how many people like free stuff
let's learn how to get free stuff with
twitter and Python let's give out the
next speaker began so you guys ever had
an idea that you tried and it works like
a hundred times better than you possibly
could have hoped this is one of those
ideas if I had to summarize this talking
one slide it would be this this is from
the movie real genius if you've never
seen it
Val Kilmer so good so my name is hunter
I'm a computer engineer and I work for a
startup in Silicon Valley that you've
never heard of
so this started when I was on twitter
and saw that there's a bunch of contest
and only have to enter them is retweet
them was like well i can write a script
to do that so I'm sure you guys have all
seen this comic it's the xkcd where he
writes a script to buy something on ebay
everyday for one dollar with free
shipping
the idea is that like you get all these
packages showing up at your house and
you don't know what's in them and that's
super fun and it kind of backfires on
him because at the end he gets put on an
FBI watch list because it buys all this
really suspicious stuff so this is kind
of what I was going for and it basically
works because it was actually better
because I didn't have to pay any money
and as far as i know i didn't end up on
any watch list because of this
particular project but I'm you know you
can never be sure
so here's the twitter account that i set
up you'll see that i really didn't try
to be stealthy at all
this is a default picture for windows
because i was too lazy to google for
anything else and it turns out you don't
have to be stealthy and this seems to
work anyway which is kind of interesting
so how hard could it possibly be
you look for contests and then you
retweet them and then you're done so i
started with the terms you might expect
variants of retweet to win and i was
using the twitter api just sleepy and
Python unfortunately the Twitter API has
a bunch of rate limits in it so this is
kind of lame because it means you have
to add a bunch of delays means you can't
enter as many as you otherwise would be
able to so the first thing I did to get
around this was rather than use the API
to search
I just scraped the twitter search
results page and this works because you
don't have to be signed in to use the
search page i gotta do is make your
request of whatever search term you want
as fast as you want and then used
beautifulsoup to go through and pull out
all of the tweets that looked like
contests and then I stored their unique
tweet ID so i didn't have to check later
to see if i had already reached that
because there's a lot of overlap between
search results as you start doing this
you'll notice that there's a lot of
contest that required to be following
the person to win this is a pretty easy
modification to make you just read X
against it and see if they ask you to
follow and if they do then you follow
them
the problem comes when you start
following about person number two
thousand because it has a limit that if
you don't have any followers are you
have a under a threshold number that you
have to you can't follow more than 2,000
people so okay I need more followers so
what's the easiest way to get more
followers by them
this is
this is fiber and this here is actually
a bad deal 500 followers for five
dollars i paid five dollars i got about
four thousand followers also i can
guarantee you that they are not real
twitter followers dislike so this works
okay i mean.they 4,000 people did
actually show up which was nice
unfortunately it's pretty easy to tell
they're not real people some of them
still had like the egg as their profile
picture and if you went into any their
profiles clear they're not real people
and I'm sure if you did any kind of
network analysis you would find that
they were all highly connected to each
other so at this point this is the
output of the script basically I'm just
have extended the number of search terms
now it's quite a few and by the end of
this i'm fairly confident that i was
covering almost every single contest
that was launched on Twitter so this was
a pretty long list of search terms you
just kind of guess and check to see what
people use when they're trying to launch
a contest so you go to the search
results eat looping through each time
and see okay is the contest if it does
have we already interested if not then
enter it
do we need to follow them that are we re
following them or not didn't follow so
to get around the follower problem i
just built a fifo is a pretty obvious
solution it's 2,000 people along and so
whenever we need to follow someone new
we kick out the very last person and pop
on the new first person and this had a
couple we'll get lucky and a couple ways
here first of all it turns out that the
length of a contest is shorter than how
long it takes one name to propagate all
the way down to the bottom of the list
which means I basically was never
unfollowing someone to early their
contest had already ended the other way
I got lucky was the total number of
contest that were launched on Twitter
was low enough that i was able to enter
every single one of them without hitting
up any rate limits once i implemented a
few of these tricks here and there is a
side effect here which is that I guess
it's some people when you follow them
they automatically follow you back
there's a lot of bought activity on
Twitter and scripts and services and
things I didn't realize how much there
was until i started interacting with
like thousands of these things but the
way it works is like you follow them and
they'll say oh great thanks to
automatically call you back but then
when you unfollow them later they don't
unfollow you back
so my follower count started increasing
with like increasingly legitimate
