Botspam apocalypse • Hacker News Board

Re: Botspam apocalypse

#241

Post by gnome_chomsky » Thu, Aug 04, 2022, 1:19 PM UTC

NickRandom wrote: post #159

paulmd wrote: post #2

> They're a major part in killing off web forums, and a significant wet blanket on any sort of fun internet creativity or experimentation. > The only ones that can survive the robot apocalypse is large web services. Your reddits, and facebooks, and twitters, and SaaS-comment fields, and discords. They have the economies of scale to develop viable countermeasures, to hire teams of people to work on the problem full ti…

> The solution is real simple Uhhmmm, I beg to differ and so do a lot of very smart people with many more servers and users than you or I are likely to see. As with most 'Oh, its' Simple - Just Do XYZ' solutions there are often very good reasons for not doing the 'Easy/Simple/One-Liner' and here are a few with yours - Firstly - The '10 bux' could exclude a vast swathe of the poorest. Skipping a couple of Starbuck cof…

> Most ‘oh its simple – why don’t they just…’ overlook (or are not aware) of the many, many good reasons why greater minds than yours or mine haven’t already implemented it.

The forums they are referring to have been operating with the "10 bux" model implemented on top of a highly customized version of vBulletin for over 20 years.

Re: Botspam apocalypse

#242

Post by lizardactivist » Thu, Aug 04, 2022, 1:20 PM UTC

End game: everything runs on US-owned services, and all users need to identify to be allowed to even raise a finger, so that "bad actors" can be kept out.

All while we blame Russia and China, and say that their spambots and evil actions forced us to do this.

Re: Botspam apocalypse

#243

Post by mjr00 » Thu, Aug 04, 2022, 1:21 PM UTC

closewith wrote: post #82

paulmd wrote: post #60

Earlier quoted context omitted.

few edits I wanted to make but couldn't while HN was down: this comes to a question of intentions, right? Like are you trying to build a high-value community , or are you trying to make a billion-dollar company? Photrio or Pentaxforums is never going to sell for a billion dollars like Reddit, and that's not the kind of community that Reddit is trying to build. The highly-chaotic multithreaded model of Reddit/HN/etc i…

> The highly-chaotic multithreaded model of Reddit/HN/etc is directly designed to be impenetrable and chaotic, where everyone is just responding to everyone rather than having a "flow of conversation" in which everyone is involved. I couldn’t disagree more with this characterisation. Part of the reason that sites like Reddit and HN are preferred to traditional fora (which have their own engagement mechanisms) is beca…

> I couldn’t disagree more with this characterisation. Part of the reason that sites like Reddit and HN are preferred to traditional fora (which have their own engagement mechanisms) is because it's possible to have a different set of discussions on a topic.

Preferred by whom, and in what contexts?

The Reddit/HN threaded comment styles work well in scenarios that are relatively high-traffic, ephemeral, and mostly anonymous, in the sense that you generally don't notice or care about the username of people with whom you're having a conversation. You're right that it makes it easier to comprehend because you can just read from the parent downwards to get the full context, and that's rarely going to get to double digits.

But this has a lot of drawbacks. It's a method of communication that's built for a burst of posts on a topic for a day or so, then effectively archived as people move onto the next topic.

This doesn't mean that users prefer this method of communication universally, though. Even though forums are dying, Discord continues to grow and offer smaller communities that actually have a "community" aspect to them. Depends on the server, but I pretty much never see extensive use of threads in Discord, if at all; most people are happy to have a constant flow of conversation in one of the channels. It's closer to how people have conversations in person.

Re: Botspam apocalypse

#244

Post by BoxOfRain » Thu, Aug 04, 2022, 1:22 PM UTC

hamilyon2 wrote: post #5

I experienced this firsthand with government immigration websites. The thing is there are only so many time slots and and people are forsed to use a certain web site to apply, so everyone is hunting for available time and generally none are available. So, some creative people set up bots which check periodically for them. They are paid services which will do that for you. Now we have bots hammering gatekeeper's websi…

This is pretty much the only way you can book a driving test in the UK at the moment unless you want to take your test in a random place in the Highlands.

Re: Botspam apocalypse

#245

Post by rapnie » Thu, Aug 04, 2022, 1:25 PM UTC

realaravinth wrote: post #67

tmikaeld wrote: post #23

Earlier quoted context omitted.

"mCaptcha uses SHA256 based proof-of-work(PoW) to rate limit users." https://github.com/mCaptcha/mCaptcha

Hello! I'm the author of mCaptcha, I'd be happy to answer any questions that people might have :)

See also dedicated submission at: https://news.ycombinator.com/item?id=32340305

Re: Botspam apocalypse

#246

Post by b112 » Thu, Aug 04, 2022, 1:25 PM UTC

marginalia_nu wrote: post #231

b112 wrote: post #219

Earlier quoted context omitted.

