Talking Drupal #489 - IXP Community Initiative

Today we are talking about The IXP Fellowship Initiative, Workplace Developer Training, and making Drupal better for the little guy with guests Carlos Ospina & Mike Anello. We'll also cover Cloudflare Turnstile as our module of the week.

For show notes visit: https://www.talkingDrupal.com/489

Topics

• What is the IXP initiative
• Why does the community think this is important
• What is the current status
• What changed in the last 10 years
• How do we encourage businesses to do this
• How can people get involved

Resources

• Turnstile
  • Intro blog post from Cloudflare
  • Irvine reCAPTCHA Study
  • Deep dive on Google Scholar
  • Alternatives
    • https://www.drupal.org/project/hcaptcha - privacy-focused alternative, still image-based
    • https://www.drupal.org/project/altcha - open, self-hosted option. Seems more basic.
  • Posts referencing Irvine study
    • https://boingboing.net/2025/02/07/recaptcha-819-million-hours-of-wasted-human-time-and-billions-of-dollars-google-profit.html
    • https://www.theregister.com/2024/07/24/googles_recaptchav2_labor/
    • https://www.pcgamer.com/gaming-industry/a-2023-study-concluded-captchas-are-a-tracking-cookie-farm-for-profit-masquerading-as-a-security-service-that-made-us-spend-819-billion-hours-clicking-on-traffic-lights-to-generate-nearly-usd1-trillion-for-google/
• Widgets
• IXP Fellowship
• Drupal Couple
• Talking Drupal 488 - Drupal Open University
• Get Involved in IXP
  • #ixp-fellowship on the Drupal Slack Workspace

Guests

Carlos Ospina - adrupalcouple.us camoa Mike Anello - drupaleasy.com ultimike

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Avi Schwab - froboy.org froboy

MOTW Correspondent

Martin Anderson-Clutz - mandclu.com mandclu

• Brief description:
  • Have you ever wanted to use Cloudflare's Turnstile web service to secure Drupal web forms, as an alternative to more intrusive CAPTCHA widgets that force users to select squares that contain traffic lights, cars, or bicycles? There's a module for that.
• Module name/project name:
  • Cloudflare Turnstile
• Brief history
  • How old: created in Sep 2022 by Adam Weiss (greatmatter)
  • Versions available: 1.1.13 which works with Drupal 9.4, 10, and 11
• Maintainership
  • Actively maintained
  • Security coverage
  • Number of open issues: 6 open issues, 3 of which are bugs, with 2 of them postponed
• Usage stats:
  • 3,981 sites
• Module features and usage
  • Anyone who maintains a Drupal site is well acquainted with the need to mitigate form spam submissions. Best practices around which tool to use are an ever-changing conversation.
  • Recently Google announced that reCAPTCHA implementations will need to be associated with a Google Cloud account, and will need to enable payment for anything that exceeds the free allowance of 10,000 assessments per month
  • reCAPTCHA v2 widgets are notorious for the challenges they can present to actual users, particularly image challenges. In addition, a 2023 UC Irvine study concluded that "the true purpose of reCAPTCHAv2 is as a tracking cookie farm for profit masquerading as a security service", so it's definitely worth considering other solutions
  • Cloudflare developed turnstile as a CAPTCHA alternative, designed to provide security while minimizing the friction for actual users. More importantly, Turnstile never harvests data for ad retargeting.
  • A free Turnstile account can create up to 10 widgets, with unlimited usage.
  • The turnstile module plugs into the existing Drupal CAPTCHA ecosystem, so it can be an easy swap out for anywhere you're currently using CAPTCHA widgets.