Hacker News Reader

Comment by noprocrasted | Hacker News Reader

Just because you can technically crack them doesn't mean they're useless.

There's a significant amount of time, skill and effort that went into the solution from this post, and the end result doesn't generalize well (you'd have to start all over for a different kind of captcha).

The vast majority of spammers would not be able to replicate this; those who do would either make money legitimately, or focus their skills on juicier targets (if you have AI/ML skills and want to do nefarious things there are other options that pay much better than spamming).

Such captchas still work well at raising the cost of successful spamming above the expected payoff from said spam.

View on HN

So, I do this type of AI development for solving CAPTCHAs.

I can't get any real jobs that pay me for my more advanced skills. My primary sins were going to a second/third-tier university and some performance concerns in a portion of my previous roles due to divorce and burn-out. I make $80k/year in government IT, and $30-150k/year as the "AI" guy in a small 2-5 person group that offers a CAPTCHA-breaking API.

The spammers aren't the ones replicating this. They just pay B2B rates (combo of SaaS + Consulting, depending on client needs) to help them remove the roadblocks.

Is your company hiring? :)

If there were a totally 100% aboveboard way to do this in a net transfer of utility from Tessier-Ashopool SA to the typical web surfer I would be a superfan.

Why do you do this?

While I can appreciate the technical achievement, you know most users of forums and imageboards don’t want any AI content at all.

> Why do you do this?

Money, obviously. I'd also do it for $30-150k/year

> you know most users of forums and imageboards don’t want any AI content at all.

He's not creating or posting any "AI content"?

Okay, but you know his actions are enabling more AI content and spam to proliferate? I hardly think he is making that much money just because legitimate users don't want to fill in a captcha.

It’s very easy to opine about the ethics others should have. Different when it’s you and your family and a comparatively easy effort will make a material difference in quality of life. And especially when you know ghe market need will be met by someone else anyway.

If someone is making a brazen statement of being "a bad guy because 80K is not enough, and could not find anything decent for those extra $30K" what kind of treatment would they expect?

I’d argue that someone cracking CAPTCHAs has a lot less dirty hands than someone who works in an actually scummy industry like US health insurance. Those companies literally kill people by denying them care to pinch pennies. This guy might cause a little more spam on the already useless mess that is YouTube comments. Who cares. I’d take the money, too.

Typical US-centric way of thinking. If your healthcare system is crippled it does not justify making internet mess for everyone else in the world.

I’d have suggested adtech before health insurers.

Tobacco pays real well

To be fair, there's a huge amount of people around here that work on the universal surveillance industry, and for many of them the alternative is way higher than 80k.

So you get a bit richer for less effort... but how do you think moderating legions of spam posts affects the lives of independent website owners, who just want to create communities around the things they love?

Or indeed the users, who have to wade through trash invading their threads?

Or other legitimate users, who now have to answer captchas from CloudFlare just to access their favourite websites?

Ultimately this is a parasitical element, choking the internet. It will kill the things it profits from. Many will give up running these sites, you walk away with your $100k, and no one can ever do it again... you've not created anything of value, but destroyed it.

Hard to think anyone who can't solve a captcha is something other than a parasite.

Parasites can solve captchas, people with accessibility issues and the poorest of people are the one being locked out.

It isn’t just those with accessibility problems that get stuck. Some are stupidly difficult- I’ve given up on one in recent times.

Maybe my disability is CAPTCHA blindness.

Captchas are not only for stopping people with disabilities anymore. They also stop people using non-approved browsers, people trying to stay anonymous, people coming from the wrong geographic areas...

If the AI has access to a credit card, but Mgulu from Nigeria doesn't, then the system doing the filtering might evolve to filter out the 'undesirable' rather than the non human.

Yes, people often do unsavory things for money. Is the point you're making that they shouldn't do bad things. Like, what are we even talking about here?

The lesson here is that systems that rely on humans to do the 'moral' thing and fail otherwise are bad systems.

HN moderates spam without the use of AI-crackable "prove you're a human" bs

> So you get a bit richer for less effort

If $150k/year is “a bit richer” for you you could simply offer to pay that poster that much in exchange for stopping.

Let us know who you work for and I'm sure we could find a few stones to throw your way.

I had no idea I'd see so many people rising in defense of bots and scammers.

A lot of people on this website are directly responsible for making botting and scamming easier to pull off. It's kind of necessary for them to find justifications for them so they can sleep soundly.

Hn is like that sometimes. You read a thread and think "well I guess I'm alone on what I think is a perfectly reasonable position"

The other one that comes to mind is anacap, which I view as fringe. I read the comment threads sometimes and it leaves me with the impression that I'm the only one that thinks Von Mises and Rothbard are a bit out there.

This sounds so out of touch, you are comparing the livelihood of a person with the quality of a meme imageboard.

So says every drug dealer.

Everyone's got their price. I would certainly do dirty deeds myself for the right amount.

We actually don’t take spam/fraud clients. Granted - there’s a bit of a delicate song+dance with each client, people who are doing spam/fraud usually know better than to admit it outright.

Our group focuses on scraping for lightly-funded LLM startups who cant pay Reddit/X/etc API fees, and data aggregation for cottage industries (price comparison, etc)

But a LOT of the people in our niche do fraud and spam, so we’re steeped in that culture whether we embrace it or reject it.

Half this forum works on filling the Internet with crap, and most of the other half work for industries that on the net are making the world a worse place, it's kind of table stakes for getting paid.

Capitalism optimises for value to the customer, not for overall public good.

