Hacker Newsnew | past | comments | ask | show | jobs | submit | lexicality's commentslogin


> Why do I have to complete a CAPTCHA?

> Completing the CAPTCHA proves you are a human and gives you temporary access to the web property.

> What can I do to prevent this in the future?

> If you are on a personal connection, like at home, you can run an anti-virus scan on your device to make sure it is not infected with malware.

Love how actual captcha spyware has turned to victim-blaming to justify its existence.


The vast majority of website-gate captchas are served by cloudflare these days. You can use the privacy pass [0] browser extension to skip them. Privacy passes are an open standard [1], so you can re-implement it yourself if you don’t trust that extension.

[0]: https://developers.cloudflare.com/waf/tools/privacy-pass/ [1]: RFC 9576 https://www.rfc-editor.org/rfc/rfc9576.html, RFC 9577 https://www.rfc-editor.org/rfc/rfc9577.html, RFC 9578 https://www.rfc-editor.org/rfc/rfc9578.html


95% of the time I click the tick box and wiggle my mouse and it lets me through without doing a captcha.

I believe they check your mouse for human-like movement as an additional factor. Could be wrong but I haven't been bothered by many captchas in the last couple years.


If malicious or scraping traffic is coming from your IP, it's not victim blaming.

AI has ruined everything good and free for everyone except a few oligarchs.


> If malicious or scraping traffic is coming from your IP, it's not victim blaming

But it is not; my IP is a residential address paid for with a credit card associated to a human who visits like 6 websites.


The message is stating that you're seeing a Captcha because suspicious traffic has come from your network. If you're not doing suspicious things, "check that you're not infected with malware" is valid feedback.

No, it’s because Cloudflare and archive.ph have some pissing content going. I forget the details, but it has nothing to do with malware on anyone’s machine. Somewhere on HN someone has given a better explanation, but I’m not spelunking for it.

No, the message is stating that because I don't allow Javascript to fingerprint and commodify my browser. The euphemized nonsense about malware is just an insult to reason at this point.

Privacy is suspicious nowadays.

I wonder. Would it be possible for any/all submissions to automatically generate (and provide) and archive.is/archive.org link? @dang

I can't think of any large downsides, it would mean every submission would have an available snapshot for the given time, and we would no longer need a user comment to provide this.


I'm confident that you didn't realize what you were saying, but I really chuckled at "I can't think of any large downsides [in institutionalizing a clearly very legally questionable practice]".

Yes, I didn't realize this was a very legally questionable practice, let alone clearly. Can you explain why?

There's a thing called "copyright" and it's kind of like a union, but for people who write or create art. It gives them the right to decide who gets to make a copy. Many of the best sources of news put up a paywall because it's what allows them to pay their reporters. When you make an illicit copy without their permission, you undermine their ability to make a living. In other words, eat.

I asked pgwhalen specifically, so chiming in with a smug/condescending reply isn't welcome.

It's also IMHO a misplaced or false criticism, per my other comments in this thread.


GP’s explanation is better than I would have given and didn’t seem smug or condescending to me - from my perspective it was welcome.

Your own original had the same problem, so let me play it straight; I don't think there is a legal issue, let alone a clear one.

You don't think phrasing like "There's a thing called 'copyright'", as if I'm not aware of what copyright is, isn't condescending?

Now, either of you relate that concept to a suggestion that HN link to archive.org


> You don't think phrasing like "There's a thing called 'copyright'", as if I'm not aware of what copyright is, isn't condescending?

No, not really. You just seem to be trying to pick a fight.


Yes, really. Not the first time you've hopped on a thread to make a bad call coupled with a personal insinuation:

https://news.ycombinator.com/item?id=43966385


I'm not interested in having a debate on the legality of it which is why I said "legally questionable." It doesn't strike me as implausible that you wouldn't know what copyright is, if you don't accept the premise that linking to the internet archive for any and all paywalled contemporary content is at least legally questionable.

> if you don't accept the premise that ... is at least legally questionable.

The premise was that this is so obvious that my naivety is funny. But no, you don't want to debate that point - Why would you care to consider otherwise, it's not you losing face if correct.

Here's an uninvited counterpoint anyway:

https://blog.archive.org/2024/03/01/fair-use-in-action-at-th...