looking accounts companies and people
and stuff that were running
these things so I kind of got a bonus
there that I was the total number of
people that i was able to follow kept
going up as i did this so then I try to
figure out how I could paralyze this and
run multiple accounts at the same time i
should say that the majority of the time
that was running this i was actually
only using a single account but if you
want to make multiple this is what i try
to do so to use the twitter api you need
to develop our account which means new
phone number and so I need to get
another phone number okay i can use
google voice well to activate google
voice in your phone number
ok so i can use to Leo to make a phone
number to activate google voice account
to activate Twitter you can't use twilio
to activate twitter because Twitter
somehow knows you're using a twilio
number and now I think even google voice
knows if using its really a number i
don't know how that works so if you know
how they're able to tell that let me
know because it really curious how that
works over the course of doing this of
course a hell lot of interesting
interactions with the great Twitter
public
this was one uh that I got busted on
because this is what I was trying to box
and I had different twitter username but
i forgot to change the display name so
person was running an account running a
contest and they were picking multiple
winners and i won multiple of the winds
so yeah I got busted here and ditch this
one another really great thing that I
liked about this was some of the false
positives I got some things look like
contest but they're not so this guy says
retweet for a chance to win these
tupperware lids have been working the
dishwasher must be following so
dutifully my script followed them and
retweeted them and it actually won the
guy DNT was like hey man you want those
work temporarily list yes it was really
disappointing because you never actually
mailed in to me i was really hoping he
would mail into never did you get a lot
of weird interaction between other box
when you do this kind of stuff so this
is an example where someone is running
some kind of service that at the end of
the week on friday they tweet out the
top five people who retweeted you so
when you don't have that many people who
retweet you but you do have a bot
following you that's retweeting
everything that you tweet about your
contest and your script is not checking
to see if those people are the same then
you get all five slots so my breasts
retweets came from me and me and me and
me and me
you also get asked for really weird
stuff so the top one was someone i don't
know if this was an a script or if it
was like a person copying and pasting
but it was some like teenage girl who
was trying to get people to retweet to
get the attention of some like pop stars
you want to ask on a date or something
the fact that i was sent this makes me
think that I don't know maybe she would
like to think that it's unlike
fourteen-year-old girl slinging code
somewhere like trying to get a date with
this guy but I don't know the middle one
like super weird i don't understand what
this is
can you make it to my party April 27 7pm
where snow forts comma sleet like I
don't know if this is the seem like
there may be some kind of
spam or social engineering I don't know
what these are but they're almost
certainly all not real people
another than the bottom when there is
someone who is promoting my account I
have no clue why you want to be
motivated to do that this is a DM I got
fit
I thought initially oh someone something
like some rot 13 or something but no
this is just how the kids are talking
now so and this was a really good one
this is a someone who's contest the
prize was an autographed by me what
so I don't understand first we'll have
expected to pull this off i have no clue
who this person is and I don't
understand why anyone would be motivated
to win an autographed by what is very
clearly a like account that is only
sending out contest so I couldn't figure
out what the motivation behind this one
is either but it was surprising to run
across sometimes my bot was actually a
jerk like in this case is because of the
fifo this person doesn't have a lot of
followers and they ran a contest I
entered because i found it and then I
didn't win so they got pushed off the
bottom later they ran another one so I
followed them again and like if you're a
big company you don't notice this kind
of stuff but you're just like a person
they're like oh man they play this
person is only in it for the contest
so sorry man who you are but this is
another one of my favorites
it looks exactly like a contest except
for you went absolutely nothing
so yeah I entered that 12 only entry
here's one more false positive i
couldn't figure out why my bot entered
this is a list of people like favorite
cereals what i figured out i think it's
because we're lucky here even though I
wasn't actually looking for just the
word lucky for some reason i picked up
the reason I'm showing these false
positives because I was not trying to
like hone in on any particular context
or any particular prize anything because
i was able to enter everything I could
find like why not you don't make your
filter wide open
you can't lose a contest that doesn't
exist but you can lose the contest that
you don't find so here is a list of
stuff that actually got shipped my house
i should point out that this is the
stuff that managed to shift which means
it's not a huge list of stuff that
wasn't physical as not the list of stuff
that they wouldn't ship because i love
the United States and I'd won the prize
in some other country so some of the
some items to point out here the top
thing there is a an album two vinyl Papa
Roach pretty great bunch of books and
