Google rolls back reCaptcha update to fix Firefox issues | Hacker News Reader

Google rolls back reCaptcha update to fix Firefox issues

bleepingcomputer.com

58 pointsgnabgib36 comments

Every decent CI would include at least a smoke test on the bigger platforms in the field. Google obviously having zero test coverage for FF on Windows, is that incompetence or malice?

Both?

Nuh, malice.

> The script attempted to modify a div's background color using document.body.removeChild, but as the script was loaded in the HTML head, the DOM had not loaded yet and document.body was not available, causing the script error.

Don't we have computers to catch such faults?

Isn't it best practice to wait for document.loaded before starting JavaScript shenanigans?

I thought so, but the bigger problem here is not failure to wait but failure to verify safety.

Ok, now I got what you meant. I was completely amiss.

Well, that's web engineering basics 101: HTML/CSS/JS should be treated as sequential (line-by-line processed). Therefore, even linkting to JS before any HTML tag will result in no element being in the DOM (while the JS is called).

Indeed. Simple enough for a computer to check. So was Google short of computers? ;)

Apparently. We should open gofundme for Google.

> Don't we have computers to catch such faults?

We had some years ago. Now we have AI.

I find it hard to believe Google didn't make these things happen on purpose, for countless times I saw someone I recommended Firefox to switched back to Chrome, I asked why and they just simply answered with "because something doesn't work on Firefox"

Which is weird because I have yet to find something that truly doesn’t work. What are these folks doing that they have to switch back. I’m guessing it’s they just don’t like how Firefox does things.

I use LibreWolf and I can’t login to gog.com on it for some reason, but I can in FF. Still not sure why.

Librewolf is one of those "privacy focused" browsers which disable half of the web's features, so it's no surprise that some things don't work.

librewolf isn't a general purpose browser, some things are supposed to be broken.

I’m curious, are there any AI assistants yet that can help me ID bikes, motorcycles and busses when the bot-detector decides to challenge me 10 times in a row?

Captcha solving services are pretty cheap and reliable. The main draw for captchas is to keep out the low effort bots that will ddos your site. Determined bot authors that can solve a captcha usually respect rate limits.

Yes, though AI has been better than humans at those for some time. The real test now days is checking if the input "looks human" .

our robot overlords have solved that problem too: https://github.com/JoonasVali/NaturalMouseMotion

For text input you can measure the time between key down and key up events when typing a long sentence and then generate delays randomly between key presses to simulate a human typing.

I've seen sites in the wild which use Firebase for login and break in Firefox. Apparently you have to launch it as a popup which Firefox tends to suppress or make a proxy from yoururl.com to google.com.

https://firebase.google.com/docs/auth/web/redirect-best-prac...

How long must we be subject to ReCAPTCHA? Just until AI can solve it and render it useless as a gateway?

I have heard that most of the "solving" you are doing is mostly to generate mouse movements and click timing that can be tracked and analysed to determine uniqueness that implies non-automation. That's probably the reason keyboard shortcuts aren't the default on 3x3 captchas. (There's a userscript I used previously that would let me hit a numpad button to click on corresponding images. It was great) Data google knows about you from elsewhere on the web is also used to determine humanity.

Even if AI blows past the percentage of the time recaptcha considers a failure (IIRC, 0.1%) it's not going away, since it cuts down on so much low-effort spam. See also: forums that use "What is 2+3?" as a captcha on registration forms.

My mother messaged yesterday "how do I get this thing to work".

Good to know it was actually broken

Oh, so glad to hear this. I thought I was going nuts.

I fail to understand why this only an issue for FF. Is the Script only present for FF depending on user agent?

See https://bugzilla.mozilla.org/show_bug.cgi?id=1894735#c15. It was code specifically targeting Firefox on Windows to blame.

> Google rolls back reCaptcha update to fix Firefox issues

Firefox issues ? It was working fine until _Google_ updated it.

>was broken on chrome with FF user agent

Why did Google target Firefox this way? Seems like an anto trust issue

As the article mentions at the end, and I agree, I don't think this was inherently meant to be an anti-firefox change, otherwise they most likely wouldn't have made something specific to firefox on windows. More likely, this is a case of an anti-bot measure that only works in firefox on windows specifically, hence the specific targeting, and some google engineer didn't bother to test it thoroughly enough.

I think intention matters less than impact. Being a browser vendor should come with a legal obligation to support other browsers just was carefully as your own on all of your company’s websites. We’d never tolerate it if, say, Verizon stopped connecting calls to T-Mobile customers and just went “ooops, totally missed that, our bad” when people complained.

Part of why I think that needs to be a legal requirement is to prevent debates about whether management knowingly sabotaged a competitor – proving intent is much harder than simply showing negative outcomes for users – but the other is to keep web standards meaningful in a world where Google has successfully pushed most people to use Chrome: if a regulation required cross-browser testing and use of W3C standards (i.e. if Firefox implements the standards and reCAPTCHA fails, Google has 7 days to fix it or shut the service down until they can), they can’t push key functionality into Chrome-only APIs.

Bug telecoms have bugs all the time and we accept it…. Complicated systems fail

What, precisely, do we accept? Have you ever personally experienced something like what I described? Feel free to provide supporting documentation.

And how many 'innocent' didn't-test-it-enough targetted user agent incidents do we have to witness in order to call it what it is and stop making excuses?

reCAPTCHA protects your website from fraud and abuse

!!!without creating friction.!!!

I have to laugh.

The better thing would be to throw away their terrible, fossilized dinosaur called recaptcha and copy some of the competitors, at least those are not annoying and doesn't force the user to do their idiotic games.

> I have to laugh.

? After every corner could hide a terrorist. Be alert. /s

Reply on news.ycombinator.com