People who do jobs like that don’t really care about the impact

Being able to spam and mind control 4chan would be amazing just for personal reasons, let alone how juicy that is to governments around the world!

It's working for the Russians.

The percentage of captchas used to deter spam is probably a minority these days. A lot of captchas nowadays are used to prevent adversarial interoperability or the free flow of information.

If you want to spam, you don't actually need to break many captchas. Just make your spam/scam/misinformation "engaging" enough and the social media platforms will host and promote your spam _for free_ and won't even ask a captcha.

This precisely. Our clients are generally looking at adversarial interoperability.

But the rhetoric around the assumption that I was doing it for spammers was also interesting, as well as being more closely related to TFA!

Despite the spamming angle, I think CAPTCHA-breaking is, on the balance, noble and honorable work. These things are user-hostile blights on the web, and any effort towards making them disappear as useless is worthwhile. Sites worried about spam should invest more in automated spam classification/elimination instead of punishing real users with CAPTCHA-solving. Not that I can offer a solution--if I could, I'd be a millionaire.

Who do you think spam classification false positives are going to be pubishing if not real users? At least with a captcha, you have some idea that you were rejected before you put in the effort to write your comment.

I am a nafri with a PhD and engineering experience (with europeans), I can't make good living going the traditional way either with with remote jobs being impossible and no luck landing a visa.. I have built custom solutions for big name EU companies to keep an eye on the competition through scraping. captcha solving cloudflare bypass is a great part of that. Getting back at companies making the UX bad with captcha does feel good also.

$30-150k/year is a big range

Ahh the good ole dilemma of selling your soul, you study what you love only to destroy it for profit. Like an entomologist hired by a pesticide company.

I get it man, gotta make the bucks helping spammers advertise their shitty products, even if they destroy the internet.

What about the spammers that already destroyed the internet by steering it entirely towards advertising & surveillance capitalism? It's like the pot calling the kettle black.

We're all complicit in the enshittification of the internet and technology in general, just that we delude ourselves into believing we're on the "good" side because we call it "advertising" or "marketing" or "analytics" instead of spam, more spam and spyware.

The end result is exactly the same however.

If you are referring to google. It's what financially powers most of the free as in beer internet, so hard disagree.

There's a difference between parasites that spam and make 1000 free gmail accounts. And Google.

> there are other options that pay much better than spamming

Are there? Say you've got a felony record and can't get a legit AI/ML job at eg OpenAI/anywhere. What would you do instead? most of the options I can think of involve getting paid for doing things that are basically spam if you zoom out enough.

There's plenty of mischief potential with "deepfakes".

How many people are there like that, and how much damage are they collectively likely to do? If you're a random spammer, how hard will it be to hire that person? Again, not aiming for impossibility, just reducing the damage.

I've been working for myself for over a decade doing random projects for clients while also doing my own thing. My resume looks awful and the job market is trash. If be willing to take a job as a jr developer and work my way up (or a sys admin).

I used to run one of the world's largest ebook piracy websites but want to put that life behind me. Recently work came across my desk to create tens of thousands of accounts on a well respected website so they could more easily scrape it.

I just want a traditional job, but I also want to support my family and $4000 for a months work

If I were you, I'd probably try looking at companies working in the web scraping and reverse engineering fields, who might even appreciate the skills even if they were acquired in a, let's just say, "different" way.

There's nothing immoral about scraping a website. Best of luck to you!

The secret is knowing that companies actually want people like you, with the real world blackhat experience, because you know how the game works in practise not just theory.

I’ve got no criminal charges of any kind and I’d still want to know about any way to work without getting flagged as a known enemy of the Cartel.

I’m lucky that some people still want chops no matter the thought crime, I’m very grateful such excellent employers exist (love you guys).

But you’re never sure you’ll line up two such in a row, this isn’t the IBM until company casket and company funeral days. Makes life “interesting” even for a risk-taker.

Captchas are now useful to distinguish well-intentioned bots (they stop whenever they see captcha) from malicious ones, which solve them, but still behave a lot like bots.

Well-intentional bots are first-class citizens

Wouldn’t a well-intentioned bot follow robots.txt anyway?

Curl and libcurl doesn't. Wget doesn't, I think.

CURL isn't a bot, it's a tool. It can be part of a bot (which may or may not respect robots.txt) but it can also just act as a user agent directly for a human operator in which case it SHOULD just do what asked. Chrome doesn't follow robots.txt either for the same reason.

Do you complete the circle and do the good bot bad bot classification with a mod bot?

Interesting, subtle difference but I always thought of captchas as having computational difficulty, but that's clearly not the point as you say. The cost is not compute but developer time.

If you manage crack it at 1mhz per captcha or 1ghz or 1000ghz, it makes no difference, as the bottleneck is the network identifier (ip address/block)

While still a type of PoW, these economics are different than offline mechanisms like password hashing or crypto. Where a 1ghz cost is still significantly different than 1mhz.

The watershed of "good enough at programming to just get a real job" vs "can code enough to be really annoying to businesses, but not enough to hack it as a dev" is a lot more on the annoying side than you'd think.

I say this with the chagrin of someone who works on a cool software product that is also coincidentally really well-shaped to make people want to abuse it.

>he vast majority of spammers would not be able to replicate this;

Eh? They just need to buy their software from someone that can. I would say many of the malware and spamware isn't created by every individual deploying it, but instead vendors that got good at it and decide to make revenue by licensing out their software to other bad actors.

Reply on news.ycombinator.com