look at the arrangement in terms of value transfer (give) and extraction (take).

The consumer-oriented ISPs give network connectivity (and maybe some other ancillary services such as an email account, anti-virus, NNTP, etc.) and take money from customers.

Google gives content (search may be more important to users, but content such as video is the focus in this case) and takes eyeballs on ads.

There is no formal connection between Google and the ISPs. There are two important informal connections: 1. Without Google (or other similar entities), the product of the consumer oriented ISP would be much less valuable to the customer. 2. Without the ISPs, Google has no way of giving its content or taking its eyeballs on ads.

At present, the ISPs perceive an asymmetry in revenue between [them and the consumer] and [Google and the consumer]. They are interested in connecting the dots from Google to the ISP in a more formal way. The only question is who has more to lose by pursuing their point.

Google can't take value from the customer without the ISPs. The ISPs' will offer less value to the customer without Google. Will an ISP without Google provide enough value to the customer to justify operating that way?

The relationship between each entity is not totally unfettered. The regulatory environment must also be considered. If the ISPs annoy the customers too much, there may be regulatory change (such as Network Neutrality, etc.). This in of itself may be good or bad for the ISPs and their complaints and threats regarding Google may be a diversion for the purpose of increasing their government supported monopoly power.

</comment><comment><USER13> That's an interesting quote: "Some European telecoms groups fear Google will reduce them to "dumb pipes"". I wonder what description would they prefer now - especially what do they want to offer above the "dumb pipe" standard?

</comment><comment> Asa-Nisse Fine, the telecoms can start taking payments from their customers to access youtube then. Lets see how many customers they'll get with that kind of deal. We (the users) already pays for the networks. This article is complete bullshit.

</comment><comment><USER10> _Mr Alierta said that if no revenue sharing agreement was possible between the internet search engines led by Google and the network operators, regulators should supervise a settlement._

This is what strikes me as disturbing. Peering has been one of the success stories of an unregulated internet infrastructure in contrast to the hugely complicated PSTN system with all manner of complicated charging schemes. In this instance getting regulators involved would almost certainly complicate things. Bureaucrats won't understand the myriad of informal relationships that underpin the peering that runs the internet.

<comment><USER12> Peering strikes me as akin to free trade between countries. Can peering relationships survive large imbalances? If packets were trade and peering relationships borders, who are the net exporters and importers?

</comment></comment><comment><USER14> the telcos don't want the public to perceive them as "dumb pipes" because fungible commodities are subject to much fiercer competition.

</comment><comment><USER15> If either party should be paying it should be the telcos. No one needs to pay for monthly Internet access without content to access. They'll find that out the first week they drop Google.

</comment><comment><USER16> Dumb Pipes? No. They're a series of tubes.</comment>


Apple: The Genius Behind Steve (2008) - <AUTHOR> http://fortune.com/2008/11/24/apple-the-genius-behind-steve/ <comment><USER2> Would be interested to know what would have happened to Apple if say Ive became CEO. Steve knew what he was doing naming Tim CEO I think. Not sure about the wow factor, but cash pile is today ~10x what it was back then, and so is stock price (11/10/2008: 14.31, 04/13/2017: 141.91)

<comment><USER3> I think the stock also split so more like 70x stock growth!</comment></comment>


Ask HN: A Good Alternative for ReCaptcha? - <AUTHOR> Are there any good alternatives for reCaptcha? It has come to a point that traditional text/sound captcha challenges are trivial to bypass today, and the more distorted we make them, the more challenging they are for humans.
Google went Sparta with their reCaptcha be, and nobody in their right mind should add a script that fingerprints users, specially from an adtech company.
What solutions do you use to thwart bad boots from submitting your forms and automating things where it should not have been? <comment><USER2> For bots which are not specifically targeted at your page i simply add an invisible form element named url. Bots _LOVE_ to share their viagra urls. Any request which submitted an url is discarded.

This trick is simple stupid and should not work but somehow the simple spam bots have not improved.

This does not work for sophisticated bots (never met one) or the ones programmed specifically for your site (happens very rarely).

<comment><USER3> Be very careful how you do this, unless you want to exclude blind users. I've seen a blind user have an online form silently fail at them because they filled in a field that wasn't visible. Using display:none applied indirectly via CSS is probably reasonably effective against bots and won't interfere with screen-readers.

