Ask Slashdot: Using a Sandbox To Deal With Spambots?

shellster_dude writes "Slashdot is certainly no stranger to the problem of spam bots. While blocking a spam bot may seem like the best solution, it is likely that the spammer will simply re-register with a different name. While trying to solve this dilemma on my own forums, I had an epiphany. What if, instead of blocking a spam bot, I could mark a spammer, and then hide all their comments from everyone else? The spammer could continue to go their merry way, spamming to their heart's content. When they visit the forum, they see their spam comments correctly placed in the threads, but their comments would only be visible to them. Thus, an effective sandbox which would prevent them from registering a new user once they had been 'blocked.' Are any other Slashdotters familiar with this technique? Does any software currently use this technique?"

Comments

I will sell you this solution already debugged!

[HornWumpus]

Why is nobody responding?

Re:I will sell you this solution already debugged!

[MightyYar]

Because it will be trivial for a spammer to check his posts from another account?

Re:I will sell you this solution already debugged!

[Impy the Impiuos Imp]

This would require them to do so. It's a running battle but spam can be caught and flagged easily enough.

Re:I will sell you this solution already debugged!

[nmb3000]

Because it will be trivial for a spammer to check his posts from another account?

I remember reading an article on Joel on Software some time ago that talks about this kind of approach. The difference was that instead of only showing those posts to the spammer/troll's account, they were also shown to that poster's /8 or /16 subnet (or something like that). This goes far in solving the problem for multiple accounts (but still fails for proxy servers).

The downside is that the troll's "local Internet" sees the spam/troll, but the greater Internet doesn't. It always seemed like a good tradeoff to me.

Wish I could find the article now, but not having any luck.

Re:I will sell you this solution already debugged!

[stephanruby]

Either way, whether you shadow ban them, or ban hem outright, the problem is still the same after that.

You'll still need to keep track of their ip address and other meta-data information to minimize the number of accounts they can create under different names. Also, I think you're overestimating the number of spammers who spam and then who check their spam results after that.

On my site, I strip out html and even urls, and yet, I still get plenty of spammers wasting cpu cycles trying to insert urls automatically.

Re:I will sell you this solution already debugged!

[KhabaLox]

Easy solution. Make it so that spammers can see posts by everyone, including other spammers. That way spammers will think they are being successful, especially if you do an IP block on them.

Until the 2nd, 3rd, 4th account is identified and marked as a spam account, it won't be able to see the posts of the 1st account.

Re:I will sell you this solution already debugged!

[Frnknstn]

This technique is widely used against trolls on various Internet forums. It is often called 'Hellbanning'

Re:I will sell you this solution already debugged!

[nschubach]

If we used addresses assigned by region it would be a great way to advertise locally. ;)

Seriously though, that (subnet sand-boxing) would be a great method. Especially considering you could then just block whoever it was locally spamming you instead of having to globally filter every spammer.

Re:I will sell you this solution already debugged!

[BronsCon]

Make new accounts able to see spam posts until x-number of successful posts. By that time, you'll have been able to identify the spammer, at which point they will continue to see their spam.

Re:I will sell you this solution already debugged!

[CSMoran]

By reducing the probability of the spammers finding out and, in consequence, of creating more accounts. Should this technique be successful.

Re:I will sell you this solution already debugged!

[Ziggitz]

Congratulations are the most inappropriate use of lmgtfy ever. It was neither an easily derivable search term the article poster could have used themselves without prior knowledge nor was it in fact, the use case that the poster was talking about.

Re:I will sell you this solution already debugged!

[Hentes]

He wouldn't spam from the account used for checking.

Re:I will sell you this solution already debugged!

[mdfst13]

Subnet blocking works great if the spamster posts himself from his own computer.

If the spammer instead hires someone and then double checks that person's work, this would fail any time they are on different subnets. At best that makes it less likely that the spammer/contractor relation works out. If the spammer uses a botnet to post, this does the reverse of what you want. It gives the spammer access to the subnets on which the botnet is located, but it shows the spammer that it didn't post for everyone else. Same thing if the spammer uses the botnet to proxy manual attempts.

My WordPress site gets a regular stream of spam posts. It's pretty obvious that they don't check if they post, as they never post (I have to manually approve all comments). I very much doubt that most of them involve any human interaction whatsoever.

This might help briefly. As soon as the spammers realize what's happening though, it will be trivial to adapt their botnets to this. All it takes is a proxy and this method loses its verification.

I like the idea of write-only comments. That would defeat most automated spam commenters. I'm less convinced of the utility of attempting to show the posts to the spammer. Particularly extending it to try to catch verification attempts by someone other than the original poster.

Re:I will sell you this solution already debugged!

[Cheech Wizard]

Because it will be trivial for a spammer to check his posts from another account?

It depends. For example vBulletin has their "Tachy goes to Coventry" option. I did use it in the past but haven't now for several years because all the person has to do, assuming the site is open to the public as my forums are, log out and view the thread their post is in (or if it's a thread they started and thus just has their post in it, just look at the forum listing they posted in) and they will see their post/thread isn't there. No need for a different user account. What I do with all spammers is BAN them. In vBulletin it locks out that email address. The spammer may have many, but since it's time consuming to make another account and try again, especially when they see their first attempt failed, they generally go away. NOTE: I'm referring to HUMAN spammers as opposed to script BOTs, which are a whole different story. I found a way, and it has nothing to do with IP or email address blocks, to completely block script bots from completing the Registration process in my forum. I just put in a timer so that if it takes less than 10 seconds (you can set the time you want, I chose 10 seconds) for "someone" to complete the registration, it's going to be a script bot so the registration is aborted. I just last Saturday saw a wave of script bots start registering. I personally have never seen so many script bots in such a short time on my site. A long time ago I set up the board with "non-standard" screens to post in or start a new thread in {I edited templates} so the bots don't know how to post or start a new thread on my forum so they couldn't actually post any spam. But - It was annoying me - something like 45+ BOT registrations in less than 6 hours. I put the registration timer in and BAM - No more BOT registrations. Script BOTs are relatively easy to defeat if you remember that 1. They are FAST, and 2. They are just scripts, so when they run into a situation that they're not programed for (such as "non-standard screens) they have to stop. As always, YMMV

Re:I will sell you this solution already debugged!

