17 ms·
Adafruit requires 2FA to prevent bots buying out Raspberry Pi
- tormock 5y agoESP8266s can be used for a lot of things that people use RPi for... and they are a lot cheaper. I just sold 2 used RPi that I bought ~10 years ago for more then what I paid for them brand new...
- n4bz0r 5y agoI've been wondering about that myself, but then it's occured to me that there are very poor countries where kids simply don't have access to no computers at all. The appeal of Pi in this situation is that you can program and prototype on the thing, and it's relatively affordable (well, at least it is supposed to be). For ESPs you'd need a separate device to write and upload the code.
- tormock 5y agoyeah, ESPs aren't general purpose computers but they are still very capable (I used one as a "router" before to create a network in my car: https://github.com/martin-ger/esp_wifi_repeater https://github.com/martin-ger/esp_wifi_repeater)
- FrenchDevRemote 5y agoThis is incredibly stupid, it's really easy to handle 2FA with a bot.(as easy as making the bot in the first place, or even easier...)
- fomine3 5y agoI thought they adopt SMS 2FA that is somewhat reasonable. But they chose TOTP, lol. Just copy pasta TOTP generator on bot. It gives bots advantage.
- syntheticnature 5y agoClever way to become the site of first resort for makers and engineers.
- ephbit 5y agoWhat's this about? Are the bots operated to manipulate the market, by buying up the whole supply to then sell at a higher price?
- dljsjr 5y agoI guess you could call it market manipulation but it's more just resellers/scalpers trying to take advantage of the chip shortage. RPis have always been in high demand and often were backordered even when things were fine; now they're supply constrained enough that scalpers can buy up in bulk and resell at high markup, similar to the GPU aftermarket going on right now.
- jason-phillips 5y agoYes, in many industries.
- teeray 5y agoThe bots are middlemen that ensure proper pricing of scarce goods. Their commission is the difference between the retail price and the actual market price.
- fartcannon 5y agoVultures, parasites, vampires.
- MereInterest 5y ago
- internet_user 5y agoWhats your preferred method of rationing scarce resources?
- mfringel 5y agoMy preferred method is overly broad rhetorical questions that add nothing to the conversation. Also, spatula. Yours?
- alexk307 5y agoGood. Supply is so limited right now, but everyone should be able to get one at MSRP if they want one. The whole goal of the Pi project is to make computers affordable to enable learning and prototyping. I pre-ordered a Pi 4 about 3 months ago, and I should receive it this week if I'm lucky.
- calvinmorrison 5y agoGood. Supply is so limited now, prices should go up
- avian 5y ago> The whole goal of the Pi project is to make computers affordable to enable learning and prototyping Is it still though? They have been pushing into various industrial and commercial markets. There was talk about Raspberry Pi Trading planning an IPO this year [1]. There are companies now that are basing their entire product lines around Raspberry Pi's Compute Modules. This then drives demand for other Raspberry Pi products as well. When you're deeply invested into that ecosystem you also need Pis 3s and 4s for builds, testing, development, etc. [1] https://news.ycombinator.com/item?id=29392649 https://news.ycombinator.com/item?id=29392649
- samwillis 5y agoAn IPO of Raspberry Pi Trading Ltd would unlock a lot of funds for the Raspberry Pi Foundation which could be reinvested into further educational activities. It’s probably a good move for the original mission of the foundation.
- peterangular 5y ago> An IPO of Raspberry Pi Trading Ltd would unlock a lot of funds It would also make every decision that the company makes from here going forward one of fiduciary responsibility to the shareholders. For a project rooted in affordable open-source hardware/software that's a major conflict of interest. I get that "Raspberry Pi (Trading) Ltd" is not the Raspberry Pi Foundation, but it is wholly owned by the foundation as a subsidiary. IMO, it'd be of major concern if any RPI business entities went public.
- NowhereMan 5y agoLooks like you can use OATH TOTP, which can be easily automated. I don't understand how this is an effective countermeasure against bots.
- samwillis 5y agoThis ads friction to the process of automating the buying process. Preventing bots is an endless cat and mouse game, every protection you put in place will be circumvented eventually. You just have to keep changing tactics and adding new layers. That’s what they are doing here. Realistically the best protection that they could put in place is a rate/qty limit on the credit card being used. It can still be automated by using stolen cards, or one of the services that instantly creates new card numbers for you. But again it adds friction. Also limiting the number of orders to delivery addresses would be a easy mitigation. It wouldn’t surprise me if they are doing both of those already though.
- wyager 5y agoThis seems like an especially trivial-to-bypass mitigation.
- samwillis 5y agoIt may be “trivial” to someone with a high level of expertise. But the number of moving parts required in that automation does add a significant barrier to most the of “script kiddies” that are using bots. You still need to automate account creation and setting up of a TOTP token, that’s not “easy” for a lot of people.