Bear in mind, inconveniencing 4.8% of users, does not map identically. Instead, you are often dumping 4.8+4.8+4.8 as you add block methods, with some overlap.

To be fair, most of my visitors are not exactly lining up with the expectations of "standard". I get >90% of my [human] traffic from desktop clients, for example.

Sure, but the logic about mitigation does hold true, if you overlap methods.

Eg, your method described in prior post, along with thongs which may lock out VPN or NAT users.

Just something to consider.

Re: Botspam apocalypse

#247

Post by tablespoon » Thu, Aug 04, 2022, 1:26 PM UTC

paulmd wrote: post #2

> They're a major part in killing off web forums, and a significant wet blanket on any sort of fun internet creativity or experimentation. > The only ones that can survive the robot apocalypse is large web services. Your reddits, and facebooks, and twitters, and SaaS-comment fields, and discords. They have the economies of scale to develop viable countermeasures, to hire teams of people to work on the problem full ti…

> This is not true at all. There are web forums that are not "web-scale" and don't spend all day fighting bot spam. The solution is real simple: it costs 10 bux to register an account, if you're a nuisance your account is banned and you pay 10bux to get back on.

That doesn't work at all unless your service is already pretty popular. Who would pay $5 to access a new, empty forum?

You mention "you need to bootstrap a community first," but that's basically an admission that this solution doesn't solve the problem at all, because you have to solve the problem in some other way to use this solution. 10bux was a solution limited to a very specific time.

Re: Botspam apocalypse

#248

Post by julianlam » Thu, Aug 04, 2022, 1:32 PM UTC

marginalia_nu wrote: post #239

julianlam wrote: post #238

I disagree with TFA's take on dealing with spam — giving up! For our app, we don't deal with spam in any novel way. We use honey pot, SFS, and Akismet. However, by far the easiest way to stop spammers is a post queue. Lots of spammers will just create a burner account, fire off their spam, and start over. Given no actual reputation, give them the trust they deserve — none. The other factor is building out a fast back…

(Author) I'm running a search engine though. Do you propose I require users to register an account, and then not allow them to search? I think my backend is plenty fast given it's hosted on a PC off domestic broadband. Most searches complete sub-100ms.

Hey, thanks for the reply!

Specific scenarios require creative solutions. For a search engine, how do you differentiate between robots and legitimate users? It seems a rate limiting step is likely the best solution.

If query rate from the same IP exceeds a threshold, throttle them creatively. +100ms the next time, +250ms the next, etc.

The upside is these bots will adjust their strategies to hit your site slower, which is the whole point, isn't it.

If they spread requests across IPs, perhaps try fingerprinting. I'm not sure how effective that is on the backend though.

Re: Botspam apocalypse

#249

Post by boredumb » Thu, Aug 04, 2022, 1:33 PM UTC

I get a ton of spam from my contact me pages even with a captcha in place, i've been experimenting with loading an initial dummy form and replacing it within a few seconds of loading to the real deal which seems to have cut down on bots submitting stuff.

Rate limit everything you can and use a captcha where acceptable, there are also a load of public IP and email blacklists that you can use to run a quick check. Working in a field where there is a large amount of bots and incentive to abuse we invest quite a bit of time and money in fraudulent traffic detection using a cornocopia of different services in tangent and at the end of the day we still see a small percentage of traffic getting through that is fantastically human like.

With that out of the way, I've been engulfed in AI and GPT3 functionality lately and I thought this post was going to be doomsaying the coming apocalypse of bot spam, because the level of human like quality coming from the AI is going (already has) to make deciphering human vs bot traffic/posts/emails/comments nearly impossible. It will be fun here soon when we see forums entirely dedicated to bots conversing and arguing with each other outside of reddit.

Re: Botspam apocalypse

#250

Post by djohnston » Thu, Aug 04, 2022, 1:36 PM UTC

I work in this space at a company you've heard of - even at our scale and with our resources the proportionally larger attack incentives mean we are constantly firefighting.

> The other alternatives all suck to the extent of my knowledge, they're either prohibitively convoluted, or web3 cryptocurrency micro-transaction nonsense that while sure it would work, also monetizes every single interaction in a way that is more dystopian than the actual skull-crushing robot apocalypse.

I understand the drawback here but I would like to see monetized transactions employed as a defense layer a little more before we make a final decision. It is undemocratic, to be sure, but maybe for those of us who can afford it it's still better than the cesspool we currently sift through on every major platform. Anyone aware of any platforms taking this approach?

Maybe the fediverse will help - by fragmenting networks attackers may have less incentive to attack a particular one.