Tyrone Dougherty

Product Manager @kasada_io (tweets are my own). Recovering Software Engineer

[Tyrone Dougherty @tyronedougherty]

@nbobba @btv_vc Is this not just an AI consultancy? Or is there a platform play here

[Tyrone Dougherty @tyronedougherty]

@ply_thu @rronak_ this makes sense.

[Tyrone Dougherty @tyronedougherty]

@rronak_ cannot be recovered faithfully from text…”

So it’s about the ability to share and compare abstracted harness design patterns rather than per invocation LLM based design of a harness per task.

I guess you could do that, but surely that would provide very mixed results 🤔

[Tyrone Dougherty @tyronedougherty]

@rronak_ … tool interfaces, and sandbox enforcement. The scientific claim is about the unit of comparison: externalizing harness pattern logic as a readable, executable object under shared runtime semantics.”

“Natural language is less precise than code, and some harness mechanisms …

[Malte Ubl @cramforce]

This potential bug report turned into a really cool investigation with a surprising ending (shared with permission).

So, @Plague_FPS was observing that Vercel BotID was detecting his own traffic as a bot. Further investigation shows that this was true for all Chromium browsers on his machine–but Firefox was working.

Hmmm. How could this be?

We went on a Zoom session with them, and eventually figured it out: A malware (or at least ultra-dark-pattern software) had installed a system proxy that was intercepting all network traffic. That proxy was triggering the BotID defenses. Uninstall the malware, and their Chromium browsers were passing again.

[Sam Crowther @InfoSecSam]

Crazy that we managed to take the software that protects the largest companies on earth from bots, and get it into the hands of any developer thanks to @vercel @cramforce @rauchg

Feels good to lift everyone to the same playing field.

@tyronedougherty

[Vercel @vercel]

BotID is a new invisible CAPTCHA layer of protection that stops sophisticated bots before they reach your backend.

It's built to secure critical routes such as checkouts, logins, and signups, or actions that trigger expensive calls like LLM-powered APIs.

https://t.co/Fz1YNn2z4O

[Malte Ubl @cramforce]

Vercel BotID: The best CAPTCHA is invisible! Powered by Kasada's industry-leading deep analysis technology for detection of the most sophisticated bots with minimal false-positive rates.

await checkBotId();

[Guillermo Rauch @rauchg]

The best CAPTCHA is invisible. Full stop. We must rid the internet of junk

1️⃣ Server
𝚎𝚡𝚙𝚘𝚛𝚝 𝚊𝚜𝚢𝚗𝚌 𝚏𝚞𝚗𝚌𝚝𝚒𝚘𝚗 𝙿𝙾𝚂𝚃(𝚛𝚎𝚚) {
𝚌𝚘𝚗𝚜𝚝 { 𝚒𝚜𝙱𝚘𝚝 } = 𝚊𝚠𝚊𝚒𝚝 𝚌𝚑𝚎𝚌𝚔𝙱𝚘𝚝𝙸𝚍()
𝚒𝚏 (𝚒𝚜𝙱𝚘𝚝) {
𝚛𝚎𝚝𝚞𝚛𝚗 𝚗𝚎𝚠 𝚁𝚎𝚜𝚙𝚘𝚗𝚜𝚎 ("🤖")
}
𝚛𝚎𝚝𝚞𝚛𝚗 𝚗𝚎𝚠 𝚁𝚎𝚜𝚙𝚘𝚗𝚜𝚎("😌")
}

2️⃣ Client
<𝙱𝚘𝚝𝙸𝚍𝙲𝚕𝚒𝚎𝚗𝚝 𝚙𝚛𝚘𝚝𝚎𝚌𝚝={[ "/𝚊𝚙𝚒/𝚜𝚒𝚐𝚗𝚞𝚙" ]} />

That’s it. It works on Vercel and we’ll bring this DX and industry-leading protection no matter where you host

[Tyrone Dougherty @tyronedougherty]

Kasada 🤝 Vercel

Proud to bring the Kasada platform directly to Vercel’s 8 million developers with BotID.

We’ve silently been protecting the web’s biggest names for years. And now — you too.

A huge thank you to the Vercel team, you guys are awesome 🙂‍↕️

[Vercel @vercel]

BotID is a new invisible CAPTCHA layer of protection that stops sophisticated bots before they reach your backend.

It's built to secure critical routes such as checkouts, logins, and signups, or actions that trigger expensive calls like LLM-powered APIs.

https://t.co/Fz1YNn2z4O

[Aaron Levie @levie]

Velocity is the only thing that works as a startup. Rapid feedback loops that get you more data. Shipping product faster than the competition. Moving quickly on internal challenges so they don’t fester. Removing bottlenecks that prevent getting to the next stage.

[Dylan O'Sullivan @DylanoA4]

He was a poet

[Malte Ubl @cramforce]

We've been in the trenches learning how to protect our AI workloads from abuse such as denial of wallet attacks. It's a unique situation over classic bot abuse because AI APIs are so expensive. Here is how to protect yourself with Vercel and Kasada
https://t.co/5QBzl3wVh9

[Guillermo Rauch @rauchg]

This is how we mitigated abuse on the AI Playground (https://t.co/4TxKhPCgEQ).

We got to keep free access, made everyone happy, and built a sustainable product.

The rare win-win-win we all win.

[Douglas Mun @douglasmun]

*Evolution of click farm fraud.*

1st generation click farm fraud, fully manual labour.

[Vercel @vercel]

AI apps are a high-value target for bots and bad actors. Learn how Vercel partners with @kasada_io to protect the AI SDK Playground:

◆ Attack Challenge Mode
◆ Next.js Middleware
◆ Kasada bot protection

https://t.co/Xil7gIV9NZ

[The Project @theprojecttv]

Many Fred Again fans were left unable to buy tickets for his surprise concerts because nearly a third of tickets were estimated to have been snapped up by bot scalpers.

So how big of a problem is ticket scalping?

[Tyrone Dougherty @tyronedougherty]

Scalpers bought thousands of tickets to my favourite artist @fredagainagain1. I missed out - and tickets are now being sold for hundreds more than the original price.

So... I wrote a blog uncovering exactly how they did it 🙃

https://t.co/Kftv34CSvS

[Clare O'Neil MP @ClareONeilMP]

Credential stuffing is a type of hack in which cyber criminals use previously stolen passwords from one website and try to reuse them elsewhere.

This is just one more reason to use using strong &amp; unique passphrases for different accounts &amp; enable multi-factor authentication.