Getting Beaten By A Voting Bot In 50 Minutes | Hacker News Reader

Getting Beaten By A Voting Bot In 50 Minutes

blog.padmapper.com

214 pointsericd77 comments

On Apartment List's blog, they are claiming that they asked voters to forward their confirmation emails to them, so that they could confirm votes right before the voting ended: http://blog.apartmentlist.com/the-2012-peoples-choice-webby-...

Based on the dating, it looks like it was posted before this PadMapper post.

Hm, interesting. I asked the Webby Awards to investigate before the voting was over, and this was written around that time - I've just been sitting on it, waiting for more info.

I sort of doubt that that explanation is legitimate, since they didn't publicly ask people to do that on any of their voting campaigns and I think the voting volumes were high enough that a secret campaign using friends of friends wouldn't have been able to cause this kind of swing. The Webby Awards admins would likely have the original voting times, though, and if that's actually what it was, I'd say it was a neat hack.

Well that's interesting. You imply some collusion between AL and the Webby awards. I wonder what the official Webby awards folks will say. Maybe the whole thing was 'fixed' -- and they went dark to just set it to the outcome they wanted? Sounds like the simplest explanation. Anyway, good detective work. Will be interesting to hear how things pan out.

Oh no, I'm not implying collusion. I was just saying that only the Webby Awards have the original voting time data, and that if AL's explanation was truthful, I would be impressed that they pulled that off successfully. Sorry if those two things got mashed together.

That's bizarre. Can any AL users confirm this?

yes I can confirm.

I believe you.

Wait, no.

Screenshot of their call-to-action on this?

Do you know anyone else who can confirm who has been on this site for a while, or at least give some details? No offense, but a confirmation from a user on their first post just after creating the account is not exactly convincing.

Haha, that's the most transparent bullshit I've ever seen.

Agreed that sounds like bullshit, but assuming they did in fact plan to win the vote in a way which looks exactly like cheating but which turns out to be unorthodox but legitimate, we've got an early contender for marketing gambit of the year.

Heh yeah, I would be pretty impressed if it was legit. The main problem would be getting a large number of people to remember and agree to jump through those hoops instead of just confirming it when they got it. Pretty interesting.

Seems to me you'd lose too many people to "Just Too Hard" syndrome for the strategy to be worth using too.

Yeah, if they don't win a Webby, they still might win a Douchey.

Not just marketing gambit, but mind control as well - people who do this kind of voting aren't going to go for the additional hurdle of redirecting their stuff... yet AL seems to have forced a ton of them to do just that.

Sometimes a cigar is just a cigar.

Google cached the page on Apr 27 as well with the same content... so it appears Apartment List didn't put up a fake date.

http://webcache.googleusercontent.com/search?q=cache:euCfseP...

If that is true, how did they have any votes up until the last few hours?

people who didn't read/didn't follow the directions.

There should be lots of AL users who can produce the exact email plea asking them to

  1.) Read and comprehend complex / sketchy instructions
  2.) Take the trouble to vote
  3.) Not instinctively click the confirmation link
  4.) Actually forward a personalized, coded email back to AL?!?

That also means AL is not disputing that a huge number of confirmation requests ultimately came from their own machines.

Extraordinary claims require extraordinary evidence -- certainly the burden of proof is on them!

(Edit: so far the only AL user to step forward created a new account 3 minutes ago)

Sounds like the kind of story an attorney would concoct after the fact.

Where are the Apartment List supporters coming from? They only have around 300 followers.

EDIT: Could it have been Mike Larsen that caused the swing? https://twitter.com/#!/Marleybonez/status/196998708292894720

Seems really unlikely, as there is no mention of the "forward your email confirmation" scheme anywhere related to this video.

There are also only 26 likes on the video; if someone was motivated enough by the video to go vote, there's at least a decent chance that he would like the video as well.

I noticed a lot of those tweets promoting the video contained the word "Advertisement" - anyone know where those come from?

