Hacker News Reader

So CSRF?

Plain CSRF wouldn't help because they're scraping the site and executing the JS. It has to be time delayed CSRF so they give up and submit before it's loaded.

The real solution is to use a CAPTCHA, but they're so user hostile, that's the last resort.

Oh I got that, I was referring to the original solution.

And I can kind of agree with the CAPTCHA being the final solution, a question though, you can't implement the Cloudflare style "CAPTCHA" which is heuristics based and not "please click the bus" type?

Reply on news.ycombinator.com