5 ms·

Hackers Cut in Line at the Burning Man Ticket Sale–And Get Caught

43 points by Libertatea 12y ago

joncalhoun 12y ago
It's too bad Ticketfly doesn't have a bug bounty program. That payout would have been interesting.
raldi 12y ago
> In recent years, Larry Page, Sergey Brin, Elon Musk, Jeff Bezos and Mark Zuckerberg have all scored tickets to Burning Man. Um, Larry and Sergey have been going to Burning Man since at least 1998: http://www.theatlantic.com/technology/archive/2013/09/the-first-google-doodle-was-a-burning-man-stick-figure/279416/ http://www.theatlantic.com/technology/archive/2013/09/the-fi...
avalaunch 12y ago
The title seems off. They haven't been caught yet. Burning man officials simply said they will find and cancel the tickets. That seems like something they might say regardless of whether they actually could do so. Can anyone explain to me how they could go about determining who skipped the line and who didn't? I'm curious.
- fWnApHU2PY6CPA 12y ago
  My understanding is that any users who entered the queue between 11:55ish (when the waiting room appeared) and 12:00 PST (when purchasing officially started) will have their tickets revoked.
fWnApHU2PY6CPA 12y ago
I believe I may accidentally be one of these "hackers." For those of you who don't know how the line worked, TicketFly sent registered users a link to a page that would allow them to purchase tickets at 12:00pm PST. Like most people, I clicked the link just before noon and ended up in a waiting room with a countdown clock and a note explaining that a continue button would appear at exactly 12:00. My coworkers and I were curious if the button was simply hidden from view using JavaScript, so we did what any hackers (in the Hacker News sense) would do – we viewed the page's source. There it was! In the middle of the page sat a small javascript function with a link to reveal the button. Curious again, we clicked it. I believe the waiting room page just refreshed at that point, and we though nothing of it. A few minutes later, the queue began, and after sitting in it for about 40 seconds, I was shown the purchasing screen. I assumed I got lucky and left happy. When I read this blog post on Saturday evening, I realized what had happened and freaked out a bit. It appears that clicking that link placed us at the top of the queue, even though we couldn't actually start the purchasing process until noon. Because of this, I am probably going to lose my tickets. Yet the fact that we could cut in line never even occurred to us, because we assumed that any queuing logic would have happened on the server side to prevent exactly this kind of exploit. I feel bad for the users that I apparently cut in front of. I feel equally crappy, though, because I'm certain that other "hackers" are in similar situations to me. From what I've read in subsequent reports, using NoScript or otherwise browsing with Javascript disabled would have revealed the button before noon. That means that those people, too, will be labeled as hackers and have their tickets revoked. I'm relatively certain that even having a system clock running a few minutes early would mark you as a line cutter. Not sure what to do next. I suppose all I can do is wait. This sucks.
- lawlessone 12y ago
  Thats not accidental.
  - fWnApHU2PY6CPA 12y ago
    We had no desire to gain any advantage in the line or 'game the system' in any way. We were simply curious how the line worked.
    - toomuchtodo 12y ago
      > We were simply curious how the line worked. I don't mean to be rude, but curiosity would've been viewing the source. Dropping into the queue early is when it got shady. Apologies if you lose your tickets, but it seems the fair way to handle the situation.
      - kordless 12y ago
        > Dropping into the queue early is when it got shady My suggestion? Don't put your queue in my computer.
        toomuchtodo 12y ago
        It doesn't matter if their technical solution wasn't perfect. It was good enough, and those who bypassed it (whatever their motives) showed up in the logs. Seems like it worked just fine. That's the problem with the HN bubble. We seem to think everyone should come up with the perfect solution, when good enough carries the day.
        fWnApHU2PY6CPA 12y ago
        Taking myself out of the equation then, since I understand that my actions may be construed as a gray area. If it turns out to be true that users with incorrectly set system clocks and users with javascript disabled accidentally cut the line, are they hackers? Should they have their tickets revoked?
Cthulhu_ 12y ago
And that's why you never put that kind of logic on the front-end. Or if you do, always make sure there's a back-end double-check. In this case, from what I gather, an unique key that could only be known if people got it via an email would've been adequate.
- davidw 12y ago
  > And that's why you never put that kind of logic on the front-end. I wonder what kinds of goodies all these front end frameworks will lead to, when they eventually fall into the hands of people who don't understand that the final arbiter of some things must be on the back end.
  - Bahamut 12y ago
