Slashdot Mirror
Ask Slashdot: Using a Sandbox To Deal With Spambots?
shellster_dude writes "Slashdot is certainly no stranger to the problem of spam bots. While blocking a spam bot may seem like the best solution, it is likely that the spammer will simply re-register with a different name. While trying to solve this dilemma on my own forums, I had an epiphany. What if, instead of blocking a spam bot, I could mark a spammer, and then hide all their comments from everyone else? The spammer could continue to go their merry way, spamming to their heart's content. When they visit the forum, they see their spam comments correctly placed in the threads, but their comments would only be visible to them. Thus, an effective sandbox which would prevent them from registering a new user once they had been 'blocked.' Are any other Slashdotters familiar with this technique? Does any software currently use this technique?"
Why is nobody responding?
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Old idea that doesn't fix much because spammers change accounts after 1-20 posts anyway.
This comment is used extensively at major media outlets such at Swedish' tabloid "www.aftonbladet.se." Facebook is used to register users.
When a user is perceived as spamming - or writing opinions that are unwelcome - the user is marked, and simply not displayed to other visitors. But the user himself does not know, and keeps spamming.
Evil. Pure evil.
http://en.wikipedia.org/wiki/Hellbanning
Reddit does something like this.
The practice goes by several other names I can't recall, but I know it as a "shadow ban"
Basically, you tick a box and nobody but that poster can see their nonsense.
Some forum software already includes the feature, others require a plugin or a roll-your-own solution.
[Fuck Beta]
o0t!
Steve Huffman, one of the creators of Reddit, talks about this exact solution during his Udacity class, Web Application Engineering. http://www.udacity.com/overview/Course/cs253/CourseRev/apr2012 I think it was during week 4 "Whom to Trust," but I don't have links to the exact video. So in short, yes, it has been done effectively in the past, though I believe they wrote their own code to do it.
This wouldn't work because spambots don't keep using a single account. If it were that easy spambots would have already been long defeated.
Seems like it would be easy enough to work around with a second bot that checks to make sure spam is getting through.
I went to eat some animal crackers and the box said, "Do not eat if seal is broken." I opened the box and sure enough..
What makes you think that they will stop just because their account doesn't get closed?
They will not notice the efficacy of their spam, they will just keep signing up and spamming. And you'll play whack-a-mole trying to put all their accounts into sandboxes.
Just how often does a spammer go back to see if his comment posted or not, or if his email got through? Rarely. Spam works on the basis of mass volume. Put a billion adverts on a billion websites and your sales will increase somehow. And the price of those adverts is next to zero after the first few thousand.
It won't work, but it will make a lot of hassle for you, from storage to filtering to just plain bandwidth if you have a thousand spammers realising they can auto-sign-up and spam you endlessly.
It's like running a "honeypot". You'll gather lots of data at great expense and resources. But you won't stop the spam.
It would certainly prevent spam temporarily but
a) the spammer would notice rather quickly if their spam doesn't show up in Google
b) the spammer could easily defeat the system by simply re-registering with another username
c) one mistake on implementing the system (eg. allowing users to read 'sandboxed' comments through a link) could maybe hide it from your users but not from the other bots that crawl your site (again Google and security bots) which would then mark your site as spam.
The problem is that spamming is usually automated so you have to have the end-user jump through hoops in order to defeat them. One of the forums I moderate actually requires a legitimate introduction on the topic of the forum before they are allowed to post in the general forums. Defeats most spammers as it's somewhat of a niche forum and automated spam is immediately recognized and user/ip banned.
Custom electronics and digital signage for your business: www.evcircuits.com
http://www.codinghorror.com/blog/2011/06/suspension-ban-or-hellban.html
Do worry about life, you will never get out alive.
I'm pretty sure that the vbulletin forum software has this feature. Users can be tagged by moderators such that all of their post are invisible to the rest of the community. Members see their own posts. In a spambot situation, I would be cautious about using this approach on account of database growth and system maintenance. ymmv.
A decent enough idea to be sure, but it must be carried forward to conclusion. Not only could these be detected by a second bot account, the spammer is still eating up your resources, whether it be disk space or processing cycles to detect viewing by bot accounts. Even if legit users never see the spam, the spammer half wins by making your system work harder to filter them out.
What's even funnier is to allow all the people marked as "spammers" to see each other's comments as well. We called this the Secret Garden.
Vbulletin implements this with their global ignore (a.k.a. Tachy Goes to Coventry) function.
upon the advice of my lawyer, i have no sig at this time
For extra points you could probably modify the registration process in all kinds of manners which would confound an automated and replay attacks. Chances are that for the average forum it would be sufficient that no script would even bother to defeat it and would simply move onto softer targets.
Your post advocates a
(X) technical ( ) legislative ( ) market-based ( ) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
(X) No one will be able to find the guy or collect the money
(X) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
( ) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
(X) Eternal arms race involved in all filtering approaches
(X) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
( ) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
( ) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
(X) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
You're correct.
The option he was thinking of does exist in VB, but it's called "Tachy goes to Coventry"
It's good for dealing with trolls
There's a site called Slashdot which allows comments to be rated from 0 to 5. Spam, trolls, and posts like this one will be moderated down to zero and blocked from view by most other users.
Check it out some time.
Currently:
Spammers can register and post for free (or sufficiently free do to low captcha cost)
You propose:
A way to squelch individual accounts. (Assuming errouneously that it has some cost to them)
The result:
Spammers will still continue registering new accounts, because in no way does it affect their cost.
A better solution: make them fund their account - PayPal with some trivial designated amount - $0.75, correlate it to the paypal address during signup. You've now added real cost and real verification. Hold the money for some time, then reverse it. The likely outcome is they'll start using stolen credit card numbers, or stop.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
Replace the forum's captcha with one of a higher grade, e.g. Recaptcha
Or eliminate it altogether, since it doesn't help and really pisses off users.
Requiring new users to be registered and await activation before being able to post.
Instead of this allow anyone to post right away, but do not allow the first few posts to be seen until they have been verified to be valid by a human. Delegate some of this verification to your most active users.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Craigslist just doesn't enter suspected spam into the index so it never shows up. The URL they email still works but nobody will ever see it in the list or the search results.
For a long time just about everything I posted ended up this way. I think using correctly formed HTML was their trigger, since there was absolutely no way the ads I posted could be considered spam. It was very annoying as a user.
:wq
Do like the supermarkets do. Just rearrange everything on the sign up page every couple of weeks or so
“He’s not deformed, he’s just drunk!”
As an analogy, normal banning is like an SMTP server rejecting spam with a 5xx failure code, while your scheme would have the server accept the spam with a 2xx code but throw the message in /dev/null
Each method has the usual pros and cons: Pretending to accept mail reduces (but does not completely eliminate) feedback to the spammer as to whether or not the message made it through. However, it plays hell with legitimate users; false-positives become much more problematic if there's not feedback.
The really important thing is to make sure Google (and the other search engines and ad services, if you care about them) can't see the spam. That's the real objective of the spammers, and those that bother checking may find that spamming you is less effective in fixing their page ranks.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Yes, using facebook as a login for a 3rd party website IS evil.