Slashdot Mirror

"On problem, as with any universal rating scheme is that it would be easy to, say, create 20 accounts and consistantly mark-down a certain author, something you cant do on /. because you would have work the accounts up to moderator status first."

If you're talking about the system used on Kuro5hin, you should be aware that the number of comments needed to turf or post a story is a percentage. As you create more accounts to affect the vote, more accounts are required to affect the vote. You end up chasing your own tail if you attempt to abuse it that way.
--

Anyway, the mod system described is not the one on K5. It's in Glasscode, which is the system the article is about. Which does not run K5. (Note: I'm not sure if you understood this or not, Sig11, but a lot of other people got it completely wrong, so that's for them).

Lastly, some advice for the kiro5hin maintainers - don't count on obscuring the statistical system to deter your attackers for long.

Which part of the statistical system do we obscure? If you want a full and detailed explanation of how the various K5 systems work, see our relaunch article.

Otherwise, I agree-- the system always has to be evolving. Think about it-- you cannot create an automated system that isn't eventually susceptible to automated attack. It's that simple. You just have to make it hard enough to attack that it's not worth it, and use the lag time to keep ahead of the kiddys. And sooner or later, you lose the race, pick your ass up, and try again (c.f. this summer for K5).

--
There is no K5 cabal.

Anyway, the mod system described is not the one on K5. It's in Glasscode, which is the system the article is about. Which does not run K5. (Note: I'm not sure if you understood this or not, Sig11, but a lot of other people got it completely wrong, so that's for them).

Lastly, some advice for the kiro5hin maintainers - don't count on obscuring the statistical system to deter your attackers for long.

Which part of the statistical system do we obscure? If you want a full and detailed explanation of how the various K5 systems work, see our relaunch article.

Otherwise, I agree-- the system always has to be evolving. Think about it-- you cannot create an automated system that isn't eventually susceptible to automated attack. It's that simple. You just have to make it hard enough to attack that it's not worth it, and use the lag time to keep ahead of the kiddys. And sooner or later, you lose the race, pick your ass up, and try again (c.f. this summer for K5).

--
There is no K5 cabal.

I can think of another site that has dealt with similar issues a few other times :-)
--

I can think of another site that has dealt with similar issues a few other times :-)
--

I can think of another site that has dealt with similar issues a few other times :-)
--

I can think of another site that has dealt with similar issues a few other times :-)
--

1990: You could easily read everything in comp.*. You bitched about all the weenies clogging up the alt hierarchy.

1995: You could easily read everything in comp.lang.perl. You bitched about all the weenies clogging up the comp.* hierarchy.

1998: You could easily read everything on slashdot. You bitched about all the weenies clogging up Usenet.

July 2000: You could easily read everything on kuro5hin. You bitched about all the weenies clogging up slashdot.

September 2000: Bloody weenies clog up kuro5hin. End of universe as we know it. Film at eleven.

Slashdot sucks, film at 11.

News for nerds, with sane submission queues

A great place to troll (heck, even their articles are trolls!)

An appropriate place for song parodies because everyone loves song parodies!

I realize slashdot has this all in one place, but the moderation system and the userbase is so pathetic these days that it's a wonder we old-timers bother to stick around. I've had this account for less than a week, and I'm already disgusted with slashdot! It used to take months for that to happen...

Smoke pot! Programming while stoned is lots of fun, and it's easier to get things done. When I'm not stoned, my mind tends to wander and I read Kuro5hin and Smokedot all day :-) Smoking pot also does wonders to reduce stress.
--

In conclusion, maybe all the Slashdot editors have been so drunk, they have hired minions of horny monkeys to approve story submissions. Can it get any worse? Hopefully, only better..

Discussion sites based on the Scoop engine let the users pick the stories. Kuro5hin is the most popular Scoop site.

In conclusion, maybe all the Slashdot editors have been so drunk, they have hired minions of horny monkeys to approve story submissions. Can it get any worse? Hopefully, only better..

Discussion sites based on the Scoop engine let the users pick the stories. Kuro5hin is the most popular Scoop site.

"Are you sure you included a URL? Didja test them for typos?"

Who knows, indeed. This is typical of Slashdot's cathedral method of story selection, as compared to kuro5hin's bazaar method. Many eyes make all bugs shallow, and all that. I'm surprised ESR hasn't picked up on this yet.

