Aus der beliebten Reihe "wäre billiger gewesen, gleich auf mich zu hören", heute: Captchas sind Scheiße.

We explore the cost and security of reCAPTCHAv2 and conclude that it has an immense cost and no security. Overall, we believe that this study’s results prompt a natural conclusion: reCAPTCHAv2 and similar reCAPTCHA technology should be deprecated.

Ja NO SHIT, Sherlock! Hätte uns doch nur jemand rechtzeitig gewarnt!1!!

Es gibt hier doch sicher einige Leser, die auf Arbeit einen "Threat Intelligence"-Feed abonniert haben.

Könnt ihr mal gucken, ob in irgendeinem davon die IPs von Crowdstrike gelistet sind?

Die waren ja wohl der größte Threat der letzten Jahre bis Jahrzehnte!

Und? Ist nicht auf der Liste? Na sowas!

Was sagt euch das über den Sinn dieser Threat-Intelligence-Dienste?

Pondering out loud:

Sometimes I post things to Ye Olde Blogge, and sometimes I post them on Mastodon only. How do I decide which? It has been somewhat random, but if I examine my decisions, I think what I have been doing is:

• Linking to a long funny article, or to Actual Artwork: Blog.

• Someone's good shitpost: Blog if it is a banger for the ages; Mastodon boost if it is an ephemeral Sensible Chuckle.

• Actual News, that will still be interesting next year: Blog.

• Breaking Bullshit News, but funny, but that won't matter tomorrow: I often just boost someone else's Mastodon post, which does not show up on the blog. (E.g. "Republican says something dumb"). Unless it is, like, such a self-own that it amounts to a Quality Shitpost, then I'll re-blog it.

  One reason for boosting others' posts is that I do not see the replies and sometimes that is for the best.

• My own "Sensible Chuckle" shitpost: sometimes I do these on the blog, and sometimes Mastodon only. The problem with the Mastodon ones is that sometimes I misjudge the popularity of these, and my throwaway one-liner gets a dozen angry replies from the Mastodon HOA or the anarcho-syndicalists, and my blog readers might enjoy skimming that pile-on.

  Plus there's the whole "the blog functions as an archive" aspect of things.

So, I dunno. Maybe I should fall into a pattern of: never make top-level Mastodon posts, only post to the blog and mirror that to Mastodon.

Here's a good "where should this have gone" example.

"Always blog" is in the spirit of POSSE, but in my case there's not a lot of "E = everywhere" in that these days -- pretty much just Mastodon -- as I no longer use Facebook or Twitter. (I do still auto-post a screenshot-breadcrumb to Instagram, because I have a few friends who seem to use that the way I use a feed reader.)

Previously, previously, previously, previously, previously.

Click here to go see the bonus panel!

Hovertext:
It suddenly became intersection of sex and technology week?

Today's News:

Click here to go see the bonus panel!

Hovertext:
Is this the one that gets me that sweet sweet hatemail I've craved for 20 years?

Today's News:

Click here to go see the bonus panel!

Hovertext:
The really distressing part is that he keeps saying names for approximately 6 hours.

Today's News: