5 ms·
I work at Vimeo. We use automated detection to flag suspicious accounts. This was a clear false-positive, and the account has been unsuspended. We don't conver
by muglug 7y ago
I work at Vimeo. We use automated detection to flag suspicious accounts. This was a clear false-positive, and the account has been unsuspended.
We don't convert urls to hyperlinks in video descriptions when the user has signed up recently, because hyperlinked urls have been used by spammers to trick visitors into visiting fraudulent sites.
This is clearly legitimate behaviour in context, but a brand-new user posting identical descriptions and urls on multiple videos is behaviour commonly seen in spam accounts, and we tend to err on the side of caution.
Edit: clarified circumstances under which urls are converted
- anderskaseorg 7y agoThat’s…what HTML escaping is for…?
- SquareWheel 7y agoWhat do you mean? Escaping doesn't help with links to spam or fraudulent sites.
- kazinator 7y agoWhat do you mean "HTML escaping"? If we escape HTML in the conventional sense, then it becomes literal text; you see <a href="whatever">...</a> instead of a clickable link because < is escaped as < and so on. User-submitted HTML content can be scrubbed against malicious tags such as scripts, cross-site exploits, or hacks involving broken syntax that disrupts the surrounding page into which it is embedded. But there is no simple way to allow a brand new user to embed a working URL, such that malicious URLs are prevented; basically you need a giant blacklist and whitelist of domains. A better UI here would be not to ban the account but just not allow the user to save the content containing HTML. The message should say "Sorry, brand new accounts are not allowed to post HTML content". Many new accounts posting HTML content are going to be legitimate.
- blackflame7000 7y agoWhat if every link was encoded with something like a tinyUrl and then whenever the link was clicked, during the translation process, check if a link is blacklisted. This also has the added benefit of allowing statistics to be gathered on common links across multiple accounts.
- gowld 7y agoApproximately 100% of spam URLs haven't been blacklisted yet, because they are being generated by high-speed automated processes.
- blackflame7000 7y agoPerhaps, but the DNS translations to the underlying servers hosting those spamURLs as well as the host header can't possibly be that varied. At the end of the day, you can have infinite URLs but you can't have infinite servers.
- kazinator 7y agoI wonder to what extent it would be effective/useful it to cross-reference SMTP blacklist databases. As in, resolve a URL to an IP address, and then see if that IP block is "spammy" in the e-mail sense.
- muglug1 7y agoWe don't allow any HTML tags in video descriptions (we pass them through a simple tag stripping filter). But we do automatically add anchor tags to urls for most videos (just not new user's videos). I agree that it's a bit of a UI issue, but communicating to a new nonpaying user that their text-only urls will one-day turn into clickable urls is particularly simple. Looking at the public videos, and reading the article, I think an automatic system detected a new user both adding urls to two separate videos, and the same user modifying those links slightly. That's sufficiently unusual behaviour that it met some threshold for an automated account ban.
- ineedasername 7y agoOkay, I'm not saying it's completely awful to try to detect bad behavior in this way, but you keep offering up explanations for why it happened when the real issue here is the lack of transparency into a rule that can get you banned, when it should be trivial to instead offer users useful feedback. As the author said, this behavior has a chilling effect, or at least an extremely frustrating one. The issue isn't "why the user's actions resulted in a ban", it's the fact that the entire situation should have been avoidable.
- drivebycomment 7y agoThey can't share the detailed rules since that will give abusers more information to take advantage of. You assume everyone is a legitimate user, but non trivial fraction of online accounts are for abuse. Since the perfect precision on abuse detection is impossible and insufficient abuse detection often means a death for the service (spam, legal, PR), this is impossible to avoid. The only question is the rate of false positive flagging. Given that this is purely anecdotal, it doesn't give me any way to assess whether Vimeo's false positive is egregiously bad or not.
- ineedasername 7y agoI don't see how an error message stating, "html markup is not allowed in your post" will in anyway facilitate more abuse than banning when the abusive bad actors will simply take the ban as a signal of the same, create another account, and then avoid the activity. There's a balance to be struck between usability and abuse prevention, and currently Vimeo has got it wrong.