It's called Scoop, and it runs over at Kuro5hin...
--

Kuro5hin's coverage of this is quite extensive.

This same story was on kuro5hin with exactly the same submission text.
Methinks someone's trying to be funny.

Related links: 1 2 3 4 5 6 7 8 9 10

Related links: 1 2 3 4 5 6 7 8 9 10

So yeah, it's back up for real, but Slashdot links don't seem to get through... (instead, right click, choose "copy link location," and paste)...

As the 'security guy' for my home, Kuro5hin.org, and other firewalls I've setup for people I know, I can tell you that:

"after all, a bunch of them are probably not even very much up-to-date and it takes a lots of time and experience to secure properly a Linux server. "

Is wrong! It's very simple: you need three things to lock down a box from remote root: nmap, lsof, and kill. Find what's open (nmap scan TCP), find out what 'owns' the port (lsof), and kill it. Then set your system to not run it. The RPC services should be turned off without even bothering to check if they're running -- every distro has them one by default (why!?). ps -ax|grep rpc .. kill. Then go and chmod -x all those binaries. No remote root. Simple, effective. You could probably have perl scripts do it :-)

Otherwise, it's just watch bugtraq, watch your box, and be suspicous. Oh, and don't run Washington University code ;-)
--

"If you look on the site, rusty all but asks for a post."

Well, maybe we need to get you some new reading specs.. "[Update by Inoshiro, 13-09-2000 11:20:00 UTC]" :-)
--

One amusing tidbit that I found while perusing the source for the Kuro5hin home page was this:

<!-- <p>On a side note, I'll prepare a list of the sites involved in the initial attack who have not been helpful in finding information about the attacker. Expect to see it within a few weeks.</p> -->

It would be nice to know where this abuse originated, and who was most interested in protecting them. A nice LARTing is definitely in order.

Instead of initially transfering it over the net, why not print it out on say paper, or a t-shirt, something along those lines. It is much more difficult to track anolog items, just look at paper money for example. Once the code is distributed to enough people the cat will be out of the bag and the people who recieved to code can start putting it in digital form and on to the internet.

If you are real ambitious you could hide the code into a picture. Then if you could get this picture into a highly distributed magazine then everyone would have the code and all they'd have to do is scan it and run it through a program to decode it. This picture method would also work if you want to still use the internet to distrubute it, atleast it would help a bit.

I would think if many people have the code before it is posted to the internet it would prove very difficult to prove who's code it is, and they would have to sue every single person who put it up which would take quite some time if they'd even bother.

Thats kind of like ShouldExist.org Its a kind of idea exchange place. Sounds a whole lot like your idea (but it doesn't run slashcode, it runs scoop.

AntiBasic writes "This article over at InfoWorld [my emphasis]

I wonder if AntiBasic and the editors at /. know and understand that Robert X. Cringely's column at Infoworld is nothing more than a gossip column. I'd hardly qualify it as an article. Might as well make it a /. headline, though, gotta keep pace with those Mac rumors that are actually jokes.

The only think we can be halfway assured of (and only halfway at that) from one of the Cringely columns is that some anonymous people that claimed to have worked at MS claim that some systems are *nix driven via email to Cringely. Yup, there's some breaking new for you. Anonymous ex-employees have gripes about MS products.

I don't really expect /. to be news par excellence, but many stories lately might as well come out of the Weekly World News.

I can't wait for K5 to come back online next month.

Anonimity definitely has a dark side.

A few years ago, Time magazine did an excellent piece on the problems to today's society. One of the things they pointed out is that the privacy of a modern household has greatly increased the incidents of child abuse. In the society that we evolved in, one large factor that stopped people from abusing their child was the fact that there was no privacy--if you abuse your child, the whole village knew about it.

The anonimity of the internet causes similar problems.

Any system administrator knows that if they put any pornographic images on their web server, their machine or their machine's connection will quickly get overloaded. For example, one of my users put up pictures of attractive women. The women were not even naked, yet the server's connection was still overloaded.

I have heard it said that the most common term asked for in the leading search engines is "pornography". People who would normally be too embarassed to go in to a liquor store or a peep show have no problem getting porno on the net. The internet makes people do what they would not normally do.