- spookthesunset 5y agoLike the poster said, it’s whack-a-mole. These trivial mitigations at least filter out low-effort script kiddies. People gaming the system “for real” will put incredible effort into getting around your countermeasures. You always have to be one step ahead of them.
- azinman2 5y ago
- snapetom 5y agoFor anyone confused in setting this up, the App is Twilio Authy in the Apple App Store. The logo in the app store has little contrast and the Adafruit blog post just calls it "Authy" which returns dozens of 2FA apps.
- azinman2 5y agoYou can use any 2FA app such as 1Password
- cheeze 5y agoIt's just oauth totp. You can use whatever 2fa authenticator you want. I like the one built into BitWarden personally. Authy works fine too (there is a good authenticator app that is actually called Authy)
- Izkata 5y ago> and the Adafruit blog post just calls it "Authy" Twilio acquired Authy in 2015, but didn't put their brand on it until a year or two ago, so a lot of people just call it "Authy" out of habit/without knowing Twilio owns it.
- ohyeshedid 5y ago*OTP isn't much of a barrier. SMS would've increased the cost a little more. Both easily automated. I know retailers are trying to fight the tide, but they're going to need more than teacups.
- nothasan 5y agoPretty easy to automate this
- Seattle3503 5y agoI'm surprised they didn't require Phone # verification given the issue they are having.
- paxys 5y agoHow does 2FA stop bots?
- cinntaile 5y agoFixed pricing with scarce goods tends to lead to this result, just let supply and demand sort it out and this problem wouldn't exist. Trying to fix this by using 2FA won't change much, it's just an arms race where each side keeps investing more and more money into fixing a problem that doesn't have to exist in the first place.
- samwillis 5y ago> just let supply and demand sort it out and this problem wouldn't exist That would go against the mission of the Raspberry Pi Foundation which is to promote computer science education. Accessibility though low prices is an important aspect of that. Not all problems are solved with free markets. https://en.m.wikipedia.org/wiki/Raspberry_Pi_Foundation https://en.m.wikipedia.org/wiki/Raspberry_Pi_Foundation
- Ajedi32 5y agoLowering prices doesn't make the product more "accessible" if you can't supply enough to keep up with demand at that price. It just turns the purchasing process into a lottery rather than a bidding war. I can't say I find the former process any more in line with the Pi foundation's stated goals than the latter.
- zht 5y agoso let's say that you target people who can only afford $30 computers if it's a lottery, then some of those people would be able to buy it at $30 if it's a bidding war, then none of them would be able to buy it at $30
- Ajedi32 5y agoThat makes sense, assuming "people who can only afford $30 computers" are your sole priority. If you also care about, for example, "people who can only afford $40 computers", then a better approach would be to raise prices to match market value and use the resulting profits to increase supply.
- cjcampbell 5y agoGlad they took this step to slow down the bots. The situation has been rough since rpilocator.com came along. I haven’t been able to complete a purchase since the week it hit HN. I use the pi for teaching, and could previously pick one up every couple weeks just by signing up for stock notifications. I was in the middle of a purchase in February when rpilocator updated to show stock and Adafruit went offline due to the traffic surge. The disruption lasted about half an hour.
- geerlingguy 5y agoIt was rough before rpilocator came along. It just highlighted how difficult it is to find any Pis in stock.
- philjohn 5y agoWill this slow down the bots? It's just an extra (simple) hoop to jump through, TOTP is easy to implement.
- vmception 5y agoWhat Adidas did was release 30,000 NFTs and require proof of current possession of one of the NFTs (colloquially called 'ownership', just hoping to avoid a semantics discussion) to gain access to the purchase of some new merchandise. If bots were not in the sale then they will not be able to purchase the merchandise. Bots can purchase one of the NFTs from someone else usually at a premium, to participate. The bot developer needs to do some additional coding. In any case, the merchandise buyers now get to feel like its more fair, even with the presence of potential bots buyers, since a stake was placed. The market has priced the NFTs based on how much they think the subsequent merchandise will resale for. Currently these are worth $4,300 and Adidas initially sold them for $800 and at least $84,000,000 in volume over 4 months. Adidas gets the proceeds of the initial NFT sale, a commission from the NFT resales ("royalties"), as well as the proceeds from selling the merchandise. It's a form of an additional factor.
- shkkmo 5y agoI sure hope more companies don't adopt this sort of gatekeeping, that sounds awful for the people who actually want to wear the shoes and great for the speculators who are abusing that demand to make money. If you have limited runs that you want to sell fairly and maximize profit on, why not just do a regular auction?
- criddell 5y agoWhat you call gatekeeping, Adidas would probably call price discovery.
