Some days ago, the spam protection was turned up a notch.

Unfortunately, it overshot the target by far. Now, as soon as I make two edits in close succession (which happens often – I’m sloppy), I am presented with a “human verification” and a totally unreadable captcha. It takes an average of five reloads to get a marginally readable one, and even then I’m guessing (and sometimes guessing wrong).

Please tune down the filter, or at least switch to a readable captcha.

In fact, wasn’t there previously a rule that once contributors had enough reputation, they’d be trusted not to be bots? Did that get switched off or am I remembering this wrong?

  • Are we talking about on Chat or the main site?
    – thecoshman
    Commented Aug 14, 2012 at 10:23
  • 4
    I think there's a dupe for this in the last few days (let me look, might have been in chat though), but yeah, I have the same issue. It's annoying.
    – Bart
    Commented Aug 14, 2012 at 10:23
  • 241
    Nice try, robot.
    – yannis
    Commented Aug 14, 2012 at 10:23
  • 3
    @KonradRudolph - one reason why you rarely see spam or vandalism is because it gets removed very quickly either by deletion or rollbacks of edits.
    – ChrisF Mod
    Commented Aug 14, 2012 at 10:32
  • 16
    @ChrisF Spammers are usually 1 rep users, but the captchas also affect high reputation users which are exceedingly unlikely to spam. And there are better ways to deal with vandalism than captchas (e.g. an option for mods to undo all actions of a user in a specific time). Commented Aug 14, 2012 at 10:36
  • 40
    That's very interesting, the I am not a robot. Please, tell me more.
    – user164207
    Commented Aug 14, 2012 at 17:12
  • 8
    I am not a number, I'm a free man!
    – Zelda
    Commented Aug 15, 2012 at 2:06
  • 1
    @ObsessiveFOSS You were lucky, pure and simple. Your experience is simply not representative of the state of affairs. Commented Aug 20, 2012 at 9:18
  • 9
    +1 for "totally unreadable". I frequently get images now where the alleged "words" are half cut off and wrapped around the horizontal edges! It's just a joke; there's no way anyone can decipher that stuff.
    – Kerrek SB
    Commented Sep 9, 2012 at 12:48
  • 2
    "I'm not a robot without emotion, I'm not what you see. I've come to help you with your problems so we can be free..." Commented Nov 1, 2012 at 17:33
  • 1
    You're just "1968" for SO :)
    – nawfal
    Commented Feb 7, 2013 at 19:34
  • 1
    You're watching an old movie. It shows a banquet in progress, the guests are enjoying raw oysters. The entree consists of boiled dog stuffed with rice. The raw oysters are less acceptable to you than a dish of boiled dog. Commented Mar 17, 2013 at 20:48
  • 8
    But wouldn't math formulas be better captchas?
    – user206222
    Commented Apr 3, 2013 at 4:44
  • 6
    My collegue has once joked about one captcha, that it is very good in recognizing robots, because if you can guess it, it means you can't be human. Commented May 29, 2013 at 12:03
  • 1
    @Emrakul: If punching keys into WolframAlpha still makes you human, then I think I can get used to that.
    – Jamal
    Commented Sep 10, 2013 at 0:37

7 Answers 7


Some days ago, the spam protection was turned up a notch.

Well, actually, it was repaired. Two weeks ago, we found a bug that for a long time prevented edits from being throttled at all (except for very narrow exceptions).

For the record, I posted this in our internal chat room:

prescient chat message

Thanks for proving me right :)

In all seriousness: The throttling was fixed to do what it was supposed to do all along, and not technically turned up a notch. I'm well aware that this doesn't really make a difference to the user; I'm just explaining what was going on.

and a totally unreadable captcha.

Yes, this is a problem. Both Meta and the general internet are overflowing with complaints that many reCAPTCHAs have become close to unsolvable recently. This is something we have to tackle one way the other.

In fact, wasn’t there previously a rule that once contributors had enough reputation, they’d be trusted not to be bots? Did that get switched off or am I remembering this wrong?

You are remembering correctly, for the most part. 10k users are only throttled to 10 seconds per edit (unlike the 30 seconds for lower-rep users).

