DEV Community: Cohan Robinson

Defeating Form Spam Bots

Cohan Robinson — Tue, 18 Feb 2020 06:38:48 +0000

Bonus: You’re gonna wind up the nerds that disable Javascript with this one.

Alright so lets take my contact page. It was receiving probably 50 to 100 spam submissions every day. Not the worst I’ve seen, but still annoying. Moreso when the spam actually gets through.

What I was doing

I was doing the standard honeypot element, y’know where you have a text that’s hidden somehow using CSS, which if filled you discard the submission. It was relatively effective, I’d probably give it a solid 75% effectiveness. The problem with 75% effectiveness if you were getting 100 spam submissions a day, you’re still getting 25 spam messages a day. Dammit.

I then changed the name of this input to other-name, in a hopes that it would trip up the spammer scripts that had a mild amount of smarts behind them - I dunno maybe they ignore fields named ‘honeypot’ or anything super obvious. I also added an aria-label aria-label="Don't fill this one out mate, it's the spam honeypot one" so that hopefully if anyone with visual difficulties could still send me message. This change of input name did help, and I’d say we got to around 90% success, or 10 spam messages a day depending on whether you’re a glass full or glass empty sort of person.

What I’m doing now

The same thing, I have not removed the above, this is in addition to. You’re going to need a page that addresses people that disable javascript, because they’ll whinge and whine about it loudly on the internet if you don’t. The internet Amish are much more noisy than the real Amish.

No you can’t fall back and accept inputs on this URL, because that defeats the entire point of this. It’s important that that page does not accept any form submissions.

Next up, send your form there. <form action='https://cohan.dev/that-needs-js/'> - Yup. You’ve just broken your form entirely. Well done.

Nah, we wanted to do that. Next up we’ll use Javascript to fix what we just broke. Spam bots will eventually start using javascript if people do this enough, but for now I’ve found that barely any of them (if any at all) are doing so.

<form id='myContactForm' action='https://cohan.dev/that-needs-js/' data-action='https://cohan.dev/your/actual/form/submit/url'>

Next it’s a case of having the browser substitute in that data-action for the regular action before submitting the form. Bung this in the page somewhere.

<script>
    function updateContactFormDestination() {
        var contactForm = document.getElementById("myContactForm");
        var realSubmitUrl = contactForm.getAttribute('data-action');

        contactForm.setAttribute('action', realSubmitUrl);
    }

    document.addEventListener("DOMContentLoaded", function(event) { 
        updateContactFormDestination();
    });
</script>

Now you can avoid getting messages from robots and nerds with javascript disabled! :D

Currently this has, for me, had a 100% success rate. 0 spam emails coming from my form per day.

I give it a week.

Maybe you should subscribe to my mail list for when I publish my next bot-thwarter! :D

We Hate Captchas!

Cohan Robinson — Sun, 29 Dec 2019 18:01:25 +0000

As part of the Year of More I’ve decided this year to do 12 projects over 12 months. I might have already cheated a bit.

I bought a website. Not something I’ve done.. ever before, but this one I liked the look of. The site is called We Hate Captchas.

A little while back I posted an ask on Hacker News “Are there any viable alternatives to reCAPTCHA?” and didn’t get much of a response outside of “There are other services”. My desire however was not to bring back the old solve-the-words thing that generally got in the way or proved completely impossible for some users with disabilities, I wanted the invisibility of Google’s reCAPTCHA but without the Google part.

Earlier today I happened across a tweet from Dalton Edwards, who’s created such a product. He’s selling up so that he can focus on other projects and was looking for a buyer.

Project for Sale: https://wehatecaptchas.com/

Sale includes ownership of all source code and the wehatecaptchas.com domain.

Please DM me if you have any questions or wish to make an offer. Thanks 😃— Dalton Edwards (@DaltonEdwards) December 27, 2019

Normally I imagine you should throw down a load of red tape for your standard website purchase but heck, I had a bit of cash knocking about and a need for a reCAPTCHAless CAPTCHAless CAPTCHA (what?). I figured the juice is worth the squeeze if I can ensure there’s an alternative to reCAPTCHA out there. Anyway short story shorter, I went and bought it.

In case anyone’s actively using it as-is I’m going to keep it online and working. In future I’ll rework some of it, change some things here and there, maybe even change domain? Admittedly the first thing I did once we’d sorted the payment/code exchange was grab nocaptcha.net. Aside from that, you keep doing you.

The site will stay up and running, if there are any changes made they’ll be done in a manner that doesn’t break anyone’s current use of the site.

Does this count as a project for The Year of More? I’m not sure yet, I guess if I give it at least a month’s worth of time throughout the year I can count it as the 13th project! Sweet!

The Year of More

Cohan Robinson — Sun, 22 Dec 2019 05:05:13 +0000

The year of more. As if spinning plates all through 2019 wasn’t exhausting enough?!

