作为Woot.com的长期用户(4年)和几袋垃圾的购买者，在我的车库中有许多其他的物品，似乎解决方案应该是Woot整体主题的一部分。

使用验证码，但要幽默。就像100万美元的促销一样，你也可以将自己当成一个人来做游戏。在过去，这使得中行的“售罄”推迟了一段合理的时间，而像我这样的人，则争先恐后地想出一个相当简单但幽默的谜题，输入优惠券代码。

此外，虽然人们不断抱怨服务器错误，但他们不会停止返回。在我看来，购买中行之所以令人兴奋，部分原因在于有无数人都想买。如果服务器抛出一个错误，或者一个奇怪的页面，这表明我是一群试图获得1500个产品中的一个的太多人中的一个。

如果你在构建谜题上投入了足够多的创造力，并且它足够新颖，它就会拖延机器人足够长的时间，给其他人一个机会。在“我想要一个”和购买页面之间放置一个临时页面，这需要一些独特的人类互动，你已经阻止了机器人，直到它们弄清楚需要发生什么。

• You haven't implemented a boring, and sometimes painfully difficult to read captcha • you've made the process more fun, • you've reduced the load on the actual secure purchase server • You'll train the users that they will need to "DO" something to get a BOC • You'll stopped the bots at the interim page, delaying their purchases until most people have at least had a chance to try and figure out the funny, but not terribly difficult puzzle. • Since being random is what a BOC is all about, a random, and changing puzzle/task would fit in simply with the whole pitch of a BOC.

随着试验的进行，临时页面背后的技术可能会变得更加先进，可以捕获用于购买页面的随机信息。自

自05年5月31日以来，我已经购买了7个BOC，没有机器人的帮助，也没有任何脚本，除了wootalyzer，我觉得这是一个可以接受的帮助。最好的一个，我没有得到，是Please Please Me BOC。B&D电池也很有趣，但我猜它并没有难倒机器人，只是让普通用户感到沮丧。

有时候，技术问题的最佳解决方案并不是更多的技术。

两种解决方案，一种高科技，一种低科技。

First the high-tech: The BOC offerings sell out in a seconds because bots get many of them in the first few milliseconds. So instead of trying to defeat the bots, sell them what they are scanning for: a bag of crap. Worthless crap, of course: bent paper clips and defiled photos of Rosie O'Donnell. Then have built-in random delays on the server for a few seconds at a time. As the sale continues, the actual value of the product sold will increase while the sell price does not. That way the first buyers (bots in the first few milliseconds) will get something worth much less than what they paid (brown onion cakes?), the next buyers (slower bots or faster humans) will get something unspectacular but worth the purchase price (bought on consignment?), and the last buyers (almost all humans) will get something worth more than the purchase price (break out champagne?). That flat-screen TV might be in the very last BOC purchased.

任何等待太久的人都会错过机会，但与此同时，任何购买太快的人也会吃亏。诀窍在于等待一段时间……但不要太多。这里面有一些运气，这是应该的。

低技术含量的解决方案是将中国银行的名称改为人类可以理解但机器人不能理解的名称。酒皮屎?装着臭味的麻袋?与各种商品相邻的拓扑平面?不要重复使用相同的名称，使用稍微不同的图片，并在产品描述中解释实际销售的产品。

让机器人用户无利可图，他们很快就会离开——也就是说，偶尔卖一些人类不可能想要的东西(可能是一袋字面上的垃圾)。

My approach would be to focus on non-technological solutions (otherwise you're entering an arms race you'll lose, or at least spend a great deal of time and money on). I'd focus on the billing/shipment parts - you can find bots by either finding multiple deliveries to same address or by multiple charges to a single payment method. You can even do this across items over several weeks, so if a user got a previous item (by responding really really fast) he may be assigned some sort of "handicap" this time around.

这也会有一个副作用(我认为是有益的，但从营销角度来看，我可能是错误的)，可能会扩大幸运的人的圈子，购买woot。

我喜欢BradC的回答(使用Ned Batchelder文章中的建议)，但我想在此基础上再增加一个层次。您不仅可以随机化字段名称，还可以随机化字段位置和使它们不可见的代码。

Now, this last bit is hard part and I don't know exactly how to do it, but someone with more JavaScript and CSS experience might be able to figure it out. Of course, you can't just keep the same positions all the time, because the scripters will just figure out that the element with position (x,y) is the real one. You would have to have some code that changes the positioning of form elements relative to other elements in order to move them off the page, overlay them on each other, etc. Then obfuscate the code that does this with some randomness introduced into it. Automatically change the obfuscation daily, before a new item is made available. The idea is that without a proper CSS and JavaScript implementation (and code to read layout of the page as a human would) a bot won't be able to figure out which elements are being shown to the user. Your server-side code, of course, knows which fields are real and which are fake.

总而言之:

字段名是随机的 字段顺序是随机的 字段隐藏代码很复杂 字段隐藏代码是随机混淆的 服务器端代码每天自动更改随机因子

在你给出的限制条件下，我不认为有办法避免某种形式的“军备竞赛”，但这并不意味着一切都完了。如果你能在军备竞赛中实现自动化，而编剧不能，那么你每次都能获胜。

这里有很多建议，所以如果这已经发布了，请原谅我。

我要做的第一件事是把订购分成两步。第一步将在记录IP地址时传回一个GUID。第二步将接收GUID，并将其与已记录的IP地址进行比较。结合阻止垃圾邮件的IP地址(IE:比人类点击刷新的速度还快)，这种技术可以阻止垃圾邮件发送者成功购买，从而解决1和3。

第二项是有问题的，但我会保持一个常规用户IP地址的运行列表，并限制任何新用户的流量。这可能会让首次访问者和拨号用户(由于IP地址的变化)受到冷落，但我认为这只是通过优先考虑回头客而在糟糕的情况下做出最好的选择……而拨号用户，即使没有任何垃圾邮件发送者，他们是否会“获胜”也是值得怀疑的。