23 ms·

I accidentally built a nudity/porn platform

482 points by elazzabi_ 6y ago

krisgenre 6y ago
Off topic, I wonder how people publicly admit they released a side project while working a full time job? AFAIK no company accepts this.
- emosenkis 6y ago
  Some companies don't prohibit side projects... My current employer typically allows them if not related to the company's areas of business.
- hrudham 6y ago
  I avoid this with contract work and freelancing. I've also worked at some start-ups that don't put this into their contract (or remove it when asked) so as not to scare the talent away. I think you're right for the larger corporates though. It's often not enforced, but you run the risk of them claiming that it was "done on their time"-style issues later if its successful.
- mvanbaak 6y ago
  As long as I'm not releasing something that is a direct competitor for my job, it's all fine. Main thing I learned is that being open about it at work takes away the fear and worries.
  - rvnx 6y ago
    As long as it's not very successful and not taking your time it's not an issue.
- timgl 6y ago
  At PostHog we explicitly allow (paid) side gigs [0], with the basic warning that the day job comes first. [0] https://posthog.com/handbook/people/side-gigs https://posthog.com/handbook/people/side-gigs
- mikro2nd 6y ago
  In my local jurisdiction it would be illegal for an employer to have any say in what you do outside work hours. They might try some restrictions via their employment contract, but in general it would have no legal effect whatsoever.
- tomschwiha 6y ago
  In Germany you have to tell your boss, but it can't be denied if within worktime limits (48h / w)
- AMerrit 6y ago
  It's pretty commonly allowed in my experience. Always with a "as long as you aren't competing with us" disclaimer.
- ClikeX 6y ago
  My employer would only complain if the side-project would reasonably make me less efficient within my contracted hours. So if I were doing 40h (5 full workdays here) every week and I'd be putting in 40h/w as well. The other gotcha is that side-projects shouldn't be in any way competing directly with my employer. If you work in product-development that is pretty easy to isolate. Agencies on the other hand could basically make anything for a client. So that's a bit tricker. No idea what of my contractual limitations are actually enforceable, though. And they've never complained about side-projects because my own projects aren't anywhere near something they would accept as a client.
- hansvm 6y ago
  It depends a bit on the jurisdiction (I'm not really sure if laws or local culture came first, but they tend to go hand-in-hand for this issue). E.g., in CA there are only a few whitelisted situations where your employer could own your side project, and in all other cases it belongs to you. As a matter of practice, most companies in the area allow side projects, and many "require" that you ask permission -- since they'll just rubber stamp approval onto whatever you're doing anyway, that typically works out in your favor; now you have written proof that your employer doesn't want to exercise any potential claims to your project even if it nominally seems to infringe on their business.
- dspillett 6y ago
  As long as you are not using company resources, including company time, or producing something that competes with the company (effectively using inside knowledge, another company resource), in most legal jurisdictions they can't stop you and any contract clause that tries is not legally enforceable. Of course that doesn't mean many don't try block such things…
- mrweasel 6y ago
  It doesn’t really matter if they accept it or not, you’re doing it on your own time. The US may be different, but here you employeer have zero say in what you do in your spare time. Don’t use company issued equipment or software licenses, that changes thing, and may count as misuse of company property and that can get you fired. Most companies I’ve worked for have a provision that states they can buy my projects, by compensating me for my work.
epaga 6y ago
"Take a competitor product, remove all features you don’t need, and make it crazy fast." Seems to me there are hundreds of lifestyle businesses just waiting to happen by following this formula. So many good ideas out there could be made so much better by reducing them to their essentials, but making them elegant and "crazy fast".
- UncleMeat 6y ago
  But what are the features you don’t need? That is not the same set for all users.
  - avian 6y ago
    A small fraction of users of a big service is often enough to run a small, non-VC funded business.
    - vorpalhex 6y ago
      The moment your goal shifts from VC-backed acquisition or public offering bid to "I'd like to support myself and some employees comfortably" the things you can do profitably become almost endless. Want to run a little webhosting business focused on small businesses? Tried and true. Want to offer custom software development for some little vertical? Easy enough. Want to just make a really nice and clean note app? That works too. When your goal of success shifts from "mind boggingly rich" to "sufficient for the lifestyle I want", it's much easier to be successful.
  - Sir_Substance 6y ago
    Yep. The late 90's and early 2000's was littered with people trying to make "light" copies of MS Word. The problem is that journalists need the wordcount feature, and teachers need the wordart feature. Remove either, you lose a demographic. That having been said, there are a lot of products out there that made their product intending it to be free, and then when they hit 1m users they started thinking "hmmm, if I could get a dollar out of every user, I could buy a house". They try to stuff a monetization model in sideways and damage their product in the process. Taking a moderately successful product that's crippled by attempting to shoehorn in monetization and redesigning it to have reasonable monetization from the beginning might be a better strategy.
joosters 6y ago
I later discovered that Instagram banned all mylink.fyi links from the platform. A customer also confirmed to me via email that Snapchat started blocking links. Heh, I’m banned by Instagram and Snapchat! [...] If you’re interested in acquiring the domain name, and/or the app, let’s talk. That domain name must have a negative value now?
- dijit 6y ago
  Thinking about it; maybe not. If you're one of those loud folks who dislike instagram/facebook (like me) then this is a nice way to ensure your content and data does not end up on the platform. Of course, they're only enforcing it themselves, so it's unlikely to be permanent. :(
sneak 6y ago
Guilt by association is illegal in most contexts, but apparently is fine for the censors at Instagram.
- _Microft 6y ago
  You're pointing out a problem there. The tools and processes around moderation (censorship might be too strong a word) are pretty lacking. Let me consider with two cases. For one the issue of a company making the rules, e.g. Facebook imposing prudery worldwide, even in places where things like a bare breast are not considered as such (yet?!). Why should someone half a world away physically and maybe even further morally have a say in what people can or cannot post in e.g. Europe? Another is bans/ignores/mutes by users, I would say. The tools for these are absolutely lacking. Mutes or bans are usually permanent and there is no way to do anything about it. It's like solving every problem with a sledgehammer. (If I wanted to, I could go and mute or ban anyone I like to on e.g. Twitter and they would have absolutely no means to explain themselves, appeal the decision or have any expectation that their sentence is going to be over one day.) Maybe social media should be rather treated like public infrastructure and should have to provide services too all while leaving any moderation problems to other entities (and should just have to execute their decisions instead of both deciding and executing). /rant
- jokethrowaway 6y ago
  It's a private platform, so yes, it's absolutely fine. When you choose to use Instagram you buy into their censorship
yelsom 6y ago
I wonder how one can know the history of a domain name before buying it. Imagine making a new website and realizing that your domain name is banned from all social networks!
- gvb 6y ago
  There are various online blacklist check tools. Examples: email: https://mxtoolbox.com/blacklists.aspx https://mxtoolbox.com/blacklists.aspx DNS blacklists: https://www.ultratools.com/tools/spamDBLookup https://www.ultratools.com/tools/spamDBLookup
- fabiandesimone 6y ago
  For Facebook use Web of Trust. That's what they use to check if a domain has a good rating. If it doesn't you won't be able to share or run ads.
Jenk 6y ago
A market platform I recently worked on allowed users (free sign up) to create multiple wishlists and then send those wishlists to arbitrary email addresses. The user could set a custom title, limited to 100 characters or so. We soon discovered a similar problem to OPs - bot accounts (mostly @qq.com addresses) were registering by the hundreds per day to create wishlists and then send those wishlists to other @qq.com addresses. They were setting the titles to arbitrary code blocks. I found it fascinating, if terribly inefficient. Some colleagues and I were speculating on the purpose, perhaps someone experimenting some kind of laundered botnet control path? We tried all kinds of measures to prevent it but ultimately we blocked all @qq.com accounts and eventually disabled the wishlist feature altogether as it had such little real usage.
- coldpie 6y ago
  We allow users to sign up for a free trial for our product, you have to put in your name & email address. After the trial expires, we send an email that says "Hey So-and-so, your trial ran out, click here to give us money, etc." Some enterprising spammers filled in the name field with spam URLs and the email field with victims' email addresses, in order to spam them. So the victim would get "Hey hxxp://buyfreerolex.com/, your trial ran out..." spam emails, from our email server. Obviously we've fixed it since, but it's absolutely wild the length spammers will go to.
  - anyzen 6y ago
    Ha, thank you! That explains it... I've had several signups via Tor to my service, none of them confirmed, every few days... I guess they were checking if they can somehow abuse the mails.
  - throwaway744678 6y ago
    Perhaps a bug in some spamming script, mistaken your sign-up form for a blog comment form?
- slyall 6y ago
  We had somebody signing up to a website with Russian email addresses. What they did though was set the the Personal name to something like the following in Russian: "Click here to see a translation http://whatever.r/?username" http://whatever.r/?username" So when we sent out the email to verify the signup the receiver saw some English text they couldn't read and the above instructions in Russian telling them to click on the link. This was a Magento site so I assume it was a standard bot.
Santosh83 6y ago
Why do social media sites treat "links to X" as directly posting X on their site? Surely the former is not against their terms of service? (Here am talking about legal adult content obviously)... These overarching powers to censor anything for any reason is disturbing to say the least.
- fsflover 6y ago
  That's why we have Mastodon now, where everyone can choose what to censor themselves.
  - hkt 6y ago
    Which inevitably means an environment normal people hate - because they end up with some of the quirkier denizens of the internet on their global timelines if they use a public instance.
    - fsflover 6y ago
      Not at all. "Normal" people simply choose "normal" instances.
      - sfkdjf9j3j 6y ago
        Which ones are you talking about?
        fsflover 6y ago
        Depends on what is normal for you. See e.g. https://mastodon.social/public https://mastodon.social/public or https://floss.social/public https://floss.social/public.
- t0astbread 6y ago
  I suppose if most of the links posted for a site are spam the social media giants would rather just ban the site entirely than do "micro-management" for the site.
avian 6y ago
Linktree, the service the author aimed to replicate had similar problems according to Wikipedia [1]. > In 2018, Instagram banned the site due to "spam," although it was lifted and Instagram issued an apology. > Rumors circulate that Instagram will issue another ban. [1] https://en.wikipedia.org/wiki/Linktree https://en.wikipedia.org/wiki/Linktree
- bichiliad 6y ago
  I wonder if using Instagram Login has helped them filter out spam accounts.
pjc50 6y ago
Yup. If you build a communications platform, it will be used for spam. If you build a hosting platform, it will be used for porn. If you build a linking platform, it will be used to spam links for porn. Anything else requires a constant uphill battle of content filtering and deletion. You could call it censorship, but it's a necessary reality.
- therealmarv 6y ago
  It's all a joke and it is censorship. On one hand FB is hiding behind freedom of speech but on the other hand I cannot send specific form of links even in private via messenger.
  - Tade0 6y ago
    Then again what else can FB or other such platform do? Porn and spam always take over eventually, because they're consumed by, ahem, highly motivated individuals.
  - unnouinceput 6y ago
    use tinyurl
- microcolonel 6y ago
  > Anything else requires a constant uphill battle of content filtering and deletion. You could call it censorship, but it's a necessary reality. Depends on how you structure it. If they're paying to list, then it makes things a lot easier.
  - ghaff 6y ago
    I suspect that this is one reason you're seeing virtual conferences that are charging $50 or whatever. Yeah, it's a few dollars to offset costs. But it also keeps out the "riff-raff" so to speak. Charging nominal fees are going to keep out the most casual users but I'm not sure it's a bad idea.
    - 6y ago
fangorn 6y ago
Was it legal "to take a closer look and see the links they are sharing"?
- 1f60c 6y ago
  Why do you think it could be illegal? The ToS also includes this: > You represent and warrant that: […] the Content will not or could not be reasonably considered to be obscene, inappropriate, defamatory, disparaging, indecent, seditious, offensive, pornographic, threatening, abusive, liable to incite racial hatred, discriminatory, blasphemous, in breach of confidence or in breach of privacy; […] For which they obviously need to look at the data.
  - majewsky 6y ago
    That doesn't imply they are looking at the data during regular operation. That just means that the user is liable for breach of contract if they post noncompliant links. The first point in time where the admin really has to look at the data would be during the discovery phase of the corresponding lawsuit between operator and customer.
- INTPenis 6y ago
  I have no idea but it should be because that's basic troubleshooting. I once discovered a pedophile network by troubleshooting their server by looking at its traffic.
- deleted 6y ago
  [deleted]
- dTal 6y ago
  Illegal not to, in this day and age. Websites are held responsible for user-generated content.
- jacquesm 6y ago
  Absolutely. Nicer if you disclose it in your terms of service but data inspection should be considered the norm unless you explicitly agree otherwise. And even then, if it isn't encrypted with a key that only you control then you should still assume your comms are being read.
elric 6y ago
One of the hidden consequences of the insane censorship that's being pushed by social media companies.
- jacquesm 6y ago
  No, it's a consequence of not being on top of abuse on your platform. And because those big social media platforms are working really hard to avoid going down through no particular fault of their own they shut stuff like this down at the first sight of trouble. HN does the same with spam, which is the only reason we can have this conversation in the first place. I take it that you do not consider that censorship?
  - elric 6y ago
    If big platforms weren't so obsessed with trying to censor porn, there would be no need for people to hijack other platforms simply so they could create links to share porn. There's this bizarre obsession with "protecting" people from nudity (especially female nipples). Advertisers will stay away from your platform if there's nudity. Credit card companies will refuse to process your payments (or charge much, much steeper fees). And for what? So people can pretend that naked bodies don't exist? That sex isn't a thing? Seems odd to me. If I want to private message my friends dirty pictures, who is FB (or whatever platform) to tell me I can't? As for spam, it's a shame that after 20+ years of the stuff, we still don't have a good answer for it. Some subset of people is spending money on whatever spammers are advertising, or they wouldn't be doing it.
    - jacquesm 6y ago
      If someone wants to set up a service where all that is within the TOS they are free to do so, just as there are other people who have decided otherwise. None of what you said is limited by the freedoms that you already have, including starting your own platform. But I'm sure that when you do, you too will find some things on it that you will want to block.
    - lovegoblin 6y ago
jacquesm 6y ago
- anything that allows file upload -> porn / warez / movies / any form of copyright violation you care to come up with. - anything that allows anonymous file upload -> childporn + all of the above. - anything that allows communications -> spam, harassment, bots - anything that measures something -> destruction of that something (for instance, google, the links between pages) - any platform where the creator did not think long and hard about how it might be abused -> all of the abuse that wasn't dealt with beforehand. - anything that isn't secured -> all of the above. Going through a risk analysis exercise and detecting the abuse potential of whatever you are trying to build prior to launching it can go a long way towards ensuring that doesn't happen. Reacting very swiftly to any 'off label' uses for what you've built and shutting down categorically any form of abuse and you might even keep it alive. React too slow and before you know it your real users are drowned out by the trash. It's sad, but that's the state of affairs on the web as we have it today.
- dustingetz 6y ago
  "Sufficiently Powerful Optimization Of Any Known Target Destroys All Value" https://thezvi.wordpress.com/2019/12/31/does-big-business-hate-your-family/ https://thezvi.wordpress.com/2019/12/31/does-big-business-ha...
- ThreeFx 6y ago
  The measure law is also known as Goodhart's law: https://en.wikipedia.org/wiki/Goodhart%27s_law https://en.wikipedia.org/wiki/Goodhart%27s_law
- est 6y ago
  github is fairly open and it's not used for porn, yet.
  - moonbug 6y ago
    and from that one can infer....
  - barbecue_sauce 6y ago
    As far as you know...
ensignavenger 6y ago
I'm building a platform that could be abused in similar ways. Does anyone have any suggested resources I could read/use to avoid this problem, preferably without employing captchas? Akismet might be helpful?
- jacquesm 6y ago
  Manual review (depends on the scale you intend to go for), build a 'trust' profile of your users, analyze the crap out of sign up page activity to detect abusers even before they've made their first move. None of those require extra user interaction and can be quite effective.
  - ensignavenger 6y ago
    " analyze the crap out of sign up page activity" Do you have any suggestions for further reading about approaches to this? I do plan to do manual verification initially, but if the project is succesful, I won't be able to keep up- a good problem to have, and I don't want to optimize prematurely- but I also don't want the site to become overcome with spam before I have any clue how to handle it :)
    - jacquesm 6y ago
      Mail me and I'll give you a recipe.
- gwd 6y ago
  One thing to think of is not to be valuable to them. So for instance, ALWAYS do HTML sanitization via whitelist; don't let anyone put any javascript or any weird CSS or HTML into your posted content that you don't allow there. If you allow links, make sure they all have the "nofollow" tag, so that you can't be used for link farming. (Both because it helps spammers, and because if Google detects that your site is being used for link farming, your own sites bomb.) Other tricks spammers use: Using a link for the username, since that is sometimes emailed or displayed even when moderated content is not. The site I run is a special-purpose conference website for a relatively small community (usually 60-100 attendees), so manually moderating all content until a user is verified works pretty well. The first year we had a handful of spammers, but their content was all deleted by me before it was seen by anyone. (With the exception of the link for a username. Missed that trick.) The next year we didn't have any spam accounts at all. No idea how well that will scale for your use case.
timwaagh 6y ago
i think it's somewhat of a start for a business if you have the stomach for it. you just need to figure out how to make money off the freeriders and get around the social media censorship for the paid users.
harry-wood 6y ago
I've come across these kinds of prototype link sharing sites in my battles with SEO spam. On the face of it SEO spam is simple: the bad guys bung a load of links into your wiki or blog comments in the hope of gaining google rankings for their "SEO clients", but... Increasingly they started bouncing links all over the place in complex spamdexing webs. Link sharing sites often get thrown in the mix, along with cross-linking other blogs/wikis where they've got their spam to stick. This all makes it easier to evade any filtering by a particular blog/wiki admin, but maybe also makes it harder for google to filter and down-rank the baddies, and finally depending on how complex a spamdexing web is, it offers protection to their clients because it ends up being impossible to see which end websites the spammer is actually aiming to promote (the links tucked away amidst the randomised cross-linked chaos) But maybe that was a game of a few years ago, and now spam bots are mostly just trying to push porn on social media.
- heipei 6y ago
