That's interesting. I didn't look into the API in detail. I took one edit request and did "copy as curl" and played with that a bit (it's just GraphQL, and I enjoyed how some fields are "snake_case" and others are "CamelCase"). I was kind of surprised that I could reuse the various authorization headers between requests, I assumed they would really want to validate that you were actually using a browser and not replaying requests with curl, but it didn't seem to cause any problems.
I guess my underlying assumption that was completely wrong was that they wanted to avoid bots this time around. It doesn't seem like they did, and I don't understand why. On one side of the spectrum if you add some defenses then the people that break them are good people to offer a job to. On the other side of the spectrum, it's a lot more fun for humans when they aren't competing with machines. Having no bot mitigation just means the computer savvy users get to stomp on the actually creative communities. It makes me a little sad.
Oh, I don't know how many of the bots were actually using the API, versus just userscripts running in TamperMonkey/ViolentMonkey. The ones I saw were userscripts, so they were browser based.
They did try _some_ prevention, there was a guy running 20 accounts who had his timers escalate up to like 18000 minutes, and also if you placed too many black pixels in sequence you'd get errors for a while before you could place again. But it definitely didn't kick in until way too late.
Comments
That's interesting. I didn't look into the API in detail. I took one edit request and did "copy as curl" and played with that a bit (it's just GraphQL, and I enjoyed how some fields are "snake_case" and others are "CamelCase"). I was kind of surprised that I could reuse the various authorization headers between requests, I assumed they would really want to validate that you were actually using a browser and not replaying requests with curl, but it didn't seem to cause any problems.
I guess my underlying assumption that was completely wrong was that they wanted to avoid bots this time around. It doesn't seem like they did, and I don't understand why. On one side of the spectrum if you add some defenses then the people that break them are good people to offer a job to. On the other side of the spectrum, it's a lot more fun for humans when they aren't competing with machines. Having no bot mitigation just means the computer savvy users get to stomp on the actually creative communities. It makes me a little sad.
Oh, I don't know how many of the bots were actually using the API, versus just userscripts running in TamperMonkey/ViolentMonkey. The ones I saw were userscripts, so they were browser based.
They did try _some_ prevention, there was a guy running 20 accounts who had his timers escalate up to like 18000 minutes, and also if you placed too many black pixels in sequence you'd get errors for a while before you could place again. But it definitely didn't kick in until way too late.