4 ms·

Xoogler here... my favorite Maps spam story is how there was a cron job that ran every (I think) 6 hours to analyze and clean up suspected scam listings [1]. Th

Xoogler here... my favorite Maps spam story is how there was a cron job that ran every (I think) 6 hours to analyze and clean up suspected scam listings [1]. The scammers figured out when the cron job runs, and set up their own cron job putting up their listings again in the minutes after Google's finished. It's a well-known problem on Maps and has been known for years. It boils down to: scammers are smart and resourceful and very good at making their scam listings look like real listings. [1] if you're wondering why they didn't do the filtering at submission time, there was a good technical reason for this at the time that I don't remember anymore

andr 7y ago
What if you required 7 hours for a listing to go live?
- jdm2212 7y ago
  The Maps folks played (and are almost certainly still playing) this game of cat and mouse with the spammers. Google comes up with better defenses, and the spammers come up with cleverer spam. I just found the cron job iteration of that cycle particularly memorable and amusing. I don't want to share anything else because I'm sure they still use some of the strategies they used back then, and it's better not to publicize them.
  - yeahitslikethat 7y ago
    There's no code of ethics among you thieves, except consumer be dammed.
sytelus 7y ago
This is not a technology problem, its a process problem. Vast majority of submitters could be cheaply verified and for small number of potential spammers, there are several options: 1. Require submitter to be legally traceable and identifiable. Establish fines/fees for misuse of your property and charge their bank accounts for cleaning fees. Blacklist them for life. 2. Once a submitter is identifiable and legally traceable, charge exponentially higher fees for number of submissions unless they want to show up as chain business in which case charge reasonable fee for validation and background checks. 3. Detect and avoid autonomous mass submissions except for highly trusted entities such as big chains.
- jdm2212 7y ago
  Google Maps is not optimizing for "percent of listings that were completely accurate at time of submission". That's how paper maps (and to a lesser degree, the Yellow Pages) mostly worked. There's a reason we stopped using them. What Google's doing is harder and more nuanced -- they want to accurately capture the world as it exists around you right now. That means understanding what parts of the world around you you care about and understanding what level of accuracy (as opposed to promptness of updates) they should optimize for. Given Maps' extraordinary success as a product, they've done this quite well. But, yes, it has failure modes that users should be aware of and that Google tries to combat without compromising the main goal.
  - toast0 7y ago
    Google is trying to build maps without human verification, because humans are expensive, and to some degree because humans can be tricked too. Accepting content without verification certainly has a side effect of getting businesses on board the instant they open, too, but that's just a happy accident.
    - jdm2212 7y ago
      Google is fine with expensive (they sunk many billions into Maps over 10+ years and only just started monetizing it). But humans don't scale. If you want to have ten thousand data points about every business on Earth, you can't get there by relying on humans. You need to automate everything from top ot bottom.
      - rabidrat 7y ago
        Perhaps scaling to Google-size is the problem.
      - toast0 7y ago
        Humans can scale, it's just that Google chooses not to use them. Anything that requires a human in the loop is something they won't do. Customer service, not going to happen. Having Youtube Kids actually have appropriate content for kids, unlikely. Being a trustworthy source for businesses on maps, no way.
ChuckMcM 7y ago
That is a great story, at Blekko my first attempt at getting rid of people trying to exploit the index was to ban any address that did more than 100 queries per second, that got a bunch. Then they start showing up again, at 99 queries per second :-). So I lower it to 50, same pattern but now 49 qps, then set it to 10 qps, they would limbo in under the wire again. They would also start using bot nets to send their query from different PCs in different places (all the same query though, typically looking for ecommerce or wordpress templates with known exploits) We would nail them by finding all the machines that made the same query, then we could just start killing any query that asked for more than page 10 of the results, etc. For a while I pondered if I could use my ability to change their behavior by changing my rules, to get them to actually create a set of behaviors that would unmask their C&C servers but not enough free time for that.
- Xeanort 7y ago
  You could start sending fake results after they exceed the ~100 queries, they will probably stop exploiting it.
  - ovi256 7y ago
    Yeah, "hellbanning" scammers is a good idea, instead of giving them a simple 401 code. Increasing the cost of their scam is the best mechanism.
  - tremon 7y ago
    This is a good idea, actually -- make it impossible to distinguish a banned request from a succesful request. At least that could delay the discovery period, as would randomizing the request limit.
    - tlavoie 7y ago
      I've wondered if a web server or proxy in something like Erlang would be ideal there, where there is little server-side penalty in dragging requests out progressively longer. With the lightweight processes, the cost per should be very, very low, and basically make it easier to Turing tarpit the scammers.
tremon 7y ago
there was a good technical reason for this at the time I gather there's a number of selfish business reasons for it instead. Google no longer gets my benefit of the doubt in these situations. They won't solve it, because solving it costs money.