    That sounds like poor engineering in general - why would you trust the client on time sensitive issues? I'm predominantly a frontend engineer, but I make sure to understand the role of the technology I use and the responsibilities that need to be addressed by other sectors.
    - davidw 12y ago
      > why would you trust the client on time sensitive issues Because someone only has a superficial understanding of how things work.
jessaustin 12y ago
I've never been to this, and I'm pretty sure I wouldn't want to go. (When I go to the desert, it's not to be around other people.) However, this whole authority-obedience-fashion-and-privilege episode seems somewhat counter to my previous media-driven impressions of the event. If you want to do something fun in the wilderness with your friends, you don't need anyone's permission for that.
- ChuckMcM 12y ago
  > you don't need anyone's permission for that. Except in this case the Bureau of Land Management's (BLM) permission. I spent a lot of time in Las Vegas and for the most part you just drove out into BLM land and it was fine. But if you have a group greater than a certain size it requires permits. The tickets process is a way for them to not exceed their permit limit of 50,000 people. Doing so would get them banned from getting permitted in the future. That said, I'm rather surprised at this point that some tech billionaire hasn't bought a couple of thousand of acres of desert[1] and allowed it to be run there. But at some point the 'exclusivity' becomes its own value. [1] Land ownership debates not withstanding.
deleted 12y ago
[deleted]
peterwwillis 12y ago
Many ticket-limited events have figured out how to run a massive timed purchasing event like this. TicketFly could have checked out any one of them to learn how to properly execute this kind of event, and prevent "line-skipping". (ShmooCon and Playa Del Fuego are two such events i'm familiar with) The system is very simple: you open up the ticket purchase page a few minutes before registration opens. The page reloads at randomish 30-second intervals. Once registration opens, the backend sets a queue number linked to a unique ID, and sets a cookie in your browser with that ID. You wait for the page to finally reload and say "it's your turn to purchase tickets!" And so, through a delayed system of individual registrations, everyone gets their ticket if they showed up at the appropriate time. The 'queue' is a server-side aspect of this system, and it all happens on servers that have their clocks synchronized. Before accepting anyone into the queue, the server software needs to check if it's 12:00 yet (or whatever time registration opens). Their software did not check the time before populating the queue. Bottom line: this was a bug in TicketFly's software, not "hacking".
- djcapelis 12y ago
  Uhm. Shmoocon and Playa Del Fuego sell... what, 2,000 tickets? Burning Man is selling 70,000 this year. 40,000 were sold in this single sale alone. That's an order of magnitude difference.
  - peterwwillis 12y ago
    The design is scalable to any ticket amount, given enough time and servers. You accept connections and assign queue numbers and then delay purchasing. You add randomization of various requests and entry in the queue itself to prevent gaming or latency-derived unfairness. I've worked on websites that return hundreds of thousands of dynamic content pages per second, and you don't even need to do that here: all you need is a landing page that sets cookies, and then you can take all day to actually allow people to purchase with the reservation number they've got. The bug has nothing to do with any of that, though...
  - forgottenpass 12y ago
    That's entirely irrelevant unless you're arguing that 40k (and/or N number of attempted buyers) are too many items to manage in a queue on the server side. Is that what you're saying?
jimrandomh 12y ago
Doing the queue/first-come-first-serve thing only makes sense if you expect the number of people arriving at exactly the starting moment to be less than your supply of tickets. Otherwise what you have is a ticket lottery, except that the "randomization" is being done by ping times rather than anything explicit. If they can't expand the ticket supply by enough to meet demand, then they should probably make an explicit ticket lottery.
- legulere 12y ago
  Doing a lottery also has the advantage that you can make some extra rules to make it more fair. For instance you can prefer people that didn't get tickets the year before.
cornewut 12y ago
I wonder if any of the "hackers" will get sued.
- amckenna 12y ago
  Why would they be sued?
WorldWideWayne 12y ago
Why do people need tickets to go out in the desert and have a big party? Perhaps my thinking is naive here, but tickets seem to run counter to one of the main principles of Burning Man which is "Radical Self Reliance". If I'm paying you for a ticket then I must be relying on someone for security.
- amckenna 12y ago
  The tickets pay for several things including the permits to hold the event on federal land, the setup and cleanup of basic infrastructure, and the maintenance of basic facilities such as porta-potties. They publish a great breakdown of where the money goes here: http://burningman.org/event/preparation/ticket-money/ http://burningman.org/event/preparation/ticket-money/