Well, yeah.. tires were spun, the engine was revved, gears were ground.. but what was there to show for it? A bunch of abandoned projects and Hosted sort of coming together in the last month or so! Ooooh well done, me. So proud.

In 2020, the year of the future, I’m going to release something. Multiple somethings. Publicly. It don’t count if nobody sees it.

Each project has 1 month before going public. If it sucks, it sucks. Do it better next time. Release date is 18:00 on the last day of each month. Time for previous months’ projects to be maintained and supported needs to be factored in.

If any take off*, the year of more may (but isn’t obliged to) end.

* ‘take off’ defined as yearly revenue > current salary

Get the latest on the current project over on the /now/ page.

Things to do in 2020:

Hosted MVP (Release end of Jan 2020)
Next project tbc (Release end of Feb 2020)
and so on

Also to do:

Personal podcast (Ep 1 to release 1st Jan 2020)
Live stream a bunch of it!
Blog it, all of it. Something like once a week.
Embrace failure on Patreon.

Lets see how this goes eh!

Heavily inspired by (read: it’s basically the exact same thing as) @levelsio’s 12 Startups in 12 Months.

“Yearly theme” comes from Cortex’s Theme System and related podcast

Automate Your Slack Status

Cohan Robinson — Sat, 07 Sep 2019 14:14:57 +0000

Automating your Slack status. Why would you want to do that? Well for one thing it stops people asking what you’re up to. Actually that’s the only reason to do it.

I recently went remote, work from home, the whole shebang. Nice.

One of the first problems we discovered with this however was that it wasn’t really possible to see what I am working on. Not in the micro-manage screenshot every 5 minutes sense but a general gist. The way I worked around this was to tie in my Slack status to display what I was doing. Lets jump in!

You will need

Zapier
Everhour.. or Harvest, or Toggl, or some form of time tracking that integrates with;
Basecamp.. or Asana, or Jira, or something else that integrates with the time tracker you picked
Slack (Duh)

Set it up

Time tracker integration (Everhour and Basecamp in my case)

This one I’m not going to be so much help with. I personally use Everhour and Basecamp. You use whatever you’re using, the key point is that you need to be able to start and stop timers that includes the title of the task you’re working on.

Zapier setup

If you’re a smart cookie you’ll only need this screenshot to set it all up. So here it is. Get on it champ.

Yes. In this you’ll need a paid Zapier account. Get your employer to pay for it or something. No I’ve not figured out a decent way to make it work without the multi-step zaps.

If you do figure out a way to do this free, please do blog about it and send me the link - I’ll give you some shoutouts here!

Choose Everhour as the starting trigger, with a trigger event of a timer starting

Leave the project section blank if you want it to work for everything!

Next up we need to make sure we’re setting our own status, rather than claiming credit for someone else’s work

Now we do the bit where we update Slack

Test it out

Pop over to Basecamp (or whatever you use, etc, etc)

boop

Look over at the Slack, what’s this

Hover the computer icon

Bosh!

Unset it when you’re done

Same again really, set up all the same except trigger on the timer stopped event and leave the slack status empty, this unsets your status.

Keep the only continue if in place, otherwise you’ll stop working whenever someone else stops a timer.

No more “are you busy” messages on Slack, noice!

Make Slack a Little Less Distracting

Cohan Robinson — Tue, 21 May 2019 09:23:51 +0000

In the browser version of Slack the favicon shows up white if any message appears. This disables that, keeping the red new-message icon intact

You’ll need a browser blocker to do this (I highly recommend uBlock Origin but any that support the Adblock-style personal blocking lists will work)

For a specific Slack server

In your personal filter list, add the following URL - replacing INSTANCE with your Slack server’s name

https://INSTANCE.slack.com/img/ico/app_icon_32px_online_unreads.png

For all Slack servers

Same thing but in your personal filter add the URL

https://a.slack-edge.com/5d94d/img/ico/app_icon_32px_online_unreads.png

Done

Now when a message that doesn’t need your attention comes in you don’t get the distracting white favicon, but will still get the red version of the icon to indicate you’ve got a new direct message. Noice.

Dynamic blocklist with Twilio

Cohan Robinson — Wed, 24 Apr 2019 18:35:35 +0000

For those moments where you wish you could dynamically block incoming calls within Twilio.. We all have them, right?

Desired end result

I have a file on my site that lists phone numbers. Any number in that list will be blocked from calling me.

You will need

A json file that contains an array of phone numbers
A Twilio number that receives calls from numbers you wish to block

First thing’s first, we’re going to pop over to a completely different site (I will write this up here if the source ever vanishes, ping me on the contact form if that’s the case)

Have a read of this article on Twilio’s help site. The section you’re after is under “Reject Calls from Specific Phone Numbers” if the anchor doesn’t work.

