Ask HN: Idea Sunday

If you have an online-community that you run and would like some ideas to combat vote-based-on-agreement, here are a few that I've thought up or come across:

(Not claiming that these strategies are ungameable).

* Limit the number of upvotes a user can give per day, thus making votes more valuable.

* Force users to space-out voting, allowing only 1 upvote every 5 minutes.

* Vote value: Votes are valued more the less you do it over a certain period - so if you only upvote once per-day, that post gets more points than if you upvoted everything in /new. Choice: Do it hidden on the backend, or could be interesting; do it in a user-configurable format. Give users, say, 100 points per-day and are allowed to upvote transparently - you can give one thing 100 points or four things 25 points.

* Time-delayed voting: votes are only allowed after a certain amount of time has passed since you clicked on a link. A well thought-out and reasoned article should take at least a couple of minutes to read, so I can upvote that after I read; I'm not likely to wait around to upvote an image-macro with fewer than a dozen words unless it's really special.

* Karma cap, both negative and positive: Limit max positive karma to something low, say 50. That's high enough to see that a user isn't brand new but isn't trivially attainable. That way, it's fine to get to the cap, but posting inane one-liners attempting to reap thousands of points for a single comment isn't so tempting. Limit negative karma to something lower, like -100 to dissuade trolls, while still showing that a user is disagreed with. Hopefully that encourages discussion for the sake of discussion.

* Meta-voting: You vote on how many points a post got, so if a pithy but well-timed comment that says "lol butts" gets a lot of points, you can vote to say that the post didn't deserve those points. Make this a limited power granted to a select (but changing) group.

* Make downvoting cost karma: If it cost karma to downvote, that could be a higher bar to drive-by-disagreeing.

* Not sure if it's a good idea, but turn the script around. Instead of trying to avoiding the Pepsi-Blue Advertising syndrome, charge money for votes transparently adding points to a post or comment. As users can still downvote items, it becomes expensive to elevate a bad piece of advertising. Maybe extend this to users by allowing users to receive money for lots of highly-rated comments. Or perhaps use Dogecoin as your currency of choice as the real-world value of 1 Doge is so low that it's effectively free in small quantities, but not actually free.

I don't think allowing the masses to vote on things is a bad idea, but it's an idea that needs some refinements for best effect.

If wireless charging gets more standard, then there won't be an eyesore of cables.

There are some services out there that will scan you for vulnerabilities, but I have yet to find a really slick way to integrate security "for free" into your own servers/services.

This would mean at minimum:

1. apt-get install X. Automatically decent kernel/network/firewall configuration occurs, removes cleartext passwords from ssh and changes the port, etc etc. This is just a base starting line.

2. malicious user detector. Probably cooperating with an API within ruby/jvm/python/php/whatever is a mixpanel-like way I can define custom events and possible milestone-firewalls. E.g. this is a new user sign up, here are the relevant fields & ip. Or here's a comment on an image from user X with IP Y. Rather than having to figure out if we're likely being abused outsource that decision to the service & have it help you block the evil-doer.

3. APIs to help with usernames/passwords, setting up TLS & perfect forward secrecy, etc. That is to say, give me patterns I can use that every app has even with some level of customization.

4. Have built in DDOS protection, particularly for resource starvation attacks that might be more app-specific (request X took Y>Z time, and it's being repeated endlessly).

I understand that security is complicated, ideally should have full time staff, every app/service is different, ya yada. Except when you're starting out you don't have these kinds of resources and something like this could get one quite far, not to mention be able to see much of the internet and what's happening across clients (like gmail with spam) and thus have an advantage over you. It seems like a giant hole in the world of app development and most people are terrible at security when it comes down to doing anything more than firewall + ssh keys + bcrypt user passwords.