3 ms·

Etsy gets multiple thousands of vendor sign-ups per day and needs a dedicated team to filter out vendors that attempt to game the marketplace by flooding it wit

by slv77 9y ago

Etsy gets multiple thousands of vendor sign-ups per day and needs a dedicated team to filter out vendors that attempt to game the marketplace by flooding it with thousands of listings for cell phone cases and other junk. A lot of it is driven by Chinese middlemen and get-rich-quick schemes that are more than happy to burn the marketplace to the ground if they can make a buck in the process. The challenge is that in the beginning the revenue is good and it's hard to say no to revenue when you need to beat the street every quarter. It seems so manageable at first. But unless you've lived its very hard to wrap your head around that you've planted the seeds of your own destruction.

devmunchies 9y ago
it wouldn't take a dedicated team to detect if a seller is uploading a high amount of items.
- slv77 9y ago
  Whatever you set your limit as it's pretty trivial to bypass if they are willing to create a thousand accounts. Close those thousand accounts and they will create a thousand more at the same rate you close them. Add velocity controls for the IP address and you'll get a thousand sign ups from a thousand IPs. Limit it by device and you'll see a thousand devices. Flag the images using a perceptual hash and the images will come back superimposed on random pictures of food. At some point you find that your accounts are now traded as a commodity on underground markets at various prices by teams that specialize in creating accounts, aging them and selling them for x cents. Add enough restrictions to new accounts and you'll find existing shops being taken over and flooded with listings. And do all of this while still having an "effortless" signup experience for new legitimate vendors.
  - triplesec 9y ago
    Are you really sure they are that sophisticated? Genuine question. THis sounds like an extreme worst case scenario
    - slv77 9y ago
      The example of cell phone case pictures superimposed over random pictures of food was from an Etsy presentation at a conference I recently attended. Routinely (i.e. daily) I see activity that may involve 500+ unique IPs and 2000-4000 attempts. The type of activity that I see isn't close to what would be considered an extreme-worst case scenario in the industry. Assuming the right economic incentives these groups are over time able to duplicate about any behavior that would be seen by a typical customer. For example, they can effectively remote desktop into a device and create a sleeper account and then come back to the exact same device a week later once the probation period has expired and execute a larger attack. Also it is hard to fully understand that markets where labor isn't scarce fundamentally organize themselves differently. For example one recent attack that I'd see involved multiple attempts from multiple IP addresses and multiple devices all within seconds of each other and using the same credit card for registration. For a while I marveled at the technical skills that would be required to orchestrate such an attack until I realized that it likely was likely a dozen people in a room sharing the same credit card number and launching the attack in a coordinated fashion. Low tech, but extremely effective when labor is cheap.

by slv77 9y ago

devmunchies 9y ago

it wouldn't take a dedicated team to detect if a seller is uploading a high amount of items.

slv77 9y ago
Whatever you set your limit as it's pretty trivial to bypass if they are willing to create a thousand accounts. Close those thousand accounts and they will create a thousand more at the same rate you close them. Add velocity controls for the IP address and you'll get a thousand sign ups from a thousand IPs. Limit it by device and you'll see a thousand devices. Flag the images using a perceptual hash and the images will come back superimposed on random pictures of food. At some point you find that your accounts are now traded as a commodity on underground markets at various prices by teams that specialize in creating accounts, aging them and selling them for x cents. Add enough restrictions to new accounts and you'll find existing shops being taken over and flooded with listings. And do all of this while still having an "effortless" signup experience for new legitimate vendors.
- triplesec 9y ago
  Are you really sure they are that sophisticated? Genuine question. THis sounds like an extreme worst case scenario
  - slv77 9y ago
    The example of cell phone case pictures superimposed over random pictures of food was from an Etsy presentation at a conference I recently attended. Routinely (i.e. daily) I see activity that may involve 500+ unique IPs and 2000-4000 attempts. The type of activity that I see isn't close to what would be considered an extreme-worst case scenario in the industry. Assuming the right economic incentives these groups are over time able to duplicate about any behavior that would be seen by a typical customer. For example, they can effectively remote desktop into a device and create a sleeper account and then come back to the exact same device a week later once the probation period has expired and execute a larger attack. Also it is hard to fully understand that markets where labor isn't scarce fundamentally organize themselves differently. For example one recent attack that I'd see involved multiple attempts from multiple IP addresses and multiple devices all within seconds of each other and using the same credit card for registration. For a while I marveled at the technical skills that would be required to orchestrate such an attack until I realized that it likely was likely a dozen people in a room sharing the same credit card number and launching the attack in a coordinated fashion. Low tech, but extremely effective when labor is cheap.