3 ms·

How do you "take out" an attacker? They will just create more accounts. The accounts themselves don't have to cluster with each other. And let's say you do find

by yuliyp 9y ago

How do you "take out" an attacker? They will just create more accounts. The accounts themselves don't have to cluster with each other. And let's say you do find a large set of accounts and ban them. New fake accounts are being constantly created and sold and used.

dredmorbius 9y ago
That's where various fingerprints (the sort of thing, incidentally, AI/ML should be pretty good at sorting out) should come in to play. Spammers, ultimately, act like spammers, and bots like bots. Unlike legitimate accounts, which typically either a) follow a small number of related accounts or b) are fairly-well-known high-profile accounts (and yes, pseudonymous accounts may be high-profile), bots either need to act within specific networks or be very indiscriminate in whom they follow / link with. And they're tremendously active. Whilst Google+ is not Facebook, Stone Temple Consulting ran an analysis of 500,000 profiles in 2015 to see what posting activity looked like.[1] I'm fairly familiar with the methods used as I'd pioneered most of them on a smaller, 50k sample. Looking at public posts only (not private posts, and not comments), there are roughly 53,000 G+ users posting 100+ times monthly, and 106,000 posting 50+ times monthly. From an independent analysis, I've estimated that Facebook traffic is, very roughly, 10x greater than G+ (as of August, 2015). So you might bump these values up by an order of magnitude to get Facebook-level scales of operation. Twitter is actually far closer to G+ in scale.[2] That is, the search space for bots is roughly 500k - 1m accounts of major active players. And it should be possible, even with only computer-assisted human intervention, to make a pretty good cut through that space. So the problem is not all that intractable. ________________________________ Notes: 1. https://www.stonetemple.com/real-numbers-for-the-activity-on-google-plus/ https://www.stonetemple.com/real-numbers-for-the-activity-on... STC's Eric Enge credits me on that page. 2. https://www.reddit.com/r/dredmorbius/comments/3hp41w/tracking_the_conversation_fp_global_100_thinkers/ https://www.reddit.com/r/dredmorbius/comments/3hp41w/trackin...
oblio 9y ago
How did we tackle spam?
- xelxebar 9y ago
  SPF, DKIM and DMARC? I jumped down the rabbit hole and set up my own mail server about a year ago. With postfix configured to look at the above I get zero spam. Looking at logs, I do get lots of connection attempts from random IPs in China and such, but my postfix unilaterally rejects anyone that doesn't have good DNS settings.
  - throwaway2048 9y ago
    spammers can and do trivially setup SPF, DKIM and DMARC

by yuliyp 9y ago

dredmorbius 9y ago

That's where various fingerprints (the sort of thing, incidentally, AI/ML should be pretty good at sorting out) should come in to play. Spammers, ultimately, act like spammers, and bots like bots. Unlike legitimate accounts, which typically either a) follow a small number of related accounts or b) are fairly-well-known high-profile accounts (and yes, pseudonymous accounts may be high-profile), bots either need to act within specific networks or be very indiscriminate in whom they follow / link with. And they're tremendously active. Whilst Google+ is not Facebook, Stone Temple Consulting ran an analysis of 500,000 profiles in 2015 to see what posting activity looked like.[1] I'm fairly familiar with the methods used as I'd pioneered most of them on a smaller, 50k sample. Looking at public posts only (not private posts, and not comments), there are roughly 53,000 G+ users posting 100+ times monthly, and 106,000 posting 50+ times monthly. From an independent analysis, I've estimated that Facebook traffic is, very roughly, 10x greater than G+ (as of August, 2015). So you might bump these values up by an order of magnitude to get Facebook-level scales of operation. Twitter is actually far closer to G+ in scale.[2] That is, the search space for bots is roughly 500k - 1m accounts of major active players. And it should be possible, even with only computer-assisted human intervention, to make a pretty good cut through that space. So the problem is not all that intractable. ________________________________ Notes: 1. https://www.stonetemple.com/real-numbers-for-the-activity-on-google-plus/ https://www.stonetemple.com/real-numbers-for-the-activity-on... STC's Eric Enge credits me on that page. 2. https://www.reddit.com/r/dredmorbius/comments/3hp41w/tracking_the_conversation_fp_global_100_thinkers/ https://www.reddit.com/r/dredmorbius/comments/3hp41w/trackin...

oblio 9y ago

How did we tackle spam?

xelxebar 9y ago
SPF, DKIM and DMARC? I jumped down the rabbit hole and set up my own mail server about a year ago. With postfix configured to look at the above I get zero spam. Looking at logs, I do get lots of connection attempts from random IPs in China and such, but my postfix unilaterally rejects anyone that doesn't have good DNS settings.
- throwaway2048 9y ago
  spammers can and do trivially setup SPF, DKIM and DMARC