At the height of One Million Checkboxes's popularity I thought I'd been hacked. A few hours later I was tearing up,…

At the height of One Million Checkboxes's popularity I thought I'd been hacked. A few hours later I was tearing up, extraordinarily proud of some brilliant teens. A thread about my favorite story from running OMCB....

nolen@itseieio · Jun 26, 2024

I made a website. it's called "one million checkboxes dot com". it has one million checkboxes on it. checking a box checks it for everyone. that's it. have fun!

If you missed it, One Million Checkboxes was a website that had...one million checkboxes on it. The checkboxes were global - checking or unchecking a box checked it or unchecked it for everyone in the world immediately. I thought it wouldn't get much attention; I was very wrong

Half a million people visited the site within days of launch. Folks checked 650,000,000 boxes in the 2 weeks I kept the site online. I did interviews with the New York Times and the Washington Post; there's a Wikipedia page and a Know Your Meme page. it was crazy!

I've written about how I kept the site online; you can read about it here: I'm not gonna talk about that - I'm gonna tell you my favorite story from the site. But to tell you the story, I need to give you some context.

nolen@itseieio · Jul 26, 2024

Alright! I've finished a detailed writeup on how I scaled One Million Checkboxes to handle people checking 650 million checks (!) i spent more time writing this blog than i spent making the site lol More highlights + blog link below

I love to build sites that let you interact with strangers. People can be assholes on the internet, so when I build these sites I think about how people are gonna try to ruin things and how I can constrain that.

Often my favorite stories come from how people play with and subvert the constraints I add - it's a bit of a trope that constraints breed creativity but I've found that to be very true with these experiments. This is foreshadowing.

With OMCB I was worried about drawing. I know (you do too) what happens when you give the internet a public canvas. So I made the number of checkboxes in a row scale to the size of your browser. Here I've written the word "example" - but it only appears at a very specific width

This meant that if you drew something on your phone it wouldn't show up for me on my laptop and vice-versa. I think this worked well; we didn't get bogged down in gross graffiti and since the constraint was subtle most people didn't even notice.

SECOND BIT OF CONTEXT - how did I store state? One million is a really big number; I wanted to store state for OMCB efficiently. To do this, I said - a checkbox is like a bit. A checkbox is checked or unchecked; a bit is 0 or 1. So we'll just keep 1 million bits in a database

Bit 3 was "1" if checkbox 3 was checked and 0 otherwise. So we've got a million bits; 8 bits in a byte so that's 125,000 bytes. 125KB - not even the size of an MP3! Computers can totally handle that. (I promise this matters)

So a few days in I'm exhausted. I'd just finished rewriting the backend in go. And I decide to dump the my database in ascii. I have no idea why I did this. I just did it. This is what I saw.

WHAT THE FUCK IS THAT

a URL with "catgirls" in it was sitting there in my database and I PANICKED. I thought I'd been hacked! I started searching through my code, searching through my logs, trying to find the problem.

But I couldn't find anything. Everything looked ok. And then wait wait! I saw it

I looked at the checkboxes on the site that corresponded to that sketchy, repeated URL. Like this H here. That represents a byte. 8 bits 8 checkboxes *those 8 checkboxes*

And I realized there was a pattern in the checkboxes. And if I changed something in that pattern - if I unchecked a box - the pattern immediately reappeared. *somebody was checking boxes to write me a message in binary*

The way that works is - we can convert our binary data to ascii by reading it 8 bits (8 checkboxes; 1 byte) at a time. That gives us a number between 0 and 255, and we can use an ascii table to convert that to a letter (basically the letters on your keyboard)

So someone was: * Checking boxes * To make numbers * To form letters * To spell this URL probably with a bot to make sure that the boxes stayed checked a certain way. I wasn't hacked! I had found a secret.

So catgirls dot win slash omcb *catgirls dot win* I clicked the link

And the link went to a discord! And the discord was called "Checking Boxes" so I join the discord

And someone was very excited to see me.

And we chat for a minute, and then they ask me a question that blows my mind: "have you seen your checkboxes as a 1000x1000 image yet?"

And I said no, and they showed me, and it looked something like this

So there's a lot going on here! In addition to the drawings, we've got some secrets. There's the binary message I found, but above that is a base64 version of the same message. And we've also got a QR code (with full error correction) that linked to the discord.

The discord was full of very sharp teens, and they were writing this message in secret to gather other very sharp teens. And it totally worked!! There were 15 people when I joined the discord but over 60 by the time I shut down the site. (the discord is now hidden)

I tried to make it hard to draw but they said "1000 times 1000 is a million" - they found a way! And they started drawing some crazy stuff.

They put a windows blue screen of death on the site (pre crowdstrike!)

They put sexy jake gyllenhaal gifs on the site

Near the end I removed my rate limits for a bit as a treat and they put a realtime rickroll on the site!!

It was sick. It was so cool. And I found this so moving I spent my childhood doing dumb stuff on the computer. People mostly didn't get mad at me when I, for example, repeatedly broke my school mail server. There's no way I'd be doing what I do now without that encouragement

So getting to provide some encouragement of my own - providing a playground like this and seeing what folks were doing and telling them how much I loved it - was so deeply meaningful to me.