So, I got 5000 kudos in 12 hours, evenly distributed across all my fics, in a small fandom deep in hiatus. Obviously, these are fake, there just arenât that many readers, and some of these stories are niche oneshots posted a year ago.
Iâm sure some of you have noticed or experienced it yourselves, but I havenât seen any posts about it on here, and this kudos bot has hit our little fandom HARD over the last few days. Every other newer fic is affected, although not all to the degree mine have been, some experience bursts of 40-100 kudos on a single fic. This is just a psa, if this happens to you, or youâre confused with the numbers you see with others. The writers themselves are not doing this, itâs a third party.
I do NOT want these kudos, theyâre meaningless and not reflective of real reader interaction, and it feels really shitty to have these forced on you. This is not harmless, certainly not to me, but not on a larger scale either. 1) It makes it impossible for me to gauge my real stats, itâs hit every single one of my fics. 2) itâs demotivating because itâs burying the real guest kudos, I donât know if any of them were real so I canât be happy about them. 3) itâs unfairly promoting my fics relative to others, which I feel horrible about. Kudos is the most common metric for readers to sort by, and I donât want to benefit at the expense of others. 4) Itâs undermining the system at large, making kudos a useless metric by which to judge stories. 5) I worry people will suspect me of doing this myself and that I look dishonest, and itâll be at best a reader-deterrent and at worst get me reported.
Ao3 is not able to do anything at present, was the response I and many others got. I understand itâs run by volunteers and resources are limited, and this post is not meant as a complaint. But I wanted to show the scope of this, because in a small fandom, this is a massive impact, fics donât GET that many kudos, and itâs already at a point where kudos are meaningless, just a few days into this. And the bot is still at it.
Have other fandoms been hit this hard? Is it just less visible in larger fandoms? Iâve talked about it in discord servers and reddit and not gotten much response from outside the tdp fandom, but enough to know that itâs not EXCLUSIVE to tdp.
The bot hit my fandom too (Mass Effect). I've done some research, and it appears to have struck several fandoms over the last month. My fics haven't been hit (yet), but it's obvious on new fics because the bot doesn't leave a proportional number of hits. It seems to have hit all fics posted/updated over the span of 12 hours or so. From Facebook group discussion, it sounds like it's usually random, so there may be other older fics that also got hit. I'm not sure.
It's really baffling why anyone would create this bot. Mass Effect is a relatively small fandom, too, though I don't know how it compares to TDP. Getting 20-60 kudos is impactful on these smaller fandoms. I don't know if it's someone trying to be nice, or someone trying to overload AO3's kudos storage. If it keeps attacking AO3, it's going to make guest kudos meaningless and maybe even cause the option to be removed.
Weâve seen both older fics and newer fics hit. It does seem to disproportionally hit newer fics, even taking into account that the effect is more visible on newer fics. Itâs hit stories with 1000+ existing kudos and stories with 3. Itâs hit long stories and short. All ratings and tags.
It seems to strike in different ways, so there may be multiple bots running in parallel. Sometimes it hits a single fic, sometimes an author, hitting all their fics at once and usually fairly evenly, as happened to me.
Itâs hit me five times total now, twice on all fics, three times on single fics. 7000+ total bot kudos, at this point more than my real kudos count. So kudos are very much a meaningless metric in our fandom at this point, itâs hit at least every other new story, but not evenly, some fics get 50 and some 300, when hit.
I haven't been following the kudos bot issues very closely, but based on what people are saying, I'm wondering whether this is actually a kudos bot, or perhaps instead a completely unrelated web crawler with an unintended impact.
(For context: Hi! I'm a Computer Science grad student who's been semi-lurking in the TDP fandom for around a year and a half now! Web crawlers are not specifically my field of study, but I do study computer systems and infrastructure; this means that web and networking infrastructure is something I deal with a lot, so I'm hopefully qualified to comment on this.)
As folks have been saying, this bot doesn't really make sense. Why would someone spam kudos everywhere if they're just trying to be nice? It doesn't take much thinking to realize that authors wouldn't appreciate this. If instead someone wanted to overload AO3's kudos system, that ALSO wouldn't make sense, because storing each individual kudo is cheap; even if each kudo required an entire kilobyte of storage space on AO3's servers (which seems unlikely), you could still store a billion of them on a single terabyte hard drive for a couple hundred dollars. Even if someone's goal was to sew chaos in a specific fandom, it still doesn't make sense, because if you wanted to do that, you'd probably focus on boosting low-quality and controversial fics, not on distributing your kudos completely arbitrarily.