<comment><USER4> Are there tools or guides to help test how websites "appear" to people with disabilities ? It is difficult to design something if you don't have an idea of what will be the outcome, but I wouldn't know which software is used by (e.g.) a blind user, let alone how I would use it.

<comment><USER5> Simply try to browse the page without using mouse, just the tab key. The next step would be to use screen reader, NVDA[1] (Windows) or Apple VoiceOver (MacOS). There are automated testing tools, but they don't cover the whole spectrum of problems. Nevertheless you can try

* WAVE (Chrome or FF plugin, [https://wave.webaim.org/extension/](https://wave.webaim.org/extension/))

* AXE ([https://www.deque.com/axe/](https://www.deque.com/axe/))

* AChecker ([https://achecker.us/checker/index.php](https://achecker.us/checker/index.php))

* Funkify (Chrome plugin, tries to emulate various disabilities)

* Lighthouse in Chrome Dev Tools also checks some accessibility rules

The full list of things that you need to take care of: [https://www.w3.org/TR/WCAG21/](https://www.w3.org/TR/WCAG21/) (it's huge I know, it takes 5-7 days to test everything from this list)

<comment><USER6> Please do the tab test. Some of us do this even if we don't need accessibility tools, as it can be faster (those who create forms which cannot be tabbed through are evil).

</comment></comment></comment></comment></comment><comment><USER7> W3C has published an extensive list of reCAPTCHA alternatives: [https://www.w3.org/TR/turingtest/](https://www.w3.org/TR/turingtest/)

W3C is requesting feedback for the document, if you'd like to make suggestions, please open an issue: [https://github.com/w3c/apa/issues](https://github.com/w3c/apa/issues)

<comment><USER8> That's a very informative document. Privacy Pass caught my eye: [https://privacypass.github.io/](https://privacypass.github.io/) It's an extension that is currently only supported by Cloudflare's CAPTCHA, that pretty much stores tokens after you complete a CAPTCHA, and the next time instead of requiring you to complete a CAPTCHA again, it will use those tokens. The point is that it does it in an anonymity preserving way. You can fork their server for a custom implementation.

<comment><USER9> So now the spammers only need to solve one captcha?

<comment><USER10> And more broadly -- it's kind of funny, but the more we all just roll our own solutions to this, the less standardized the solutions, and the harder it is for spammers to scale.

</comment></comment></comment></comment><comment><USER11> Akismet is a third party service that works really well. You send data there with a HTTP POST and it will reply with a yes or no, it is spam or not spam. It is not that hard to implement. You do have to be aware that you are sending user data to that service, which you have to mention in your privacy policy.

Stop Forum Spam is a similar third party service. You send it an ip address and an email address. It will reply on both items if it is spam, together with a confidence level. Quite interesting way to reply :) It is originally intended to fight registration spam, but you can use it for comment spam or contact forms as well.

JavaScript spamfilters can be very usefull. Most spambots do a HTTP GET for a page with a form. They fill in all the fields and submit it with a HTTP POST. They don't run any JavaScript on that page. You can have honeypot and timeout fields on a form that get manipulated by JavaScript, and spambots will not validate. Works really well, and all transparent to the user. The only "risk" is that in the future spammers might start using more sophisticated spambots, like using Electron or Chromium. I implemented spamfilters like this in a WordPress plugin and it works really well for me: [https://wordpress.org/plugins/la-sentinelle- antispam/](https://wordpress.org/plugins/la-sentinelle-antispam/)

<comment><USER12> > The only "risk" is that in the future spammers might start using more > sophisticated spambots

You're also making your website unusable for people with Javascript blocked or disabled in their browsers.

<comment><USER11> In the context of the question, that is not relevant. reCAPTCHA requires JavaScript as well. The question is about an alternative to reCAPTCHA. Both methods use JavaScript.

I do understand where you are coming from though. And I also think this alternative is better in this regard. reCAPTCHA loads JavaScript from a third- party domain. With JavaScript spamfilters you are loading them from the first- party domain.

<comment><USER13> reCaptcha has a noscript alternative with iframes and checkboxes. Once completed you have to manually copy an authorisation string to a field and submit it.