Come back here when you get to the “CODE” part.

…

That JSON file I mentioned

Simple enough, upload it somewhere public, it should look something like this (but with real numbers of course)

[
    "+441234567891",
    "+441234567893",
    "+441234567892"
]

Remember to not put the comma on that last number listed. JSON doesn’t like that.

Now for some code

Done the setup part? Sweet. Now in Twilio, under the Runtime -> Functions section go to Configure on the sidebar and under Dependencies add a new NPM module request.

Version shouldn’t be required but in case you’re after it, at the time of writing it’s 2.88.0.

Just to note: For me, the form input was hidden under the save button. Bit weird.. Click the version of the last one you can see and tab into it.

Once you hit the Save button it should pop up a message about saving, then deploying, then deployed.

Go back to the Manage -> Your function. Insert this code below, making three replacements

https://cohan.io/blocked-numbers.json: Replace with the URL to your blocked numbers file
https://ic4.io/twilio-voicemail: The URL to whatever was previously handling your inbound flow.

Personally I use a Twimlet to just dump everyone into voicemail.

exports.handler = function(context, event, callback) {

    var request = require('request');

    request('https://cohan.io/blocked-numbers.json', function (error, response, body) {

        let twiml = new Twilio.twiml.VoiceResponse();
        let blocked = true;

        if (error) {
            twiml.redirect("https://ic4.io/twilio-voicemail");
        }
        else {
            let blocklist = JSON.parse(body);

            if (blocklist.length > 0) {
                if (blocklist.indexOf(event.From) === -1) {
                    blocked = false;
                }
            }
            if (blocked) {
                twiml.reject();
            }
            else {
                twiml.redirect("https://ic4.io/twilio-voicemail");
            }
            callback(null, twiml);
        }

    });

};

Running through this, when we receive a new inbound call we:

Make a request to fetch our blocklist
If that fails we’re going to assume we don’t have a blocklist, proceed as normal
If it succeeds we parse the JSON into blocklist
We then check if the number calling us right now against the list
If it is not listed, proceed as normal
If it is in the blocklist, reject the call

For curiosity purposes; When you reject a call, to the caller there’s an automated message that says the number is not in use then it instantly hangs up on them.

Make it so

To apply your newly created function to your phone number(s), check out the article Configuring Phone Numbers to Receive Voice Calls

Dun

That was easy enough… right? Hit up the discussion forum if you need a hand :)

The Problem with Luminary and Other Exclusive "Podcast" Hosts

Cohan Robinson — Mon, 22 Apr 2019 20:21:34 +0000

“heh guess people just don’t like paying for things”

Dammit, no. That’s not the problem.

More news of Luminary, Spotify, The BBC, etc doing their exclusive lockdown of the podcast ecosystem popping up as Luminary readies to go live.

The problem these companies don’t seem to grasp, and indeed the tech blogs that report on them, is the problem with them is not that they’re paid content. It’s that they’re not podcasts.

Podcasts have RSS feeds. Podcasts can be played in any podcast client. Podcasts can be played on iPods, dammit. There needs to be a way to download the episodes and play them on any device.

Patreon for example gets this. You can set up an exclusive-to-patrons podcast feed on their system and Patreon will give your patrons a unique link that they can use to access the content. This is all it needs.

If Luminary, Spotify, The BBC, whoever else, were to provide users with a unique RSS URL they can subscribe to in their client of choice we’re all on the same page.

It is not an issue with paying for podcasts. It’s an issue with their podcasts not being podcasts. Open up your doors, podcasting is inclusive - not exclusive.

Let the market decide if your podcasts are worth paying for, don’t try to lock down the ecosystem that’s been around since before you were a startup sparkle in some nerd’s eye. Quit trying to wall everything off. Ya dinguses.

Podcast Chapter-o-tron

Cohan Robinson — Sat, 20 Apr 2019 19:00:00 +0000

I wanted a simple way to add chapters to my podcast episodes.

I know there’s other software out there that does this - it’s mostly all Mac software (grumble grumble) - but I wanted a nice simple web interface to adding podcast chapters. Naturally I couldn’t find one.

Enter the Podcast Chapter-o-tron. Select your podcast file, specify where your chapters need to be, hit Go. Give it a moment to upload and process and it’ll chuck you back a file with your chapters encoded in to the file.

These chapters have tested working with Overcast so far, but I imagine any player that supports chapters will display them.

To note this is the very most basic initial build of this sort of thing, so it’s missing a few things. No file upload or processing progress bar yet and if there’s an error it’ll just chuck you your file back (I know, that’s not the best).

Also because I’m just hosting it on my standard tinkering server for now if the disk fills up it’ll probably just completely fall over spectacularly. I’ll keep an eye on that for now and set it up to clean up old files automatically soon.

Podcast Chapter-o-tron