If you are developer try using https://github.com/instagrambot/instabot (Instagram is part of Facebook). You will be blocked quite fast. For research and fun I did things more sophisticated than instabot and still got blocked. So Facebook as company is researching this area and is actively using whatever is possible. I'm pretty sure they will get much better in the future. In the end they want companies to buy ads and if competition gives better result than they do, they will lose.

Use selenium or puppeteer with stealth plugins and a real user agent and I suspect it will be A LOT harder for them to block you.

Selenium is still relatively easy to detect by JS, but on the other hand it does require some dedicated[0] effort even if just the user-agent is overriden and that itself might be enough to work for relatively long time. Other important thing is rotating over different IPs that appear realistic[1]

[0] dedicated in a sense of lets include some script specifically designed to detect Selenium. [1] for example it's kind of unlikely that non-bot visitor is using IP from a range used by amazon instances. not sure how often this is used but I assume that most bot-detection systems would use that information at least as one of the metrics

I have written browser extension.

how sophisticated is it? a browser extension sounds pretty high-level and limited to me. does it just use the host browser's user agent? or is it able to spoof multiple legitimate user agents, connect to fb via proxy servers, handle queueing, rotation, retirement, etc.? in which case how is a browser extension more useful than [scripting language of choice]?

There are a lot of JS-based detection techniques that rely on things being or not being available. By using an actual browser you have JS/WASM environment that is identical to what is expected from a real user. By using [scripting language of choice] you would need to emulate everything that a given bot-detection system tries to check.

From my very limited experience there are two main categories of websites:

1. Using curl and/or [library of your choice] in a [scripting language of choice] is enough

2. Forget about not being detected without a full blown browser unless you want to spend endless hours trying to emulate whatever is needed to be emulated and also willing to burn some accounts and IPs in the process.

A lot of questions here. In short I have tried to imitate how I browse Instagram myself but not too sophisticated. I think that higher sophistication might have helped a little bit. Scripting based solutions are detected in minutes, browser based solution was blocked only after 20+ hours. I have not used any proxies while I think it can be done - however that does not solve the problem.

Answering last question, it depends what do you mean by scripting language. Let's assume it is Python then you have two choices: imitate browser or risk to be detected as bot quite fast. Writing browser extension is quite easy and you can imitate real user quite easy. The only problem that you will have is to imitate real human being in a way that does not match Instagram's bot detection algorithm.

This doesn't tackle the click farms / click workers though...

You don't know that

If they still exist and still work...

I don't know, I would like to hear Vint Cerf do a talk on intelligence services. Particularly if the second half of the topic is spitballing solutions.

There are videos of him talking about the inception of the internet. In fact, he explains in detail how we wanted to be able to have mobile military units that could relay data back to HQ real time in enemy territory and that was why ARPA created the internet. I don't want to misquote him, but essentially he said something to the effect of it isn't like you can ask your enemy to set up a network for you just prior to invasion

Vint ain't never been the Freedom Rider, he's the cop (so to speak).

I think there's already an answer to this. In a large organization, such a pervasive and difficult problem can't be solved in a direct fashion, because there's always some weird alternate consideration that keeps it from getting tackled. Only a top-down initiative from C-level implemented across the organization has a chance at rooting it out, and if such an initiative existed we'd have heard about it and gotten yearly progress reports.

I think what we're seeing instead is the same as counterfeits or promoted search results at Amazon: solving it could become an existential threat to either popularity or profit, so they're just "managing" it as BAU.

I guess one alternative explanation would be that it's a hard problem, and Facebook doesn't know how to solve it. Or that current efforts aren't having good results.

In either case, Facebook has a financial incentive to say nothing, instead of publicizing lackluster results.

Or, my guess, they'd rather keep any news about the existence of this off the front pages, as broader knowledge of its existence by their (not as technically informed) advertising customers only negatively impacts Facebook.

Kind of how a beachfront town wouldn't want to advertise the fact that Great White sharks exist... at all.

I don’t buy it, we’re building ai that can drive, classify scans better than professional doctors, translate - but we can’t figure out fake accounts? Come on.

Driving, diagnosing, and translating are not good comparisons, because none of those are adversarial.

The problem here is that adversaries are adjusting to whatever measures are put in place. In that respect it might be more like winning at Chess or Go. Which computers can do, but it’s decidedly non-trivial.

And here’s the kicker: If we postulate some hand-wavium big-data/machine-learning/AI that can detect bots and adjust when the bots evolve, why can’t we also postulate some hand-wavium big-data/machine-learning/AI that can run bots and evade the bot detection?

Driving often is adversarial, and no AI can actually drive yet (outside of some very limited circumstances on a small number of roads).

It's probably not that they can't classify fake accounts but that doing so at a scale requires too large resources and it's more economical to employ only simpler techniques that weed out most of the bots and live with the remaining few.

Then if they also happen to anyhow benefit from the existence of those fake accounts then it becomes even harder to justify costly filters and leads to a sufficient-enough-to-not-look-obviously-weak grade filtering

If it's so problematic, they shouldn't have released the feature(s) in the first place. They unleashed a firehose (a hose that shoots fire) without any controls to turn it down, or off, or even to aim it away from the hospital full of babies. Controls that were well-known as common and standard for decades before Zuckerberg was first rejected by a girl.

Facebook is entirely out of control as a social force, and PR agencies are the only thing holding back public perception.

I'd assume these fake likes improve the metrics of most managers... "look at the improved user activity since rollout of X feature!"

There's probably not much incentivation to investigate them too deeply.

Or perhaps slightly more temporally related, how Vint Cerf feels about ISOC selling .org :)