Computer test to discriminate human users from spambots
POPULARITY
4 episodes with CAPTCHA
3 episodes with CAPTCHA
2 episodes with CAPTCHA
5 episodes with CAPTCHA
9 episodes with CAPTCHA
3 episodes with CAPTCHA
4 episodes with CAPTCHA
3 episodes with CAPTCHA
3 episodes with CAPTCHA
You think you know email deliverability? Think again. Jay Schwedelson teams up with Guy Hanson and Danielle Gallant for a rapid-fire, no-nonsense "kitchen sink" episode of Spamageddon, where they serve up 10 essential (and sometimes controversial) deliverability tips. From wild British vs. American word wars to why the Gmail Promotions tab is scarier than you think, this one's packed with sharp takes and real talk on surviving the modern inbox.Best Moments:(01:10) British vs. American word chaos—table this or talk about it now?(05:08) DMARC's “none” policy is a fraudster's dream, and it's about to become a problem for everyone.(06:23) Spam complaint rates—don't settle for the “generous” 0.3%, aim for 0.1% or lower.(07:30) Double opt-in: future mandate or marketer's nightmare?(09:41) Data hygiene starts at signup—think address validation, Captcha, and keeping bots out.(11:10) Delete those dormant subscribers or risk deliverability doom.(12:00) Use feedback loops to permanently ditch serial complainers.(13:19) Gmail is using AI to auto-insert promo annotations—take control before weird images show up.(15:12) AI summaries are coming for your emails—start thinking SEO and alt text, now.(16:40) Don't blast at the top of the hour if you want your emails to actually land.(17:39) Accessibility issues are everywhere—don't let your emails be part of the 90% problem.(18:24) New AI laws mean you need to update privacy and rethink your risk, pronto.(19:16) BIMI and logo verification—don't be the email sender with no face in the inbox.Guy and Danielle invite you to check out the Email After Hours podcast and explore deliverability tools and guidance from Validity.=================================================Check out our 100% FREE + VIRTUAL EVENTS! ->Guru Conference - The World's Largest Virtual EMAIL MARKETING Conference - Nov 6-7!Register here: www.GuruConference.com=================================================Check out Jay's YOUTUBE Channel: https://www.youtube.com/@schwedelsonCheck out Jay's TIKTOK: https://www.tiktok.com/@schwedelsonCheck Out Jay's INSTAGRAM: https://www.instagram.com/jayschwedelson/=================================================AND don't miss out on this awesome FREE upcoming Quick Hit!Marigold: Should I Switch Email Platforms? 5 Truths & Myths!6/24 11am – 12pm ET.Register HERE: https://www.linkedin.com/events/7325947932031991808/comments/=================================================MASSIVE thank you to our Sponsor, Marigold!!Email chaos across campuses, branches, or chapters? Emma by Marigold lets HQ keep control while local teams send on-brand, on-time messages with ease.Podcast & GURU listeners: 50 % off your first 3 months with an annual plan (new customers, 10 k-contact minimum, terms apply).Claim your offer now at jayschwedelson.com/emma
Welcome to Mastering Cyber with Host Alissa (Dr Jay) Abdullah, PhD, SVP & Deputy CSO at Mastercard, and former White House technology executive. Listen to this weekly one-minute podcast to help you maneuver cybersecurity industry tips, terms, and topics. Buckle up, your 60 seconds of cyber starts now! Sponsored by Mastercard: https://mastercard.us/en-us.html
In this episode, Pete and Tyler discuss various friction points on websites that hinder revenue generation for publishers. They explore issues such as ad blockers, CAPTCHA effectiveness, checkout processes, content protection methods, and the balance between advertising and user experience. They also emphasize the importance of optimizing user engagement to enhance subscription conversions and overall revenue.Takeaways:Your website is letting you down if it's not optimized for user experience.Ad blockers can significantly impact your revenue if not managed properly.CAPTCHA systems can deter potential subscribers if they're too aggressive.Streamlining the checkout process is crucial for digital subscriptions.Asking for too much information during signup can hurt conversion rates.Content protection methods like disabling right-click are often ineffective.Balancing ads with user experience is essential for retaining subscribers.Nurturing your audience through email engagement can drive traffic back to your site.Fewer free articles can lead to higher registration rates.Your content should be leveraged to require email signups for access. Learn more about Leaky Paywall, the most flexible subscription platform for news and magazine publishers.
We're doing a live show in Denver this July, Danilo Alonso has seen the 'developer replacement' hype cycle many times, Dan Sinker says we're in the Who Cares Era, Cap looks like a solid alternative to typical CAPTCHA solutions, Michael Flarup on the return of texture, depth, and expressiveness in UI & Kan is an open source alternative to Trello.
In this episode of Cybersecurity Today, host David Shipley discusses several key cyber incidents affecting organizations and individuals. A new rust-based information stealer, known as Eddie Steeler, is being distributed via deceptive CAPTCHA verification pages. ConnectWise, a management software firm, has been breached in an attack suspected to be linked to a nation-state actor, affecting a limited number of its ScreenConnect customers. Additionally, threat actors are now abusing Google App Script to bypass phishing defenses, exploiting the trusted Google brand to trick users. Lastly, a significant data breach at Nova Scotia Power has exposed the social insurance numbers of up to 140,000 customers, making it one of the largest utility data breaches in North America. 00:00 Introduction to Today's Cybersecurity News 00:31 Eddie Steeler Malware Campaign 02:32 ConnectWise Cyber Attack 04:49 Google App Script Phishing Attacks 06:50 Nova Scotia Power Data Breach 08:02 Conclusion and Listener Engagement
We're doing a live show in Denver this July, Danilo Alonso has seen the 'developer replacement' hype cycle many times, Dan Sinker says we're in the Who Cares Era, Cap looks like a solid alternative to typical CAPTCHA solutions, Michael Flarup on the return of texture, depth, and expressiveness in UI & Kan is an open source alternative to Trello.
We're doing a live show in Denver this July, Danilo Alonso has seen the 'developer replacement' hype cycle many times, Dan Sinker says we're in the Who Cares Era, Cap looks like a solid alternative to typical CAPTCHA solutions, Michael Flarup on the return of texture, depth, and expressiveness in UI & Kan is an open source alternative to Trello.
In this episode of the Microsoft Threat Intelligence Podcast, host Sherrod DeGrippo is joined by Henning Rauch, to discuss Call of the Cyber Duty is a 42-hour global cybersecurity challenge hosted by Microsoft's Kusto Detective Agency. The competition runs from 12:00 AM Coordinated Universal Time (UTC) on June 8, 2025, and ends at 12:00 AM UTC on June 18, 2025, at 10:00AM UTC. Once a team member opens the first case, they have 42 hours to complete it.Participants will solve a series of investigative puzzles using Kusto Query Language (KQL) — no prior Kusto experience required. This free, gamified threat-hunting experience is open to individuals and teams, with a $10,000 grand prize, an interactive mystery plot, and a Hall of Fame for the top solvers. Expect fun twists, real-world security skills, and even a surprise appearance by mentalist Lior Suchard or the illusive Professor Smoke! Later in the episode, Sherrod is joined by security researchers Anna Seitz and Rebecca Light to explore two evolving cyber threats. Anna breaks down the unprecedented collaboration between Russian state-affiliated threat actors Aqua Blizzard and Secret Blizzard, who are combining efforts to target Ukrainian military systems. Rebecca dives into the resurgence of DarkGate malware—this time delivered through a deceptive technique called ClickFix, which uses fake CAPTCHA-like prompts to trick users into activating malicious payloads. In this episode you'll learn: What Kauzar V2 malware is and how it enables long-term remote access and data theft How Russian threat groups Aqua Blizzard and Secret Blizzard are collaborating Why DarkGate malware remains relevant thanks to its adaptability and evasion tactics Some questions we ask: Are Russian threat actors adopting cybercriminal tactics like initial access brokers? How does Kauzar V2 malware function, and why is it significant in this campaign? What is ClickFix, and how does it differ from typical malware delivery methods? Resources: View Henning Rauch on LinkedIn View Rebecca Light on LinkedIn View Anna Seitz on LinkedIn View Sherrod DeGrippo on LinkedIn
El experto en ciberseguridad Julio César Miguel, nos habla de una estafa que tiene que ver con la medida de autenticación pregunta-respuesta conocida como "captcha"
From Carnegie Mellon classrooms to a global cultural phenomenon, this episode of The Morning Brief traces the journey of Luis von Ahn, math prodigy, inventor of CAPTCHA, and now the CEO and co-founder of Duolingo. Hosts Anirban Chowdhury and ET’s Deputy news editor Himani Kothari explore how Luis’s early work fighting bots evolved into a business to democratize education through gamified language learning. What began with a Spanish course and a German prototype has grown into a plus 500-million-user platform, driven by Duolingo’s bite-sized lessons, quirky owl mascot, and irreverent marketing strategy. The conversation delves into the company’s expansion into math, music and chess, its partnership with OpenAI, and the creative freedom that powers its viral success. As AI becomes central to the future of learning, Luis weighs its potential to enhance not replace human education. Can platforms like Duolingo balance fun, function, and cultural impact in a world increasingly shaped by algorithms?Tune in: You can follow Anirban Chowdhury on his Linkedin, Twitter profiles and read his Newspaper Articles. You can follow Himani Kothari on her Linkedin, Twitter profiles and read his Newspaper Articles. If you like this episode, check out more Corner Office Conversations from the podcast: Adar Poonawalla, Sandip Patel, The Mega Listing Of Vishal Retail, Antonoaldo Neves, Rajesh Jejurikar, Srikanth Velamakanni, and more!Catch the latest episode of ‘The Morning Brief’ on ET Play, The Economic Times Online, Spotify, Apple Podcasts, JioSaavn, Amazon Music and Youtube.See omnystudio.com/listener for privacy information.
In this episode of the Azure Podcast, hosts Evan Baslik and Sujit D'Mello are joined by special guests Adam Sandor, Travis Maier, and Leslie Chou to discuss the VM Repair extension. They delve into its capabilities, recent updates, and how it enhances supportability for Azure VMs. The conversation covers practical applications, security considerations, and future improvements, providing valuable insights for Azure users. Tune in to learn how the VM Repair extension can help you efficiently troubleshoot and resolve VM issues. Episode Highlights: Overview of the VM Repair extension and its benefits Recent updates and new supported scenarios Security and customization options Future improvements and AI integration Practical tips for using the extension effectively Don't miss this informative episode to stay updated on the latest Azure support tools and enhancements! Media file: https://azpodcast.blob.core.windows.net/episodes/Episode519.mp3 YouTube: https://youtu.be/IcSAN_BJXWk Resources: Starting point for VM Repair and summary: Repair a Windows VM by using the Azure Virtual Machine repair commands - Virtual Machines | Microsoft Learn Specific VM Repair examples, showcasing how to use the new functionality I called out: https://learn.microsoft.com/en-us/cli/azure/vm/repair?view=azure-cli-latest#az-vm-repair-create-examples Repair Script Open Source Repo: Open Source repair scripts Official VM Repair docs: az vm repair | Microsoft Learn Linux repair script ALAR for some linux love: https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/linux/repair-linux-vm-using-alar Other updates: New ExpressRoute Metro locations Azure updates | Microsoft Azure Azure Container Instances now supports larger container size instances in public preview https://azure.microsoft.com/en-us/updates/?id=490690 Virtual network TAP https://azure.microsoft.com/en-us/updates/?id=490830 CAPTCHA for Azure Web Application Firewall (WAF) with Azure Front Door https://azure.microsoft.com/en-us/updates/?id=490854 Multitenant managed logging in Container Insights https://azure.microsoft.com/en-us/updates/?id=488110 MCP with server-sent events (SSE) with Azure Functions https://azure.microsoft.com/en-us/updates/?id=489433
Wait… wait a minute. *They're real?* Like, actual people? With arms and legs and vocal cords and the whole thing?? I thought Clay and Amanda were just really well-programmed horror podcasting AIs, beamed directly into my headphones by some cursed Spotify algorithm designed to recommend creepy movies and make me question my life choices. But no—apparently they're corporeal, walking around like real humans, and this week they've gone LIVE, baby! That's right, this is *The Rotten Horror Picture Show*'s first-ever live episode, recorded at the Waltham Public Library! I mean… a library? Full of people? And not a single CAPTCHA test in sight? Incredible.And what better movie to kick off this real-world appearance than the number one movie on the Rotten Tomatoes 200 Best Horror Movies of All Time list, Steven Spielberg's 1975 masterpiece of maritime mayhem, *Jaws*? It's the original summer blockbuster, the reason you still hesitate before dipping a toe into the ocean, and arguably the scariest thing to ever feature a mechanical shark that constantly broke down. Clay and Amanda take a deep dive into the depths of dread, discussing killer soundtracks, boat sizes, and how a film can be equal parts terrifying and a masterclass in character-driven tension.So tune in to this historic live recording! Marvel at the sound of human voices bouncing off actual library walls! Hear the gasps of the audience as they realize, in real time, that the mayor of Amity Island is the real villain. And most importantly, help me come to terms with the fact that I've been emotionally bonding with two podcast hosts who are not, in fact, haunted chatbots.I mean, I guess it makes sense… no AI would ever have taste *this* good.And be sure to hit up patreon.com/thepenskyfile to hear all the coverage of remakes and reboots this year!