You'll also notice that the link in this post (https://archive.is/TajtJ) shows a 'log in' button, implying that log-in credentials where not used (or abused) to get/share this snapshot.


I don’t follow the first paragraph of this comment at all, it just seems vaguely antagonistic. You also seem to be suggesting I’m taking a view on a debate that I am not.

That such a blog post exists at least suggests the legal “question” exists, which again is the only thing I said in the first place.


The practise in this case is not starting a competing service to archive.org, but linking to it, so the downsides are what?

There’s a big difference between accepting people will post links that just happen to, sometimes get people past paywalls - and operationalising that so it’s the default behaviour

Actually I'd say the opposite: If it only happens with paywalled sites it's clear that its purpose it to circumvent paywalls. If you always do it, It's so there is a record of the original site at time of posting.

It would also help with sites that can't handle the hacker News traffic load. Happens all the time

didn't google try this with AMP or whatever? It wasn't very popular

Large downsides? How about the news sources going bankrupt? Someone has to pay for reporters.

The sooner some "news sources" go bankrupt the better, especially The Economist.

One large downside is that publishers whose paywalls are being circumvented by the act of submitting to HN, would consider legal action against HN.

Why isn't that already an issue then? archive.is links remain, despite being easy to otherwise detect?

IANAL, but it would seem to me HN couldn't be liable, since it is a third party (archive.is/org) caching the site. In fact, I always assumed that's why the links aren't removed.


I am also not a lawyer, but I would guess that a court might differentiate between choosing not to actively scour user generated content for archive links, versus choosing to proactively provide those links.

I'd guess otherwise.

Worse still, the loop-de-loops can make your packets dizzy which is an unpleasant experience for anyone doing a video call with you and makes games such as VR chat completely untenable.

Yes! Although looping dizziness happens in copper, too.

If you ever experience this, but can't uncoil the transmission cables, a workaround is to spin your desk chair in the opposite direction of data flow, at about the speed of light (for the respective cable medium). This temporary cancels out the effects of ethernet frame looping induced dizziness. Alternatively, you can treat any sickness symptomatically by chewing on a piece of ginger. The latter also helps with aforementioned data-abrasion in fiber optic cables through means not fully understood, yet.


It does highly improve the QoS if you stream Sonic gameplay.

It's less than two hundred words long, I promise you it's not going to take very long to read

This sounds like my kind of hell. I actively enjoy going to work in a busy office and the primary reason to do so is to chat to my coworkers.

I literally cannot work in silence. The best place I ever worked was at one CCC congress where someone had set up a bunch of desks in the corner of one of the raves.

What even is the point of going in to the office if you're going to sit in silent ranks trying to increase shareholder value as much as possible without any breaks or distractions? Eugh.

Bonus: by the way "Trait 2" is written I know for sure that the author has never experienced real hyperfocus. True hyperfocus is something to be avoided at all costs. Writing code for 6 hours straight is a terrible experience and leaves you drained, physically uncomfortable and sometimes mildly injured if you were in a bad posture during that time.


> I literally cannot work in silence.

That is different for many neurodivergent people, but not all. I know some who need silence. I myself need some noise floor, but something that is not distracting, like chatter than I cannot understand or make out, and without loudness spikes or recognizable names/topics/voices. For me, some kinds of music or soundscapes like waves on a beach or forest work best.

And generally, everyone who needs their personal noise in a quiet room can always use headphones. The opposite doesn't work, and the only available soundscape is "office noise" anyways.


Your last point tells me that you haven't experienced hyperfocus. The fact that you ascribe consequences to the act of prolonged focus means you don't experience the ADHD type of hyperfocus.

Because man, consequences do not connect that way. When I hyperfocus for hours, the primary emotion is satisfaction. We fixate due to a malfunction in reward centers, which happens to override negative consequences for long enough that your stiff back is no longer correlated at all to the fact that you've sat motionless over a keyboard for hours.

Even raising the question of avoiding hyperfocus excludes you. Hyperfocus is generally not something that can be avoided or controlled. The chemical gradients hit a tipping point and you're committed whether you want to or not-- and without your awareness or consent.

You appear to be suffering from bad work ethic/balance, not ADHD. Because this is not in any way how an ADHD person experiences hyperfocus. It's not a choice or a consideration, it is an event that happens without your input or control.


