Skip to main content

CodeSOD: Solve a Captcha to Continue

4 days 3 hours ago

The first time Z hit the captcha on his company's site, he didn't think much of it. And to be honest, the second time he wasn't paying that much attention. So it wasn't until the third time that he realized that the captcha had showed him the same image every single time- a "5" with lines scribbled all over it.

That led Z to dig out the source and see how the captcha was implemneted.

<Center>Click a number below to proceed to the next page. <br>Some browsers do not like this feature and will try to get around it. If you are having trouble<br> seeing the image, empty your internet cache and temporary internet files may help. <br>Please ensure you have no refresher add-ons installed on your browser.<br /> <table border=1><Tr><td colspan='3' align='center'> <font style='font-size:36px;'><img width='150' title='5' alt='5' src='valimages/5.gif'> </font></td></tr> <Tr> <Td align=center><font size='6'><A href='valid.php?got=crimied&linknum=1'>1</a></font></td> <Td align=center><font size='6'><A href='valid.php?got=crimied&linknum=2'>2</a></font></td> <Td align=center><font size='6'><A href='valid.php?got=crimied&linknum=3'>3</a></font></td> </tr> <Tr> <Td align=center><font size='6'><A href='valid.php?got=crimied&linknum=4'>4</a></font></td> <Td align=center><font size='6'><A href='valid.php?got=crimied&linknum=5'>5</a></font></td> <Td align=center><font size='6'><A href='valid.php?got=crimied&linknum=6'>6</a></font></td> </tr> <tr> <Td align=center><font size='6'><A href='valid.php?got=crimied&linknum=7'>7</a></font></td> <Td align=center><font size='6'><A href='valid.php?got=crimied&linknum=8'>8</a></font></td> <Td align=center><font size='6'><A href='valid.php?got=crimied&linknum=9'>9</a></font></td> </tr></table> </Center>

Look, I know there's a joke about how hard it is to center things in CSS, but I think we've gone a little overboard with our attempt here.

Now, the PHP driving this page could have easily been implemented to randomly select an image from the valimages directory, and there was some commented out code to that effect. But it appears that whoever wrote it couldn't quite understand how to link the selected image to the behavior in valid.php, so they just opted to hard code in five as the correct answer.

The bonus, of course, is that the image for five is named 5.gif, which means if anyone really wanted to bypass the captcha, it'd be trivial to do so by scraping the code. I mean, not more trivial than just realizing "it's the same answer every time", but still, trivial.

Of course, out here in the real world, captchas have never been about keeping bots out of sites, and instead are just a way to trick the world into training AI. Pretty soon we'll roll out the Voight-Kampf test, but again, the secret purpose won't be to find the replicants, but instead gather data so that the next generation of replicants can pass the test.

[Advertisement] Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.
Remy Porter

Linux Gamers on Steam Finally Cross Over the 3% Mark

4 days 4 hours ago
"It finally happened," writes the GamingOnLinux site: Linux gamers on Steam as of the Steam Hardware & Software Survey for October 2025 have crossed over the elusive 3% mark. The trend has been clear for sometime, and with Windows 10 ending support, it was quite likely this was going to be the time for it to happen as more people try out Linux... Overall, 3% might not seem like much to some, but again — that trend is very clear and equates to millions of people. The last time Valve officially gave a proper monthly active user count was in 2022, and we know Steam has grown a lot since then, but even going by that original number would put monthly active Linux users at well over 4 million. Additional details from Phoronix: The only time Steam on Linux use was close to the 3% mark was when Steam on Linux initially debuted a decade ago and at that time the overall Steam user-base was much smaller than it is today. Long story short, thanks to the ongoing success of Valve's Steam Deck and other handhelds plus Steam Play (Proton) working out so well, these October numbers are the best yet... a hearty 0.41% increase to Linux... landing its overall marketshare at 3.05%. Windows meanwhile was at 94.84% (falling below 95% for the first time in a while) and macOS at 2.11%. For comparison, in October 2024 Steam on Linux was at 2.00%. The Linux-specific data shows SteamOS commanding around 27% of all the Linux installs at large. SteamOS most notably being on the Steam Deck hardware.

Read more of this story at Slashdot.

