Conversation

Notices

1. Zero :zt_think: :artix: (zero@strelizia.net)'s status on Sunday, 28-May-2023 00:35:17 JST Zero :zt_think: :artix:

   Want captchas for Pleroma that may be harder to crack?
   Pleroma uses a C captcha generator from huacnlee/rucaptcha on GitHub, but it’s an older version, and it has been updated to generate much stronger captchas now.

   The problem is that it’s now written in Rust, so I don’t think Pleroma devs will even think about accepting this upstream unless someone rewrites it in C/C++, but I did it anyway.

   I modified the Rust code to be a cli and output the same thing the old C stuff did (https://github.com/animeavi/rucaptcha), so it’s a drop-in replacement. If you want you can even compile this on your own PC and replace the binary in /opt/pleroma/deps/captcha/priv and be done with it.

   If you want to do it a more “proper” way, keep reading.

   You need to install Rust+Cargo first of course.

   Replace the existing :captcha in mix.exs for Pleroma with those values.

   {:captcha, git: "https://github.com/animeavi/elixir-captcha.git", ref: "d280d06ae7ba7757a772567b9e608dba3a0c0ae2"},

   Then run mix deps.get and mix compile, all that good stuff, it will take a while because Rust lol, but you can keep the instance running while it compiles, and it should just work.

   First two pics are current Pleroma captchas, last two are the new ones.

   • xianc78 and  like this.
   •  (mint@ryona.agency)'s status on Sunday, 28-May-2023 00:41:50 JST 

     in reply to
     @zero I just found some random Go captcha module and imported it in place of the default binary. Doesn't seem much harder to crack, but it should at least stop the spambot in case it would still be using captchaboy's ML model.
     https://gitgud.io/mintplg/elixir-captcha
     image.png
     image.png
   • Zero :zt_think: :artix: (zero@strelizia.net)'s status on Sunday, 28-May-2023 00:44:20 JST Zero :zt_think: :artix:

     in reply to

     • 
     @mint yeah the problem is having external deps, i may submit mine to the gitlab just so people can find it (plus my idea of downloading precompiled binaries)
      likes this.
   • :blank: (i@declin.eu)'s status on Sunday, 28-May-2023 00:51:36 JST :blank:

     in reply to

     • 
     • meso
     @meso @mint @zero not as bad as the stuff microsoft keeps using
      likes this.
   • meso (meso@asbestos.cafe)'s status on Sunday, 28-May-2023 00:51:37 JST meso

     in reply to

     • 
     @mint @zero this is schizophrenic captcha i cant read this
      repeated this.
   •  (mint@ryona.agency)'s status on Sunday, 28-May-2023 00:53:18 JST 

     in reply to

     • meso
     • :blank:
     @i @meso @zero
     1641158627264.gif
   • Zero :zt_think: :artix: (zero@strelizia.net)'s status on Sunday, 28-May-2023 00:58:37 JST Zero :zt_think: :artix:

     in reply to

     • 
     • meso
     • :blank:
     @mint @meso @i i think a better captcha is needed but maybe a more real solution is stealing something like this and having that on the register page along with the captcha
     
     https://github.com/BaseSecrete/active_hashcash
     
     idk how possible that is tho
      likes this.