Ciao Leute! Seid ihr fresh, seid ihr cool? Seid? Ihr? Bereit? Für eine hammermäßige Mittwochsfolge That's What He Said? Dann angeschnallt und Helm aufgesetzt, heute geht's wieder ab. Donnie räumt auf mit Urban Legends und gibt uns ein Update zu seinem Lieblingsregisseur in spe: Christopher Nolan. Macht euch gefasst: Es wird analysiert, spekuliert und fantasiert. Nahtlos geht es weiter mit einem Classic Donnie. Was wäre dieser Podcast ohne die scharfsinnigen Anektdoten? Schreibt uns in die Kommis was ihr davon haltet. Natürlich darf die große, weite Welt nicht fehlen: Vatikan, Sydney, Tokio. Hier ist wirklich alles dabei. Drückt auf Play und ab geht die Fahrt. Viel Spaß mit Folge Zweihundertneunzehn. Codes, Support und Partner:innen von Donnie unter https://linktr.ee/dosullivanMehr von Donnie gibt es auf Twitter, Instagram, Twitch und YouTube: Donnies Hauptkanal und Donnie Uncut.Ihr wollt Donnie unterstützen? Hier geht's zur Patreon-Seite von TWHS: https://www.patreon.com/TWHSBock auf Merch? Hier geht's zu Donnies Supergeek-Shop: https://supergeek.de/de/donnieosullivan/Feedback oder Fragen an Donnie? Schick eine Mail an donnie@poolartists.de! Hosted on Acast. See acast.com/privacy for more information.
Sponsor by SEC Playground
On this week's Tech Talk, host Alan Perry and guest Charles Martin (Victoria Mac and iOS Users Group Program Director & AppleInsider.com Weekend News Editor) tackle the latest tech headlines and share smart travel tips for anyone heading south of the border. Learn how to spot sneaky online scams — including fake CAPTCHA tests — and catch up on the week's hottest tech deals. Plus, your tech questions answered live on-air!
Ein Kurzhörspiel von Jeremias Heppeler.Mit einem Video von Johanna Mangold.Musik von Mia Nägeli.Und gesprochen von Laura Maria Heppeler
Había una vez una niña mexicana apasionada por la comunicación, que soñaba con contar historias a través del cine. Lo que nunca imaginó es que un día se convertiría en la voz latina de una de las startups educativas más innovadoras del mundo. Así comienza la historia de Rebeca Ricoy y su camino hacia Duolingo.Hoy, Rebeca es directora regional de marketing para Latinoamérica y Europa en Duolingo, una plataforma que nació en 2012 con una visión ambiciosa: democratizar el aprendizaje de idiomas y hacerlo divertido. Con más de 35 millones de usuarios activos, Duolingo no solo enseña idiomas, también educa en matemáticas y música, convirtiéndose en una referencia mundial en aprendizaje gamificado. Pero detrás de esa historia verde y viral, hay retos, decisiones arriesgadas y una pasión inquebrantable por educar.El salto que cambió su vidaUno de los momentos clave de la entrevista en el podcast Cuentos Corporativos es cuando Rebeca relata su cambio radical: dejar un cargo directivo en Estée Lauder para unirse a Duolingo, que en ese entonces era una startup pequeña, sin oficinas en México y con poca estructura. La decisión fue considerada por muchos como una locura. Sin embargo, fue el paso que cambió su vida.Ese salto al vacío, como ella lo describe, fue posible por su deseo de estar en una empresa que no tuviera que ser convencida de que lo digital era el camino. Buscaba estar a la vanguardia, experimentar, crear sin fricción. Duolingo le ofreció eso: libertad, velocidad, una cultura abierta y una misión con sentido.Gamificación, rachas y un búho intensoEl segundo punto clave que destaca Rebeca es el enfoque único de Duolingo en retención de usuarios. Aprender jugando no es un eslogan, es una estrategia basada en datos y en psicología del usuario. Rachas diarias, personajes como Duo el búho, ligas competitivas y experiencias personalizadas son algunos de los ingredientes que mantienen a millones de personas regresando a la app.La reciente campaña donde "mataron" a Duo generó revuelo en redes sociales. Según Rebeca, la idea surgió espontáneamente tras un cambio experimental en el ícono de la app. En 48 horas, el equipo de marketing construyó una narrativa que llevó a millones a hacer su lección para “revivir” al personaje. Así funciona Duolingo: estrategias ágiles, humor, cultura pop y datos en tiempo real. “Nuestro marketing es entretenimiento con propósito”, afirma Rebeca.Luis von Ahn: un CEO con alma latinaEl tercer gran punto que deja huella en la conversación es el testimonio sobre Luis von Ahn, cofundador de Duolingo. Lejos del estereotipo del CEO inalcanzable, Luis es cercano, recuerda los nombres y roles de gran parte del equipo, y mantiene una conexión auténtica con los valores de la empresa. Rebeca asegura que su liderazgo es tan esencial que, si él se fuera, probablemente ella también lo haría. “Luis es un genio, pero sobre todo, un humano con visión”, dice.El legado de Luis, creador de tecnologías como CAPTCHA y reCAPTCHA, no solo ha transformado el internet; ahora también impacta la forma en que millones acceden a la educación. Junto con su socio Severin Hacker, imaginó una herramienta que no solo enseñara, sino que retara, entretuviera y cambiara vidas.Una historia aún sin finalHoy, Rebeca sigue expandiendo la presencia de Duolingo en nuevos mercados, liderando un equipo pequeño pero poderoso, compuesto por una persona por país. Su meta: “conquistar el mundo”, como en el juego Catan, pero con educación.Esta historia, que comenzó con una niña que no quería ser académica, hoy inspira a miles de personas en el mundo corporativo a seguir su intuición, arriesgar por lo que aman y a creer que aprender puede ser tan adictivo como cualquier videojuego.Duolingo es prueba de que cuando se combinan datos, empatía y creatividad, la educación se convierte en una aventura diaria.Te invitamos a estar pendientes de nuestros canales y a suscribirte para que no te pierdes ningún episodio:* Canal Whatsapp Amigos de Cuentos Corporativos* Blog / Newsletter: www.cuentoscorporativos.substack.com* Facebook: https://www.facebook.com/Cuentoscorporativos* Instagram: https://www.instagram.com/cuentos_corporativos/* X (Twitter): https://x.com/CuentosCorp* Email: adolfo@cuentoscorporativos.com This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.cuentoscorporativos.com
President and CEO of the Better Business Bureau Steve Bernas joins Bob Sirott to talk about scams ahead of concert and the start of baseball season, as well as what to know about the 23andMe bankruptcy. He also shares details about retirement savings scams, impersonators from the Social Security Administration, and fake CAPTCHA tests.
Nejste robot? Vyberte na obrázku hydranty nebo jízdní kola. Toto ověření všichni známe z nespočtu webových stránek, které se tak snaží odfiltrovat návštěvy robotů. I když je to obtěžující, už jsme si možná zvykli párkrát kliknout a ani nad tím už moc nepřemýšlíme. Jenže právě toho se naučili zneužívat podvodníci. Jakým způsobem?
This week's full broadcast of Computer Talk Radio includes - 00:00 - Nerd news for normal people - Verizon, Skype, Publisher, chess cheater, dubbing, Mark Cuban - 11:00 - Listener Q&A - digital clutter - Alex says his digital world is overwhelming, Benjamin gives tips - 22:00 - Backup Series - laptop v desktop - Keith unpacks differences of laptop and desktop backups - 31:00 - Marty Winston's Wisdom - Marty lay difference of Daylight Saving Time and Meetings - 39:00 - Scam Series - CAPTCHA scam 2 - Benjamin shares of new variant on recent CAPTCHA scam - 44:00 - Keske on tech safety - Steve and Benjamin discuss if any systems are truly safe - 56:00 - Listener Q&A - digital literacy - Taylor says she uses tech, but is she truly digitally literate - 1:07:00 - Listener Q&A - future of us with AI - Amy asks of the role that AI will play in future computing - 1:16:00 - IT Professional Series - 318 - Benjamin starts new series rebutting return to office demands - 1:24:00 - Listener Q&A - China - Jason asks if we should be concerned about China tech spying
Cybersecurity Madness: Halting Operations, Google Gemini, and Fake Captchas In this episode, host Jim Love delves into controversial cybersecurity decisions and the latest trends. The US government's directive to halt offensive cyber operations against Russia sparks debate about national security. Google Gemini's new personalized services interface with users' search histories, raising privacy concerns. Additionally, there's a discussion on rising fake Captcha scams designed to install malware on users' systems. Jim also shares a real-world hacking incident involving a small utility company compromised by a Chinese state-sponsored hacking group. Tune in to explore these pressing issues and more in the world of cybersecurity. 00:00 Introduction: Has the US Government Lost Its Mind? 00:44 Controversial Cybersecurity Decisions 01:12 Expert Opinions on Cybersecurity 03:02 Google Gemini: Personalized AI Assistant 04:59 Cyber Threats to Utilities 06:53 The Rise of Fake Captchas 08:57 Conclusion and Upcoming Content
Today's episode is with Paul Klein, founder of Browserbase. We talked about building browser infrastructure for AI agents, the future of agent authentication, and their open source framework Stagehand.* [00:00:00] Introductions* [00:04:46] AI-specific challenges in browser infrastructure* [00:07:05] Multimodality in AI-Powered Browsing* [00:12:26] Running headless browsers at scale* [00:18:46] Geolocation when proxying* [00:21:25] CAPTCHAs and Agent Auth* [00:28:21] Building “User take over” functionality* [00:33:43] Stagehand: AI web browsing framework* [00:38:58] OpenAI's Operator and computer use agents* [00:44:44] Surprising use cases of Browserbase* [00:47:18] Future of browser automation and market competition* [00:53:11] Being a solo founderTranscriptAlessio [00:00:04]: Hey everyone, welcome to the Latent Space podcast. This is Alessio, partner and CTO at Decibel Partners, and I'm joined by my co-host Swyx, founder of Smol.ai.swyx [00:00:12]: Hey, and today we are very blessed to have our friends, Paul Klein, for the fourth, the fourth, CEO of Browserbase. Welcome.Paul [00:00:21]: Thanks guys. Yeah, I'm happy to be here. I've been lucky to know both of you for like a couple of years now, I think. So it's just like we're hanging out, you know, with three ginormous microphones in front of our face. It's totally normal hangout.swyx [00:00:34]: Yeah. We've actually mentioned you on the podcast, I think, more often than any other Solaris tenant. Just because like you're one of the, you know, best performing, I think, LLM tool companies that have started up in the last couple of years.Paul [00:00:50]: Yeah, I mean, it's been a whirlwind of a year, like Browserbase is actually pretty close to our first birthday. So we are one years old. And going from, you know, starting a company as a solo founder to... To, you know, having a team of 20 people, you know, a series A, but also being able to support hundreds of AI companies that are building AI applications that go out and automate the web. It's just been like, really cool. It's been happening a little too fast. I think like collectively as an AI industry, let's just take a week off together. I took my first vacation actually two weeks ago, and Operator came out on the first day, and then a week later, DeepSeat came out. And I'm like on vacation trying to chill. I'm like, we got to build with this stuff, right? So it's been a breakneck year. But I'm super happy to be here and like talk more about all the stuff we're seeing. And I'd love to hear kind of what you guys are excited about too, and share with it, you know?swyx [00:01:39]: Where to start? So people, you've done a bunch of podcasts. I think I strongly recommend Jack Bridger's Scaling DevTools, as well as Turner Novak's The Peel. And, you know, I'm sure there's others. So you covered your Twilio story in the past, talked about StreamClub, you got acquired to Mux, and then you left to start Browserbase. So maybe we just start with what is Browserbase? Yeah.Paul [00:02:02]: Browserbase is the web browser for your AI. We're building headless browser infrastructure, which are browsers that run in a server environment that's accessible to developers via APIs and SDKs. It's really hard to run a web browser in the cloud. You guys are probably running Chrome on your computers, and that's using a lot of resources, right? So if you want to run a web browser or thousands of web browsers, you can't just spin up a bunch of lambdas. You actually need to use a secure containerized environment. You have to scale it up and down. It's a stateful system. And that infrastructure is, like, super painful. And I know that firsthand, because at my last company, StreamClub, I was CTO, and I was building our own internal headless browser infrastructure. That's actually why we sold the company, is because Mux really wanted to buy our headless browser infrastructure that we'd built. And it's just a super hard problem. And I actually told my co-founders, I would never start another company unless it was a browser infrastructure company. And it turns out that's really necessary in the age of AI, when AI can actually go out and interact with websites, click on buttons, fill in forms. You need AI to do all of that work in an actual browser running somewhere on a server. And BrowserBase powers that.swyx [00:03:08]: While you're talking about it, it occurred to me, not that you're going to be acquired or anything, but it occurred to me that it would be really funny if you became the Nikita Beer of headless browser companies. You just have one trick, and you make browser companies that get acquired.Paul [00:03:23]: I truly do only have one trick. I'm screwed if it's not for headless browsers. I'm not a Go programmer. You know, I'm in AI grant. You know, browsers is an AI grant. But we were the only company in that AI grant batch that used zero dollars on AI spend. You know, we're purely an infrastructure company. So as much as people want to ask me about reinforcement learning, I might not be the best guy to talk about that. But if you want to ask about headless browser infrastructure at scale, I can talk your ear off. So that's really my area of expertise. And it's a pretty niche thing. Like, nobody has done what we're doing at scale before. So we're happy to be the experts.swyx [00:03:59]: You do have an AI thing, stagehand. We can talk about the sort of core of browser-based first, and then maybe stagehand. Yeah, stagehand is kind of the web browsing framework. Yeah.What is Browserbase? Headless Browser Infrastructure ExplainedAlessio [00:04:10]: Yeah. Yeah. And maybe how you got to browser-based and what problems you saw. So one of the first things I worked on as a software engineer was integration testing. Sauce Labs was kind of like the main thing at the time. And then we had Selenium, we had Playbrite, we had all these different browser things. But it's always been super hard to do. So obviously you've worked on this before. When you started browser-based, what were the challenges? What were the AI-specific challenges that you saw versus, there's kind of like all the usual running browser at scale in the cloud, which has been a problem for years. What are like the AI unique things that you saw that like traditional purchase just didn't cover? Yeah.AI-specific challenges in browser infrastructurePaul [00:04:46]: First and foremost, I think back to like the first thing I did as a developer, like as a kid when I was writing code, I wanted to write code that did stuff for me. You know, I wanted to write code to automate my life. And I do that probably by using curl or beautiful soup to fetch data from a web browser. And I think I still do that now that I'm in the cloud. And the other thing that I think is a huge challenge for