有多少个机器人“启用”了 JS？
我们谈论的是普通的日常垃圾邮件机器人——我们试图防止它们使用验证码。
其中有多少能够在某种嵌入式浏览器中运行 JS？
如果数量非常少，那么像这样的解决方案到底如何有用：http://wcaptcha.wozia.pt/sample.php
除了明显的可用性/可访问性问题之外，这些拖放解决方案要求客户端有JS。连退路都没有。因此，假设它的目的是防止机器人（非人类），这不是完全多余的吗？或者至少在技术上有多少机器人能够尝试这样的事情方面是多余的？
如果客户端有 JS（这是此解决方案工作的先决条件），那么假设客户端不是机器人不是安全的（在合理的范围内）吗？
We're talking your average everyday spamming bots -- those which we try to protect against using captcha.
How many of them are capable of running JS in some kind of embedded-browser?
If it's a very tiny amount, then how on earth can solutions like this be useful: http://wcaptcha.wozia.pt/sample.php
Apart from the obvious usability/accessibility issues, these drag-n-drop solutions require the client to have JS. There's not even a fallback. So, assuming it is intended to protect against bots (non-humans) isn't it entirely redundant, or at least redundant to the extent of how many bots would be technically capable of attempting such a thing?
If the client has JS (which is a pre-requisite for this solution to work) then isn't it safe (within reasonable measure) to assume the client not a bot?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这并不是那么多余。如果您只是检测 Javascript，人们仍然可以启动 Selenium 实例并假装发表评论。现在这样做的垃圾邮件机器人数量仅占少数，但随着垃圾邮件战争的发展，您可以打赌垃圾邮件机器人将转向其他方法，例如使用浏览器。如果你检测到 JavaScript 并让他们拖放一些东西，它肯定会证明你是一个人。
但我认为这种实现是不切实际的，因为仍然有 % 的人因为某种原因而关闭了 JS。我听说这个百分比是 2% 或 3%，当你谈论数十万访问者时，这仍然是一个不错的数字。
另一种方法是使用 noscript 选项，要求用户在想要在博客上发表评论时激活 Javascript。
It isn't that redundant. If you just detect for Javascript, people can still boot up instances of Selenium and pretend to comment. The number of spam bots doing that now is in the minority, but as the spam wars evolve, you can bet spam bots will move on to other methods such as using a browser. If you detect for Javascript AND make them drag and drop something, it'll definitely prove you're a human.
But I think this implementation is just not practical because there is still a % of people that have JS off for whatever reason. I hear this % is 2 or 3%, which is still a good amount when you're talking about hundreds of thousands of visitors.
An alternative is to have a noscript option that asks the user to activate Javascript if he/she wants to comment on the blog.
是的，很少有垃圾邮件机器人会启用 JavaScript。
垃圾邮件是一种百分比游戏。只有极少数的垃圾邮件会为垃圾邮件发送者带来收入。如果你会增加垃圾邮件的成本，那么它在经济上就变得不可行。在支持 JavaScript 的浏览器中发送垃圾邮件比在命令行上发送垃圾邮件要昂贵得多，因此如果您坚持使用curl，一次可以发送更多垃圾邮件。
是的，这是多余的。
与其让用户执行这种毫无意义的任务，不如自动执行 JavaScript 检查。它可以像一个脚本一样简单，获取网站的域名并将其作为隐藏字段插入到每个表单中。这将阻止所有路过的垃圾邮件发送者。如果您的网站足够引人注目，足以吸引自定义垃圾邮件发送者，那么此解决方案无论如何都不够。
对于那些没有 JavaScript 的人，只需在他们的帖子失败后向他们展示常规的旧图像验证码即可。
Yes, very few spambots will have JavaScript enabled.
Spam is a percentages game. Only a very small percentage of spam messages will trigger any revenue for the spammer. If you can increase the cost of spam, you make it economically infeasible. Spamming in a JavaScript-enabled browser is way more expensive than spamming on the command line, so you can send out more spam at a time if you stick to curl.
Yes, it is redundant.
Rather than making users do this pointless task, you might as well automatically perform a javascript check. It could be as simple as a script that grabs the domain name of the site and inserts it into each form as a hidden field. This will stop all drive-by spammers. If your site is high-profile enough to attract custom spammers, this solution won't be enough anyway.
For those without JavaScript, just show them a regular old image CAPTCHA after their post fails.
恕我直言，一个更大的问题是可用性。验证码总是会降低转化率，而且通常会显着降低。如果你的目标是使用 JS 作为阻止机器人的手段，我可以告诉你，它为我显着减少了 90% 以上的机器人流量。
只需合并一个由 JS 填充的隐藏字段即可。如果没有填写，他们要么是一个机器人，要么是那些关闭了 JS 的白痴之一，无论如何你都不想迎合他们。
还包含一个在 DOM 中可见的隐藏字段。使用“position:absolute; left:9999px; top:-9999px”等 CSS 让它飞离屏幕。不要使用“显示：无；”如果填写此字段，则它们是机器人。
我用它减少了 90% 以上的垃圾邮件，所以你应该使用它而不是验证码类型，除非你是一家大企业。如果您是一家大企业，那么您唯一真正的解决方案是后端服务器端解决方案。祝你好运，在 StackOverflow 上找到它。他们关闭您的评论的速度会比人们回答它的速度更快。 （而且它的 Google 排名会比其他任何东西都高）
A bigger issue is usability IMHO. Captcha is always going to decrease conversion rates, and often significantly. If your goal is to use JS as a means of deterring bots, I can tell you that it has significantly reduced bot traffic for me by more than 90%.
Just incorporate a hidden field that gets populated by JS. If it isn't filled in, they're either a bot, or one of those idiots with JS turned off, who you don't really want to cater to anyway.
Also incorporate a hidden field that is visible in the DOM. Make it fly off the screen with CSS like "position:absolute; left:9999px; top: -9999px". Don't use "display:none;" If this field is filled in, they're a bot.
I cut down our spam more than 90% with this, so you should use it over Captcha types, unless you're a big business. If you're a big business, your only real solution is a back-end server side solution. Good luck finding that on StackOverflow. They'll close your comment quicker than people can answer it. (and it will have better Google rank than anything out there)