[socceroos]

Interesting. However, I don't think you'd be attracting many new users when they see 90% spam on your forums.

Re:I will sell you this solution already debugged!

[HornWumpus]

Once you identify them, serve them up a custom post message web page that will do a stupid DOS attack on whatever site is currently being attacked by the B-tards.. That will make their life very interesting.

Re:I will sell you this solution already debugged!

[Goaway]

Spammers have botnets to do their posting from. No IP-based approach is ever going to work on them, as they have a huge number of IP addresses readily available, and evenly distributed across the address space.

Re:I will sell you this solution already debugged!

[Nethemas the Great]

Until you--the legitimate user were--were caught in the mess created by your spamming neighbor. There is no absolute solution to spam. Unfortunately the solution that will be put forth eventually will be to "license" computer users. Unfortunately by the time people realize that this didn't solve anything it will be too late and beyond return. The best solution for spam is to employ artificial intelligence. More specifically AI on the level of Watson and beyond. Regrettably computing power on the caliber necessary to tackle the volume doesn't exist and is presently cost prohibitive. In other words, you're screwed. Spam will be with us for some time yet to come. The best we'll have for the near term is a reasonable firewall from the worst of it using the usual heuristics and blacklist pools.

Re:I will sell you this solution already debugged!

[Neil Boekend]

Punch that neighbour. Preferably with a punchdagger

Re:I will sell you this solution already debugged!

[Anonymous Coward]

You mean like this?

Re:I will sell you this solution already debugged!

[justforgetme]

you can keep track of what accounts are accessed by what user. So when one of those accounts gets marked you just mark the associated accounts as well. It isn't perfectly clean but better deal with one misjudged user than loose thousands.

Still, just banning the troll/spamer and identifying high risk registration locations for monitoring is usually the cleanest way. Nowadays you clean your forum of one user in what 10ms?

Re:I will sell you this solution already debugged!

[Joce640k]

Easy solution. Make it so that spammers can see posts by everyone, including other spammers. That way spammers will think they are being successful, especially if you do an IP block on them.

Until the 2nd, 3rd, 4th account is identified and marked as a spam account, it won't be able to see the posts of the 1st account.

I think you overestimate spammers. 99.9999999% of them aren't people, they're bots. I doubt they're even checking from other accounts.

Re:I will sell you this solution already debugged!

[Joce640k]

Most spammers are bots who are programmed to constantly create new accounts anyway.

Re:I will sell you this solution already debugged!

[Joce640k]

Because it will be trivial for a spammer to check his posts from another account?

Yawn. When hellbanning became widespread the spammers just started creating a new account for every spam session.

Spammers are *bots* (maybe backed by people in third world countries who'll sit all day reading captchas for $0.10). Any idea of a 'battle of wits' between you and a spammer is just an overactive imagination on your part.

Re:I will sell you this solution already debugged!

[petermgreen]

Still there are possibilities for the spammer. One is to use a "test account" that is not used for actually spamming but is only used for checking if spamming was successful. Another is to just create new accounts for every spam run anyway on the assumption that previous accounts will have been caught.

This has much the same problem as many "clever" soloutions to spam. They will work as long as only a few people use them but when they become popular it's pretty easy for the spammers to implement countermeasures.

Re:I will sell you this solution already debugged!

[Phydaux]

It wasn't Joel it was Jeff :)

Re:I will sell you this solution already debugged!

[bandy]

So says the guy with the seven-digit account number.

Re:I will sell you this solution already debugged!

[Frnknstn]

You are correct about the lmgtfy link, that was supposed to be a google.com/search?q=hellban link instead. Must have been a brainfart or typo or something. Can you imagine how embarrased I must be?

Re:I will sell you this solution already debugged!

[CAIMLAS]

I like this idea, combined with spamd greylisted rate limiting.

You post a message. You get added to a greylist. If you break a certain post rate limit, you go on a blacklist where you remain until your timer counts down to 0 and you're removed from the blacklist; or you increase your counter by attempting subsequent posts.

While on the blacklist and/or greylist, you effectively have your bandwidth throttled/rate limited for the forum communication. It 'fakes' a low bandwidth connection. So in essence, you aren't preventing them from posting, you just make them think "their server sucks" and they move on to another target while making them take more time to send fewer messages (screwing up their 'economy of scale') and requiring more local resources (cpu, ram, etc.) to perform a specific attack.

In my experience, maintaining a forum is more work than maintaining a high traffic/visibility mail system that isn't set up well. Since most spamming is now automated, this probably has a higher likelihood of success. Most spam is also dispersed through exploiting bugs in the framework implementation as well, so it's entirely likely you could end up with 10k accounts, all of which are spammers.

Re:I will sell you this solution already debugged!

[sootman]

It was Joel first. I, too, remember reading about it many years ago. (Jeff's post is just a year old.) Here's a mention of it from 2004:

http://joi.ito.com/weblog/2004/12/20/happy-trolls.html

(See comment #2)

[later]

Aha! I knew I had it. Way back when, he was revamping his community, and he, briefly, made it so you had to sign up to get an email to hear when it would be launched. I still have that email. It is entitled "Building Communities with Software" but it differs slightly from this. According to Google there is exactly one copy of the original email on the WWW and here it is.

If you post something and it gets deleted, we'll use a cookie to actually continue to show you your own post. We just don't show it to anyone else in the world. 9 times out of 10, you won't even know your post has been deleted. If you delete cookies or go to another computer, you may catch us, but most of the time people don't even notice that their post was removed.

Re:I will sell you this solution already debugged!

[sootman]

It was in 2003 when he was revamping his forums. He sent out an email to members that was similar to what he posted here but slightly different, including what you're describing:

If you post something and it gets deleted, we'll use a cookie to actually continue to show you your own post. We just don't show it to anyone else in the world. 9 times out of 10, you won't even know your post has been deleted. If you delete cookies or go to another computer, you may catch us, but most of the time people don't even notice that their post was removed.

Re:I will sell you this solution already debugged!

[nmb3000]

Ha! I knew it was Joel. Thanks for digging that up!

Old Idea

[Anonymous Coward]

Old idea that doesn't fix much because spammers change accounts after 1-20 posts anyway.

