3 ms·
> where I had an agent karma Was this a browser using agent? What did you use?
by echelon 6mo ago
> where I had an agent karma
Was this a browser using agent? What did you use?
- carlgreene 6mo agoIt used the browser agent to grab user cookies after signing in, then made API calls iirc. Using just a browser is way too token intensive and slow. It would look for 401 errors then run the browser automation to login with the credentials and grab the token.
- echelon 6mo agoI'm surprised these platforms don't have advanced heuristics to detect API calls and inauthentic traffic. Did you clone the Reddit API from browser traffic and then turn it into a 100% API driven thing? I'd imagine they'd be sniffing browser agents, plugins, cookies, etc. to fingerprint. Using JavaScript scroll position, browsing rate and patterns, etc. Maybe their protections just aren't that sophisticated.
- tardedmeme 6mo agoReddit is known to fingerprint TLS and quickly shadowban accounts that don't have the fingerprints of browsers.
- echelon 6mo agoTLS fingerprinting and Cloudflare are easy to bypass. There are lots of libraries that do so. The application-layer stuff is harder. Each application can develop its own heuristics, and that's difficult to automate in a cross-cutting fashion. Reddit doesn't do anything about that? That seems stupid.
- deleted 6mo ago[deleted]
- 81AB24FB 6mo ago> TLS fingerprinting and Cloudflare are easy to bypass. There are lots of libraries that do so. Easy for you does not mean easy for everyone. My experience is that TLS fingerprinting paired with blocking specific user agents gets a variety of majority of bot traffic. It's the same a basic online security: You can protect against script kiddies with basic hygiene. If the threat analysis is Mossad, then yeah, you're fucked.