EditorDavid

ISPs more likely to throttle netizens who connect through carrier-grade NAT: Cloudflare

4 days 5 hours ago
When operators see danger, innocent users are dragged down along with bad actors

Before the potential of the internet was appreciated around the world, nations that understood its importance managed to scoop outsized allocations of IPv4 addresses, actions that today mean many users in the rest of the world are more likely to find their connections throttled or blocked.…

Simon Sharwood

OpenAI's Sam Altman Defends $1 Trillion+ Spending Commitments, Predicts Steep Revenue Growth, More Products

4 days 6 hours ago
TechCrunch reports: OpenAI CEO Sam Altman recently said that the company is doing "well more" than $13 billion in annual revenue — and he sounded a little testy when pressed on how it will pay for its massive spending commitments. His comments came up during a joint interviewon the Bg2 podcast between Altman and Microsoft CEO Satya Nadella about the partnership between their companies. Host Brad Gerstner (who's also founder and CEO of Altimeter Capital) brought upreports that OpenAI is currently bringing in around $13 billion in revenue — a sizable amount, but one that's dwarfed by more than $1 trillion in spending commitments for computing infrastructure that OpenAI has made for the next decade. "First of all, we're doing well more revenue than that. Second of all, Brad, if you want to sell your shares, I'll find you a buyer," Altman said, prompting laughs from Nadella. "I just — enough. I think there are a lot of people who would love to buy OpenAI shares." Altman's answer continued, making the case for OpenAI's business model. "We do plan for revenue to grow steeply. Revenue is growing steeply. We are taking a forward bet that it's going to continue to grow and that not only will ChatGPT keep growing, but we will be able to become one of the important AI clouds, that our consumer device business will be a significant and important thing. That AI that can automate science will create huge value... "We carefully plan, we understand where the technology — where the capability — is going to go, and the products we can build around that and the revenue we can generate. We might screw it up — like, this is the bet that we're making, and we're taking a risk along with that." (That bet-with-risks seems to be the $1.4 trillion in spending commitments — but Altman suggests it's offset by another absolutely certain risk: "If we don't have the compute, we will not be able to generate the revenue or make the models at this kind of scale.") Satya Nadella, Microsoft's CEO, added his own defense, "as both a partner and an investor. There has not been a single business plan that I've seen from OpenAI that they have put in and not beaten it. So in some sense, this is the one place where in terms of their growth — and just even the business — it's been unbelievable execution, quite frankly..."

Read more of this story at Slashdot.

EditorDavid

Manufacturer Remotely Bricks Smart Vacuum After Its Owner Blocked It From Collecting Data

4 days 7 hours ago
"An engineer got curious about how his iLife A11 smart vacuum worked and monitored the network traffic coming from the device," writes Tom's Hardware. "That's when he noticed it was constantly sending logs and telemetry data to the manufacturer — something he hadn't consented to." The user, Harishankar, decided to block the telemetry servers' IP addresses on his network, while keeping the firmware and OTA servers open. While his smart gadget worked for a while, it just refused to turn on soon after... He sent it to the service center multiple times, wherein the technicians would turn it on and see nothing wrong with the vacuum. When they returned it to him, it would work for a few days and then fail to boot again... [H]e decided to disassemble the thing to determine what killed it and to see if he could get it working again... [He discovered] a GD32F103 microcontroller to manage its plethora of sensors, including Lidar, gyroscopes, and encoders. He created PCB connectors and wrote Python scripts to control them with a computer, presumably to test each piece individually and identify what went wrong. From there, he built a Raspberry Pi joystick to manually drive the vacuum, proving that there was nothing wrong with the hardware. From this, he looked at its software and operating system, and that's where he discovered the dark truth: his smart vacuum was a security nightmare and a black hole for his personal data. First of all, it's Android Debug Bridge, which gives him full root access to the vacuum, wasn't protected by any kind of password or encryption. The manufacturer added a makeshift security protocol by omitting a crucial file, which caused it to disconnect soon after booting, but Harishankar easily bypassed it. He then discovered that it used Google Cartographer to build a live 3D map of his home. This isn't unusual, by far. After all, it's a smart vacuum, and it needs that data to navigate around his home. However, the concerning thing is that it was sending off all this data to the manufacturer's server. It makes sense for the device to send this data to the manufacturer, as its onboard SoC is nowhere near powerful enough to process all that data. However, it seems that iLife did not clear this with its customers. Furthermore, the engineer made one disturbing discovery — deep in the logs of his non-functioning smart vacuum, he found a command with a timestamp that matched exactly the time the gadget stopped working. This was clearly a kill command, and after he reversed it and rebooted the appliance, it roared back to life. Thanks to long-time Slashdot reader registrations_suck for sharing the article.

Read more of this story at Slashdot.

EditorDavid