6 ms·

I made a college punching bag for rejected highschoolers

54 points by skillseeddev 1y ago

deleted 1y ago
[deleted]
1970-01-01 1y ago
Very fun site, reminiscent of the old WWW when these kinds of academic jests and jabs were both allowed and somewhat useful to the world. (https://web.archive.org/web/20050602024057/http://www.ratemyprofessor.com/ShowMost.jsp https://web.archive.org/web/20050602024057/http://www.ratemy...)
- nottorp 1y ago
  > were both allowed Yeah, my first thought was which college is going to file a complaint for "terrorism" first...
ericmcer 1y ago
He's surprised that essentially a while loop was all it took to skew his results? Of course that is all it takes to hammer an unprotected API. I would almost blame whoever abuses the API rather than him for not protecting something made purely for others enjoyment. It getting messed with is almost part of the experience.
- dylan604 1y ago
  If you have never had the pleasure of being raided by bots, it is always a life experience when it first happens. It's only natural to think some personal side project would not be something to attract someone's attention to bother in this way. It's also a learning experience to finally realize that there are people that absolutely are willing to do this just because they can and/or just to see if it can be messed with. Also, never underestimate that your side project might land just right with someone that has a bone to pick and your project gives them the avenue to do it. If you've never experienced any of that, it is very easily dismissed or flat out never even considered.
- 0xTJ 1y ago
  No, you can admit that making the API simple was a mistake, but you always blame the person abusing the API (it's not like this is a critical system with valuable information). If everyone was acting in good faith, it wouldn't be a problem. (Though if someone is negligent with an important API, they should also be blamed.)
  - ericmcer 1y ago
    that is what i said....
- Wowfunhappy 1y ago
  How do you even really protect against bots? You can throw up a CAPTCHA but (A) that won't actually stop all the bots and (B) it's going to lock out some legitimate users who did nothing wrong.
  - bombcar 1y ago
    State of the art is basically a modified crypto miner that runs in javascript - the client says "processing" for awhile until it solves the math problem, then lets you in. Still bottable but takes tons more CPU power than the server needs.
  - ericmcer 1y ago
    Just add rate limiting, a single line in nginx and most server libraries would cover this. More sophisticated attackers (using multiple IP, hiding fingerprints) aren't going to bother with a site like this (probably lol) The code that got him wasn't a "bot" it was just a script that spawned a couple children and had them all hit the API on loop.
- skillseeddev 1y ago
  This was my first time dealing with APIs at scale, so I didn't do a whole lot of protection. I'm glad the site got botted though, I learned a lot about rate-limits, and the botter (from MIT) was kind enough to help me protect the API from future botters. It was a great learning experience, and I'd gladly do it again
gaws 1y ago
> I launched the app on Reddit on Ivy Day. A lot of people got rejected and were extremely frustrated, so this app was like the perfect stress ball. I was not prepared for the huge spike in traffic. The author intentionally released the app on one of the most-viewed sites on the internet (Reddit) on one of the biggest days for high school graduates (Ivy Day). How, in this hyper viral time, did he not consider the possibility of high traffic?
- scienceman 1y ago
  People post things all the time and they flop or get little attention. Reddit may be one of the most-viewed sites on the internet but that doesn't mean everything posted on it is too.
- magneticnorth 1y ago
  It's almost never that easy to get a simple side project website to go viral.
- skillseeddev 1y ago
  I've launched a dozen other projects on Reddit before, and none of them went this viral.
bombcar 1y ago
Add a "pay to punch" x100 or whatever and roll in the cash! (you might be surprised that people would pay to punch their own college, either out of wanting it to be exclusive or being annoyed at it even though they're going there)
- skillseeddev 1y ago
  that might actually work, I haven't considered that before. Thanks for the suggestion!
loeg 1y ago
Lol. I, too, was rejected by CMU and MIT.
- selimthegrim 1y ago
  I was rejected by MIT but not CMU (I did not apply to SCS though, having heard about the "get a life" class and gotten scared. I was also into chemistry at the time)
- brcmthrowaway 1y ago
  Join a smaller school, like Stony Brook
  - loeg 1y ago
    I went to my state school. This was, uh, many years ago.
indiansdontwipe 1y ago
[dead]
giarc 1y ago
Surprised to see Brock University up there. As the saying in Ontario goes, "If you can walk and talk, you can get into Brock".
- thr0waway001 1y ago
  Is it harder than Borchmore? That's my alma mater. Ooga chaka! Ooga chaka! Ooga ooga, ooga chaka!
- beezlebroxxxxxx 1y ago
  You always hear these sayings and then when you look at acceptance rates in Canadian higher-ed you find that there just aren't that many highly selective schools. Brock isn't an outlier at all; compared to a school like Stanford, for example, literally every Canadian school is wildly more accepting. People just apply to less schools at once (less culture of moving for school) and the schools have far more clear grade requirements --- if you meet them then you have like a 95% chance of getting accepted. There is no insane competitive application process like in the US and no one cares about what school you went to for undergraduate. It is funny how every school has a saying like that for rivals, though.
cultofmetatron 1y ago
for most things, college is a ripoff. medicine and law aside most of these courses could just be filled with just the books at a fraction of the cost. Something harder like stem? ok so lets say your average person at 18 wants to learn to learn electrical engineering. they can either spend 10-20k per semester at a university for the next 4 years. for the price of one semester, you can get yourself a all the books for your subject and... mathacademy.com -> 500 bucks/yr laptop -> 4000 oscillopscope -> $500-1000 power supply -> $400 prusa core one 3d printer + mms (makign enclosures etc) -> $1800 various other smaller stuff (multimeter, wires, components) (1000-2000) That still leaves plenty of cash to just pay an engineer or tutor by the hour to give you personalized attention and answer any questions you might have.
- aprilthird2021 1y ago
  > for most things, college is a ripoff It's just objectively not. A college degree increases earning potential so much, and the median student loan debt is only $20k. Even if the earning potential increased only $5k/year it would easily pay for itself over the course of even a fleeting professional career. Paying a tutor to teach you whatever isn't going to qualify you for a job like a degree will and won't connect you to employers like a fully staffed university recruiting office will
  - gwbas1c 1y ago
    I think there's a lot to be said for people going to college for the wrong reasons. Likewise, there's a lot to be said for people who show up at the wrong college, and end up with a lot of debt but no degree. But, your (aprilthird2021's) sentiment is right. College is (generally) worth it. A lot of the lessons are more than what comes from a book and self-directed teaching.
ASUfool 1y ago
Kind of surprised my NYU (Stern, '01) is #3. I'd think maybe Duke could be high up the list during March Madness if hoops fans got wind of the site.
aprilthird2021 1y ago
Not surprised to see someone from MIT tried to bot the punches to make their school on top :)
DerekL 1y ago
Title is misspelled, should be “high schoolers” (two words).

