Changes
Page history
please mdlint and my spell checker a little more
authored
Sep 11, 2024
by
anarcat
Show whitespace changes
Inline
Side-by-side
service/donate.md
View page @
32719f4f
...
...
@@ -619,28 +619,30 @@ Both servers have firewalled SSH servers (rules defined in Puppet,
There are two separate CAPTCHA systems in place on the donation form:
-
[
django-simple-captcha
](
https://pypi.org/project/django-simple-captcha/
)
, a four-character text CAPTCHA which sits in
the form just above the Stripe or Paypal interface and submit button.
It integrates with Django's forms natively and failing to fill it out
properly will invalidate the form submission even if all other fields
are correct. It has an
`<audio>`
player just below the image and text
field, to assist those who might have trouble reading the characters.
CAPTCHA images and audio are generated on the fly and stored in the
Django database (and they are the only things used by
`donate-neo`
which are so stored).
-
[
altcha
](
https://github.com/altcha-org/altcha
)
, a challenge-based CAPTCHA in the style of Google reCAPTCHA
or Cloudflare Turnstile. When a user interacts with the donation form,
the ALTCHA widget makes a request to
`/challenge/`
and receives a
proof-of-work challenge (detailed
[
here, in the ALTCHA documentation
](
https://altcha.org/docs/proof-of-work/
)
).
Once done, it passes its result to
`/verifychallenge/`
, and the server
confirms that the challenge is correct (and that its embedded timestamp
isn't too old). If correct, the widget calls the Stripe SDK function which
embeds the credit card payment form. We re-validate the proof-of-work
challenge when the user attempts to submit the donation form as well; it is
not sufficient to simply brute force one's way past the ALTCHA via
malicious Javascript, as passing that re-validation is necessary for the
`donate-neo`
backend to return the donation-specific client secret, which
itself is necessary for the Stripe transaction to be made.
-
[
django-simple-captcha
](
https://pypi.org/project/django-simple-captcha/
)
, a four-character text CAPTCHA which sits
in the form just above the Stripe or Paypal interface and submit
button. It integrates with Django's forms natively and failing to
fill it out properly will invalidate the form submission even if all
other fields are correct. It has an
`<audio>`
player just below the
image and text field, to assist those who might have trouble reading
the characters. CAPTCHA images and audio are generated on the fly
and stored in the Django database (and they are the only things used
by
`donate-neo`
which are so stored).
-
[
altcha
](
https://github.com/altcha-org/altcha
)
, a challenge-based CAPTCHA in the style of Google
reCAPTCHA or Cloudflare Turnstile. When a user interacts with the
donation form, the ALTCHA widget makes a request to
`/challenge/`
and receives a proof-of-work challenge (detailed
[
here, in the
ALTCHA documentation
](
https://altcha.org/docs/proof-of-work/
)
). Once done, it passes its result to
`/verifychallenge/`
, and the server confirms that the challenge is
correct (and that its embedded timestamp isn't too old). If correct,
the widget calls the Stripe SDK function which embeds the credit
card payment form. We re-validate the proof-of-work challenge when
the user attempts to submit the donation form as well; it is not
sufficient to simply brute force one's way past the ALTCHA via
malicious Javascript, as passing that re-validation is necessary for
the
`donate-neo`
backend to return the donation-specific client
secret, which itself is necessary for the Stripe transaction to be
made.
`django-simple-captcha`
works well to prevent automated form submission regardless
of payment processor, whereas
`altcha`
's role is more specifically to prevent
...
...
@@ -712,7 +714,7 @@ Instagram, Mozilla, Disqus, Bitbucket, Nextdoor and Clubhouse."
LTS releases are supported for "typically 3 years", see
[
their release
process
](
https://docs.djangoproject.com/en/5.1/internals/release-process/
)
for more background.
Support mostly happens over the
[
commun
n
ity section
](
https://www.djangoproject.com/community/
)
of the main
Support mostly happens over the
[
community section
](
https://www.djangoproject.com/community/
)
of the main
website, and through Discord, a forum, and GitHub issues.
We had a consultant (
[
stephen
](
https://gitlab.torproject.org/stephen
)
) who did a lot of the work on
...
...
...
...