  I'm facing the same issue with a URL analysis service I operate which lets you take a snapshot and screenshot of a website. I get countless submissions to other sites which allow user-generated content (Reddit, Medium, random support sites, everything that's "open") and all of these sites themselves host images and links to "Watch XX Soccer Game Live 2020 HD" etc., so all link-spam. I found my ways to battle these submissions and users, but obviously don't want to reveal them here. The other thing is signup-spam. I'd say a full 50% of my signups are spam, and I do my best to remove those user accounts. What surprised me was that the spammers seem to be human, i.e. using a Gmail address (which requires verification), solving Captcha, entering form fields, clicking the email-verify link, etc. Just crazy. Again, the countermeasures are not something I would want to publicize...
yoran 6y ago
We've had multiple spammer attacks over the years. Our platform allows users to create and publish their own content. Our primary target is education, teachers and students. But naturally it's being abused by spammers. It's been an interesting cat and mouse game to counter them. - One time, they used our platform to publish links to their streaming websites for the quarter finals of the 2018 Champions League. Suddenly we ended up being first result on Google for "arsenal v barcelona". It was fifteen minutes before the game so you can imagine that we got a lot of traffic. On the one hand it was kind of flattering that the SEO ranking of our domain was so strong. On the other hand, it wasn't great nor beneficial for the platform to be abused like that. As a counter-measure, we decided to block indexing of project pages for 24 hours when they're first made public. The spammers never came back. - Another time, we got an email from AWS that our SES bounce rate was 15%, and it was rising fast. Being blocked from sending emails by AWS would have been a disaster. It turned out that our invitation system was abused. A creator of a project can invite an external person by email. That person receives an email saying "John Doe invites you to collaborate on 'A nice project about the 2018 Champions League'" with a link to the project. Replace "A nice project about the 2018 Champions League" by a Chinese ad and you've got yourself spammers who are sending thousands of emails a second to a random collection of email addresses. Naturally a lot of these bounce, which caused AWS to warn us. So we had to start verifying the MX validity of invited email addresses and throttle the system to a maximum of 100 emails in a window of 24 hours. - We still get a lot of spammers publishing obvious spammy projects. One thing that has helped is the Clearbit Risk API. You send them an email address and it comes back with an assessment of how spammy the address is. We use it for certain domains (protonmail.com, yandex.com,...) and it frequently flags someone as a spammer right after signup. They can still use the platform but can't make stuff public, completely defeating the purpose of them being spammy. I'm sure they'll keep finding creative ways to get around the limitations we put in. The toughest is to find a way to counter them without it hampering the experience for all the other users.
- Demiurge 6y ago
  Awesome tips there!
victor106 6y ago
> I optimized it in a way I’ll only pay hosting fees when the site is having a lot of traffic. Like 1M+ visits per month. I wonder what optimizations were done so you can only pay for 1M+ hits?
- JshWright 6y ago
  1 million hits in a month is only one request every couple seconds. It doesn't take much to host that.
  - nightcracker 6y ago
    > 1 million hits in a month is only one request every couple seconds. That's a really naive view of how hits are distributed over time.
    - majewsky 6y ago
      Even if rush hour has 10 times more traffic than off hours, that's still only 4 requests per second. Any unoptimized Postgres on a 2/2 node should be able to handle these loads just fine.
    - marcosdumay 6y ago
      That's the average. Of course, hits are not homogeneously distributed. But an average of less than one hit a second leaves more than enough leeway for any reasonable clustering you may come with. Any small computer can handle thousands of times more than that. There is some questions about bandwidth costs, that can vary wildly.
- elazzabi_ 6y ago
  Hey, author of the post here. The whole app lives in Firebase. Once a user hits a profile page, a cloud function runs, get the data from the DB, constructs the page, and caches it at the CDN for 24h. If a user add/delete something on their profile, the cache is removed. Otherwise, the content is served from cache only with no need for a lot of computation. With this, you can still get your way through Firebase's generous free tier https://firebase.google.com/pricing https://firebase.google.com/pricing
mensetmanusman 6y ago
Link hiding tools are unfortunately a security threat due to all the bad actors in the world.
Demiurge 6y ago
I've been maintaining a community forum for more than a decade. We had some abusive users, so we introduced pre-moderation. Meaning, any new user is on probation for a few posts, and all anonymous posts have to be manually approved by an admin to be posted publicly. This has pretty much completely stopped the visible abuse. However, for about 10 years, there are bots registering every day, some of them even make realistic accounts with cool and unique username, email, even description. Strangely, the email and username never match... And they make post with html links embedded. They even know to actually select the 'HTML' content type, which is an extra select input. Some bots even make a few innocent posts, before the link spam. But just too few to get past probation. Obviously, the spam posts never get approved, and accounts never get out of pre-moderation queue and yet they're still trying every day... Not intelligent enough to make more than 2 dumb posts. Similarly, I have some work projects that have user registration with a human on-boarding process, where another person has to add the user to their group for them to share any data, none of which is ever public. So these bots are tirelessly registering, and staying in limbo forever. Thousands of useless accounts. It boggles the mind how much energy is wasted, but I guess it must my profitable enough.
- nickjj 6y ago
  > This has pretty much completely stopped the visible abuse. This process works well but it can also turn away a ton of people from ever joining. I know there's this one product that only offers support through public forums and new accounts need to be reviewed by a moderator and then you're not allowed to post any threads until you've made a few replies to other threads and it's been white listed by a moderator, and then on top of that and you also can't use links until you've met some other criteria. But in order to get proper support it requires linking to large files (videos) that aren't able to be uploaded directly through the forums. It becomes such a pain in the ass to open a support request. It could easily take over a week just to post your question and the worst part about it is the forum software orders posts by date, and your post will be buried on the 8th page before it's visible because it takes your original pre-moderated post date as when it was created.
  - Demiurge 6y ago
joshspankit 6y ago
I’ve never wanted the ability to “react” to hn comments as much as I want it for the comments on this post.
alexellisuk 6y ago
I really like the design of the page - very clean and easy to understand the value prop. I could see this being useful for influencers and bloggers. Shame to hear about the mis-use :-(
tomschwiha 6y ago
For me the knowledge that bots rather don't execute and run Javascript helps to get rid of most bot comment/contact requests.
- 95_JL_OK 6y ago
  Some can, Selenium or other browser automation is sometimes used in bots. Really, any headless browser can be paired up with some automated QA toolkit and turned into a rather effective bot. All that has to happen is for the bot to load the page in headless mode, then issue the keystroke events to the specified elements.
  - tomschwiha 6y ago
    From my experience most don't as it costs more money (ressources). For me a hidden input with some math solved by Javascript got rid of 10 spam contact requests per day to actually 0. However of course, the larger a page gets the more dedicated the bots get. But for the plain porn/russian spam it helped.
Abishek_Muthian 6y ago
We were running a privacy focussed Chat-App-Network dating platform in 2017 which was accelerated by Facebook[1]. i.e. A network between, Messenger<->Viber<->Telegram<->Line App. By design no media sharing was allowed(to prevent pornography) and the user profile images were received from the platform itself. But we soon faced unique challenge of people from certain countries using their children picture as profile picture(often just the children), there were people with group photo as profile image and then there were people who using explicit images as profile pictures. So we integrated Amazon Rekognition to identify children, group and explicit images. Those using explicit images were banned immediately and those with children/group photo image(Face detection not Facial recognition) were asked to change their profile image(Their profile was not shown to anyone until they changed their profile picture with just them). We were processing >200,000 profile images per month as people change their profile images often. But, as we very well know Amazon Rekognition or for the fact any such ML solution is not 100% accurate, we faced issues with people with darker skin color(Amazon told me that they were working to fix the issue; exactly why this type of half baked tech shouldn't be used for things which can cause harm) and so we had to reduce the confidence levels to such an extent that anything resembling a child would be flagged by the system(False positives are better in this case than false negatives). [1]https://hitstartup.com/about/#FindDate https://hitstartup.com/about/#FindDate
- 2sk21 6y ago
  Fascinating! How expensive was it to use Rekognition in your application? Was it a significant expense?
  - Abishek_Muthian 6y ago
    Thank you, I think we incurred ~ $200 for ~200,000 images for Rekognition API and I also think Amazon had fairly large free-tier limit for Rekognition at that time, since the service was relatively new.
- nerdkid93 6y ago
  > privacy focused Chat-App-Network... accelerated by Facebook Why would any company focusing on privacy partner with Facebook or Google? I would guess that some ardent supporters of such a product/company would be put off by such a partnership, no?
dhosek 6y ago
I run a mediawiki site. I got to play the cat and mouse game as well. For a while I was getting hundreds of spam page creations per day despite implementing as many defenses as I could. I was at least once a day going through and deleting the spam posts using the Smite Spam plugin. It's finally calmed down and I get one or two posts maybe every couple of weeks. I think I may have finally been removed from the site list of whatever "packaged" software the spammers use.
- vorpalhex 6y ago
  With prebuilt software, a small custom change required for creating content is often times enough to deter mass automated spam. My go to for a number of the years was to add a form field with the label "Enter the word 'orange'". Trivial for a human but requires just a bit of customization for a bot, enough that most spammers won't bother.
  - dhosek 6y ago
    I'm building a bespoke replacement for the wiki since all the pages share the same structure and the mediawiki solution isn't as user-friendly as I'd like. Hopefully I won't do anything dumb like the naïve contact form I'd made that turned into a spam vector because I was putting unsanitized user input into mail headers.
ganzuul 6y ago
Slasdot's moderation system is brilliant in this regard.
- ramses0 6y ago
  Can you elaborate?
  - ganzuul 6y ago
    Oh, yes. It assigns a small number of 'moderation points' to random users, and a larger number to trusted users. Essentially their algo picks out random users to moderate just a little, which lets the diaspora bump up visibility of what they like. In addition to up and downvotes the mods label a post "+1 Informative", "+1 Funny", or "-1 Flamebait". Users can assign more visibility to something which has been voted Informative twice than once Informative and once Funny. There is no "-1 I disagree". The purpose of the votes are obvious. There is meta-moderation on top of this which has users check the moderation of other users. I assume people who repeatedly abuse their privilege are given sub-naive priority for mod point assignment. This scales with traffic and requires the minimum of admin oversight.
    - ramses0 6y ago
      I'd forgotten about the random mod privileges, and meta-mod.
draw_down 6y ago
I have to say, “build a link sharing site and then forget about it” seems like a strange approach to success.
desireco42 6y ago
I wanted a long time ago to make a free speech forum and platform. As much as I believe it would be good to have place you can say what you want, the hassle of spam and plain nastiness is just what always stopped me from doing this.
dumbfounder 6y ago
I struggled with it myself with Twicsy, except Twicsy was just a window into Twitter and made it much easier to find the porn and (gag) child porn. I remember the first time I found a network of child porn, it made me sick to my stomach. Tooks me hours to get rid of it, report it to Twitter, and to the authorities. It was a problem for a long time, I felt like I was doing all of Twitter's dirty work that they wouldn't do themselves. I made tools for people to report it easily, and tools to eliminate it en masse. Twitter took way way way way way too long cleaning up their act in this respect. They also often just deleted tweets and not pictures, pictures could linger for months without being deleted from their content servers, and still appear in Google.
jonnycomputer 6y ago
I recall in the early days of mobile apps downloading an ipad app which had this neat idea that kids could share their drawings, made in the app, with each other in a sort of random way. It did not take long for me to realize that meant seeing an endless stream of inappropriate, or sometimes potentially harmful content (e.g. from adults interested in exploiting children).
devit 6y ago
I don't understand what the problem is with using the service to provide links to porn, and also don't understand why Instagram and Snapchat would care about links to lists of links to porn?
- buzzerbetrayed 6y ago
  I imagine it would have to do with 1) The number of minors on Instagram and Snapchat. and 2) The image that Instagram and Snapchat want for their platforms. They aren’t looking to become tumblr in the eyes of the masses.
taftster 6y ago
Here's an example of a similar problem - that I created for a website I help a friend with. We had outbound referral links, basically to monitor the number of times that a visitor clicks out of the website. The URL pattern was something like: example.com/out.php?url=outbound.com The out.php script would just simply (naively) redirect the user to the url specified. We never validated if the outbound link was to an authorized reference. The result is the same. Eventually spammers figured out the above link and then just started posting their spam using the site's redirect script to any number of social media sites, embedded in email, etc. What's interesting too is that we would see multiple redirects embedded into a single request. e.g. out.php?url=another.link.service/link=spammer.com Obviously in hindsight this was stupid, but when we built it (some 10 years ago), the idea seemed pretty sound if not maybe a little naive. The solution would have been to only allow redirect links to authorized outbound sites, which works when those links are relatively static and not open ended.
mikorym 6y ago
There is an easier way to accidentally build a porn website: 1) register domain 2) don't renew Not completely unrelated either, since it seems like OP's domain is now bust too... What is also interesting is that probably half of what FB or <insert nonexistant competitor> does is moderation of sorts. This is why FB is becoming a commerce/community page website and why they need Instagram for social media.
iagooar 6y ago
> Other solutions include: requiring credit cards for trial periods, ban all adult content from the platform… But they all require me to put extra effort in the project. And I don’t have time for that. There is people who spend their entire life trying to build a working business, and those who just walk away from what would possibly be a pretty lucrative business because of lack of time. Humans, strange and exciting beings, really.
picodguyo 6y ago
I created a site intended for family photo/video sharing and it did not take long for people to start uploading penis pics. The weird thing is they don't even have a reason or recipient. They just want their penis out there on the internet in the hopes someone might stumble upon it.
klyrs 6y ago
Every time I see somebody identify moderation as censorship, I remember my experiences with public wikis, forums, etc. It's always spam and porn. They'll spin up more fake users than you'll ever have real users, every damned time. It's a vicious cycle, as real users won't stick around if you don't filter.
twodave 6y ago
IMO the better way to design a product like this to avoid abuse would be to simply force them to sign in using each platform they want to link to. At that point all you're building is a way for people to say, "These 5 social media accounts are all me". You could allow them to select one of their accounts to source information and a photo for their combined profile. At that point you're not storing anything besides links to social media profile pages. In effect you get to piggy-back on those sites' abuse mitigation strategies (though of course you're stuck with the lowest common denominator). Your biggest decision at that point is which social media platforms to allow onto your service.
boo-ga-ga 6y ago
Thinking about this when working on a social network (yes, I know) as a pet project at spare time, I've got a question: are there any tools for handling improper text/images automatically? I think there are some lists of "bad words", but not sure if they are available for most widely used languages. But are there libs/SDKs/online services that I can feed a picture and they will tag it as potentially improper, for example porn or some swastikas, so I can pre-moderate manually only such images? Looks like it could be a nice and useful service.
bilater 6y ago
Firebase has a email verify feature You should use that so spam emails can be blocked from using your service.
codezero 6y ago
For most bad actors, a small amount of work is all that's needed to block them from a new platform like this. 1. Use email verification / captchas 2. Block mailinator/throwaway account addresses 3. Use something like Cloudflare/Akamai to protect against egregious bad actors 4. Add some other level of social validation like a major OAuth provider 5. Simple pattern matching - as the author noted, these are rarely sophisticated, and once you put even a small barrier up, they usually trickle down. You can even go further and just limit the features your product has specifically to hurt their use case, or you can actively shadow ban the users yourself, so they don't know their links aren't working.
munificent 6y ago
Paying for bouncers is an understood part of the cost model for a nightclub. If you provide any sort of real or virtual venue that allows unvetted participants, you have to factor in the cost of dealing with bad actors. If you have a virtual venue, you have to factor in the cost of dealing with automated bad actors. It's just how human nature works. 90% of people are great, but 10% can do a lot of damage.
- mrwww 6y ago
  great analogy
guenthert 6y ago
Pics or it didn't happen!
r0rshrk 6y ago
No offence to you but this is why I hate PH so much. Any product launched there goes down in <6 months.
sas41 6y ago
Ow boy, my first real comment on HN, please be gentle! Okay, so I have something related to this. two paragraph back-story was cut... So I built SASRip[1], an Open Source website with an API that allows you to download audio or video from any web-page that is supported by youtube-dl (I use youtube-dl and ffmpeg to do muxing/transcoding). I also built a browser addon for it called Media Reaper[2] (chromium version available on SASRip's website[3]). Now, I wanted to build a no BS, no tracking website, so all I have is internal logs, these logs keep incoming requests like so: Time, URL, ID string, success/fail, the ID is just to tell where the request came from, web site, API call or the browser addon, I keep no IP data or anything like that, and boy do people download the nasty stuff, there is all kinds of nasty stuff, taboo stuff, feet stuff and stuff I didn't even know existed. Now I live in constant fear that someday, looking trough those logs I will find CP and I am not sure what I should do, I know implementing tracking methods goes against both my morals and the philosophy of the service, but at the same time I am not sure if I can keep on going, knowing I could do something about it but I am not. Ultimately I think it is very likely that I will shut the service down if I find CP on it, with no way of tracking the person down, perhaps leave a message with why I shut down. ---------------------------------------- P.S. I make no money on this service, it's purely donation based. P.P.S I know I can do muxing and transcoding via some really cool JS libraries, but I wanted to sharpen some of other skills with this project. ---------------------------------------- [1] - https://sasrip.cf/ https://sasrip.cf/ [2] - https://addons.mozilla.org/en-US/firefox/addon/media-reaper/ https://addons.mozilla.org/en-US/firefox/addon/media-reaper/ [3] - https://sasrip.cf/Home/MediaReaper https://sasrip.cf/Home/MediaReaper
fl0wenol 6y ago
Everyone just want to be horny on main and I think the internet needs to get over / accept this so we can focus and making that profitable and safe.

