Hacker News Reader

Comment by benmmurphy | Hacker News Reader

> I think there’s literally no way for the backend to tell that the request isn’t sent by my browser and is actually being sent by a random Python program.

Oh my sweet summer child. Unfortunately, there is a whole industry built around this. This a great blog discussing different detection methods: https://incolumitas.com/

View on HN

The point still stands. The server can use any number of heuristics to try and figure out traffic source but (1) it is still an approximation, since they can all be spoofed, and (2) the more strict you make the detection logic, the more regular users are affected as well.

There's a way to make your point without being rude and infantilizing.

I think that interpretation is more on you than anything -- "sweet summer child" is not literally referring to a child but someone whose innocence or blissful ignorance hasn't been ruined by the can of worms they just opened.

It means those things precisely because the person is a child. In A Song of Ice and Fire winter can last over a decade hence "summer child", a young one that has never experienced the hardship of winter https://en.wiktionary.org/wiki/sweet_summer_child

Regardless, starting out with any variation of "you're blissfully ignorant" isn't needed either. I get offense usually isn't intended but the use of that phrase has always stuck me as a very condescending way to respond.

> I get offense usually isn't intended but the use of that phrase has always stuck me as a very condescending way to respond.

You recognize it's not meant to be offensive, but you want to treat it as offensive? Wouldn't it feel better to assume good faith and not treat it as offensive?

The same phrase spoken from one individual to another can be interpreted as offensive or not. Tom might say "Fuck you!" to Bill, but Bill is best friends with Tom and knows he's kidding, and laughs. If they didn't know each other, Bill would get offended. But either way it's just words. Tom's intended meaning doesn't change despite what Bill wants to assume the meaning was. It's up to us to decide to get offended or not.

that definition misplaces the origin of the phrase, "sweet summer's child" has been in use since the mid-19th century or earlier:

https://books.google.co.uk/books?id=mGQSAAAAYAAJ&pg=PA52#v=o...

It may not be the first time the combination of words was ever written but it's certainly the first time it caught on and based on the timings where it caught on from (book then show) https://books.google.com/ngrams/graph?content=sweet+summer+c...

It is simply a common phrase to refer to a naive and innocent person, it has nothing to do with Game of Thrones. Although I like how he used it, it immediately makes its meaning clear.

Here's that search without "Sweet": https://books.google.com/ngrams/graph?content=summer+child%2...

As a counterpoint, I take the phrase as a funny way of saying "you lucky person". I definitely see how it can come off as condescending, I just find the reference obscure enough that it's more funny than offensive to me.

Even if that were so, it strikes me as odd to characterise the author — one of the world's more accomplished software professionals — as blissfully ignorant.

I can't resist a rhetorical flourish :) The situation between defenders of the API and users of the API is extremely weird. If you were an alien from another planet and witnessed what was going on you would be shocked. People are being paid to prevent people from accessing an API and people are being paid to defeat these countermeasures. This is similar to people being paid to dig holes and other people are being paid to fill in the holes. I think the aliens would conclude there is something wrong with the economic system. I don't know what the solution is but seeing as I'm a digger I really don't want rock the boat :)

> People are being paid to prevent people from accessing an API and people are being paid to defeat these countermeasures. This is similar to people being paid to dig holes and other people are being paid to fill in the holes

Let me tell you about this little thing called tax accountants and the IRS...

> I think the aliens would conclude there is something wrong with the economic system.

These aliens are unfamiliar with adversarial systems?

Reminds me a a SciFi short story I read once where some aliens came to earth. Everyone thought they were amazingly smart, but it turned out they had just been working on their tech for a lot longer and were very dumb. The protagonist in the story figured this out, and sold them the Brooklyn Bridge...

> there is something wrong with the economic system. ... I'm a digger I really don't want rock the boat

My advice, based on experience: when you find yourself in this situation immediately start looking for a way off the boat. Urgently. It is rare for people on the boat to notice this before it sinks, and those few who do always seem to overestimate the supply of lifeboats.

Browser calls (and sessions) are indeed tricky to emulate - you'll generally have much better luck with reverse engineering mobile client API calls.

Totally agree. I used to work on a load testing product that spent many, many dev hours attempting to achieve a high degree of fidelity on web recordings at the HTTP and sometimes even the socket level of emulation. It was extremely tricky. We employed alot of regex matching mechanisms and used to keep a regression test bucket of thousands of example HTTP traffic recordings to avoid messing up cookies, headers, post data and query strings to name a few things.

In the early days, the developer abuses around ASP view state payload were an absolute nightmare to deal with. I used to half-joke that I could speak HTTP after staring at the raw traffic and how 5 page loads could generate 100+ requests which had dependencies on one another.

Interestingly, there were also an interesting class of client-server bugs that only were obvious in recordings (e.g. multiple repeat HTTP head requests to check if a resource existed). Each object or library dev clearly had no knowledge that the function triggered just before also wanted to check if that resource exists. This resulted in a huge amount of redundant unnecessary calls because nobody coordinated and optimized at this level.

Fun stroll down memory lane.

any resources for that just like this post? I am going to google as well, but wanted something if people already had on the top of their head

Try the iOS Charles proxy app, it allows you to scan and inspect network traffic for most apps.

Her example code doesn't even set a user agent header, making it trivial to distinguish these requests from ones an actual browser would make.

Yup, she is using the Requests library which has a default header that explicitly states the request is coming from Python Requests library.

Perhaps the fact that there's a whole industry built around this instead of, you know, a couple of well-cooked solutions that everyone uses, implies that it's not possible and isn't going to be for the foreseeable future.

Well, in this case the existence of a whole industry built around this is a reflection of the fact that it's impossible to implement a single static solution to the problem. It will forever be a cat and mouse game.

Yes. And I think the great thing about her observation is the naive view is actually true in practice (to some degree...). It is very difficult to distinguish between a 'legitimate' user that is a human and a bot. At least without reverting to captcha's and if the benefit to subverting the captcha's is high enough then you can just get human's to solve the captchas.

Reply on news.ycombinator.com