<comment><USER14> I don't think the noscript alternative works anymore. I get this message "Please enable JavaScript to get a reCAPTCHA challenge."

[https://www.google.com/recaptcha/api2/demo](https://www.google.com/recaptcha/api2/demo)

<comment><USER13> Huh, last time I hit a cloudflare website on Tor it directed me to [https://www.google.com/recaptcha/api/fallback?k=..](https://www.google.com/recaptcha/api/fallback?k=..).

Perhaps that's just a cloudflare thing.

</comment></comment></comment></comment></comment></comment><comment> LogIN- As per google "reCAPTCHA is a free service that protects your website from spam and abuse" but instead one can argue that reCAPTCHA is a service that transfer spam issue from the provider to its users, so at the end one provider will be free of spam (I guess) but all of his users will be spamed, tricked, fingerprinted and abused to actually constantly work for free for this 3rd party ant-spam service

<comment><USER8> I suppose you expand the usage of spam to also mean the recaptcha mini-games where you tick all the boxes with traffic lights in them. I agree with the sentiment. I'll add that if you don't use anti-fingerprinting or anti-tracking measures, then recaptcha catches on really quickly that you're a person, and it's not much of a bother in that case. The problem with it is that it's made for the ad-peddling web, not for the private web, or whatever the alternative should be called.

</comment></comment><comment><USER15> I think it is best to design your own captcha around your use case. All you need to do is make the amount of work for spammers too high for targeting your site.

Just recently, I added the idea of a captcha that might actually be enjoyable for users to my list of "things that should exist":

[http://www.gibney.de/things_that_should_exist](http://www.gibney.de/things_that_should_exist)

The idea is to show the user a random image and ask what is on it. If the image is beautiful, that might even be fun. And there are many sites that offer beautiful public domain images. And have tags for everything in them.

There probably are many other funny and enjoyable captcha ideas one could implement.

<comment><USER16> PassThePopcorn has a similar CAPTCHA-like implementation to the Pexels one you mentioned in your article. It has a repository of movie posters (which I think are user submitted to the movies themselves), one of which is chosen and the user is asked what movie the poster is for. I've always thought of that as an "enjoyable" CAPTCHA.

<comment><USER17> GazelleGames does that with game covers. Lichess has one where you need to find a checkmate in one move. It's usually pretty easy, but could in theory be frustrating for someone just starting with chess.

</comment></comment></comment><comment><USER18> I had a serious problem with bots spamming my forum. I implemented all the usual captchas but none of it worked. What I found interesting was that I was able to defeat the bots simply by "tricking" them. I kept the old forum up but basically set this forum to auto delete the content on it. I then setup a brand new forum and for whatever reason bots don't spam it, at all. It is almost like the bot goes to the original forum, spams it, and then moves on thinking it has completed its mission. I even flat out disabled the captcha to see if anything changed and nothing did. The new forum never got spammed. I have no idea why that happened but it strangely did work. When I do get spam, I don't think that spam is from bots. It is from humans posting instead but that is at least manageable to clean up.

It kinda leads me to conclude that each developer has to create "out of the box" solutions instead of some plug and play solution. If a plug and play solution is developed then all the spam bot creators start figuring out ways to crack or simply create a service for human based cracking. If unconventional methods are used on each site then it gets more complicated for the spammers.

</comment><comment><USER19> I'm a fan of the Chinese-style captchas where you just move a puzzle piece with a slider. I have no idea how defeatable it is vs reCaptcha but it's far far less painful.

<comment><USER20> I don't know these, do you have an example?

<comment><USER21> Geetest is one of them, I've seen it on crypto projects generally, binance for example.

</comment></comment></comment><comment><USER22> The best solution I've ever come to that didn't negatively impact my clients was generating a UUID on the server via an ajax call 100ms after page load. That UUID was stored in a cookie, and returned via AJAX and stuck it in a hidden field on the form.

Server checks cookie != null and cookie == hidden field, and returned a 200 OK regardless of if it failed (used the response text for success or failure indication), and deleted the cookie.

Implemented it across a network of sites ~10 years ago, and only a handful of spam had gotten through when I quit that job 4 years ago. They had been getting 10-20 spam comments per day per site.

