Hacker News Reader

That reminds me of my terrible spam prevention hack. We kept getting a bunch of spammers signing up for our newsletters, so I made the form require a JavaScript based hidden input to submit. That worked for a while, but then new spammers started executing the JS and getting through. So I added new JS that just waits 15 seconds before putting the right hidden values in the form, and that’s done the trick (for now).

View on HN

So CSRF?

Plain CSRF wouldn't help because they're scraping the site and executing the JS. It has to be time delayed CSRF so they give up and submit before it's loaded.

The real solution is to use a CAPTCHA, but they're so user hostile, that's the last resort.

Oh I got that, I was referring to the original solution.

And I can kind of agree with the CAPTCHA being the final solution, a question though, you can't implement the Cloudflare style "CAPTCHA" which is heuristics based and not "please click the bus" type?

Reply on news.ycombinator.com