Yet, the bot that's doing this is clearly being run intentionally, so there must be an explanation. How do we know that it's being run intentionally? Well, consider the fact that some fics have gotten around 300 kudos in a short span of hours. Since AO3 guest kudos are distinguished by IP address, this means that someone had to have access to 300 distinct IP addresses during that time. Normal people do not have the ability to administer networks with that many IP addresses, and when they do, it's for a business or operational use that would preclude using those IP addresses for something like submitting Kudos on AO3. It's much more likely that these IP addresses are being rented from an elastic computing platform, such as Amazon Web Services or an illegal botnet.
Now, I don't have access to pricing information for any illegal botnets, so I plugged in 300x 1 vCPU 1 GiB instances into the AWS pricing calculator and selected the standard on-demand cost for renting 300 t4g.micro instances. It comes out to about 1,800 USD per month. Yikes! While there are plenty of ways to lower this cost, especially if you don't need to be spamming kudos around the clock, the point is still that running a bot like this on hundreds of machines is expensive. You spend that much money if you have a business, legitimate or illegitimate, not just because you feel like doing it.
Nobody is going to run a bot for thousands of dollars a month (or even hundreds of dollars a month if they found ways to be cheaper) without really intending to do it. But also, I would be shocked if anyone cared enough about messing with AO3 kudos to spend that much money, either.
Of course, the question now is -- if it's not someone targeting AO3 specifically (this is not guaranteed, of course, but seems probable to me), then who is doing this, and why?
Well, there's an anecdote about a small business that I remember reading a long time ago that might be relevant. I cannot find the original article, but it goes about like this:
There's a small business who has a public-facing website that's running a custom content management system (CMS). (Note that a CMS is a particular type of website code used to make the website be easily managed by people who aren't programmers. Wordpress, for example, is a CMS, and you can theoretically even use Tumblr as a CMS if you have low standards for your business.)
They had a programmer on staff who implemented that CMS themself, including designing all of the web pages and the backend software. This meant that it hadn't been widely tested by other people outside of the company, and had some bugs.
In order to make it maintainable by anyone at the company, all of the other employees had access to the backend of the website, which included options to create, edit, and delete pages on the website.
One day, out of the blue, every single page on their website was deleted. Everyone panicked!
Luckily, they had backups, so they restored the website.
The next week, everything was deleted again! And everyone panicked, because this happening once is a terrifying fluke, but twice is a pattern that implies it will happen again!
As you can guess, it's rather terrifying for a small business to lose their entire website when their very existence depends on their website.
After extensive investigation, this is what an expert found: somehow, every single delete button for every single page had been pressed by an anonymous user.
How? Well, it turned out that one of their employees had accidentally copy-pasted a link to their backend into one of the visible pages of their website. As it turned out, the delete buttons on that backend page were implemented as simple links, which meant they looked to the computer to just be random hyperlinks that could be clicked to visit a new page. (And it just happened that visiting that "new page" also caused something to be deleted.)
A web crawler from a major search engine (like the crawler that Google uses to visit and index the entire internet so that they can offer search results for everything) had randomly visited the main page of their website, and then visited the page that happened to have the link to the backend, and then visited the backend itself, and then tried to visit each one of the deletion pages in turn.
It did this because, of course, it was just programmed to visit everything it could and record everything it saw for the search engine to look through later! And that meant clicking on every link, including all of the deletion links!
The morals of this story (which I was taught as a young budding web developer) were that a) you shouldn't use simple links to indicate actions (you should use forms, or at least hidden forms, instead), b) that you should always require authentication to perform administrative operations, and c) that you should think about the impacts of what would happen if a web crawler visited your site.
Now, AO3 actually knows what they're doing, unlike the programmer in this story. The Kudos button is, in fact, a form behind the scenes, which is a good way to implement this:
This is a good way to make a kudos button, because it a) requires the client to submit a form with a POST method (something regular and polite web crawlers, like the ones used by major search engines, know they shouldn't do), and b) requires an authenticity token (a long string of random data) to verify that the user was someone who actually loaded the fic's main page.