> Your last point tells me that you haven't experienced hyperfocus. The fact that you ascribe consequences to the act of prolonged focus means you don't experience the ADHD type of hyperfocus.

What a strange thing to say

> When I hyperfocus for hours, the primary emotion is satisfaction

Lucky you. Are you in your 20s? I thought it was great when I was in my 20s.

> which happens to override negative consequences for long enough that your stiff back is no longer correlated at all to the fact that you've sat motionless over a keyboard for hours.

And your stiff back magically fixes itself the moment you stop concentrating?

> Even raising the question of avoiding hyperfocus excludes you. Hyperfocus is generally not something that can be avoided or controlled. The chemical gradients hit a tipping point and you're committed whether you want to or not-- and without your awareness or consent.

Avoiding it is easy, you simply prevent yourself ever having enough focus for it to hit, or have external stimuli that can cut through it. I have a bunch of alarms and reminders set up throughout the day that are generally enough to jerk me out of it and remind me that I need to breathe properly, sit up straight, drink water and attend to bodily functions.

> You appear to be suffering from bad work ethic/balance, not ADHD.

Thanks for the armchair diagnosis, maybe I should stop taking these pills the doctor gave me


I tried my best to keep the question neutral but you can probably guess I'm not a huge fan of this trend

Sure, it's cute to see a Studio Ghibli re-enactment of your blog post but then I'm always left wondering if I'm going to spend more time reading the article than the author took to write it. It kind of ruins my enjoyment of the indieweb if I end up looking suspiciously at dashes. Could this have been a twitter thread with a few photos and the raw prompts instead?

All that being said, I've been trying to work out if this is another thing I should let go. With how outrage-fuelled social media is these days I've been working on being less judgemental of others if it doesn't directly affect me.

20 years ago you could have perfectly civil conversations on forums with people with usernames xXx_ShadowFox69_xXx and typically the contents of their messages was more important than how cringy their signature was. Maybe this is just an unfortunate part of the modern web I should look past, even if I don't like it?


You would think it's common sense but I've received PRs that the author didn't understand and when questioned told me that the AI knows more about X than they do so they trust its judgement.

A terrifying number of people seem to think that the damn thing is magic and infallible.


I suspect most of it is going to utilities for power, water and racking.

That being said, if I was Sam Altman I'd also be stocking up on yachts, mansions and gold plated toilets while the books are still private. If there's $10bn a year in outgoings no one's going to notice a million here and there.


How many gold toilets do you need? I mean, I don't even own one.


Tragically I don't make CEO money so I also don't have one but I presume you'd want to have at least one per mansion and another one in the office. Maybe a separate one for special occasions.


Lovely to see someone building something that doesn't require Kubernetes over 4 AWS AZs, DynamoDB, S3, Lambda etc etc.


> Does uv work in all of these cases?

Yes. The goal of uv is to defuck the python ecosystem and they're doing a very good job at it so far.


What are the big offenders right now? What does uv unfuck?

I only work a little bit with python.


In my experience every other python tool has a variety of slightly to extremely painful behaviours that you have to work around or at least be aware of.

Sometimes it's things like updating to Fedora 43 and every tool you installed with `pipx` breaking because it was doing things that got wiped out by the system upgrade, sometimes it's `poetry update --only dep1` silently updating dep2 in the background without telling you because there was an update available and even though you specified `--only` you were wrong to do that and Poetry knows best.

Did you know that when you call `python -m venv` you should always pass `--upgrade-deps` because otherwise it intentionally installs an out of date version of pip and setuptools as a joke? Maybe you're not using `python -m venv` because you ran the pyenv installer and it automatically installed `pyenv-virtualenv` without asking which overrides a bunch of virtualenv features because the pyenv team think you should develop things in the same way they do regardless of how you want to delevop things. I hate pyenv.

So far the only problem I've had with uv is that if you run `uv venv` it doesn't install pip in the created virtualenv because you're supposed to run `uv pip install` instead of `pip install`. That's annoying but it's not a dealbreaker.