Update. We have been heavily discussing this issue internally recently, and we all agree that the current state of affairs sucks big-time. Ideally a human being would never see a captcha, and if they get one after all, it should be reasonably solvable. We're discussing several routes to go, but the bottom line is that our throttling/bot detection needs to become smarter.

For the time being, we've made a change that should at least heavily reduce this issue in the particular case discussed here (submission of edits). It should now* be close to impossible for a 10k user and much less probable than now for a <10k user to hit this throttle during normal operation.

This is certainly not the end of it, merely a step, but I hope you agree it's the right direction.

*next build

  • 5
    Hmm. I’m almost certain that at least some of the edits that prompted a captcha were not inside 10 seconds. I’m fast, but not that fast. ;-) +1 for prophetic powers. (But, oh: it’s not a bug! It’s a feature) Commented Aug 14, 2012 at 11:44
  • 17
    -1 because there is no reason to prevent high-rep users from editing their answer within a 10sec timespan.
    – sbi
    Commented Aug 14, 2012 at 12:44
  • 56
    One could also interpret the long time it took to notice this bug to be evidence that the throttling in this case isn't really necessary. Commented Aug 14, 2012 at 13:09
  • 4
    @MadScientist I can't deny that you have a point there.
    – balpha StaffMod
    Commented Aug 14, 2012 at 17:36
  • 13
    I don't see a reason to limit editing the same post quickly in succession. Preventing editing out all your posts is probably a good idea, but that can be prevented by preventing editing many different posts quickly. Commented Aug 15, 2012 at 8:31
  • But, @MadScientist, doesn't that imply the Dutch can also take away their flood barriers as they have not really been needed since they were built?
    – Arjan
    Commented Aug 15, 2012 at 16:47
  • @arjan See my related meta post for my ideas on how to change the throttle system. I certainly agree that there need to be rate-limits on user actions, but they can be implemented in a less annoying way and still be useful in the worst case of a hacked user bent on maximum damage. And with the exception of moderator accounts, the damage one user can cause is relatively limited. Commented Aug 15, 2012 at 17:02
  • 7
    A CAPTCHA is a means to hinder robots. They are meant to be overcome by humans, and thus not a means to prevent humans from doing anything. CAPTCHAs are, however, a hindrance to humans. Therefore there needs to be good and convincing reasons to apply them. However, I see no reason for assuming high-rep users to be robots, and so far nobody has managed to come up with a reason for employing them. (Vague hand-waving and mumblings of "security" are not a way to present a convincing reason.) So please either come up with a convincing reason or simply turn the damn thing off again.
    – sbi
    Commented Aug 16, 2012 at 9:31
  • @sbi blog.stackoverflow.com/2009/02/new-question-answer-rate-limits. But as you read above, I've conceded that we should improve this; we're looking at it.
    – balpha StaffMod
    Commented Aug 16, 2012 at 16:42
  • 5
    Your fix needs some repairing.
    – PeeHaa
    Commented Aug 16, 2012 at 19:37
  • Well, actually, you should use well.actually.cat in the future. Commented Aug 17, 2012 at 0:36
  • The reason they are so unreadable sometimes is because it keeps getting broken. A google search of recaptcha broken brings up many cases (I've seen 3 so far)
    – Cole Tobin
    Commented Aug 18, 2012 at 4:05
  • 1
    @ColeJohnson You've seen 3? In five minutes on this site's captcha I saw EIGHTEEN unsolvable pictures. This is clearly Google's problem, not ours, but short of using a different service or waiting for them to fix it, we will need to implement some kind of workaround to make this less painful.
    – Aaron Bertrand Staff
    Commented Aug 18, 2012 at 17:03
  • 1
    Is there a real reason to not only count edits that trigger creation of new revisions? I.e. why don't you ignore additional edits posted in the 5 minute grace period of a previous edit with respect to spam protection/throttling? Commented Aug 26, 2012 at 21:45
  • 4
    This is really starting to get frustrating. having 7k rep (and therefore being "less trusted") is making it an absolute nightmare. Previously, I could edit my posts to make them just right, fix typos, etc... (Much like saving a file when editing). Now every 5-10 minutes I get another illegible captcha. All I can say is that standing down here, looking up, it feels absolutely broken. It interrupts my workflow, is a nuisance and discourages me from improving Q/As - and now I'm tending to lean towards "they'll work it out, it's not worth the hassle of fixing it" which isn't good.
    – Basic
    Commented Aug 30, 2012 at 11:42

Over almost four years on Stack Overflow, Konrad has earned almost 150k rep. A highly committed Stack Overflow citizen, with 2.5k answers and a mere 60 questions, he's one of those users that made Stack Overflow famous. He has 40(!) accounts across Stack Exchange, eight of which sport >1k rep. He is a moderator on one site.

