Hacker News new | ask | show | jobs
by crazygringo 40 days ago
Me.

I think the idea is sad and tragic, but also that we are at the point where we have no choice but to do something.

AI/LLM's have created a vector for abuse that previous tools are failing to protect against, and the problem is only getting worse.

I'm sick of the increase of LLM slop on websites in comments and posts. I'm sick of how fraud and spam and abuse can be increasingly automated in ways current tools can't catch. I'm sick of hosting costs exploding as hobby websites get hammered for no reason.

I don't realistically see any alternative but for some kind of reliable signal that a web request is most likely coming from a real person (not a perfect guarantee, but something good enough). Which means some kind of attestation that it's a real hardware device that costs at least a few bucks and is making human-level numbers of requests (not millions per day), or else some kind of digital ID attestation system.

And I much prefer device attestation that keeps you personally anonymous, as opposed to identity attestation that will inevitably allow the government to track your browsing.

So this seems like the lesser evil. If there are other ideas I'm very open to them as well, but I basically see something like this as a sadly necessary and inevitable evil. Something is necessary and this is less worse than the alternatives. And the fact that website owners choose whether to enable this or not means that those who want to keep an internet open to all devices and web requests can do so, if they're willing to handle the additional costs in handling abuse.

1 comments

>I don't realistically see any alternative but for some kind of reliable signal that a web request is most likely coming from a real person (not a perfect guarantee, but something good enough). Which means some kind of attestation that it's a real hardware device that costs at least a few bucks and is making human-level numbers of requests (not millions per day), or else some kind of digital ID attestation system.

After years and years of looking, a problem for which cryptocurrency is the perfect solution has been found.

Oh wait, Hashcash is kind of how we got cryptocurrency in the first place.

But yes, let's pretend that much less creepy forms of attestation aren't a solved problem and figure out how we can introduce more avenues for surveillance.

Hashcash was a really intriguing idea. But it fell completely apart once it was realized that spammers could use botnets to do all the proof of work for free.

Plus Hashcash isn't a great solution for mobile devices especially, as it uses up battery and low-end devices particularly suffer. And obviously challenges have to get harder every year to keep up with high-end hardware, which makes older hardware become increasingly unusable even faster for web browsing.

So unfortunately it is not a solved problem. That's why device attestation still seems like the least-bad solution right now.

Why would we stick to hashcash when we have decades of work built on it?

You can trivially substitute device attestation with e.g. proof of burn.

Instead of tying attestation to specific hardware manufacturers and configurations, it can be trivially tied to monetary value.