Hacker News Reader

That's also relatively easy to protect. First defense is rate-limited, second is captchas, third is having a dynamic "secret" key fetching from some backend via JS that gets injected into the form and works as a "password" to successfully trigger the email to get sent (but displaying success messages even if it's not).

View on HN

> but displaying success messages even if it's not

Please don't do stuff like this. Some of use use VPNs and aggressively block third party JS. These sorts of shenanigans render many sites unusable which is frustrating but simply not using those services is a price I'm more than willing to pay at this point.

There is no need for 3rd party JS. It's something like ten lines and you can embed it in a script tag right next to the form elements.

> dynamic "secret" key fetching from some backend via JS that gets injected into the form and works as a "password" to successfully trigger the email to get sent

Are you describing nonces? A nonce is basically a "secret" (due to SSL encryption) number inserted into the HTML and submitted via a form. You don't need JS, just SSL.

Yeah, but in simpler terms :)

Making it require JS is on purpose as a lot of spam robots only parse HTML and don't execute JS, so you get less spam that way.

Reply on news.ycombinator.com