Hacker News Reader

I'm sure they have an API bots can use.

The API doesn't know whether there's a human behind it or not. It's the same API used for third-party clients.

Easily detected by IP ranges.

because obviously there's no way to obfuscate an IP address

/s

If I'm using my VPN, my Twitter bots will be coming from the same IP range as me using Tweetbot or the Twitter website.

Even without the VPN, I occasionally have a bot that posts from a home machine with the same IP range as Tweetbot et al.

How would you differentiate between a human sending a tweet via the API and a bot?

User-agents

- User-Agent is an optional HTTP header

- RESTful APIs don't even expect a User-Agent

- User-Agent is customisable (ie bad bots can trivially use an array of seemingly authentic strings)

- Even Google are moving away from using User-Agent for identification.