Warning: this question does not represent a security concern and really isn't all that serious.

The problem lies with this badge:
enter image description here
Which is awarded for: Visited every section of the FAQ.

However, instantly earn this badge by opening up the JavaScript console in your browser and entering:

$.ajax({ url: '/faq/read', type: 'POST',
data: { fkey: StackExchange.options.user.fkey } });

Congratulations! You just earned a badge.

Now for the technical explanation:

The way this badge appears to be implemented, when you expand each section of the FAQ, an AJAX request is made to /faq/read, granting you the badge. The code that checks whether each section has been expanded is completely client-side and the server trusts completely that the user actually did expand each of those sections (note that it doesn't trust that the user has read the sections - there's no way of ever being able to do that).

The solution? Well... there really isn't one that I can come up with. Even visiting multiple pages to earn the badge can be scripted.

Any suggestions for ways to make this more difficult are welcome.

share|improve this question
It's a bronze badge. A bronze badge щ(゚Д゚щ) –  lunboks Oct 15 '11 at 19:42
Did it take you more time or less time than just clicking each section of the FAQ to figure that out? –  Flexo Oct 15 '11 at 20:45
add comment

3 Answers

up vote 12 down vote accepted

Warning: this answer contains an instance of irony. It also contains an instance of sarcasm.

So? The user has visited every section of the FAQ. With the help of a browser, sure, but that's necessary anyway, unless you go and read the server's disks with a magnetized needle like a real programmer. (It might not work so well.)

I propose that in order to expand each section of the FAQ, you must solve a captcha. That will ensure that a human being is doing the expansion.

Well, you did say you wanted to make visiting every section of the FAQ more difficult.

The point of this badge is to get people to read the FAQ. If they're going to go out of their way not to read the FAQ, there's nothing you can do.

Ok, there is: you can do a reading comprehension test. Or at least a reading test, like AT&T Research does when you want to download ksh. I'm not sure how well that would work, but this (unlike the previous one) isn't a ridiculous idea.

share|improve this answer
A captcha... good idea! I never thought of that. –  uɐɯsO uɐɥʇɐN Oct 15 '11 at 19:35
Probably one of the biggest frustrations is that most of the FAQ is identical across all SE sites - so if I've read it once, I've read 95% of the content in all of the others. I'm certainly not advocating it, but this little script could avoid expanding blocks of text for 30 minutes straight to get the badge on all of the sites. –  uɐɯsO uɐɥʇɐN Oct 15 '11 at 19:37
@GeorgeEdison Or you could just not care about badges you're unwilling to earn? I don't have anything to say in my profile, so I don't have autobiographer, even though it's trivial to get –  Michael Mrozek Oct 15 '11 at 19:40
I hate captchas .. and having to do multiple captchas to expand multiple sections, gah... FAQ it. –  Stephen Oct 15 '11 at 19:41
Okay, to avoid any further confusion, I'm not saying that a captcha is worth implementing. I just happened to think that it does answer the question I asked and therefore is a "good idea". –  uɐɯsO uɐɥʇɐN Oct 15 '11 at 19:52
@Stephen WTF? How can someone possibly take the captcha suggestion seriously? –  Gilles Oct 15 '11 at 19:53
@Gilles: surely the point of stephen's comment was to make the FAQ it pun? –  jrturton Oct 15 '11 at 19:57
I've updated the question now. –  uɐɯsO uɐɥʇɐN Oct 15 '11 at 20:21
add comment

I don't think it's a big problem really. If you're smart enough to figure that out for yourself, in order to game the badge, or you've already found meta (and this question to copy and paste it from) then it seems likely that you already:

  1. understand Q&A and the mechanics of the site
  2. can find the FAQ at appropriate points in time

These two things seem to be the point of the badge so it doesn't seem like there's anything being lost by from the perspective of the site by gaming it like that.

share|improve this answer
add comment

To echo Gilles, So? It Probably takes less time to do this manually than by hacking around with JavaScript. There should probably be a separate badge for reading it mechanically to prove how L33t you are.

The value of the badge comes from the fact that it highlights that the FAQ exists at all. I know I didn't read every section of it until I'd been a member for a month or so and was scrabbling round for any easy badges to earn.

It's only a bronze one. You should worry more about those dastardly people using robots to log in every day to win the Enthusiast and Fanatic badges.

share|improve this answer
I think we can all agree that copy-and-pasting that line of code takes all of 10 seconds. Expanding each section of the FAQ takes longer than that. –  uɐɯsO uɐɥʇɐN Oct 15 '11 at 19:45
Speak for yourself, I don't even know where the JavaScript console is on my browser :) –  jrturton Oct 15 '11 at 19:48
I second @jrturton. –  Oxwivi Oct 16 '11 at 9:07
I'd been a member for "2 years, 10 months" and just got the badge today. I stopped caring about badges after the first few months and that one was newer. Of course, I had to try the obvious approach just for fun: $(".show-more").click(). Now, where's that badge-gaming badge? –  patridge Oct 18 '11 at 21:28
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .