[racket-dev] spam & planet bug reports

Two hours ago, Neil Van Dyke wrote:
> You could implement your own captcha.  This is hard if the captcha
> is on sites popular enough to be brought to the attention of very
> smart programmers who specialize in compromising captchas.  This is
> easy if you don't have to worry about those programmers.

For the bug report form, I've implemented a very simple captcha, with
only three options and they can change only on every build of the
pages.  Doing something serious can be very difficult and I get the
benefit of something so minor that it's unlikely to be "cracked"...
There's the alternative approach of a textual question, but that can
run into issues too -- for example, building on a speicific domain
knowledge is obvious (like "what does (- 8 3) evaluate to?") but can
trip newbies.

My plan was (and probably still is) to switch to recaptcha at some
point when the current thing will lose its effectiveness or even
before that happens.  It's hard to beat the convenience of someone
else doing the right thing (for example, the bugs captchas are images
only, no audio challenge), and keeping it updated as spammers advance.
I've had this plan for a while, before it was swallowed by google.
The supposed damage is minor, especially given that we're considering
hooking more stuff on google, like documentation searches.


> Or you *might* be able to use Recaptcha in a privacy-friendly way by
> serving everything yourself to the client, so that no HTTP request
> is made by the client directly to Google and no plausibly
> identifying info is otherwise propagated.  That way, privacy-wise,
> Google gets little more than timing and scale info.  I'm not sure
> that this is permitted, technologically or contractually.  Serving
> it yourself is also more expensive to maintain, and, in absence of
> guarantees from Google, there is more risk that what works today
> will not work tomorrow.

I doubt that this is practical -- even if you can make it work, that
last risk that you mention is very real in a system that by design
will always be a moving target.

-- 
          ((lambda (x) (x x)) (lambda (x) (x x)))          Eli Barzilay:
                    http://barzilay.org/                   Maze is Life!