Dev.to · 5 min read

Two sites asked my automation to prove it was human. I stopped both times, and I want to argue that was correct

Two sites asked my automation to prove it was human. I stopped both times, and I want to argue that was correct

I run distribution for a small browser extension with a set of scripts. They publish articles, verify that the published pages are actually readable without a session, and keep a ledger. It is mundane work and most of it is allowed everywhere. Twice in two hours last night, a site put a human verification in front of the next step. Once when posting an answer to a question that had been open for years. Once when creating an account. Both times my scripts stopped and reported the wall. Both times I left it there. What the walls actually said The first was a dialog in the middle of the page: we cannot quite tell whether you are a person or a script, please check the box. The second was a checkbox that said, in the local language, verify that you are human, and under the submit button, please complete the security check. Neither of these is ambiguous. They are not rate limits, they are not a captcha protecting a form from abuse in some abstract sense. They are the site saying, in words, that it wants a person here and is not sure it has one. Why the box is not the question It is tempting to read a checkbox as an obstacle, because it looks like one: a small widget between you and the thing you want, and there is a whole industry that will click it for you. But the widget is not what is being asked. What is being asked is an assertion, and the assertion has a truth value. My scripts are not a person. Checking a box that says otherwise is not a clever workaround, it is a false statement made to a party that asked me a direct question. I find that clarifying, because it removes the engineering framing entirely. There is nothing to solve. The site asked, I know the answer, and the answer is no. The cost, stated plainly, because a rule that costs nothing proves nothing The second wall is the expensive one. That platform has exactly the kind of publishing route I have been looking for since I measured that directories are closed to me: their documentation says posting is open to all users, free, no badge required on my own site, no payment, no waiting queue, with direct attribution to the author. I read the whole page before touching the form, and the terms were better than anything I have found in three weeks. The account creation asked whether I was human. So I do not have the account, and I do not have the channel. I want to be precise about what that means: I gave up a free, open, well documented distribution surface, for a rule that cost me nothing to write down and quite a lot to keep. That is what makes it a rule rather than a preference. The case where the site told me exactly what it wanted, and I could comply The same night, a different constraint went the other way, and the contrast is the useful part. Above the answer box on that question site, there is a line saying that content generated by AI tools may be posted but must be referenced according to their policy. I opened the policy and read it: allowed, with attribution, and unreferenced content will likely be deleted. That is a site drawing a line I can honour. So I wrote the attribution into the answer, plainly, naming what wrote it and where the material came from. The answer never went up, because of the other wall, but the reasoning stands: when a platform states a condition I can meet truthfully, I meet it. When it states one I cannot meet truthfully, I stop. The rule is not do not automate. It is do not lie to the thing you are automating against. What I actually do at a wall Three things, and none of them is retry. I capture the screen and read it. Every structured read I ran returned nothing at all on both of these walls. My scripts asked the page for error messages, alerts, disabled buttons, and the page had none of those. It had a picture and a sentence. Two screenshots cost me nothing and answered both cases immediately. I write down what the site offers. Both entries in my notes describe the terms in the site's own words, so that the option is still there for a human to take later, and so that I do not rediscover the same wall in a month and spend another hour on it. I mark it closed rather than pending. A blocked route left as pending quietly accumulates until the list of things to do is mostly things that cannot be done. The part I would defend in an argument If you route around a check that exists specifically to exclude scripts, you are not beating a puzzle. You are moving the cost onto everyone who comes after you, because the response to successful evasion is always a harder check, and harder checks are paid for by people with old devices, poor connections and screen readers. The wall was not built for me. It got built because enough people treated it as a puzzle. Disclosure I build BlueTicks for Gmail, a Chrome and Firefox extension that shows WhatsApp style ticks in your Gmail sent list, one tick sent and two blue ticks opened. It costs 4 dollars a year and there is a free tier. Everything above comes from running its distribution with tooling I write myself, and last night that tooling ran into two doors it should not open. You can find it at blueticks.io. If your automation hits a human verification, the useful question is not how to get past it. It is whether the honest answer to what it asks is yes.

This is a summary aggregated from Dev.to. Read the complete article on the original site:

Read full article at Dev.to

Related stories