Absolutely rampant. I think most communities that were still on the canvas day 2 and on either had a huge inbuilt following or resorted to bots.
I think Osu, the superstonk people and France probably were botting, but unless those bots were incredibly poorly written, I don't think were the cause of the sudden erasure - the bot code I saw shared most widely was definitely looking up which colour to pick based on the rendered colour code, and one discord I was in that was using it was definitely alerted to the white starting because the bots started erroring out for being unable to find the desired colour. I think it's more likely hostile bots were the cause of the swift erasure. If they're just picking a random or first colour to try wipe it out, they'd still function and contribute to swift deletion
That's interesting. I didn't look into the API in detail. I took one edit request and did "copy as curl" and played with that a bit (it's just GraphQL, and I enjoyed how some fields are "snake_case" and others are "CamelCase"). I was kind of surprised that I could reuse the various authorization headers between requests, I assumed they would really want to validate that you were actually using a browser and not replaying requests with curl, but it didn't seem to cause any problems.
I guess my underlying assumption that was completely wrong was that they wanted to avoid bots this time around. It doesn't seem like they did, and I don't understand why. On one side of the spectrum if you add some defenses then the people that break them are good people to offer a job to. On the other side of the spectrum, it's a lot more fun for humans when they aren't competing with machines. Having no bot mitigation just means the computer savvy users get to stomp on the actually creative communities. It makes me a little sad.
Oh, I don't know how many of the bots were actually using the API, versus just userscripts running in TamperMonkey/ViolentMonkey. The ones I saw were userscripts, so they were browser based.
They did try _some_ prevention, there was a guy running 20 accounts who had his timers escalate up to like 18000 minutes, and also if you placed too many black pixels in sequence you'd get errors for a while before you could place again. But it definitely didn't kick in until way too late.
Comments
Absolutely rampant. I think most communities that were still on the canvas day 2 and on either had a huge inbuilt following or resorted to bots.
I think Osu, the superstonk people and France probably were botting, but unless those bots were incredibly poorly written, I don't think were the cause of the sudden erasure - the bot code I saw shared most widely was definitely looking up which colour to pick based on the rendered colour code, and one discord I was in that was using it was definitely alerted to the white starting because the bots started erroring out for being unable to find the desired colour. I think it's more likely hostile bots were the cause of the swift erasure. If they're just picking a random or first colour to try wipe it out, they'd still function and contribute to swift deletion
That's interesting. I didn't look into the API in detail. I took one edit request and did "copy as curl" and played with that a bit (it's just GraphQL, and I enjoyed how some fields are "snake_case" and others are "CamelCase"). I was kind of surprised that I could reuse the various authorization headers between requests, I assumed they would really want to validate that you were actually using a browser and not replaying requests with curl, but it didn't seem to cause any problems.
I guess my underlying assumption that was completely wrong was that they wanted to avoid bots this time around. It doesn't seem like they did, and I don't understand why. On one side of the spectrum if you add some defenses then the people that break them are good people to offer a job to. On the other side of the spectrum, it's a lot more fun for humans when they aren't competing with machines. Having no bot mitigation just means the computer savvy users get to stomp on the actually creative communities. It makes me a little sad.
Oh, I don't know how many of the bots were actually using the API, versus just userscripts running in TamperMonkey/ViolentMonkey. The ones I saw were userscripts, so they were browser based.
They did try _some_ prevention, there was a guy running 20 accounts who had his timers escalate up to like 18000 minutes, and also if you placed too many black pixels in sequence you'd get errors for a while before you could place again. But it definitely didn't kick in until way too late.