<comment><USER23> That will work for low end drive by stuff. Anyone motivated will have a better bot. I was running one 10-12 years ago that was essentially a headless browser. It had a JavaScript runtime and a custom DOM. It could run jquery, prototype, ajax and just about everything else that was popular at the time. I even had a custom flash runtime in there for the jackass sites with the nav in flash.

These days you could just throw together a selenium script and call it a day.

This kind of stuff is fine for stopping comment spam because there are so many other opportunities out there that the spammers move on to an easier target. If you need to protect against a targeted attack then it's a lot more difficult.

<comment><USER24> Does any kind of captcha stop a targeted attack? I don't think that's what captchas are for.

<comment><USER23> Maybe. Maybe not. They are pretty darn difficult. I've seen a few that are fairly straightforward to break. For the good ones, you'd need some quality CV tech and if what you have is that good then you're probably better off using it for something other than breaking captchas in order to post comment spam for penis pills or whatever they are peddling these days.

<comment><USER24> You can pay teenagers in the Phillipines a few dollars a day to solve any kind of captchas for you. Maybe I have a different concept of a targeted attack, but that seems certainly in the realm of what a criminal enterpise or nation state would expend on a high value target.

</comment></comment></comment></comment></comment><comment><USER25> > It has come to a point that traditional text/sound captcha challenges are > trivial to bypass today

I have yet to see a general-purpose tool to which you can throw any text captcha and it'll solve it.

Just because there are academic papers that demonstrated it once doesn't mean there's still a huge barrier to entry in implementing this solution (which spammers won't do as long as it's easier to move onto another target).

There are paid captcha-solving services out there and even those are still powered by humans even though it's in their commercial interests to automate the process. Them not doing so further suggests that AI is not there yet.

<comment><USER26> [https://github.com/dessant/buster](https://github.com/dessant/buster) What about this one?

<comment><USER25> Does it actually work? Speech recognition is often terrible enough in normal conditions, so I don't expect it working well on audio captchas which are often designed to counteract speech recognition.

<comment><USER27> Buster works great! I use it all the time.

</comment></comment></comment></comment><comment><USER28> It might be worth considering a honeypot approach. E.g. having a field in the form that isn't visible for users that, when filled in, indicates that it is likely a SPAM submission.

[https://www.projecthoneypot.org/](https://www.projecthoneypot.org/)

<comment><USER29> I do this but I also put a javascript field that is already checked and js unchecks it. not great for no script users but pretty good for any random bot that is using curl or some other scripting language and doesn't check your trap box.

<comment><USER30> You can make that checkbox visible by default and put label "I'm not a bot" and uncheck + hide it using JS, that way noscript users will still see the checkbox and uncheck it manually.

<comment><USER31> Bots might be smart enough to uncheck that from the label; maybe text near the top of the form that says "please uncheck the checkbox near the submit button"?

<comment><USER32> You could use CSS to place label and checkbox visually close but completely unrelated in the DOM. Not great for accessibility, but better than the current situation.

</comment></comment></comment></comment></comment><comment><USER33> Unfortunately, there aren't many good captcha systems that don't do the equivalent of what ReCaptcha does, because we're at a point where fingerprinting users is a strong signal to help identify contractors doing captchas on behalf of bots.

Even some silicon valley products use captcha-breaker services. These services present themselves as sophisticated APIs but in reality they're just dispatching work to humans who accept pennies an hour at internet cafes; a competition with Amazon's mechanical turk for digital sweatshops. They're common and cheap and the tech industry feeds them. Undercutting the workforce doing the captcha busting is the only viable way to stop that.

Your real alternative is to do the fingerprinting yourself.

</comment><comment><USER34> There was a good podcast about this [0] just a couple weeks ago. They interviewed the guy who invented CAPTCHA as well as the head engineer on ReCaptcha v3.

The gist of it was that in a few years, all Captchas will be useless because machine learning is too easy and cheap. The only way to defeat spam will be to use reCaptcha v3 or something like it, because those services will use what they know about you to determine if you're a bot or not, plus their own machine learning of what "normal" behavior is for your website. It sounds like ReCaptcha v3 is basically an app level IDS.