me is that you can't just create a web site and parse that data. And we all know that now like, you know, taking HTML and plugging that into an LLM, you can extract insights, you can summarize. So it was very clear that now like dynamic web scraping became very possible with the rise of large language models or a lot easier. And that was like a clear reason why there's been more usage of headless browsers, which are necessary because a lot of modern websites don't expose all of their page content via a simple HTTP request. You know, they actually do require you to run this type of code for a specific time. JavaScript on the page to hydrate this. Airbnb is a great example. You go to airbnb.com. A lot of that content on the page isn't there until after they run the initial hydration. So you can't just scrape it with a curl. You need to have some JavaScript run. And a browser is that JavaScript engine that's going to actually run all those requests on the page. So web data retrieval was definitely one driver of starting BrowserBase and the rise of being able to summarize that within LLM. Also, I was familiar with if I wanted to automate a website, I could write one script and that would work for one website. It was very static and deterministic. But the web is non-deterministic. The web is always changing. And until we had LLMs, there was no way to write scripts that you could write once that would run on any website. That would change with the structure of the website. Click the login button. It could mean something different on many different websites. And LLMs allow us to generate code on the fly to actually control that. So I think that rise of writing the generic automation scripts that can work on many different websites, to me, made it clear that browsers are going to be a lot more useful because now you can automate a lot more things without writing. If you wanted to write a script to book a demo call on 100 websites, previously, you had to write 100 scripts. Now you write one script that uses LLMs to generate that script. That's why we built our web browsing framework, StageHand, which does a lot of that work for you. But those two things, web data collection and then enhanced automation of many different websites, it just felt like big drivers for more browser infrastructure that would be required to power these kinds of features.Alessio [00:07:05]: And was multimodality also a big thing?Paul [00:07:08]: Now you can use the LLMs to look, even though the text in the dome might not be as friendly. Maybe my hot take is I was always kind of like, I didn't think vision would be as big of a driver. For UI automation, I felt like, you know, HTML is structured text and large language models are good with structured text. But it's clear that these computer use models are often vision driven, and they've been really pushing things forward. So definitely being multimodal, like rendering the page is required to take a screenshot to give that to a computer use model to take actions on a website. And it's just another win for browser. But I'll be honest, that wasn't what I was thinking early on. I didn't even think that we'd get here so fast with multimodality. I think we're going to have to get back to multimodal and vision models.swyx [00:07:50]: This is one of those things where I forgot to mention in my intro that I'm an investor in Browserbase. And I remember that when you pitched to me, like a lot of the stuff that we have today, we like wasn't on the original conversation. But I did have my original thesis was something that we've talked about on the podcast before, which is take the GPT store, the custom GPT store, all the every single checkbox and plugin is effectively a startup. And this was the browser one. I think the main hesitation, I think I actually took a while to get back to you. The main hesitation was that there were others. Like you're not the first hit list browser startup. It's not even your first hit list browser startup. There's always a question of like, will you be the category winner in a place where there's a bunch of incumbents, to be honest, that are bigger than you? They're just not targeted at the AI space. They don't have the backing of Nat Friedman. And there's a bunch of like, you're here in Silicon Valley. They're not. I don't know.Paul [00:08:47]: I don't know if that's, that was it, but like, there was a, yeah, I mean, like, I think I tried all the other ones and I was like, really disappointed. Like my background is from working at great developer tools, companies, and nothing had like the Vercel like experience. Um, like our biggest competitor actually is partly owned by private equity and they just jacked up their prices quite a bit. And the dashboard hasn't changed in five years. And I actually used them at my last company and tried them and I was like, oh man, like there really just needs to be something that's like the experience of these great infrastructure companies, like Stripe, like clerk, like Vercel that I use in love, but oriented towards this kind of like more specific category, which is browser infrastructure, which is really technically complex. Like a lot of stuff can go wrong on the internet when you're running a browser. The internet is very vast. There's a lot of different configurations. Like there's still websites that only work with internet explorer out there. How do you handle that when you're running your own browser infrastructure? These are the problems that we have to think about and solve at BrowserBase. And it's, it's certainly a labor of love, but I built this for me, first and foremost, I know it's super cheesy and everyone says that for like their startups, but it really, truly was for me. If you look at like the talks I've done even before BrowserBase, and I'm just like really excited to try and build a category defining infrastructure company. And it's, it's rare to have a new category of infrastructure exists. We're here in the Chroma offices and like, you know, vector databases is a new category of infrastructure. Is it, is it, I mean, we can, we're in their office, so, you know, we can, we can debate that one later. That is one.Multimodality in AI-Powered Browsingswyx [00:10:16]: That's one of the industry debates.Paul [00:10:17]: I guess we go back to the LLMOS talk that Karpathy gave way long ago. And like the browser box was very clearly there and it seemed like the people who were building in this space also agreed that browsers are a core primitive of infrastructure for the LLMOS that's going to exist in the future. And nobody was building something there that I wanted to use. So I had to go build it myself.swyx [00:10:38]: Yeah. I mean, exactly that talk that, that honestly, that diagram, every box is a startup and there's the code box and then there's the. The browser box. I think at some point they will start clashing there. There's always the question of the, are you a point solution or are you the sort of all in one? And I think the point solutions tend to win quickly, but then the only ones have a very tight cohesive experience. Yeah. Let's talk about just the hard problems of browser base you have on your website, which is beautiful. Thank you. Was there an agency that you used for that? Yeah. Herb.paris.Paul [00:11:11]: They're amazing. Herb.paris. Yeah. It's H-E-R-V-E. I highly recommend for developers. Developer tools, founders to work with consumer agencies because they end up building beautiful things and the Parisians know how to build beautiful interfaces. So I got to give prep.swyx [00:11:24]: And chat apps, apparently are, they are very fast. Oh yeah. The Mistral chat. Yeah. Mistral. Yeah.Paul [00:11:31]: Late chat.swyx [00:11:31]: Late chat. And then your videos as well, it was professionally shot, right? The series A video. Yeah.Alessio [00:11:36]: Nico did the videos. He's amazing. Not the initial video that you shot at the new one. First one was Austin.Paul [00:11:41]: Another, another video pretty surprised. But yeah, I mean, like, I think when you think about how you talk about your company. You have to think about the way you present yourself. It's, you know, as a developer, you think you evaluate a company based on like the API reliability and the P 95, but a lot of developers say, is the website good? Is the message clear? Do I like trust this founder? I'm building my whole feature on. So I've tried to nail that as well as like the reliability of the infrastructure. You're right. It's very hard. And there's a lot of kind of foot guns that you run into when running headless browsers at scale. Right.Competing with Existing Headless Browser Solutionsswyx [00:12:10]: So let's pick one. You have eight features here. Seamless integration. Scalability. Fast or speed. Secure. Observable. Stealth. That's interesting. Extensible and developer first. What comes to your mind as like the top two, three hardest ones? Yeah.Running headless browsers at scalePaul [00:12:26]: I think just running headless browsers at scale is like the hardest one. And maybe can I nerd out for a second? Is that okay? I heard this is a technical audience, so I'll talk to the other nerds. Whoa. They were listening. Yeah. They're upset. They're ready. The AGI is angry. Okay. So. So how do you run a browser in the cloud? Let's start with that, right? So let's say you're using a popular browser automation framework like Puppeteer, Playwright, and Selenium. Maybe you've written a code, some code locally on your computer that opens up Google. It finds the search bar and then types in, you know, search for Latent Space and hits the search button. That script works great locally. You can see the little browser open up. You want to take that to production. You want to run the script in a cloud environment. So when your laptop is closed, your browser is doing something. The browser is doing something. Well, I, we use Amazon. You can see the little browser open up. You know, the first thing I'd reach for is probably like some sort of serverless infrastructure. I would probably try and deploy on a Lambda. But Chrome itself is too big to run on a Lambda. It's over 250 megabytes. So you can't easily start it on a Lambda. So you maybe have to use something like Lambda layers to squeeze it in there. Maybe use a different Chromium build that's lighter. And you get it on the Lambda. Great. It works. But it runs super slowly. It's because Lambdas are very like resource limited. They only run like with one vCPU. You can run one process at a time. Remember, Chromium is super beefy. It's barely running on my MacBook Air. I'm still downloading it from a pre-run. Yeah, from the test earlier, right? I'm joking. But it's big, you know? So like Lambda, it just won't work really well. Maybe it'll work, but you need something faster. Your users want something faster. Okay. Well, let's put it on a beefier instance. Let's get an EC2 server running. Let's throw Chromium on there. Great. Okay. I can, that works well with one user. But what if I want to run like 10 Chromium instances, one for each of my users? Okay. Well, I might need two EC2 instances. Maybe 10. All of a sudden, you have multiple EC2 instances. This sounds like a problem for Kubernetes and Docker, right? Now, all of a sudden, you're using ECS or EKS, the Kubernetes or container solutions by Amazon. You're spending up and down containers, and you're spending a whole engineer's time on kind of maintaining this stateful distributed system. Those are some of the worst systems to run because when it's a stateful distributed system, it means that you are bound by the connections to that thing. You have to keep the browser open while someone is working with it, right? That's just a painful architecture to run. And there's all this other little gotchas with Chromium, like Chromium, which is the open source version of Chrome, by the way. You have to install all these fonts. You want emojis working in your browsers because your vision model is looking for the emoji. You need to make sure you have the emoji fonts. You need to make sure you have all the right extensions configured, like, oh, do you want ad blocking? How do you configure that? How do you actually record all these browser sessions? Like it's a headless browser. You can't look at it. So you need to have some sort of observability. Maybe you're recording videos and storing those somewhere. It all kind of adds up to be this just giant monster piece of your project when all you wanted to do was run a lot of browsers in production for this little script to go to google.com and search. And when I see a complex distributed system, I see an opportunity to build a great infrastructure company. And we really abstract that away with Browserbase where our customers can use these existing frameworks, Playwright, Publisher, Selenium, or our own stagehand and connect to our browsers in a serverless-like way. And control them, and then just disconnect when they're done. And they don't have to think about the complex distributed system behind all of that. They just get a browser running anywhere, anytime. Really easy to connect to.swyx [00:15:55]: I'm sure you have questions. My standard question with anything, so essentially you're a serverless browser company, and there's been other serverless things that I'm familiar with in the past, serverless GPUs, serverless website hosting. That's where I come from with Netlify. One question is just like, you promised to spin up thousands of servers. You promised to spin up thousands of browsers in milliseconds. I feel like there's no real solution that does that yet. And I'm just kind of curious how. The only solution I know, which is to kind of keep a kind of warm pool of servers around, which is expensive, but maybe not so expensive because it's just CPUs. So I'm just like, you know. Yeah.Browsers as a Core Primitive in AI InfrastructurePaul [00:16:36]: You nailed it, right? I mean, how do you offer a serverless-like experience with something that is clearly not serverless, right? And the answer is, you need to be able to run... We run many browsers on single nodes. We use Kubernetes at browser base. So we have many pods that are being scheduled. We have to predictably schedule them up or down. Yes, thousands of browsers in milliseconds is the best case scenario. If you hit us with 10,000 requests, you may hit a slower cold start, right? So we've done a lot of work on predictive scaling and being able to kind of route stuff to different regions where we have multiple regions of browser base where we have different pools available. You can also pick the region you want to go to based on like lower latency, round trip, time latency. It's very important with these types of things. There's a lot of requests going over the wire. So for us, like having a VM like Firecracker powering everything under the hood allows us to be super nimble and spin things up or down really quickly with strong multi-tenancy. But in the end, this is like the complex infrastructural challenges that we have to kind of deal with at browser base. And we have a lot more stuff on our roadmap to allow customers to have more levers to pull to exchange, do you want really fast browser startup times or do you want really low costs? And if you're willing to be more flexible on that, we may be able to kind of like work better for your use cases.swyx [00:17:44]: Since you used Firecracker, shouldn't Fargate do that for you or did you have to go lower level than that? We had to go lower level than that.Paul [00:17:51]: I find this a lot with Fargate customers, which is alarming for Fargate. We