cds most which were signed which is cool
t-shirts a lot of like stuff you would
kind of get at like a career fair you
know glasses and pens and stuff like
that
twelve bottles of cherry juice a
calendar of 365 cats and my favorite
physical thing that I got was that
cowboy hat over there because that is a
cowboy hat is signed by the stars of a
Mexican soap opera that I've never heard
of before
the reason i love it is because it's
like the perfect example of a totally
random stuff that showed up at my door
that I would never have expected to get
some people like when i wrote about this
we're saying you know it's kinda lame
because maybe there was someone who
liked was a huge fan of that mexican
soap opera and like they didn't get that
thing and you did and it's wasted on you
and like I understand where they're
coming from to some extent the right but
i would say that i have exactly the same
amount of appreciation if not more for
that thing they do but for a totally
different reason
so I think that's okay there's a lot of
weird intangible stuff I got to there
were some restaurant in England that I
want reservations to like 30 times in a
row can figure out why they weren't
getting onto me also won a there were
some like cam girl who had a contest to
win should write whatever you want it on
her body and chocolate sauce and take a
picture and send it to you so I want and
so I'm trying to think
all right what can I have a right to try
to go to right the maxwell's equations
but she didn't do it was kinda lame if
you wanna see the full list of stuff is
it there's a ton of stuff on here that I
didn't cover because it's way too long
but it's fun to dig through there
there's some really random stuff so
towards the end I tried to repurpose my
bot for good because I noticed that
there were some tweets where you would
retweet to donate to stuff people say
retweet now donate a dollar to security
was like well i can add that to the into
the list why not
so some people like actually appreciate
and they're like hey this is great
because i had real followers at this
point we're seeing it but even this
backfired at the end unfortunately
retweet of that one
alright so the the stats at the end here
i entered about 265,000 contests and on
average I 14 comments per day every day
for nine months straight
so this works
the most valuable thing I one was a four
thousand dollar trip to Fashion Week in
New York City i did not actually regime
this prize because first of all they
didn't pay for travel and I didn't live
in New York second I wasn't that
interested in going to Fashion Week
anyway and third of all you have to pay
taxes on four thousand dollar prize
which I was not selective about you're
not from the US you may be surprised to
learn that you have to pay taxes on
contest winnings the United States and
speaking of that
yes I pay taxes on the things that I
want I never released the code for this
in what may have been a futile attempt
to try to stem the flow of twitter
contest spam but I wrote about it and
people made their own version anyway so
there's a whole bunch on github if you
want to look at some most of them are
fairly naive i still get email sometimes
people like a man i try to make a
version of that python script and i got
banned immediately like well yeah so if
you if you look through some of these
there there are some things that in this
talk that I don't think a lot of them
implement that you could probably
improve if you wanted to
so if you want to keep me from winning
contests
it's really simple obviously I was not
trying to do this stealthily and it
turns out that didn't really matter so
if you're trying to prevent this kind of
people from winning then i gotta do is
check to see if the person looks very
obviously like a spambot if you would
have gone to my page you would have seen
that it's tweeting contest every 30
seconds without sleeping ever it's
probably not a person
weirdly their version of this that i
found i was looking before I started to
see if anyone had tried this before and
I know there's at least one or two
people who are doing extremely stealthy
version of this and because i don't
really know is because he emailed me and
said like hey I try this too and those
it's unlikely you would ever be able to
actually catch but i also saw some
examples of what looked like I don't
know people who were kind of doing this
manually would sit at the computer for
like 45 hour stretches and just like
literally the exact same thing go to the
church alternates retweet so i guess it
depends how much you want
how insane you want your entrance to be
able to be to be able to restrain a
person who spends four hours versus the
script can also try to make it harder to
programmatically enter and you can do
this by adding a second step like you
know asking a question or something
this works okay but it's not great
because all you have to do because
everything on Twitter's public is look
to see what everyone else is responding
to this question about and then just
repeat it so this may stem like some
really naive attempts and you can also
try running it on another platform it
seems like it's more difficult to make a
legitimate looking fake facebook account
than it is a fake Twitter account and it
can also be tied to a real identity
which twitter can obviously isn't and
finally you just have to accept the fact
that if you're running a contest people
are going to try to game it ever since
people have been running contests people
have been trying to gain them and that's
kind of the way it's always going to be
so that's just part of doing it so again
here's the list of stuff if you want to
look over it and if you want to follow
me on twitter i guarantee it's one
percent human generated content then
that's my provisional thanks