please mdlint and my spell checker a little more authored by anarcat's avatar anarcat
...@@ -619,28 +619,30 @@ Both servers have firewalled SSH servers (rules defined in Puppet, ...@@ -619,28 +619,30 @@ Both servers have firewalled SSH servers (rules defined in Puppet,
There are two separate CAPTCHA systems in place on the donation form: There are two separate CAPTCHA systems in place on the donation form:
- [django-simple-captcha](https://pypi.org/project/django-simple-captcha/), a four-character text CAPTCHA which sits in - [django-simple-captcha](https://pypi.org/project/django-simple-captcha/), a four-character text CAPTCHA which sits
the form just above the Stripe or Paypal interface and submit button. in the form just above the Stripe or Paypal interface and submit
It integrates with Django's forms natively and failing to fill it out button. It integrates with Django's forms natively and failing to
properly will invalidate the form submission even if all other fields fill it out properly will invalidate the form submission even if all
are correct. It has an `<audio>` player just below the image and text other fields are correct. It has an `<audio>` player just below the
field, to assist those who might have trouble reading the characters. image and text field, to assist those who might have trouble reading
CAPTCHA images and audio are generated on the fly and stored in the the characters. CAPTCHA images and audio are generated on the fly
Django database (and they are the only things used by `donate-neo` and stored in the Django database (and they are the only things used
which are so stored). by `donate-neo` which are so stored).
- [altcha](https://github.com/altcha-org/altcha), a challenge-based CAPTCHA in the style of Google reCAPTCHA - [altcha](https://github.com/altcha-org/altcha), a challenge-based CAPTCHA in the style of Google
or Cloudflare Turnstile. When a user interacts with the donation form, reCAPTCHA or Cloudflare Turnstile. When a user interacts with the
the ALTCHA widget makes a request to `/challenge/` and receives a donation form, the ALTCHA widget makes a request to `/challenge/`
proof-of-work challenge (detailed [here, in the ALTCHA documentation](https://altcha.org/docs/proof-of-work/)). and receives a proof-of-work challenge (detailed [here, in the
Once done, it passes its result to `/verifychallenge/`, and the server ALTCHA documentation](https://altcha.org/docs/proof-of-work/)). Once done, it passes its result to
confirms that the challenge is correct (and that its embedded timestamp `/verifychallenge/`, and the server confirms that the challenge is
isn't too old). If correct, the widget calls the Stripe SDK function which correct (and that its embedded timestamp isn't too old). If correct,
embeds the credit card payment form. We re-validate the proof-of-work the widget calls the Stripe SDK function which embeds the credit
challenge when the user attempts to submit the donation form as well; it is card payment form. We re-validate the proof-of-work challenge when
not sufficient to simply brute force one's way past the ALTCHA via the user attempts to submit the donation form as well; it is not
malicious Javascript, as passing that re-validation is necessary for the sufficient to simply brute force one's way past the ALTCHA via
`donate-neo` backend to return the donation-specific client secret, which malicious Javascript, as passing that re-validation is necessary for
itself is necessary for the Stripe transaction to be made. the `donate-neo` backend to return the donation-specific client
secret, which itself is necessary for the Stripe transaction to be
made.
`django-simple-captcha` works well to prevent automated form submission regardless `django-simple-captcha` works well to prevent automated form submission regardless
of payment processor, whereas `altcha`'s role is more specifically to prevent of payment processor, whereas `altcha`'s role is more specifically to prevent
...@@ -712,7 +714,7 @@ Instagram, Mozilla, Disqus, Bitbucket, Nextdoor and Clubhouse." ...@@ -712,7 +714,7 @@ Instagram, Mozilla, Disqus, Bitbucket, Nextdoor and Clubhouse."
LTS releases are supported for "typically 3 years", see [their release LTS releases are supported for "typically 3 years", see [their release
process](https://docs.djangoproject.com/en/5.1/internals/release-process/) for more background. process](https://docs.djangoproject.com/en/5.1/internals/release-process/) for more background.
Support mostly happens over the [communnity section](https://www.djangoproject.com/community/) of the main Support mostly happens over the [community section](https://www.djangoproject.com/community/) of the main
website, and through Discord, a forum, and GitHub issues. website, and through Discord, a forum, and GitHub issues.
We had a consultant ([stephen](https://gitlab.torproject.org/stephen)) who did a lot of the work on We had a consultant ([stephen](https://gitlab.torproject.org/stephen)) who did a lot of the work on
... ...
......