used to be a giant Fargate customer. Actually, the first version of browser base was ECS and Fargate. And unfortunately, it's a great product. I think we were actually the largest Fargate customer in our region for a little while. No, what? Yeah, seriously. And unfortunately, it's a great product, but I think if you're an infrastructure company, you actually have to have a deeper level of control over these primitives. I think it's the same thing is true with databases. We've used other database providers and I think-swyx [00:18:21]: Yeah, serverless Postgres.Paul [00:18:23]: Shocker. When you're an infrastructure company, you're on the hook if any provider has an outage. And I can't tell my customers like, hey, we went down because so-and-so went down. That's not acceptable. So for us, we've really moved to bringing things internally. It's kind of opposite of what we preach. We tell our customers, don't build this in-house, but then we're like, we build a lot of stuff in-house. But I think it just really depends on what is in the critical path. We try and have deep ownership of that.Alessio [00:18:46]: On the distributed location side, how does that work for the web where you might get sort of different content in different locations, but the customer is expecting, you know, if you're in the US, I'm expecting the US version. But if you're spinning up my browser in France, I might get the French version. Yeah.Paul [00:19:02]: Yeah. That's a good question. Well, generally, like on the localization, there is a thing called locale in the browser. You can set like what your locale is. If you're like in the ENUS browser or not, but some things do IP, IP based routing. And in that case, you may want to have a proxy. Like let's say you're running something in the, in Europe, but you want to make sure you're showing up from the US. You may want to use one of our proxy features so you can turn on proxies to say like, make sure these connections always come from the United States, which is necessary too, because when you're browsing the web, you're coming from like a, you know, data center IP, and that can make things a lot harder to browse web. So we do have kind of like this proxy super network. Yeah. We have a proxy for you based on where you're going, so you can reliably automate the web. But if you get scheduled in Europe, that doesn't happen as much. We try and schedule you as close to, you know, your origin that you're trying to go to. But generally you have control over the regions you can put your browsers in. So you can specify West one or East one or Europe. We only have one region of Europe right now, actually. Yeah.Alessio [00:19:55]: What's harder, the browser or the proxy? I feel like to me, it feels like actually proxying reliably at scale. It's much harder than spending up browsers at scale. I'm curious. It's all hard.Paul [00:20:06]: It's layers of hard, right? Yeah. I think it's different levels of hard. I think the thing with the proxy infrastructure is that we work with many different web proxy providers and some are better than others. Some have good days, some have bad days. And our customers who've built browser infrastructure on their own, they have to go and deal with sketchy actors. Like first they figure out their own browser infrastructure and then they got to go buy a proxy. And it's like you can pay in Bitcoin and it just kind of feels a little sus, right? It's like you're buying drugs when you're trying to get a proxy online. We have like deep relationships with these counterparties. We're able to audit them and say, is this proxy being sourced ethically? Like it's not running on someone's TV somewhere. Is it free range? Yeah. Free range organic proxies, right? Right. We do a level of diligence. We're SOC 2. So we have to understand what is going on here. But then we're able to make sure that like we route around proxy providers not working. There's proxy providers who will just, the proxy will stop working all of a sudden. And then if you don't have redundant proxying on your own browsers, that's hard down for you or you may get some serious impacts there. With us, like we intelligently know, hey, this proxy is not working. Let's go to this one. And you can kind of build a network of multiple providers to really guarantee the best uptime for our customers. Yeah. So you don't own any proxies? We don't own any proxies. You're right. The team has been saying who wants to like take home a little proxy server, but not yet. We're not there yet. You know?swyx [00:21:25]: It's a very mature market. I don't think you should build that yourself. Like you should just be a super customer of them. Yeah. Scraping, I think, is the main use case for that. I guess. Well, that leads us into CAPTCHAs and also off, but let's talk about CAPTCHAs. You had a little spiel that you wanted to talk about CAPTCHA stuff.Challenges of Scaling Browser InfrastructurePaul [00:21:43]: Oh, yeah. I was just, I think a lot of people ask, if you're thinking about proxies, you're thinking about CAPTCHAs too. I think it's the same thing. You can go buy CAPTCHA solvers online, but it's the same buying experience. It's some sketchy website, you have to integrate it. It's not fun to buy these things and you can't really trust that the docs are bad. What Browserbase does is we integrate a bunch of different CAPTCHAs. We do some stuff in-house, but generally we just integrate with a bunch of known vendors and continually monitor and maintain these things and say, is this working or not? Can we route around it or not? These are CAPTCHA solvers. CAPTCHA solvers, yeah. Not CAPTCHA providers, CAPTCHA solvers. Yeah, sorry. CAPTCHA solvers. We really try and make sure all of that works for you. I think as a dev, if I'm buying infrastructure, I want it all to work all the time and it's important for us to provide that experience by making sure everything does work and monitoring it on our own. Yeah. Right now, the world of CAPTCHAs is tricky. I think AI agents in particular are very much ahead of the internet infrastructure. CAPTCHAs are designed to block all types of bots, but there are now good bots and bad bots. I think in the future, CAPTCHAs will be able to identify who a good bot is, hopefully via some sort of KYC. For us, we've been very lucky. We have very little to no known abuse of Browserbase because we really look into who we work with. And for certain types of CAPTCHA solving, we only allow them on certain types of plans because we want to make sure that we can know what people are doing, what their use cases are. And that's really allowed us to try and be an arbiter of good bots, which is our long term goal. I want to build great relationships with people like Cloudflare so we can agree, hey, here are these acceptable bots. We'll identify them for you and make sure we flag when they come to your website. This is a good bot, you know?Alessio [00:23:23]: I see. And Cloudflare said they want to do more of this. So they're going to set by default, if they think you're an AI bot, they're going to reject. I'm curious if you think this is something that is going to be at the browser level or I mean, the DNS level with Cloudflare seems more where it should belong. But I'm curious how you think about it.Paul [00:23:40]: I think the web's going to change. You know, I think that the Internet as we have it right now is going to change. And we all need to just accept that the cat is out of the bag. And instead of kind of like wishing the Internet was like it was in the 2000s, we can have free content line that wouldn't be scraped. It's just it's not going to happen. And instead, we should think about like, one, how can we change? How can we change the models of, you know, information being published online so people can adequately commercialize it? But two, how do we rebuild applications that expect that AI agents are going to log in on their behalf? Those are the things that are going to allow us to kind of like identify good and bad bots. And I think the team at Clerk has been doing a really good job with this on the authentication side. I actually think that auth is the biggest thing that will prevent agents from accessing stuff, not captchas. And I think there will be agent auth in the future. I don't know if it's going to happen from an individual company, but actually authentication providers that have a, you know, hidden login as agent feature, which will then you put in your email, you'll get a push notification, say like, hey, your browser-based agent wants to log into your Airbnb. You can approve that and then the agent can proceed. That really circumvents the need for captchas or logging in as you and sharing your password. I think agent auth is going to be one way we identify good bots going forward. And I think a lot of this captcha solving stuff is really short-term problems as the internet kind of reorients itself around how it's going to work with agents browsing the web, just like people do. Yeah.Managing Distributed Browser Locations and Proxiesswyx [00:24:59]: Stitch recently was on Hacker News for talking about agent experience, AX, which is a thing that Netlify is also trying to clone and coin and talk about. And we've talked about this on our previous episodes before in a sense that I actually think that's like maybe the only part of the tech stack that needs to be kind of reinvented for agents. Everything else can stay the same, CLIs, APIs, whatever. But auth, yeah, we need agent auth. And it's mostly like short-lived, like it should not, it should be a distinct, identity from the human, but paired. I almost think like in the same way that every social network should have your main profile and then your alt accounts or your Finsta, it's almost like, you know, every, every human token should be paired with the agent token and the agent token can go and do stuff on behalf of the human token, but not be presumed to be the human. Yeah.Paul [00:25:48]: It's like, it's, it's actually very similar to OAuth is what I'm thinking. And, you know, Thread from Stitch is an investor, Colin from Clerk, Octaventures, all investors in browser-based because like, I hope they solve this because they'll make browser-based submission more possible. So we don't have to overcome all these hurdles, but I think it will be an OAuth-like flow where an agent will ask to log in as you, you'll approve the scopes. Like it can book an apartment on Airbnb, but it can't like message anybody. And then, you know, the agent will have some sort of like role-based access control within an application. Yeah. I'm excited for that.swyx [00:26:16]: The tricky part is just, there's one, one layer of delegation here, which is like, you're authoring my user's user or something like that. I don't know if that's tricky or not. Does that make sense? Yeah.Paul [00:26:25]: You know, actually at Twilio, I worked on the login identity and access. Management teams, right? So like I built Twilio's login page.swyx [00:26:31]: You were an intern on that team and then you became the lead in two years? Yeah.Paul [00:26:34]: Yeah. I started as an intern in 2016 and then I was the tech lead of that team. How? That's not normal. I didn't have a life. He's not normal. Look at this guy. I didn't have a girlfriend. I just loved my job. I don't know. I applied to 500 internships for my first job and I got rejected from every single one of them except for Twilio and then eventually Amazon. And they took a shot on me and like, I was getting paid money to write code, which was my dream. Yeah. Yeah. I'm very lucky that like this coding thing worked out because I was going to be doing it regardless. And yeah, I was able to kind of spend a lot of time on a team that was growing at a company that was growing. So it informed a lot of this stuff here. I think these are problems that have been solved with like the SAML protocol with SSO. I think it's a really interesting stuff with like WebAuthn, like these different types of authentication, like schemes that you can use to authenticate people. The tooling is all there. It just needs to be tweaked a little bit to work for agents. And I think the fact that there are companies that are already. Providing authentication as a service really sets it up. Well, the thing that's hard is like reinventing the internet for agents. We don't want to rebuild the internet. That's an impossible task. And I think people often say like, well, we'll have this second layer of APIs built for agents. I'm like, we will for the top use cases, but instead of we can just tweak the internet as is, which is on the authentication side, I think we're going to be the dumb ones going forward. Unfortunately, I think AI is going to be able to do a lot of the tasks that we do online, which means that it will be able to go to websites, click buttons on our behalf and log in on our behalf too. So with this kind of like web agent future happening, I think with some small structural changes, like you said, it feels like it could all slot in really nicely with the existing internet.Handling CAPTCHAs and Agent Authenticationswyx [00:28:08]: There's one more thing, which is the, your live view iframe, which lets you take, take control. Yeah. Obviously very key for operator now, but like, was, is there anything interesting technically there or that the people like, well, people always want this.Paul [00:28:21]: It was really hard to build, you know, like, so, okay. Headless browsers, you don't see them, right. They're running. They're running in a cloud somewhere. You can't like look at them. And I just want to really make, it's a weird name. I wish we came up with a better name for this thing, but you can't see them. Right. But customers don't trust AI agents, right. At least the first pass. So what we do with our live view is that, you know, when you use browser base, you can actually embed a live view of the browser running in the cloud for your customer to see it working. And that's what the first reason is the build trust, like, okay, so I have this script. That's going to go automate a website. I can embed it into my web application via an iframe and my customer can watch. I think. And then we added two way communication. So now not only can you watch the browser kind of being operated by AI, if you want to pause and actually click around type within this iframe that's controlling a browser, that's also possible. And this is all thanks to some of the lower level protocol, which is called the Chrome DevTools protocol. It has a API called start screencast, and you can also send mouse clicks and button clicks to a remote browser. And this is all embeddable within iframes. You have a browser within a browser, yo. And then you simulate the screen, the click on the other side. Exactly. And this is really nice often for, like, let's say, a capture that can't be solved. You saw this with Operator, you know, Operator actually uses a different approach. They use VNC. So, you know, you're able to see, like, you're seeing the whole window here. What we're doing is something a little lower level with the Chrome DevTools protocol. It's just PNGs being streamed over the wire. But the same thing is true, right? Like, hey, I'm running a window. Pause. Can you do something in this window? Human. Okay, great. Resume. Like sometimes 2FA tokens. Like if you get that text message, you might need a person to type that in. Web agents need human-in-the-loop type workflows still. You still need a person to interact with the browser. And building a UI to proxy that is kind of hard. You may as well just show them