Re:mCaptcha: Open-source proof-of-work captcha for websites
by 1vuio0pswjnm7 on Wednesday August 09, 2023 @01:35AM
(#37059046)
"The point of of CAPTCHA is to tell Computers and Humans Apart, that's what CHA stands for."
But what is the point of telling computers and humans apart. Look at all the hype around "AI". Why would we want to tell one from the other. Certainly there are reasons. What are they.
Perhaps the goal is advertising. Perhaps websites that use CAPTCHAs want clients that are advertising friendly, with graphics and Javascript and what not.
Perhaps the goal is to conserve server resources. But in that case it would seem whitelisting or rate-limiting would be a better solution.
For example, academic journal websites put the IP addresses of subscriber institutions on a whitelist. No problem downloading a paper from a journal when sitting in the university library but to do so from home requires a proxy.
What is most annoying about so-called "Web APIs", which might seem like a reasonable approach to solve the resource usage problem, is that websites will often deliberately not publish the rate limits.
Websites can of course do whatever they like, they can block everyone or no one or anything in between, but unfortunately they use the alleged problem of "bot traffic" to justify tactics that are really aimed at increasing ad revenue. They might start blocking requests without a user-agent header. (For example, Stackoverflow sites do this.) But what problem is that solving. Anyone can forge a UA header. It isn't even required by the RFCs. It's solving the problem of no UA header. No they are trying to collect as much data as possible. They are trying to serve ads. Is it going to solve the "bot traffic" problem. Who knows. But they are getting more data and that's what they really want.
For many years I have been downloading source code from FTP and HTTP servers, e.g., NetBSD and various mirrors used for software in the packages distribution, and also binary packages from Linux distribution package repositories, and I wonder sometimes why these sites do not have problems with "bot traffic" that websites filled with ads claim to have. In fact, the majority of the traffic these mirrors receive is automated. It's all "bots", i.e., scripts, package managers, and other automation.
Anyway, the point is that there's an elephant in the room with respect to discussions of CAPTCHAs and that is data collection and advertising. Why do websites want certain browsers. It's possible to have non-automated, manually operated clients that actually use less resources than Chrome. And yet sites will often proclaim these clients are "bots". There is more to discuss than just that awful "bot traffic". Humans are getting blocked and constantly urged to enable JS or install Chrome.
But what is the point of telling computers and humans apart. Look at all the hype around "AI". Why would we want to tell one from the other. Certainly there are reasons. What are they.
Perhaps the goal is advertising. Perhaps websites that use CAPTCHAs want clients that are advertising friendly, with graphics and Javascript and what not.
Perhaps the goal is to conserve server resources. But in that case it would seem whitelisting or rate-limiting would be a better solution.
For example, academic journal websites put the IP addresses of subscriber institutions on a whitelist. No problem downloading a paper from a journal when sitting in the university library but to do so from home requires a proxy.
What is most annoying about so-called "Web APIs", which might seem like a reasonable approach to solve the resource usage problem, is that websites will often deliberately not publish the rate limits.
Websites can of course do whatever they like, they can block everyone or no one or anything in between, but unfortunately they use the alleged problem of "bot traffic" to justify tactics that are really aimed at increasing ad revenue. They might start blocking requests without a user-agent header. (For example, Stackoverflow sites do this.) But what problem is that solving. Anyone can forge a UA header. It isn't even required by the RFCs. It's solving the problem of no UA header. No they are trying to collect as much data as possible. They are trying to serve ads. Is it going to solve the "bot traffic" problem. Who knows. But they are getting more data and that's what they really want.
For many years I have been downloading source code from FTP and HTTP servers, e.g., NetBSD and various mirrors used for software in the packages distribution, and also binary packages from Linux distribution package repositories, and I wonder sometimes why these sites do not have problems with "bot traffic" that websites filled with ads claim to have. In fact, the majority of the traffic these mirrors receive is automated. It's all "bots", i.e., scripts, package managers, and other automation.
Anyway, the point is that there's an elephant in the room with respect to discussions of CAPTCHAs and that is data collection and advertising. Why do websites want certain browsers. It's possible to have non-automated, manually operated clients that actually use less resources than Chrome. And yet sites will often proclaim these clients are "bots". There is more to discuss than just that awful "bot traffic". Humans are getting blocked and constantly urged to enable JS or install Chrome.