Hacker Newsnew | past | comments | ask | show | jobs | submit | ademarre's commentslogin

I am all for using proper typographic symbols, but it is unclear what place the precomposed ellipsis U+2026—what I assume you mean by “true ellipsis”—has in that canon, especially with the compressed form it takes in most fonts.


I integrated Turnstile with a fail-open strategy that proved itself today. Basically, if the Turnstile JS fails to load in the browser (or in a few specific frontend error conditions), we allow the user to submit the web form with a dummy challenge token. On the backend, we process the dummy token like normal, and if there is an error or timeout checking Turnstile's siteverify endpoint, we fail open.

Of course, some users were still blocked, because the Turnstile JS failed to load in their browser but the subsequent siteverify check succeeded on the backend. But overall the fail-open implementation lessened impact to our customers nonetheless.

Fail-open with Turnstile works for us because we have other bot mitigations that are sufficient to fall back on in the event of a Cloudflare outage.


So to bypass captcha all a user has to do is block the script from loading? I can see that working but only for attacks that aren’t targeted?


Only if they are able to block the siteverify check performed by our backend server. That's not the kind of attack we are trying to mitigate with Turnstile.


Gandi was sold to a private equity firm in a leveraged buyout in 2019 [0,1]. Nothing good has happened with Gandi since.

[0] https://www.crunchbase.com/acquisition/montefiore-investment...

[1] https://news.gandi.net/en/2019/02/futureofgandi-the-adventur...


ISPs aren't helping either. Ziply Fiber only provides IPv6 with their 10 Gig and up plans, starting at $300/month.


The lettering on the proposal is very interesting. I assume it was hand drawn. I can't find any typeface quite like it. Google Lens suggested it is similar to Copperplate Gothic, which it is and at once is not even close.


Neutraface has some similarities, including the low crossbar height. Fittingly, it appears to be used in materials published by the Frank Lloyd Wright Foundation.


This would be a better link; the blog post on which the Bleeping Computer article is primarily based. They refer to it but never link to it:

https://www.cloudsek.com/blog/compromising-google-accounts-m...


> it would be highly likely that multiple systems around the world would generate the same number.

"Highly likely"? No. You are ignoring probability. See UUIDv4, which does not use time or NIC/MAC but does use 122 random bits.


Shazam-like fingerprinting for text. The complete LLM outputs wouldn't need to be stored, just the fingerprints along with some mechanism for trusted timestamping (could be Blockchain).


This has been done for a very long time. Blockchains are definitely not required (this isn't just the usual hate from HN of Blockchain, it just actually doesn't make sense here). Fingerprinting by shingling (windows of text) with some normalization steps is pretty typical in plagiarism or similarity detection. A big database of docid-shingleid pairs along with weights for their frequency is often a very simple and fast way to do this analysis. The big part is getting OpenAI/anthropic/etc to do it on their data and provide a service for that, but there's obviously a lot of unwanted consequences - specifically storing of all user data (even if the shingled and docids are hashes, it's still info).


> I let it expire for a few days, now they are charging me $100/year!

It sounds like your domain name entered the redemption period. The high fee to restore a domain in the redemption period is mandated by the registry, not the registrar. So Gandi is not price gouging; they are required to collect that fee for restoring the domain.


Speaking of billing, are there any good resources or examples for an engineer who gets thrown into this domain?


I don’t know, I didn’t find any. I started (20+ years ago) by talking to my accountant, but they tend to overcomplexify things.

I am thinking about doing some open source work in the space. I wonder if anyone would find it helpful. And I’m always up for consulting work :)


If I get thrown in the domain I’d probably pay for a few hours of consulting from an expert, like doctor_eval.

I’ve found nothing more efficient than a one on one conversation with a domain expert who can help me build my own mental model.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: