2

I just did my first edit and as always I was attacked by captcha. I often make language errors, so I have to fix it later. I know why the rule exist, but for power-editing other people questions there should be no check (it would be cool also if you remove checks for fast changing your own questions/comments/answers - you could not store all version, just the latest in that usecase)

P.S. If that is not possible, could you at least change captcha to be less annoying?(you have the best as far as annoyances goes)

EDIT

I just got attacked by captcha because I was adding tags to question(not mine question, thats why it hurts), why adding tags is a bad thing? I can do things slower, but im bored if I do things too slow and we all know that many people are too busy to add the right tags.

Improve this question
3
  • 6
    Slow Internet makes the fairly frequent captchas extremely frustrating.
    – moinudin
    Commented Jan 1, 2011 at 18:47
  • 1
    because it is an extra page, that sometimes shows up, and sometimes not.
    – studiohack
    Commented Jan 1, 2011 at 22:07
  • P.S. You could also upvote my question, on meta votes are not only for cool people, but also to push idea and change that stupid system.
    – IAdapter
    Commented Jan 1, 2011 at 22:17

4 Answers 4

Reset to default
8

I think the CAPTCHA system was one of the very few things in Stack Overflow done wrong since the beginning.

It is way to aggressive; some steps were taken during the past year to relax the rules a little, but it is still too annoying. Think about facebook: it has CAPTCHAs too but how many times have you been asked for one?

CAPTCHA - since it annoys the user - should be used only if by doing so it will stop automated programs from damaging the website. It should not be used as a preventive measure, "just in case": it should be set up after seeing automated bots and in such a way that it annoys the users as little as humanly possible.

For example existing high rep users should never be asked for a CAPTCHA unless their actions are too fast to have been performed by a human (this is how facebook does it, by the way.. If you create a new account and send a couple of messages you will be captcha'd, but if you send even 10 from an old account you won't).

This has been proposed in the past but Jeff was against it because "what happens if a high rep account gets compromised by a spammer?". But, has it ever happened? What are the chances that a high rep account gets compromised, not just by anyone, but by a spammer? Is this chance worth inconveniencing thousands of people who donate their time in order to improve the website?

Improve this answer
4
  • 2
    I'm guessing your code is full of vulnerabilities because "eh, it's never happened to me!". Security isn't about reacting, it's about preventing.
    – Nicholas Knight
    Commented Jan 2, 2011 at 17:18
  • Add least Stack Overflow's CAPTCHAs are readable; I just had to renew a domain and it took me seven tries before I could get it right.
    – Aarobot
    Commented Jan 2, 2011 at 17:19
  • 2
    @Nicholas: not in this case. If a bot goes through it's not the end of the world; whatever damage it does (spam posts, etc) can easily be reverted in an automated fashion. You always have to weight security and convenience, based on what you want to protect. You wouldn't go through 20 security checkpoints, have your retina scanned, and be cavity searched just to go buy groceries right? :) But this is probably acceptable for entering a nuclear facility. Different things require different security.
    – Andreas Bonini
    Commented Jan 2, 2011 at 18:46
  • 1
    The first thing SO got wrong was OpenID. Captcha was the 2nd worst thing.
    – user136634
    Commented Jan 2, 2011 at 19:59
1

For some reason it's seen by the site's owner as very desirable to have restrictions on all activities, to keep people from using them a lot. So to keep you from doing too much janitorial work there are captchas that get in your way. I don't know why it is assumed to be good for the site if cleanup actions are made tedious and frustrating.

Having 10k reputation reduces the captcha time limits to a level where you don't hit them all that often.

Improve this answer
5
  • but to get 10k you have to ask/answer a lot of stupid questions(from hard questions you can only get satisfaction), but its good to know that, thx for sharing. maybe it has something to do with db performance? the more updates/inserts the slower the db is.
    – IAdapter
    Commented Jan 2, 2011 at 11:47
  • 1
    @01: I got to 10k and well above without answering "a lot of stupid questions", and that was over a year ago. Maybe you should post better answers?
    – Aarobot
    Commented Jan 2, 2011 at 17:42
  • And sth - it's simply foolish not to use any rate-limiting on any modern site. It's easy to say it's unnecessary when nothing bad is happening, but take those limits away and it won't be long before the first DDoS or spam attack.
    – Aarobot
    Commented Jan 2, 2011 at 17:43
  • @Aarobot: For DDoS you really don't need to edit posts, I don't think the captcha is any help there. And to edit you need 2000 rep, which shows a certain commitment to the site. I would assume that only quite few of those people would turn their accounts into spamming accounts. For sure it wouldn't be that many that it couldn't be dealt with individually. If someone wanted to spam/... through editing it would need to be dealt with individually anyway since you can also cause a lot of harm with one edit per 30 seconds (or whatever the limit is). I don't see how the captcha helps there at all.
    – sth
    Commented Jan 2, 2011 at 18:52
  • You're kidding, right? Denial of service attacks don't have to be done at the network level. Usually a much quicker path is to bring down the application or the database, and write transactions are by far the quickest way to do that. Rate-limiting write access is one of the most important things that any web application can do.
    – Aarobot
    Commented Jan 2, 2011 at 19:00
1

for power-editing other people questions there should be no check

Massive batch "power"-editing is bad. It pollutes all question listing pages, the points of entry for answerers.

(it would be cool also if you remove checks for fast changing your own questions/comments/answers - you could not store all version, just the latest in that usecase)

This is already done. Multiple edits to the same post by the same user within 5 minutes of each other are merged in the same "commit."

Improve this answer
0

The most famous answer on SO was made by someone who just returned home from a pub. Even high rep users use the site when they aren't exactly, well, themselves.

I like the system as-is. It makes you think twice before doing things, while helping to defeat a compromised account that is doing deliberately bad things.

Deliberately forcing a pause from time to time is not a bad thing. If you think about it, it wastes 1-5 seconds of the hour that you were going to use the site otherwise. What could you have done in 1-5 seconds? And, what does getting pissed at a simple form to submit do to you during the 90 seconds you spend doing something constructive?

If you drive, there are red lights and stop signs. If you resent them, you must be a very unhappy person.

Improve this answer
1
  • 1
    Actually, most stop signs in North America are used for traffic calming rather than legitimate safety concerns and end up doing more harm than good. Stop-sign related accidents factor high into the overall statistic, but how often do you hear about accidents at unguarded intersections or roundabouts? That being said, I don't resent them, I just treat them as yield signs when they clearly aren't necessary.
    – Aarobot
    Commented Jan 2, 2011 at 17:34

You must log in to answer this question.