C

Solutions to complex digital problems.

[C @unreleased]

A thread of some of my favourite bypasses that I've shared over the years

[C @unreleased]

@dwbypass i am just the flesh and bones remaining of a once great man

[C @unreleased]

enough manifesting

[C @unreleased]

manifesting an rm67-02

[C @unreleased]

@b_nnett Bezos accepted foot pics so I’m up

[C @unreleased]

@b_nnett Don’t be obsene the collection uncollectable

[C @unreleased]

We go band for band rn let’s see who really the big c

[Pulcy @Pulcys]

Clavicular was having the time of his life k*ssing every girl in his section at the club😳

“I’m the BIG C, I MOG yall. I’m the big C”

[C @unreleased]

@m_chael @nathanclark_ the only things truly worth doing in life are gambling, fraud and drinking

[C @unreleased]

@Rhynotic @nickbruhman @WeAreMalice @OminousAIO @TheBotBibleS @PokeMRKT @BotCookerCops how are you missing express notify bro

[C @unreleased]

@DillanWeb3 is that cope i'm hearing

[C @unreleased]

@austin_mer16162 u got nice feet?

[C @unreleased]

@nickbruhman just a small percentage of my slash cashback

[C @unreleased]

@victorcardenas @davidcardenascc come say hi

[C @unreleased]

@18pairsonkith @m_chael he wasn't homeless that was balenciaga

[C @unreleased]

manifesting an rm67-02

[C @unreleased]

@Ticket_Help2022 @DougKolk @saumil I did explain it. I'd be happy to jump on a call with either of you and go through your concerns.

[C @unreleased]

@Cyborgmatt @crackedbackdoor @CLEMENTINATOR 7 years later, please help me get the tickets so I can run it back, there's nothing I wouldn't do

[C @unreleased]

They are pointless beyond a point, extreme-scale automated checkout fraud is a much bigger issue than people buying tickets to resell (Nike was having $400/second in fraudulent transactions)

The BOTS Act isn't gospel. It does not apply to people outside of the jurisdiction of the USA.

[C @unreleased]

This discussion is going in circles, so I’ll summarise my position rather than repeat the same points.

Nothing Ticketmaster does will realistically improve your chances of fans getting hold of more tickets. Whatever system or restriction is introduced, bots can complete the process faster, at greater scale, and more effectively than humans.

The bots will simply adapt. Every new restriction becomes just another obstacle for bot operators to work around.

You want to really stop bots? Turn Ticketmaster releases into an auction house and let the highest bidders buy. See how much fans like that. Remove profit from the botters' pockets and put it into Ticketmaster's.

[C @unreleased]

Ok a few more points:

"Ticketmaster can see how long it took to cart/checkout and the exact times the tickets get released. Immediate flag and put on notice accounts that check out faster than any human without automation could check out"

So your first point is to base it on timing. For reserved tickets, since there's a 7-minute timer, it's very easy for bots to just make their checkout slower without losing the cart; for FCFS, they can just add artificial delays to make it slower (but still not too slow that it loses to humans). Skilled human buyers that buy a lot of tickets will also be punished for being too fast because of false positives

"Also combine with even just checking Ticketmaster resale and seeing people have entire rows of tickets many times 2-3 times the order limit"

You cannot buy over the ticket limit. Botters will use multiple accounts to do that. These accounts cannot be connected together for the same reason they can't block them at checkout

"If that detection is working as well as you believe, then I'd expect to see a noticeable drop in tickets immediately"

Because it's a flawed system, as are all antibots, and it doesn't matter what Ticketmaster does; bots will win. Just because they're doing more to prevent bots doesn't mean it prevents them.

You have no evidence to say these are bots buying the tickets, not just fast humans watching and buying the tickets quickly to list & resell them. Of course they are, but you can't prove it and neither can Ticketmaster.

"If the intended design is collect more signals, block more bots, and get more tickets into the hands of real fans, then I'd like to see evidence that it's actually accomplishing that."

That’s the problem! The bots they fail to block are the ones that look human. If Ticketmaster had clear evidence that a buyer was using a bot, it would stop the purchase at checkout, as it already does when it detects obvious bot activity. So asking for proof that the remaining buyers are bots creates a circular problem. The hardest bots to detect are exactly the ones for which Ticketmaster cannot produce definitive evidence. You won't ever be able to obtain the evidence you desire.

There is not a single thing Ticketmaster can do that will help get tickets into the hands of real fans that bots can't do as well. It's unfortunate to hear I get that, but that's the way it works and the way it will always work.

Whilst they say "Get more tickets into the hands of real fans", what it actually means is: "Get more tickets into the hands of a smaller number of botters"

Do you want accounts to be logged in before they can add tickets to their cart? You're still not gonna get tickets. You want Ticketmaster to sue botters they can detect? You're still not gonna get tickets. You want Ticketmaster to make it FCFS or bring back cart timers? It doesn't matter; You're still not gonna get tickets.

[C @unreleased]

First point: You're asking is an impossible task. How should Ticketmaster differentiate between users who bought tickets without a bot and those who did? There isn't a way to tell for certain. If you're saying that simply because the tickets appeared on TM resale afterwards means they were bot-bought, unfortunately it's really hard to prove. And being hard to prove introduces false positives that will affect real buyers who didn't bot.

The screenshot you posted provides no evidence that they botted the tickets (Of course they are) but the point is if somebody dives into the account data and signals, they probably look no different to you and me buying the tickets.

Regarding additional bot prevention on the FCFS carts - It does, that's why they're doing it. It doesn't help botters in any meaningful way to do it like this.

How do you really think users have a chance during carthold? You think a person will refresh the page, find the tickets, then click cart faster than a bot? Not a chance, ever.

So, regarding "Why would a bot operator repeatedly reserve tickets for seven minutes instead of simply buying them if they can", this is where I think the confusion lies.

Just because a bot can cart the tickets, they still have the whole payment flow to go through again (like fcfs), without competition for those tickets. If Ticketmaster determines they're a bot and fails the checkout due to being detected as a bot the ticket will have go back into stock afterwards, which they will need to recart and use a different account, with different signals to actually complete the purchase.

So it might look like:
BOT carts -> fails checkout due to bot blocked
BOT recarts -> uses a different account -> fails checkout again
BOT recarts again -> uses a different account -> success

With FCFS drops the bot doesn't have long enough to do it three times in a row because a real user could actually checkout faster than a bot could. Of course the botter could cart those same tickets multiple times and try on three accounts at the same time etc, but then from the botters perspective you could be flagging 10-20 accounts for a single checkout causing banned/lost accounts. FCFS also allows TM to consider checkout-speed (which is a flawed system) but the most obvious bots will fail by being too obvious.

Regarding your second point: I think the problem is that bots are a small issue compared to the absolutely monstrous money-printing giant that Ticketmaster is, and certain business decisions can't be sacrificed just because it's "better for bots." it doesn't matter if it's better for bots or not, bots will still beat you and I

Third: If you tell me why & how you still think that, I can explain further, but to summarise: A bot needing to do more work is always worse than a bot that needs to do less work.

Bots operate under a higher level of control than the browser UI itself; behavioural signals are easy to mimic and circumvent.

Ticketmaster are trying their best, but they're fighting a losing battle. If you tell me your plan and what you think Ticketmaster should do, I will point out flaws in your system, because there isn't a system that can effectively detect bots. Just tricks & gotcha's

Extra yap from me:

You're against Persona, which is definitely the strongest way (still flawed) to stop bots but comes at a cost. In fact, I don't understand from a business perspective how they can afford to do that without seriously hurting conversions, leading me to think it's an obvious trigger caused by an obviously bad-flow that botters are making rather than something more sophisticated

[C @unreleased]

First point: This is exactly what they should be doing. Carting is easy, and Ticketmaster doesn't have enough signals to accurately determine whether a user is a bot from carting alone. When they remove the timer they get all these additional signals and data from the account's activity, previous order history, card/checkout details and much more. Then they can deny you on the purchase-level instead of the carting level. Since they're able to stop more bots because they have more data, there's more chance a real user can checkout on the same seats because they're not held.

It doesn't work like this in practice; the bots will still get the tickets the majority of the time, but it works much better than allowing a bot to re-reserve the tickets every 7~ minutes. Real fans basically have zero chance when there's a carthold.

Second: Yes, this is a correct point and very true. However, I think this is moreso done from a business perspective, not an anti-bot one. Higher checkout conversions, better purchase rates, etc, but they do this on some events (Probably not enough, as you mentioned); however, you still will be beaten by more sophisticated bots (especially with carthold)

Third: This would have happened regardless of it being carthold or not.

It doesn't matter whether the "fans" buy the argument or not. It is undeniably much better for the fans to do FCFS and let Ticketmaster deny on the payment layer than it is on the cart level.

The fan experience is more annoying because fans will reach checkout and then see that the tickets are out-of-stock. But don't get it twisted; frustration at checkout does not mean their chances were worse.

The real comparison isn't "bots versus fans with no timer." It is:

- Bots competing with fans in real time, while Ticketmaster has more data to evaluate the purchase and prevent them
versus
- Bots repeatedly locking the same inventory in carts before real fans can access it

I agree with a lot of the things you write, but this one isn't it.