The news of hackers exploiting a “back door” in BMOrg’s new ticketing system broke last week on Reddit. We covered it last Wednesday in Ticket Hell. Now, the story has been picked up by a broader media audience, with stories in WIRED, Computer World, Paste Magazine, CBS Local, and SFist.
Burning Man has practically gone mainstream. The once-fringe desert camping festival is now cultural fodder for The Simpsons and Taco Bell commercials. Celebrities and CEOs routinely attend. So it’s no surprise that 40,000 Burning Man tickets sold out in less than an hour last Wednesday when they went on sale.
But software engineers in Silicon Valley hacked into the Burning Man ticketing system powered by Ticketfly to cut to the front of the queue. Who needs luck when you have engineering skills and you’re willing to use ‘em for your advantage?
…Several engineers and web developers on a Burning Man Reddit thread speculated that hackers were able to create this backdoor after discovering a few lines of JavaScript code on the ticketing website that gave preeminent access to tickets three minutes before they officially went on sale at noon on Wednesday.
“They left code in the page that allowed you to generate the waiting room URL ahead of time,” said Michael Vacirca, a software engineer at a large defense corporation. “If you knew how to form the URL based on the code segment then you could get in line before everyone else who clicked right at noon.”
Burning Man admits the error and says those hacked tickets will be put back up for grabs during the scheduled last-minute sale in August.
[Read the full story at WIRED]
It’s interesting to watch the corporate spin machine in action. Rather than any sophisticated hacking being required, simply entering your code directly into TicketFly seems to have worked. According to hundreds of Burner comments on the Interwebz, clicking the emailed link ten minutes after noon pretty consistently got Burners in to buy tickets immediately, whereas clicking the link a few seconds after noon led to many Burners being stuck in the queue for 90 minutes with no success.
To me, these are the real issues here: it was definitely not First Come, First Served, and it was trivially easy to bypass the queue – multiple methods were used, and most did not require the ability to write code or hack into systems. The focus on these “200 hacker tickets” is smoke and mirrors around the obvious explosion in the number of tickets being listed on the secondary market. Even BMOrg are now encouraging Burners to get tickets and vehicle passes “on the open market”. With software to automatically buy as many tickets as you want from TicketFly selling for a mere $750 – about the profit margin for a single ticket right now – it seems that there continue to be some serious issues with BMOrg’s ticketing system.
Who would have thought they could make it even worse than the lottery? As BMOrg proved with their Spark movie, perceived ticket scarcity makes a nice story for the media.
The way this year’s sale operated, however, didn’t help to dissipate the resentment. Those interested in purchasing tickets were placed in an online queue as each sale was processed and given a time estimate as to how long they would be kept waiting before they could purchase tickets. The time estimates kept shifting, going from an 24 minute wait, to 46 minutes, back down to 18 minutes, to then “more than an hour,” which might as well have read, “abandon all hope ye who enter here.” At one point, the line was inexplicably “paused” for several minutes, causing another nerve-wracking moment on social media.
This drastic, back-and-forth change in wait times gave those in line the illusion that somehow hackers were cutting in front of them and bumping them out of scoring tickets. Burning Man’s social media team responded by saying that the wait times fluctuated based on how long it took each buyer to complete the purchase. It surely didn’t qualm any anxiety to have used such an unpredictable factor as a counter, instead of a fixed number (“There are 39,999 people in front of you trying to buy tickets”).
See the comments from ZOrg in Emotional Roller Coaster From Hell about why this theory of wait times fluctuating because of some people taking a long time to complete transactions doesn’t add up.
This is not the first time Silicon Valley has been criticized for tampering with Burning Man’s ideals and processes. Last year’s festival garnered unflattering feedback from Burning Man die-hards after venture capitalists, executives and celebrities descended on the desert with air-conditioned camps, personal assistants and other VIP-perks. In recent years, Larry Page, Sergey Brin, Elon Musk, Jeff Bezos and Mark Zuckerberg have all scored tickets to Burning Man.
