[josefresco]

I can tell you on the small level asking a simple question to activate the form action stops 99% of spam. Something like "What color is snow?" Granted, with a well trained "AI" system solving these questions would be trivial but I have yet to see it in practice.

[dewey]

Sounds easy, but at this point everyone is trained to solve these captchas and implementing the questions is not a quick thing either on a bigger scale (Translations, cultural differences, bots easily bypassing them etc.). I've used captchas on my sites before because bots were just hammering the login form, checking checkboxes and causing me to rack up email sending bills.

[phoronixrly]

Sorry for nitpicking but you need a puzzle that is knowledge-agnostic (be it cultural or scientific), otherwise you're guarding your site from both bots and people unfamiliar with the concept of or lacking the pre-existing knowledge necessary to solve the puzzle.

What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities and in parts of the world where there is no snow...

[josefresco]

I agree, and thankfully we're dealing with mostly regional visitors to small local business/organization websites. Not a global audience. That being said, it's hard to think of a simple question, with little to no ambiguity.

Once example is for a landscaper: What is the color of healthy grass?

The answer is "green" of course, but grass is common in our region. That question would not work in a culture or region unfamiliar with "lawn grass".

[phoronixrly]

Yes, I would go for simpler stuff (word or digit puzzles) and package it in a way that is friendly for screen readers. So... No images or video, or at least one alternative to them that at the same time does not make it easy for the bots...

This has the added benefit that translators will be forced to come up with a translation that makes sense when your projects gets to a point that it needs i18n.

[throwaway7283]

> What colour is snow is close but you can't assume that everyone knows what snow is, let alone what colour it is. This includes both people with disabilities and in parts of the world where there is no snow...

Google will happily ask you to point out which squares contain fire hydrants. Is there a captcha that meets your standards?

[phoronixrly]

Yes, I also saw the post about the fire hydrants the other day. No I was not able to confirm that fire hydrants are shown in countries in which they are not a common sight.

However, I am far from arguing in favour of reCAPTCHA. It is also an example of shit CAPTCHA that also bans people. I am often one of these people.

No there is no example of a CAPTCHA-as-a-service that I know of that I would be fine to impose on my users.

[idunnoman1222]

There are no humans that know the word snow who don’t know what colours Snow is

[phoronixrly]

> There are no humans that know the word snow who don’t know what colours Snow is

Sorry, I don't follow, English is a second language to me, but how does this stand against my statement that 'many people don't know the concept of snow, let alone what colour it is'?

[harshreality]

There's no reason for an English language website to cater to people who don't know what snow is. How can it be discriminatory to have a question a user can't comprehend, when they won't be able to comprehend the rest of the website either? Even blind people who can read English Braille and input text in English know that snow is white, even if they've never seen it.

If a website is multilingual, it can offer language/region selection and add appropriate questions for each of them.

[phoronixrly]

I did not say it was discriminatory -- I stick to basic terms -- you may inadvertently be guarding against people who for one reason or another don't possess the knowledge to solve the puzzle. For example I could copy over an integral from one of my undergrad exams. 'Please calculate the value of the integral and enter it in the field below' (completely accessible to screen readers as well). This would effectively ban not only people who have not taken a calculus class, but many of my uni colleagues who have happily forgotten everything about calculus after they took their exams 10 years ago...

Another example for an inadvertently hard puzzle, this time due to a lack knowledge as a consequence of being part of a different culture, would be asking US people what colour is the edelweiss. In my country children learn about it in first grade if not in kindergarten. Another -- asking Europeans/US people what colour is romduol... I don't consider this discriminatory, I don't consider people in the US or Europe uneducated because they cannot solve such a simple puzzle... It is just poor/lazy/stupid design that fails the single requirement to block bots and only bots. And I get it 'I would just google it'... But how many conversions will you lose if a considerable part of your users need to google something to go to the next step of your funnel? It's just inexcusably shit UX...

You would indeed be fine with the 'snow' question if your site must only be visited and used by fellow citizens of your country (where citizens implies similar education -- both cultural and scientific). You would indeed be fine if you can make sure the puzzle will be translated intelligently (including the solution) if your site may be used in a foreign country or by users speaking the language in your own country.

I usually cannot make any of these assumptions for any of the projects I work on. The site's audience is but a whim of the Product team, and I18n is outsourced to (once) translation agencies and now directly to an LLM... This can even be done (and frankly should be done) without the knowledge or input of the dev team. Also, neither translators nor LLMs can be expected to understand that they must come up with basically a new puzzle that will not be hard for people that use the specific language. And I as a developer that does not speak the specific foreign language while I can roughly validate their translation (if by any chance it passes by me for review and I go above and beyond what is expected of me and pass it trough a translation service) and return it with feedback for fixes, I cannot rely that they will abide by the feedback, or how long it would take... Those are a lot unknowns to consider these assumptions reliable, and it seems much less effort to come up with a simpler puzzle that contains the answer in itself... Its effectiveness against spam will be exactly the same.

Also, you will definitely not be fine if your puzzle contains a concept foreign for a considerable part of people who can't for example see or hear. You would also not be fine if your puzzle's technical implementation makes it impossible to be perceived by them. The latter part is very simple to get wrong. For example, one of the best ways to protect any site from blind people is to implement a hero image slidshow that steals the focus on each slide. Their screen readers' focus gets moved each second and they literally cannot perceive, let alone navigate the site...

Finally, none of the peculiarities above excuses straight up going for reCAPTCHA. Even if you don't give a f about your users' data EU users can and will get you in trouble with EU regulators exactly when you get to a scale at which CAPTCHA use is a necessity. There's a cultural difference for you.

[LordKeren]

.