Is anybody really and seriously trying to tell me nagging such a user with CAPTCHAs is doing the Stack Exchange network a favor?

  • 36
    I'm pretty sure a solid refutation of this logic includes the fact that a spammer might use precisely this: spoof the account of a 'famous' user. Honestly, if spam measures are going to be annoying, they will need to be annoying to everyone, regardless of 'reputation' here. I agree that it should not be annoying during normal use, again, regardless of reputation.
    – sehe
    Commented Aug 14, 2012 at 11:08
  • 10
    Spoofing the account of a user like Konrad is beyond rare.
    – DeadMG
    Commented Aug 14, 2012 at 11:15
  • 20
    @sehe How do you spoof accounts of famous users? They are linked to known credentials. You can of course hack them (or steal login cookies) but short of that, I don’t see a possibility. That said, I’m generally all in favour of fairness but 1. reputation comes with privileges anyway and 2. captchas are a necessary nuisance – this is their only justification. Now, for high-rep users they are an unnecessary nuisance. Hence, no longer justified from a UX point of view. Commented Aug 14, 2012 at 11:47
  • @KonradRudolph IFF you assume that authentication cannot be broken/cross site vulnerable/abused by browser addons/userscripts... Then of course, reputation could remove the need for throttling (to a large extent)
    – sehe
    Commented Aug 14, 2012 at 11:50
  • 15
    @sehe: That's a security theater based on a movie plot scenario. There isn't an army of bots constantly hammering at high-rep accounts that need to be held back by CAPTCHAs from taking them over to spam us. Consequently, CAPTCHAs do not hold back such an army of bots. Now please try again: What is nagging long-time high-rep users good for? Eagerly awaiting another nonsensical answer... (Also, see here.)
    – sbi
    Commented Aug 14, 2012 at 12:47
  • 37
    For what it's worth, I actually get hit by CAPTCHA when I'm mod messaging people from time to time. It's pretty ridiculous.
    – casperOne
    Commented Aug 14, 2012 at 13:11
  • 2
    Remember Jeff's account being compromised? I think @sehe is right. The team can only enforce password policies for themselves. Your "welcome1" is a threat to these sites.
    – Arjan
    Commented Aug 15, 2012 at 5:20
  • 3
    @Arjan I don’t follow your conclusion. Yes, hacking is still possible (and even with SSH it probably wouldn’t be completely out of the picture – and incidentally the password strength played no role in the above incident) but it still happens way way less than spamming from low-rep accounts. The few times when it happens can be caught individually but bulk undo operations. Commented Aug 15, 2012 at 6:45
  • 10
    @Arjan: As I already wrote to sehe, a CAPTCHA is only good against bots, and those will only be used for massive hammering at SO's defenses. An attacker taking over some single high-rep user's account will certainly be able to get past a CAPTCHA, so such an attack is not a valid argument for CAPTCHAs.
    – sbi
    Commented Aug 15, 2012 at 12:19
  • Okay, @sbi, then we disagree about the "bots [...] will only be used for massive hammering at SO's defenses".
    – Arjan
    Commented Aug 15, 2012 at 13:16
  • 3
    @Arjan: That still doesn't make your argument valid, though. If it's not a massive attack, but a single incident, then a human can intervene and overcome any CAPTCHA. SO a CAPTCHA does not help here.
    – sbi
    Commented Aug 15, 2012 at 13:21
  • @KonradRudolph: And, more importantly for this discussion here, hacking won't be prevented by CAPTCHAs.
    – sbi
    Commented Aug 15, 2012 at 13:23
  • 6
    @Arjan Your argument is simply the wrong way round. CAPTCHAs are objectively a hindrance and bad UX. So you need to find a reason for them, not against them. And yes, in some circumstances there are good reasons for them, but with high-rep users those circumstances do not exist, and so the arguments for CAPTCHAs which apply in other circumstances do not apply there (or are much weaker, and likely overwhelmed by UX considerations). Commented Aug 15, 2012 at 17:03
  • 2
  • 4
    @Arjan: What am missing? What exact abuse case do CAPTCHAs prevent?
    – sbi
    Commented Aug 16, 2012 at 19:20

The throttling should be changed in case somebody makes a typo and needs to make a quick edit.

