[jeremycherfas]I finally bowed to the inevitable and removed the comment form from my website. These Russian spammers have been playing havoc with the site, despite it being behind Cloudflare and I just don't have the luxury of trying to discover exactly how they are doing what they are doing. Maybe over the next couple of days I'll find the energy to write up the experience.
Ekul@jeremycherfas I know you mentioned your site is behind Cloudflare, but unfortunately that alone doesn't stop sophisticated Russian/Chinese bots. Did you add a Cloudflare Turnstile to your form? That is a great way to put an end to them.
[Murray]We've found Turnstile works pretty well, though its localisation support is lacking and it can occasionally trip up assistive tech (its still _way better_ with the latter than more traditional Captchas though, so that's a win)
solonovamaxtbh, I personally actually find cf captchas on websites to be *incredibly* annoying, and half the time when I see them I will just close the site if I don't care a lot about that particular site
solonovamaxif you have to use it at all, at least make it so the captcha isn't for the entire site and instead only required for submitting a comment, and not for viewing the site in general
solonovamaxbecause whenever a site uses cf, I will constantly see captchas which waste like 30+ seconds of my time because I have a setting in my browser to isolate 3rd party cookies by 1st party domain (i.e. if A loads js from B which sets a cookie for B, if a site C loads js from B it won't be able to see the previous cookie), this is to prevent tracking but also leads to constant triggering of captchas
[Murray]1000% agree on making the captcha only impact the actual form or section that matters. As someone who uses a non-Chromium browser, captchas always trigger for me too, and they suck 😄
[jeremycherfas]The trade off for me is between making it easy to submit a comment or message me and overall site security. Thinking about it, I get so few non-webmention comments I could just remove that permanently. And it is easy enough to find my email and use that, without a form.
[jeremycherfas]Forensically, I am interested in how the spammers avoid the CF “under attack” challenge and how they bypass my rudimentary honeypot. But I may never bother to find out.
[Murray]Turnstile is useful because, in *most* cases, it requires no additional input by people. It can typically work out your not a bot just via how you fill out the form, so it should be as easy to submit as if it wasn't there at all. From our end, it has basically handled all spam on the sites we use it on, which include several fairly large NHS programmes that absolutely get search-driven traffic, and used to get a lot of spam
girlonthemoonnot sure where to ask this-- anyone know of sites/services that support login thru indieauth? i'm thinking like jamesg's artemis reader & pronouns.page
LoqiIndieAuth is a federated login protocol for Web sign-in, enabling users to use their own domain to sign in to other sites and services https://indieweb.org/indieauth
LoqiIt looks like we don't have a page for "login thru indieauth" yet. Would you like to create it? (Or just say "login thru indieauth is ____", a sentence describing the term)
btremI'm writing a quick how-to. And I have a question: is there a standard character to use to indicate a program menu item and sub-item? I'll probably use ` -> ` unless there's something better. Maybe a unicode character?