3 ms·

What did the bot situation look like this year? I know that the stock-related areas and Osu! were accused of botting (and faded to white very quickly when Plac

What did the bot situation look like this year? I know that the stock-related areas and Osu! were accused of botting (and faded to white very quickly when Place ended last night, sort of confirming the accusations), but it seemed like coordination through popular streamers seemed to cause the most aggressive edits to succeed. I initially imagined that communities that cared to bot would have some sort of coordination server, and users would add compute power to that from their local machines. The local thing that each user ran would get a pixel to change from the coordination server, then use their auth credentials and IP address to make the edit. Reading some comments below, though, it seems like there was no IP rate limiting and no requirement to use an active account. So instead of needing a coordination server, I'm guessing that interested users just made a lot of accounts and cycled through them locally to make the desired edits. Does anyone know for sure? (The main reason I didn't bot this was because I assumed having a pool of residential IPs and high-karma accounts would be mandatory. I guess I was wrong, though!) Some other comments below imply that this was an intentional decision to boost user numbers before an investment round / IPO. I hope the investors that are looking to get in on that get access to the database to determine whether or not the numbers are legitimate. I'm surprised investors are OK with spam accounts being counted as legitimate users. They aren't going to buy anything that's advertised or invite their friends ;)

Macha 5y ago
Absolutely rampant. I think most communities that were still on the canvas day 2 and on either had a huge inbuilt following or resorted to bots. I think Osu, the superstonk people and France probably were botting, but unless those bots were incredibly poorly written, I don't think were the cause of the sudden erasure - the bot code I saw shared most widely was definitely looking up which colour to pick based on the rendered colour code, and one discord I was in that was using it was definitely alerted to the white starting because the bots started erroring out for being unable to find the desired colour. I think it's more likely hostile bots were the cause of the swift erasure. If they're just picking a random or first colour to try wipe it out, they'd still function and contribute to swift deletion
- jrockway 5y ago
  That's interesting. I didn't look into the API in detail. I took one edit request and did "copy as curl" and played with that a bit (it's just GraphQL, and I enjoyed how some fields are "snake_case" and others are "CamelCase"). I was kind of surprised that I could reuse the various authorization headers between requests, I assumed they would really want to validate that you were actually using a browser and not replaying requests with curl, but it didn't seem to cause any problems. I guess my underlying assumption that was completely wrong was that they wanted to avoid bots this time around. It doesn't seem like they did, and I don't understand why. On one side of the spectrum if you add some defenses then the people that break them are good people to offer a job to. On the other side of the spectrum, it's a lot more fun for humans when they aren't competing with machines. Having no bot mitigation just means the computer savvy users get to stomp on the actually creative communities. It makes me a little sad.
  - Macha 5y ago
    Oh, I don't know how many of the bots were actually using the API, versus just userscripts running in TamperMonkey/ViolentMonkey. The ones I saw were userscripts, so they were browser based. They did try _some_ prevention, there was a guy running 20 accounts who had his timers escalate up to like 18000 minutes, and also if you placed too many black pixels in sequence you'd get errors for a while before you could place again. But it definitely didn't kick in until way too late.

Macha 5y ago

Absolutely rampant. I think most communities that were still on the canvas day 2 and on either had a huge inbuilt following or resorted to bots. I think Osu, the superstonk people and France probably were botting, but unless those bots were incredibly poorly written, I don't think were the cause of the sudden erasure - the bot code I saw shared most widely was definitely looking up which colour to pick based on the rendered colour code, and one discord I was in that was using it was definitely alerted to the white starting because the bots started erroring out for being unable to find the desired colour. I think it's more likely hostile bots were the cause of the swift erasure. If they're just picking a random or first colour to try wipe it out, they'd still function and contribute to swift deletion

jrockway 5y ago
That's interesting. I didn't look into the API in detail. I took one edit request and did "copy as curl" and played with that a bit (it's just GraphQL, and I enjoyed how some fields are "snake_case" and others are "CamelCase"). I was kind of surprised that I could reuse the various authorization headers between requests, I assumed they would really want to validate that you were actually using a browser and not replaying requests with curl, but it didn't seem to cause any problems. I guess my underlying assumption that was completely wrong was that they wanted to avoid bots this time around. It doesn't seem like they did, and I don't understand why. On one side of the spectrum if you add some defenses then the people that break them are good people to offer a job to. On the other side of the spectrum, it's a lot more fun for humans when they aren't competing with machines. Having no bot mitigation just means the computer savvy users get to stomp on the actually creative communities. It makes me a little sad.
- Macha 5y ago
  Oh, I don't know how many of the bots were actually using the API, versus just userscripts running in TamperMonkey/ViolentMonkey. The ones I saw were userscripts, so they were browser based. They did try _some_ prevention, there was a guy running 20 accounts who had his timers escalate up to like 18000 minutes, and also if you placed too many black pixels in sequence you'd get errors for a while before you could place again. But it definitely didn't kick in until way too late.