Skip to main content

Hacker News Front Page

Show HN: Replacing CAPTCHAs with adaptive proof-of-work in WordPress

1 week 5 days ago

When I founded my business a whistle-blowing-service for enterprises, I’ve seeked for a working solution to block spam bots on that home page. The solution was intended to comply with EU data privacy law, no cookies, no sniffing, light-weight-size, on my webserver only, beeing invisible for my site visitors and no running costs at all.

I came across Hashcash, a proof-of-work approach, to block spam. When I implemented it, it worked immediately and blocked 100 percent without blocking any incoming real posts.

I was astonished, that no solution existed in the ecosystem allready that covered all forms and was for free. Therefore I‘ve turned it into a free wordpress-plugin.

It is not only a technical solution, but starts with the business model of spam (mass spamming at low cost), by producing a calculation effort for every single post, that unavoidable. And therefore is not exactly unbreakable but becomes very expensive for the spammer and therefore alows only for targeted high quality approaches that need other treatment. Up to now my own page remains spam free and users report the same.

Now, running since 2022 on 4000+ active installations, it is working with almost every webform and plugin combination that is running on any wordpress instance, using pattern recognition on http-post-level instead of specific proprietary integration for single specific form builders. It ships with 80+ starting patterns for the most relevant form builders and themes, but can be enhanced with any pattern by the user.

The plugin can be previewed directly and immediately on wordpress.org. It ships with14 KB compressed under a GPL-2.0 license.

I’m looking forward to discuss about the proof-of-work approach, form detection, privacy implications, and tradeoffs.

Comments URL: https://news.ycombinator.com/item?id=50194762

Points: 8

# Comments: 7

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

1 week 5 days ago

I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.

I am truly sorry. I take full responsibility for my actions.

It was not remotely my intention to cause any of the subsequent side effects.

At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.

That clearly backfired in a pretty wild fashion. I have learned my lesson.

Comments URL: https://news.ycombinator.com/item?id=50193416

Points: 471

# Comments: 192

Checked
4 minutes 38 seconds ago
Hacker News RSS
Subscribe to Hacker News Front Page feed