6 ms·

I don't understand why it's better to surreptitiously alter records for ToS violators rather than simply close their accounts altogether. Seems like the definit

I don't understand why it's better to surreptitiously alter records for ToS violators rather than simply close their accounts altogether. Seems like the definition of a slippery slope.

deftnerd 9y ago
I agree. If they're going to be doing this, why not also use the Cloudflare apps framework to insert a warning overlay on the page content saying that the domain has been reported for phishing. If that's too slippery slope, then so is the email _DMARC override settings. And doesn't this kind of behavior open them up to a lot of legal risk? By moderating _DMARC records, they're assuming responsibility for email content going into the future. If inappropriate content is then passed via email, and Cloudflare failed to blackhole it with _DMARC recordsy, then the can't they become liable for that content?
mox1 9y ago
Because evidence has shown when you waste the time of people doing this, they move on. If you instantly ban them, its easy to spot, easy to automate and doesn't really solve the problem. https://en.wikipedia.org/wiki/Stealth_banning https://en.wikipedia.org/wiki/Stealth_banning
- Chaebixi 9y ago
  > Because evidence has shown when you waste the time of people doing this, they move on. I'm not convinced of this. At best, shadow-banning wastes a little bit of their time and delays slightly their inevitable creation of a new account. > If you instantly ban them, its easy to spot, easy to automate and doesn't really solve the problem. Shadowbanning only really works for unsophisticated users. If you know it's a possibility, it's easy to check for (just create another account and check with it). Phisher's are probably going to be fairly sophisticated, since they're working to make a profit, not to only disrupt or push a POV.
  - mox1 9y ago
    Correct this will not stop "sophisticated" users. The whole goal of this system is to cause bad actors to dedicate more resources to using your platform and add a shadow of doubt. Spammers, etc. all want a cheap easy payday, that's the entire point (money for minimal time). I run a service that spammers and pfishers love. I started by banning these people (and sending them an e-mail letting them know why). They didn't stop, they just grabbed another free e-mail and continued. Now I quietly just delete the data they submit and never ban accounts. I let them submit data, tell them its accepted, then some time later (1-120 seconds) just delete the data. Their account still works, they just can't do much with it. Once the system became unreliable for them, they just moved on to something else.
    - Chaebixi 9y ago
      > Spammers, etc. all want a cheap easy payday, that's the entire point (money for minimal time). I'm under the impression that spamming isn't as easy as it once was, and a fair amount of effort needs to be devoted to bypassing spam/abuse detection and blocks, which is exactly what a shadowban is. > Once the system became unreliable for them, they just moved on to something else. I would imagine that would depend on if there are equivalent services that the spammer could more easily migrate to. It sounds like they didn't move on from spamming, just from your service. Switching to drop in replacement would definitely be easier than writing a shadowban detector. I'm just disputing that shadowbanning is a more effective solution than straight bans. It's just not that much harder to detect.
an_account 9y ago
These are free accounts so if you flat ban it’s easy for them to pop up again and slightly alter their technique to avoid detection.
jacquesm 9y ago
Seeing this comment on HN has to be some record level of irony.

I don't understand why it's better to surreptitiously alter records for ToS violators rather than simply close their accounts altogether. Seems like the definition of a slippery slope.

deftnerd 9y ago

I agree. If they're going to be doing this, why not also use the Cloudflare apps framework to insert a warning overlay on the page content saying that the domain has been reported for phishing. If that's too slippery slope, then so is the email _DMARC override settings. And doesn't this kind of behavior open them up to a lot of legal risk? By moderating _DMARC records, they're assuming responsibility for email content going into the future. If inappropriate content is then passed via email, and Cloudflare failed to blackhole it with _DMARC recordsy, then the can't they become liable for that content?

mox1 9y ago

Because evidence has shown when you waste the time of people doing this, they move on. If you instantly ban them, its easy to spot, easy to automate and doesn't really solve the problem. https://en.wikipedia.org/wiki/Stealth_banning https://en.wikipedia.org/wiki/Stealth_banning

Chaebixi 9y ago
> Because evidence has shown when you waste the time of people doing this, they move on. I'm not convinced of this. At best, shadow-banning wastes a little bit of their time and delays slightly their inevitable creation of a new account. > If you instantly ban them, its easy to spot, easy to automate and doesn't really solve the problem. Shadowbanning only really works for unsophisticated users. If you know it's a possibility, it's easy to check for (just create another account and check with it). Phisher's are probably going to be fairly sophisticated, since they're working to make a profit, not to only disrupt or push a POV.
- mox1 9y ago
  Correct this will not stop "sophisticated" users. The whole goal of this system is to cause bad actors to dedicate more resources to using your platform and add a shadow of doubt. Spammers, etc. all want a cheap easy payday, that's the entire point (money for minimal time). I run a service that spammers and pfishers love. I started by banning these people (and sending them an e-mail letting them know why). They didn't stop, they just grabbed another free e-mail and continued. Now I quietly just delete the data they submit and never ban accounts. I let them submit data, tell them its accepted, then some time later (1-120 seconds) just delete the data. Their account still works, they just can't do much with it. Once the system became unreliable for them, they just moved on to something else.
  - Chaebixi 9y ago
    > Spammers, etc. all want a cheap easy payday, that's the entire point (money for minimal time). I'm under the impression that spamming isn't as easy as it once was, and a fair amount of effort needs to be devoted to bypassing spam/abuse detection and blocks, which is exactly what a shadowban is. > Once the system became unreliable for them, they just moved on to something else. I would imagine that would depend on if there are equivalent services that the spammer could more easily migrate to. It sounds like they didn't move on from spamming, just from your service. Switching to drop in replacement would definitely be easier than writing a shadowban detector. I'm just disputing that shadowbanning is a more effective solution than straight bans. It's just not that much harder to detect.

an_account 9y ago

These are free accounts so if you flat ban it’s easy for them to pop up again and slightly alter their technique to avoid detection.

jacquesm 9y ago

Seeing this comment on HN has to be some record level of irony.