Defending bot-detection code that runs on the attacker's own machine (opens in new tab)

Every line of client-side bot detection runs on hardware the attacker fully owns. Here's the engineering philosophy we use to defend code we can never actually hide.