8 ms·

> keeping out bot You can forget about it. It is not possible. Simple as that.

by malka1986 4mo ago

Wowfunhappy 4mo ago
Let's say I'm selling concert tickets. How do I prevent bots from buying up all the tickets and scalping them?
- luckylion 4mo ago
  Tie them to the buyer's identity, offer at-value buy-backs until X weeks before event, disallow resale.
- MyMemoryfails 4mo ago
  I'd simply check filling speed, even with browser's autocomplete humans are slow due needing click submit. Then when it's "processing", do them in bulk and prioritize slower users. There's huge opportunity do bot checks after checkout without affecting user experience. Also on product launches you could add unique field which requires user to input, for example that way bots can't prepare for launches.
  - fragmede 4mo ago
    huh. no wonder my password manager's auto submit triggers bot detection (it's a fairly popular one).
  - arbol 4mo ago
    Yeah, this doesn't even begin to cut it
- ndriscoll 4mo ago
  Sell them via a Dutch auction. Eliminate the arbitrage opportunity for scalpers and make more money in the process.
  - dcrazy 4mo ago
    That’s how you wind up with only kids of millionaires at your Taylor Swift concert.
    - queenkjuul 4mo ago
      So a Taylor Swift concert
- ranguna 4mo ago
  Do it like plane tickets do, tie a ticket to an identity + buyback up to a week or so before the concert in case someone wants to cancel (or authorize the transfer and capture only a week before). Ask for ID and ticket at the entrance.
- arbol 4mo ago
  - behavioural fingerprinting - ja4 - IP rep - queue mechanism - card country to IP country checks - app attestation - custom metrics based on knowledge of past scalpers It's hard but it's not impossible. You can make it very inconvenient for scalpers. They need to poll at volume so their behaviour is very much detectable. A hard stance is required on IP rep, especially for more in demand concerts.
  - Wowfunhappy 4mo ago
    I don't now, a lot of this seems just as invasive as WebGL fingerprinting, if not more invasive.
    - arbol 4mo ago
      It's either that or you tie tickets to government ID like in France. If the arbitrage opportunity is more than the cost of automation then someone will exploit it.

> keeping out bot You can forget about it. It is not possible. Simple as that.

Wowfunhappy 4mo ago

Let's say I'm selling concert tickets. How do I prevent bots from buying up all the tickets and scalping them?

luckylion 4mo ago
Tie them to the buyer's identity, offer at-value buy-backs until X weeks before event, disallow resale.
MyMemoryfails 4mo ago
I'd simply check filling speed, even with browser's autocomplete humans are slow due needing click submit. Then when it's "processing", do them in bulk and prioritize slower users. There's huge opportunity do bot checks after checkout without affecting user experience. Also on product launches you could add unique field which requires user to input, for example that way bots can't prepare for launches.
- fragmede 4mo ago
  huh. no wonder my password manager's auto submit triggers bot detection (it's a fairly popular one).
- arbol 4mo ago
  Yeah, this doesn't even begin to cut it
ndriscoll 4mo ago
Sell them via a Dutch auction. Eliminate the arbitrage opportunity for scalpers and make more money in the process.
- dcrazy 4mo ago
  That’s how you wind up with only kids of millionaires at your Taylor Swift concert.
  - queenkjuul 4mo ago
    So a Taylor Swift concert
ranguna 4mo ago
Do it like plane tickets do, tie a ticket to an identity + buyback up to a week or so before the concert in case someone wants to cancel (or authorize the transfer and capture only a week before). Ask for ID and ticket at the entrance.
arbol 4mo ago
- behavioural fingerprinting - ja4 - IP rep - queue mechanism - card country to IP country checks - app attestation - custom metrics based on knowledge of past scalpers It's hard but it's not impossible. You can make it very inconvenient for scalpers. They need to poll at volume so their behaviour is very much detectable. A hard stance is required on IP rep, especially for more in demand concerts.
- Wowfunhappy 4mo ago
  I don't now, a lot of this seems just as invasive as WebGL fingerprinting, if not more invasive.
  - arbol 4mo ago
    It's either that or you tie tickets to government ID like in France. If the arbitrage opportunity is more than the cost of automation then someone will exploit it.