Outside of that, I feel very confident that I could give a link to the uv docs to a junior developer and tell them to run `uv python install 3.13` and `uv tool install ruff` and then run `uv sync` in a project and everything will work out and I'm not going to have to help them recover their hard drive because they made the foolish mistake of assuming that `brew install python` wouldn't wreck their macbook when the next version of Python gets released.


uv not only completely replaces all of pip, pyenv & venv, but it also does a much better job than any of them at their intended function, as well as a bunch of other convenient, simple developer-friendly features.

1. pip isn't entirely to blame for all of Python's bad package management - distutils & setuptools gave us setup.py shenanigans - but either way, UV does away with that in favour of a modern, consistent, declarative, parseable PEP 508 manifest spec, along with their own well-designed lockfile (there was no accepted lockfile PEP at the time UV was created - since PEP 715 has become accepted UV has added support, though that PEP is still limited so there's more work to do here).

2. pyenv works fine but uv is faster & adds some nice extra features with uvx

3. venv has always been a pain - ensuring you're always in the right venv, shell support, etc. uv handles this invisibly & automatically - because it's one tool you don't need to worry about running pip in the right venv or whatever.


pip and venv. The Python ecosystem has taken a huge step backwards with the preachy attitude that you have to do everything in a venv. Not when I want to have installable utility scripts usable from all my shells at any time or location.

I get that installing to the site-packages is a security vulnerability. Installing to my home directory is not, so why can't that be the happy path by default? Debian used to make this easy with the dist-packages split leaving site-packages as a safe sandbox but they caved.


Regarding why not your home directory: which version of Foo do you install, the one that Project A needs or the incompatible one that Project B needs?

The brilliant part about venvs is that A and B can have their completely separate mutually incompatible environments.


They have their place. But the default shouldn't force you into a "project" when you want general purpose applicability. Python should work from the shell as readily as it did 20 years ago. Not mysteriously break what used to work with no low-friction replacement.


Python can work from the shell, if you don’t have external dependencies. But once you have external dependencies, with incompatible potential versions, I just don’t see how you could do this with “one environment”.


It does work from the shell.


Why can't we just have something like npm/gradle/maven dependencies? What makes python any different?


A python virtualenv is just a slightly more complicated node_modules. Tools like PDM, Poetry and uv handle them automatically for you to the point where it effectively is the same as npm.

The thing that makes Python different is that it was never designed with any kind of per-project isolation in mind and this is the best way anyone's come up with to hack that behaviour into the language.


For years, pipx did almost all the work that I needed it to do for safely running utility scripts.

uv has replaced that for me, and has replaced most other tools that I used with the (tiny amount of) Python that I write for production.


> Not when I want to have installable utility scripts usable from all my shells at any time or location.

Can't you just have the thing on your PATH be a wrapper that invokes the tool via its venv?


That's what `uv tool install` does: it creates the wrapper and puts a symlink to it into ~/.local/bin (which you can add to PATH with `uv tool update-shell` if you don't want to do it manually). I don't recall pip doing anything helpful here; I think it still leaves it up to the end user to either add the venv's bin directory to their PATH or create the wrapper and put it somewhere already on the PATH. So it's a reasonable complaint that `pip install` has become less useful now that it resists installing tools outside of a venv but still lacks the replacement feature (which third party tools like uv and pipx do provide).


It unfucks nothing because it wasn't fuckd in the first place. Whole uv is solution to non existing problem.


That's giving way too much credit to uv.


I'm interpreting this as "uv was built off of years of PEPs", which is true; that being said the UX of `uv` is their own, and to me has significantly reduced the amount of time I spend thinking about requirements, modules, etc.


uv is really that good.


If so, ok, let's port this prototype to back to python and get rid of uv.


What does this comment mean? Port the dependency and virtual environment manager back to the language?

Should we port npm “back” to node js?


Well, go does have the module management, including downloading new versions of itself, built-in into the `go` tool itself. It is really great.

But I don't see this hapenning in python.


You don't see that happening because you don't want to.


npm is written in javascript, not rust or c#.

yes, we should bring package manager back. if it is so awesome and solves some problem.


Sounds good, I agree that uv should come with the language in the same way npm comes with node and cargo comes with rust.

You keep using words like "we" and "us" so I assume you'll be kicking off writing the PEP to make this happen?


They've definitely not done it yet, but they're getting there.


It really isnt


If it was easy there would be more memory manufacturers, rather than 2-3 wholesalers who sell to the people who put badges & rgb on it


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: