Dan Q

Author: Dan Q

Bypassing WordPress / Jetpack’s “Prove your humanity:” CAPTCHA

One of the most-popular WordPress plugins is Jetpack, a product of Automattic (best-known for providing the widely-used WordPress hosting service “WordPress.com“). Among Jetpack’s features (many of which are very good) is Jetpack Protect which adds – among other things – the possibility for a CAPTCHA to appear on your login pages. This feature is slightly worse than pointless as it makes it harder for humans to log in but has no significant impact upon automated robots; at best, it provides a false sense of security and merely frustrates and slows down legitimate human editors.

WordPress/Jetpack's CAPTCHA, asking for the solution to "9+10="
Thanks, WordPress, for slowing me down with a CAPTCHA that a robot can solve more-easily than a human.

“Proving your humanity”, as you’re asked to do, is a task that’s significantly easier for a robot to perform than a human. Eventually, of course, all tests of this nature seem likely to fail as robots become smarter than humans (especially as the most-popular system is specifically geared towards training robots), but that’s hardly an excuse for inventing a system that was a failure from its inception. Jetpack’s approach is fundamentally flawed because it makes absolutely no effort to disguise the challenge in a way that humans are able to read any-differently than robots. I’ll demonstrate that in a moment.

Jetpack security settings: "Protect" switch
Don’t just disable this, though! Other “Protect” features make sense. If only you could disable just the one that doesn’t…

A while back, a colleague of mine network-enabled Jetpack Protect across a handful of websites that I occasionally need to log into, and it bugged me that it ‘broke’ my password safe’s ability to automatically log me in. So to streamline my workflow – as well as to demonstrate quite how broken Jetpack Protect’s CAPTCHA is, I’ve written a userscript that you can install into your web browser that will completely circumvent it, solving the maths problems on your behalf so that you don’t have to. Here’s how to use it:

  1. Install a userscript manager into your browser if you don’t have one already: I use Tampermonkey, but it ought to work with almost any of them.
  2. Install Jetpack Maths Solver.

From now on, whenever you go to a page whose web path begins with “/wp-login.php” that contains a Jetpack Protect maths problem, the answer will be automatically calculated and filled-in on your behalf. The usual userscript rules apply: if you don’t trust me, read the source code (there are really only five lines to check) and disable automatic updates for it (especially as it operates across all domains), and feel free to adapt/improve however you see fit. Maybe if we can get enough people using it Automattic will fix this half-hearted CAPTCHA – or at least give us a switch to disable it in the first place.

Update: 15 October 2018 – the latest version of Jetpack makes an insignificant change to this CAPTCHA; version 1.2 of this script (linked above) works around the change.

Article posted at UTC on .

5 comments

Improving URLs for AMP pages

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Improving URLs for AMP pages (Accelerated Mobile Pages Project)

TL;DR: We are making changes to how AMP works in platforms such as Google Search that will enable linked pages to appear under publishers’ URLs instead of the google.com/amp URL space while maintai…

TL;DR: We are making changes to how AMP works in platforms such as Google Search that will enable linked pages to appear under publishers’ URLs instead of the google.com/amp URL space while maintaining the performance and privacy benefits of AMP Cache serving.

When we first launched AMP in Google Search we made a big trade-off: to achieve the user experience that users were telling us that they wanted, instant loading, we needed to start loading the page before the user clicked. As we detailed in a deep-dive blog post last year,  privacy reasons make it basically impossible to load the page from the publisher’s server. Publishers shouldn’t know what people are interested in until they actively go to their pages. Instead, AMP pages are loaded from the Google AMP Cache but with that behavior the URLs changed to include the google.com/amp/ URL prefix.

We are huge fans of meaningful URLs ourselves and recognize that this isn’t ideal. Many of y’all agree. It is certainly the #1 piece of feedback we hear about AMP. We sought to ensure that these URLs show up in as few places as possible. Over time our Google Search native apps on Android and iOS started defaulting to showing the publishers URLs and we worked with browser vendors to share the publisher’s URL of an article where possible. We couldn’t, however, fix the state of URLs where it matters most: on the web and the browser URL bar.

…

Regular readers may recall that I’ve complained about AMP. This latest announcement by the project lead of the AMP team at Google goes some way to solving the worst of the problems with the AMP project, but it still leaves a lot to be desired: for example, while Google still favours AMP pages in search results they’re building a walled garden and penalising people who don’t choose to be inside it, and it’s a walled garden with fewer features than the rest of the web and a lock-in effect once you’re there. We’ve seen this before with “app culture” and with Facebook, but Google have the power to do a huge amount more damage.

Repost posted at UTC on .

No comments

The elephant in the diversity room

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

The elephant in the diversity room – QuirksBlog (quirksmode.org)

false

Although there’s a lot of heated discussion around diversity, I feel many of us ignore the elephant in the web development diversity room. We tend to forget about users of older or non-standard devices and browsers, instead focusing on people with modern browsers, which nowadays means the latest versions of Chrome and Safari.

This is nothing new — see “works only in IE” ten years ago, or “works only in Chrome” right now — but as long as we’re addressing other diversity issues in web development we should address this one as well.

Ignoring users of older browsers springs from the same causes as ignoring women, or non-whites, or any other disadvantaged group. Average web developer does not know any non-whites, so he ignores them. Average web developer doesn’t know any people with older devices, so he ignores them. Not ignoring them would be more work, and we’re on a tight deadline with a tight budget, the boss didn’t say we have to pay attention to them, etc. etc. The usual excuses.

…

Repost posted at UTC on .

No comments

Women speakers and attendees at Amsterdam web conferences

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Women speakers and attendees at Amsterdam web conferences – QuirksBlog (quirksmode.org)

false

As a slight contribution to the diversity in web development discussion, here are the ratios of female attendees and speakers from the Amsterdam web conferences Krijn and I organised or are close to. I’m not sure what these numbers mean, but someone will surely have a bright idea after staring at them for long enough.

Krijn gathered the crucial attendee numbers, while I added the speakers, a calculation, and some general remarks.

…

Repost posted at UTC on .

No comments

BBC – Travel – Welcome to Monowi, Nebraska: population 1

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Welcome to Monowi, Nebraska: population 1 (bbc.com)

Eighty-four-year-old Elsie Eiler pays taxes to herself, grants her own alcohol licence and is the only remaining resident in Monowi, Nebraska.

Elsie Eiler, only citizen of Monowi, Nebraska

Eighty-four-year-old Elsie Eiler pays taxes to herself, grants her own alcohol licence and is the only remaining resident in Monowi, Nebraska…

Repost posted at UTC on .

No comments

Nigel, the world’s loneliest bird, dies next to the concrete decoy he loved

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Nigel, the world's loneliest bird, dies next to the concrete decoy he loved (Washington Post)

The gannet heeded conservationists' calls to settle on a small New Zealand island. Unfortunately, no eligible ladies did.

Nigel with his concrete decoy gannet

Nigel, a handsome gannet bird who lived on a desolate island off the coast of New Zealand, died suddenly this week. Wherever his soul has landed, the singles scene surely cannot be worse.

The bird was lured to Mana Island five years ago by wildlife officials who, in hopes of establishing a gannet colony there, had placed concrete gannet decoys on cliffsides and broadcast the sound of the species’ calls. Nigel accepted the invitation, arriving in 2013 as the island’s first gannet in 40 years. But none of his brethren joined him.

In the absence of a living love interest, Nigel became enamored with one of the 80 faux birds. He built her — it? — a nest. He groomed her “chilly, concrete feathers . . . year after year after year,” the Guardian reported. He died next to her in that unrequited love nest, the vibrant orange-yellow plumage of his head contrasting, as ever, with the weathered, lemony paint of hers.

“Whether or not he was lonely, he certainly never got anything back, and that must have been [a] very strange experience,” conservation ranger Chris Bell, who also lives on the island, told the paper. “I think we all have a lot of empathy for him, because he had this fairly hopeless situation.”

…

Repost posted at UTC on .

No comments

The Amazing Dinosaur Found (Accidentally) by Miners in Canada

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

This Is the Best Dinosaur Fossil of Its Kind Ever Found (Magazine)

The 110 million-year-old fossil of a nodosaur preserves the animal’s armor, skin, and what may have been its final meal.

Nodosaur fossil

On the afternoon of March 21, 2011, a heavy-equipment operator named Shawn Funk was carving his way through the earth, unaware that he would soon meet a dragon.

That Monday had started like any other at the Millennium Mine, a vast pit some 17 miles north of Fort McMurray, Alberta, operated by energy company Suncor. Hour after hour Funk’s towering excavator gobbled its way down to sands laced with bitumen—the transmogrified remains of marine plants and creatures that lived and died more than 110 million years ago. It was the only ancient life he regularly saw. In 12 years of digging he had stumbled across fossilized wood and the occasional petrified tree stump, but never the remains of an animal—and certainly no dinosaurs.

But around 1:30, Funk’s bucket clipped something much harder than the surrounding rock. Oddly colored lumps tumbled out of the till, sliding down onto the bank below. Within minutes Funk and his supervisor, Mike Gratton, began puzzling over the walnut brown rocks. Were they strips of fossilized wood, or were they ribs? And then they turned over one of the lumps and revealed a bizarre pattern: row after row of sandy brown disks, each ringed in gunmetal gray stone.

“Right away, Mike was like, ‘We gotta get this checked out,’ ” Funk said in a 2011 interview. “It was definitely nothing we had ever seen before.”

…

Repost posted at UTC on .

No comments

Poundland Nooky

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

500 Internal Server Error (minxylydia.com)

false

There aren’t many great things to write about Hounslow, other than me being in it isn’t the sort of place that brings in visitors. There’s a tired shopping centre, an Asda (whose car park has just been closed), lots of planes going over and Hounslow Heath, which frankly is just a large bit of scrubland whatever their website tells you about it being a “Local Nature Reserve and Site of Importance for Nature Conservation (of Metropolitan Importance)” I really wouldn’t make the effort to see it.

​What Hounslow does boast is three, yes THREE Poundlands. I have no idea why we need three Poundlands, especially as the high street also boasts a brand new PoundWorld, a 99p shop and a 97p shop. Seriously, the three Poundlands are literally five minute walks away from each other. You may have seen the press this week about Poundland’s new sex toy range. Sex toys, in Poundland, for a quid?! Yes, indeedy!

​Actually, they first released their pound bullet vibe a few years back (how did I miss this?!) but now they have extended their range further. It’s called Nooky. Of course it is.

…

Repost posted at UTC on .

No comments

Review of Pizza Stazione

This review of Pizza Stazione originally appeared on Google Maps. See more reviews by Dan.

Pizza Stazione, Kiosk 3, 107 Gloucester Green, Oxford OX1 2RH, United Kingdom.

Rating: ⭐⭐⭐⭐

Not the best pizza by any stretch, but perfectly acceptable and spectacular value. A fiver for a weekday large pizza is something you can’t argue with.

Digest for January 2018

Summary

This month, I looked-back at Troma Night XXI, 14 years prior, and the impact it’d ultimately have on the future of my circle of friends. I visited Wakefield Samaritans, shared thoughts about the realisation that “early programmers” are learning to code later this generation than the last and that the nature of Internet memes has changed significantly, cried at a tear-jerking short film, and learned about the Pig War of 1859.

I also reshared a video of my sister falling off a chair, as captured by a McDonalds’ CCTV camera, that originally appeared in a tweet of hers.

All posts

Posts marked by an asterisk (*) are referenced by the summary above.

Articles

Notes

Reposts

Reposts marked with a dagger (†) include my comments or interpretation.

Videos

Collection posted at UTC on .

No comments

How the Mom Internet became a spotless, sponsored void

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Perspective | How the Mom Internet became a spotless, sponsored void (Washington Post)

Gritty blogs have given way to staged Instagram photos.

A grinning toddler is bundled in a creamy quilted blanket and bear-eared hat. Next to him, an iPhone atop a wicker basket displays a Winnie-the-Pooh audiobook. The caption accompanying the Instagram shot explains, “i am quite excited to have partnered with @audible_com…. i’m not sure who loves it more, this little bear or his mama!?”

More than 260,000 people follow Amanda Watters, a stay-at-home mom in Kansas City, Mo., who describes herself on Instagram as “making a home for five, living in the rhythm of the seasons.” Her feed is filled with pretty objects like cooling pies and evergreen sprigs tucked into apothecary vases, with hardly any chaos in sight.

This is the “mommy Internet” now. It’s beautiful. It’s aspirational. It’s also miles from what motherhood looks like for many of us — and miles from what the mommy Internet looked like a decade ago.

…

Repost posted at UTC on .

No comments

Here’s The Plan

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Here's the Plan – Animated Short Film (YouTube)

French Subs by: Garance Broze ✨✨Here's the Plan merchandising available at https://herestheplanshop.tictail.com !✨✨

Well, I just had my heart broken by a cartoon about a dog and a cat. Or as the top commenter at the time of writing puts it “I’M NOT CRYING! YOU’RE CRYING, SHUT UP!”

Repost posted at UTC on .

No comments

Security Breaches Don’t Affect Stock Price

This is a repost promoting content originally published elsewhere. See more things Dan's reposted.

Security Breaches Don't Affect Stock Price – Schneier on Security (schneier.com)

false

Interesting research: “Long-term market implications of data breaches, not,” by Russell Lange and Eric W. Burger. Abstract: This report assesses the impact disclosure of data breaches has on the total returns and volatility of the affected companies’ stock, with a focus on the results relative to the performance of the firms’ peer industries, as represented…

Turns out you can’t trust the free market to penalise companies whose negligence permits data breaches. I am Dan’s lack of surprise. This is, of course, why security requires regulation.

Repost posted at UTC on .

No comments