[0] [https://www.npr.org/sections/money/2019/04/24/716854013/epis...](https://www.npr.org/sections/money/2019/04/24/716854013/episode-908-i-am- not-a-robot)

<comment><USER35> > those services will use what they know about you

This is inherently user-hostile, as it presupposes tracking and identification. I _don 't_ want them to know anything about me!

<comment><USER36> Which is kind of the trick - there may be a point not to far in the future where it is nearly impossible to tell the difference between hostile bots and users who are just really into privacy and not being tracked.

</comment></comment></comment><comment><USER37> In my personal blog I am using "Riddler" Drupal module, and have had good experience: [https://www.drupal.org/project/riddler](https://www.drupal.org/project/riddler)

You can create your own Captcha questions / answers. I feel like this is the preferred way of handling spam posts, creating your own custom Captcha implementation.

<comment><USER38> Eventually your questions will be answered by humans and added to database.

<comment><USER39> Might be good idea to extend the plug-in so adding questions is as easy as sending an SMS, then you can spend less than a minute daily to add a question/answer combo:

        Color of the sky at night? Black

<comment><USER40> #000000

</comment></comment></comment></comment><comment><USER41> I have a mail server with a new address generated per post (or per comment for thread functionality) on a blog i run. People then get to mail their comments. For all reputable mail sites I let things directly through, for everything else I use a spam filter turned to 11 together with a mail-back link for post verification.

I have had zero spam the last 8 years.

The code is ancient and runs on an even older version of lispworks with Auth details hard coded all over the place, so I the time it would take for me to share it would be longer than to rewrite it in some hip language.

Had I been lazy and not as privacy conscious I would have let Gmail do the spam filtering for me.

<comment><USER42> Have you considered open-sourcing that and posting it on HN? I'd use it.

<comment><USER41> I have been asked to many times, but it is part of a largish website written in Common Lisp. The codebase is written by me over 3 years with no consideration for modularity. It would be a considerable effort to break it out.

There is nothing technically novel about it. Heck, python even includes an SMTP server in the stdlib. You could.probably write a PoC in a couple of hours.

</comment></comment></comment><comment><USER43> Depends on why you need it.

Captchas work well for telling humans from bots for the purpose of denying automated/scripted access. But here a simple IP-based blacklist works well, because of how many bots now live on Amazon's properties and some such.

You don't need a captcha to filter out bot _spam_. That's a massive overkill.

stopforumspam.com works well. You can combine it with a simple keyword based filter, have it tag hits with a cookie, temporarily blacklist the IP and then filter them out based on that as well. Auto-submit it to stopforumspam too. Obviously, also have whitelisting in place, e.g. to let through existing customers, previously cleared posters, etc.

For bonus points, first-time posts that look OK may be put into a "shadow ban"-ish mode, whereby they are visible to the posters and mods, but not anyone else. Until they are cleared. This works equally well.

The bottom line is there's no spam that doesn't try to promote something and they aren't likely to target just _you_ , so there's always a keyword/URL you can latch onto, and it also makes sense to participate in a distributed monitoring framework to piggy-back on each other's first hits.

<comment><USER44> "there's no spam that doesn't try to promote something" is, unfortunately, not true. Or at least, some spam plays the long con. On sites where karma or social graph confers advantage, bots will harvest one or both through low- effort, high-payoff posts. Various disinformation and distraction campaigns may sell only confusion, discord, or volume of content. And if it's the graph itself or specific connections which matter, ossiby for hishing, recruitment, or other compromise, you'll see other behaviours.

Not all media manipulation is commercial. Not by a long shot.

You're fighting the last war, if not older.

</comment></comment><comment><USER45> As a user I found geetest [1] to be really friendly and much easier to use than recaptcha. I have never integrated it myself.

