A bot doesn’t have to break into a system to become a problem

 A bot doesn’t have to break into a system to become a problem

When I started building ErsteWerk, bots were something fairly abstract to me.

I knew they existed. I knew that online forms were automatically scanned and that sooner or later every public system would also begin attracting traffic that its creator never expected.

But as long as you are building a relatively small project, it is easy to treat security as something being prepared “for the future.”

The last few weeks have changed my perspective a little.

During a period when I deliberately limited my interference with ErsteWerk and focused primarily on observing the running system, more than 20 suspicious account creation attempts appeared.

And that made me realize something interesting.

A bot doesn’t actually have to successfully break into a system to make life difficult for its creator.

It is enough that it forces the system to work.

You have to distinguish a human from an automated process. You have to decide when behavior becomes suspicious. You have to limit false alarms, because security that stops a real user also becomes a problem.

And then you still have to answer the most difficult question:

How do you make life difficult enough for a bot without making life difficult for a human at the same time?

At ErsteWerk, the answer did not become one “magic” security measure.

The registration mechanism has been gradually expanded and currently uses five layers of control. I deliberately do not describe publicly exactly how they work.

I also do not treat the number five as an achievement.

If the behavior of automated systems changes tomorrow, the system will probably have to change as well.

And this is where an even more interesting reflection appears for me.

When building an online system, we are not building something in an empty room. The moment we expose it to the Internet, it begins operating in an environment we do not control.

Users appear.

Search engines appear.

Errors appear.

And bots appear.

Each of them, in some way, tests what previously existed only as code.

That is why the recent break from developing new ErsteWerk features turned out to be more interesting for me than I expected.

Instead of asking:

“What else can I add?”

I increasingly find myself asking:

“What is the current system trying to tell me?”

And perhaps listening to the answer is one of the stages of moving from building a project to maintaining a real system.

Related observation from ErsteWerk

I described the broader context of this experiment and what happened while I deliberately reduced changes to the portal in:

“Czas posłuchać własnego systemu”  ErsteWerk

"Time to listen to our own system a small update"  Linkedin