- shkkmo 5y agoAn auction seems like a much simpler way to do price discovery without excluding that part of your customer base that doesn't know how to use an NFT (or doesn't want to.) Edit: The market is for the NFTs, not for the shoes themselves. It isn't clear to me how Adidas is able to separate demand for the shoes themselves from speculative interest in making money off of the NFT. Markets can indeed be great price discovery mechanisms, but rampant speculation can significantly tarnish the effectiveness of that mechanism because the pricing can become more dependent of the market's understanding of demand rather than on the demand itself.
- chmod600 5y agoWhat's the background here? Why is this model so popular? Are previous models a viable alternative for some? How long until production can catch up?
- wnevets 5y agoIt seems like online scalping in general has skyrocketed since the pandemic started in 2020, the most famous probably being GPU cards.
- stjohnswarts 5y agoAnd the ubiquitous ticket scalper bots.
- chmod600 5y agoI was interested to hear more about why this model is so exciting. Any thoughts, or just faster/better?
- HeyLaughingBoy 5y agoI think it's just because it's the newest model and for many newest == best. Also, they're cheap, so the difference between a pi4 and a pi2b isn't that much $$$.
- noobermin 5y agoIt's across the board, with GPUs, things like these pis, retro games and accessories even, it's pretty annoying. Thankfully necessities like TP and masks are no longer being scalped but it's still happening in electronics.
- sbierwagen 5y agoScalping happens when the list price is lower than the market price. Nobody scalps shares of Alphabet, because the price floats. Merchants don't want to increase list prices, because they'll get yelled at, so instead they run out of stock and middlemen collect the arbitrage price. If you don't like it, tell stores to increase prices, and tell CNN to stop running stories about how awful greedy businessmen are causing inflation purely out of spite.
- dzhiurgis 5y agoI've recently sold my 2-3 yr old unused RPI and made a profit, thats insane.
- deleted 5y ago[deleted]
- lagrange77 5y agoMaybe these are just some pitiful injured robots, trying to get hold of some spare parts for self repair. :'(
- atlgator 5y agoIs there a particular use case making the Pi 4 so in demand?
- hashkb 5y agoI don't understand what's so hard about this problem - if you have a platform that's impacted by bots and scalpers, and if you want to do the right thing, or give the appearance of doing the right thing with almost no cost to yourself or your business, you should release your product in a fair lottery with reasonable purchase limits. You have plenty of time before the product is released to register and verify everyone. You completely avoid traffic issues. Accounting is easy - you'll sell out when you run the lottery. You'll build a reputation for releasing inventory fairly and without causing undue stress on your customers, and avoid the suspicion that you're in cahoots with the scalpers (looking at you, Ticketmaster). I'm accustomed to stressing out over concert tickets and struggling to get gaming consoles, and have a deep hatred of scalpers and the platforms that enable them, but I had no idea that scalpers were ruining the educational/hobby markets too. That seems really low.
- ineedasername 5y agoWhat about stuffing the lottery box with countless bot-created accounts entering the lottery?
- hashkb 5y agoYou'd have a lot more time to find and boot them prior to running the lottery. Assuming you didn't/couldn't detect them, at least you spare your users the anxiety and inconvenience of the on-sale while they get screwed.
- digitallyfree 5y agoAs an aside, used thin clients and industrial PCs are a good x86 alternative to the Pi if you require similar performance and don't need GPIO. They are quite plentiful on ebay, include a housing, and consume little power.
- bradly 5y agoMaybe now is now a good time to sell all my Pi's I bought through-out the years with good intentions of building something one day.
- largbae 5y agoIndeed. Once you start, you won't stop
- adolph 5y agoAdafruit does have stock of Pi Zero WH in the form of Google AIY vision kit. Kinda spendy for what it is tho. https://www.adafruit.com/product/3780 https://www.adafruit.com/product/3780
- n4bz0r 5y agoGiven one of the goals of the project is to allow young people to have an affordable PC to learn linux and programming, it would make sense to reserve a part of the stock for verified students (or teachers) at MSRP.
- amelius 5y agoBetter let the bots through, let them pay, then say that the items are on backorder. >:)
- charcircuit 5y agoIf you want to prevent scalpers just sell the new units that come into stock in a reverse auction. Start the price at $500 and lower the price by a dollar every minute. Once all of the stock is sold out you charge everyone the price the last unit was sold for. In this system bots don't have an advantage over humans. Humans can preinput what they are willing to pay and there will be no race against bots like what you see here.
- ineedasername 5y agoSelling above MSRP without legitimate expenses to justify it still means the retailer is willing to sacrifice the RPi mission. Your proposal is not bad as a "price discovery" methodology but it does run counter to the RPi mission if it sells above their desired price.
- cinntaile 5y agoIsn't a reverse auction just another price discovery mechanism? Why is it superior?
- ineedasername 5y agoI didn't make a judgement on that method of price discovery. My comment was that it may still result in a price higher than the one desired by the RPi creators. Price discovery is not their goal, their goal is to make devices with educational applications cheap enough to be extremely affordable. If a retailer like Adafruit agrees with that goal, then a reverse auction or any other form of price discovery will run counter to that goal if it results in a higher price.
- charcircuit 5y agoIf supply is plentiful the price goes to the floor (MSRP). If there is not enough supply it is sold at a price that is as small as possible while allowing people who want it the most to get it (using the money they are willing to spend on it as a proxy for how badly they want it). If you are still worried about the mission the extra revenue could go towards a fund that helps people in need in regards to buying one.
- TrevorFSmith 5y agoIf you have an RPi that you're not using then be a hero and offer it to your maker friends.
- ineedasername 5y agoI have 2 or 3 RPi 2 models and an RPi 3. Any thoughts on how I could get it into good hands not looking to scalp them? The local schools don't need them.
- dawnerd 5y agoI don't know why this is so hard for retailers to figure out. Valve has an excellent system. Let me give you a down payment, five dollars, ten, whatever. Put my name on a list and when its my turn to buy give me a few days to purchase, and if not refund and move on to the next person. It's like all these retailers forgot backordering was a thing. They could even store the address and limit to one order per x period of time.
- kelnos 5y agoYeah, this has been really frustrating for me, too. I've been trying to buy a Compute Module 4, and everyone is sold out of that as well. I'd be perfectly happy to even pay the full price to place a backorder, and just wait for them to ship it to me whenever my order hits the top of the list. I don't want to keep checking daily to see if anyone has something, and then click through to each of 5 different retailers to only find out that they've sold out again in the time it's taken me to click through. It's such a waste of time.
- leguminous 5y agoAs far as I know, you can place a backorder with Newark or Allied.
- ElSinchi 5y agoJust put an order with a 70 week wait with Newark They even confirmed manually via email if I really really really wanted to place the backorder
- kelnos 5y agoAh, thanks! For some reason I'd missed that last time I looked. The other 4 retailers listed on raspberrypi.com for the US don't appear to accept preorders, but you're right about Newark. Now I just need to wait until October for my CM4 to ship... :(
- batch12 5y agoOr increase the price for the bots detected to a few thousand dollars
- abc123yeet 5y agoThey can have my old ones
- jzer0cool 5y agoWhat might be in the pi 4 that it is being bought out? Is there just a limited supply at the moment?
- jimrandomh 5y agoJust raise the price already. The market price of a Pi Zero 2W is about $70 right now. For my application, I'm happy to pay it, because the alternative would be spending a month of skilled developer time designing a daughterboard and porting software to a different SBC. If Adafruit actually succeeded in preventing scalpers from buying up the supply, this would mean misallocating boards to projects where a dozen other boards would have worked just as well.
- 2xpress 5y agoIndeed, if the demand exceeds the supply then the prices have to go up. This way more money will be available for the manufacturer to increase the supply. This is the basic law of economics, and anybody trying to play games around it will only make things worse and end up in poverty.
- throwaway81523 5y agoWhat were you doing building a product(?) around a 02W anyway? They are supposed to be 1 per person, like the old 0 series. They have never been offered in quantity even when there wasn't a shortage.
- savant_penguin 5y agoMaybe I'm being naive here, but why is it so hard to just make more?
- ineedasername 5y agoA reasonable question, but also a simple answer: we're in a global chip shortage.
- gnulinux 5y agoWe're in the middle of a huge chip shortage. All kinds of semiconductor materials are very expensive nowadays due to low supply. Companies like Pi simply can't find enough material.
- danbr 5y agoConfused how 2FA prevents bots from ordering. What’s stopping someone from setting up a verified account and automating a 2FA order process? Unless there is an additional purchase limit?
- FateOfNations 5y agoIt doesn't outright prevent it, but it does make it more complicated, puting it out of the skill range for a decent chunk of the bot operators.
- barbazoo 5y agoWouldn't a recaptcha be a much more robust way to prevent bots from ordering?
- iJohnDoe 5y agoSorry for an obvious question. What is the current situation that requires anyone to use a bot to buy a Pi? Why is a Pi so important today?
- harryvederci 5y agoIf I'm not mistaken, the Raspberry Pi was meant to be an affordable device for educational purposes. Now bots are buying them, making them scarce, making them less affordable. Could licensing help here? What if the Raspberry Pi Foundation would sell devices with a license that says you can't sell it for more than a certain price, and you can only sell it / give it away under the same license?
- krageon 5y agoWhat would that license do? How would it be enforced? Not at all, in which case such rules are bad.
- Havoc 5y agoI’ve got like 3 pi4s lying around mostly idle that I bought before supply/demand went insane. Maybe I should list them somewhere if there is so much demand