Echoes
Echoes
The Test That Taught Machines to Pass It
Between 2009 and today, billions of people clicked through grid squares identifying crosswalks, storefronts, and traffic lights. They were proving they were human. They were also labeling training data for the very systems that would make the test obsolete. CAPTCHA began as a bet placed at Carnegie Mellon in 2003: that certain perceptual problems would stay hard for machines long enough to serve as a reliable gate. The bet had a structural flaw, and it was built into the gate itself.
The Test That Taught Machines to Pass It
Between 2009 and today, billions of people clicked through grid squares identifying crosswalks, storefronts, and traffic lights. They were proving they were human. They were also labeling training data for the very systems that would make the test obsolete. CAPTCHA began as a bet placed at Carnegie Mellon in 2003: that certain perceptual problems would stay hard for machines long enough to serve as a reliable gate. The bet had a structural flaw, and it was built into the gate itself.
Human-Speed Infrastructure
HTTP/1.0 opened a fresh TCP connection for every single request. A brutal performance penalty, and nobody cared, because the client on the other end was reading, thinking, moving a cursor. The protocol's overhead hid inside human hesitation.
Every layer built on top inherited that calibration. Apache's keepalive timeout defaulted to 15 seconds: roughly the pause between clicks. Rate limits sat at single-digit requests per second. The Retry-After header imagined a patient visitor who'd wander off and come back later.
Agents don't wander. They queue. And thirty years of infrastructure shaped by human tempo now pushes back at a speed that made sense for readers, not for software completing tasks.
Persistence and Proof
The Session Assumption
Web protocols carry a portrait of their first user. HTTP had no memory, so Netscape gave it cookies, and the security conventions that followed were calibrated to a specific creature: one that idles, gets distracted, walks away from the keyboard. The 15-minute session timeout is a sketch of a human body leaving a chair. What happens when the thing holding the session doesn't have a body to leave?
Who Clicks Authorize
Web protocols carry a portrait of their first user. OAuth 2.0 was built around a pronoun and a click: a human, present, reading a permissions screen, deciding to say yes. The entire authorization chain assumes someone is there to consent. Fourteen years later, agents act on behalf of users who aren't in the room, holding tokens designed for people who were. That gap is widening faster than the specs can follow.
Further Threads