andr 7y ago

What if you required 7 hours for a listing to go live?

jdm2212 7y ago
The Maps folks played (and are almost certainly still playing) this game of cat and mouse with the spammers. Google comes up with better defenses, and the spammers come up with cleverer spam. I just found the cron job iteration of that cycle particularly memorable and amusing. I don't want to share anything else because I'm sure they still use some of the strategies they used back then, and it's better not to publicize them.
- yeahitslikethat 7y ago
  There's no code of ethics among you thieves, except consumer be dammed.

sytelus 7y ago

This is not a technology problem, its a process problem. Vast majority of submitters could be cheaply verified and for small number of potential spammers, there are several options: 1. Require submitter to be legally traceable and identifiable. Establish fines/fees for misuse of your property and charge their bank accounts for cleaning fees. Blacklist them for life. 2. Once a submitter is identifiable and legally traceable, charge exponentially higher fees for number of submissions unless they want to show up as chain business in which case charge reasonable fee for validation and background checks. 3. Detect and avoid autonomous mass submissions except for highly trusted entities such as big chains.

jdm2212 7y ago
Google Maps is not optimizing for "percent of listings that were completely accurate at time of submission". That's how paper maps (and to a lesser degree, the Yellow Pages) mostly worked. There's a reason we stopped using them. What Google's doing is harder and more nuanced -- they want to accurately capture the world as it exists around you right now. That means understanding what parts of the world around you you care about and understanding what level of accuracy (as opposed to promptness of updates) they should optimize for. Given Maps' extraordinary success as a product, they've done this quite well. But, yes, it has failure modes that users should be aware of and that Google tries to combat without compromising the main goal.
- toast0 7y ago
  Google is trying to build maps without human verification, because humans are expensive, and to some degree because humans can be tricked too. Accepting content without verification certainly has a side effect of getting businesses on board the instant they open, too, but that's just a happy accident.
  - jdm2212 7y ago
    Google is fine with expensive (they sunk many billions into Maps over 10+ years and only just started monetizing it). But humans don't scale. If you want to have ten thousand data points about every business on Earth, you can't get there by relying on humans. You need to automate everything from top ot bottom.
    - rabidrat 7y ago
      Perhaps scaling to Google-size is the problem.
    - toast0 7y ago
      Humans can scale, it's just that Google chooses not to use them. Anything that requires a human in the loop is something they won't do. Customer service, not going to happen. Having Youtube Kids actually have appropriate content for kids, unlikely. Being a trustworthy source for businesses on maps, no way.

ChuckMcM 7y ago

That is a great story, at Blekko my first attempt at getting rid of people trying to exploit the index was to ban any address that did more than 100 queries per second, that got a bunch. Then they start showing up again, at 99 queries per second :-). So I lower it to 50, same pattern but now 49 qps, then set it to 10 qps, they would limbo in under the wire again. They would also start using bot nets to send their query from different PCs in different places (all the same query though, typically looking for ecommerce or wordpress templates with known exploits) We would nail them by finding all the machines that made the same query, then we could just start killing any query that asked for more than page 10 of the results, etc. For a while I pondered if I could use my ability to change their behavior by changing my rules, to get them to actually create a set of behaviors that would unmask their C&C servers but not enough free time for that.

Xeanort 7y ago
You could start sending fake results after they exceed the ~100 queries, they will probably stop exploiting it.
- ovi256 7y ago
  Yeah, "hellbanning" scammers is a good idea, instead of giving them a simple 401 code. Increasing the cost of their scam is the best mechanism.
- tremon 7y ago
  This is a good idea, actually -- make it impossible to distinguish a banned request from a succesful request. At least that could delay the discovery period, as would randomizing the request limit.
  - tlavoie 7y ago
    I've wondered if a web server or proxy in something like Erlang would be ideal there, where there is little server-side penalty in dragging requests out progressively longer. With the lightweight processes, the cost per should be very, very low, and basically make it easier to Turing tarpit the scammers.

tremon 7y ago

there was a good technical reason for this at the time I gather there's a number of selfish business reasons for it instead. Google no longer gets my benefit of the doubt in these situations. They won't solve it, because solving it costs money.