Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

51–60 of 358 posts

Re: Botspam apocalypse

#51

Post by bayindirh »

sircastor wrote: post #32
paulmd wrote: post #2

> They're a major part in killing off web forums, and a significant wet blanket on any sort of fun internet creativity or experimentation. > The only ones that can survive the robot apocalypse is large web services. Your reddits, and facebooks, and twitters, and SaaS-comment fields, and discords. They have the economies of scale to develop viable countermeasures, to hire teams of people to work on the problem full ti…

>The solution is real simple: it costs 10 bux to register an account, if you're a nuisance your account is banned and you pay 10bux to get back on. Many years ago there was a public server called SDF (Super Dimensional Fortress). It was a BSD system and anyone could get a user account for $1. The theory was even the least of us, a kid scrounging for money on the street, could come up with a dollar (and presumably the…

SDF is still alive and kicking, though. I have an account with them.

Re: Botspam apocalypse

#52

Post by mjevans »

s1k3s wrote: post #44
kazinator wrote: post #15

In the 1980's, we kept anklebyters off dial-up BBSses with a simple technique: voice validation. To join the forum, you had to fill an application first, which included your real name and phone number. The sysop would give you a call for a quick chat, and then grant you access if you didn't seem like a twit. This would be entirely practical for some small-time operator trying to run a forum off residential broadband,…

I guess it's a different time and it also depends on who's your target audience. Some people go crazy if you ask for their email address. Phone numbers and calling is a big no-no.

I'm one of those radical militants who refuses to give up any means of direct contact...

However for a small scale thing I'd gladly go visit at a face to face meetup to fulfill this type of validation.

Re: Botspam apocalypse

#53

Post by jart »

krageon wrote: post #49
unglaublich wrote: post #14

Earlier quoted context omitted.

What keeps bots from just fixing their acts and reporting correct info instead?

Nothing. Once this sort of fingerprinting becomes common the common bot frameworks will bypass it.

But it's not common. So for the time being, redbean users have the advantage.

Re: Botspam apocalypse

#54

Post by rapnie »

timmaxw wrote: post #26
tmikaeld wrote: post #23

Earlier quoted context omitted.

"mCaptcha uses SHA256 based proof-of-work(PoW) to rate limit users." https://github.com/mCaptcha/mCaptcha

Nice! Yeah, mCaptcha looks like just what I had in mind. I wonder why this approach hasn't been widely adopted?

mCaptcha is in the process of being adopted in Gitea and Codeberg. See recent Fediverse post from the project account: https://gts.batsense.net/@mcaptcha/statuses/01G9KRBRC8CRC9M3...

Re: Botspam apocalypse

#55

Post by bryanrasmussen »

efitz wrote: post #41
BiteCode_dev wrote: post #31

It's not that bad. First, of course, you have cloudflare and recaptcha, which are free and very efficient, as the author say. But even if you don't want to use them (some of my services don't), most bots are very dumb: - require JS, and you lose half of the web ones - silly tricks like hidden input fields in forms that worked in 2000 still work in 2022. Use a bunch of them, and you can yet again halve the bot traffic…

Also, attackers are rarely going to try to guess your URLs - they’re going to find them via Google or Shodan, or, if you’re a good rest citizen, via “/ /“

>Also, attackers are rarely going to try to guess your URLs -

because then the attack becomes DOS as they cycle through dictionaries of words?

Re: Botspam apocalypse

#56

Post by [deleted] »

bayindirh wrote: post #51
sircastor wrote: post #32

Earlier quoted context omitted.

>The solution is real simple: it costs 10 bux to register an account, if you're a nuisance your account is banned and you pay 10bux to get back on. Many years ago there was a public server called SDF (Super Dimensional Fortress). It was a BSD system and anyone could get a user account for $1. The theory was even the least of us, a kid scrounging for money on the street, could come up with a dollar (and presumably the…

SDF is still alive and kicking, though. I have an account with them.

[deleted]

Re: Botspam apocalypse

#57

Post by [deleted] »

bayindirh wrote: post #51
sircastor wrote: post #32

Earlier quoted context omitted.

>The solution is real simple: it costs 10 bux to register an account, if you're a nuisance your account is banned and you pay 10bux to get back on. Many years ago there was a public server called SDF (Super Dimensional Fortress). It was a BSD system and anyone could get a user account for $1. The theory was even the least of us, a kid scrounging for money on the street, could come up with a dollar (and presumably the…

SDF is still alive and kicking, though. I have an account with them.

[deleted]

Re: Botspam apocalypse

#58

Post by rapnie »

zozbot234 wrote: post #27
timmaxw wrote: post #21

I wonder if proof-of-work would help. Suppose every form submission requires an expensive calculation, calibrated to take about 1 second on a typical modern computer/smartphone. For human users, this happens in the background, although it makes the website feel slower. But for bots, it dramatically limits how many submissions each botnet host can make to random websites.

For small scale self-hosted forums, bespoke CAPTCHA questions can work quite well in practice. Make it weird enough and it just isn't worth that much for malicious users to break, while most humans can pass easily. Spammers benefit from volume.

> most humans can pass easily

Beware when choosing a CAPTCHA that serving "most humans" might exclude those with accessibility issues, like the visually impaired.

Re: Botspam apocalypse

#59

Post by Nextgrid »

remram wrote: post #40
Nextgrid wrote: post #16

Earlier quoted context omitted.

There are (at least) 2 kinds of spam - "technical" spam such as bots hammering the web service with requests and consuming resources, and the commonly-accepted definition of spam where bots post promotional or other obnoxious content. I feel like the article here talks more about the first kind. I do agree with your solution for the second kind of spam though.

> bots hammering the web service with requests and consuming resources I've never seen this referred as "spam". Denial of service, botting, scraping, sure, but does anyone call that spam?

The author seems to be referring to this as "spam" so I've reused their definition. In general I agree, what the author is experiencing is more akin to a DoS than a spam attack.

Re: Botspam apocalypse

#60

Post by paulmd »

paulmd wrote: post #2

> They're a major part in killing off web forums, and a significant wet blanket on any sort of fun internet creativity or experimentation. > The only ones that can survive the robot apocalypse is large web services. Your reddits, and facebooks, and twitters, and SaaS-comment fields, and discords. They have the economies of scale to develop viable countermeasures, to hire teams of people to work on the problem full ti…

few edits I wanted to make but couldn't while HN was down: this comes to a question of intentions, right? Like are you trying to build a high-value community, or are you trying to make a billion-dollar company? Photrio or Pentaxforums is never going to sell for a billion dollars like Reddit, and that's not the kind of community that Reddit is trying to build.

The highly-chaotic multithreaded model of Reddit/HN/etc is directly designed to be impenetrable and chaotic, where everyone is just responding to everyone rather than having a "flow of conversation" in which everyone is involved. The "everyone responding to everyone" is literally engagement, and that's what those sites/companies want to drive, not community-building. It's designed to suck as a medium for serious discourse, because making 27 slight variations on the same response to 27 different comments keeps you on the site.

As long as we persist in having engagement be the primary metric, that's what you will get, and as long as we persist in the idea that the objective of social media needs to be making a couple people into billionaires, engagement is going to be the focus.

And again, it's a fundamental shift in "who the customers are". Are the customers the people using the site, who want a great place to discuss the nuances of parrot taxonomy, or are your customers the advertisers? Those lead to different ways you build the community.

And you can still make a six-figure income being a webmaster of a smaller community too. You're just not going to make Reddit money off Pentaxforums.

Post reply on HN