CAPTCHAs can protect public resources as well. But the main problem here is about preventing generated spam content, not scraping. This can be mitigated by placing CAPTCHAs only on pages with signup/login and comment forms.

>This can be mitigated by placing CAPTCHAs only on signup/login and comment forms.

If only...

Algorithmic turing test is a more interesting problem. https://xkcd.com/810/

Traditional captcha solving ability has already been surpassed by the bots which is now why there's so many new and creative different CAPTCHAs. Until someone trains a model to solve them that is.

It's a never-ending arms race. CAPTCHA services are improving just as the attackers are. Just because they're not 100% accurate or effective doesn't mean they're worthless. They're just the first line of defense.

Just don't forget the scale doesn't stop at zero. They can be less than worthless and cost you actual humans visiting your site.

That'd be a nice way of looking at it, if serving content was cheap. It is not. I want to put my CV online, but I'm not willing to shill out tens of thousands every year to have it scraped for gigabytes per day. Doesn't happen, you say? Didn't before, definitely. Now there's so many scrapers building data sets that I've certainly had to block entire ranges of IPs due to repeated wasting of money.

It's like the classic "little lambda thing" that someone posts on HN and finds a $2 million invoice in their inbox a couple weeks later. Except instead of going viral your achievements get mulched by AI.

I have a personal website (including my CV in PDF), blog, and self-hosted email. A story I posted once made the HN frontpage and my e-mail is in my profile, meaning my content is read by more bots than humans.

My monthly hosting costs are ca. $10 a month. Therefore I'm really curious: if hosting your CV requires "tens of thousands every year", what does your setup looks like?

I imagine it is something about bandwidth costs

Gigabytes? How big is your CV?

>lambda thing

I never understood why anyone thought this was ever a good idea. QoS is a natural rate limit for non critical resources.