I am all for using proper typographic symbols, but it is unclear what place the precomposed ellipsis U+2026—what I assume you mean by “true ellipsis”—has in that canon, especially with the compressed form it takes in most fonts.
Only if they are able to block the siteverify check performed by our backend server. That's not the kind of attack we are trying to mitigate with Turnstile.
I integrated Turnstile with a fail-open strategy that proved itself today. Basically, if the Turnstile JS fails to load in the browser (or in a few specific frontend error conditions), we allow the user to submit the web form with a dummy challenge token. On the backend, we process the dummy token like normal, and if there is an error or timeout checking Turnstile's siteverify endpoint, we fail open.
Of course, some users were still blocked, because the Turnstile JS failed to load in their browser but the subsequent siteverify check succeeded on the backend. But overall the fail-open implementation lessened impact to our customers nonetheless.
Fail-open with Turnstile works for us because we have other bot mitigations that are sufficient to fall back on in the event of a Cloudflare outage.
Neutraface has some similarities, including the low crossbar height. Fittingly, it appears to be used in materials published by the Frank Lloyd Wright Foundation.
The lettering on the proposal is very interesting. I assume it was hand drawn. I can't find any typeface quite like it. Google Lens suggested it is similar to Copperplate Gothic, which it is and at once is not even close.
Shazam-like fingerprinting for text. The complete LLM outputs wouldn't need to be stored, just the fingerprints along with some mechanism for trusted timestamping (could be Blockchain).
> I let it expire for a few days, now they are charging me $100/year!
It sounds like your domain name entered the redemption period. The high fee to restore a domain in the redemption period is mandated by the registry, not the registrar. So Gandi is not price gouging; they are required to collect that fee for restoring the domain.
Those are good words to use. That's how people should think of these redirects and use them, as long as you are careful to use explicit cache directives.
There seems to be some FUD going on here. The solution to the OP problem is simply to use 301 redirects with Cache-Control headers to limit caching to some reasonably short duration.
It is true that browsers will cache 301 redirects eternally, but only if the server does not supply cache directives to indicate otherwise. For this reason, it is always advisable to include some cache directives in 301 redirect responses, like `Cache-Control: max-age=86400`. I'm surprised that this isn't more universally acknowledged as an important practice.
As far as search engines, there will not be a problem if a URL that used to return a 301 now returns a 200. The web changes, and search engines know that very well.
Add: There also seems to be a lot of confusion about the meaning of permanent. Permanent should not be taken to mean eternal. If I move to a new house, I consider that a permanent move, because I no longer live at the old address. But it would be unreasonable to assume that I will never move again. I might even move back to the original house! Such moves are like permanent redirects; I might have my mail forwarded, but it is not an indelible, eternal change. Temporary redirects (302, 303, 307) are more like leaving a sticky note on the door while you're out running an errand; you have not permanently relocated.
That quote supports my statement. Notice that the serialized object is the thing that was constructed by the attacker, not some user data that you serialized yourself.
> "As set forth in the Dodd-Frank Act, the SEC protects the confidentiality of whistleblowers and does not disclose any information that could reveal a whistleblower’s identity."