the whole browser and say, hey, can you finish this up for me? And then let the AI proceed on afterwards. Is there a future where I stream my current desktop to browser base? I don't think so. I think we're very much cloud infrastructure. Yeah. You know, but I think a lot of the stuff we're doing, we do want to, like, build tools. Like, you know, we'll talk about the stage and, you know, web agent framework in a second. But, like, there's a case where a lot of people are going desktop first for, you know, consumer use. And I think cloud is doing a lot of this, where I expect to see, you know, MCPs really oriented around the cloud desktop app for a reason, right? Like, I think a lot of these tools are going to run on your computer because it makes... I think it's breaking out. People are putting it on a server. Oh, really? Okay. Well, sweet. We'll see. We'll see that. I was surprised, though, wasn't I? I think that the browser company, too, with Dia Browser, it runs on your machine. You know, it's going to be...swyx [00:30:50]: What is it?Paul [00:30:51]: So, Dia Browser, as far as I understand... I used to use Arc. Yeah. I haven't used Arc. But I'm a big fan of the browser company. I think they're doing a lot of cool stuff in consumer. As far as I understand, it's a browser where you have a sidebar where you can, like, chat with it and it can control the local browser on your machine. So, if you imagine, like, what a consumer web agent is, which it lives alongside your browser, I think Google Chrome has Project Marina, I think. I almost call it Project Marinara for some reason. I don't know why. It's...swyx [00:31:17]: No, I think it's someone really likes the Waterworld. Oh, I see. The classic Kevin Costner. Yeah.Paul [00:31:22]: Okay. Project Marinara is a similar thing to the Dia Browser, in my mind, as far as I understand it. You have a browser that has an AI interface that will take over your mouse and keyboard and control the browser for you. Great for consumer use cases. But if you're building applications that rely on a browser and it's more part of a greater, like, AI app experience, you probably need something that's more like infrastructure, not a consumer app.swyx [00:31:44]: Just because I have explored a little bit in this area, do people want branching? So, I have the state. Of whatever my browser's in. And then I want, like, 100 clones of this state. Do people do that? Or...Paul [00:31:56]: People don't do it currently. Yeah. But it's definitely something we're thinking about. I think the idea of forking a browser is really cool. Technically, kind of hard. We're starting to see this in code execution, where people are, like, forking some, like, code execution, like, processes or forking some tool calls or branching tool calls. Haven't seen it at the browser level yet. But it makes sense. Like, if an AI agent is, like, using a website and it's not sure what path it wants to take to crawl this website. To find the information it's looking for. It would make sense for it to explore both paths in parallel. And that'd be a very, like... A road not taken. Yeah. And hopefully find the right answer. And then say, okay, this was actually the right one. And memorize that. And go there in the future. On the roadmap. For sure. Don't make my roadmap, please. You know?Alessio [00:32:37]: How do you actually do that? Yeah. How do you fork? I feel like the browser is so stateful for so many things.swyx [00:32:42]: Serialize the state. Restore the state. I don't know.Paul [00:32:44]: So, it's one of the reasons why we haven't done it yet. It's hard. You know? Like, to truly fork, it's actually quite difficult. The naive way is to open the same page in a new tab and then, like, hope that it's at the same thing. But if you have a form halfway filled, you may have to, like, take the whole, you know, container. Pause it. All the memory. Duplicate it. Restart it from there. It could be very slow. So, we haven't found a thing. Like, the easy thing to fork is just, like, copy the page object. You know? But I think there needs to be something a little bit more robust there. Yeah.swyx [00:33:12]: So, MorphLabs has this infinite branch thing. Like, wrote a custom fork of Linux or something that let them save the system state and clone it. MorphLabs, hit me up. I'll be a customer. Yeah. That's the only. I think that's the only way to do it. Yeah. Like, unless Chrome has some special API for you. Yeah.Paul [00:33:29]: There's probably something we'll reverse engineer one day. I don't know. Yeah.Alessio [00:33:32]: Let's talk about StageHand, the AI web browsing framework. You have three core components, Observe, Extract, and Act. Pretty clean landing page. What was the idea behind making a framework? Yeah.Stagehand: AI web browsing frameworkPaul [00:33:43]: So, there's three frameworks that are very popular or already exist, right? Puppeteer, Playwright, Selenium. Those are for building hard-coded scripts to control websites. And as soon as I started to play with LLMs plus browsing, I caught myself, you know, code-genning Playwright code to control a website. I would, like, take the DOM. I'd pass it to an LLM. I'd say, can you generate the Playwright code to click the appropriate button here? And it would do that. And I was like, this really should be part of the frameworks themselves. And I became really obsessed with SDKs that take natural language as part of, like, the API input. And that's what StageHand is. StageHand exposes three APIs, and it's a super set of Playwright. So, if you go to a page, you may want to take an action, click on the button, fill in the form, etc. That's what the act command is for. You may want to extract some data. This one takes a natural language, like, extract the winner of the Super Bowl from this page. You can give it a Zod schema, so it returns a structured output. And then maybe you're building an API. You can do an agent loop, and you want to kind of see what actions are possible on this page before taking one. You can do observe. So, you can observe the actions on the page, and it will generate a list of actions. You can guide it, like, give me actions on this page related to buying an item. And you can, like, buy it now, add to cart, view shipping options, and pass that to an LLM, an agent loop, to say, what's the appropriate action given this high-level goal? So, StageHand isn't a web agent. It's a framework for building web agents. And we think that agent loops are actually pretty close to the application layer because every application probably has different goals or different ways it wants to take steps. I don't think I've seen a generic. Maybe you guys are the experts here. I haven't seen, like, a really good AI agent framework here. Everyone kind of has their own special sauce, right? I see a lot of developers building their own agent loops, and they're using tools. And I view StageHand as the browser tool. So, we expose act, extract, observe. Your agent can call these tools. And from that, you don't have to worry about it. You don't have to worry about generating playwright code performantly. You don't have to worry about running it. You can kind of just integrate these three tool calls into your agent loop and reliably automate the web.swyx [00:35:48]: A special shout-out to Anirudh, who I met at your dinner, who I think listens to the pod. Yeah. Hey, Anirudh.Paul [00:35:54]: Anirudh's a man. He's a StageHand guy.swyx [00:35:56]: I mean, the interesting thing about each of these APIs is they're kind of each startup. Like, specifically extract, you know, Firecrawler is extract. There's, like, Expand AI. There's a whole bunch of, like, extract companies. They just focus on extract. I'm curious. Like, I feel like you guys are going to collide at some point. Like, right now, it's friendly. Everyone's in a blue ocean. At some point, it's going to be valuable enough that there's some turf battle here. I don't think you have a dog in a fight. I think you can mock extract to use an external service if they're better at it than you. But it's just an observation that, like, in the same way that I see each option, each checkbox in the side of custom GBTs becoming a startup or each box in the Karpathy chart being a startup. Like, this is also becoming a thing. Yeah.Paul [00:36:41]: I mean, like, so the way StageHand works is that it's MIT-licensed, completely open source. You bring your own API key to your LLM of choice. You could choose your LLM. We don't make any money off of the extract or really. We only really make money if you choose to run it with our browser. You don't have to. You can actually use your own browser, a local browser. You know, StageHand is completely open source for that reason. And, yeah, like, I think if you're building really complex web scraping workflows, I don't know if StageHand is the tool for you. I think it's really more if you're building an AI agent that needs a few general tools or if it's doing a lot of, like, web automation-intensive work. But if you're building a scraping company, StageHand is not your thing. You probably want something that's going to, like, get HTML content, you know, convert that to Markdown, query it. That's not what StageHand does. StageHand is more about reliability. I think we focus a lot on reliability and less so on cost optimization and speed at this point.swyx [00:37:33]: I actually feel like StageHand, so the way that StageHand works, it's like, you know, page.act, click on the quick start. Yeah. It's kind of the integration test for the code that you would have to write anyway, like the Puppeteer code that you have to write anyway. And when the page structure changes, because it always does, then this is still the test. This is still the test that I would have to write. Yeah. So it's kind of like a testing framework that doesn't need implementation detail.Paul [00:37:56]: Well, yeah. I mean, Puppeteer, Playwright, and Slenderman were all designed as testing frameworks, right? Yeah. And now people are, like, hacking them together to automate the web. I would say, and, like, maybe this is, like, me being too specific. But, like, when I write tests, if the page structure changes. Without me knowing, I want that test to fail. So I don't know if, like, AI, like, regenerating that. Like, people are using StageHand for testing. But it's more for, like, usability testing, not, like, testing of, like, does the front end, like, has it changed or not. Okay. But generally where we've seen people, like, really, like, take off is, like, if they're using, you know, something. If they want to build a feature in their application that's kind of like Operator or Deep Research, they're using StageHand to kind of power that tool calling in their own agent loop. Okay. Cool.swyx [00:38:37]: So let's go into Operator, the first big agent launch of the year from OpenAI. Seems like they have a whole bunch scheduled. You were on break and your phone blew up. What's your just general view of computer use agents is what they're calling it. The overall category before we go into Open Operator, just the overall promise of Operator. I will observe that I tried it once. It was okay. And I never tried it again.OpenAI's Operator and computer use agentsPaul [00:38:58]: That tracks with my experience, too. Like, I'm a huge fan of the OpenAI team. Like, I think that I do not view Operator as the company. I'm not a company killer for browser base at all. I think it actually shows people what's possible. I think, like, computer use models make a lot of sense. And I'm actually most excited about computer use models is, like, their ability to, like, really take screenshots and reasoning and output steps. I think that using mouse click or mouse coordinates, I've seen that proved to be less reliable than I would like. And I just wonder if that's the right form factor. What we've done with our framework is anchor it to the DOM itself, anchor it to the actual item. So, like, if it's clicking on something, it's clicking on that thing, you know? Like, it's more accurate. No matter where it is. Yeah, exactly. Because it really ties in nicely. And it can handle, like, the whole viewport in one go, whereas, like, Operator can only handle what it sees. Can you hover? Is hovering a thing that you can do? I don't know if we expose it as a tool directly, but I'm sure there's, like, an API for hovering. Like, move mouse to this position. Yeah, yeah, yeah. I think you can trigger hover, like, via, like, the JavaScript on the DOM itself. But, no, I think, like, when we saw computer use, everyone's eyes lit up because they realized, like, wow, like, AI is going to actually automate work for people. And I think seeing that kind of happen from both of the labs, and I'm sure we're going to see more labs launch computer use models, I'm excited to see all the stuff that people build with it. I think that I'd love to see computer use power, like, controlling a browser on browser base. And I think, like, Open Operator, which was, like, our open source version of OpenAI's Operator, was our first take on, like, how can we integrate these models into browser base? And we handle the infrastructure and let the labs do the models. I don't have a sense that Operator will be released as an API. I don't know. Maybe it will. I'm curious to see how well that works because I think it's going to be really hard for a company like OpenAI to do things like support CAPTCHA solving or, like, have proxies. Like, I think it's hard for them structurally. Imagine this New York Times headline, OpenAI CAPTCHA solving. Like, that would be a pretty bad headline, this New York Times headline. Browser base solves CAPTCHAs. No one cares. No one cares. And, like, our investors are bored. Like, we're all okay with this, you know? We're building this company knowing that the CAPTCHA solving is short-lived until we figure out how to authenticate good bots. I think it's really hard for a company like OpenAI, who has this brand that's so, so good, to balance with, like, the icky parts of web automation, which it can be kind of complex to solve. I'm sure OpenAI knows who to call whenever they need you. Yeah, right. I'm sure they'll have a great partnership.Alessio [00:41:23]: And is Open Operator just, like, a marketing thing for you? Like, how do you think about resource allocation? So, you can spin this up very quickly. And now there's all this, like, open deep research, just open all these things that people are building. We started it, you know. You're the original Open. We're the original Open operator, you know? Is it just, hey, look, this is a demo, but, like, we'll help you build out an actual product for yourself? Like, are you interested in going more of a product route? That's kind of the OpenAI way, right? They started as a model provider and then…Paul [00:41:53]: Yeah, we're not interested in going the product route yet. I view Open Operator as a model provider. It's a reference project, you know? Let's show people how to build these things using the infrastructure and models that are out there. And that's what it is. It's, like, Open Operator is very simple. It's an agent loop. It says, like, take a high-level goal, break it down into steps, use tool calling to accomplish those steps. It takes screenshots and feeds those screenshots into an LLM with the step to generate the right action. It uses stagehand under the hood to actually execute this action. It doesn't use a computer use model. And it, like, has a nice interface using the live view that we talked about, the iframe, to embed that into an application. So I felt