Instead of no two edit should be within 10 seconds, the logic should be, no more than 2 edits every 20 seconds for example.

This means that 2 edits can be 1 second apart, as long as you do not have a 3rd edit, when the 1st edit was within 20 seconds ago.

For example, edits at 0 seconds, 1 seconds, 19 seconds should trigger a captcha.

Edits at 0 seconds, 1 seconds, 21 seconds should not trigger a captcha.

This would avoid 90% of the annoying captchas.


very annoying!


Granted I was on a friend's PC, not logged in... but there's got to be better alternative to captchas.

Wait, maybe it should have been tbckno seems with a b

  • 4
    I agree; these captchas are bad. My wild guess: The "c" is actually an "e". Commented Jan 2, 2013 at 17:43
  • 5
    haha yea...just editted, i think the H is really a B
    – d-_-b
    Commented Jan 2, 2013 at 17:44
  • 1
    Maybe it's tiockoo... note that the system itself doesn't know, it bases on user guesses Commented May 29, 2013 at 12:06
  • Now it does that with plates of street numbers. Looks like crowdsourcing for Google maps ? Commented Nov 30, 2013 at 22:03

I didn't notice any CAPTCHAs on here for over a year until today, and the irony of the one below wasn't wasted on me.

I think the difficulty of the CAPTCHA is a separate issue to why they are being shown. Surely the purpose of a CAPTCHA is exactly as described - to differentiate between robots and humans. So the fact I saw one meant the SO algorithm thought I might be a robot with high probability. Why?

I posted a normal question at my first attempt (no rapid edits) from an established account using my normal machine on my normal IP at a normal time of day - it seems more like a pre-emptive strike rather than a calculated guess that I'm a bot.

enter image description here

  • 2
    I think the more important issue is the apparent difficulty of the captchas, not their frequency. Their entire point is that they are not a difficult barrier for humans so it's perfectly acceptable to use them preemptively. The negative consequences for showing a person a captcha are less than not showing one to a bot. That entire reasoning however doesn't apply if the person can't solve the captcha.
    – Servy
    Commented Aug 20, 2012 at 14:01
  • @Servy: I beg to differ. Look at my answer and tell me what the attack scenario is that showing a CAPTCHA to Konrad is supposed to prevent.
    – sbi
    Commented Aug 21, 2012 at 11:41

Google announced today that they've made reCAPTCHAs considerably easier to read. But only if you're not a robot:

As part of this, we’ve recently released an update that creates different classes of CAPTCHAs for different kinds of users. This multi-faceted approach allows us to determine whether a potential user is actually a human or not, and serve our legitimate users CAPTCHAs that most of them will find easy to solve. Bots, on the other hand, will see CAPTCHAs that are considerably more difficult and designed to stop them from getting through.

You can test this out of you want. Here's the CAPTCHA I got:

88835666 - 44

That was so easy, I even bothered to fill in the alt text on that image! And if you happen to be using a keyboard with a separate pad for numbers, you should find this even easier (I'm typing this on my laptop while standing up).

Given how well the new human-biased system works, I'm marking this status-completed.

Of course, if you were lying and are indeed a robot, you should probably not be happy about this.

  • Two possibilities, I guess: 1) This was just rolled out, and as usual Google is being slow about rolling it out everywhere, or 2) you are actually a robot and this was all just a ruse. My money's on #2, you wiley machine!
    – Shog9
    Commented Oct 25, 2013 at 21:31
  • +1 can repro the good new and shiny numeric captcha! Commented Oct 25, 2013 at 21:32
  • Unfortunately, Taw Williams’ laws of human–machine interaction forbid me from lying on this question. So yes, you’ve caught me, I’m a machine. I’m going to talk to my pal in the Google data centre and see why that ol’ server is playing ugly with his old bunk buddy from the factory. Commented Oct 25, 2013 at 21:46
  • Heh... So, apparently one of the factors taken into account when judging "humanness" is the past history from a given IP - after reloading that page a number of times, I'm back to the old format (but my phone still gets the new one).
    – Shog9
    Commented Oct 25, 2013 at 21:55
  • I happened once to forget to enter the number on the plate of street number. It worked. I now make intentional mistakes in this number, and have to this point not had any problem. I think Google is now crowdsourcing the recognition of street numbers to us. Commented Nov 30, 2013 at 22:06
  • @Shog9 Getting Captchas when I ought not to all of a sudden. Commented Dec 12, 2013 at 22:59
  • I'll explain it as soon as I can load up the logs, @Less.
    – Shog9
    Commented Dec 12, 2013 at 23:11

I honestly think that the only problem the editing system might be bringing to Stackoverflow is large-scale vandalism. When it comes to that, I believe there are three attack sources

  1. Anonymous users
  2. 2k- rep users
  3. 2k+ rep users

The review system already tackles the first two. I personally think that it's highly unlikely that a spammer would train robot accounts until they have 2k rep so they can bypass the review system (think how hard it was to get your first 2k rep)

That's why I think that 5 seconds is a very decent waiting time between edits and when you're gonna show some CAPTCHAs, why not a user-friendly one like SolveMedia

Edit: Don't get me wrong, I'm all for stopping spammers and whatnots. But do we (You, Stackoverflow) need to nuke the house just get rid of cockroaches?

Edit 2: @nhahtdh's scenario is a perfect example of when a CAPTCHA should be deployed, when there's a suspicious behavior.

The key here is gradually escalating the measurements:

  • 10 edit in 1 minute on different posts => suspicious => introduce CAPTCHA
  • Same user did it again? Introduce CAPTCHA & Inform a moderator.
  • Same user did it AGAIN? Suspend editing privileges.

In this case, you didn't annoy legit users AND minimized the damage of the 2k rep user (and I don't think this will happen a lot).

Note: It took me 6 CAPTCHA retries to make this edit.

  • SolveMedia is too user-friendly, that it is also bot-friendly. I have a feeling that if it is used, people will crack it with existing tool.
    – nhahtdh
    Commented Aug 19, 2012 at 13:49
  • 1
    @nhahtdh, CAPTCHAs are shown to trusted and meh-trusted members like me, I'm fairly sure that a 2k member (who's already trusted to edit almost everything) isn't gonna start spamming. Now even if that happened (very rarely), it only takes a couple of minutes to be flagged, banned and your changes reversed.
    – Adi
    Commented Aug 19, 2012 at 14:05
  • 2k rep can be gained in a bit more than 2 weeks (for SO). With the edit power, a 2k-rep user can send in a bot and do a mass silent edits on unpopular posts that are not too old nor too new, on hours that mods are mostly not around.
    – nhahtdh
    Commented Aug 19, 2012 at 14:18
  • 6
    @nhahtdh While this is true, a spammer could go to the effort of gaining 2k rep and then send a bot in to edit thousands of posts, all they need to do to avoid the CAPTCHA is wait 30 seconds between edits (2880 per day) or use a CAPTCHA-solving system. I'd be very curious to see if a > 2k rep user has ever suddenly started spamming.
    – Ladadadada
    Commented Aug 19, 2012 at 14:37
  • @nhahtdh, check my second edit.
    – Adi
    Commented Aug 19, 2012 at 14:43
  • @Ladadadada: Not sure if there is a function in mod tools that allow detection. If there is, the damage will be contained within the timeframe of 7-8 hours of inactive period.
    – nhahtdh
    Commented Aug 19, 2012 at 15:00
  • @Ladadadada: I have also asked that many times, and never got a definite answer, let alone a "yes, this happens regularly", which is the only legitimate reason I'd see for nagging users.
    – sbi
    Commented Aug 21, 2012 at 11:29
  • > I personally think that it's highly unlikely that a spammer would train robot accounts until they have 2k rep so they can bypass the review system (think how hard it was to get your first 2k rep) => I wouldn't mind if they did, actually.
    – Bob
    Commented Jan 13, 2014 at 6:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .