3 ms·

(i'm the author) there were a bunch of bots run by different people, but for the most part they coordinated in the discord so that they weren't fighting over t

by eieio 2y ago

(i'm the author) there were a bunch of bots run by different people, but for the most part they coordinated in the discord so that they weren't fighting over the same "territory" at one point there was a group not in the discord trying to draw in the same place as the people in the discord, which lead to the bots constantly changing checkboxes to try two different images! but it was mostly cooperative

shombaboor 2y ago
what was the technical nature of the bot, a local shell bash/python script running constantly to make curl-esque requests the clicks on defined parts of the grid? Or something on top of the browser like a chrome extension? I'm curious because I wonder what the defense would be against it (I'm naive to such things).
- eieio 2y ago
  Most of the bots were in python or node afaik. Bash would be a little hard because you had to send data over a websocket. They had some notion of the squares they were watching and what their values needed to be (to draw the images). And then they subscribed to the full state of the grid (which my API made really easy to do) and would respond by sending websocket requests to check boxes when they got toggled to the "wrong" value. I'm sure people did other things - lots of people wrote scripts in the browser console. But I think the above is basically what people in the discord did. I had some basic protections in place. There's some client-side rate limiting that prevents the really trivial "run the script in the console stuff" and then some server-side per-IP limiting to prevent really aggressive botting. Plus my server got slow at some points which inadvertently slowed people down. The big difficulty with the server-side stuff is that you don't want to be too aggressive with IP based limiting because sometimes a large group of people resides behind a single IP (like at a school) and you want to make sure that all of those people can play. So it's a balancing act.
memorabilia 2y ago
Thanks for replying! Now I understood.

by eieio 2y ago

shombaboor 2y ago

what was the technical nature of the bot, a local shell bash/python script running constantly to make curl-esque requests the clicks on defined parts of the grid? Or something on top of the browser like a chrome extension? I'm curious because I wonder what the defense would be against it (I'm naive to such things).

eieio 2y ago
Most of the bots were in python or node afaik. Bash would be a little hard because you had to send data over a websocket. They had some notion of the squares they were watching and what their values needed to be (to draw the images). And then they subscribed to the full state of the grid (which my API made really easy to do) and would respond by sending websocket requests to check boxes when they got toggled to the "wrong" value. I'm sure people did other things - lots of people wrote scripts in the browser console. But I think the above is basically what people in the discord did. I had some basic protections in place. There's some client-side rate limiting that prevents the really trivial "run the script in the console stuff" and then some server-side per-IP limiting to prevent really aggressive botting. Plus my server got slow at some points which inadvertently slowed people down. The big difficulty with the server-side stuff is that you don't want to be too aggressive with IP based limiting because sometimes a large group of people resides behind a single IP (like at a school) and you want to make sure that all of those people can play. So it's a balancing act.

memorabilia 2y ago

Thanks for replying! Now I understood.