However, even though an ordinary polite web crawler from Google or Bing or such wouldn't submit this form (and therefore wouldn't randomly add kudos), a broken or intentionally malicious web crawler might do so. Why would it do this? Well, the web is constantly being crawled by all sorts of less-than-honest people. They're looking for social security numbers to steal, phone numbers and email addresses that they can send spam to, comment sections they can fill with advertising, and all sorts of other things. And web crawlers used by spammers, in particular, are very likely to submit random forms, usually with long paragraphs of text advertising dodgy over-the-counter medications, in the hopes that the website will publish that data on its website in a comments section. (Though, of course, there are other people who might write web crawlers to submit forms for other reasons as part of crawling the internet. This is just an example.)
Now, let's think about the observations of which fics have been hit. Folks have reported that sometimes it hits all the fics of an author, or sometimes hits the most recent several hours of fics in a fandom, or sometimes hits several fics within a particular specific tag.
The thing these all have in common is that, for each category people have described of "what gets hit at once", there's a specific AO3 web page that probably contains links to all of those fics that get hit. There are the main pages for each fandom (which tend to start with the most recent several hours of fics), there are author pages for each author (which have all of those author's fics), and there are tag pages for each tag (which have a bunch of the fics under that tag). Those all have very neat lists of links to lots of different fics in that category... and when a web crawler sees a long list of links to traverse, it will often traverse all of them! And then might submit the form it finds on each such page, not realizing that it's a kudos form and won't actually display any spam text.
(It seems to me that it would likely also submit the comments forms, but it's a lot easier to identify a spammy comment than a spammy kudo, so I wouldn't be surprised if AO3 were already managing to deal with those without us knowing.)
Also, web crawlers for search engines tend to target pages that are linked to the most by other pages, because those are the pages that are most likely to contain important and interesting content. It's possible that other web crawlers would also have the same property, either intentionally or unintentionally, which would help explain why these particular pages are visited so much: there are lots of links to each author page, and lots of links to each main fandom page, and lots of links to each tag! So these pages would be prime candidates for a crawler to traverse.
Now, the big open question here is: if these kudos were caused by a web crawler, why is it submitting the same form several times? Shouldn't it only try once, see that the request doesn't bring it anywhere new, and then stop? This is one of the things that this theory doesn't quite explain; one possibility is that, since each independent visit to the same fic page produces a 'kudos' form with a different authenticity token, the crawler might assume that these are different forms, and might go different places, and therefore is willing to try each one many different times. Another possibility is that each of the crawler's computers don't actually communicate with each other, and therefore don't realize that other computers have already tried submitting the kudos form.
The point of all this is: the behavior of this bot doesn't sound to me like it's a bot intended to create lots of fake kudos. I wouldn't rule out the possibility, but it just doesn't make sense to me. Instead, I wonder if it's more likely that there's a random web crawler that happens to be causing this effect entirely by accident.
If this were caused by accident, then it might be possible to AO3 to block the specific web crawler, though this would depend on exactly how it's implemented; if it were implemented in a botnet, then this would be a lot harder, because each of the computers generating the fake requests would be normal computers used by real people, and therefore hard to distinguish from those people visiting AO3 themselves and clicking on the 'kudos' buttons as guest. If it wasn't targeting AO3 in particular, changes by AO3 would disrupt its impact on AO3, but the creator of the crawler wouldn't care; it's not like pressing the 'kudos' button a lot of times was actually helping them send out spam (or whatever they were trying to do). If this were an AO3-specific kudos bot, by contrast, it would be easy for them to keep adjusting their code to avoid any enforcement mechanisms implemented by AO3.
So, how could this hypothesis be tested?
Well, if this is an AO3-specific bot, it is going to have AO3-specific intelligence. But if it's not, it's going to (most likely) be following all sorts of random links it finds. It might be possible to insert an external link into the notes of a fanfic targeted by the bot that directs the bot to an external honeypot webserver. (A "honeypot" is a computer designed to convince hackers or automated bots that it's a real computer, even though it's carefully tracking everything they do for information-gathering purposes.) That honeypot webserver could display a fake copy of an AO3 page, with a fake kudos button, and record in detail everything about every single request made to it by any clients.
If this weren't an AO3-specific bot, it would likely proceed to spam the fake kudos button on that external website hundreds of times, each one providing the web server with exact information about exactly where each of the requests was coming from. This information could be used to help identify who was responsible, or at least tell us whether there was any easy way to distinguish those fake requests from real ones. If it were an AO3-specific bot, it would never click on that external website, because it would look at the URL and recognize that it wasn't actually AO3.