As peer comment mentions, though, there's no mention of the confirmation scheme on that video or the related site (assuming no retconning).

http://spnsr.tw/ kicks you to http://sponsoredtweets.com/ so I'd say it's them.

Ah nice, thanks. I probably wouldn't use that, but it's always nice to find out about the tools of the trade.

It's clever that this will explain why all the votes come from the same IP.

Convenient, too for AL.

A conspiracy involving that many people that did not leak at all? Very unlikely.

Welcome to the wonderful world of awards. As you'll find out pretty quickly if you keep going for awards, what happened to you here is nothing more than business as usual. The immense majority of awards out there are 100% bullshit and completely meaningless.

The ones that rely on public votes are very obviously always worthless but the ones relying on a judging panel are, in their vast majority, just as meaningless.

This is actually why entering awards is a great strategy for cash-poor startups who can't afford to pay a PR person. Anybody can win awards. In fact, I haven't personally tried that strategy, but I'm certain that you don't even need to have a product, or a business at all, to win awards. Put together a pretty looking web page for a non-existent product, write a convincing enough description, enter a few random awards and, soon-enough, you should be the proud owner of an award-winning non-existent product.

There are two reasons why it's worth spending a few minutes from time to time entering awards as a startup:

- Many people don't understand how awards work and believe that they actually mean something (well, they do mean something: that you're better at winning awards than your competitors). So having an award-winning product does increase your credibility with clients.

- More importantly though, the reason people organise awards is generally to generate PR for themselves. So they'll generally have a PR company lined up to make sure that the award gets covered in the media. Which in turns means that the winners get free PR. And that, for a startup, is priceless.

If you visit the Youtube link posted on the Ap. List blog post (http://www.youtube.com/watch?v=9qY9dAhsWZg&feature=playe...) You'll notice a lot of posts saying they were sent by Ty Moss, Kenny Powers etc. I'm assuming these were sponsored plugs and might have effected the outcome(?). But you'll also notice in the youtube description a link to this page: http://www.aTrueUnderdog.com which in turn points to this page > http://www.organizer.org/webby9.htm which in turn points to the webby ballot. WTF is going on there and who is http://www.organizer.org?

EDIT: Apparently the domain belongs to Denis Grosz (http://grosz.com/about) who is on the Ap. List team...http://blog.apartmentlist.com/about/

EDIT #2: I just had a thought...Grosz may be attempting to increase clicks through the organizer url to make it appear more valuable.

Well noted, though it doesn't seem malicious unless the url http://pv.webbyawards.com/ballot/46 casts a vote directly (can't check since it's offline).

No that link wouldn't have voted directly. It would have been the index link for that particular award category. I agree it doesn't appear malicious, just odd.

all there is on that organizer.org redirect page is google analytics - it appears that this was used to track clicks. looks benign.

Yep. Looks like the number at the end of the URL denotes where the user is being tracked from. There are several links that all function the same way: organizer.org/webby8.htm, organizer.org/webby2.htm, organizer.org/webby3.htm, organizer.org/webby4.htm, organizer.org/webby5.htm, organizer.org/webby6.htm etc

Ah yeah, I guess this would handle tracking of the original source if the link happened to spread.

Maybe the redirect is meant to launder the traffic and make the real source impossible to track? Organizer.org seems to be parked with made-for-google content relating to different types of "organizers". It's also possible that he was trying to pump up that domain's Google juice a bit by hopefully getting links from that made to be viral video, or that it was simply the domain he had easiest access to for putting up a redirect for traffic tracking.

Well looking at Mechanical Turk [1] it seems that Twitter manipulation comes in at about 5 cents a 'hit' so if a Webby was worth $25,000 to you, you could buy half a million votes. I was wondering if you could go 'back in time' but couldn't find that, to see if there was anything like this in it.

That being said, there are lots and lots of bots on Twitter [2]and given how easy it is to program one, and the fact that folks might pay for it, wouldn't you like to have a 'twitter army' in your pocket that for the right price could give you a shout out? Heck people do it with zombie PCs all the time.

