Mainly Claude and Muse Spark. It seemed happy to help if it was convinced that I controlled the website with the test captchas on it. I’ve also found the more Claude saves memories of working on the project the less conflicted it gets.
Did you ever get one of those cybersecurity incidents from Claude while working on this project. By the way, great job man this is a remarkably well done project. I'm glad you are getting more traction here you deserve it. Well done man!
That’s what I did :) It was useful for trying all the different types of Turnstile (managed [with and without action/cdata], non interactive, invisible, under attack, interactive challenge page)
Author here. I submitted this a few days ago but seems like it was added to the second chance pool so now it’s on the front page. Anyways, I have received a report from a user that this solver did not work for them with European proxies but did with US proxies… so they may be serving different versions for different regions. I will fix that soon. I’m not at my computer right now but it was working when I tested it a few hours ago (Cloudflare constantly changes things).
You can also look at https://github.com/insanai/sibuna, for it you can do PoW and can get access via an a Token. Also it has a wasm based solver for itself which works with users. You can also run it on local machine with wasm runtime no need of browser. Probably it can also help with cloudflare. I am the author of sibuna.
BTW, I did fix all the issues I was able to reproduce when using German and French IP addresses. Please email the address in my profile if you encounter any other problems (and make sure you are using the latest commit).
Thank you for creating this. For those of us who want to use bots to help them with daily tasks (so that AI does the chores and the human doesn't have to!) and get blocked by idiotic "anti-bot" policies, this is really helpful.
Many of this tools primary aim is to even the scales. If bot spends less energy its a cost for the provider. If bots spend same or more energy compared to provider who designed it for human consumption then its fair. Its about balancing the scales and for a small website, ecommerce or content provider who runs a small scale operation, its imperative to control the costs as they have limited compute, memory and bandwidth budget.
This is one of the motivation I created sibuna to be able to help them.
I think the problem we have is an ill-defined concept of "human consumption". I understand the desire (instinct?) to ban crawlers, but I'd argue that bots serving human needs are different. Consider: bots that fetch the content for me so as to present it in a different form. Bots that need to fetch documentation, because they are writing software for me. Bots that read or explain the content to me because I am disabled. There are many use cases where "bots" are there specifically to fulfill human needs, and yet we ban them.
Worse, many of us outsource the control over who can access their website to a third party, in this case a corporation that is an increasingly menacing monopoly on the internet — which I think is a problem, too.
> There are many use cases where "bots" are there specifically to fulfill human needs, and yet we ban them.
Definitely you can use bots if they solve human problem, but then let them work on human scales. In Sibuna its based on PoW which does not mean bots are banned, its just they need to show proof of work which takes 20ms to 30ms, humans might not be able to perceive it even. But for bots who create 100's of copies and want to dig inside the content without care for bandwidth or compute costs of a small provider its fair trade to do some PoW before access.
>Worse, many of us outsource the control over who can access their website to a third party
This is the precise reason I created Sibuna as I mentioned earlier you can have it without much fuss and supports similar features as cloudflare and even includes a high performance console.
This is a one sided view and Google captcha will never play along or agree with you. If a web server request is killed at the edge, its usually for good reason. There's other ways around that anyway
My understanding is that there is some sort of rate limiting around PATs per Apple ID (that’s why they require you to be signed in). Also if you want to scale to millions per day you don’t want to have to use headless browsers.
For the last few builds released by Cloudflare, I basically just told an agent “Hi they changed something. Please fix.” And waited for a few hours (mostly spent in Rust compilation) until it came back fixed. Keeping the codebase clean while doing that long term is honestly the harder part.
Yes, that was my goal. I will update this for the next couple of weeks, but probably not forever. However I think this is a pretty good foundation for future efforts.
You know this is easily verifiable right…. I just put 10 random pages into Pangram and they all came back 100% human. And now I feel bad for making an even greater proportion of comments on this thread not about graph theory.
Pangram is very good if you can provide enough text, in my experience.
I wouldn't use it as a 100% infallible AI detector when the stakes are high (accusing someone of cheating) but it's very good at detecting AI generated text when you can drop large sections of text into it.
My anecdotal experience has been that is is very reliable on inputs over 500 words. There are a number of third party evaluations that corroborate. Pangram is pretty easy to test for yourself if you are a skeptic.
> In a class I taught at Berkeley, I did an experiment where I wrote a simple little program that would let people type either “f” or “d” and would predict which key they were going to push next. It’s actually very easy to write a program that will make the right prediction about 70% of the time. Most people don’t really know how to type randomly. They’ll have too many alternations and so on. There will be all sorts of patterns, so you just have to build some sort of probabilistic model. Even a very crude one will do well. I couldn’t even beat my own program, knowing exactly how it worked. I challenged people to try this and the program was getting between 70% and 80% prediction rates. Then, we found one student that the program predicted exactly 50% of the time. We asked him what his secret was and he responded that he “just used his free will.”
There's another version where a stats professor divides people into two groups. One group flips a coin 50 times and writes on a whiteboard the results. The other comes up with 50 results.
They leave the room and when they come back immediately know which is which. Specifically because of the over-alternation that yours mentioned. A string of HHHHHH is exactly as likely as HTHTHT, but people don't intuit that.
The strings are equally likely if they're being purely randomly selected, but not if they're being selected by people with a poor understanding of random. In the latter case, people are more likely to select HTHTHT.
I wonder what thought process led you to believe that even though the strings are equally likely and random, people who don't choose the one you think is more random have somehow inferior understanding of randomness
The issue the anecdote is reflecting is that across the data of 50 naive made-up coin tosses there are too many alternating sequences and probably zero HHHHHH.
I understand your point, but the context is that repeatedly, experiments have shown that humans inject too much pattern to be good rngs. It turns out that is visible with training after the fact.
Yes, it is possible that any two 50-sequence patterns are actual rng. But some of them are much more likely, and we can tell.
I'm not sure what your point is. A collection of samples were taken from humans, and they did not form a uniform distribution. Samples from an unbiased RNG are much closer to uniform.
Are you saying we should ignore the distribution we observe from humans and predict them as uniform anyway?
You say yourself "strings are equally likely if they're being purely randomly selected". So you move the goalpost to define "random" as "whatever a human would think is random".
> Samples from an unbiased RNG
you mean a PRNG.
> Are you saying we should ignore the distribution we observe from humans and predict them as uniform anyway?
I'm saying the exercise in general is a little pointless, but that's fine.
I have managed to get 38-48% the times I tried. I believe I might have been influenced by the article I just read.
It would be interesting to see if by giving people advice on statics it would produce, on average, a measurably different outcome.
> (...) Then, we found one student that the program predicted exactly 50% of the time. We asked him what his secret was and he responded that he “just used his free will.”
- Scott Aaronson, Quantum Computing Since Democritus.
Similar to me, when I have to choose randomly I look for a number anywhere around. If it's odd, one choice, even is the other.
My strategy for rock paper scissors is to always go rock, and tell everyone that's my strategy. It's more fun for me seeing how people deal with that information than the win would be. Not very random though
I don't think Zipf's law gives you this. It mostly says that common words tend to be short, but it doesn't tell you what proportion of the text will be common words. For example, in English writing two-letter words are found much more than one-letter words.
However, I think you're correct anyway. The right distribution to look at is something like the orange series in the bottom graph on [0]. Eyeballing it, it does look like 3/5/7/9/11-letter words appear more in aggregate than those of 2/4/6/8/10 (49% Vs 44.5%), and longer words are a rounding error.
I used the digits of pi, transposing and changing the order, and got 14% on the original game. Professional poker players will use external sources of randomness to make sure they’re perfectly balancing their positions and not exploitable.
I really enjoyed reading the log book from the training of OPT-175B at Meta… I guess it’s all classified info but it’d be fun to read a blog post about the crazy day to day issues you run into when doing things at this scale :)
GPU failures are frequent enough that at a certain scale, you constantly have workers dropping out. Designing systems that can still keep training is very interesting!
I'm pretty sure you would get into Berkeley with that profile. Also you can just major in math and get a job as a software engineer anyways. I agree that the system has reached the point of absurdity though. ETH Zurich and KU Leuven have the best solution to this issue in my mind, which is to let everyone in but make the classes ridiculously hard so that 50% leave in the first year.
> I'm pretty sure you would get into Berkeley with that profile
I was rejected from EECS@Cal and CS@CMU at the time (though my alum interviewer for CMU kept in contact with me to this day, and helped open doors for me professionally) yet got into an Ivy and waitlisted at MIT ¯\_(ツ)_/¯
And this was before college admissions got as competitive as it is for you guys today.
Most HNers graduated college in the 1990s and early 2000s and don't realize how competitive admissions have become across the board from 2008-09 onwards.
> Also you can just major in math and get a job as a software engineer anyways
Absolutely! Applied Math is a heavily interdisciplinary major that is very powerful.
wreq/wreq_util can do it for you for certain popular browsers but there is also support setting custom values in the profile file
reply