Re:Old Idea

[cpu6502]

I wouldn't say it "doesn't work." I experienced this shadow banning after I mentioned I not only own a Hybrid electric car, but also a diesel car that gets similar mileage (49MPG). Well the environmentalists furiously attacked me for daring to use the word "diesel" in their forum, and the group owner (also anti-diesel) made my posts invisible.

It took me a few weeks to realize that none of my posts were being responded too. Rather than waste time with another account, I just left the place. So the shadow-ban worked.

Re:Old Idea

[timothyf]

Feels like apples to oranges a bit. You weren't a spammer, they just disagreed with you and provided a hostile environment for expressing your views, which would discourage any normal person from participating. A spammer probably wouldn't care about the shadow ban if they discovered it and would just create a new account if they felt that the target was valuable enough.

Re:Old Idea

[gman003]

More precisely, most spammers use an account once. They may make several dozen posts at once (one phpbb bot I saw would post the same thing in every single subforum at once), or they may only make one, but they seem to assume that their account will be banned pretty much after the first infraction.

Assuming they're using bots, that makes sense. The exception would be human-generated spam, especially that which tries to camouflage as actual discussion, and double-especially if they use multiple accounts to hold a "discussion" with themselves. As this is a) very expensive, time-wise and b) barely distinguishable from unpaid fanboyism, it's not something I would worry about.

Re:Old Idea

[Shoten]

And it's also not apples and oranges because spammers aren't people...they are bots. They aren't checking to see if their posts are still there, since there's not much they can do about it one way or the other, and it takes up resources (and is hard to program) to do so. The bots just go on their merry way, regardless of what is done. You're better off just whacking the spam or setting things up so that it requires a human to post in the first place.

Re:Old Idea

[EdIII]

It can be very effective. The goal of the spammer is to have their content visible to both users and search engines for as long as possible. If the account gets banned in this way very quickly then the whole operation is without value, especially long term value to any search engines.

Create as many accounts as you like. If they get banned in the same way, the spammer never accomplishes his goal and has to spend an enormous amount of resources (botnets are not cheap to create) just to get short term visibility.

Some other ideas:

  - Add some URL lookups to identify spam/malware similar to lists used to classify emails
  - Ban URL shorteners. Not needed for a site like Slashdot where you don't even see the link. Either that, or just convert the link, evaluate it, and display the target domain to the user anyways.
  - 72 hour probation period before your posts become visible to search engines.
  - Spam button for users to click. Set a threshold and allow users with good standing, high karma, to report. Real users would complain when they notice they are banned (like cpu6502) and the site admins can evaluate and take appropriate action.

Re:Old Idea

[zieroh]

As a forum owner (for a forum with an entirely different subject matter) your story sounds... unlikely. Extremely one-sided, at best. I get this kind of thing a lot on my own forum -- people who act like asshats (and are usually contrary at the same time) who point the finger at some kind of intolerance on the forum admin / moderators part. Usually, though, it's not that they mentioned some "unspeakable" word -- it's that they acted like asshats while doing it.

I'd bet real money that you were an asshat.

Re:Old Idea

[zieroh]

And it's also not apples and oranges because spammers aren't people...they are bots.

That's often true, but not 100%. I have basically two classes of spammer on my own forum. The bots are easy to detect with some clever coding (hint: bots only read HTML) but the human-driven spammers usually get through, only to be quickly banned. The bot attempts outnumber the human attempts by about 100 to 1, but the humans are far more likely to be successful.

Re:Old Idea

[Pikoro]

I just make it so someone has to have at least 2 manually approved comments or posts in order to be able to post automatically. No spam after that that isn't automatically captured. Just gotta clean out the posts every once in a while.

Re:Old Idea

[EricTheRed]

I see the same thing in my forums. The capcha gets the spam bots but the mules (humans being paid pittance to spam) still try to get through, strangely they tend to post on a Monday morning.

What I do to catch them is:
* moderate the first X posts from any user.
* don't allow posts from certain countries, usually India, South Korea & China.

There's no automation on this as its low volume anyhow but it does work.

Re:Old Idea

[gsslay]

The idea that spambots come back and check what's happened to their forum spam is as ridiculous as thinking they care if their email spam bounces or is blocked. That takes intelligence, something spambots don't have.

Spambots move on, never looking back, relentlessly spamming regardless. They work to quantity, not quality.

www.aftonbladet.se is using this, major media site

[Anonymous Coward]

This comment is used extensively at major media outlets such at Swedish' tabloid "www.aftonbladet.se." Facebook is used to register users.
When a user is perceived as spamming - or writing opinions that are unwelcome - the user is marked, and simply not displayed to other visitors. But the user himself does not know, and keeps spamming.
Evil. Pure evil.

hellbanning.

[Anonymous Coward]

http://en.wikipedia.org/wiki/Hellbanning

Re:hellbanning.

[unrtst]

Mod parent up... perfect answer to the question.

Re:hellbanning.

[Nitewing98]

So it works much like the Phantom Zone. Zod can see us, but can't interact with us. Brilliant!

Re:hellbanning.

[michelcolman]

Now, what would be even better would be fake answers from other users! If you're just trying to fool bots that might have an algorithm for detecting hellbanning, you could even just make random replies with random words. If you're trying to fool humans, you might try multiple variations and synonyms of "go stuff yourself", seemingly coming from other users.

Of course, all of this does not address the fact that you only need a single "normal" account that has never been used for spam and from a very different IP address (spoofed via vpn or whatever) to check up on all of your bots' posted messages.

Re:hellbanning.

[Kergan]

Typically, hell banned users can see each others' posts. That way, trolls and spammers get to interact with other trolls and spammers.

Re:hellbanning.

[Anonymous Coward]

Other posts have revealed the weakness in hellbanning as a remedy to spammers.
Hellbanning is also a poor choice against non-spammers. A regular user would have no idea when or why he had been hellbanned. If a single admin has differing political views, that user can be effectively banned without being made aware of it. Without being aware of it, that user will waste his time posting, believing himself to be a part of that community while being effectively shunned by it. He has no opportunity to make an appeal to a higher admin (esp. in the case of a renegade moderator) because he does not know the reason his posts are ignored.

