We've all been there:
What's the biggest impediment common to all three?
If you didn't say CAPTCHA, then a) you've had a significantly less frustrating life than some of us, and b) what's it like to have low blood pressure?
I've recently started doing platform work with some people I've known for a while and am glad to be working with again. There's a difference between engineering for a paycheck and engineering for the love of the work, and these folks are firmly in the latter camp. It helps that the work has a chance to be more directly impactful than the last time we all shared an email domain.
My first chance to be impactful on this job, too, started with solving a CAPTCHA - though this one was a slightly different puzzle. Could we make a test that was intended to ensure presence of a human itself a bit more humane?
A CAPTCHA — the Completely Automated Public Turing test to tell Computers and Humans Apart — is one of those little puzzles a site throws at you when its owner wants to be sure there's a real person pushing the submit button. If you've been on the internet any time in the last two decades, you've met one: usually a grid of photos containing, occasionally, a bicycle or a bus, mixed in with whatever someone's desperate to get a car's vision system to classify as not a bicycle or a bus. These were typically served through Google's reCAPTCHA, offered for free in exchange for the fruits of that human-gated proof of work - the image labelling you were quietly doing for them.
More recently, providers have shifted to a model where the proof of work is done by the browser itself, performing a small but deliberately expensive calculation - effectively a sleep command for whatever script is scraping the page or trying to buy front-row seats. Providers like Cloudflare offer this directly with Turnstile.
This style of CAPTCHA has two real benefits for the user:
In our case, we had an additional accessibility problem to solve, one of a more technical nature. When you put a CAPTCHA in front of a form, you take on a responsibility, as the maintainer of that site and the services behind it, to do everything you can to keep that CAPTCHA reachable for your users. A customer who can't get into your site won't long remain a customer. Our product used Google's reCAPTCHA, which isn't available everywhere and that was quickly becoming a quiet obstacle to growth in certain markets.
The answer we landed on was to replace Google as our CAPTCHA provider with one we could host on our own infrastructure. That solved the accessibility problem for those customers and, as a bonus, kept their data private: nothing in the flow that decides whether a user is human needs to leave our network.
Altcha is who we turned to for this, a drop-in bit of infrastructure that completely eliminates the need for a third party to be involved in the process.
The implementation was really straightforward:
That was it. With everything bundled into an artifact for deployment and our in-house developer platform handling the rest, we gathered on a Zoom call one recent Friday evening, clicked promote, and said so long to "What do you mean there are more bicycles — that's clearly a mural."