54 points by skillseeddev 1y ago

deleted 1y ago

[deleted]

1970-01-01 1y ago

Very fun site, reminiscent of the old WWW when these kinds of academic jests and jabs were both allowed and somewhat useful to the world. (https://web.archive.org/web/20050602024057/http://www.ratemyprofessor.com/ShowMost.jsp https://web.archive.org/web/20050602024057/http://www.ratemy...)

nottorp 1y ago
> were both allowed Yeah, my first thought was which college is going to file a complaint for "terrorism" first...

ericmcer 1y ago

He's surprised that essentially a while loop was all it took to skew his results? Of course that is all it takes to hammer an unprotected API. I would almost blame whoever abuses the API rather than him for not protecting something made purely for others enjoyment. It getting messed with is almost part of the experience.

dylan604 1y ago
If you have never had the pleasure of being raided by bots, it is always a life experience when it first happens. It's only natural to think some personal side project would not be something to attract someone's attention to bother in this way. It's also a learning experience to finally realize that there are people that absolutely are willing to do this just because they can and/or just to see if it can be messed with. Also, never underestimate that your side project might land just right with someone that has a bone to pick and your project gives them the avenue to do it. If you've never experienced any of that, it is very easily dismissed or flat out never even considered.
0xTJ 1y ago
No, you can admit that making the API simple was a mistake, but you always blame the person abusing the API (it's not like this is a critical system with valuable information). If everyone was acting in good faith, it wouldn't be a problem. (Though if someone is negligent with an important API, they should also be blamed.)
- ericmcer 1y ago
  that is what i said....
Wowfunhappy 1y ago
How do you even really protect against bots? You can throw up a CAPTCHA but (A) that won't actually stop all the bots and (B) it's going to lock out some legitimate users who did nothing wrong.
- bombcar 1y ago
  State of the art is basically a modified crypto miner that runs in javascript - the client says "processing" for awhile until it solves the math problem, then lets you in. Still bottable but takes tons more CPU power than the server needs.
- ericmcer 1y ago
  Just add rate limiting, a single line in nginx and most server libraries would cover this. More sophisticated attackers (using multiple IP, hiding fingerprints) aren't going to bother with a site like this (probably lol) The code that got him wasn't a "bot" it was just a script that spawned a couple children and had them all hit the API on loop.
skillseeddev 1y ago
This was my first time dealing with APIs at scale, so I didn't do a whole lot of protection. I'm glad the site got botted though, I learned a lot about rate-limits, and the botter (from MIT) was kind enough to help me protect the API from future botters. It was a great learning experience, and I'd gladly do it again