- netsectoday 7y agoSo was this a UI-level filter that failed and let un-sanitized html hit the server, which triggered the auto-block?
- netsectoday 7y agoThe employee has responded to all other questions that don't touch on the specifics of their fraud detection algo. After those responses it sounds like they have a behavioral threshold that looks something like: "x number of videos that include an external link or html that have been created or updated within x period of time for a specific account or ip address", where the limits are probably much tighter on the free accounts.
- gesman 7y agoThis is great and fast response here. Does Vimeo has a way for human employee to proactively (not as a result of social media shaming) look at- and unblock customer account in case it was a result of false positive? Ban-first, handle-later is not exactly customer friendly policy.
- muglug 7y ago> Does Vimeo has a way for human employee to proactively (not as a result of social media shaming) look at- and unblock customer account in case it was a result of false positive? No, but we have a great support team that responds to all customer enquiries (though paying customers get priority). > Ban-first, handle-later is not exactly customer friendly policy. It is when the content being banned might harm customers.
- zapzupnz 7y ago> It is when the content being banned might harm customers. I think this is the right way to approach it because it seems, and this is entirely my unscientific view, a lot of those scammer websites target uploading to Vimeo, Dailymotion, and so on (basically, the websites that aren't as big as YouTube) because they think that being a smaller outfit, the company is less likely to flag and remove the viedo. Then those scam videos turn up relatively high in Google Searches for full movies, full episodes, etc. I notice this especially for non-English, non-Hollywood content. Lots of French, Chinese, Japanese, Korean stuff, all with dubious links.
- luismedel 7y agoI think it's not. If the scoring system detects some suspicious activity, it's the current operation which should be halted (in this context, the video should have been retired), but not the user account. If after a human review, the account present evident violation of TOS, then, yes, ban the user. edit: bad grammar.
- mkl 7y agoAutomatically deactivating links or removing URLs would be just as effective at avoiding harm, and a message explaining that had happened would be much more friendly than terminating accounts without warning.
- hispanic 7y agoI can confirm that my account is now re-enabled! Thanks. > We don't allow hyperlinks in video descriptions when the user has signed up recently... So, I should be able to add hyperlinks in my descriptions at some point down the line? But, how will I know when that is? The fact that me trying resulted in my account being disabled makes me really scared to try it again - ever.
- muglug1 7y agoResponding with an alt because I throttle my HN usage... I should clarify: we allow you to include any url you want, but we don't add anchor tags to the outputted HTML for new users' videos (unless they're paying customers).
- hispanic 7y agoAhhh - so I wouldn't have even tried to submit the markup in the first place. Got it. Thanks.
- CobrastanJorji 7y agoAs a person who posts too frequently on social media, I am interested in your self-throttling solution. Is there a browser extension or something you use?
- muglug1 7y agoIt's an option in the Hacker News account settings.
- a13n 7y agoHN has throttling logic built in, go to your user profile and configure noprocrast, maxvisit, minaway
- CobrastanJorji 7y agoNeato, thanks!
- johnmarcus 7y agoif you can diagnose the issue after submission, why don't you simply not allow it to be saved in the field to begin with, you know, like normal devs of every platform since 1995. That's 24 years of precedence.
- catpsyke 7y agoWould they have been unsuspended even if this didn't hit HN?
- muglug 7y agoYes, it would just have taken a little longer (maybe a day).
- gowld 7y agoWhy do you provide faster service to users who are popular on HN, instead of taking your licks and investing in better response times for your whole user base? As a non-famous person, I wouldn't feel comfortable using your service.
- lexs 7y agoYou wouldn't be comfortable using their service because you might need to wait a day during support questions?
- dang 7y ago"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- gowld 7y agoIf you don't trust HTML from new users, how about disabling HTML for new users, instead disabling their videos? Why crush people and scare newbies off when you can make a proportionate response?