I often suspect myself of being hellbanned when constructive posts of my own are completely ignored while trolls and flames are bumped to 20 pages of replies. Further, I've seen my own ignored posts duplicated by others receive pages of replies. Is this hellbanning or are the forums along with dummy accounts being used to artificially increase the 'forum cred' (i.e. popularity) of a user in order to place him in high places in online communities? This is similar to astro-turfing if you've never noticed it.

Lastly, hellbanning seems comparable to a citizen being arrested and sentenced in the middle of the night without charge or trial. He isn't able to contest the arrest nor does the rest of the community become aware of it. Corruption reigns.
For individual users, it's much better to forthcoming. State why the user is banned, the duration of the ban, and how an appeal can be made. If the forum is ideally antagonistic to that user, he will leave and will know that this set of people is not where he should spend his time. If, instead, he is simply ignored without knowing why, he wastes his time and continues to resort to more flagrant attempts to be heard, also becoming a burden to the hostile community. A level of transparency is much more efficient than a machiavellian plot to undermine all those whose views differ.

I'll reiterate that this was in response to hellbanning as a general solution to unwanted users rather than as

Reddit

[cornface]

Reddit does something like this.

Re:Reddit

[Hentes]

So does Slashdot. With low enough karma noone else will see your posts.

Shadow Ban

[TubeSteak]

The practice goes by several other names I can't recall, but I know it as a "shadow ban"
Basically, you tick a box and nobody but that poster can see their nonsense.

Some forum software already includes the feature, others require a plugin or a roll-your-own solution.

Re:Shadow Ban

[History's Coming To]

Yup, also known as "miserable users" on some forum software.

Hey, wacky idea, why not assign a "degree of spamminess" rating and let people decide on their own level of viewing? You could even do it for funny posts, informative posts, troll posts etc. Mind you, it could get out of hand and overly complicated.

Re:Shadow Ban

[compro01]

I believe miserable users is a different trick or at least it is on Vbulletin. Miserable users adds a lengthy delay to all of the user's actions, kicks them to error pages, etc.

Nice functionality, or it would be if it didn't do unfortunate things to server load on 3.x.

Re:Shadow Ban

[Compaqt]

Drupal has a module to do this to put trolls in their own "cave"

http://drupal.org/project/cave

Re:Shadow Ban

[fak3r]

I see what you did there, nice!

Re:Shadow Ban

[blunte]

They might become suspicious if they never saw any replies, so perhaps put all the banned folks in a group so they could spam each other. That would cause them extra angst, seeing only competitors replying.

Re:Shadow Ban

[Inda]

Wasn't this in use on SA or some other shite site I visited 15 years ago?

It doesn't work long term. New accounts are easy to obtain and the spammer/griefer/troller tends to come back with nothing to lose.

Reddit Does

[Stickybombs]

Steve Huffman, one of the creators of Reddit, talks about this exact solution during his Udacity class, Web Application Engineering. http://www.udacity.com/overview/Course/cs253/CourseRev/apr2012 I think it was during week 4 "Whom to Trust," but I don't have links to the exact video. So in short, yes, it has been done effectively in the past, though I believe they wrote their own code to do it.

Wouldn't work

[Desler]

This wouldn't work because spambots don't keep using a single account. If it were that easy spambots would have already been long defeated.

Re:Wouldn't work

[kesuki]

or you could just blog all the scams you already recieve, use weboftrust to flag their site and if your lucky they will lose their godaddy accounts. it is a lot of work, but that is where weboftrust kicks in by distributed spam detection. once their main c&c gets detected they go down. i used to use spamcop, but i was inundated with spam, and normals cant always tell spam from nonspam however web of trust makes it a little easier for end users to never go to red ring sites.

Wouldnt they just

[brickmack]

Either change accounts often, which I think is common anyway, or have a second bot checking if the posts show up, and stopping the first when it stops seeing the posts?

Hell-banning

[Anonymous Coward]

It's called hell-banning, and it's a blessing for bots, but unfair hell when applied unjustly to a non-spamming real user, as is often the case with automated solutions - I'm talking to you, Hacker News, you moronic cunts.

Two Bots

[TheNinjaroach]

Seems like it would be easy enough to work around with a second bot that checks to make sure spam is getting through.

Re:Two Bots

[Sloppy]

Spam is like burglary. Why bother breaking through the burglar bars (or writing a specialized bot for one site), when you can just go to the next house?

Re:Two Bots

[rew]

Now, please think a bit further.

What would be more effective for a spammer: Check back to see if their spam made it through? From a different account? Or.... just try and insert more spam into some forum/wiki/whatever?

I have a wiki, and now a forum that gets spammed. They don't come back to check. They come back to insert more spam. Instead of using existing accounts, they create a new one. On my wiki, the combination of measures means they are stopped from posting stuff, but not from creating accounts. So I'm getting lots of new accounts. But not very many spam posts. :-)

So... Hellbanning works: It makes sure other users and search engine spiders don't see the spam. It also helps for real-people forum-trolls: to them it looks as if the forum works, but they are being ignored.

No.

[ledow]

What makes you think that they will stop just because their account doesn't get closed?

They will not notice the efficacy of their spam, they will just keep signing up and spamming. And you'll play whack-a-mole trying to put all their accounts into sandboxes.

Just how often does a spammer go back to see if his comment posted or not, or if his email got through? Rarely. Spam works on the basis of mass volume. Put a billion adverts on a billion websites and your sales will increase somehow. And the price of those adverts is next to zero after the first few thousand.

It won't work, but it will make a lot of hassle for you, from storage to filtering to just plain bandwidth if you have a thousand spammers realising they can auto-sign-up and spam you endlessly.

It's like running a "honeypot". You'll gather lots of data at great expense and resources. But you won't stop the spam.

Re:No.

[wonkey_monkey]

But you won't stop the spam.

The idea (not that it's a particularly brilliant one) isn't to inconvenience spammers or to stop them spamming - it's designed to stop users being spammed. Think of it like putting all the mimes in the world on a remote island - they can carry on doing their thing but none of us have to put up with it.

Hmm. Excuse me, I have some extraordinarily silent renditions to arrange.

Re:No.

