Free WordPress plugin uses proof-of-work instead of CAPTCHAs to block form spam

·1 views

A developer of a whistleblowing service for enterprises sought a spam-blocking method that complied with EU privacy law, used no cookies, and ran at no cost. He adopted Hashcash, a proof-of-work technique, which required each form submission to carry a small computational cost, making mass spamming expensive. The approach reportedly blocked all spam in his tests without stopping genuine posts, and he released it as a free GPL-2.0 WordPress plugin around 14 KB in size. Running since 2022 on over 4,000 active installations, the plugin detects form submissions via HTTP-post pattern recognition and ships with 80+ patterns for popular form builders and themes. The author has invited discussion on the method's tradeoffs, form detection, and privacy implications.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Arista VeloCloud Orchestrator Exposure: What ZoomEye Data Shows and Doesn't

A ZoomEye search on 22 October 2026 for the title fingerprint "VeloCloud" returned 520 matching internet-facing assets. That figure reflects hosts advertising a VeloCloud-related page title, a broad product-family signal rather than a count of vulnerable orchestrators or of systems on affected versions. A narrower query for "VeloCloud Orchestrator" with an HTTP service match returned only a handful of results. Arista has reported active exploitation of CVE-2026-114625 and named two source addresses seen in the attacks. Experts stress that organisations should inventory their own orchestrators and compare release versions against the patched builds instead of relying on external counts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Private Image Storage: Signed Links, Retention Deadlines and Object-Store Costs

The article argues that images should live in a private bucket and be delivered through short-lived signed URLs issued only after an authorization check. It stresses that retention and deletion matter more to cost and compliance than metadata, especially for property-management apps handling leases and inspection photos. The author recommends a per-object ledger tracking scope, deadlines, legal holds, size and downloads, with monthly storage, request and egress estimates derived from it. Deletion should be handled by a frequent queue-based worker that verifies removal and keeps an audit manifest with a content hash. Signed URLs should never be exposed in pages, logs or analytics, and their expiry should be tuned to the sensitivity of the file.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Parsing Property Owner Names in pandas: Individuals, Joint Owners, Trusts and LLCs

Property owner fields in county assessor records often combine several people and entities in one cell, which complicates contact-finding work. Co-owner markers such as ETUX and ETAL, trustee designations, business suffixes, and estate wording all need to be recognized before a list is used for skip tracing. A tutorial shows how to build a pandas pipeline that classifies each owner as an individual or an entity, splits joint owners into separate rows, and parses LAST FIRST MIDDLE names while flagging ambiguous cases instead of guessing. The approach keeps the raw column unchanged and adds a parse_status column, with tests written as plain assert statements. Because naming conventions vary by county and over time, the author recommends sampling each export before relying on any keyword rule.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Part 5 of the Communications series covers capturing delivery events after dispatch

Part 4 ended with messages marked as Dispatched, meaning a provider accepted them but not that recipients received them. Real providers such as Twilio report later stages like sent, delivered, or undelivered, and email and push services report bounces, opens, and invalid tokens. This article records those delivery events in Communications, stores them, and displays them to buyers on a new Messages page. Communications now sends each buyer a single message on the first channel that can reach them, using only verified email addresses and phone numbers. Delivery events are represented by a provider-agnostic DeliveryReport structure that captures the event, channel, provider, and outcome.

0 comments Read more at DEV Community