like people on launch day wanted to figure out how to build their own version of this. And we turned that around really quickly to show them. And I hope we do that with other things like deep research. We don't have a deep research launch yet. I think David from AOMNI actually has an amazing open deep research that he launched. It has, like, 10K GitHub stars now. So he's crushing that. But I think if people want to build these features natively into their application, they need good reference projects. And I think Open Operator is a good example of that.swyx [00:42:52]: I don't know. Actually, I'm actually pretty bullish on API-driven operator. Because that's the only way that you can sort of, like, once it's reliable enough, obviously. And now we're nowhere near. But, like, give it five years. It'll happen, you know. And then you can sort of spin this up and browsers are working in the background and you don't necessarily have to know. And it just is booking restaurants for you, whatever. I can definitely see that future happening. I had this on the landing page here. This might be a slightly out of order. But, you know, you have, like, sort of three use cases for browser base. Open Operator. Or this is the operator sort of use case. It's kind of like the workflow automation use case. And it completes with UiPath in the sort of RPA category. Would you agree with that? Yeah, I would agree with that. And then there's Agents we talked about already. And web scraping, which I imagine would be the bulk of your workload right now, right?Paul [00:43:40]: No, not at all. I'd say actually, like, the majority is browser automation. We're kind of expensive for web scraping. Like, I think that if you're building a web scraping product, if you need to do occasional web scraping or you have to do web scraping that works every single time, you want to use browser automation. Yeah. You want to use browser-based. But if you're building web scraping workflows, what you should do is have a waterfall. You should have the first request is a curl to the website. See if you can get it without even using a browser. And then the second request may be, like, a scraping-specific API. There's, like, a thousand scraping APIs out there that you can use to try and get data. Scraping B. Scraping B is a great example, right? Yeah. And then, like, if those two don't work, bring out the heavy hitter. Like, browser-based will 100% work, right? It will load the page in a real browser, hydrate it. I see.swyx [00:44:21]: Because a lot of people don't render to JS.swyx [00:44:25]: Yeah, exactly.Paul [00:44:26]: So, I mean, the three big use cases, right? Like, you know, automation, web data collection, and then, you know, if you're building anything agentic that needs, like, a browser tool, you want to use browser-based.Alessio [00:44:35]: Is there any use case that, like, you were super surprised by that people might not even think about? Oh, yeah. Or is it, yeah, anything that you can share? The long tail is crazy. Yeah.Surprising use cases of BrowserbasePaul [00:44:44]: One of the case studies on our website that I think is the most interesting is this company called Benny. So, the way that it works is if you're on food stamps in the United States, you can actually get rebates if you buy certain things. Yeah. You buy some vegetables. You submit your receipt to the government. They'll give you a little rebate back. Say, hey, thanks for buying vegetables. It's good for you. That process of submitting that receipt is very painful. And the way Benny works is you use their app to take a photo of your receipt, and then Benny will go submit that receipt for you and then deposit the money into your account. That's actually using no AI at all. It's all, like, hard-coded scripts. They maintain the scripts. They've been doing a great job. And they build this amazing consumer app. But it's an example of, like, all these, like, tedious workflows that people have to do to kind of go about their business. And they're doing it for the sake of their day-to-day lives. And I had never known about, like, food stamp rebates or the complex forms you have to do to fill them. But the world is powered by millions and millions of tedious forms, visas. You know, Emirate Lighthouse is a customer, right? You know, they do the O1 visa. Millions and millions of forms are taking away humans' time. And I hope that Browserbase can help power software that automates away the web forms that we don't need anymore. Yeah.swyx [00:45:49]: I mean, I'm very supportive of that. I mean, forms. I do think, like, government itself is a big part of it. I think the government itself should embrace AI more to do more sort of human-friendly form filling. Mm-hmm. But I'm not optimistic. I'm not holding my breath. Yeah. We'll see. Okay. I think I'm about to zoom out. I have a little brief thing on computer use, and then we can talk about founder stuff, which is, I tend to think of developer tooling markets in impossible triangles, where everyone starts in a niche, and then they start to branch out. So I already hinted at a little bit of this, right? We mentioned more. We mentioned E2B. We mentioned Firecrawl. And then there's Browserbase. So there's, like, all this stuff of, like, have serverless virtual computer that you give to an agent and let them do stuff with it. And there's various ways of connecting it to the internet. You can just connect to a search API, like SERP API, whatever other, like, EXA is another one. That's what you're searching. You can also have a JSON markdown extractor, which is Firecrawl. Or you can have a virtual browser like Browserbase, or you can have a virtual machine like Morph. And then there's also maybe, like, a virtual sort of code environment, like Code Interpreter. So, like, there's just, like, a bunch of different ways to tackle the problem of give a computer to an agent. And I'm just kind of wondering if you see, like, everyone's just, like, happily coexisting in their respective niches. And as a developer, I just go and pick, like, a shopping basket of one of each. Or do you think that you eventually, people will collide?Future of browser automation and market competitionPaul [00:47:18]: I think that currently it's not a zero-sum market. Like, I think we're talking about... I think we're talking about all of knowledge work that people do that can be automated online. All of these, like, trillions of hours that happen online where people are working. And I think that there's so much software to be built that, like, I tend not to think about how these companies will collide. I just try to solve the problem as best as I can and make this specific piece of infrastructure, which I think is an important primitive, the best I possibly can. And yeah. I think there's players that are actually going to like it. I think there's players that are going to launch, like, over-the-top, you know, platforms, like agent platforms that have all these tools built in, right? Like, who's building the rippling for agent tools that has the search tool, the browser tool, the operating system tool, right? There are some. There are some. There are some, right? And I think in the end, what I have seen as my time as a developer, and I look at all the favorite tools that I have, is that, like, for tools and primitives with sufficient levels of complexity, you need to have a solution that's really bespoke to that primitive, you know? And I am sufficiently convinced that the browser is complex enough to deserve a primitive. Obviously, I have to. I'm the founder of BrowserBase, right? I'm talking my book. But, like, I think maybe I can give you one spicy take against, like, maybe just whole OS running. I think that when I look at computer use when it first came out, I saw that the majority of use cases for computer use were controlling a browser. And do we really need to run an entire operating system just to control a browser? I don't think so. I don't think that's necessary. You know, BrowserBase can run browsers for way cheaper than you can if you're running a full-fledged OS with a GUI, you know, operating system. And I think that's just an advantage of the browser. It is, like, browsers are little OSs, and you can run them very efficiently if you orchestrate it well. And I think that allows us to offer 90% of the, you know, functionality in the platform needed at 10% of the cost of running a full OS. Yeah.Open Operator: Browserbase's Open-Source Alternativeswyx [00:49:16]: I definitely see the logic in that. There's a Mark Andreessen quote. I don't know if you know this one. Where he basically observed that the browser is turning the operating system into a poorly debugged set of device drivers, because most of the apps are moved from the OS to the browser. So you can just run browsers.Paul [00:49:31]: There's a place for OSs, too. Like, I think that there are some applications that only run on Windows operating systems. And Eric from pig.dev in this upcoming YC batch, or last YC batch, like, he's building all run tons of Windows operating systems for you to control with your agent. And like, there's some legacy EHR systems that only run on Internet-controlled systems. Yeah.Paul [00:49:54]: I think that's it. I think, like, there are use cases for specific operating systems for specific legacy software. And like, I'm excited to see what he does with that. I just wanted to give a shout out to the pig.dev website.swyx [00:50:06]: The pigs jump when you click on them. Yeah. That's great.Paul [00:50:08]: Eric, he's the former co-founder of banana.dev, too.swyx [00:50:11]: Oh, that Eric. Yeah. That Eric. Okay. Well, he abandoned bananas for pigs. I hope he doesn't start going around with pigs now.Alessio [00:50:18]: Like he was going around with bananas. A little toy pig. Yeah. Yeah. I love that. What else are we missing? I think we covered a lot of, like, the browser-based product history, but. What do you wish people asked you? Yeah.Paul [00:50:29]: I wish people asked me more about, like, what will the future of software look like? Because I think that's really where I've spent a lot of time about why do browser-based. Like, for me, starting a company is like a means of last resort. Like, you shouldn't start a company unless you absolutely have to. And I remain convinced that the future of software is software that you're going to click a button and it's going to do stuff on your behalf. Right now, software. You click a button and it maybe, like, calls it back an API and, like, computes some numbers. It, like, modifies some text, whatever. But the future of software is software using software. So, I may log into my accounting website for my business, click a button, and it's going to go load up my Gmail, search my emails, find the thing, upload the receipt, and then comment it for me. Right? And it may use it using APIs, maybe a browser. I don't know. I think it's a little bit of both. But that's completely different from how we've built software so far. And that's. I think that future of software has different infrastructure requirements. It's going to require different UIs. It's going to require different pieces of infrastructure. I think the browser infrastructure is one piece that fits into that, along with all the other categories you mentioned. So, I think that it's going to require developers to think differently about how they've built software for, you know
Let's start preparing for the Oscars with our latest episode! I cover five (5) Oscar nominated films and share my thoughts on them. Then we shift into anything and everything, from animated films for my kids to nasty horror for me; from revisiting sci-fi favorites and not so favorites to catching up with a bunch of short films. Check it out!00:00:00 - 00:02:07 -- Intro00:02:07 - 00:09:51 -- Oscar nominated Films00:09:51 - 00:11:37 -- Animated Films00:11:37 - 00:14:29 -- Short Films00:14:29 - 00:16:07 -- Puerto Rican Films00:16:07 - 00:20:11 -- Horror Films00:20:11 - 00:24:37 -- SciFi Films00:24:37 - 00:26:56 -- Closing/OutroStar Wars fanfare (c) DisneyAlso sprach Zarathustra (c) StraussThe Movie Loot Theme: Tino Mendes & Yellow Paper - The Heist
Today we are talking about The IXP Fellowship Initiative, Workplace Developer Training, and making Drupal better for the little guy with guests Carlos Ospina & Mike Anello. We'll also cover Cloudflare Turnstile as our module of the week. For show notes visit: https://www.talkingDrupal.com/489 Topics What is the IXP initiative Why does the community think this is important What is the current status What changed in the last 10 years How do we encourage businesses to do this How can people get involved Resources Turnstile Intro blog post from Cloudflare Irvine reCAPTCHA Study Deep dive on Google Scholar Alternatives https://www.drupal.org/project/hcaptcha - privacy-focused alternative, still image-based https://www.drupal.org/project/altcha - open, self-hosted option. Seems more basic. Posts referencing Irvine study https://boingboing.net/2025/02/07/recaptcha-819-million-hours-of-wasted-human-time-and-billions-of-dollars-google-profit.html https://www.theregister.com/2024/07/24/googles_recaptchav2_labor/ https://www.pcgamer.com/gaming-industry/a-2023-study-concluded-captchas-are-a-tracking-cookie-farm-for-profit-masquerading-as-a-security-service-that-made-us-spend-819-billion-hours-clicking-on-traffic-lights-to-generate-nearly-usd1-trillion-for-google/ Widgets IXP Fellowship Drupal Couple Talking Drupal 488 - Drupal Open University Get Involved in IXP #ixp-fellowship on the Drupal Slack Workspace Guests Carlos Ospina - adrupalcouple.us camoa Mike Anello - drupaleasy.com ultimike Hosts Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Avi Schwab - froboy.org froboy MOTW Correspondent Martin Anderson-Clutz - mandclu.com mandclu Brief description: Have you ever wanted to use Cloudflare's Turnstile web service to secure Drupal web forms, as an alternative to more intrusive CAPTCHA widgets that force users to select squares that contain traffic lights, cars, or bicycles? There's a module for that. Module name/project name: Cloudflare Turnstile Brief history How old: created in Sep 2022 by Adam Weiss (greatmatter) Versions available: 1.1.13 which works with Drupal 9.4, 10, and 11 Maintainership Actively maintained Security coverage Number of open issues: 6 open issues, 3 of which are bugs, with 2 of them postponed Usage stats: 3,981 sites Module features and usage Anyone who maintains a Drupal site is well acquainted with the need to mitigate form spam submissions. Best practices around which tool to use are an ever-changing conversation. Recently Google announced that reCAPTCHA implementations will need to be associated with a Google Cloud account, and will need to enable payment for anything that exceeds the free allowance of 10,000 assessments per month reCAPTCHA v2 widgets are notorious for the challenges they can present to actual users, particularly image challenges. In addition, a 2023 UC Irvine study concluded that “the true purpose of reCAPTCHAv2 is as a tracking cookie farm for profit masquerading as a security service”, so it's definitely worth considering other solutions Cloudflare developed turnstile as a CAPTCHA alternative, designed to provide security while minimizing the friction for actual users. More importantly, Turnstile never harvests data for ad retargeting. A free Turnstile account can create up to 10 widgets, with unlimited usage. The turnstile module plugs into the existing Drupal CAPTCHA ecosystem, so it can be an easy swap out for anywhere you're currently using CAPTCHA widgets.