While pornography is somewhat harmless, other activity on the internet isn't. The actions of the anonymous person who brought down Kiro5hin come to mind. As does the random bannings on many IRC channels (where the operators as often as not broke in to accounts or engaged in credit card fraud to get a system they could run a bot on to control the channel), the efforts people go to to cheat in online games, countless breakin attempts any experienced system administrator sees in their logs, the nonstop tide of spam, and so on. All of these are things that poeple do when they do not get a chance to look in the eyes of the person who they are harming with their selfish actions.

It does not surprise me that the internet is full of people who take but do not give back. Human nature has always had the takers who complain when the stuff they are not taking is not good enough for their selfish purposes, and the givers who get little in return for their giving except complaints from the takers. The anonimity of the internet makes this problem worse.

Anyway, that is my rant of the day. Time to go back to coding my current open-source project.

- Sam

I think it's something akin to the people who don't read the articles but have something to post. Sometimes this is caused by the slashdotting of the articles. Other times, and I think this is the majority of times, it's simply due to lack of time. Slashdot has so many contributors that, if someone did take the time to review the product in question (or, for that matter, read the article), they would be hard-pressed to be noticed underneath the hundreds of other posts.
That's one of the reasons I miss K5 - a smaller userbase generally meant more, and better, discussion. I still like it here, but it's hard to get a word in edgewise.

This is why I like Kuro5hin.org so much... There the users decide if a story gets posted or not... If only it was back up... :-(

There are in fact a significant number of checks in place to slow down abuses (notice I did not say "prevent abuses"). While it's certainly possible to continue adding more and more, it's equally possible to continue creating spam scripts that get around whatever checks are in place.

Until we get real AI, then things like the "lameness filter" will never work. And the worse thing is, they even encourage the spammers to get around them - I remember there being a spate of spam shortly after the lameness filter was introduced in the first place. It's just asking for trouble really.

Oh, and you might want to tell Rob to pick better names for these things - "lameness filter" and "bitchslapping" are both the sort of name that gets people wound up even more than the thing itself.

Probably the only solution which would actually work in the long run is banning non-logged-in posting entirely, and making it difficult to get a new account. Note that this change would significantly change the way the site operates.

Yeah, it wouldn't be /. then... that's a tough one to answer. The other alternative is to completely change moderation/Karma etc. - there's an interesting proposal at scoop.kuro5hin. org about a "mojo" system of moderation which might actually cut down on spam. Whether it'd work with a site of /.'s size is another question though.

I don't think there is anything of quality posted anonymously - hasn't been for a long time.

Not entirely true, it's just buried under a lot of crap and nobody sees it. Some of the more intelligent AC posters moved to k5 before it died.

Perhaps another solution would be for the general slashdot readership to a) avoid feeding the trolls and spammers and b) moderate freely. It's not ideal, but nothing is.

I don't think a) is something policy can change... :) But b) might help, as long as the problem of "revenge" metamoderation is solved - a lot of people don't moderate anymore thanks to people constantly metamodding them as "unfair".

Anyway, just some of my thoughts...

You choose the stories at kuro5hin.org

hrm... not anymore...

I'm very sad to see that "the bastards got you down". Kuro5hin.org was an interesting site that was just starting to take off. I had dozens of stories in my hotlist that I hadn't even had a chance to read yet. I do hope this shutdown is temporary; it was a good site. (I don't suppose you can put it up in a readonly mode for registered users to view old material?)

I understand the frustration of dealing with assholes on a volunteer basis; I don't think anyone can fault you for shutting the site down. Still, I think it provided a valuable service to the community, and I think this situation is quite unfair to you. That's why I decided to send you this unsolicited $20 donation for Kuro5hin.org in appreciation for all your hard work. Whether or not you ever revive Kuro5hin.org, keep the money; you've earned it. (Use it to go see a good movie or something!)

Take a break for a few days or weeks; it sounds like you need it. Then, consider if there's a way to bring it back, in a form less vulnerable to abuse. Perhaps anonymous ID's (with waiting periods before posting) and/or "sponsorship" by existing users might help somewhat; I don't know. Maybe just leaving the site down for a week or two will bore the current attackers into going someplace else.

It sure would be nice to return to the spirit of cooperation that Usenet News had 20 years ago. Unfortunately, it's not clear how that's possible given the rampant wave of immature script kiddies ruining everything they can...

I'll have to read the judge's ruling and the statute, but my understanding is that an injunction is backed by a bond (or perhaps other terminology, but same effect) placed by the plaintif, in proportion to damages. I suspect a similar arrangement in this case. Statute would be 17 USC 502, though I don't see reference to the bond here. Hmmm....

IANAL. Corrections/amplifications apprecitated.

What part of "Gestalt" don't you understand?
Scope out Kuro5hin

Of course, with /., we don't know what goes on in the sub queue, or if/when it's being attacked. It would be interesting to know about this, though there is the copycat problem associated with asking the question.

And I've got to say, /.'s been a great friend of K5 today, shout out to VA as well. Thanks, people. The world may not be perfect, but parts of it are excellent.

What part of "Gestalt" don't you understand?
Scope out Kuro5hin

Rusty pulled K5 "because I didn't want my name associated with what was showing up on the site". The issue was discriminating signal from noise. At a certain point, things reached the level of crashing scoop.k5.org, but this wasn't the initial or principle problem.

The problem is that IP-based blocking only works against finite IPs. In this case, the attacks were coming from a relatively small number of sites, but things kept escalating beyond the ability of the K5 volunteer staff to deal with them.

Yes, chokepoint DoS is a possible attack, but the weblog was choking on poor quality data long before that.

What part of "Gestalt" don't you understand?
Scope out Kuro5hin

Whoops, scoop.kuro5hin.org seems to be down right now, not surprisingly. You can still the Scoop project on sourceforge, though.

What pains me is that the Three Big Weblogs (TBW) have portions of the solution. Slashdot has filtering tools. K5 has a good moderation system. Advogato has a good membership vetting system. However, the pieces need to be put together. Having them on seperate systems doesn't quite cut it.

What part of "Gestalt" don't you understand?
Scope out Kuro5hin

I posted a rough set of notes on what I felt are the components of a good moderation system at scoop (http://scoop.kuro5hin.org/). Unfortunately, the site's down at the moment.

Abstracting, the Scoop engine uses a bounded metric (floating point 1-5 score) plus editorial oversite (content can be removed) to filter content.

Some of the interface tools need to be improved. Bulk moderation (set scores, then submit en mass) and filtering (seting min/max thresholds) need to be implemented. There's also the whole issue of anonymous story and content submission -- I ultimately feel that a solution akin to that described by Larry Lessig in Code and Other Laws of Cyberspace, the "Yale Wall", is necessary. This describes a physical posting board on which anonymous posts were allowed (not garbage-collected), if signed, potentially by anyone. Weblog equivalent would be an anon queue, regularly cleaned out, in which registered users could "sign" posts, but wouldn't be obligated to. Anonimity is then a grant by the community, but isn't a fully free of responsibility.

I do feel somewhat strongly that there has to be an equivalent of what's called "karma" at /., though the past reaction has been rather strongly negative when the issue's been raised at K5. Advogato's trust metric is one implmentation, I think it's better than /.'s, but I haven't seen something that works really well yet.

What part of "Gestalt" don't you understand?
Scope out Kuro5hin

I posted a rough set of notes on what I felt are the components of a good moderation system at scoop (http://scoop.kuro5hin.org/). Unfortunately, the site's down at the moment.

Abstracting, the Scoop engine uses a bounded metric (floating point 1-5 score) plus editorial oversite (content can be removed) to filter content.

Some of the interface tools need to be improved. Bulk moderation (set scores, then submit en mass) and filtering (seting min/max thresholds) need to be implemented. There's also the whole issue of anonymous story and content submission -- I ultimately feel that a solution akin to that described by Larry Lessig in Code and Other Laws of Cyberspace, the "Yale Wall", is necessary. This describes a physical posting board on which anonymous posts were allowed (not garbage-collected), if signed, potentially by anyone. Weblog equivalent would be an anon queue, regularly cleaned out, in which registered users could "sign" posts, but wouldn't be obligated to. Anonimity is then a grant by the community, but isn't a fully free of responsibility.

I do feel somewhat strongly that there has to be an equivalent of what's called "karma" at /., though the past reaction has been rather strongly negative when the issue's been raised at K5. Advogato's trust metric is one implmentation, I think it's better than /.'s, but I haven't seen something that works really well yet.