482 points by elazzabi_ 6y ago

Off topic, I wonder how people publicly admit they released a side project while working a full time job? AFAIK no company accepts this.

emosenkis 6y ago
Some companies don't prohibit side projects... My current employer typically allows them if not related to the company's areas of business.
hrudham 6y ago
I avoid this with contract work and freelancing. I've also worked at some start-ups that don't put this into their contract (or remove it when asked) so as not to scare the talent away. I think you're right for the larger corporates though. It's often not enforced, but you run the risk of them claiming that it was "done on their time"-style issues later if its successful.
mvanbaak 6y ago
As long as I'm not releasing something that is a direct competitor for my job, it's all fine. Main thing I learned is that being open about it at work takes away the fear and worries.
- rvnx 6y ago
  As long as it's not very successful and not taking your time it's not an issue.
timgl 6y ago
At PostHog we explicitly allow (paid) side gigs [0], with the basic warning that the day job comes first. [0] https://posthog.com/handbook/people/side-gigs https://posthog.com/handbook/people/side-gigs
mikro2nd 6y ago
In my local jurisdiction it would be illegal for an employer to have any say in what you do outside work hours. They might try some restrictions via their employment contract, but in general it would have no legal effect whatsoever.
tomschwiha 6y ago
In Germany you have to tell your boss, but it can't be denied if within worktime limits (48h / w)
AMerrit 6y ago
It's pretty commonly allowed in my experience. Always with a "as long as you aren't competing with us" disclaimer.
ClikeX 6y ago
My employer would only complain if the side-project would reasonably make me less efficient within my contracted hours. So if I were doing 40h (5 full workdays here) every week and I'd be putting in 40h/w as well. The other gotcha is that side-projects shouldn't be in any way competing directly with my employer. If you work in product-development that is pretty easy to isolate. Agencies on the other hand could basically make anything for a client. So that's a bit tricker. No idea what of my contractual limitations are actually enforceable, though. And they've never complained about side-projects because my own projects aren't anywhere near something they would accept as a client.
hansvm 6y ago
It depends a bit on the jurisdiction (I'm not really sure if laws or local culture came first, but they tend to go hand-in-hand for this issue). E.g., in CA there are only a few whitelisted situations where your employer could own your side project, and in all other cases it belongs to you. As a matter of practice, most companies in the area allow side projects, and many "require" that you ask permission -- since they'll just rubber stamp approval onto whatever you're doing anyway, that typically works out in your favor; now you have written proof that your employer doesn't want to exercise any potential claims to your project even if it nominally seems to infringe on their business.
dspillett 6y ago
As long as you are not using company resources, including company time, or producing something that competes with the company (effectively using inside knowledge, another company resource), in most legal jurisdictions they can't stop you and any contract clause that tries is not legally enforceable. Of course that doesn't mean many don't try block such things…
mrweasel 6y ago
It doesn’t really matter if they accept it or not, you’re doing it on your own time. The US may be different, but here you employeer have zero say in what you do in your spare time. Don’t use company issued equipment or software licenses, that changes thing, and may count as misuse of company property and that can get you fired. Most companies I’ve worked for have a provision that states they can buy my projects, by compensating me for my work.

epaga 6y ago

"Take a competitor product, remove all features you don’t need, and make it crazy fast." Seems to me there are hundreds of lifestyle businesses just waiting to happen by following this formula. So many good ideas out there could be made so much better by reducing them to their essentials, but making them elegant and "crazy fast".

UncleMeat 6y ago
But what are the features you don’t need? That is not the same set for all users.
- avian 6y ago
  A small fraction of users of a big service is often enough to run a small, non-VC funded business.
  - vorpalhex 6y ago
    The moment your goal shifts from VC-backed acquisition or public offering bid to "I'd like to support myself and some employees comfortably" the things you can do profitably become almost endless. Want to run a little webhosting business focused on small businesses? Tried and true. Want to offer custom software development for some little vertical? Easy enough. Want to just make a really nice and clean note app? That works too. When your goal of success shifts from "mind boggingly rich" to "sufficient for the lifestyle I want", it's much easier to be successful.
- Sir_Substance 6y ago
  Yep. The late 90's and early 2000's was littered with people trying to make "light" copies of MS Word. The problem is that journalists need the wordcount feature, and teachers need the wordart feature. Remove either, you lose a demographic. That having been said, there are a lot of products out there that made their product intending it to be free, and then when they hit 1m users they started thinking "hmmm, if I could get a dollar out of every user, I could buy a house". They try to stuff a monetization model in sideways and damage their product in the process. Taking a moderately successful product that's crippled by attempting to shoehorn in monetization and redesigning it to have reasonable monetization from the beginning might be a better strategy.

joosters 6y ago

I later discovered that Instagram banned all mylink.fyi links from the platform. A customer also confirmed to me via email that Snapchat started blocking links. Heh, I’m banned by Instagram and Snapchat! [...] If you’re interested in acquiring the domain name, and/or the app, let’s talk. That domain name must have a negative value now?

dijit 6y ago
Thinking about it; maybe not. If you're one of those loud folks who dislike instagram/facebook (like me) then this is a nice way to ensure your content and data does not end up on the platform. Of course, they're only enforcing it themselves, so it's unlikely to be permanent. :(

sneak 6y ago

Guilt by association is illegal in most contexts, but apparently is fine for the censors at Instagram.

_Microft 6y ago
You're pointing out a problem there. The tools and processes around moderation (censorship might be too strong a word) are pretty lacking. Let me consider with two cases. For one the issue of a company making the rules, e.g. Facebook imposing prudery worldwide, even in places where things like a bare breast are not considered as such (yet?!). Why should someone half a world away physically and maybe even further morally have a say in what people can or cannot post in e.g. Europe? Another is bans/ignores/mutes by users, I would say. The tools for these are absolutely lacking. Mutes or bans are usually permanent and there is no way to do anything about it. It's like solving every problem with a sledgehammer. (If I wanted to, I could go and mute or ban anyone I like to on e.g. Twitter and they would have absolutely no means to explain themselves, appeal the decision or have any expectation that their sentence is going to be over one day.) Maybe social media should be rather treated like public infrastructure and should have to provide services too all while leaving any moderation problems to other entities (and should just have to execute their decisions instead of both deciding and executing). /rant
jokethrowaway 6y ago
It's a private platform, so yes, it's absolutely fine. When you choose to use Instagram you buy into their censorship

yelsom 6y ago

I wonder how one can know the history of a domain name before buying it. Imagine making a new website and realizing that your domain name is banned from all social networks!

gvb 6y ago
There are various online blacklist check tools. Examples: email: https://mxtoolbox.com/blacklists.aspx https://mxtoolbox.com/blacklists.aspx DNS blacklists: https://www.ultratools.com/tools/spamDBLookup https://www.ultratools.com/tools/spamDBLookup
fabiandesimone 6y ago
For Facebook use Web of Trust. That's what they use to check if a domain has a good rating. If it doesn't you won't be able to share or run ads.

