Top all-time · #8003
Josh Fraser
Personal blog · onlineaspect.comwebstartups
Josh Fraser writes Online Aspect, a personal blog at onlineaspect.com about web and startups. Since 2007, 9 different Hacker News readers have linked it 45 times, most often “Why you should never use a CAPTCHA”. The last post was in 2020, but the archive is still widely read.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN links Josh Fraser's posts on EventVue's startup failure post-mortem, cross-domain JavaScript, and reading GET parameters from script tags. One commenter calls his follow-up post on EventVue a mandatory read.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
A blog about building stuff on the web by Josh Fraser
Most-linked posts?
- Why you should never use a CAPTCHA2 people · 7 mentions · first linked 2010-07-02
- /2010/10/26/a-few-words-about-eventvue/2 people · 2 mentions · first linked 2010-12-08
- /2007/06/08/auto-detect-a-time-zone-with-javascript/2 people · 2 mentions · first linked 2012-08-24
What Hacker News says?
I absolutely hate CAPTCHAs and have done my best to persuade developers to never use them (1). But in fairness to Google, the promise of their new Captcha system is that it uses all of your previous browsing history across the web to determine how likely you are to be a bot. You can't do a fair apples to apples comparison unless the browsing history and behavior is the same across both browsers. 1) https://www.onlin…
Comment linking /2010/07/02/why-you-should-never-use-a-captcha/
on “Google's Captcha in Firefox vs. in Chrome”Submitted The security hole I found on Amazon.com as a story · 139 points
HN discussionHere's the JavaScript behind it: https://www.gstatic.com/recaptcha/api2/r20141202135649/recap... It's hard to see what's sent over the wire (it's obfuscated), but the source gives you a good idea of what they're collecting. The biggie is the GA cookie which is running on over 10 million sites. Like any CAPTCHA, this is still breakable -- just load your actual cookies into Selenium or PhantomJS and replay your mouse…
Comment linking /2010/07/02/why-you-should-never-use-a-captcha/
on “Are You a Robot? Introducing “No CAPTCHA ReCAPTCHA””Submitted Why Greplin is my favorite new startup as a story · 20 points
HN discussionI'll repost this once again. Why you should never use a CAPTCHA: http://www.onlineaspect.com/2010/07/02/why-you-should-never-...
Comment linking /2010/07/02/why-you-should-never-use-a-captcha/
on “Captchas are Becoming Ridiculous”Submitted Navigational breadcrumbs in Rails as a story · 20 points
HN discussionI did some A/B testing on this a few years ago and found that HTML email had a better response rate for me. My methodology wasn't perfect, but I shared the results on my blog anyway: http://www.onlineaspect.com/2008/01/25/the-value-of-split-te...
Comment linking /2008/01/25/the-value-of-split-testing/
on “Show HN: Responsive Email Templates”Submitted Why you should never use a CAPTCHA as a story · 16 points
HN discussionMy personal rant on this topic: http://www.onlineaspect.com/2010/07/02/why-you-should-never-...
Comment linking /2010/07/02/why-you-should-never-use-a-captcha/
on “Captchas Are Becoming Ridiculous”Submitted Google Apps for your domain is awesome, except when it isn’t as a story · 15 points
HN discussionIt sounds like Google have changed their policies on this. Just a few months ago I was caught on the other side of this issue. Basically I bought a domain and wasn't able to get Google Apps set up because someone else had used it in the past. Here's the full story: http://www.onlineaspect.com/2010/11/12/issues_with_google_ap...
Comment linking /2010/11/12/issues_with_google_apps/
on “Do not let your domain expire with Google Apps”Submitted Pinterest’s 25 edge cases as a story · 5 points
HN discussionAgreed about open-source leading to greater security. Here's what I wrote on the topic a few years ago: http://www.onlineaspect.com/2010/01/19/openness-and-security...
Comment linking /2010/01/19/openness-and-security-go-hand-in-hand/
on “Estonian E-Voting Source Code Made Public”Submitted Don't wait for permission as a story · 5 points
HN discussionThere's actually a ton of data to support the idea that making activities feel more dangerous makes them safer. I actually gave a talk on this topic a few years ago: http://www.onlineaspect.com/2010/07/05/ignite-boulder-11/ How to Live Dangerously by Warwick Cairns is a great book on the topic as well.
Comment linking /2010/07/05/ignite-boulder-11/
on “Why 12-Foot Traffic Lanes Are Disastrous for Safety”Submitted Seeing the world between startups as a story · 4 points
HN discussionBack in 2013 I discovered that you could use clickjacking to trick someone into buying anything you wanted from Amazon (assuming they were signed in). It took them almost a year to fix the issue. They never paid me a bounty. https://onlineaspect.com/2014/06/06/clickjacking-amazon-com/
Comment linking /2014/06/06/clickjacking-amazon-com/
on “DoubleClickjacking: A New type of web hacking technique”Submitted TechStars companies’ hosting decisions as a story · 3 points
HN discussionI'm not a web developer, but can't you do that with Javascript? http://www.w3schools.com/jsref/jsref_gettimezoneoffset.asp http://www.onlineaspect.com/2007/06/08/auto-detect-a-time-zo...
Comment linking /2007/06/08/auto-detect-a-time-zone-with-javascript/
on “Why you should not be displaying relative dates.”Submitted How business guys can identify good coders as a story · 3 points
HN discussionDid you read this post-mortem from EventVue? http://www.onlineaspect.com/2010/10/26/a-few-words-about-eve... It was on HN last week. The funny thing is, showing who is coming to a conference actually hurt their client! Because people tend to register so late... So double check your claims that you know who is coming.
Comment linking /2010/10/26/a-few-words-about-eventvue/
on “Lanyrd feeds: never miss out on a conference”Submitted Coding for the unexpected as a story · 3 points
HN discussionYou mentioned EventVue's excellent post-mortem already. But for anyone thinking of building a startup in that space, Josh Fraser (EventVue's co-founder)'s follow-up post is also a mandatory read: http://www.onlineaspect.com/2010/10/26/a-few-words-about-eve... - since he posted that follow-up on his own blog, it would be worth linking both in the article. And if anyone is thinking of building something in the event s…
Comment linking /2010/10/26/a-few-words-about-eventvue/
on “Startup failure post-mortems”Submitted The protocols powering the real-time web as a story · 3 points
HN discussionFor those who are interested, I wrote a post on the challenges of extracting forenames and surnames and shared some imperfect code that takes a stab at it: http://www.onlineaspect.com/2009/08/17/splitting-names/
Comment linking /2009/08/17/splitting-names/
on “Why Users Fill Out Forms Faster with Unified Text Fields”Submitted Can't remember which social login method you used? as a story · 2 points
HN discussionI found eaxyXDM to be well.. not so easy. Not in actual usage but it felt like too much of magic going around, which made me uncomfortable using it (what if some thing breaks and I'm not able to fix it..). I ended up using much more limited but much easier to understand code at this location: http://www.onlineaspect.com/2010/01/15/backwards-compatible-... It uses postmessage for newer browsers and hash location tric…
Comment linking /2010/01/15/backwards-compatible-postmessage/
on “EasyXDM – crossdomain javascript done right”Submitted Broken business models as a story · 2 points
HN discussionThis feels like a good time to repost my article on why you should never use a CAPTCHA: http://www.onlineaspect.com/2010/07/02/why-you-should-never-...
Comment linking /2010/07/02/why-you-should-never-use-a-captcha/
on “Attacking Audio reCaptcha using Google's Web Speech API”Submitted Working hard to be lucky but not working too hard as a story · 2 points
HN discussion
