[sph]

So? That can still be modelled in a RPC manner.

Instead of sending a "query <string>" command, I have to do:

    -> get-captcha
    <- returns a captcha object
    -> solve-captcha <id> <solution>
    <- returns a token string
    -> query <token> <string>
    <- returns a list of results

Very simplified. If HTTP is the transport, the current Authentication header is very good at encapsulating these details without having to repeat them every command.

Point is, HTTP is still too low level and we're paying people $150k a year to write glue code and reimplement API clients until they quit and do the same thing at another company.

[Linosaurus]

Could work for the traditional image check, but not at all for the user behavior analysis magic they do. Which seems to take over.