6 ms·

I wonder if some of those "guests" are website scrapers or other automated systems from competitors that are looking to get pricing info.

GordonS 7y ago
I wonder if some of these automated systems are ran by booking.com, or someone contracted to run them? Too cynical?
- paranoidrobot 7y ago
  I worked for a competitor, and the amount of time+money we spent blocking scrapers was insane. The reason we spent all that time+money? It affected the metrics on which we were paid, AND consumed a huge amount of compute resources of ourselves and partners. It's also (at least in part) why places are doing the "Sign up to see special offers" thing - because the offer isn't for display on the open site, and they don't want that value to appear on scrapers. So... logged in users only, and validate that user isn't doing scraping.
  - wolco 7y ago
    Why not offer a public api? Logging in seems like a small hurdle for a bot but enough of a hassel that customers lose interest.
    - rocqua 7y ago
      Login with re-captcha, and banning of accounts that are obviously scraping could be quite effective I guess.
    - paranoidrobot 7y ago
      We did have an API, but it wasn't public - because search traffic is expensive. Both, as mentioned, in compute resources, but also in pissing off and/or outright crashing vendors. Logging in - requiring an email validation loop - would be simple for bots, but again, anti-bot tech stops them from doing it en-masse.
  - GordonS 7y ago
    > AND consumed a huge amount of compute resources of ourselves and partners Wow, I'm interested to know more here! How much bot/scraper traffic was there that it cost you big on compute?
    - paranoidrobot 7y ago
      I don't want to give away too much detail - Company IP, self identifying, etc. However, lets just say that if normal peak traffic is 1X, then bot traffic can come in at 100-10000X. And in most cases it's not a smooth rise, it'll be a case of suddenly all this new traffic came in, no warning, no rise. How many non-trivially complex sites do you know that can suddenly take 100-10000X their normal peak in under a minute? Those that do - are their managers happy about spending on idle infrastructure? How fast do you think even services like AWS can scale? (hint: it's not fast enough). Normal traffic is, in aggregate, quite predictable in load. Outside of very unusual situations, you don't get hundreds of thousands of people suddenly hitting your site. Plus, because that traffic is nice and predictable, you can have decent caching rules, reducing the cost of the traffic again. Along comes Mr Botnet and they want to scrape everything: every hotel in every city, every checkin/out tuple for stays of 1-7 days for the next 12 months, and a bunch of room configurations. Kiss your caching goodbye, because now not only is your cache hit ratio for their searches going to be effectively zero, but now it's being filled with other shit that nobody else wants. And this is just our infrastructure. There's the third party OTAs that we hit, and they have the same issue, often with smaller and less experienced teams running on crappier infrastructure. So, you get angry calls from them that their shared hosting provider is cutting them off and you're ruining their business. Because of course, this shared hosting is not only hosting their room availability search API, but their hotel check-in and sales applications - so nobody in 30 hotels can check-in/out.
      - GordonS 7y ago
        Thanks for the detail. It's just mind-boggling to me that you could have a peak of (for example) 1K requests per second, then a bot rises that to 10M requests per second. If nothing else, it seems incredible that bot authors would be so willfully harmful - they must know that kind of behaviour is going to prompt a reaction
  - jacquesm 7y ago
    > Sign up to see special offers Another reason why they do that is because their partners require they don't advertise special pricing to the world at large, they're contractually forbidden from doing so.
smueller1234 7y ago
As you might intuitively conclude, Booking and its competitors invest quite heavily into detecting real vs. bot traffic. Often, sites will block bot traffic or degrade the content. Booking is very torn on that because they don't want an arms race. When I worked on the experiment tooling, we very much preferred to have more, but tagged bot traffic than less and undiscovered. That's because for the experiment analysis, the undiscovered bot traffic was poison.
eggie5 7y ago
True the are lots of booking scrapers like trivago

GordonS 7y ago

I wonder if some of these automated systems are ran by booking.com, or someone contracted to run them? Too cynical?

paranoidrobot 7y ago
I worked for a competitor, and the amount of time+money we spent blocking scrapers was insane. The reason we spent all that time+money? It affected the metrics on which we were paid, AND consumed a huge amount of compute resources of ourselves and partners. It's also (at least in part) why places are doing the "Sign up to see special offers" thing - because the offer isn't for display on the open site, and they don't want that value to appear on scrapers. So... logged in users only, and validate that user isn't doing scraping.
- wolco 7y ago
  Why not offer a public api? Logging in seems like a small hurdle for a bot but enough of a hassel that customers lose interest.
  - rocqua 7y ago
    Login with re-captcha, and banning of accounts that are obviously scraping could be quite effective I guess.
  - paranoidrobot 7y ago
    We did have an API, but it wasn't public - because search traffic is expensive. Both, as mentioned, in compute resources, but also in pissing off and/or outright crashing vendors. Logging in - requiring an email validation loop - would be simple for bots, but again, anti-bot tech stops them from doing it en-masse.
- GordonS 7y ago
  > AND consumed a huge amount of compute resources of ourselves and partners Wow, I'm interested to know more here! How much bot/scraper traffic was there that it cost you big on compute?
  - paranoidrobot 7y ago
    I don't want to give away too much detail - Company IP, self identifying, etc. However, lets just say that if normal peak traffic is 1X, then bot traffic can come in at 100-10000X. And in most cases it's not a smooth rise, it'll be a case of suddenly all this new traffic came in, no warning, no rise. How many non-trivially complex sites do you know that can suddenly take 100-10000X their normal peak in under a minute? Those that do - are their managers happy about spending on idle infrastructure? How fast do you think even services like AWS can scale? (hint: it's not fast enough). Normal traffic is, in aggregate, quite predictable in load. Outside of very unusual situations, you don't get hundreds of thousands of people suddenly hitting your site. Plus, because that traffic is nice and predictable, you can have decent caching rules, reducing the cost of the traffic again. Along comes Mr Botnet and they want to scrape everything: every hotel in every city, every checkin/out tuple for stays of 1-7 days for the next 12 months, and a bunch of room configurations. Kiss your caching goodbye, because now not only is your cache hit ratio for their searches going to be effectively zero, but now it's being filled with other shit that nobody else wants. And this is just our infrastructure. There's the third party OTAs that we hit, and they have the same issue, often with smaller and less experienced teams running on crappier infrastructure. So, you get angry calls from them that their shared hosting provider is cutting them off and you're ruining their business. Because of course, this shared hosting is not only hosting their room availability search API, but their hotel check-in and sales applications - so nobody in 30 hotels can check-in/out.
    - GordonS 7y ago
      Thanks for the detail. It's just mind-boggling to me that you could have a peak of (for example) 1K requests per second, then a bot rises that to 10M requests per second. If nothing else, it seems incredible that bot authors would be so willfully harmful - they must know that kind of behaviour is going to prompt a reaction
- jacquesm 7y ago
  > Sign up to see special offers Another reason why they do that is because their partners require they don't advertise special pricing to the world at large, they're contractually forbidden from doing so.

smueller1234 7y ago

As you might intuitively conclude, Booking and its competitors invest quite heavily into detecting real vs. bot traffic. Often, sites will block bot traffic or degrade the content. Booking is very torn on that because they don't want an arms race. When I worked on the experiment tooling, we very much preferred to have more, but tagged bot traffic than less and undiscovered. That's because for the experiment analysis, the undiscovered bot traffic was poison.

eggie5 7y ago

True the are lots of booking scrapers like trivago