Jenk 6y ago

A market platform I recently worked on allowed users (free sign up) to create multiple wishlists and then send those wishlists to arbitrary email addresses. The user could set a custom title, limited to 100 characters or so. We soon discovered a similar problem to OPs - bot accounts (mostly @qq.com addresses) were registering by the hundreds per day to create wishlists and then send those wishlists to other @qq.com addresses. They were setting the titles to arbitrary code blocks. I found it fascinating, if terribly inefficient. Some colleagues and I were speculating on the purpose, perhaps someone experimenting some kind of laundered botnet control path? We tried all kinds of measures to prevent it but ultimately we blocked all @qq.com accounts and eventually disabled the wishlist feature altogether as it had such little real usage.

coldpie 6y ago
We allow users to sign up for a free trial for our product, you have to put in your name & email address. After the trial expires, we send an email that says "Hey So-and-so, your trial ran out, click here to give us money, etc." Some enterprising spammers filled in the name field with spam URLs and the email field with victims' email addresses, in order to spam them. So the victim would get "Hey hxxp://buyfreerolex.com/, your trial ran out..." spam emails, from our email server. Obviously we've fixed it since, but it's absolutely wild the length spammers will go to.
- anyzen 6y ago
  Ha, thank you! That explains it... I've had several signups via Tor to my service, none of them confirmed, every few days... I guess they were checking if they can somehow abuse the mails.
- throwaway744678 6y ago
  Perhaps a bug in some spamming script, mistaken your sign-up form for a blog comment form?
slyall 6y ago
We had somebody signing up to a website with Russian email addresses. What they did though was set the the Personal name to something like the following in Russian: "Click here to see a translation http://whatever.r/?username" http://whatever.r/?username" So when we sent out the email to verify the signup the receiver saw some English text they couldn't read and the above instructions in Russian telling them to click on the link. This was a Magento site so I assume it was a standard bot.

Santosh83 6y ago

Why do social media sites treat "links to X" as directly posting X on their site? Surely the former is not against their terms of service? (Here am talking about legal adult content obviously)... These overarching powers to censor anything for any reason is disturbing to say the least.

fsflover 6y ago
That's why we have Mastodon now, where everyone can choose what to censor themselves.
- hkt 6y ago
  Which inevitably means an environment normal people hate - because they end up with some of the quirkier denizens of the internet on their global timelines if they use a public instance.
  - fsflover 6y ago
    Not at all. "Normal" people simply choose "normal" instances.
    - sfkdjf9j3j 6y ago
      Which ones are you talking about?
      - fsflover 6y ago
        Depends on what is normal for you. See e.g. https://mastodon.social/public https://mastodon.social/public or https://floss.social/public https://floss.social/public.
t0astbread 6y ago
I suppose if most of the links posted for a site are spam the social media giants would rather just ban the site entirely than do "micro-management" for the site.

avian 6y ago

Linktree, the service the author aimed to replicate had similar problems according to Wikipedia [1]. > In 2018, Instagram banned the site due to "spam," although it was lifted and Instagram issued an apology. > Rumors circulate that Instagram will issue another ban. [1] https://en.wikipedia.org/wiki/Linktree https://en.wikipedia.org/wiki/Linktree

bichiliad 6y ago
I wonder if using Instagram Login has helped them filter out spam accounts.

pjc50 6y ago

Yup. If you build a communications platform, it will be used for spam. If you build a hosting platform, it will be used for porn. If you build a linking platform, it will be used to spam links for porn. Anything else requires a constant uphill battle of content filtering and deletion. You could call it censorship, but it's a necessary reality.

therealmarv 6y ago
It's all a joke and it is censorship. On one hand FB is hiding behind freedom of speech but on the other hand I cannot send specific form of links even in private via messenger.
- Tade0 6y ago
  Then again what else can FB or other such platform do? Porn and spam always take over eventually, because they're consumed by, ahem, highly motivated individuals.
- unnouinceput 6y ago
  use tinyurl
microcolonel 6y ago
> Anything else requires a constant uphill battle of content filtering and deletion. You could call it censorship, but it's a necessary reality. Depends on how you structure it. If they're paying to list, then it makes things a lot easier.
- ghaff 6y ago
  I suspect that this is one reason you're seeing virtual conferences that are charging $50 or whatever. Yeah, it's a few dollars to offset costs. But it also keeps out the "riff-raff" so to speak. Charging nominal fees are going to keep out the most casual users but I'm not sure it's a bad idea.
  - 6y ago

fangorn 6y ago

Was it legal "to take a closer look and see the links they are sharing"?

1f60c 6y ago
Why do you think it could be illegal? The ToS also includes this: > You represent and warrant that: […] the Content will not or could not be reasonably considered to be obscene, inappropriate, defamatory, disparaging, indecent, seditious, offensive, pornographic, threatening, abusive, liable to incite racial hatred, discriminatory, blasphemous, in breach of confidence or in breach of privacy; […] For which they obviously need to look at the data.
- majewsky 6y ago
  That doesn't imply they are looking at the data during regular operation. That just means that the user is liable for breach of contract if they post noncompliant links. The first point in time where the admin really has to look at the data would be during the discovery phase of the corresponding lawsuit between operator and customer.
INTPenis 6y ago
I have no idea but it should be because that's basic troubleshooting. I once discovered a pedophile network by troubleshooting their server by looking at its traffic.
deleted 6y ago
[deleted]
dTal 6y ago
Illegal not to, in this day and age. Websites are held responsible for user-generated content.
jacquesm 6y ago
Absolutely. Nicer if you disclose it in your terms of service but data inspection should be considered the norm unless you explicitly agree otherwise. And even then, if it isn't encrypted with a key that only you control then you should still assume your comms are being read.

elric 6y ago

One of the hidden consequences of the insane censorship that's being pushed by social media companies.

jacquesm 6y ago
No, it's a consequence of not being on top of abuse on your platform. And because those big social media platforms are working really hard to avoid going down through no particular fault of their own they shut stuff like this down at the first sight of trouble. HN does the same with spam, which is the only reason we can have this conversation in the first place. I take it that you do not consider that censorship?
- elric 6y ago
  If big platforms weren't so obsessed with trying to censor porn, there would be no need for people to hijack other platforms simply so they could create links to share porn. There's this bizarre obsession with "protecting" people from nudity (especially female nipples). Advertisers will stay away from your platform if there's nudity. Credit card companies will refuse to process your payments (or charge much, much steeper fees). And for what? So people can pretend that naked bodies don't exist? That sex isn't a thing? Seems odd to me. If I want to private message my friends dirty pictures, who is FB (or whatever platform) to tell me I can't? As for spam, it's a shame that after 20+ years of the stuff, we still don't have a good answer for it. Some subset of people is spending money on whatever spammers are advertising, or they wouldn't be doing it.
  - jacquesm 6y ago
    If someone wants to set up a service where all that is within the TOS they are free to do so, just as there are other people who have decided otherwise. None of what you said is limited by the freedoms that you already have, including starting your own platform. But I'm sure that when you do, you too will find some things on it that you will want to block.
  - lovegoblin 6y ago

jacquesm 6y ago

- anything that allows file upload -> porn / warez / movies / any form of copyright violation you care to come up with. - anything that allows anonymous file upload -> childporn + all of the above. - anything that allows communications -> spam, harassment, bots - anything that measures something -> destruction of that something (for instance, google, the links between pages) - any platform where the creator did not think long and hard about how it might be abused -> all of the abuse that wasn't dealt with beforehand. - anything that isn't secured -> all of the above. Going through a risk analysis exercise and detecting the abuse potential of whatever you are trying to build prior to launching it can go a long way towards ensuring that doesn't happen. Reacting very swiftly to any 'off label' uses for what you've built and shutting down categorically any form of abuse and you might even keep it alive. React too slow and before you know it your real users are drowned out by the trash. It's sad, but that's the state of affairs on the web as we have it today.

dustingetz 6y ago
"Sufficiently Powerful Optimization Of Any Known Target Destroys All Value" https://thezvi.wordpress.com/2019/12/31/does-big-business-hate-your-family/ https://thezvi.wordpress.com/2019/12/31/does-big-business-ha...
ThreeFx 6y ago
The measure law is also known as Goodhart's law: https://en.wikipedia.org/wiki/Goodhart%27s_law https://en.wikipedia.org/wiki/Goodhart%27s_law
est 6y ago
github is fairly open and it's not used for porn, yet.
- moonbug 6y ago
  and from that one can infer....
- barbecue_sauce 6y ago
  As far as you know...

ensignavenger 6y ago

I'm building a platform that could be abused in similar ways. Does anyone have any suggested resources I could read/use to avoid this problem, preferably without employing captchas? Akismet might be helpful?