43 points by Libertatea 12y ago

It's too bad Ticketfly doesn't have a bug bounty program. That payout would have been interesting.

raldi 12y ago

> In recent years, Larry Page, Sergey Brin, Elon Musk, Jeff Bezos and Mark Zuckerberg have all scored tickets to Burning Man. Um, Larry and Sergey have been going to Burning Man since at least 1998: http://www.theatlantic.com/technology/archive/2013/09/the-first-google-doodle-was-a-burning-man-stick-figure/279416/ http://www.theatlantic.com/technology/archive/2013/09/the-fi...

avalaunch 12y ago

The title seems off. They haven't been caught yet. Burning man officials simply said they will find and cancel the tickets. That seems like something they might say regardless of whether they actually could do so. Can anyone explain to me how they could go about determining who skipped the line and who didn't? I'm curious.

fWnApHU2PY6CPA 12y ago
My understanding is that any users who entered the queue between 11:55ish (when the waiting room appeared) and 12:00 PST (when purchasing officially started) will have their tickets revoked.

fWnApHU2PY6CPA 12y ago

I believe I may accidentally be one of these "hackers." For those of you who don't know how the line worked, TicketFly sent registered users a link to a page that would allow them to purchase tickets at 12:00pm PST. Like most people, I clicked the link just before noon and ended up in a waiting room with a countdown clock and a note explaining that a continue button would appear at exactly 12:00. My coworkers and I were curious if the button was simply hidden from view using JavaScript, so we did what any hackers (in the Hacker News sense) would do – we viewed the page's source. There it was! In the middle of the page sat a small javascript function with a link to reveal the button. Curious again, we clicked it. I believe the waiting room page just refreshed at that point, and we though nothing of it. A few minutes later, the queue began, and after sitting in it for about 40 seconds, I was shown the purchasing screen. I assumed I got lucky and left happy. When I read this blog post on Saturday evening, I realized what had happened and freaked out a bit. It appears that clicking that link placed us at the top of the queue, even though we couldn't actually start the purchasing process until noon. Because of this, I am probably going to lose my tickets. Yet the fact that we could cut in line never even occurred to us, because we assumed that any queuing logic would have happened on the server side to prevent exactly this kind of exploit. I feel bad for the users that I apparently cut in front of. I feel equally crappy, though, because I'm certain that other "hackers" are in similar situations to me. From what I've read in subsequent reports, using NoScript or otherwise browsing with Javascript disabled would have revealed the button before noon. That means that those people, too, will be labeled as hackers and have their tickets revoked. I'm relatively certain that even having a system clock running a few minutes early would mark you as a line cutter. Not sure what to do next. I suppose all I can do is wait. This sucks.

lawlessone 12y ago
Thats not accidental.
- fWnApHU2PY6CPA 12y ago
  We had no desire to gain any advantage in the line or 'game the system' in any way. We were simply curious how the line worked.
  - toomuchtodo 12y ago
    > We were simply curious how the line worked. I don't mean to be rude, but curiosity would've been viewing the source. Dropping into the queue early is when it got shady. Apologies if you lose your tickets, but it seems the fair way to handle the situation.
    - kordless 12y ago
      > Dropping into the queue early is when it got shady My suggestion? Don't put your queue in my computer.
      - toomuchtodo 12y ago
        It doesn't matter if their technical solution wasn't perfect. It was good enough, and those who bypassed it (whatever their motives) showed up in the logs. Seems like it worked just fine. That's the problem with the HN bubble. We seem to think everyone should come up with the perfect solution, when good enough carries the day.
        fWnApHU2PY6CPA 12y ago
        Taking myself out of the equation then, since I understand that my actions may be construed as a gray area. If it turns out to be true that users with incorrectly set system clocks and users with javascript disabled accidentally cut the line, are they hackers? Should they have their tickets revoked?

