HNHacker News
TopNewBestAskShowJobs

akalsz

102 karma · joined September 11, 2020

submissionscomments
akalsz··on ReCAPTCHA and the Anonymous Experience
Yes, and it's absolutely solvable by bots (there's even a browser plugin for it[1]) so it isn't available if Google decides you are one. But it does work if you aren't that suspicious, so most of the time it should let blind users through. Well it's a bit more complicated because there are scores and such, but from an end-user perspective that's how it usually works.

Though if you aren't considered suspicious, image captchas are way less ridiculous, too. The scoring system goes all the way from .1 to .9, but usually you're either in one or the other category based on who knows what (probably mostly ip addresses, but Google doesn't tell us so who knows?).

So in the end the service is mostly just something that arbitrarily classifies users as one or the other, bots can absolutely solve them when classified as "probably human" and they're impossible for humans when classified as "probably bot".

If you want to actually present users a challenge to verify they're human, you're even better off giving them something like captchouli[2], or just a good old scrambled letters on a picture thing (which is what Google uses for their login as well, BTW). hCaptcha is also a great alternative (anything is, really) since it's still mostly about classifying users by making suspicious ones solve challenges. reCAPTCHA is absolutely not, it judges you before the challenge.

And that's fine, some websites want that. It's their choice, I'm not mad if they ban me for not wanting to be tracked, it's probably for the better. What does make me angry is that reCAPTCHA is advertised falsely, that the challenge is a joke and a crime against humanity at once, and that despite that, people seem to believe that it's the challenge that is magically blocking the bots without realizing they're also blocking legitimate users.

[1]: https://github.com/dessant/buster

[2]: https://github.com/bakape/captchouli

akalsz··on ReCAPTCHA and the Anonymous Experience
> reCAPTCHA

> anonymous

Pick one. reCAPTCHA is based on tracking users in countless unknown ways, which is why it's basically unusable with any kind of known proxy (i.e. Google usually classifies Tor users or users from 3rd world countries as bots by default). It may be stopping "dark web hackers", exactly because it's unsolvable by anyone Google decides to be a potential threat, and that also includes bots.

Honestly, I feel like everyone would be better off if instead of reCAPTCHA, websites just used some service that automatically blocks proxies. That way you aren't getting Google to track legit users, and still forbidding potential users from joining who would otherwise be blocked by reCAPTCHA. And maybe if Google isn't watching me on your website, perhaps I'll be more inclined to visit you from my actual IP.

Or just use something that is actually solvable by humans, like hCaptcha. Cloudflare did that and it's wonderful (well, compared to reCAPTCHA), I can solve it in a few seconds, unlike reCAPTCHA which I can keep clicking on for countless minutes only to get told that "my network is sending too many requests" or something.

akalsz··on Update on MuseScore 3.6 and 4.0
I do suggest Wine, actually. I've just ran Sekaiju with it and it happily played a random MIDI file I selected after changing the output port in settings to TiMidity++ (the first dropdown list in Setup->MIDI device and instrument->Midi out device). It probably also isn't just me, the latest appdb rating of Sekaiju is platinum on wine 4.0 - for the record, I'm using 5.20 staging.
akalsz··on Facebook Seeks Shutdown of NYU Research Project into Political Ad Targeting
> This company is the absolute height of hypocrisy, hubris and deception.

Welcome to surveillance capitalism. "We are watching you" doesn't sell as well as "We are connecting people".

akalsz··on YouTube-dl has received a DMCA takedown from RIAA
Your proprietary code analogy is incredibly weird. Why would anyone need gofyourself-dl to download your container code? And what does Google have to do with the creation of youtube-dl, which is used to download stuff hosted on Google's website? And you talked about publishing code, but where does youtube-dl publish the videos it downloads? Or are you just implying that not executing all of Google's code and not watching a gazillion ads to download and view videos is some sort of "theft of IP"? Or is it that youtube-dl doesn't automatically delete the video after watching? I seriously don't get it.

> don't for a second think the RIAA is thrilled with that mechanism

What would they prefer doing? Arrest people who are using youtube-dl to listen to music? Go after people who are rehosting music from youtube on their website?

akalsz··on YouTube-dl has received a DMCA takedown from RIAA
An alternative: https://github.com/soimort/you-get
akalsz··on Rdrview – Firefox Reader View as a Linux command line tool
Lynx is great, but I personally prefer w3m[1]. Of course it's still quite limited without css/js, but it renders websites way nicer (with shiny html features like frames, tables, etc.), and even supports displaying images.

With the right configuration, it can also do stuff like automatically replacing urls, or youtube-dl'ing a page and piping its output to mpv.

[1] https://github.com/tats/w3m

akalsz··on Microsoft just force restarted my Windows PC again to install more unwanted apps
> But we should be honest about the shortcomings. Desktop Linux is not secure and you only have privacy if you trust all of your applications.

No operating system is secure when it comes to installing untrusted applications. The strength of desktop Linux is the vast amounts of available free and open-source software, ergo software that you can actually trust. To my knowledge, no other OS beats that - usually you can't even trust your OS itself these days.

Plus we already have a universally supported sandboxing technology, it's our web browser. I can use Microsoft's software inside a Firefox container when I'm forced to, without giving them access to my home folder, keystrokes/mouse events, etc. Even better, half of the requests those things would make are blocked by uBO.

akalsz··on Cloudflare’s privacy crusade continues with a challenge to Google Analytics
> You can block requests to Google Analytics, but blocking requests to Cloudflare essentially means blocking the Internet. Checkmate content blockers ;-)

You can still mostly evade their tracking: they're intentionally letting the Tor Browser through, most of the time[1]. Though it's still a tad annoying how they decided that legitimate Tor traffic may only come from the TBB, so you even have to fake certain headers for them to let plain Firefox over Tor use this feature[2].

[1] https://blog.cloudflare.com/cloudflare-onion-service/

[2] https://addons.mozilla.org/en-US/firefox/addon/onionflare/

akalsz··on Cloudflare keeps sending emails over a year after account was cancelled
> Yet compared to many other large companies, Cloudflare has been a company with at least a respectable reputation and track record.

Has it? See the following page (which also contains complaints about unsolicited e-mail, among others): https://codeberg.org/themusicgod1/cloudflare-tor

← PreviousPage 2 of 2