gaws 1y ago

> I launched the app on Reddit on Ivy Day. A lot of people got rejected and were extremely frustrated, so this app was like the perfect stress ball. I was not prepared for the huge spike in traffic. The author intentionally released the app on one of the most-viewed sites on the internet (Reddit) on one of the biggest days for high school graduates (Ivy Day). How, in this hyper viral time, did he not consider the possibility of high traffic?

scienceman 1y ago
People post things all the time and they flop or get little attention. Reddit may be one of the most-viewed sites on the internet but that doesn't mean everything posted on it is too.
magneticnorth 1y ago
It's almost never that easy to get a simple side project website to go viral.
skillseeddev 1y ago
I've launched a dozen other projects on Reddit before, and none of them went this viral.

bombcar 1y ago

Add a "pay to punch" x100 or whatever and roll in the cash! (you might be surprised that people would pay to punch their own college, either out of wanting it to be exclusive or being annoyed at it even though they're going there)

skillseeddev 1y ago
that might actually work, I haven't considered that before. Thanks for the suggestion!

loeg 1y ago

Lol. I, too, was rejected by CMU and MIT.

selimthegrim 1y ago
I was rejected by MIT but not CMU (I did not apply to SCS though, having heard about the "get a life" class and gotten scared. I was also into chemistry at the time)
brcmthrowaway 1y ago
Join a smaller school, like Stony Brook
- loeg 1y ago
  I went to my state school. This was, uh, many years ago.

indiansdontwipe 1y ago

[dead]

giarc 1y ago

Surprised to see Brock University up there. As the saying in Ontario goes, "If you can walk and talk, you can get into Brock".

thr0waway001 1y ago
Is it harder than Borchmore? That's my alma mater. Ooga chaka! Ooga chaka! Ooga ooga, ooga chaka!
beezlebroxxxxxx 1y ago
You always hear these sayings and then when you look at acceptance rates in Canadian higher-ed you find that there just aren't that many highly selective schools. Brock isn't an outlier at all; compared to a school like Stanford, for example, literally every Canadian school is wildly more accepting. People just apply to less schools at once (less culture of moving for school) and the schools have far more clear grade requirements --- if you meet them then you have like a 95% chance of getting accepted. There is no insane competitive application process like in the US and no one cares about what school you went to for undergraduate. It is funny how every school has a saying like that for rivals, though.

cultofmetatron 1y ago

for most things, college is a ripoff. medicine and law aside most of these courses could just be filled with just the books at a fraction of the cost. Something harder like stem? ok so lets say your average person at 18 wants to learn to learn electrical engineering. they can either spend 10-20k per semester at a university for the next 4 years. for the price of one semester, you can get yourself a all the books for your subject and... mathacademy.com -> 500 bucks/yr laptop -> 4000 oscillopscope -> $500-1000 power supply -> $400 prusa core one 3d printer + mms (makign enclosures etc) -> $1800 various other smaller stuff (multimeter, wires, components) (1000-2000) That still leaves plenty of cash to just pay an engineer or tutor by the hour to give you personalized attention and answer any questions you might have.

aprilthird2021 1y ago
> for most things, college is a ripoff It's just objectively not. A college degree increases earning potential so much, and the median student loan debt is only $20k. Even if the earning potential increased only $5k/year it would easily pay for itself over the course of even a fleeting professional career. Paying a tutor to teach you whatever isn't going to qualify you for a job like a degree will and won't connect you to employers like a fully staffed university recruiting office will
- gwbas1c 1y ago
  I think there's a lot to be said for people going to college for the wrong reasons. Likewise, there's a lot to be said for people who show up at the wrong college, and end up with a lot of debt but no degree. But, your (aprilthird2021's) sentiment is right. College is (generally) worth it. A lot of the lessons are more than what comes from a book and self-directed teaching.

ASUfool 1y ago

Kind of surprised my NYU (Stern, '01) is #3. I'd think maybe Duke could be high up the list during March Madness if hoops fans got wind of the site.

aprilthird2021 1y ago

Not surprised to see someone from MIT tried to bot the punches to make their school on top :)

DerekL 1y ago

Title is misspelled, should be “high schoolers” (two words).