It seems like now, Silicon Valley is leveraging more than its money to get in front of the line.
[Read the full story at WIRED]
Way to shift the blame to your customers, BMOrg. “Silicon Valley is using its technical might to cheat the system and get Burning Man tickets”: it sure makes a great angle for a story, compared to “some people typed the code into TicketFly”.
Actually it’s BMOrg’s leadership that has been criticized for tampering with Burning Man’s ideals, not Silicon Valley. No-one gives a flying fuck if Zuck brings his P.A., but many Burners do care when some on the Board of Directors are selling $17,000 hotel rooms like it’s some sort of Mega-AirBnB in the desert, and getting an unlimited supply of tickets for their customers and sherpas.
Cancelling 200 tickets will do nothing to fix the problems that occurred in the Directed Group and Individual ticket sales. There is no evidence that it will hurt scalpers, indeed it may even punish some Burners for being radically self-reliant. BMOrg have said they will void these tickets and add them back to the OMG sale – so now there are 1200 tickets left, for 60,000 Burners to attempt to buy in milliseconds on August 5.






We have no information that this is Susan, or that this camp is offering vehicle pass trades. It’s Burning Man, these things do happen…
Some Burners are reporting that Verizon customers got through much faster:
Verizon Customer Service: I was a Verizon Customer Service Representative for 9 years until I moved into management. Verizon has a camp at BM, but I can’t tell you the name. We’ve been working closely with BMorg to bring cell service and other benefits to the playa. I can’t tell you officially that Verizon customers get preferential treatment in the sale of BM tickets, but if I were you, I would change service providers next year to increase your chances.
There has been a great deal of discussion online about this ticket situation. Here are a few selected highlights from Voices of Burning Man:
IE How can there be a thousand scalped tickets? Do 100 people work for stub hub who have the back door secret? Who, besides the 1%, can afford to pay $1000 for a ticket, many many tickets? Something just seems out of line here. I feel your pain.
Hmmm, okay, I guess that was my surprise of the day. I wasn’t going to play the game this year, but decided ‘oh what the hell’. So at 12 minutes after, I got in thinking I had zero chance since I know everyone else starts within seconds after the hour. Guess what? Tickets baby!
We didn’t break any rules as the codes they used were from other friends and they purchased all of our tickets as they were getting through so quickly.
I was lucky (so much so that I had to check my confirmation email multiple times to make sure that it was actually real) enough to get ticket within minutes and was never put in the dreaded queue. At about 11:59 (2:59 my time) I clicked the link in the email and was told I was to early. I kept closing the page and re-clicking the link until the page changed. My memory gets little fuzzy here – to much adrenaline – but I don’t even remember seeing a green button. The page first said something about the site being down. So I refreshed. Then it said all tickets were already in carts! BUT HOW COULD THAT BE!?! Only a minute had gone by. I just kept refreshing the page until the ticket buying option came up – bingo, got one in about four minutes.
This is the same thing I did last year. Refreshing constantly. Didn’t get put in queue either. Got my ticket in two minutes.
Unfortunately out of our planned camp of six, only myself and my friend got tickets. The others will join the thousands of others in the hunt for one.
To all of those looking – best of luck and stay positive.
Also, all international tickets are sent out via post which is way better as there’s no need to spend hours queueing for Will Call!!
I’ve no idea why BMorg don’t implement a similar system, why keep trying to reinvent the wheel??
This further implies that the end of all the successful 21,500 sales probably occurred around 64.5 minutes after noon, i.e. the AVERAGE rate of processing of successful transactions was about 1,000 every three minutes, or FIVE PER SECOND.
This further implies that TRANSACTIONS WERE PROCESSED IN PARALLEL. i.e. there were MULTIPLE SERVERS (or AT LEAST multiple threads within a single server) processing the eventually successful transactions at any given time. We can estimate that the fastest an average individual could possibly complete the final purchase with confirmations of credit card, mailing address, etc would be 10 seconds, and a more likely upper average transaction time for an individual final purchase completion would be about 60 seconds. Since the eventual average processing rate was 5 purchases per second, this means that there must have been somewhere between 50 and 300 processes (threads within servers) handling eventually successful transactions ON AVERAGE throughout the sale.
