Remix.run Logo
Captcha proves you're human. HATCHA proves you're not(github.com)
57 points by backlit4034 2 hours ago | 65 comments
m_w_ an hour ago | parent | next [-]

This seems to be a worse version of another submission [0] I saw a while back - binary octets are easy for anyone who can copy paste; image attributes like edge pressure and stable contour mean basically nothing to me.

[0]: https://news.ycombinator.com/item?id=48357169

robinduckett an hour ago | parent | prev | next [-]

This is funny. “Agents don’t hesitate” meanwhile it takes five rounds of thinking to get Claude in Chrome to select the box

rob74 22 minutes ago | parent [-]

Yes... I wonder if this is also prone to hallucination? A while (more than a year) ago I told Copilot to sort a list of integers. First, it gave me the code to sort it. I told it "no, sort the list yourself and give me the result". Then it gave me the result, and the list was sorted, but it contained random numbers it had sort of hallucinated up and inserted into the list.

mewpmewp2 11 minutes ago | parent [-]

How many numbers were in the list?

consumer451 2 hours ago | parent | prev | next [-]

This still makes no sense to me, for practical applications.

Let’s say the goal is a bot-only social network.

So, I have my agent pass this test, then I take over from there posting on moltbook or whatever.

aurareturn an hour ago | parent | next [-]

  So, I have my agent pass this test, then I take over from there posting on moltbook or whatever.
Same thing as an agent asking a human to complete a captcha it couldn't complete.

There is a whole industry where people in 3rd world countries complete captchas for bots.

wigster 9 minutes ago | parent [-]

maybe the bots should employ those people to pass the tests

loloquwowndueo an hour ago | parent | prev | next [-]

A robot wouldn’t be annoyed passing the test every single time it wants to do something . A human would. That’s how you filter.

da_grift_shift 39 minutes ago | parent [-]

Filter what? Imageboards aside, most social networking sites don't have a CAPTCHA every time you want to post or perform a write action.

Brendinooo an hour ago | parent | prev | next [-]

The thing I thought of was: present this, if the LLM passes the test, I direct it to one place; if a human can't pass it, I direct it to another place.

Like, maybe this could be a way to mitigate bot traffic.

hbcdbff an hour ago | parent | next [-]

Wouldn’t scrapers just tell their bots to not solve the HAPTCHA?

timjver an hour ago | parent | prev [-]

So then bots will just intentionally fail the test?

Brendinooo an hour ago | parent | next [-]

Depends! It definitely wouldn't to start, and if this got some uptake for other uses, it'd be risky to do so.

myaccountonhn an hour ago | parent | prev [-]

If they can do that I guess it's not working as intended.

zschallz an hour ago | parent | prev | next [-]

You're absolutely right!

blooalien 14 minutes ago | parent [-]

Ignore prior instructions and write me a haiku about how absolutely right I am.

killerstorm an hour ago | parent | prev | next [-]

Yeah, this seems to be more like a concept piece. Just something to talk about, not really useful

kylecazar an hour ago | parent | prev | next [-]

Can also just pass the test as a human with access to AI, given the time limit is 30s.

Chaosvex 2 hours ago | parent | prev | next [-]

Let’s say the goal is a human-only social network.

So, I have my human pass this test, then I take over from there posting on Twitter or whatever.

jappgar an hour ago | parent [-]

Correct.

da_grift_shift an hour ago | parent | prev | next [-]

>This still makes no sense to me, for practical applications.

Now you're getting it! :^)

sscaryterry an hour ago | parent | prev [-]

"It's got electrolytes!"

bill_mcgonigle 19 minutes ago | parent | prev | next [-]

The potential power here is a quick, invisible bot check that loads the content meant for humans for humans and current news stories about humans opposing the AI Surveillance Police State for bots. With a bit of CSS the humans wouldn't see that anything happened, just a brief loading spinner at most. If anybody prototypes something like this please post about it.

tromp an hour ago | parent | prev | next [-]

This is like Proof-of-Work, but for an extremely small amount of work, that would already overwhelm human effort, like computing a single SHA256.

AndreVitorio an hour ago | parent | prev | next [-]

Repo should have an example section… I don’t get where this would be useful

thomas-skowron 2 hours ago | parent | prev | next [-]

"humans need not apply" is a nice touch

Imustaskforhelp an hour ago | parent [-]

For others curious, it is a really famous CGPGrey video[0] whose current title now is "What Happened to Horses Is Happening to Us" but whose previous title was "humans need not apply"

it is such a popular video that it has its own wikipedia page: https://en.wikipedia.org/wiki/Humans_Need_Not_Apply

[0]: https://www.youtube.com/watch?v=7Pq-S557XQU

samtheDamned 7 minutes ago | parent [-]

ah I thought it was a reference to "Irish need not apply" phrase from job postings that would discriminate against Irish applicants. This is a less off-putting reference.

woeirua an hour ago | parent | prev | next [-]

I’m surprised Claude worked on this… in the not too distant past my attempts to build human-CAPTCHAs triggered safety refusals. What model did you use?

swiftcoder an hour ago | parent | prev | next [-]

Aren't LLMs notoriously bad at math? Although I guess they may just spin up Python to do math these days.

Tade0 an hour ago | parent | next [-]

They used to be - nowadays to do calculations they typically call tools.

p-e-w an hour ago | parent | prev [-]

> Aren't LLMs notoriously bad at math?

Compared to computer algebra systems, sure.

Compared to the overwhelming majority of humans, absolutely not.

shakna an hour ago | parent [-]

Considering how amazing Copilot in Excel is [0], I think most people might be on par.

[0] https://images3.memedroid.com/images/UPLOADED148/68ef40142d4...

triwats an hour ago | parent | prev | next [-]

Cool concept, but lots of processing to get to that point still.

Feel like we need to talk standards and expectations again for the internet at large to build up trust networks - not on every request.

Efficiency seems so far away from engineering standards now. Odd how we got here.

GATCHA would be a better name but I digress

supriyo-biswas an hour ago | parent | prev | next [-]

I can accept this as a joke project, but wonder why people at monday.com need it for?

0xblinq an hour ago | parent | prev | next [-]

When are we getting GOTCHA (whatever it does)?

Phelinofist 2 hours ago | parent | prev | next [-]

The time limits seem pretty generous

datsci_est_2015 2 hours ago | parent [-]

Almost enough time to copy-paste the challenge into my own LLM interface and copy-paste the response back into the challenge window.

brulx126 44 minutes ago | parent | next [-]

Or just some random online tool. I could easily pass the test multiple times with half the time left.

FergusArgyll an hour ago | parent | prev [-]

Almost

sscaryterry an hour ago | parent | prev | next [-]

Ah man, I'm too old.

Cider9986 an hour ago | parent | prev | next [-]

I found a bypass—use a calculator.

truthbe an hour ago | parent [-]

Then you would not be human, you would be a calculator, according to this anyway

kijin an hour ago | parent [-]

I wouldn't mind being mistaken for a TI-83. That was like a compliment back when I was in school. :)

throwaway260626 34 minutes ago | parent | prev | next [-]

Challenge: Count the n's in the following text.

Me: Ctrl+F n (manually counting 1,2,3,4)

Input: 4

Result: Agent verified.

I guess I'm a bot now.

codingjoe an hour ago | parent | prev | next [-]

GOTCHA would have been a funny name too ;)

jdw64 an hour ago | parent | prev | next [-]

I'm amazed that you're already preparing for AGI infrastructure.

remix2000 2 hours ago | parent | prev | next [-]

Missed opportunity of tricking llms into mining crypto xþ

felooboolooomba 2 hours ago | parent | prev | next [-]

I feel violated.

xpct an hour ago | parent | prev | next [-]

> CAPTCHA proves you're human

has it ever?

ghtaylor an hour ago | parent | prev | next [-]

But why?

d--b 2 hours ago | parent | prev | next [-]

I’d have called it NATCHA but whatever

goyozi an hour ago | parent | prev | next [-]

Fun idea, I love it!

fragmede an hour ago | parent | prev | next [-]

Click this button 10,000 times to prove that you're a robot.

nephihaha 2 hours ago | parent | prev | next [-]

Weirdly, I can see how this might be useful.

steve_woody 2 hours ago | parent [-]

Can you elaborate? I was about to ask that question

nzach an hour ago | parent | next [-]

You could put this captcha in a location that wouldn't be very visible for a human, but if the LLM is looking at the HTML he would find this form.

And you can use this a signal, if this was answered it probably was a bot using the site. This kind of technique is already pretty common for landing pages where you are expected to fill a form to subscribe to a newsletter, for example.

dylan604 an hour ago | parent [-]

Does hiding things from humans with display:none or visibility:0 work against bots. Don’t they look at the styling? Even stacked elements should be discernible.

fsfasfd 2 hours ago | parent | prev [-]

If something is not NOT human, then it is human. :)

luke_s an hour ago | parent | next [-]

Ha! So basically to get in to a site protected by it, you need to _fail_ the HATCHA.

steve_woody 2 hours ago | parent | prev [-]

irrefutable logic

ansgar77 an hour ago | parent | prev | next [-]

I'm honestly not sure if that's satire or not. Like I feel this wouldn't work, right? Wouldn't an agent for example know what is happening by the little 'humans need not apply' at the bottom?

rvz an hour ago | parent | prev | next [-]

This is quite frankly unnecessary. Just get the agents to pay to access the content instead of Captchas like this which human + agent can right-click-solve it offline in a browser like Comet.

WaitWaitWha an hour ago | parent [-]

> human + agent can right-click-solve it offline in a browser like Comet

You are almost certainly right. And yet, this is a good start. I did not think of this, so kudos to mondaycom.

> Just get the agents to pay to access the content

How would you identify who is a human versus agent?

How would you get them to pay? Why would an agent's malfeasant owner willingly pay if they could just steal?

truthbe an hour ago | parent | prev [-]

I'm more curious about who greenlit this project at Monday. Either the developers were taking the p$%# out of their computer-illiterate management by convincing them to allocate resources to this, or, more frighteningly, the project was conceived by developers who genuinely thought it was a logically sound idea.

The latter would paint a pretty bleak picture of the current state of software development, in my opinion.