compbio

An incredibly fascinating story. Tom Perkins: "Mister Sloot, you have done an unbelievable job. You are going to be the richest man on earth."

A TV-repair man working for over 20 years as a recluse in his attic. When his invention was ready for demo's, Roel Pieper was one of the first to take a look at it. He almost fell out of his chair and said "This is it!" when the device showed 16 movies running at different speeds. He quit his job at Philips later that week to form a company around the invention of Sloot.

Had Jan Sloot really found a new and novel way to store information, beating Shannon's law? Vector graphics? Pre-storing the code book? Or was that only the hook to get as much investors behind it and make a few really really rich?

I think the system was entirely within information theory laws. To see this, we look at a former invention of Sloot. As a TV-repair man he had to buy the schematics for the TV's he was working on. These schematics came on a CD or floppy disk. Sloot patented a device that had all the schematics of every TV already on it in a heavily compressed form. To "unlock" a schematic, one could call a phone number and receive a small keycode that one would enter. This would remove all the hassle of individual data carriers like CD's and floppies, which was a huge market at the time.

I believe the Sloot Digital Coding System was to be a setup-box for media and software. A commercial PirateBay of sorts. You would download (or bring in your device to a local shop) encrypted versions of the latest software and movies. Then you could simply call a number or buy a chip card to unlock a movie you wanted to see. A CD-I Netflix 10 years before Netflix.

This would have made the DVD market redundant. Like a Dolby Surround chip build into all sorts of electronics, so would this technology be licensed to other manufacturers.

The only (and very big) problem was that Jan Sloot did not get to really finish his update-code. How to efficiently and automatically update the database of these devices? A team could have probably worked around it, but Jan Sloot kept to himself and was enormously paranoid. He did not allow Faraday cage tests to rule out suitcase transmitters. He claimed they could be used to reverse engineer his simple invention.

The source-code for the device was never found. In the locker that PI's expected it to be, they found a John Grisham novel, and the only device ever opened after Sloot's death, contained a simple harddrive.

Jan Sloot's attic room was cleaned the day after he died. All his papers, chips and devices were taken. The widow of Jan Sloot and her son have no clue were it went.

I do not get the problem of hiring a clickfarm for 1$ an hour to click on cat pics.

If we take reputation, IP and cookie. All must be in order to pass. We want to spam a 1000 forms today. Scenario 1: The clickfarm itself fills in the Captcha. Result: Their IP's will soon be blacklisted, reputation of a third-world account will be inherently low. Scenario 2: We let the clickfarm send the answer to our own bot, which selects the right pictures. Result: Google will see a single IP and cookie trying out 1000s of captcha's a day, and ban you. Scenario 3: We let the clickfarm send the answer to our own bot, this bot uses a list of proxies that haven't yet been banned. Result: Google will see a single account cookie trying out 1000s of captcha's a day, from different IP's and ban you.

Can anyone come up with a scenario which involves reputation, IP and cookie that does not end up with Google detecting and banning your efforts? Cookie swapping?

The spammers thought the same when Bayesian spam filtering started working: "I'll just program a Markov chain to insert some none-spammy words". It did not work out quite so well.

I've also been thinking on how to defeat this, but even the mouse movement seems hard. You are trying to beat the big data statistics that Google has on these mouse movements. Programming a distorted mouse path does not take into account micro-movements (compare with saccades) or speed. To simulate mouse movements convincingly, I figure you'd need a model based on actual mouse movement data on these Captcha's. Also, you may succeed once or twice, but the third time the system is detecting your bot, making all your work void, since your code is now a new signature for bot-detection.

Bots want to quickly leave a message and move on to the next one. Real users first read an article, before they comment. If "Time on site before filling in Captcha" is a feature, then there may be no other way around detection, than for your bot to wait 5-10 minutes before filling in the Captcha.

I think this new system really makes it easier for non-bots to quickly fill in a captcha, and makes it harder for bots. Also because reputation (of IP, of cookies and behavior on Google domains) now seems to play a larger role.

The result of this reputation system for Captcha's is that Google admits to tracking their users outside their own domains. This also places the entire Google+ eco-system, analytics code, Chrome, fonts, charts and Google Hosted Libraries in a different light. Google tracks you everywhere, and the actions you take build or break your online reputation. I am not sure as a legit user that I want to trade this privacy concern, just so I can show my "humanity" and that I am not an evil bot. An evil bot would crawl the pages where these captchas are hosted, and join this data with the captcha user data. Then you can get personalized advertisements when you comment on 4chan in political threads.