The Profile-Views Hack

Status: complete. Ran about six years ago, between jobs. Doesn't work anymore, for reasons I'd like to take partial credit for.

The thesis

LinkedIn tells you who viewed your profile. So if you view someone's profile, some fraction of them will look back at yours. That's it. The whole idea was that this is a real distribution channel and the only variable is volume.

What made it possible

I was doing a lot of LinkedIn scraping at the time and two things stood out.

The first is that their IDs were sequential integers starting from one. Not hashes, not opaque tokens — just counting numbers. They were also polymorphic, which is the part I still find pleasing: the same integer space covered people and companies both, so an ID would resolve to a person or an org depending on what happened to live at that number.

The second is that the profile-view record has to originate on the client. The server can't know you looked at someone unless your device tells it, which means the reporting is an event the client sends, in batches, on a timer. Once you've seen that in the request log, the shape of the whole thing is obvious.

The escalation

I went up in orders of magnitude — 30,000 views, then 300,000, then 3 million, then 30 million. That laddering wasn't caution exactly. I was probing for where the rate limiter actually lived, how many events would fit in a single request, how fast I could send them. All from one IP and one session, which in hindsight is the detail that makes the result interesting.

They noticed at 30 million views in a couple of hours. Account suspended until I uploaded ID and agreed to the terms of service, reinstated about a week later.

What it returned

• ~30,000,000 profile views sent
• ~300,000 people who viewed me back, roughly 1%
• ~3,000 who continued through to my portfolio site, roughly 1% of those

The part I didn't expect: when they reinstated the account, they hadn't cleared the view records. All those events were still sitting in the database, so the 300,000 kept arriving over the following ninety days. The suspension ended the sending, not the receiving.

Two conclusions, one about marketing and one about security. The conversion funnel held at almost exactly 1% at each step across a very large sample, which is a cleaner number than anything I've measured since. And defenses lag probing — the limits that existed weren't enforced anywhere near the volume that would have made them meaningful. Pushing until something notices you is a way of measuring how much resilience is actually there versus assumed.

LinkedIn uses UUIDs now. You can still surface the old integer IDs if you go looking. I have no evidence I was responsible for the change and I intend to keep believing it anyway.

The open question, which is why this doc is here

This story should be my best-performing content. Numbers, a real mechanism, a suspension, a funnel that held at scale, a punchline about UUIDs. I've posted about it more than once. It hasn't done well.

I don't know why, and I'd like to. Some candidates:

• People don't believe it, and disbelief reads as scroll-past rather than as an argument in the comments
• It's admitting to something gray, and the reflex is to not engage publicly
• It's six years stale, so nobody can act on it
• I've been telling it as an accomplishment, and accomplishments underperform — which would be consistent with what my two best posts have in common, both being postures of not knowing something. See the lightbulb hook

That last one is testable and the others mostly aren't. The rewrite would be to tell it from inside the confusion — the moment of realizing the client has to be the one reporting the view — rather than from the far end where it already worked.