Testing this hypothesis in this way would require:
Someone to write (or repurpose) some existing honeypot code for the external server to use
Someone to rent an external server (possibly a cheap one via a cloud platform) to run the honeypot code (or to reuse an existing server they already have access to).
Someone to be willing to insert a link to the honeypot in the notes of one of their fanfics. (Or multiple fanfics, preferably, because the more places the link shows up, the more likely it is that a crawler would go to it. Basically, you would be trying to have the crawler hit a fic while the link was visible in it.)
Of course, there's no guarantee that this would actually give accurate results; it's possible that the crawler would arbitrarily decide not to visit the external domain (perhaps because it hadn't seen it frequently), and it's also possible that (if this were an intentional kudos bot) the person running the bot could intentionally feed bad information to the external domain (thus making it look like it was a random web crawler when in fact it was intentional). So I'm not going to say that this is something people should do; I'm mostly mentioning it as one possible thing that could be attempted by a group if they wanted to do that.
Really, at the end of the day, the best way to solve this would be for AO3 to investigate, because they're the people who can actually look at what's really happening on their servers. Unfortunately, they're sufficiently short-staffed that I doubt this is going to be done, but people could always try to convince them that this is worth their time to try to solve.
this is a bit different from my usual content iâve posted on here but!! iâve made playlists for the mystic messenger characters (excluding vanderwood, for now?) and i wanted to share them!! i tried very hard to make them fit each character and just sound good! theyâre all only 10 songs for now but iâll be adding to them when i can!! i hope you enjoy!! and if you listen to any please let me know your thoughts in my ask or the tags!! Ëâ· ÍÍÍÍâłâ„
JAEHEE KANG
â âthe others, they don't have the same effectâ / playlist link
JUMIN HAN
â âsweet knowing that i love youâ / playlist link
SAERAN CHOI
â âwhat lies beyond the ruby fields?â / playlist link
SAEYOUNG CHOI
â âyou are the problem. you are the traffic.â / playlist link
V / KIM JIHYUN
â âif all the world remains this shade of blueâ / playlist link
YOOSUNG KIM
â âiâm a man in an unmade bed, breaking apart every word you saidâ / playlist link
ZEN / HYUN RYU
â âitâs the thought of you that slightly scares me, but takes my breath awayâ / playlist link
BONUS PRIZE: RIKA KIM
â âcause i could be your goddess, iâm waiting in the gardenâ / playlist link
My very late entry to day two of @jaeheeweek22ââs event!
Youâve only just moved into Jaeheeâs apartment. The last box hasnât even been unpacked yet, it has just been sitting in the living room, waiting to be remembered. Your excuse is that youâre too busy to do it. The truth is that you want this new feeling to last. You want the last box to be memorable, you want to make the last thing you unpack special, youâre just not sure how to do it yet. You want to remember the very moment her space became your shared space.
You have loved every moment of living with her so far. You love waking up next to her and finding that she has tucked herself up against you and nestled her head in the crook of your neck. You love that you no longer have to get dressed and leave at night, but that you can leave your clothes exactly where she dropped them and worry about it tomorrow instead. You love that this feels more like home than anywhere else ever has.
You have also enjoyed learning about her little routines. Each day might be a little bit different from the last, but she always starts her morning the same. After her alarm clock goes off, she shuffles off to the kitchen to make her first cup of coffee. She does it by muscle memory, eyes barely open, but itâs somehow still perfect every time. Until that little ritual is done, she wonât hear or remember anything you tell her (youâve learned from experience). After her first sip, she will open her eyes properly and focus on you, though she wonât offer more than sleepy halfhearted answers to anything you ask.
Making tea is a ritual too, just like in the morning with her coffee. After you return home from work and get comfortable, you pick out a flavour of tea to try out that night. You read the label out loud for her so she can give her input, and as the water boils, you measure out a teaspoon of honey for each mug.
This is usually when she will join you in the kitchen and take the teaspoon from your hand. Youâve only recently learned of this little quirk of hers, but she always likes to finish whatever is left of the honey on the teaspoon. She watches you finish off the tea with the spoon in her mouth, already anticipating snuggling up on the sofa with you with your hot drinks.
Before you hand her her mug, you always lean in to kiss her, and you relish the sweetness that lingers on her lips.
janainaart
jbbartram-illu
dededos
origamiaround
romaincrisis
ellievsbear
snowghoul