[1] https://www.mturk.com/mturk/viewsearchbar?searchWords=twitte...!

[2] http://www.sysomos.com/insidetwitter/mostactiveusers/

At the risk of sounding naive, I still think that this kind of nonsense should be called out and not just some "norm" for online voting. The concept of consumer democracy has a lot of potential, and we need to keep objecting to bots and bought votes to make it reliable. Acceptance of unethical behavior just makes it more entrenched.

Oh I absolutely agree. In fact any sort of voting where the only authentication for the constituent is an email address should never be used for anything. It is entirely possible to fabricate a million users in the blink of an eye. Even ones that use a variety of web mail services (Gmail, Hotmail, Yahoo, Etc) Not to mention that its pretty trivial to set up your own domains and create mailbox farms with automated responses clicking on authenticating links.

I am speculating that this sort of abuse will lead to the emergence of a nominal digital ID implementation. A point where an individual will not be allowed to participate in some online activities that they might wish to participate in because their lack of proof that they are real, and unique.

but, why wait until the last minutes? when I cheat ... I mean, if I were going to cheat, I'd want to make it look good. So, I would spread the votes out over a longer period.

Procrastination. The contest deadline could have been a motivator.

A great motivator for the dev team, sure.

Not a great motivator for 'random' people.

The 'constant rate' allegation is serious, but given the number of 'votes' involved if there is any truth to the claim it should be trivial to suss out. Humans suck at cheating statistics. Even someone with a good model for human behavior in these circumstances isn't going to have a good handle on faking all the metrics picked up by third party web analytics in conjunction with server logs.

So, let's see what comes out of this.

Yeah, I'm very curious too. If the Webby Awards people ever respond to my request for them to inspect the data, I'll follow this up with any findings they share.

That is a great question. One could speculate, last minute idea "Hey this is close enough, I bet we could win it with ..." or a feint of obviousness, or any number of things.

The OP speculates a voting robot, however if you did it with Mechanical Turk which uses real people you might find that they procrastinate and only pick up tasks that are about to go off the lists or something. That would be especially true if price per hit went up as it approached the deadline, one could arbitrage the value vs the number of hits you could do in time to meet the deadline.

Yeah, I added MTurk as a possible explanation in one of my edits before putting up the post. It would be a more expensive, but harder to trace way to do the same thing - MTurk is effectively a human bot. One giveaway would be that most of those IPs are likely to come from outside the US, and since most of these sites only serve US (and Canada/UK in the case of PM), it'd be easy to tell that something was off if you knew that fact.

One reason to do it at the last minute is not to leave a chance for competitors to react, as demonstrated by the parent post actually: they saw promising results early on, relaxed and went for a nice dinner and just checked later.

How confident can you be that voting percentages found through a neat hack can be reliable? If the percentages were taken down, the Webby admins could have been doing anything during that period, under the assumption that those percentages wouldn't be seen (and therefor didn't need to be accurate).

Here's an alternate explanation to the events observed: The Webby admins started removing what they considered to be fraudulent votes during the blackout period. Most of these removed votes came from PadMapper and Zillow, which increased (linearly) Apartment List's percentage.

Full disclosure: I have no dog in this fight. I haven't used any of the services mentioned, and I've only really heard of Zillow.

Yeah, that's possible too. I ruled that out because they weren't going to announce for 5 days, so they'd have time to analyze/tweak the data after the voting was finished, rather than messing with the live data. Their tweak just removed a bit of data from the page, doubtful it was significantly different logic-wise. Even if Zillow and PadMapper were doing nefarious things, it's unlikely that they would have the same proportion of fraudulent votes while AL had far less, though - that would require coordination between PM and Zillow or some outside factor that would cause us to naturally cheat the same amount.

>started removing what they considered to be fraudulent votes during the blackout period

I doubt they'd begin this process while voting was still taking place.

Since you obviously wanted to win, sorry you got cheated, but at this point I think the only people who pay any attention to the Webbys are those who've paid to be "nominated."

