Why first click isn't fair

Ask anyone who missed a drop what went wrong and you’ll hear the same thing: the bots got there first. Ask a queue vendor and you’ll hear that their queue is first-come, first-served, and therefore fair.

Both are true. That’s the problem.

A fair rule can still produce an unfair result

First-come, first-served does exactly what it promises: whoever arrives first goes first, and nobody can jump the line.

But the line is settled in the first second or two after a drop opens — and in that second, a person with a mouse is competing against software that was already on the page, refreshing many times a second, from hundreds of residential broadband connections rented by the hour so that each looks like a different customer in a different town.

A quick human reaction to something appearing on screen is about a quarter of a second, plus the time it takes to move a hand to a mouse. A script has no hand, is already sitting on the page waiting for it to change, and automates requests instantly.

The rule is fair. The race that feeds it is not. The result is a sold-out drop where the first few hundred positions were never really available to a human.

The presale draw: remove the prize for speed

If speed is what’s being gamed, stop rewarding speed. A Dropify presale does that in two steps:

1. Registration. For a window before the drop — an hour, a day, whatever you choose — anyone can sign up. Nobody has a position yet, and the page says so. Registering in the opening millisecond and registering forty minutes later put you in exactly the same place: registered.

2. The draw. When the drop opens, everyone who registered gets a spot in line at the exact same moment, in random order, via a cryptographic shuffle executed at flip time. From there the queue runs normally, admitting people at the pace you’ve set.

The consequence is the only sentence that matters:

In a presale draw, being first to register wins you nothing. Everyone who registers has the exact same expected chance at every position.

There is no longer anything for a bot to win by being fast.

What the draw does and doesn’t do

Two boundaries worth being clear about:

The draw is a presale mode, not how the queue always works. The everyday Dropify queue is first-come, first-served, which is the right behavior when pacing traffic rather than allocating scarce stock. The draw is a mode you switch on specifically for a drop.

A draw alone doesn’t stop bots — so it doesn’t work alone. Removing the speed prize still leaves the volume play: register ten thousand times and win a share of the pool. That’s why every registration has to pass a human check and solve a proof-of-work challenge, with extra computational work demanded from traffic originating from data centers (AWS, GCP, Hetzner, etc.). The draw makes speed worthless; entry checks make volume expensive. You need both, and both are standard on every plan.

Why publishing the mechanism is the point

There is an obvious objection to explaining how the draw works: doesn’t describing the mechanism help someone attack it?

No — and it is worth saying why, for the same reason a bank will tell you what kind of lock is on the vault. The draw is protected by a random permutation number created at the last possible moment and never stored or shared in advance. It is not protected by secrecy. Anything that only works while customers are in the dark is not secure — it is just unexamined.

The audience that matters most is not the merchant; it is the shopper. Drop audiences talk to each other, and a shopper who believes a line was rigged blames the brand that hosted it. Being able to explain why the line was drawn fairly is the product.

What your customers see

During registration: You’re in, your place will be drawn when the drop starts, being early doesn’t help. No fake position numbers ticking away — until the draw happens, there is no position.

At the drop: A position, a progress bar, and a line that moves at the pace you set.

The one thing a shopper never has to do is refresh faster than everyone else.