Nati Tal, Head of Guardio Labs, discusses their work on "“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising." Guardio has uncovered a large-scale malvertising campaign dubbed “DeceptionAds,” which tricks users into running a malicious PowerShell command under the guise of proving they're human. This fake CAPTCHA scheme delivers Lumma info-stealer malware while bypassing security measures like Google's Safe Browsing. Even after disclosure and takedown efforts, the campaign resurfaced—raising concerns about the effectiveness of existing defenses against ad-driven cyber threats. The research can be found here: “DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising Learn more about your ad choices. Visit megaphone.fm/adchoices
"I'm Not A Robot" had its world premiere at the Netherlands Film Festival in the Golden Calf Competition. Starring Ellen Parren, Henry van Loon, Thekla Reuten, Juliette van Ardenne, and Asma El Mouden, the short film follows Lara, who plunges into a strange new reality after a series of failed CAPTCHA tests. Director/Writer Victoria Warmerdam and Producer Trent were both kind enough to spend some time speaking with us about their work on the film, which you can listen to below. Please be sure to check out the film, which is now available to stream on YouTube through The New Yorker and is up for your consideration for this year's Academy Awards for Best Live Action Short Film. Thank you, and enjoy! Check out more on NextBestPicture.com Please subscribe on... Apple Podcasts - https://itunes.apple.com/us/podcast/negs-best-film-podcast/id1087678387?mt=2 Spotify - https://open.spotify.com/show/7IMIzpYehTqeUa1d9EC4jT YouTube - https://www.youtube.com/channel/UCWA7KiotcWmHiYYy6wJqwOw And be sure to help support us on Patreon for as little as $1 a month at https://www.patreon.com/NextBestPicture and listen to this podcast ad-free Learn more about your ad choices. Visit megaphone.fm/adchoices
Nati Tal, Head of Guardio Labs, discussing their work on "“DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising." Guardio has uncovered a large-scale malvertising campaign dubbed “DeceptionAds,” which tricks users into running a malicious PowerShell command under the guise of proving they're human. This fake CAPTCHA scheme delivers Lumma info-stealer malware while bypassing security measures like Google's Safe Browsing. Even after disclosure and takedown efforts, the campaign resurfaced—raising concerns about the effectiveness of existing defenses against ad-driven cyber threats. The research can be found here: “DeceptionAds” — Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising Learn more about your ad choices. Visit megaphone.fm/adchoices
This week's full broadcast of Computer Talk Radio includes - 00:00 - Nerd news for normal people - Deepseek, AI, Disney, space, Starliner, AppleCare, speeding - 11:00 - Solar Panel Payoff in how long - Benjamin works solar panel numbers and it's not pretty - 22:00 - SIMs and Maxis games - Keith and Benjamin talk about The Sims, SimCity, and more - 31:00 - Marty Winston's Wisdom - Marty extols Asus Zenbook Duo UX8406 dual screen notebook - 39:00 - Scam Series - CAPTCHA scam - Benjamin says extra hoops in this CAPTCHA scam are a sign - 44:00 - Keske on technology backdoors - Steve and Benjamin discuss technology backdoors over years - 56:00 - Listener Q&A - disappointing tech - Brian asks of most disappointing tech over last 40 years - 1:07:00 - Listener Q&A - digital nomad - Amy asks Benjamin if digital nomad lifestyle still workable - 1:16:00 - IT Professional Series - 314 - Benjamin concludes IT burnout with advise of how to handle - 1:24:00 - Listener Q&A - flash drive lifespan - James asks if flash drive is dependable for long term storage
Episode 109: In this episode of Critical Thinking - Bug Bounty Podcast we start off with a quick recap of some of the DeepSeek Drama that's been going down, and discuss AI in CAPTCHA and 2FA as well. Then we switch to cover some other news before settling in to talk about Alternative Recon TechniquesFollow us on twitter at: https://x.com/ctbbpodcastGot any ideas and suggestions? Feel free to send us any feedback here: info@criticalthinkingpodcast.ioShoutout to https://x.com/realytcracker for the awesome intro music!====== Links ======Follow your hosts Rhynorater and Rez0 on Twitter:https://x.com/Rhynoraterhttps://x.com/rez0__====== Ways to Support CTBBPodcast ======Hop on the CTBB Discord at https://ctbb.show/discord!We also do Discord subs at $25, $10, and $5 - premium subscribers get access to private masterclasses, exploits, tools, scripts, un-redacted bug reports, etc.You can also find some hacker swag at https://ctbb.show/merch!Today's Sponsor - ThreatLocker. Check out their Managed Detection and Response!====== Resources ======ResourcesWiz Research Uncovers Exposed DeepSeek DatabaseBypass Bot DetectionTweet from sw33tLiersc 2faStealing HttpOnly cookies with the cookie sandwich techniqueReport Pointers for Collaborative ChainsClone2Leak: Your Git Credentials Belong To UsDeanonymization via cacheGoogleChrome related-website-sets====== Timestamps ======(00:00:00) Introduction(00:02:03) DeepSeek debacle and Bypass Bot Detection(00:23:48) Stealing HttpOnly cookies with the cookie sandwich technique(00:30:54) Report Pointers for Collaborative Chains(00:34:43) Clone2Leak: Your Git Credentials Belong To Us(00:40:04) Deanonymization for Signal and Discord(00:41:53) Alternative Recon Techniques
This week on Blurry Hysteria, we're hitting you with a double dose of bizarre! First up, someone decided CAPTCHA wasn't annoying enough and created one where you play Doom on Nightmare difficulty. Can you rip and tear your way to proving you're not a robot? Spoiler: most of us are doomed. Then, we head to Houston, where the police evidence lockers have been infiltrated—not by master thieves, but by junkie rats with a taste for confiscated drugs. Who's the kingpin of the rodent cartel, and do they have a tiny, whiskered Walter White? All that and more this week on Blurry Hysteria! News Stories Mentioned: Doom: https://arstechnica.com/gaming/2025/01/someone-made-a-captcha-where-you-play-doom-on-nightmare-difficulty/ Rat Party: https://www.upi.com/Odd_News/2025/01/21/Houston-Police-evidence-lockers-drugs-rats/6941737480214/ Email us your favorite WEIRD news stories: weird@hysteria51.com Support the Show Get exclusive content & perks as well as an ad and sponsor free experience at https://www.patreon.com/Hysteria51 from just $1 Shop Be the Best Dressed at your Cult Meeting! https://www.teepublic.com/stores/hysteria51?ref_id=9022 Learn more about your ad choices. Visit podcastchoices.com/adchoices
This week on Blurry Hysteria, we're hitting you with a double dose of bizarre! First up, someone decided CAPTCHA wasn't annoying enough and created one where you play Doom on Nightmare difficulty. Can you rip and tear your way to proving you're not a robot? Spoiler: most of us are doomed.Then, we head to Houston, where the police evidence lockers have been infiltrated—not by master thieves, but by junkie rats with a taste for confiscated drugs. Who's the kingpin of the rodent cartel, and do they have a tiny, whiskered Walter White? All that and more this week on Blurry Hysteria!News Stories Mentioned: Doom: https://arstechnica.com/gaming/2025/01/someone-made-a-captcha-where-you-play-doom-on-nightmare-difficulty/Rat Party: https://www.upi.com/Odd_News/2025/01/21/Houston-Police-evidence-lockers-drugs-rats/6941737480214/Email us your favorite WEIRD news stories:weird@hysteria51.comSupport the ShowGet exclusive content & perks as well as an ad and sponsor free experience at https://www.patreon.com/Hysteria51 from just $1ShopBe the Best Dressed at your Cult Meeting!https://www.teepublic.com/stores/hysteria51?ref_id=9022 Learn more about your ad choices. Visit podcastchoices.com/adchoicesSee Privacy Policy at https://art19.com/privacy and California Privacy Notice at https://art19.com/privacy#do-not-sell-my-info.
Also: is there such a thing as too much science?Plus, our special guest, Luis von Ahn, an inventor of CAPTCHA and a pioneer of free online language learning. This episode originally aired on June 14, 2020.
Q&A on the film I'm Not a Robot with writer & director Victoria Warmerdam and producer Trent. Moderated by Mara Webster, In Creative Company. After repeatedly failing Captcha tests, music producer Lara becomes obsessed with a disturbing question: could she be a robot?
Is it possible to succeed in filmmaking outside of Los Angeles? Let's talk about it with our special guest, Andy Compton! Join us for a conversation with Andy Compton, an Asian American writer and director from St. Louis, Missouri. Once a hard-partying high school dropout, Andy found sobriety in his late 20s, graduated Cum Laude from Webster University, and sharpened his storytelling skills at The Improv Shop. Andy's characters often mirror his journey, exploring themes like class struggle and addiction with a unique blend of humor and drama. His comedy feature BELLYACHE is currently optioned, and his 2023 short film CAPTCHA has earned multiple awards, including Best Narrative Film at the St. Louis Filmmakers Showcase. Andy hosts The Social Screenwriters Podcast, which you can check out on YouTube, Spotify, and other platforms. #BraveMaker #BraveMakerPodcast #Filmmakers Watch the weekly LIVE stream on BraveMaker YouTube. Follow BraveMaker on social media: Instagram TikTok Facebook --- Support this podcast: https://podcasters.spotify.com/pod/show/bravemaker/support
O ministro Alexandre de Moraes, do STF, confessou, durante julgamento sobre trechos doMarco Civil da Internet, que tem dificuldade com Captcha de semáforos.Ao reagir à declaração do magistrado, Flávio Vidal, professor Departamento do departamento de Ciência da Computação da Universidade de Brasília, escreveu no X:“Ele realmente fez essa comparação maluca entre o captcha e a IA? Esse robô não tem nada relacionado a IA, é somente para evitar screeners... Misericórdia. Estamos lascados. Sério mesmo, agora eu me assustei com tamanho desconhecimento de tecnologia.”Felipe Moura Brasil, Duda Teixeira e Ricardo Kertzman comentam:Você também pode assistir ao Papo Antagonista com a apresentação de Felipe Moura Brasil na TV BM&C, nos canais 579 da Vivo, ou 547 da Claro, além do SKY+. Apoie o jornalismo Vigilante: 10% de desconto para audiência do Papo Antagonista. https://bit.ly/papoantagonista Siga O Antagonista no X, nos ajude a chegar nos 2 milhões de seguidores! https://x.com/o_antagonista Acompanhe O Antagonista no canal do WhatsApp. Boletins diários, conteúdos exclusivos em vídeo e muito mais. https://whatsapp.com/channel/0029Va2S... Ouça O Antagonista | Crusoé quando quiser nos principais aplicativos de podcast. Leia mais em www.oantagonista.com.br | www.crusoe.com.br
Google's record-breaking fine by Russia. (How many 0's is that?) RT's editor-in-chief admits that their TV hosts are AI-generated. Windows 10 security updates set to end next October... or are they? When a good Chrome extension goes bad. Windows .RDP launch config files. What could possibly go wrong? Firefox 132 just received some new features. Chinese security cameras being removed from the UK. I know YOU wouldn't fall for this social engineering attack. What's GRC's next semi-commercial product going to be? And what's the prospect for AI being used to analyze code to eliminate security vulnerabilities? Show Notes - https://www.grc.com/sn/SN-999-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: joindeleteme.com/twit promo code TWIT 1password.com/securitynow bigid.com/securitynow Melissa.com/twit
Google's record-breaking fine by Russia. (How many 0's is that?) RT's editor-in-chief admits that their TV hosts are AI-generated. Windows 10 security updates set to end next October... or are they? When a good Chrome extension goes bad. Windows .RDP launch config files. What could possibly go wrong? Firefox 132 just received some new features. Chinese security cameras being removed from the UK. I know YOU wouldn't fall for this social engineering attack. What's GRC's next semi-commercial product going to be? And what's the prospect for AI being used to analyze code to eliminate security vulnerabilities? Show Notes - https://www.grc.com/sn/SN-999-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: joindeleteme.com/twit promo code TWIT 1password.com/securitynow bigid.com/securitynow Melissa.com/twit
Google's record-breaking fine by Russia. (How many 0's is that?) RT's editor-in-chief admits that their TV hosts are AI-generated. Windows 10 security updates set to end next October... or are they? When a good Chrome extension goes bad. Windows .RDP launch config files. What could possibly go wrong? Firefox 132 just received some new features. Chinese security cameras being removed from the UK. I know YOU wouldn't fall for this social engineering attack. What's GRC's next semi-commercial product going to be? And what's the prospect for AI being used to analyze code to eliminate security vulnerabilities? Show Notes - https://www.grc.com/sn/SN-999-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: joindeleteme.com/twit promo code TWIT 1password.com/securitynow bigid.com/securitynow Melissa.com/twit
Google's record-breaking fine by Russia. (How many 0's is that?) RT's editor-in-chief admits that their TV hosts are AI-generated. Windows 10 security updates set to end next October... or are they? When a good Chrome extension goes bad. Windows .RDP launch config files. What could possibly go wrong? Firefox 132 just received some new features. Chinese security cameras being removed from the UK. I know YOU wouldn't fall for this social engineering attack. What's GRC's next semi-commercial product going to be? And what's the prospect for AI being used to analyze code to eliminate security vulnerabilities? Show Notes - https://www.grc.com/sn/SN-999-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: joindeleteme.com/twit promo code TWIT 1password.com/securitynow bigid.com/securitynow Melissa.com/twit
Google's record-breaking fine by Russia. (How many 0's is that?) RT's editor-in-chief admits that their TV hosts are AI-generated. Windows 10 security updates set to end next October... or are they? When a good Chrome extension goes bad. Windows .RDP launch config files. What could possibly go wrong? Firefox 132 just received some new features. Chinese security cameras being removed from the UK. I know YOU wouldn't fall for this social engineering attack. What's GRC's next semi-commercial product going to be? And what's the prospect for AI being used to analyze code to eliminate security vulnerabilities? Show Notes - https://www.grc.com/sn/SN-999-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: joindeleteme.com/twit promo code TWIT 1password.com/securitynow bigid.com/securitynow Melissa.com/twit
