Conol 1.1.3 — Free credits go to real people

Conol gives every new account free credits, and more for completing the onboarding quests. In early October a wave of scripted sign-ups treated that as a vending machine: thousands of accounts from a handful of mailboxes and temporary-mail domains, each one running the quests within a minute of being created and pocketing the rewards. We have written about an earlier wave in The week the bots came. This release changes when free credits are paid and who can register, so the credits keep going to people. If you are a person, almost nothing changes for you; the few things that do are below.

Your welcome credits arrive once you verify your email

Why. The sign-up bonus used to land the instant an account row existed, before anyone had clicked the verification link. Hundreds of the scripted accounts never verified at all and still held their bonus. Paying on verification ties the credits to a mailbox someone can actually read.

How to use it. Sign up as usual, open the verification email, and click the link. Your bonus is in your balance by the time you land in the app. If you join through a friend's shared note, the referral bonus for you and for them follows the same rule and arrives when you verify. Google and GitHub sign-ins are verified by the provider, so those accounts get their credits at sign-up as before.

Quest rewards unlock after your first day

Why. The onboarding quests pay a few hundred credits each for things a real user does in their first session. Scripts completed all of them a median of 72 seconds after sign-up. A short waiting period costs a person nothing and makes each throwaway account a day's work instead of a minute's.

How to use it. Nothing about completing quests changes: do the thing, and the quest is marked done on the spot. The reward is paid automatically once your email is verified and your account is a day old. If you complete a quest before then, an inbox note tells you the credits are waiting; open the Home page any time after the day is up and they are in your balance. Nothing you completed early is lost.

One account per mailbox

Why. Most mail providers treat name+anything@ as the same inbox as name@, and Gmail also ignores dots, so n.a.m.e@gmail.com is name@gmail.com. One mailbox created hundreds of "different" accounts this way, every one of them verified. Temporary-mail services add a second trick: they point hundreds of custom domains at their own servers, so a blocklist of domain names never catches up.

How to use it. Sign up with your ordinary address. If you already have an account under a variant of it, the sign-up form tells you so and sends you to log in instead. Addresses at temporary-mail services, and at domains that have no mail server, are declined with a clear message, because a verification email could never reach them. If you have a legitimate reason to use a plus-address (a work filter, say) and get turned away, log in with the original address; it is the same account.

Sign-up is harder to automate

Why. Two more doors the scripts used. The hourly limit on registrations from one network address allowed a hundred-plus accounts a day if the script paced itself, and a link to a shared note let anyone register through it, including shares made by brand-new accounts that then chained registrations one into the next.

How to use it. You should never notice either limit. One network address can create at most ten accounts a day, which still covers a classroom or an office. A shared note's join link opens registration once the account that shared it is a week old, the same age the referral bonus already required. If you hit either limit by accident, wait a little or ask a member for an invitation, which works regardless.