CAPTCHA Meltdown

Craiglist does charge in some categories

In your main article, you noted "With combat costs mounting, it's hard to see how Craigslist, which has always been a free service, can continue to survive with its no-visible-means-of-revenue model."

This is incorrect. Craigslist grosses many millions per year by charging for job listings and apartment broker listings in limited markets. See their FAQ on this. So they have quite a bit of money that they devote to solving a problem that threatens their existence.

Whether they can defeat the spammers is entirely different, of course.

The Problem

The real problem is the system architecture. A Security mechanism that relies on somehow identifying all Attackers is destined to fail.

I understand that some security packages now have over a Million "threats" they have to scan for.

This is a self defeating strategy.

The correct strategy is the one used on IBM's Mainframe systems: Only Authorized Programs execute and Only Authorized Users get to run them. It's a Much Shorter List and one that can be maintained by the Computer's Owner.

The other part of the problem is the Language Architecture. Things like "Buffer Overflows" and "Memory Leaks" are the fault of the "Object Oriented", "break it up into tiny little pieces" methods of programming.

A sane Language/Compiler combo would not Allow the "Buffer Overflow" to occur. The simple act of Checking the Size of the 5 pound bag BEFORE stuffing in 10 pounds of cr@p would solve this problem. Most 8 year olds could figure this out.

"Memory Leaks" are the results of umpteen gazillion "Objects" each asking for it's own little chunk of storage, then, improperly written programs not "knowing" when to release them. Storage management is a time consuming process under the Best of conditions. Yet, we have languages which go out of the way to make it worse. The simple solution is to Plan storage allocation as part of the overall design of the application and allocate the majority of the storage in a single, carefully planned block which can then be worked with by the various routines which make up the program. And released all together when the application Exits.

The time saved in Storage Management would allow the Applications themselves to execute much faster, resulting in Useful Work being accomplished.

Time and Inconvenience

The only sure-fire way to implement a counter-measure is to make the work-arounds of stopping measures cost too much in time or convenience to be worth it. The problem being that this also costs the legitimate users time and convenience, which is like cutting off an infected limb.

The surest counter-measure I can think of is to make the person signing on talk to a real person. For every programmed question there can be a programmed answer. For every computer-generated pattern there can be a computer generated pattern recognition application. For the time being however, there's no way for a computer to talk to a person and really fool the individual. (For the time being)

The problem is a matter of cost; it doesn't cost the cheaters nearly as much as it costs the service-providers in this game. Using human security is expensive. While the cheaters just have to react to the counter-measures, it's not like they're a legitimate business. Meanwhile, the service providers not only have to pay for security measures to keep their business legitimate in the eyes of the consumers, they also have to keep their customers happy.

The worst part? If the cheater's tactics don't work, it's only a problem for the cheater. If the security measures don't work, not only is it a wasted effort for the service provider but there is the potential spill-over to also create problems for their customers.

I don't see how there can ever be a final solution, because as long as there's money to be made cheating the system someone will figure out a way to exploit it. In the meantime, all security can do is continue to change and evolve in order to make sure the system is never overwhelmed and a limb must be sacrificed.