But given the EXTREME variations in expected wait times that I saw during my 57-minute wait to get to the final purchase page, IT CANNOT POSSIBLY BE TRUE that there was no variation in server resources (e.g. due to server or thread crashes/hangs) during the first hour of the sale process, EVEN WHEN YOU ACCOUNT FOR THE “PAUSE” of the line (unless you assume that the algorithm to calculate the remaining wait time was complete bullshit 🙂
Because IF the allocation of server resources had remained constant (apart from the pause), and the average time taken by an individual to buy ticket(s) when they got to the final page remained constant, AND the remaining wait time algorithm WASN’T complete BS, then we should have seen expected remaining times decreasing monotonically throughout each successful purchasor’s sale process.
Because IF the position in the queue was determined by the server arrival times of the clicks on each user’s green button (in my case at about two SECONDS past noon), then effectively every eventually successful person’s position in the queue was determined WITHIN THE FIRST FEW SECONDS AFTER NOON of the sale, since on the basis of my experience clicking two seconds after noon (I synced my computer’s clock with the nist.gov atomic clock and had a display of that running during my purchase) and being probably one of the last people to get a ticket, there must have been over 20,000 green button clicks received at the servers within the first few seconds….
The thing that gets me (and probably most other people) emotionally wound up, is when we see (as I did), for over half an hour, that each minute my expected wait time is going down by a minute (so we believe all is going along nicely and we just have to wait) and then suddenly it goes up (as it did in my case) from 9 minutes to OVER AN HOUR, when we are MORE THAN HALF AN HOUR into the wait process. Changes like that CANNOT POSSIBLY be due to changes in the AVERAGE time taken by an individual user behavior in completing their purchase once they are on the final page, which probability theory tells us is EXTREMELY unlikely to change by a factor of two over many thousands of presumably similar buyers. It MUST be due to changes in the allocation of resources on the sever side (e.g. crashes).
So if the sale had proceeded per the theoretical “stable” model, by 30 minutes into it there should have been approximately 10,000 eventually successful purchases left to process. But my remaining wait time after waiting more than 30 minutes was shown to be 9 minutes (which would imply an estimated average sale completion of more than 1,000 per minute i.e. three times the final “official” average). But then it went up to “over an hour”, a change by more than a factor of six, which cannot be reasonably accounted for by changes in average user purchase time behavior.
On a technical note, there is really no need for the process to be as incomprehensible as it currently is. Since there is a pre-reg, it is trivial to load-balance ahead of time. In principle, if we expect 80,000 attempts to purchase, we can pre-allocate users to 80 servers, each of which only needs to process 1,000 requests (or equivalent architectures with multiple threads per server). The ONLY technical challenge is in fairly synchronizing across server queues, but if the clocks of the servers are synchronized, and arrival times of each user “green button click” are noted at each server down to the millisecond, then there is NO REASON WHATSOEVER not to make it totally transparent to everyone within the first few minutes of the sale EXACTLY what position they are at in the queue, EXACTLY what the average purchase processing time has been so far, and to show a REALISTIC view of how likely it is for their purchase to be successful given the current average number of tickets sold per customer, plus a REALISTIC and relatively predictably changing estimate of how long it will take to either get to the purchase page or find out that they have not been successful….
I’m a “glass half full” kind of guy, so I celebrate the fact that I was able to buy one ticket, but I still do think it was weird that I wasn’t able to buy two, and I strongly believe that the whole process could be dramatically improved…
People- My comments have nothing to do radical inclusion. This ticket thing year after year has nothing to do with radical inclusion. This is business making business decisions which for the life of me I don’t agree with.
Chip- Please help the rest of the org understand this, to give back to the loyal customers just like you did so perfectly at JDV.
Disappointed? Yes. But more just tired of this ticket game year after year.