[coldsalmon]

Whether it works or not, "Spambot Sandbox" is a great band name.

Re:No.

[drkim]

Great idea. I can see the marquee now:

Tonight only!

Opening act:
"Spambot Sandbox"

Feature Attraction:
"Hell Banned"

Re:No.

[CrowdedBrainzzzsand9]

Agree about the mindless bots. Humans don't check the postings often, if ever. I blocked a class C IP block once. The event log showed attempted hourly postings 6 months later.

Some things that help:
--Moderate the forum: heavy human labor, but works. The nonsense of most spam is immediately obvious
--banned words: tricky to avoid banning legit postings. Best used in combination with moderation. But its pretty safe to ban the names of the commonly spammed drugs, expensive sports shoes and ladies' accessories, etc.

Re:No.

[jeffmeden]

But you won't stop the spam.

The idea (not that it's a particularly brilliant one) isn't to inconvenience spammers or to stop them spamming - it's designed to stop users being spammed. Think of it like putting all the mimes in the world on a remote island - they can carry on doing their thing but none of us have to put up with it.

Hmm. Excuse me, I have some extraordinarily silent renditions to arrange.

The idea presumes that the spammer does some sort of follow-up to see if his posts aren't just deleted immediately, who will then decide IF he should post more spam from a different account. The false premise here is that they somehow value checking for old spam more than they do the opportunity to just post more spam.

The *only* way to stop spammers is to have enough of a profile on how they operate at any given time as to be able to algorithmically track their entire process. Trying to "beat" little pieces will only result in them picking a different piece (like user verification in this case) to attack. Look at email spam; for users of high-volume mail services (like Gmail) spam is reduced to an almost unnoticeable level, thanks to their ability to see so many millions of users worth of email and put together spam patterns instantly and precisely. Therefore, a viable solution to forum spam (certainly more so than this idea) is to have a forum (or some centralized service) large enough to see forum spam from a huge sample.

Re:No.

[HornWumpus]

Once you've decided to ignore a post it's a small step to serve up a slightly different post message web page.

The spammer version post message page could just ignore the content of the message and only send minimal another spam type data, or could simply delay and fake a successful post page locally in javascript. It could fake being a common virus and hope the spammers ISP kicks him offline as a zombie (I'm thinking having it fire the post repeatedly to a well known botnet cnc server).

Re:No.

[tlhIngan]

Just how often does a spammer go back to see if his comment posted or not, or if his email got through? Rarely. Spam works on the basis of mass volume. Put a billion adverts on a billion websites and your sales will increase somehow. And the price of those adverts is next to zero after the first few thousand.

Or not.

Yes, most spammers do it on a mass basis and most don't bother to actually check if it's posted. As far as they care, their spamming tool signs up for an account (rarely, if ever, do they reuse an account), makes the postings using that account, and leave, permanently.

Spammers are paid by the volume, and they're prepaid in advance. The spammer and the content being spammed are rarely the same person - instead, a business needing "marketing services" comes up to a spammer, pays them the $100 or so, and that's it. Spammer gets paid if successful or not - they don't care if the customer ever comes back because there's plenty more.

Re:No.

[John Bokma]

Spammers spam via botnets/proxies in parallel and accept that part of their spam will never reach human eyes. If you really want to piss of spammers then report them to their hosting providers. Some -- not all, since a spammer pays money while a bitching geek only costs money -- will drop the spamvertized site. This actually costs spammers (or their customers) actually time and money.

Re:No.

[F.Ultra]

I think that the premise is more along the line that the Spambot notices that he's been targeted because he no longer can log into his account.

Re:No.

[coofercat]

I agree - and for smaller sites with less resources, you're basically encouraging traffic that eats your bandwidth and gives you no benefit in return for it.

Personally, I manually delete the small amount of spam Mollom doesn't catch,and all links have the nofollow on them. I seriously doubt the spammers are looking to see if their spam posts "work" because if they did, they'd see that I was deleting them fairly quickly and they were getting no pagerank from them anyway.

The "sandbox" is great if you have lots of spare resources and you're participating in a decentralised anti-spam solution. Otherwise it's most probably just a waste of your resources.

Hellbanning

[taco8982]

What you're referring to is known as Hellbanning (https://en.wikipedia.org/wiki/Hellbanning) and is used on various sites. I'm mostly familiar with it from Hacker News which employs it.

Re:Hellbanning

[Bieeanda]

I was going to mention this. SomethingAwful used to do this on vanishingly rare occasions, but it put extra load on their already heavily hacked VBulletin servers, and it didn't prevent the targets from otherwise making pests of themselves by 'Hellbumping' old threads up to the front page.

Well, it would be easily detectable

[guruevi]

It would certainly prevent spam temporarily but
a) the spammer would notice rather quickly if their spam doesn't show up in Google
b) the spammer could easily defeat the system by simply re-registering with another username
c) one mistake on implementing the system (eg. allowing users to read 'sandboxed' comments through a link) could maybe hide it from your users but not from the other bots that crawl your site (again Google and security bots) which would then mark your site as spam.

The problem is that spamming is usually automated so you have to have the end-user jump through hoops in order to defeat them. One of the forums I moderate actually requires a legitimate introduction on the topic of the forum before they are allowed to post in the general forums. Defeats most spammers as it's somewhat of a niche forum and automated spam is immediately recognized and user/ip banned.

Article on Coding Horror

[timdaman]

http://www.codinghorror.com/blog/2011/06/suspension-ban-or-hellban.html

Good Idea, Yet Easy to Subvert

[erik.erikson]

It's a great idea but there's an issue... If aware of such a policy, such a spammer could create to accounts. One to simply be a "is my other account banned" validation-only account. The strategy could be more effective if the "invisibility" were applied on an IP basis (all accounts from the communicating from the same IP could also view the comments) or something of the like but that strategy could as easily be subverted by switching IPs. Still, it increases the work required of a spammer and complicates their efforts, so I take it as an overall good method of discouraging spam or at least making it more expensive to spam.

Re:Good Idea, Yet Easy to Subvert

[heypete]

Indeed. I do part-time abuse desk work for a medium-sized email provider. We have basic no-automated-signup methods, such as only allowing one new account per day per /24 (we're only doing IPv4 right now, but are working on transitioning to dual-stack) and a captcha. It's reasonably effective at stopping bot signups, though we do see a lot of spammers creating new accounts from a bunch of open proxies to avoid the subnet blocks.