[1] [https://www.geetest.com/](https://www.geetest.com/)

</comment><comment><USER46> Simplest way is to use filtering.

``` (defparameter _spam-words_ '("viagra" "cialis" "v1agra" "c1alis" "tamadol" "hydrocodome" "doxycyline" "prozac" "prozca" "prizac" "doxycyclins" "anx8ety" "amytriptylone" "poker" "laxative" "anatrim" "breast" "penis" "fiorinal" "sexy" "kaspersky" "hoodia" "thyroid" "coupon.com" "vuitton" "coupon" "fetish" "famotidine" "footwear" "sweetwater" "sunglasses" "ninja" "www" "http" "cheap3ddigitalcameras.com" "aquadivingaccessories.com" "tastyarabicacoffee.com" "firstname.lastname@example.com" "bit.ly" "cottonsleepingbags.com" "italiancarairbags.com" "newpopularwatches.com" "glasslightbulbs.com" "browndecorationlights.com" "fx-brokers.review" "ceramicsouvenirs.com" "xevil" "senuke" "captcha" "xrumer" "vkontakte" "апрап" "erectile" "spellingscan" "lialda" "lamborghini" "doubles your bitcoin" "pro- expert.online" "specified wallet" "selected wallet" "online casino" "multimillionaire" "win-win lottery" "lottery" "Перезвоните пожалуйста" "email@example.com" "meeting-club.online" "from2325214cv" "did you receive my offer" "Domain zone .de" "all your photos" "Pay 1 BTC" "to our bitcoin wallet" "you will be sued" "police will be interested" "hacked")) ```

<comment><AUTHOR> If HN had this filter, you wouldn't be able to submit this comment.

</comment></comment><comment><USER47> I had a strange idea about solving this problem: How about a micro-payment, something like $0.01, instead of solving a puzzle? In that case maybe you won't care if many bots login to your website.

I think that I by this time I have the technology to make something like this work, I was wondering if this is a good solution though. What do you think?

<comment><USER10> You could use JavaScript cryptocurrency mining instead. User clicks a button to activate miner script, it runs in their browser for 10-30 seconds or whatever, then reports back to your server that they are good to go.

<comment><USER48> You'll lose people who are blocking this kind of shit. Also you might end up on a Firefox blacklist.

<comment><USER10> Don't know how the blacklist works. As someone who blocks javascript by default, if I were asked to enable this to submit a login, I would probably be okay doing so if I could be confident a script was only mining and not fingerprinting me. (Big if)

</comment></comment></comment></comment><comment><USER49> Whatever you use, please remember not everyone has good vision / hearing / dextrous mouse control. Captchas can be a nightmare for accessibility. Most of the 'clever' solutions to this will completely block some subset of keyboard users / blind users / eye gaze users along with the bots.

<comment><USER50> It's really frustrating talking to client side developers these days about 508 compliance. It feels like only one in 10 understand the concept of accessibility.

</comment></comment><comment><USER51> For automation I would recommend ratelimiting endpoints. I personally tend to use 5 requests per IP/second along with 100 requests/minute as default and then override specific endpoints to e.g. 1 request per IP/hour.

For user input I recommend keeping the first comment submitted by a new account/IP hidden until you/moderators have approved it, after which new comments from that user no longer needs to be approved before they become visible to other users.

</comment><comment><USER52> If it's a problem with spammy blog comments I would recommend to just remove any kind of input on the site and ask people to send you an email with their questions and concerns.

Be sure to use a separate email and give it to readers on your about page via some language like "questions (dash) and (dash) comments (at) (this domain)".

If it's for account signups just send an email confirmation link and possibly include a code in the email that has to be submitted manually as well.

</comment><comment><USER53> For those who are interested in an alternative CAPTCHA service, we at NetToolKit are putting the finishing touches on a service that we hope to launch at the end of next month (June). The CAPTCHAs are interactive and meant to be fun for the user -- no machine learning training involved. We'd be thrilled to get some early feedback before launch, so if anyone is interested, please reach out via email or via our website (both in profile).

</comment><comment><USER54> What about PoW ([https://en.wikipedia.org/wiki/Proof-of- work_system](https://en.wikipedia.org/wiki/Proof-of-work_system)) ?

It require minimum user interaction, and you will eliminate most of spammers bot, since it will lose its cost-effectiveness. You can implement something like coin-hive proof-of-work, without having to mine monero anyway

</comment><comment><USER55> Looking at these comments (141 at the time of this post) the answer looks to be: No.

I have small business clients, Google's reCAPTCHA is our best option. They aren't willing to pay for some obscure, and expensive one-off solution that might work. They just want the spam to stop. I fill out reCAPTCHAs every god damned day because I work on the web. Asking "normal" users to fill out a handful each year isn't asking that much.

Maybe for your startup "rolling your own" makes sense, but not for small biz.

<comment><USER53> There are definitely alternatives. For example, [https://hcaptcha.com/](https://hcaptcha.com/) (I have not used or evaluated them).

If any of your small business clients might be interested in our new CAPTCHA service that should launch late next month, please let me know (see profile for contact information). Our pricing is projected to be $10 for 100,000 requests.

</comment></comment><comment><USER56> I think reCaptcha is very terrible. For HTML forms, a simple question could be used (change them sufficiently often when spam is received), or you may require the user to edit the URL manually in order to access something, based on the client IP address perhaps (which would be displayed). I also invented a protocol-independent CAPTCHA, which is also text-based, and uses SASL. You should allow the user to implement the code themself if they want to do rather than requiring that they use your code.

</comment><comment><USER57> I also recommend mailing the website owners who uses ReCaptcha about why it's a nuisance and stating that you and many others won't be using the site anytime soon.

<comment><USER58> Doesn't work, they don't care. I mailed+twitted to many among which were Dropbox/HumbleBundle/Packt etc.. most just ignore me or came back with canned responses like "we value security blah blah improves security blah blah your data..." :(

</comment></comment><comment><USER59> Unless your website is under targeted attack just putting "2+3" on a image will block 99.9% of all bots. You hardly even have to distort the image or randomize the math but doing so could help against script kiddies. Only drawback vs reCAPTCHA is you have to show the captcha all the time instead of automatically suspecting bots.

If you are under targeted attack by someone more dedicated, captcha is not going to be the only defense in your book.

<comment> massimo-nazaria > Unless your website is under targeted attack just putting "2+3" on a image > will block 99.9% of all bots.

Absolutely.

I did exactly that with a PHP script which generated images with the GD library.

It definitively worked for me.

</comment></comment><comment><USER60> For the use case of blocking general web form spam, we've had good results with relying solely on IP reputation crowdsourced via AbuseIPDB:

[https://www.abuseipdb.com/about](https://www.abuseipdb.com/about)

Occasionally we're an early target of a fresh IP, but we report it back to the database to help later victims. The more people contribute to such a system, the better it gets.

<comment><USER61> Many IPs are shared by more than one endpoint, and hundreds or thousands of endpoints sometimes share a single IP. Say a home router is compromised on an ISP using CGNAT and you block by IP, you could potentially be blocking an entire neighborhood of innocent users.

Having parts of the Internet blocked for huge numbers of their customers puts pressure on ISPs to monitor and censor users traffic, which is not the direction I want to see the Internet go.

IPs do not have a one-to-one relationship with users, and I feel strongly that they shouldn't be treated as if they do.

<comment><USER60> Thank you, that's well-put. I also share that value.

Another value that I hold is that the cost of bad actors shouldn't be externalized to innocent people, i.e. that it's unfair for me to pay the cost of completing a captcha just because somebody somewhere else is misbehaving.

I'm not sure how to reconcile those.

</comment></comment></comment><comment><USER62> > nobody in their right mind should add a script that fingerprints users

Fingerprinting users is no more a problem than using cookies, there are far more legitimate reasons to use these things than illegitimate. The problem is Google and Facebook using these techniques to spy on people at massive scale.

Once again the problem is Google and Facebook not the internet.

<comment><USER63> The problem with fingerprinting is that it's used to track users across sites. Cloudflare's "super cookies" and ordinary ad-network cookies are both examples of fingerprinting which use cookies and could definitely argued to be bad for user privacy.

A text-based challenge-response captcha doesn't fingerprint you in any way. Google's reCaptcha does -- not to mention that it uses you for free labour that I would argue should be a violation of minimum wage laws in most countries (Google hires people to do data entry for ML, so why am I being forced to do the same work for free in order to post a comment on a forum or log into a website).

</comment></comment><comment><USER64> A commenter on HN some years ago claimed a 100% success rate at blocking spam by requiring all web form submissions to be cryptographically signed. This solution struck me as stunningly elegant both by raising the standard for constructive feedback and promoting public awareness of secure communication.

<comment><USER42> Cryptographically signed where and how? Do you mean to say that you get a full string like "a=1&b=something&c=[1,2,3]" and hash/encrypt that? Or do you encrypt each individual field? Or something else?

</comment></comment><comment><USER65> [https://hcaptcha.com/](https://hcaptcha.com/) ?

</comment><comment><USER66> I like those math questions captcha. Fun and I doubt a bot or even a real persona spammer will waste time on this. Make the question appear on an image instead of text and the bot will also have to do OCR on top of being wolframalpha to defeat your captcha.

<comment><USER67> TBH, I had decent results with the most trivial "3+4=" style CAPTCHAs. I know some sites where there's even only a single, hard-coded question/answer.

In the world where it's not about scaling to infinity, you're not getting targeted attacks, you're getting stupid bots that pummel every site thinking it's a WordPress install from 2007 and anything different is enough to scuttle it.

By the time your service is popular enough to justify building a focused bot or tossing low-wage workers at it, hopefully you have the revenue in to finance something more sophisticated.

</comment></comment><comment><USER68> > nobody in their right mind should add a script that fingerprints users

I helped vendor-select and lead implementation on a fraud solution that was an integration with SiftScience (yc-funded, [https://sift.com/](https://sift.com/)), which relies on fingerprinting. This was years ago but I still think about the project and how it plays with user privacy etc. I will say that -- fingerprinting as a component in fraud management is/can be highly effective.

The problem is, once you get into payments fraud through bots, I think the conversation becomes way more nuanced. If you're looking for a solution to bots spamming or throwing bad data into your app, maybe that's a little extreme. But if the choice between privacy and becoming a front for credit card fraud and chargebacks, you're in a choice between who the victims of your service are going to be, and how much ill is done.

</comment><comment><USER69> Have seen these guys, met the founders a while back at AppSecUSA: [https://funcaptcha.com/](https://funcaptcha.com/) It's those puzzles/games as captchas.

</comment><comment><USER70> > Google went Sparta with their reCaptcha be, and nobody in their right mind > should add a script that fingerprints users, specially from an adtech > company

Elaborate?

</comment><comment><USER71> Recaptcha is also blocked in China. Users there wont be able to bypass it at all to accomplish a protected task.

Anyone knows of a good alternative that works there?

<comment><USER72> Yup, this is a huge problem on my company's website. We really like reCaptcha but, alas, have to fall back to our home-rolled version because reCaptcha completely fails for our Chinese users.

</comment></comment><comment><USER73> "went Sparta"???

</comment><comment><USER74> recaptcha v3 is invisible.

</comment><comment><USER75> Just ask a math question?

</comment><comment> ak-47 A bit late, but honorable mention: [https://xkcd.com/233/](https://xkcd.com/233/)

</comment><comment><USER76> Just out of curiosity, isn't that feasible today to implement some machine learning to stop spammers? Is there any project trying to come from this angle?

<comment><USER20> That's like saying "why don't you use algoritms and code". Like, sure, but what is it you're proposing? What features would you learn from and match against?

(For those unfamiliar with algoritms and code as solution, it's a reference to this: [https://www.reddit.com/r/ProgrammerHumor/comments/5ylndv/so_...](https://www.reddit.com/r/ProgrammerHumor/comments/5ylndv/so_thats_how_they_did_it_its_brilliant/) )

<comment><USER76> Actually we have implemented something like that for HTTP requests. Features would be: IP (first 3 octets are probably enough), posting time, length, time to solve captcha, time between clicks, country where the IP is located, post contains certain words (can be learnt from spam posts), does the post contain a link(y/n)

I think I would start with these, probably looking into what other people are doing.

<comment><AUTHOR> An ideal machine learning implementation would also need the context, such as the original post itself, parent comment(s), other comments in the thread, etc.

It can be quite difficult than one might think. For example, now that we are talking about spam, the word "Viagra" shouldn't block my comment, even though my parent post doesn't mention the word or in a situation where nobody else mentioned it.

</comment></comment></comment></comment><comment><USER77> How about put your users first and don't farm them out to Google ML training because someone told you to. Recaptcha is a cancer on the web.

<comment><USER78> Isn't that what they're doing, hence this question?</comment></comment>