What part of "Gestalt" don't you understand?
Scope out Kuro5hin

Persistant buggers out there.

What part of "Gestalt" don't you understand?
Scope out Kuro5hin

God.. I guess.

Check out scoop.kuro5hin. org, too...

This sounds just like what's going on at /. except that at /. apparently the back end is tougher and the system itself just keeps on running.

At scoop: endless automated posts by, in this case, an "Anonymous Hero" -- coming in about every 1 or 2 seconds, with the title and the body of the post just blocks of randomly assembled phrases.

It's occured to me some time ago that all the AC bullshit that gets posted here is by a bot (or bots..) or a script (or scripts..)...

...but what I don't understand is why our /. crew isn't hard at work coding a defense?

Perhaps because they are afraid of even worse assaults if they don't let the scr1pt k1ddi3z have their way?

Has a tacit agreement been reached: "We'll let you post your AC crap as long as you don't shut us down completely."

Maybe the /. folks and the kuro5hin folks can get together and come up with a joint defense for this kind of nonsense...

Or maybe it's really way past time to get rid of anonymous posts altogether.

Of course, we could just run up the white flag and surrender to these punks completely, except that /.'s already acting like it's done just that.

t_t_b
--
I think not; therefore I ain't®

The code they use is scoop

It's hard to explain what was happening at kuro5hin to someone that has never seen it. The stories that were submitted there were seen and voted on by all users. If the story was good and got lots of +1 votes, it was posted, otherwise it was not posted. Rusty (the maintainer) did not want to stop anonymous story posting because kuro5hin would lose a lot of good stories. They did ban IP's that these were coming from, but the attacker had many to come from. Blocking subnets was the same deal.

Actually scoop is still up, most of the discussions about moderation/site maintenance/code sits there.

Acutally, Scoop states that although we have given them significant load, and caused many ISEs, we haven't taken the site down. They're kinda proud of that, and should be.

Good luck to em getting back up, let's offer all the support we can.

Does k5 implement any sort of time delay between submissions (either stories or comments) coming from the the same ip address? Or was the problem that the attacker(s) used a highly distributed attack?

Just a few thoughts...
----

Scoop is still up and available...

Its user base was much smaller than Slashdot, and as of the time the attacks started, discussion tended to be more "useful" than what we have here at Slashdot now, since it hadn't attracted the attention of most of the internet. I've been around Slashdot long enough that it reminds me of what this place used to be like in the early days (from my perspective, late 1997 - early 1998).

If you want to have an idea of what the flavor of Kuro5hin was, have a look at scoop.kuro5hin.org, the development site for the scoop engine, the back end of Kuro5hin. I assume the engine is still under development despite the shutdown, and I certainly hope it continues to be developed in the face of all this crap.

I'm not dumb enough or idealistic enough to have expected that Kuro5hin wouldn't have eventually been overrun with the same kind of gargage that Slashdot gets every day, and I don't expect that it will never happen again to sites like Slashdot or Kuro5hin again either. It's sad, but probably just a fact of life that we're just going to have to deal with idiots. Slashdot has shown that technical solutions aren't capable of solving other peoples' personal problems, even though they can seem to make them manageable. I guess the fact of the matter is that no amount of good coding (or bad coding either, for that matter) can keep a jackass from being a jackass.

-------

How about a system where you upload your page and it gets voted for/against like on kiro5hin ? I think that would be an interesting site.

There was a story on kuro5hin about someone who run a website with open file access, and his computers have just been seized by the FBI after some companies complained about illegal stuff that was uploaded. This sounds all too similar.

---
Jon E. Erikson

Yeesh. I'm going through your posts one by one and you display an amazing ability to count on nobody looking very hard.

" You may not agree with the law or its interpretation, but that's no excuse for breaking it! "

How else do you get the validity of a law tested?? You have an OBLIGATION to break lousy laws.

" to derail the Truths that have been revealed to all of us through the words of our Lord. "

Do I even need to touch this one?

" ...the fact that open source imitates rather than innovating,... "

Uh... DeCSS...? You remember, that little program that has the MPAA on it's ear, the open-source program that has Fair Use applications? That thing?

My .02
Quux26