It's clear that they're the same spammer, as they create accounts with distinctive patterns and their post-account-creation behavior is very similar. It's really annoying. You'd think they'd give up after a while as it's clear that we're onto them, as their accounts get nuked within minutes of creation before they can abuse them.

I've proposed doing something similar to IRC servers where our server checks the user's IP address to see if it's running any open proxies on common ports, then checks various public open proxy blacklists. Alas, developer resources are constrained and they're working on other stuff.

In regards to forums and blogs, I've found reasonably good luck with Akismet and the WordPress plugin "conditional captcha" -- all comments/posts are sent to Akismet to see if the message is spammy. If it is, the plugin comes into play and presents the user with a captcha. If they solve the captcha within 10 minutes, the message gets placed in the moderation queue for approval (I figure that if it's spammy enough to trip Akismet, it is likely to warrant human moderation). If the captcha isn't solved within that time period then the message is deleted. It keeps out a ton of spam and saves the administrator time from having to go through a queue with hundreds of messages. Over the last few years, this method has caught tens of thousands of spam comments on one of my blogs and only about 10 messages made it into the moderation queue (only one of which was actually legitimate). I'm sure a similar method can be implemented for web forums.

vbulletin

[scint]

I'm pretty sure that the vbulletin forum software has this feature. Users can be tagged by moderators such that all of their post are invisible to the rest of the community. Members see their own posts. In a spambot situation, I would be cautious about using this approach on account of database growth and system maintenance. ymmv.

Re:vBulletin

[compro01]

That it is. Especially combined with automatic multiple account detection. They can keep making more accounts and they just get detected and automatically added to the GI until they give up and go away.

A for Effort

[jimmifett]

A decent enough idea to be sure, but it must be carried forward to conclusion. Not only could these be detected by a second bot account, the spammer is still eating up your resources, whether it be disk space or processing cycles to detect viewing by bot accounts. Even if legit users never see the spam, the spammer half wins by making your system work harder to filter them out.

The Secret Garden

[george14215]

What's even funnier is to allow all the people marked as "spammers" to see each other's comments as well. We called this the Secret Garden.

Re:The Secret Garden

[PPH]

Usenet variant: Some free Usenet sites that have been havens for troublemakers or allow practices like injecting articles with fake paths get blocked from NNTP forwarding by other sites' admins. So pretty soon, posters on these sites see all the garbage they attempt to spam various groups with. But nobody else does.

Vbulletin

[compro01]

Vbulletin implements this with their global ignore (a.k.a. Tachy Goes to Coventry) function.

Just require activation

[DrXym]

Some ways to reduce spam.

1. Replace the forum's captcha with one of a higher grade, e.g. Recaptcha
2. Requiring new users to be registered and await activation before being able to post.
3. Use an extension that taps into NoSpam or similar to so that registrants can be flagged by their ipaddress or email address if they are known spammers.
4. Use the forum's tools to limit the damage newbies they can do even if they slip through this.
5. Add a simple challenge to the registration page which is necessary for registration to succeed

For extra points you could probably modify the registration process in all kinds of manners which would confound an automated and replay attacks. Chances are that for the average forum it would be sufficient that no script would even bother to defeat it and would simply move onto softer targets.

Re:Just require activation

[rho]

For extra points you could probably modify the registration process in all kinds of manners which would confound an automated and replay attacks. Chances are that for the average forum it would be sufficient that no script would even bother to defeat it and would simply move onto softer targets.

This is the answer, more or less. For small-to-middling forums, reducing spam is pretty easy. A few volunteers to delete the ones that get through suffices for the rest.

It breaks down to 1) keep out easy drive-by spammers, which means registration with a valid email address and some kind of barrier to detour the smarter bots (ReCaptcha and the like); 2) filter posts through Akismet or similar method; 3) have a community large enough and engaged enough to want to zero out spam posts.

The third step is the hardest, and has nothing to do with spam posts.

Re:Just require activation

[godel_56]

Some ways to reduce spam.

1. Replace the forum's captcha with one of a higher grade, e.g. Recaptcha

ReCaptcha has become so difficult recently that I can't guess half of them. As well as being horribly distorted, many of the newer unknowns seem to be in foreign (non-english) languages, so you can't even guess them from context.

Beehive's "worm mode"

[mlts]

There used to be a Web forum product called Beehive (not sure on its status these days) which had this as a feature. A spammer or troll could spew all they wanted to, and if the "worm mode" bit was set, only they could see their postings -- nobody else.

For a constant troll, I'd say go for it. For a hit and run spammer who really just wants to get stuff on the board and then run off, I'd say don't bother; they won't be back on that account most likely.

nope

[Anonymous Coward]

Your post advocates a

(X) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
(X) No one will be able to find the guy or collect the money
(X) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
(X) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:

( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:

(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Re:nope

[mdfst13]

That's a standard form. The person just went through and filled it out. I doubt that it took long. In my opinion, several of the Xs are wrong. For example:

(X) No one will be able to find the guy or collect the money

What money? Why do you need to find the guy? Better would have been

( ) It will stop spam for two weeks and then we'll be stuck with it

As this is the kind of approach against spam that is easy to bypass once spammers realize that it is there.

Re:nope

[Anonymous Coward]

Also, this is essentially a blacklist.

Re:nope

[Phydaux]

Wow nostalgia trip. It's been years since I saw this form last.

Re:nope

[funky_vibes]

Blacklists only suck when accounts aren't associated with any cost.
Whitelists only suck if you think everyone should be treated equally. ;)

vBulletin

[phorm]

You're correct.
The option he was thinking of does exist in VB, but it's called "Tachy goes to Coventry"

It's good for dealing with trolls

Yes, it has been done

[Minwee]

There's a site called Slashdot which allows comments to be rated from 0 to 5. Spam, trolls, and posts like this one will be moderated down to zero and blocked from view by most other users.

Check it out some time.

Re:Yes, it has been done

[Nadaka]

-1 and up actually. I believe it goes over +5 even if it only displays +5, it seems to offer a buffer against people troll modding because they don't like what you have to say.

Re:Yes, it has been done

[Forever Wondering]

As I'm sure many people already know, you can also flag the comment and it goes to the site admins. Even when I'm modding, I don't want to burn a modpoint on a spammer. I'd rather mod up a good comment instead. You can flag even if you don't have mod points.

--

Recently, there was a spate of spam on slashdot about antivirus software. IIRC, in a single day there were eight instances/variants of the same spam on a single discussion alone [and more on other discussions on the same day]. Different spiels, accounts, AC's.

Such aggressive spamming can [realistically] only be dealt with by the site itself (e.g. filtering by content). The content trigger was probably easy, as each spam message would feature the product name no less than 10 times.

I haven't seen the particular spam recently, so I'm guessing something was done about it.

Re:Yes, it has been done

[Mister Transistor]

Either that or the insufferable douchebags at the MCPC marketing arm finally figured out that Google doesn't crawl the forums here... Fucking twits.

Re:Yes, it has been done

[Minwee]

OMG, don't click on that link! NSFW!

Relax. It's not like I linked to TV Tropes or anything.

That would have been horrible.

Pluck Software

[ironicsky]

From what I understand from a contact of mine who works for a news paper, their website has this functionality. They told me that when a spammer is blocked or their comment is deleted they are the only ones who dont know. They can keep posting and they think their posts show up, but to the rest of the world they don't exist. Their websites comments appear to be run by a company called Pluck by DemandMedia.

Same Idea Here

[Arabian Nights]

I'm really happy to read this paragraph. I had the same epiphany when I began planning for a recipe website that allowed for comments without passwords (to login avoid hassle). I also worked out a similar system to the backend of an Omegle clone, essentially pairing abusive (Ctrl+V then exit, Ctrl+V then exit) users with a Cleverbot routine until they stopped spamming, sandboxing them from the greater user base.

From this thread, I learned this system is called "Hellbanning" and some of its downsides are similar to those of honeypots, e.g. you have to store useless data, bandwidth usage goes up by those who think their spam is working, etc. I think these are fair complaints, but the jusy is still out whether these downsides outweigh the benefits of hellbanning.

Hellbanning represents an entirely new way of handling user submitted content. The current norm shows the status of every post to the user who created it. "That comment is awaiting moderation" and "This has been flagged." Essentially, by giving status reports and feedback to abusers, you are grading them on their work and giving them constructive criticism. By obscuring the extent to which their content is shared, they don't know if their efforts are in vain, and they can't improve on their failing techniques if they don't know what is working what isn't.

I would enjoy hearing about anyone else's knowledge about obscurring user content in real world applications, or any theoretical concerns or loopholes someone just hearing about it can come up with.

Do the cost benefit analysis

[scorp1us]

Currently:
Spammers can register and post for free (or sufficiently free do to low captcha cost)

You propose:
A way to squelch individual accounts. (Assuming errouneously that it has some cost to them)

The result:
Spammers will still continue registering new accounts, because in no way does it affect their cost.

A better solution: make them fund their account - PayPal with some trivial designated amount - $0.75, correlate it to the paypal address during signup. You've now added real cost and real verification. Hold the money for some time, then reverse it. The likely outcome is they'll start using stolen credit card numbers, or stop.

Re:Do the cost benefit analysis

[Nadaka]

And that means that I will never ever use the forum. I do no business with paypal, at all, ever. They are a shady business with questionable ethics at best.

Re:Do the cost benefit analysis

[scorp1us]

I hear ya. Accept bitcoin then. At least that market is not as shady.

Re:Do the cost benefit analysis

[nschubach]

Hell, if I could get 10 million people to let me borrow a $1 for 6 months... I'd gladly return their money after collecting interest off it.

service already exist for this

[itslennie]

http://www.stopforumspam.com/ http://akismet.com/ Depending on your forum software, someone will most likely have done the hard work and integrated these services to do what need. I use these on vBulletin to moderate spam posts.

Easy to defeat the defeat

[SuperKendall]

Seems like it would be easy enough to work around with a second bot that checks to make sure spam is getting through.

So you make the troll visible to all for a few seconds after the troll has posted, or always visible if someone tries to go to the site directly...

And the troll is visible for longer to anyone visiting the site from the same IP address.

But most spammers would not really bother with a verification pass. They have new places to spam.

Re:Easy to defeat the defeat

[bakes]

You forgot this one: make all the trolls posts visible to all the other trolls.

No no no!

[fustakrakich]

Let us filter the spammers at our end. If you guys do it, you'll get too many false positives. The whole process will become entirely political. Please, don't. And besides the spammer can log in through a proxy find out he's being censored, and just open another account through the proxy.

Re:No no no!

[fustakrakich]

Forgot: You can let us filter them through the foes list. Or just add "spam" to the other categories we have. But please don't censor anybody, not even the spammers

Re:No no no!

[Larryish]

And besides the spammer can log in through a proxy find out he's being censored, and just open another account through the proxy.

I see this argument quite often. It is a false argument.

A big problem on forums is the problem of multiple posts by the same completely automated spammer.

It is like the bot runs using the same account/ip until the site returns an error code, and then it makes a new account or uses a new proxy or both

The desirable effect of the hellban is to return no error code to fully automated spambots, thus cutting down on the amount of spam viewed by desirable patrons and search indexers.

Of course the database size still grows due to spam accounts, but there is no reason that the hellbanned account cannot be set for deletion after a period of time.

Simply because it is not the "be-all and end-all" of spam control doesn't mean it is useless, in fact hellbanning is quite effective in reducing visible spam.

Allow posting right away, but moderate...

[SuperKendall]

Replace the forum's captcha with one of a higher grade, e.g. Recaptcha

Or eliminate it altogether, since it doesn't help and really pisses off users.

Requiring new users to be registered and await activation before being able to post.

Instead of this allow anyone to post right away, but do not allow the first few posts to be seen until they have been verified to be valid by a human. Delegate some of this verification to your most active users.

Re:Allow posting right away, but moderate...

[rew]

Now THAT is an interesting idea.

How about the following:

Accept new users. No hassle. Accept new posts from new users: no hassle. But IF the first post contains an external link, automatically hell-ban the user until a moderator intervenes.