jacquesm 6y ago
Manual review (depends on the scale you intend to go for), build a 'trust' profile of your users, analyze the crap out of sign up page activity to detect abusers even before they've made their first move. None of those require extra user interaction and can be quite effective.
- ensignavenger 6y ago
  " analyze the crap out of sign up page activity" Do you have any suggestions for further reading about approaches to this? I do plan to do manual verification initially, but if the project is succesful, I won't be able to keep up- a good problem to have, and I don't want to optimize prematurely- but I also don't want the site to become overcome with spam before I have any clue how to handle it :)
  - jacquesm 6y ago
    Mail me and I'll give you a recipe.
gwd 6y ago
One thing to think of is not to be valuable to them. So for instance, ALWAYS do HTML sanitization via whitelist; don't let anyone put any javascript or any weird CSS or HTML into your posted content that you don't allow there. If you allow links, make sure they all have the "nofollow" tag, so that you can't be used for link farming. (Both because it helps spammers, and because if Google detects that your site is being used for link farming, your own sites bomb.) Other tricks spammers use: Using a link for the username, since that is sometimes emailed or displayed even when moderated content is not. The site I run is a special-purpose conference website for a relatively small community (usually 60-100 attendees), so manually moderating all content until a user is verified works pretty well. The first year we had a handful of spammers, but their content was all deleted by me before it was seen by anyone. (With the exception of the link for a username. Missed that trick.) The next year we didn't have any spam accounts at all. No idea how well that will scale for your use case.

timwaagh 6y ago

i think it's somewhat of a start for a business if you have the stomach for it. you just need to figure out how to make money off the freeriders and get around the social media censorship for the paid users.

harry-wood 6y ago

I've come across these kinds of prototype link sharing sites in my battles with SEO spam. On the face of it SEO spam is simple: the bad guys bung a load of links into your wiki or blog comments in the hope of gaining google rankings for their "SEO clients", but... Increasingly they started bouncing links all over the place in complex spamdexing webs. Link sharing sites often get thrown in the mix, along with cross-linking other blogs/wikis where they've got their spam to stick. This all makes it easier to evade any filtering by a particular blog/wiki admin, but maybe also makes it harder for google to filter and down-rank the baddies, and finally depending on how complex a spamdexing web is, it offers protection to their clients because it ends up being impossible to see which end websites the spammer is actually aiming to promote (the links tucked away amidst the randomised cross-linked chaos) But maybe that was a game of a few years ago, and now spam bots are mostly just trying to push porn on social media.

heipei 6y ago
I'm facing the same issue with a URL analysis service I operate which lets you take a snapshot and screenshot of a website. I get countless submissions to other sites which allow user-generated content (Reddit, Medium, random support sites, everything that's "open") and all of these sites themselves host images and links to "Watch XX Soccer Game Live 2020 HD" etc., so all link-spam. I found my ways to battle these submissions and users, but obviously don't want to reveal them here. The other thing is signup-spam. I'd say a full 50% of my signups are spam, and I do my best to remove those user accounts. What surprised me was that the spammers seem to be human, i.e. using a Gmail address (which requires verification), solving Captcha, entering form fields, clicking the email-verify link, etc. Just crazy. Again, the countermeasures are not something I would want to publicize...

yoran 6y ago

We've had multiple spammer attacks over the years. Our platform allows users to create and publish their own content. Our primary target is education, teachers and students. But naturally it's being abused by spammers. It's been an interesting cat and mouse game to counter them. - One time, they used our platform to publish links to their streaming websites for the quarter finals of the 2018 Champions League. Suddenly we ended up being first result on Google for "arsenal v barcelona". It was fifteen minutes before the game so you can imagine that we got a lot of traffic. On the one hand it was kind of flattering that the SEO ranking of our domain was so strong. On the other hand, it wasn't great nor beneficial for the platform to be abused like that. As a counter-measure, we decided to block indexing of project pages for 24 hours when they're first made public. The spammers never came back. - Another time, we got an email from AWS that our SES bounce rate was 15%, and it was rising fast. Being blocked from sending emails by AWS would have been a disaster. It turned out that our invitation system was abused. A creator of a project can invite an external person by email. That person receives an email saying "John Doe invites you to collaborate on 'A nice project about the 2018 Champions League'" with a link to the project. Replace "A nice project about the 2018 Champions League" by a Chinese ad and you've got yourself spammers who are sending thousands of emails a second to a random collection of email addresses. Naturally a lot of these bounce, which caused AWS to warn us. So we had to start verifying the MX validity of invited email addresses and throttle the system to a maximum of 100 emails in a window of 24 hours. - We still get a lot of spammers publishing obvious spammy projects. One thing that has helped is the Clearbit Risk API. You send them an email address and it comes back with an assessment of how spammy the address is. We use it for certain domains (protonmail.com, yandex.com,...) and it frequently flags someone as a spammer right after signup. They can still use the platform but can't make stuff public, completely defeating the purpose of them being spammy. I'm sure they'll keep finding creative ways to get around the limitations we put in. The toughest is to find a way to counter them without it hampering the experience for all the other users.

Demiurge 6y ago
Awesome tips there!

victor106 6y ago

> I optimized it in a way I’ll only pay hosting fees when the site is having a lot of traffic. Like 1M+ visits per month. I wonder what optimizations were done so you can only pay for 1M+ hits?

JshWright 6y ago
1 million hits in a month is only one request every couple seconds. It doesn't take much to host that.
- nightcracker 6y ago
  > 1 million hits in a month is only one request every couple seconds. That's a really naive view of how hits are distributed over time.
  - majewsky 6y ago
    Even if rush hour has 10 times more traffic than off hours, that's still only 4 requests per second. Any unoptimized Postgres on a 2/2 node should be able to handle these loads just fine.
  - marcosdumay 6y ago
    That's the average. Of course, hits are not homogeneously distributed. But an average of less than one hit a second leaves more than enough leeway for any reasonable clustering you may come with. Any small computer can handle thousands of times more than that. There is some questions about bandwidth costs, that can vary wildly.
elazzabi_ 6y ago
Hey, author of the post here. The whole app lives in Firebase. Once a user hits a profile page, a cloud function runs, get the data from the DB, constructs the page, and caches it at the CDN for 24h. If a user add/delete something on their profile, the cache is removed. Otherwise, the content is served from cache only with no need for a lot of computation. With this, you can still get your way through Firebase's generous free tier https://firebase.google.com/pricing https://firebase.google.com/pricing

mensetmanusman 6y ago

Link hiding tools are unfortunately a security threat due to all the bad actors in the world.

Demiurge 6y ago

I've been maintaining a community forum for more than a decade. We had some abusive users, so we introduced pre-moderation. Meaning, any new user is on probation for a few posts, and all anonymous posts have to be manually approved by an admin to be posted publicly. This has pretty much completely stopped the visible abuse. However, for about 10 years, there are bots registering every day, some of them even make realistic accounts with cool and unique username, email, even description. Strangely, the email and username never match... And they make post with html links embedded. They even know to actually select the 'HTML' content type, which is an extra select input. Some bots even make a few innocent posts, before the link spam. But just too few to get past probation. Obviously, the spam posts never get approved, and accounts never get out of pre-moderation queue and yet they're still trying every day... Not intelligent enough to make more than 2 dumb posts. Similarly, I have some work projects that have user registration with a human on-boarding process, where another person has to add the user to their group for them to share any data, none of which is ever public. So these bots are tirelessly registering, and staying in limbo forever. Thousands of useless accounts. It boggles the mind how much energy is wasted, but I guess it must my profitable enough.

nickjj 6y ago
> This has pretty much completely stopped the visible abuse. This process works well but it can also turn away a ton of people from ever joining. I know there's this one product that only offers support through public forums and new accounts need to be reviewed by a moderator and then you're not allowed to post any threads until you've made a few replies to other threads and it's been white listed by a moderator, and then on top of that and you also can't use links until you've met some other criteria. But in order to get proper support it requires linking to large files (videos) that aren't able to be uploaded directly through the forums. It becomes such a pain in the ass to open a support request. It could easily take over a week just to post your question and the worst part about it is the forum software orders posts by date, and your post will be buried on the 8th page before it's visible because it takes your original pre-moderated post date as when it was created.
- Demiurge 6y ago

joshspankit 6y ago

I’ve never wanted the ability to “react” to hn comments as much as I want it for the comments on this post.

alexellisuk 6y ago

I really like the design of the page - very clean and easy to understand the value prop. I could see this being useful for influencers and bloggers. Shame to hear about the mis-use :-(

tomschwiha 6y ago

For me the knowledge that bots rather don't execute and run Javascript helps to get rid of most bot comment/contact requests.

