What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

As I'm going through tagging questions as discussion, feature-request, or bug (as requested by Jeff), it would be awesome if I wasn't subject to CAPTCHAs. So I humbly request that there be a developer flag that can be placed on a user that will prevent him from getting the CAPTCHA.

It would be done after talking with the user and getting his agreement not to bot the site using his account, and would be a convenience feature for users who do manual retagging.

Edit: In response to the account being compromised, there are two scenarios.

  1. compromised by CSRF, which SO already protects against
  2. compromised by a knowledgeable malicious entity. I think this case is equivalent to a user's, moderator, or administrator account being compromised. The damage will be done at a faster rate, yes. It's up to the user being responsible.

In response to someone going postal and not agreeing to honor his word: I didn't expect the flag to be set very often, only on a dozen or two people. Jeff already trusts many of us with the keys to his castle - those with ♦'s, Greg debugging the data dump, and so on. I see this as no different. The few people who have proven themselves as valuable contributors retagging items on SO are perfect examples and candidates.

share|improve this question

7 Answers 7

Your account could still be taken over by a bot and then run through the whole time.

Therefore, this should be on a per session basis. If you pass a CAPTCHA during the current session, you should be trusted until that session ends (maybe timeout of an hour). That would solve the retagging/mass edits issue that I know I always hit if I answer a question and then edit the tags/grammar of it.

Also, there should be a timer, so that if you hit x number of actions within y seconds that are evenly spaced out, you get the CAPTCHA again to prevent the human signup/bot takeover that TXI mentions.

share|improve this answer

What would stop a user from agreeing to not bot, and then to go bot once he now has free reign? Sure you could ban him afterwards, but the damage would have already been done.

share|improve this answer
3  
What kind of sick monster would break a promise?! –  Hilarious Comedy Pesto Jul 10 '09 at 19:17
1  
@Pesto: Only someone who hated ponies, so that should be the yardstick by which we measure a person's bot-itude: "Do you like ponies? No? CAPTCHA!!!" –  gnostradamus Jul 10 '09 at 19:20
2  
The same thing that stops a moderator from going postal and deleting users (which I bet you there is no captcha on). –  Tom Ritter Jul 10 '09 at 19:21
    
Tom Ritter: I'm not following. What -does- stop moderators from going postal and deleting users? –  TheTXI Jul 10 '09 at 19:29
    
@TheTXI: Moderators who go postal don't get any donuts. –  Hilarious Comedy Pesto Jul 10 '09 at 19:30
3  
Same thing that stops you from pushing through the captcha and trolling all the SO sites. Your reputation (the real-world concept; not the number), honor, integrity, sense of goodness, loyalty, honesty, and general non-douche-ness. –  Tom Ritter Jul 10 '09 at 19:32

As has been stated before, this doesn't help if your account is compromised. The mechanism is in place to prevent funny business - and you're implicitly agreeing to not be a bot in the first place, which is something you or anyone else could easily go back on anyhow.

I'm not sure there's a good way to say 'this person is not and never will be a bot'. What if Jeff runs over your toe in his Hummer, and you want 'revenge'?

share|improve this answer

Just remember that when you answer a reCAPTCHA, you're doing good for the world. Taking that into consideration might ease the pain for you. :)

share|improve this answer

Since the whole idea behind reputation is so the system can learn to trust you, perhaps the higher your reputation, the more the captchas could be relaxed? Maybe have around 4000 rep (double the editing reputation threshold) the capcha could occur after 10 consecutive edits (instead of the current two), or even disabled entirely?

Accounts being compromised and used for mass-edits seem extremely uncommon and unlikely, and even if this happens it should be a case of temporarily disabling their account, undoing the evil changes and informing the user via email about what has happened..

I'm not sure there's a good way to say 'this person is not and never will be a bot'. What if Jeff runs over your toe in his Hummer, and you want 'revenge'?


Your account could still be taken over by a bot and then run through the whole time.


What would stop a user from agreeing to not bot, and then to go bot once he now has free reign?

About the same as what's in place now - not much.. Captchas are, and always will be susceptible to the.. erm.. "bored Australian" attack..

A user with >2000 reputation could go and start editing spam into posts.. moderators could start randomly deleting accounts and such, but... they don't..

They've invested a lot of time into their account (10 days if they hit the rep-cap every day, which is unlikely for a new user). If a user starts being evil, their account gets deleted, their edits undone and that's the end of it.

share|improve this answer

Assuming you are a logged in user and have >= 200 reputation:

After successfully completing one captcha, we now suppress captcha for 5 minutes on your account.

share|improve this answer

I'd say the odds of this happening are low, based on this metric:

Developer time necessary to implement such a system: A lot
Developer time saved by such a system: 0
Developer time necessary to keep system the same: 0

Once again, laziness wins the day!

share|improve this answer
    
That's a good point. However, if we want to push SO's tagging capabilities and flesh out the system, this would encourage people to do mechanical turk retagging. –  Tom Ritter Jul 10 '09 at 19:26
    
I'm guessing Jeff and the team suffer this as much as the other people making rapid changes, such as our "editor" users, and the ♦ moderators. So the second one certainly isn't 0. –  Marc Gravell Jul 10 '09 at 21:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .