Switching to hCaptcha + Beta Inbox available

[mark]

Hi all,

Since we moved off of Cloudflare last month, I know there have been some sharp edges around captchas and 403s that some of you have been experiencing, particularly if you're using a VPN or similar.

As of today, I've moved us over to a Dreamwidth hosted hCaptcha solution which is -- hopefully -- a much, much better experience. Please let me know how the experience is and if you're seeing any problems. I tried to keep it pretty non-invasive and flexible but hopefully still effective at keeping out spambots.

Second big thing: As part of the big effort to modernize our code (to bring it into the last decade, at the very least), we have a beta version of the Inbox ready to play with! Please head on over to the Beta Features page and feel free to turn on the Beta Inbox.

Please drop any comments or feedback on this post, thank you!

Comments

[assholic]

Whatever push you did also fixed the huge stretch out of the page number block at the bottom of large page number posts as well as the huge gap between parenthesis in the (post a new comment) portions and the weird stretch that was happening between the userhead graphic and the username if one was put in a ul/il format table. Thank you. That was driving me insane every time I saw it.

I also tested commenting around with a VPN and haven't had any of the human slider/car dot tests.

[mark]

Oh good! Yeah, we made some fixes to the CSS that happened to go out when I was pushing out updated Captcha logic. Glad it got nailed!

[lexicalcrow]

Well, I'm a VPN user, and one thing I've noticed is that my DW-hosted mood theme is now loading again, as is the image in my profile. I also no longer get captchas every time I open DW pages from my pinned reading page in firefox.

However, all embedded media is now displaying captchas with the DW page embedded into them, but they are not resolving no matter how many times I do them correctly. I don't know if this is intended behaviour or not, but it is very annoying. This is not affecting pictures/photos, just embedded media like youtube videos and spotify playlists.

[mark]

I bet I know what that is -- I just pushed a speculative fix. Can you tell me if the embeds are still doing a captcha thing? It's definitely not intended.

[wolfy_writing]

I know that the level of Captchas I get varies from day to day, and today was a lot. Sometimes it doesn’t seem to get that I’ve already confirmed I’m human from the VPN address, and it expects me to reconfirm it multiple times in a row, or I’ll go from my inbox to my reading page and it will require me to reconfirm.

I know you’re doing your best and I appreciate the work you’re putting in!

[mark]

Today -- before my post? Or even in the past 90 minutes?

[andrewducker]

I wasn't getting captchas, just a 403 almost every time I left a comment. Fingers crossed that doesn't happen any more!

[mark]

Please let me know if the 403s continue!

And to be quite honest, I still have no idea why they were happening... but when in doubt, add one part 10 ton excavator and two fifths of something strong and just rip it out...

[trobadora]

I haven't had a 403 yet today, after having them constantly since the switch away from Cloudflare, so it looks like at least for me this worked! Thank you very much.

[mark]

Victory! Well, hopefully. Please do let me know if anything continues to be bad, and apologies for the length of time that took.

[nestra]

First thing in the morning I'd get a captcha when trying to access DW, then when clicking on my Reading List, and then when looking at comments on an entry. So far this morning, no captchas. Thank you!

[laireshi]

I'm on VPN and I haven't seen a captcha since this post was made! And before that I kept having captchas all the time (and captchas that refused to let me in), so this is great news. Thank you!

[ilyena_sylph]

+does a Dance of Joy+

Oh, thank gods.

The Captchas were about to make me cuckoo!

[morrow]

ooo exciting news re: the inbox!

[innitmarvelous_og]

So far so good with me. I have not had to do any Captchas today. LOL I was getting used to them and had even learned that if I didn't do the test correctly, I needed to reload the entire page before trying again.

Thanks for the fix!

[ayebydan]

A lot easier access to the site in the past 7 days. Thanks guys!

[dalmatians]

Hey there, this update looks great so far! I'm not sure if anyone has raised this issue yet (and apologies if this is a duplicate), but since tightening up the DDOS protections in the May 15th update, Dreamwidth has been pretty much scrubbed from Google results.

As an example, searching "Dreamwidth Layouts" turns up a single result from Dreamwidth (directing to the Interests page) and then a ton of InsaneJournal and LiveJournal results. Previously, such a search would have returned popular layout communities hosted here on Dreamwidth. Searching for specific roleplay games that exist on Dreamwidth is now more likely to turn up Plurk results or player-made wikis than the game itself.

Has something been blocking Google's (and potentially other search engine's) web crawlers?

[mark]

This was "intentional" in that we purposefully did block the various bots that would index content as a means of controlling traffic. But, let me revisit it now that we have some form of captcha that we can actually control -- it may be worth allowing Google at least (since they're well behaved.)

[pangolin20]

I haven't been personally involved with this, but I still want to thank you for all the work you put in for this community.

And so far, the Beta inbox and the Beta posting page look quite good! Thanks for modernizing!

[jadelennox]

Disclaimers:

1. I don't personally get the captchas ever
2. I don't even know how to trigger them
3. I know y'all are super thoughtful so you probably addressed this if it's possible
4. Has it been hcaptcha all along? Like I said, I never get them, maybe you already dealt with all this.

But on other sites, the accessibility of hcaptcha is annoying as balls. You have to literally sign up with hcaptcha as a user, bookmark an accessibility cookie URL that's hard to bookmark if you're not a tech person, and reset the cookie via that bookmark regularly (more often if you auto-delete cookies or if you use private/incognito/container browsing). I understand that the other fuck-cloudflare considerations might make this choice unavoidable, but if that's the case there should probably be a blog post and documentation page explaining how to use them accessibly. The hcaptcha page explaining it is nowhere near adequate.

(Just because I'm a programmer and sighted and I still find the friction of accessible hcaptcha almost unbearable, so any documentation to lower the friction for non-programmers or people who have to deal with debugging it through a screen reader.)

[mark]

Do you know if reCAPTCHA is any better at this?

I use hCaptcha at $dayjob and we found it to be the best of the options (including considering pricing), but I know that the accessibility cookie workflow is not the smoothest, even if it's effective (at stopping bots.)

[elemirion]

I still only get nine entries before it says there are no more entries. I've been on Dreamwidth for several years but I can no longer access what was there.

[sockiness]

Passerby, but do you mean via your reading page? Because there's a line at the bottom of your layout that should explain it: There are no earlier entries to display. This page displays only the most recent 1000 entries posted within the last 14 days.

If the comms you follow aren't that active, you're only going to get a limited amount of returns on that. If you go to the comms properly, you'll see the full view of what you're not getting via your reading page. RP is really only good for if you're in active comms and want to keep them all together.

[theweakhavepurpose]

For the new Beta Inbox - it's not word wrapping. It's cutting off letters and putting the rest of them on the next line. It's really bad on mobile almost every word is cut in half at the end of the line.

And two suggestions:
- I'd like an 'Expand All' button if they're going to be collapsed by default
- It'd be nice to click anywhere in the box to select a message rather than just on the little checkbox

[sporky_rat]

Please post that in the entry for the Beta Inbox Feedback? It's easier for the dev to keep up with feedback if it's all in one place.

[theladyscribe]

[Copying this from the feedback post in dw_beta!]

I'm using the latest version of Opera on a Macbook Air. Some initial thoughts/comments:

- Text in the subject lines wraps in a weird way; words are being split in weird places, like "excellent" displaying as "excelle/nt."
- Things feel a bit cramped, which may be partially due to the text wrapping issue. Some extra spacing between the subject line and the timestamp section might help this (and make both the subject line and timestamp a little easier to parse).
- I'd personally like a little more color contrast or borders between inbox messages. I'm using the default site skin, so it's alternating light gray/dark gray. The lighter gray messages especially sort of blend into the page itself.
- I'm not sure how I feel about the navigation buttons being between the Mark Read/Mark Unread/Delete and Mark All Read/Delete All buttons. Would it be possible to have the navigation buttons on a separate line and the action buttons either above or below them? In addition, there's a single navigation button below all of the others, which bothers me aesthetically, especially because it's not centered (I actually didn't notice it at first, but it's right below the p1 button).
- There's no space between the "Delete" button and the page 1 button (or the arrow button if you click to another page of messages). The spacing between the page buttons and between the Mark Read/Mark Unread/Delete buttons is fine.
- Is it possible to add the navigation/action bar as a footer in addition to having it as a header?

[meowmensteen]

Just as long as you keep away from this decade :b

Everything has been working perfectly for me. I've been using Pale Moon and using a script blocker. I love that the only script I have to run to get all the functions of this site is your own. I really appreciate that. Thank you very much.

[ethereal_tempest]

Just tried with my VPN on and STILL got a "forbidden 403" error message. Maybe its because I use McAfee? I am not sure.

[mark]

Can you send me a private message with your IP address while you're on the VPN? I can do some testing to see why this is happening (hopefully.)

[murphys_lawyer]

Thanks! I no longer have to use a captcha every time I visit a friend's page.

[winstre]

Around 11:45 PM CST 10/8 got a CAPTCHA telling me I was (semi)randomly selected, but it did at least let me view the page I was visiting when I solved it. I am not using a VPN.

[jazzyjj]

I did get a few 403 errors about a month or so ago, but haven't gotten as many lately so I think the issue is fixed on my end. I also have a question about the beta inbox. That is, when exactly did it come out? The reason I'm asking is that I used to have to weed through more verbiage and duplicate things in order to get to the messages. For example, VoiceOver would say "sent" twice and it's not doing that now. Or perhaps this is because I got a new Mac for my birthday this year. In any case, I'll have a look during the week. Update at 7:08 pm Chicago time: I did briefly check out the beta inbox earlier today, as I have been clearing it out. I had to log out and then back in again in order for my inbox to be totally empty. I don't know whether this is the way it's supposed to be, or a bug that has yet to be squished. But both this one and the past iteration of the Dw inbox get an A in my books. Thanks as always for doing such a nice job with things. I'll of course understand if things still have to be tweaked here and there.

[lawyerbyday]

Not a complaint, but more a heads up since I'm not entirely certain if it's a me thing or not. I've noticed since this recent push that refreshing and loading pages is taking longer to do so than it was pre-push. Sometimes it feels like it's trying to 403/502 me, but then it finally loads, or I have to hit enter on the url bar just to make sure it goes through. In comparison to pre-push, it's about 10x longer to have a reply go through or to even hit parent on low-traffic posts. (I'm used to having posts load more slowly or a page load slower if it's high traffic and has a lot of comments to load, but when there's about 20 comments on the whole page and it's taking its sweet time, it's noticeable.)

Again, not complaining, but mentioning in case it's not just me.

[ravenna]

+1

the site's been VERY slow for me the past day, and a few times it's lagged out/stalled entirely (no error code, just incomplete loading) even on very light pages. not experiencing slowdowns on other websites at the same time and my speed tests are green.