Does anybody know how much the Webby folks charge for a nomination?

Haha I don't think you can buy a full nom, but if memory serves they charge either 200 or 300 as an entry fee per category. I think they get ballpark 10k entries for roughly 100 categories, and make 5*category# noms.

They make $2 million from entries only?

Slate thinks so, as of 2008:

  Even after allowing for discounted entry fees, the back of
  the envelope says the Webbys could be taking in more than
  $2 million from its contestants.

http://www.slate.com/articles/news_and_politics/press_box/20...

There might be sponsorships, and I think they also sell additional merch, and maybe tickets to the awards event. It's probably not cheap to organize.

So ApartmentsList knew they were going to cheat at the end, so they have one bot do everything required to vote, and towards the end, and then later have another bot go through and confirm addresses. And since they know they're going to be called out on their shit, they post a blog post telling everybody to forward the confirmations.

There's no way theyd be able to get a significant number of people to not only go vote, but then forward a registration email

Of course there's a way: if there were specific instructions on oDesk, and they paid per vote.

Here is an example: https://www.odesk.com/jobs/hours-facebook-votes_%7E%7Ef07c72...

Of course, any of these could easily be them; there are hundreds of anonymous posts paying for votes. It's so easy and common to scam online votes that it happens all the time.

Honestly - no-one pays any attention to awards.

(http://successfulsoftware.net/2007/08/16/the-software-awards...)

(http://www.guardian.co.uk/technology/2007/aug/23/guardianwee...)

Those two just say that it's easy to get fake awards. That's completely orthogonal to how much (if any) attention people pay to them.

Internet opinion polls are a complete waste of time. Imagine if you had spent the time wasted on this on developing a new feature or marketing copy. Things like the Webby awards are a way designed to separate you from the dollars in your marketing budget by pandering to your ego. The general public absolutely does not care, any more than you care about the Daytime TV Emmy awards (yes, such things exist).

Even if you don't care, I think the media does. The cost of entry was pretty low, though (200 or 300, I think) - certainly a lot less than any ad buy. And you get some great ego stroking if you win as a bonus :-)

Webbys? Why do you care about winning it? This is a joke of an award that doesn't mean anything at all.

An excuse to visit friends in NYC?

Apartment List just 'elaborated': http://blog.apartmentlist.com/webby-strategy-elaborated/

Note the distorted use of page view statistics to help put the explanation in context. If you have a look at Alexa you'll see padmapper gets substantially more traffic than Apartment List.

For the record I don't think they've used a bot, but I do think they've used outside(paid) help to generate votes.

Seems that it would be easy enough to get some voters to corroborate their claim (maybe some screenshots) rather than offer this non-proof elaboration?

A semi-related question: Isn't padmapper using a bot to scrape websites? Isn't it mapping craigslist, which specifically says, please don't scrape us, we don't want that?

Just wondering out loud some.

> please don't scrape us, we don't want that

Those are still murky waters. Copyright law allows the compilation of a third-party's data as long as you are creating something original with it.

Just because something is legal, doesn't necessarily make it a nice thing to do.

Collecting data using RSS feeds maybe (like several other startups here to collect CL data)? Much more benign to the servers.

Hopefully this will get some attention and they'll do some checking to get rid of fraud votes.

Your article has a HN counter next to the Facebook "Like," and Tweet buttons--where did you grab that from?

If you look at the html you will find a url to hnbutton.appspot.com, and if you hit it without any parameters you will get forwarded to:

https://github.com/igrigorik/hackernews-button

Good detective work! Saved me from having to look up the URL :-)

So basically AL is claiming they did a mass voting snipe?

Seems a bit disingenuous but then again Ebay bidding seems to have been this way for a while and now the strategy is moving to other areas if this is the case.

As is often the case with these awards, the only winner is the site running the contest. Other players in the game have incentive to send traffic to the site running the contest, who gets more traffic. Meanwhile, the sites being voted on spend lots of time trying to win, and in turn asking their users to spend their time voting.

Reply on news.ycombinator.com