How We Built r/Place (2017)

Very interesting post.

Where can we find posts like these — e.g. architectural and technological analysis and decisions in real word contexts?

From the linked article:

> The API should be generally open and transparent so the reddit community can build on it (bots, extensions, data collection, external visualizations, etc) if they choose to do so.

They specifically made r/place (at least in 2017) to be easy to bot. Without botting I don't think individual users could coordinate well enough against spam to build some of the more complex art.

What did the bot situation look like this year? I know that the stock-related areas and Osu! were accused of botting (and faded to white very quickly when Place ended last night, sort of confirming the accusations), but it seemed like coordination through popular streamers seemed to cause the most aggressive edits to succeed.

I initially imagined that communities that cared to bot would have some sort of coordination server, and users would add compute power to that from their local machines. The local thing that each user ran would get a pixel to change from the coordination server, then use their auth credentials and IP address to make the edit. Reading some comments below, though, it seems like there was no IP rate limiting and no requirement to use an active account. So instead of needing a coordination server, I'm guessing that interested users just made a lot of accounts and cycled through them locally to make the desired edits. Does anyone know for sure? (The main reason I didn't bot this was because I assumed having a pool of residential IPs and high-karma accounts would be mandatory. I guess I was wrong, though!)

Some other comments below imply that this was an intentional decision to boost user numbers before an investment round / IPO. I hope the investors that are looking to get in on that get access to the database to determine whether or not the numbers are legitimate. I'm surprised investors are OK with spam accounts being counted as legitimate users. They aren't going to buy anything that's advertised or invite their friends ;)

Absolutely rampant. I think most communities that were still on the canvas day 2 and on either had a huge inbuilt following or resorted to bots.

I think Osu, the superstonk people and France probably were botting, but unless those bots were incredibly poorly written, I don't think were the cause of the sudden erasure - the bot code I saw shared most widely was definitely looking up which colour to pick based on the rendered colour code, and one discord I was in that was using it was definitely alerted to the white starting because the bots started erroring out for being unable to find the desired colour. I think it's more likely hostile bots were the cause of the swift erasure. If they're just picking a random or first colour to try wipe it out, they'd still function and contribute to swift deletion

That's interesting. I didn't look into the API in detail. I took one edit request and did "copy as curl" and played with that a bit (it's just GraphQL, and I enjoyed how some fields are "snake_case" and others are "CamelCase"). I was kind of surprised that I could reuse the various authorization headers between requests, I assumed they would really want to validate that you were actually using a browser and not replaying requests with curl, but it didn't seem to cause any problems.

I guess my underlying assumption that was completely wrong was that they wanted to avoid bots this time around. It doesn't seem like they did, and I don't understand why. On one side of the spectrum if you add some defenses then the people that break them are good people to offer a job to. On the other side of the spectrum, it's a lot more fun for humans when they aren't competing with machines. Having no bot mitigation just means the computer savvy users get to stomp on the actually creative communities. It makes me a little sad.