Re:this is called "ghosting"

[CubicleZombie]

Craigslist just doesn't enter suspected spam into the index so it never shows up. The URL they email still works but nobody will ever see it in the list or the search results.

For a long time just about everything I posted ended up this way. I think using correctly formed HTML was their trigger, since there was absolutely no way the ads I posted could be considered spam. It was very annoying as a user.

Perhaps a better solution...

[davidwr]

Allow logged-in users to flag posts and allow high-reputation users' flags to count more than other users'.

If a post gets too many "flag points" in too short a period of time, it is hidden to non-logged-in users. Let logged-in users set their own "hide or collapse posts with more than X points" threshhold."

To discourage spam you want search engines to not see it. Consider marking public/no-log-in-required pages that have new posts on them as "noindex, nofollow" for the first few hours or days.

The original suggestion you offer has merit except it's too easy for a spammer to defeat. In addition to wanting to hide reported spam from non-logged in users and from logged-in users who don't want to see it, You want a solution that tells search engines "this message is new, don't index it" and a method to make sure new posts are reviewed for spamminess before the searchbot timer expires.

Torture the blind

[fustakrakich]

Do like the supermarkets do. Just rearrange everything on the sign up page every couple of weeks or so

My sandbox

[inode_buddha]

I've had a sandbox for more than a decade. Its called Yahoo.

Sounds great...

[stevenfuzz]

Until they figure it out after 1 day and create another account anyway. Or maybe they create and revolve 40 accounts and DOS you, in spite, using 15 differant ips. This would fake a 15 year old in 1995 using their Visual Basic AOL program, but not a company being paid to spam. As someone who has developed scrape spiders and anti-spam code (for highly spammed websites), you are going to need to think a little deeper. I can tell you one thing, any spam bot software worth it's weight in obnoxious comments is going to look for every possible way to fool you.

Re:I'll go you one better.

[stevenfuzz]

IF($postObj->body == "Do Not Comment"){
$postObj = $postHandler->nextPost();
}


Tough one.

Analogy with SMTP

[dskoll]

As an analogy, normal banning is like an SMTP server rejecting spam with a 5xx failure code, while your scheme would have the server accept the spam with a 2xx code but throw the message in /dev/null

Each method has the usual pros and cons: Pretending to accept mail reduces (but does not completely eliminate) feedback to the spammer as to whether or not the message made it through. However, it plays hell with legitimate users; false-positives become much more problematic if there's not feedback.

Markov...

[ilikenwf]

Roll your own, or use Akismet...

Make sure Google etc can't see it.

[billstewart]

The really important thing is to make sure Google (and the other search engines and ad services, if you care about them) can't see the spam. That's the real objective of the spammers, and those that bother checking may find that spamming you is less effective in fixing their page ranks.

Hmm

[systemeng]

A good use for stupidfilter http://stupidfilter.org/ perhaps?

I had this idea years ago

[Cute Fuzzy Bunny]

When I was a forum mod for a large forum some years ago, we had a lot of troll problems and the same guys would keep showing up as sock puppets. A lot of the time it took a while to suss out if someone was for real or one of the persistent trolls.

So I did come up with an idea to mirror the forum, with idiots and highly suspected idiots able to post all they wanted on the fake mirror, with the non crappy people on the real forum. So what it looked like was that everyone had the trolls on their ignore list, or that they weren't very interesting because no matter what they said, nobody answered them. But they did have some fun conversations with each other that nobody ever saw.

After a while, the persistent ones got tired of the effort since they were getting no return, and they went away.

So yeah, your idea should work unless the spammer notices that the bot isn't actually working properly.

Deceptive

[fa2k]

I don't like it. Depends on your foum, but it's much worse than being banned for normal people. So how about a staged solution: As others pointed out, it is necessary to show the filtered posts to users on the same IP address as the spammer, otherwise all spammers will create two accounts and verify that their messages come through. The solution is that *the first time someone spams, they get a proper ban*. Ideally a timed ban, such that normal users who are not spammers can wait for e.g. 1 week and then get back. The spammer can create a new account, and it can be filtered. This may be too complicated, but I find the proposal quite dishonest, in case someone is banned for having an unpopular opinion, etc. Moderators are not always fair. [[ The last time this came up on slashdot I wrote something similar about it being deceptive, then I wrote "How can I even be sure that this message is visible to others?" And someone replied, thanks :D ]]

The brother of this idea

[NorthWay]

The brother of this idea is a browser adblocker that actually loads the ads, but does not show them to you. Might need a change or two to your browser to make it know what to just invisibelize, but that should be doable?

(You still want to block tracker gifs and similar, but that already works, you just need two kinds of iffy address links.)

FARK.com does it, too

[belgianguy]

Because their algorithm misfired and put me under a shadowban for a while. It's hard to detect, but after a while I really felt as if I was talking into a void. So I loaded up a proxy server and connected to FARK through it, and surely enough, my posts weren't visible.

I give the admins a profanity-laden piece of my mind and they apologized, seems their spam detector was a bit over-eager. I still go there from time to time.

Re:www.aftonbladet.se is using this, major media s

[DarwinSurvivor]

Yes, using facebook as a login for a 3rd party website IS evil.

What about false positives?

[ukoda]

I recently got banned for my first post to a technical forum of a VPN provider service I am using. Not sure what went wrong but was able to get the problem fixed pretty quickly. With this proposal I would never had know there was a problem that needed fixed.

done for anti-email spam

[ILongForDarkness]

I worked at a anti-spam company a few years. That was one of the things we did. We would send a 250 Ok to a message regardless of if it was accepted or not. If it wasn't accepted the customer had the option of putting it into a quarantine or just not writing it anywhere. I think we also always told suspect bad senders (essentially anyone we haven't seen before or anyone with a non-perfect score in our reputation and various blocklists) that a recipient exists. If things were suspect we'd throttle their connection way down to reduce load on the customers systems and make the bot really inefficient/prove them to be a bot because they don't obey SMTP standards for request timeouts (profit is proportional to emails/hr so generally spammer cut corners in terms of always assuming messages are accepted, not bothering to send the QUIT command etc). I imagine some similar stuff could be used for forums.