Cthulhu_ 12y ago

And that's why you never put that kind of logic on the front-end. Or if you do, always make sure there's a back-end double-check. In this case, from what I gather, an unique key that could only be known if people got it via an email would've been adequate.

davidw 12y ago
> And that's why you never put that kind of logic on the front-end. I wonder what kinds of goodies all these front end frameworks will lead to, when they eventually fall into the hands of people who don't understand that the final arbiter of some things must be on the back end.
- Bahamut 12y ago
  That sounds like poor engineering in general - why would you trust the client on time sensitive issues? I'm predominantly a frontend engineer, but I make sure to understand the role of the technology I use and the responsibilities that need to be addressed by other sectors.
  - davidw 12y ago
    > why would you trust the client on time sensitive issues Because someone only has a superficial understanding of how things work.

jessaustin 12y ago

I've never been to this, and I'm pretty sure I wouldn't want to go. (When I go to the desert, it's not to be around other people.) However, this whole authority-obedience-fashion-and-privilege episode seems somewhat counter to my previous media-driven impressions of the event. If you want to do something fun in the wilderness with your friends, you don't need anyone's permission for that.

ChuckMcM 12y ago
> you don't need anyone's permission for that. Except in this case the Bureau of Land Management's (BLM) permission. I spent a lot of time in Las Vegas and for the most part you just drove out into BLM land and it was fine. But if you have a group greater than a certain size it requires permits. The tickets process is a way for them to not exceed their permit limit of 50,000 people. Doing so would get them banned from getting permitted in the future. That said, I'm rather surprised at this point that some tech billionaire hasn't bought a couple of thousand of acres of desert[1] and allowed it to be run there. But at some point the 'exclusivity' becomes its own value. [1] Land ownership debates not withstanding.

deleted 12y ago

[deleted]

peterwwillis 12y ago

Many ticket-limited events have figured out how to run a massive timed purchasing event like this. TicketFly could have checked out any one of them to learn how to properly execute this kind of event, and prevent "line-skipping". (ShmooCon and Playa Del Fuego are two such events i'm familiar with) The system is very simple: you open up the ticket purchase page a few minutes before registration opens. The page reloads at randomish 30-second intervals. Once registration opens, the backend sets a queue number linked to a unique ID, and sets a cookie in your browser with that ID. You wait for the page to finally reload and say "it's your turn to purchase tickets!" And so, through a delayed system of individual registrations, everyone gets their ticket if they showed up at the appropriate time. The 'queue' is a server-side aspect of this system, and it all happens on servers that have their clocks synchronized. Before accepting anyone into the queue, the server software needs to check if it's 12:00 yet (or whatever time registration opens). Their software did not check the time before populating the queue. Bottom line: this was a bug in TicketFly's software, not "hacking".

djcapelis 12y ago
Uhm. Shmoocon and Playa Del Fuego sell... what, 2,000 tickets? Burning Man is selling 70,000 this year. 40,000 were sold in this single sale alone. That's an order of magnitude difference.
- peterwwillis 12y ago
  The design is scalable to any ticket amount, given enough time and servers. You accept connections and assign queue numbers and then delay purchasing. You add randomization of various requests and entry in the queue itself to prevent gaming or latency-derived unfairness. I've worked on websites that return hundreds of thousands of dynamic content pages per second, and you don't even need to do that here: all you need is a landing page that sets cookies, and then you can take all day to actually allow people to purchase with the reservation number they've got. The bug has nothing to do with any of that, though...
- forgottenpass 12y ago
  That's entirely irrelevant unless you're arguing that 40k (and/or N number of attempted buyers) are too many items to manage in a queue on the server side. Is that what you're saying?

jimrandomh 12y ago

Doing the queue/first-come-first-serve thing only makes sense if you expect the number of people arriving at exactly the starting moment to be less than your supply of tickets. Otherwise what you have is a ticket lottery, except that the "randomization" is being done by ping times rather than anything explicit. If they can't expand the ticket supply by enough to meet demand, then they should probably make an explicit ticket lottery.

legulere 12y ago
Doing a lottery also has the advantage that you can make some extra rules to make it more fair. For instance you can prefer people that didn't get tickets the year before.

cornewut 12y ago

I wonder if any of the "hackers" will get sued.

amckenna 12y ago
Why would they be sued?

WorldWideWayne 12y ago

Why do people need tickets to go out in the desert and have a big party? Perhaps my thinking is naive here, but tickets seem to run counter to one of the main principles of Burning Man which is "Radical Self Reliance". If I'm paying you for a ticket then I must be relying on someone for security.

amckenna 12y ago
The tickets pay for several things including the permits to hold the event on federal land, the setup and cleanup of basic infrastructure, and the maintenance of basic facilities such as porta-potties. They publish a great breakdown of where the money goes here: http://burningman.org/event/preparation/ticket-money/ http://burningman.org/event/preparation/ticket-money/