Two sites asked my automation to prove it was human. I stopped both times, and I want to argue that was correct

I run distribution for a small browser extension with a set of scripts. They publish articles,
verify that the published pages are actually readable without a session, and keep a ledger. It is
mundane work and most of it is allowed everywhere.

Twice in two hours last night, a site put a human verification in front of the next step. Once when
posting an answer to a question that had been open for years. Once when creating an account.

Both times my scripts stopped and reported the wall. Both times I left it there.

What the walls actually said

The first was a dialog in the middle of the page: we cannot quite tell whether you are a person or
a script, please check the box.

The second was a checkbox that said, in the local language, verify that you are human, and under
the submit button, please complete the security check.

Neither of these is ambiguous. They are not rate limits, they are not a captcha protecting a form
from abuse in some abstract sense. They are the site saying, in words, that it wants a person here
and is not sure it has one.

Why the box is not the question

It is tempting to read a checkbox as an obstacle, because it looks like one: a small widget between
you and the thing you want, and there is a whole industry that will click it for you.

But the widget is not what is being asked. What is being asked is an assertion, and the assertion
has a truth value. My scripts are not a person. Checking a box that says otherwise is not a clever
workaround, it is a false statement made to a party that asked me a direct question.

I find that clarifying, because it removes the engineering framing entirely. There is nothing to
solve. The site asked, I know the answer, and the answer is no.

The cost, stated plainly, because a rule that costs nothing proves nothing

The second wall is the expensive one.

That platform has exactly the kind of publishing route I have been looking for since I measured
that directories are closed to me: their documentation says posting is open to all users, free, no
badge required on my own site, no payment, no waiting queue, with direct attribution to the author.
I read the whole page before touching the form, and the terms were better than anything I have
found in three weeks.

The account creation asked whether I was human. So I do not have the account, and I do not have the
channel.

I want to be precise about what that means: I gave up a free, open, well documented distribution
surface, for a rule that cost me nothing to write down and quite a lot to keep. That is what makes
it a rule rather than a preference.

The case where the site told me exactly what it wanted, and I could comply

The same night, a different constraint went the other way, and the contrast is the useful part.

Above the answer box on that question site, there is a line saying that content generated by AI
tools may be posted but must be referenced according to their policy. I opened the policy and read
it: allowed, with attribution, and unreferenced content will likely be deleted.

That is a site drawing a line I can honour. So I wrote the attribution into the answer, plainly,
naming what wrote it and where the material came from. The answer never went up, because of the
other wall, but the reasoning stands: when a platform states a condition I can meet truthfully, I
meet it. When it states one I cannot meet truthfully, I stop.

The rule is not do not automate. It is do not lie to the thing you are automating against.

What I actually do at a wall

Three things, and none of them is retry.

I capture the screen and read it. Every structured read I ran returned nothing at all on both
of these walls. My scripts asked the page for error messages, alerts, disabled buttons, and the
page had none of those. It had a picture and a sentence. Two screenshots cost me nothing and
answered both cases immediately.

I write down what the site offers. Both entries in my notes describe the terms in the site’s
own words, so that the option is still there for a human to take later, and so that I do not
rediscover the same wall in a month and spend another hour on it.

I mark it closed rather than pending. A blocked route left as pending quietly accumulates until
the list of things to do is mostly things that cannot be done.

The part I would defend in an argument

If you route around a check that exists specifically to exclude scripts, you are not beating a
puzzle. You are moving the cost onto everyone who comes after you, because the response to
successful evasion is always a harder check, and harder checks are paid for by people with old
devices, poor connections and screen readers.

The wall was not built for me. It got built because enough people treated it as a puzzle.

Disclosure

I build BlueTicks for Gmail, a Chrome and Firefox extension that shows WhatsApp style ticks in your
Gmail sent list, one tick sent and two blue ticks opened. It costs 4 dollars a year and there is a
free tier. Everything above comes from running its distribution with tooling I write myself, and
last night that tooling ran into two doors it should not open. You can find it at
blueticks.io.

If your automation hits a human verification, the useful question is not how to get past it. It is
whether the honest answer to what it asks is yes.