Live data from Hacker News

Ask HN: Is Hacker News under attack from spam bots?

news.ycombinator.com

481–490 of 513 posts

Re: Ask HN: Is Hacker News under attack from spam bots?

#481

Oh my god, you aren’t kidding. As of right now, there’s 350 (plus or minus a few) dead spam comments at the bottom of this page. Someone obviously misplaced a decimal somewhere - you obviously don’t want to flood a forum with THAT many bot messages.

I don't think we're dealing with the cream of the crop here. They're not even smart enough to have it make up new, plausible user names.

Re: Ask HN: Is Hacker News under attack from spam bots?

#482

Earlier quoted context omitted.

I clicked on the Discord link in the spam message for fun, entered a random username, and immediately got asked to verify with my phone number before I could even read the messages in the chatroom. HN doesn't need to do that and I don't want them to do that, but a simple captcha or a proof of work algo like what Cloudflare uses would at least slow down the flood of bot accounts.

That’s the Orwellian way that discord cracks down on users that it deems, for whatever reason, “suspicious”. It is tied to the IP address and anything else associated with it, but if you had an existing account before the flag then that account won't be flagged, only new accounts. There is no appeal process and they won’t even tell you what your offense was. Unfortunately I’ve had to pay for an extra cell phone line…

As a non-Discord user, I'm glad I'm a non-Discord user. That sounds hellish. Is whatever's being gate-kept worth it?

Re: Ask HN: Is Hacker News under attack from spam bots?

#483

Earlier quoted context omitted.

That’s the Orwellian way that discord cracks down on users that it deems, for whatever reason, “suspicious”. It is tied to the IP address and anything else associated with it, but if you had an existing account before the flag then that account won't be flagged, only new accounts. There is no appeal process and they won’t even tell you what your offense was. Unfortunately I’ve had to pay for an extra cell phone line…

I don't use Discord anymore but the phone number thing seems new, in the past I was able to visit as a guest and be able to read messages but not chat. Then again Twitter and Reddit are doing the same thing now and forcing people to log in, so I'm not surprised. Considering how many community groups and open source projects now use a Discord in place of a public forum this looks like a disaster going forwards since a…

I tried to join Discord during the pandemic when I lived in China and they forced phone number verification both on and off VPN (presumably because both VPNs and China IPs are considered untrustworthy, which annoyingly defeats the point of using VPN). Then I went to Canada and bought a local prepaid SIM, but the area code was not recognized as a valid phone number so I still couldn't sign up.

It's very frustrating as a user to be region-locked on the supposedly open internet, but the real feeling of violation happens when companies layer phone number requirements on top of the region lock, which in many countries means that your government ID is now linked to the account, because you cannot buy a SIM without linking it to your ID. Truly a cyberpunk dystopia.

Re: Ask HN: Is Hacker News under attack from spam bots?

#485
post #460

Anyone have some insight into the motivation of spam bot behavior? It doesn't make sense to me that they'd intentionally re-post the same link on a story 100+ times. Perhaps repeating the same link is good for SEO farming? Or somehow there's a belief that 100+ identical comments is more effective than just a few? Also the comments all seem to end with a 15 character random string, which I assume is just there to add…

Just a guess: a teenager who learned to script and thought this was novel. This isn't an organized marketing campaign, it's a DoS with some links for amusement. Other than the volume, it's not even script kiddie level. Presumably they have access to proxy servers, though.

A teenager who just learned to script bested a forum for (and by!) the Silicon Valley elite?

Shameful if true. But unsurprising.

Re: Ask HN: Is Hacker News under attack from spam bots?

#486
post #443

Earlier quoted context omitted.

I don't know... Hacker News keeps complaining that they want the old 90's web experience back, now it feels like some shitty PHP messageboard from back in the day getting pwned by script kiddies. Enjoy the nostalgia while it lasts I guess.

I clicked on the Discord link in the spam message for fun, entered a random username, and immediately got asked to verify with my phone number before I could even read the messages in the chatroom. HN doesn't need to do that and I don't want them to do that, but a simple captcha or a proof of work algo like what Cloudflare uses would at least slow down the flood of bot accounts.

Pretty sure I remember hacker news having cloudflare captchas some time ago. Maybe they enabled the "attack mode" back then? Not sure why it wasn't enabled today. @dang could answer maybe.

Re: Ask HN: Is Hacker News under attack from spam bots?

#487
post #5

Interesting that this wasn’t baked in as a preventative method for repeat usernames. Which is also ironic because why would this guy reuse the same username for his little spam campaign when it can be nuked in one line of code… Amateur stuff. Never seen it happen before though!

I like how all of you keep demeaning the spammer as being amateur or less than script kiddie.

And yet, he bested you, the supposedly experts at web dev and hyperscaling. You create trillions of dollars of value. And yet, your social hot spot is beyond laughably bad at handling that "incompetent" attacker.

Re: Ask HN: Is Hacker News under attack from spam bots?

#488

So if it is possible with comments, does it mean it is possible with voting? I'm wondering how many posts recently came to main page upvoted by bots

HN doesn't have any integrity about voting in general. Look at the "about" text of https://news.ycombinator.com/user?id=pwdisswordfishc for example, and then look at the username. There is a whole family of pwdisswordfish* accounts btw. The "b" account's "about" text even has a holier-than-thou attitude about it.

If you go to https://news.ycombinator.com/newest , from time to time there apears stories with 50 upvotes in 30 minutes, and perhaps a few sockpuppets/shills comments. If you do the math, they should be in the front page, but misteriously they aren't. So the conclussion is that HN has a secret feature that detect (some of) the tricks. I think I read some coment from pg or dang about voting rings, but it was a long time ago, but it has no details. The details are part of the secret sause.

Also people flag strange threads, so the detection is not only automatic. If you notice something strange, you can send an email to dang: hn@ycombinator.com

Re: Ask HN: Is Hacker News under attack from spam bots?

#489
post #382

Earlier quoted context omitted.

This forum is built with early 2000s technology. It doesn't even use two-factor authentication or captchas for creating accounts. This was honestly bound to happen sooner or later.

I don't want them to require a email/phone for privacy's sake, but they should definitely have a captcha of sorts to limit bot accounts.

Relying on security through obscurity goes away pretty quickly once you’re popular.

Re: Ask HN: Is Hacker News under attack from spam bots?

#490

Earlier quoted context omitted.

That’s the Orwellian way that discord cracks down on users that it deems, for whatever reason, “suspicious”. It is tied to the IP address and anything else associated with it, but if you had an existing account before the flag then that account won't be flagged, only new accounts. There is no appeal process and they won’t even tell you what your offense was. Unfortunately I’ve had to pay for an extra cell phone line…

I don't use Discord anymore but the phone number thing seems new, in the past I was able to visit as a guest and be able to read messages but not chat. Then again Twitter and Reddit are doing the same thing now and forcing people to log in, so I'm not surprised. Considering how many community groups and open source projects now use a Discord in place of a public forum this looks like a disaster going forwards since a…

It's a per-server setting. Ranges from phone verification to email verification to minimum account age.
Post reply on HN