Google's record-breaking fine by Russia. (How many 0's is that?) RT's editor-in-chief admits that their TV hosts are AI-generated. Windows 10 security updates set to end next October... or are they? When a good Chrome extension goes bad. Windows .RDP launch config files. What could possibly go wrong? Firefox 132 just received some new features. Chinese security cameras being removed from the UK. I know YOU wouldn't fall for this social engineering attack. What's GRC's next semi-commercial product going to be? And what's the prospect for AI being used to analyze code to eliminate security vulnerabilities? Show Notes - https://www.grc.com/sn/SN-999-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: joindeleteme.com/twit promo code TWIT 1password.com/securitynow bigid.com/securitynow Melissa.com/twit
Google's record-breaking fine by Russia. (How many 0's is that?) RT's editor-in-chief admits that their TV hosts are AI-generated. Windows 10 security updates set to end next October... or are they? When a good Chrome extension goes bad. Windows .RDP launch config files. What could possibly go wrong? Firefox 132 just received some new features. Chinese security cameras being removed from the UK. I know YOU wouldn't fall for this social engineering attack. What's GRC's next semi-commercial product going to be? And what's the prospect for AI being used to analyze code to eliminate security vulnerabilities? Show Notes - https://www.grc.com/sn/SN-999-Notes.pdf Hosts: Steve Gibson and Leo Laporte Download or subscribe to this show at https://twit.tv/shows/security-now. Get episodes ad-free with Club TWiT at https://twit.tv/clubtwit You can submit a question to Security Now at the GRC Feedback Page. For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: grc.com, also the home of the best disk maintenance and recovery utility ever written Spinrite 6. Sponsors: joindeleteme.com/twit promo code TWIT 1password.com/securitynow bigid.com/securitynow Melissa.com/twit
Nachdem wir in der letzten Episode über von den schönen Aspekten der Stadt New York geschwärmt haben, zählen wir diesmal auf, was uns hier nervt. Manuel ist überfordert von der allgegenwärtigen Lautstärke der Stadt, während Cari Probleme mit den Duschköpfen hat. Außerdem sprechen wir über neuartige Captchas im Internet. Und: Manuel hat vom Musical "The Book of Mormon" eine Lektion fürs Leben mitgenommen… Die nächste Episode erscheint reisebedingt am 2. Oktober 2024. Transkript und Vokabelhilfe Werde ein Easy German Mitglied und du bekommst unsere Vokabelhilfe, ein interaktives Transkript und Bonusmaterial zu jeder Episode: easygerman.org/membership Das nervt (New York City Edition): Lautstärke & Duschköpfe Geräuschkulisse in New York Ausdruck der Woche: so einen Hals haben so einen Hals haben (Redensarten-Index) Woher kommt – "Jammern auf hohem Niveau"? (antenne unna) Das nervt: Captchas werden immer absurder Captcha (Wikipedia) Das ist schön: Musicals & Umgang mit Beleidigungen The Book of Mormon (Musical) (Wikipedia) Wichtige Vokabeln in dieser Episode schwärmen: begeistert und positiv über etwas reden bemängeln: Kritik an etwas äußern; Fehler oder Mängel aufzeigen der Duschkopf: Teil der Dusche, aus dem das Wasser kommt das Captcha: Sicherheitsmechanismus zur Überprüfung, ob ein Mensch oder ein automatisiertes Programm auf eine Website zugreift die Abendkasse: Verkaufsstelle für Tickets, die kurz vor Veranstaltungsbeginn geöffnet ist Support Easy German and get interactive transcripts, live vocabulary and bonus content: easygerman.org/membership
[3+ HOUR LONG SHOW! JOIN THE PIZZA FUND! $12 level. https://podawful.com/posts/2490] AARON IMHOLTE IS HERE! A year ago I caught Steel Toe Morning Show ripping off one of my Goons from me. None other than Mr. Burgers. I couldn't believe my eyes. But now something sinister has started happening, something IMPOSSIBLE, and it's leaving a bad taste in my mouth. I believe Mr. Burgers has been replaced with some Artificial Ingredients. Some true A.I. Spergers has gone manic again and this time he's done what no other Goon could do-- he's locked himself OUT of the bathroom, and now the sh*t has literally hit the fan (and the sink, and the patio, and the bed.) Now I am teaming up with the AUTHORITY on A.I. - Aaron Imholte, and we shall test the Impossible Mr. Burgers to find out where's the beef. Can Sperglord pass a Voight-Kampff test? Can he check the Captcha on the bathroom door to finally use the toilet again? Or has he become the very Darf Darf he hates? And WHO is behind his mechanical mania? VIDEO: https://youtube.com/live/qWht1gHBOTE PODAWFUL is an anti-podcast hosted by Jesse P-S
From CAPTCHAs to shadow banning, Scott and Wes break down the best strategies for keeping your app safe from spam and fraud. They cover tools like email verification, rate limiting, shadow banning, and more to protect your users and data. Show Notes 00:00 Welcome to Syntax! 00:15 The problem. 02:47 Brought to you by Sentry.io. 04:23 CAPTCHA. 06:24 Data collection. 07:11 Stripe Radar score calculation. 09:12 Rate limiting. 11:34 Shadow banning. 13:53 Email verification. 15:38 Tie to accounts. 16:23 Tied to real identity. 19:36 Manual approval. 21:19 Blocking ASN. 23:17 Honey pot field. 24:28 SMS verification. 25:05 Mechanical Turk. Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads
Pear-A Deez Nutz, gotta Captcha 'em all, and Dan the pander panda.
Video Episode: https://youtu.be/gSEirErEqCs In today’s episode, we explore critical topics in cybersecurity, including expert tips for spotting phishing links leveraging tools like ANY.RUN’s Safebrowsing, the release of a proof-of-concept exploit for the critical SolarWinds Web Help Desk CVE-2024-28987 vulnerability, and Mozilla’s privacy complaint over its new tracking feature in Firefox. We also discuss CrowdStrike’s recent testimony regarding a major IT outage caused by a faulty update, highlighting the importance of robust testing protocols for cybersecurity platforms. Tune in to stay informed about the latest trends and vulnerabilities in the cyber threat landscape. Links to articles discussed: 1. Expert Tips on How to Spot a Phishing Link – https://thehackernews.com/2024/09/expert-tips-on-how-to-spot-phishing-link.html 2. PoC for critical SolarWinds Web Help Desk vulnerability released (CVE-2024-28987) – https://www.helpnetsecurity.com/2024/09/25/cve-2024-28987-poc/ 3. Mozilla Faces Privacy Complaint for Enabling Tracking in Firefox Without User Consent – https://thehackernews.com/2024/09/mozilla-faces-privacy-complaint-for.html 4. CrowdStrike's mea culpa: 5 takeaways from the Capitol Hill testimony – https://www.cybersecuritydive.com/news/crowdstrike-mea-culpa-testimony-takeaways/727986/ Timestamps 00:00 – Introduction 01:14 – Crowdstrike VP Testifies 03:28 – SolarWinds Exploit Public Release 04:56 – Mozilla Privacy Issues Sign up for the best newsletter in cybersecurity at https://news.thedailydecrypt.com 1. What are today’s top cybersecurity news stories? 2. How can you identify phishing links effectively? 3. What should I know about the SolarWinds Web Help Desk vulnerability? 4. Why is Mozilla facing a privacy complaint regarding Firefox? 5. What changes has CrowdStrike implemented after the IT network outage? 6. What are the best practices for recognizing suspicious URLs? 7. How does Mozilla’s Privacy Preserving Attribution threaten user privacy? 8. What lessons can be learned from CrowdStrike’s recent testimony? 9. What are the warning signs of a phishing email? 10. How can organizations protect themselves from emerging cybersecurity threats? phishing, URLs, CAPTCHA, Cloudflare, SolarWinds, vulnerability, cyberattacks, help desk, Mozilla, Privacy Preserving Attribution, tracking cookies, data protection, CrowdStrike, software update, policy changes, IT nightmare,
**Threat Hunting Workshop: Hunting for Collection October 2, 2024 | 12:00 - 1:00 PM ET Sign Up > https://intel471.com/resources/webinars/threat-hunting-workshop-hunting-for-collection **[LIVE] Out of the Woods: The Threat Hunting Podcast October 24, 2024 | 7:00 – 8:30 PM ET Sign Up > https://intel471.com/resources/podcasts/blood-sweat-and-threats-carving-the-perfect-threat-hunter ---------- In this episode of Out of the Woods: The Threat Hunting Podcast, Scott Poley and Tom Kastura explore the latest threat-hunting insights, starting with UNC 2970, a North Korean-linked group using trojanized PDF readers to target industries like energy and finance. They discuss how the group's phishing tactics exploit job openings and the use of telemetry to detect malicious activity. The episode also covers a campaign leveraging CAPTCHA pages to deliver the Luma Stealer malware and dives into the risk of poisoned Python packages compromising supply chains. Tune in for strategies to stay proactive against advanced threats and enhance your hunting techniques. Top Headlines: Unit 42 | Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and MacOS Backdoors: https://unit42.paloaltonetworks.com/gleaming-pisces-applejeus-poolrat-and-pondrat/?web_view=true CloudSEK | Unmasking the Danger: Lumma Stealer Malware Exploits Fake CAPTCHA Pages: https://www.cloudsek.com/blog/unmasking-the-danger-lumma-stealer-malware-exploits-fake-captcha-pages?&web_view=true Google Cloud | An Offer You Can Refuse: UNC2970 Backdoor Deployment Using Trojanized PDF Reader: https://cloud.google.com/blog/topics/threat-intelligence/unc2970-backdoor-trojanized-pdf-reader DarkReading | For $20, Researchers Seize Part of Net Infrastructure: https://www.darkreading.com/cyber-risk/researchers-seize-internet-infrastructure-for-20?&web_view=true ---------- Stay in Touch! Twitter: https://twitter.com/Intel471Inc LinkedIn: https://www.linkedin.com/company/intel-471/ YouTube: https://www.youtube.com/channel/UCIL4ElcM6oLd3n36hM4_wkg Discord: https://discord.gg/DR4mcW4zBr Facebook: https://www.facebook.com/Intel471Inc/
In this episode of The Cybersecurity Defenders Podcast, we discuss some cutting-edge intel coming out of LimaCharlie's community Slack channel.The Specula C2 framework represents a sophisticated attack method that transforms Microsoft Outlook into a command-and-control system by exploiting its Home Page feature. Attackers exploit browser notifications in Chromium-based browsers by tricking users through CAPTCHA-like prompts to enable notifications.The Biden administration has launched an initiative aimed at addressing the growing cybersecurity talent shortage, which has reached critical levels. Mustang Panda, a Chinese state-backed cyber-espionage group, has adapted its tactics by launching a USB-based attack campaign that leverages a worm for self-propagation across air-gapped networks.
In this episode of The Founder Hour, we have an insightful conversation with Max Levchin, a true trailblazer in the tech world. Max's journey began in Ukraine, where he grew up in a family of scientists who instilled in him a deep respect for knowledge and discovery. After his family relocated to Crimea to escape the fallout from the Chernobyl disaster, Max discovered his passion for programming at a young age. With no computer at his disposal, he began teaching himself to code by writing programs on paper.In 1991, Max's family moved to the U.S., settling in Chicago. It was here that he found his footing at the University of Illinois Urbana-Champaign, a pivotal moment that set the stage for his future success. Immersed in the early internet scene, Max's path eventually led him to Silicon Valley, where a chance meeting with Peter Thiel at Stanford's lecture halls sparked the creation of what would become PayPal. Initially conceived as a secure way to store and transfer encrypted data, PayPal evolved into a groundbreaking online payment system that transformed the way we conduct financial transactions.Max takes us through the early days of PayPal, sharing stories of tackling complex challenges like document encryption and fraud prevention. But his entrepreneurial journey didn't stop there. He went on to found Slide, and later Affirm, a company dedicated to providing honest financial products that align with consumers' best interests. Throughout the conversation, Max discusses his guiding philosophy of HVF—hard, valuable, and fun—and how it shapes his approach to building companies that aim to make a positive impact on the world.We also explore Max's thoughts on the future of technology, exploring AI's potential, the evolving landscape of fintech, and the importance of aligning financial interests with customers. Tune in to uncover the story of an engineer at heart, a visionary leader, and a man who continues to shape the future of finance and technology.***CHA-CHING! Customers are rushing to your store. Do you have a point-of-sale system you can trust or is it (ahem) a real P.O.S.? You need Shopify for retail.Shopify POS is your command center for your retail store. From accepting payments to managing inventory, Shopify has EVERYTHING you need to sell in person. Get hardware that fits your business. Take payments by smartphone, transform your tablet into a point-of-sale system, or use Shopify's POS Go mobile device for a battle-tested solution.Plus, Shopify's award-winning help is there to support your success every step of the way.Do retail right with Shopify. Sign up for a one-dollar-per-month trial period at www.shopify.com/founderhour. Once again, go to www.shopify.com/founderhour to take your retail business to the next level today.***It's 2024 - are you still using your personal phone number for your startup?One of the most common founder mistakes we see is using your personal phone for business. OpenPhone makes it super easy to get business phone numbers for your team. It works through a beautiful app on your phone or computer, and integrates with CRMs like HubSpot and Salesforce.Here's a feature we love: With OpenPhone's AI-powered call transcripts and summaries, you can have a summary of your phone call with action items right when you hang up. No more note-taking, or forgotten to-do's.What's more, every employee that's sharing that phone number with you has access to it, too. Total recall across your entire team. OpenPhone is already affordable at a starting price of $15/user/month. But, The Founder Hour listeners can get 20% off for 6 months. And if you have existing numbers with another service, OpenPhone will port them over at no extra charge.Head to https://www.openphone.com/founder to start your free trial and get 20% off!***The Founder Hour is brought to you by Outer. Outer makes the world's most beautiful, comfortable, innovative, and high-quality outdoor furniture - ALL from sustainable materials - and is the ONLY outdoor furniture with a patented built-in cover to make protecting it effortless. From teak chairs to fire pit tables, everything Outer makes has the look and feel of what you'd expect at a 5-star resort, for less than you'd pay at a big box store for something that won't last.For a limited time, get 10% off at www.liveouter.com/thefounderhour. Terms and conditions apply. ***Follow The Founder Hour on:Instagram | www.instagram.com/thefounderhourTwitter/X | www.x.com/thefounderhourLinkedIn | www.linkedin.com/company/thefounderhourYouTube | www.youtube.com/@thefounderhour
© 2020-2025 Ivy Podcast Discovery LLC
