Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Is Hacker News under attack from spam bots?

news.ycombinator.com

Post reply on HN
Print view View original

471–480 of 513 posts

Re: Ask HN: Is Hacker News under attack from spam bots?

#471

Post by mysteria »

krapp wrote: post #443
mysteria wrote: post #410

Earlier quoted context omitted.

I don't want them to require a email/phone for privacy's sake, but they should definitely have a captcha of sorts to limit bot accounts.

I don't know... Hacker News keeps complaining that they want the old 90's web experience back, now it feels like some shitty PHP messageboard from back in the day getting pwned by script kiddies. Enjoy the nostalgia while it lasts I guess.

I clicked on the Discord link in the spam message for fun, entered a random username, and immediately got asked to verify with my phone number before I could even read the messages in the chatroom. HN doesn't need to do that and I don't want them to do that, but a simple captcha or a proof of work algo like what Cloudflare uses would at least slow down the flood of bot accounts.

Re: Ask HN: Is Hacker News under attack from spam bots?

#473

Post by water-data-dude »

Oh my god, you aren’t kidding. As of right now, there’s 350 (plus or minus a few) dead spam comments at the bottom of this page. Someone obviously misplaced a decimal somewhere - you obviously don’t want to flood a forum with THAT many bot messages.

Re: Ask HN: Is Hacker News under attack from spam bots?

#474

Post by cabbageears »

Bilal_io wrote: post #400

Are you lonely and want to do something? Flag those spam comments. Yeah, I was surprised by the amount, it feels like an attack rather than spam. I hope this didn't interrupt Dang from something more important.

    function modifyElements(pSel, cSel, rxStr) {
        const regex = new RegExp(rxStr, 'i');
        const pEls = document.querySelectorAll(pSel);
        pEls.forEach(pEl => {
            const fEl = pEl.querySelector(cSel);
            if (fEl && regex.test(fEl.textContent)) {
                pEl.style.display = 'none';
            }
        });
    }
    
    let rx = /(hi are u lonely|want (an )?ai gf?)/i;
    
    modifyElements(".athing.comtr", ".comment", rx);
People can add onto the regex as needed, I guess. I haven't seen enough of the comments to be more specific since that seemed to get them. :-/

Re: Ask HN: Is Hacker News under attack from spam bots?

#475

Post by troydavis »

varenc wrote: post #460

Anyone have some insight into the motivation of spam bot behavior? It doesn't make sense to me that they'd intentionally re-post the same link on a story 100+ times. Perhaps repeating the same link is good for SEO farming? Or somehow there's a belief that 100+ identical comments is more effective than just a few? Also the comments all seem to end with a 15 character random string, which I assume is just there to add…

Just a guess: a teenager who learned to script and thought this was novel. This isn't an organized marketing campaign, it's a DoS with some links for amusement. Other than the volume, it's not even script kiddie level. Presumably they have access to proxy servers, though.

Re: Ask HN: Is Hacker News under attack from spam bots?

#476

Post by celdon25 »

mysteria wrote: post #471
krapp wrote: post #443

Earlier quoted context omitted.

I don't know... Hacker News keeps complaining that they want the old 90's web experience back, now it feels like some shitty PHP messageboard from back in the day getting pwned by script kiddies. Enjoy the nostalgia while it lasts I guess.

I clicked on the Discord link in the spam message for fun, entered a random username, and immediately got asked to verify with my phone number before I could even read the messages in the chatroom. HN doesn't need to do that and I don't want them to do that, but a simple captcha or a proof of work algo like what Cloudflare uses would at least slow down the flood of bot accounts.

That’s the Orwellian way that discord cracks down on users that it deems, for whatever reason, “suspicious”. It is tied to the IP address and anything else associated with it, but if you had an existing account before the flag then that account won't be flagged, only new accounts. There is no appeal process and they won’t even tell you what your offense was.

Unfortunately I’ve had to pay for an extra cell phone line just to use the app for work. VOIP numbers are rejected and must be unique per account. In my case it was likely because I had the audacity to back up my chat messages with a script. After a few years I can make new accounts again but I feel like I’m playing Russian roulette every time I do.

If you don’t use separate accounts for privacy someone can dump a list of potentially any known server you’ve ever been in. I knew it would be only a matter of time until something like this would happen: https://www.reddit.com/r/privacy/s/A5nvuZBLab

Re: Ask HN: Is Hacker News under attack from spam bots?

#477

Post by mysteria »

celdon25 wrote: post #476
mysteria wrote: post #471

Earlier quoted context omitted.

I clicked on the Discord link in the spam message for fun, entered a random username, and immediately got asked to verify with my phone number before I could even read the messages in the chatroom. HN doesn't need to do that and I don't want them to do that, but a simple captcha or a proof of work algo like what Cloudflare uses would at least slow down the flood of bot accounts.

That’s the Orwellian way that discord cracks down on users that it deems, for whatever reason, “suspicious”. It is tied to the IP address and anything else associated with it, but if you had an existing account before the flag then that account won't be flagged, only new accounts. There is no appeal process and they won’t even tell you what your offense was. Unfortunately I’ve had to pay for an extra cell phone line…

I don't use Discord anymore but the phone number thing seems new, in the past I was able to visit as a guest and be able to read messages but not chat. Then again Twitter and Reddit are doing the same thing now and forcing people to log in, so I'm not surprised.

Considering how many community groups and open source projects now use a Discord in place of a public forum this looks like a disaster going forwards since all the information in there will become locked up. And of course the chats and internal discussion threads aren't indexed by search engines.

Re: Ask HN: Is Hacker News under attack from spam bots?

#478

Post by anigbrowl »

fragmede wrote: post #461
anigbrowl wrote: post #445

Earlier quoted context omitted.

Obviously you can't filter for every possibility in advance, but with a hands-on moderator and some regex it should be super-easy to throttle this. And as more than one person has pointed out, just shutting down new account creation/posting for 24 hours would be equally effective. I'm perplexed at how a mature site full owned and catering to network technologists is vulnerable to such a laughably crude attack.

but then you've shut down account creation for 24 hours. The site operators get to choose how they want to play it, but it seems they don't want to do that just yet. You're right that it's laughably crude though. Says a lot about things that this hasn't happened until now.

but then you've shut down account creation for 24 hours.

But so what? The impact of that would be negligible, almost certainly less than that of having site performance go through the floor/become temporarily unreadable. It's not like a B2C product launch, and the target audience of HN is more or less optimally positioned to understand why one might deliberately interrupt service.

Re: Ask HN: Is Hacker News under attack from spam bots?

#479

Post by anigbrowl »

fragmede wrote: post #470
anigbrowl wrote: post #418

Earlier quoted context omitted.

All these approaches increase server load. You're likely not the only one doing so, so the server has to respond to a read and flag request for every person. I'm not sure how many flags it takes to kill a post, something like 6 iirc. When you multiply that by the number of spam posts it adds up to a lot. I'm honestly perplexed that HN doesn't have any kind of string filtering facility considering its centrality in th…

it's never needed it before, and it's not being run by a huge team. it's hard to make time to prepare for a thing that hasn't happened before when you're busy dealing with everything else.

This isn't the first spam/DDOS attack on HN, although it's one of the more severe. This is basic stuff for any kind of user-driven forum, going back to the BBS days. You are going to have periodic problems with trolls and spammers so you need to have some sort of mitigation process in place. That doesn't need to be some sort of top-heavy new technology, it can be as simple as the ability to add a few new scripting rules or wildcard matches on a few minutes notice, or hit the pause button on new account creation.

Re: Ask HN: Is Hacker News under attack from spam bots?

#480

Post by EasyMark »

mysteria wrote: post #410
krapp wrote: post #382

Earlier quoted context omitted.

This forum is built with early 2000s technology. It doesn't even use two-factor authentication or captchas for creating accounts. This was honestly bound to happen sooner or later.

I don't want them to require a email/phone for privacy's sake, but they should definitely have a captcha of sorts to limit bot accounts.

that seems reasonable to me
Post reply on HN