5 ms·

That’s…what HTML escaping is for…?

SquareWheel 7y ago
What do you mean? Escaping doesn't help with links to spam or fraudulent sites.
kazinator 7y ago
What do you mean "HTML escaping"? If we escape HTML in the conventional sense, then it becomes literal text; you see <a href="whatever">...</a> instead of a clickable link because < is escaped as < and so on. User-submitted HTML content can be scrubbed against malicious tags such as scripts, cross-site exploits, or hacks involving broken syntax that disrupts the surrounding page into which it is embedded. But there is no simple way to allow a brand new user to embed a working URL, such that malicious URLs are prevented; basically you need a giant blacklist and whitelist of domains. A better UI here would be not to ban the account but just not allow the user to save the content containing HTML. The message should say "Sorry, brand new accounts are not allowed to post HTML content". Many new accounts posting HTML content are going to be legitimate.
- blackflame7000 7y ago
  What if every link was encoded with something like a tinyUrl and then whenever the link was clicked, during the translation process, check if a link is blacklisted. This also has the added benefit of allowing statistics to be gathered on common links across multiple accounts.
  - gowld 7y ago
    Approximately 100% of spam URLs haven't been blacklisted yet, because they are being generated by high-speed automated processes.
    - blackflame7000 7y ago
      Perhaps, but the DNS translations to the underlying servers hosting those spamURLs as well as the host header can't possibly be that varied. At the end of the day, you can have infinite URLs but you can't have infinite servers.
      - kazinator 7y ago
        I wonder to what extent it would be effective/useful it to cross-reference SMTP blacklist databases. As in, resolve a URL to an IP address, and then see if that IP block is "spammy" in the e-mail sense.
- muglug1 7y ago
  We don't allow any HTML tags in video descriptions (we pass them through a simple tag stripping filter). But we do automatically add anchor tags to urls for most videos (just not new user's videos). I agree that it's a bit of a UI issue, but communicating to a new nonpaying user that their text-only urls will one-day turn into clickable urls is particularly simple. Looking at the public videos, and reading the article, I think an automatic system detected a new user both adding urls to two separate videos, and the same user modifying those links slightly. That's sufficiently unusual behaviour that it met some threshold for an automated account ban.
  - ineedasername 7y ago
    Okay, I'm not saying it's completely awful to try to detect bad behavior in this way, but you keep offering up explanations for why it happened when the real issue here is the lack of transparency into a rule that can get you banned, when it should be trivial to instead offer users useful feedback. As the author said, this behavior has a chilling effect, or at least an extremely frustrating one. The issue isn't "why the user's actions resulted in a ban", it's the fact that the entire situation should have been avoidable.
    - drivebycomment 7y ago
      They can't share the detailed rules since that will give abusers more information to take advantage of. You assume everyone is a legitimate user, but non trivial fraction of online accounts are for abuse. Since the perfect precision on abuse detection is impossible and insufficient abuse detection often means a death for the service (spam, legal, PR), this is impossible to avoid. The only question is the rate of false positive flagging. Given that this is purely anecdotal, it doesn't give me any way to assess whether Vimeo's false positive is egregiously bad or not.
      - ineedasername 7y ago
        I don't see how an error message stating, "html markup is not allowed in your post" will in anyway facilitate more abuse than banning when the abusive bad actors will simply take the ban as a signal of the same, create another account, and then avoid the activity. There's a balance to be struck between usability and abuse prevention, and currently Vimeo has got it wrong.

What do you mean? Escaping doesn't help with links to spam or fraudulent sites.

What do you mean "HTML escaping"? If we escape HTML in the conventional sense, then it becomes literal text; you see <a href="whatever">...</a> instead of a clickable link because < is escaped as < and so on. User-submitted HTML content can be scrubbed against malicious tags such as scripts, cross-site exploits, or hacks involving broken syntax that disrupts the surrounding page into which it is embedded. But there is no simple way to allow a brand new user to embed a working URL, such that malicious URLs are prevented; basically you need a giant blacklist and whitelist of domains. A better UI here would be not to ban the account but just not allow the user to save the content containing HTML. The message should say "Sorry, brand new accounts are not allowed to post HTML content". Many new accounts posting HTML content are going to be legitimate.

blackflame7000 7y ago
What if every link was encoded with something like a tinyUrl and then whenever the link was clicked, during the translation process, check if a link is blacklisted. This also has the added benefit of allowing statistics to be gathered on common links across multiple accounts.
- gowld 7y ago
  Approximately 100% of spam URLs haven't been blacklisted yet, because they are being generated by high-speed automated processes.
  - blackflame7000 7y ago
    Perhaps, but the DNS translations to the underlying servers hosting those spamURLs as well as the host header can't possibly be that varied. At the end of the day, you can have infinite URLs but you can't have infinite servers.
    - kazinator 7y ago
      I wonder to what extent it would be effective/useful it to cross-reference SMTP blacklist databases. As in, resolve a URL to an IP address, and then see if that IP block is "spammy" in the e-mail sense.
muglug1 7y ago
We don't allow any HTML tags in video descriptions (we pass them through a simple tag stripping filter). But we do automatically add anchor tags to urls for most videos (just not new user's videos). I agree that it's a bit of a UI issue, but communicating to a new nonpaying user that their text-only urls will one-day turn into clickable urls is particularly simple. Looking at the public videos, and reading the article, I think an automatic system detected a new user both adding urls to two separate videos, and the same user modifying those links slightly. That's sufficiently unusual behaviour that it met some threshold for an automated account ban.
- ineedasername 7y ago
  Okay, I'm not saying it's completely awful to try to detect bad behavior in this way, but you keep offering up explanations for why it happened when the real issue here is the lack of transparency into a rule that can get you banned, when it should be trivial to instead offer users useful feedback. As the author said, this behavior has a chilling effect, or at least an extremely frustrating one. The issue isn't "why the user's actions resulted in a ban", it's the fact that the entire situation should have been avoidable.
  - drivebycomment 7y ago
    They can't share the detailed rules since that will give abusers more information to take advantage of. You assume everyone is a legitimate user, but non trivial fraction of online accounts are for abuse. Since the perfect precision on abuse detection is impossible and insufficient abuse detection often means a death for the service (spam, legal, PR), this is impossible to avoid. The only question is the rate of false positive flagging. Given that this is purely anecdotal, it doesn't give me any way to assess whether Vimeo's false positive is egregiously bad or not.
    - ineedasername 7y ago
      I don't see how an error message stating, "html markup is not allowed in your post" will in anyway facilitate more abuse than banning when the abusive bad actors will simply take the ban as a signal of the same, create another account, and then avoid the activity. There's a balance to be struck between usability and abuse prevention, and currently Vimeo has got it wrong.