</> MAANG.io
system design · 301

Advanced

Master system design interviews with scalable architecture patterns, distributed systems, and real-world design challenges.

0/480 solved 0% complete

Section 9: Trying to Break the On-Sale - Interviewer Deep-Dive Challenges

Executive Summary: With the hold and the waiting room on the board, the interviewer starts attacking. Seven escalations: bots, a slow payment provider, hold hoarding, a double-clicked Pay button, "why not Redis", general admission and a lying seat map. Each is answered by a decision you already made, with the number behind it and its flip trigger.

Challenge 1: "Half the Queue Is Bots"

"1.5 million of your 3 million fans are scripts. What now?"

What they're really asking: Do you defend where bots win, at entry and at hold time?

The model answer: Layers, cheapest first, each one at the edge before the origin sees anything:

Bot defence flowchart: Arrival at the edge, then CAPTCHA or proof-of-work at queue entry (fail: Challenged or blocked; pass: Queue token signed and bound to account + device), then Velocity checks on joins per account, device and IP range (anomalous: Challenged or blocked; normal: Watermark admission, same as every fan), then Per-account limit of 4 tickets per show, One live hold per account per show, and Checkout

Proof-of-work adds about a second of phone CPU per entry: nothing for one fan, a real bill for a farm minting millions of entries. Binding the token to account and device stops one login from minting a thousand positions. A bot that survives all of it is one shopper with 4 tickets and an 8-minute hold, admitted at the same 67 a second as Jordan. A verified-fan presale moves the filter before the sale starts.

Rejected: CAPTCHA at checkout only, because by then the bot already holds seats. The flip is demand: at 50 fans per seat and rising, real-time filtering gives way to the registration lottery in Section 11.

The senior line: "Bots win at entry and at hold time, so that's where the defences sit. Anything that gets through is just another account with 4 tickets."

Quick check before moving on:


Sign in to continue reading

The rest of this lesson is available with a free account. Signing in with Google or Microsoft is free.

Sign in to read the full lesson

Sign in to MAANG.io

Use your Google or Microsoft account — no password to remember.

Continue with Google Continue with Microsoft

Please accept the terms above to continue.