95_JL_OK 6y ago
Some can, Selenium or other browser automation is sometimes used in bots. Really, any headless browser can be paired up with some automated QA toolkit and turned into a rather effective bot. All that has to happen is for the bot to load the page in headless mode, then issue the keystroke events to the specified elements.
- tomschwiha 6y ago
  From my experience most don't as it costs more money (ressources). For me a hidden input with some math solved by Javascript got rid of 10 spam contact requests per day to actually 0. However of course, the larger a page gets the more dedicated the bots get. But for the plain porn/russian spam it helped.

Abishek_Muthian 6y ago

We were running a privacy focussed Chat-App-Network dating platform in 2017 which was accelerated by Facebook[1]. i.e. A network between, Messenger<->Viber<->Telegram<->Line App. By design no media sharing was allowed(to prevent pornography) and the user profile images were received from the platform itself. But we soon faced unique challenge of people from certain countries using their children picture as profile picture(often just the children), there were people with group photo as profile image and then there were people who using explicit images as profile pictures. So we integrated Amazon Rekognition to identify children, group and explicit images. Those using explicit images were banned immediately and those with children/group photo image(Face detection not Facial recognition) were asked to change their profile image(Their profile was not shown to anyone until they changed their profile picture with just them). We were processing >200,000 profile images per month as people change their profile images often. But, as we very well know Amazon Rekognition or for the fact any such ML solution is not 100% accurate, we faced issues with people with darker skin color(Amazon told me that they were working to fix the issue; exactly why this type of half baked tech shouldn't be used for things which can cause harm) and so we had to reduce the confidence levels to such an extent that anything resembling a child would be flagged by the system(False positives are better in this case than false negatives). [1]https://hitstartup.com/about/#FindDate https://hitstartup.com/about/#FindDate

2sk21 6y ago
Fascinating! How expensive was it to use Rekognition in your application? Was it a significant expense?
- Abishek_Muthian 6y ago
  Thank you, I think we incurred ~ $200 for ~200,000 images for Rekognition API and I also think Amazon had fairly large free-tier limit for Rekognition at that time, since the service was relatively new.
nerdkid93 6y ago
> privacy focused Chat-App-Network... accelerated by Facebook Why would any company focusing on privacy partner with Facebook or Google? I would guess that some ardent supporters of such a product/company would be put off by such a partnership, no?

dhosek 6y ago

I run a mediawiki site. I got to play the cat and mouse game as well. For a while I was getting hundreds of spam page creations per day despite implementing as many defenses as I could. I was at least once a day going through and deleting the spam posts using the Smite Spam plugin. It's finally calmed down and I get one or two posts maybe every couple of weeks. I think I may have finally been removed from the site list of whatever "packaged" software the spammers use.

vorpalhex 6y ago
With prebuilt software, a small custom change required for creating content is often times enough to deter mass automated spam. My go to for a number of the years was to add a form field with the label "Enter the word 'orange'". Trivial for a human but requires just a bit of customization for a bot, enough that most spammers won't bother.
- dhosek 6y ago
  I'm building a bespoke replacement for the wiki since all the pages share the same structure and the mediawiki solution isn't as user-friendly as I'd like. Hopefully I won't do anything dumb like the naïve contact form I'd made that turned into a spam vector because I was putting unsanitized user input into mail headers.

ganzuul 6y ago

Slasdot's moderation system is brilliant in this regard.

ramses0 6y ago
Can you elaborate?
- ganzuul 6y ago
  Oh, yes. It assigns a small number of 'moderation points' to random users, and a larger number to trusted users. Essentially their algo picks out random users to moderate just a little, which lets the diaspora bump up visibility of what they like. In addition to up and downvotes the mods label a post "+1 Informative", "+1 Funny", or "-1 Flamebait". Users can assign more visibility to something which has been voted Informative twice than once Informative and once Funny. There is no "-1 I disagree". The purpose of the votes are obvious. There is meta-moderation on top of this which has users check the moderation of other users. I assume people who repeatedly abuse their privilege are given sub-naive priority for mod point assignment. This scales with traffic and requires the minimum of admin oversight.
  - ramses0 6y ago
    I'd forgotten about the random mod privileges, and meta-mod.

draw_down 6y ago

I have to say, “build a link sharing site and then forget about it” seems like a strange approach to success.

desireco42 6y ago

I wanted a long time ago to make a free speech forum and platform. As much as I believe it would be good to have place you can say what you want, the hassle of spam and plain nastiness is just what always stopped me from doing this.

dumbfounder 6y ago

I struggled with it myself with Twicsy, except Twicsy was just a window into Twitter and made it much easier to find the porn and (gag) child porn. I remember the first time I found a network of child porn, it made me sick to my stomach. Tooks me hours to get rid of it, report it to Twitter, and to the authorities. It was a problem for a long time, I felt like I was doing all of Twitter's dirty work that they wouldn't do themselves. I made tools for people to report it easily, and tools to eliminate it en masse. Twitter took way way way way way too long cleaning up their act in this respect. They also often just deleted tweets and not pictures, pictures could linger for months without being deleted from their content servers, and still appear in Google.

jonnycomputer 6y ago

I recall in the early days of mobile apps downloading an ipad app which had this neat idea that kids could share their drawings, made in the app, with each other in a sort of random way. It did not take long for me to realize that meant seeing an endless stream of inappropriate, or sometimes potentially harmful content (e.g. from adults interested in exploiting children).

devit 6y ago

I don't understand what the problem is with using the service to provide links to porn, and also don't understand why Instagram and Snapchat would care about links to lists of links to porn?

buzzerbetrayed 6y ago
I imagine it would have to do with 1) The number of minors on Instagram and Snapchat. and 2) The image that Instagram and Snapchat want for their platforms. They aren’t looking to become tumblr in the eyes of the masses.

taftster 6y ago

Here's an example of a similar problem - that I created for a website I help a friend with. We had outbound referral links, basically to monitor the number of times that a visitor clicks out of the website. The URL pattern was something like: example.com/out.php?url=outbound.com The out.php script would just simply (naively) redirect the user to the url specified. We never validated if the outbound link was to an authorized reference. The result is the same. Eventually spammers figured out the above link and then just started posting their spam using the site's redirect script to any number of social media sites, embedded in email, etc. What's interesting too is that we would see multiple redirects embedded into a single request. e.g. out.php?url=another.link.service/link=spammer.com Obviously in hindsight this was stupid, but when we built it (some 10 years ago), the idea seemed pretty sound if not maybe a little naive. The solution would have been to only allow redirect links to authorized outbound sites, which works when those links are relatively static and not open ended.

mikorym 6y ago

There is an easier way to accidentally build a porn website: 1) register domain 2) don't renew Not completely unrelated either, since it seems like OP's domain is now bust too... What is also interesting is that probably half of what FB or <insert nonexistant competitor> does is moderation of sorts. This is why FB is becoming a commerce/community page website and why they need Instagram for social media.

iagooar 6y ago

> Other solutions include: requiring credit cards for trial periods, ban all adult content from the platform… But they all require me to put extra effort in the project. And I don’t have time for that. There is people who spend their entire life trying to build a working business, and those who just walk away from what would possibly be a pretty lucrative business because of lack of time. Humans, strange and exciting beings, really.

picodguyo 6y ago

I created a site intended for family photo/video sharing and it did not take long for people to start uploading penis pics. The weird thing is they don't even have a reason or recipient. They just want their penis out there on the internet in the hopes someone might stumble upon it.

klyrs 6y ago

Every time I see somebody identify moderation as censorship, I remember my experiences with public wikis, forums, etc. It's always spam and porn. They'll spin up more fake users than you'll ever have real users, every damned time. It's a vicious cycle, as real users won't stick around if you don't filter.

twodave 6y ago

IMO the better way to design a product like this to avoid abuse would be to simply force them to sign in using each platform they want to link to. At that point all you're building is a way for people to say, "These 5 social media accounts are all me". You could allow them to select one of their accounts to source information and a photo for their combined profile. At that point you're not storing anything besides links to social media profile pages. In effect you get to piggy-back on those sites' abuse mitigation strategies (though of course you're stuck with the lowest common denominator). Your biggest decision at that point is which social media platforms to allow onto your service.

boo-ga-ga 6y ago

Thinking about this when working on a social network (yes, I know) as a pet project at spare time, I've got a question: are there any tools for handling improper text/images automatically? I think there are some lists of "bad words", but not sure if they are available for most widely used languages. But are there libs/SDKs/online services that I can feed a picture and they will tag it as potentially improper, for example porn or some swastikas, so I can pre-moderate manually only such images? Looks like it could be a nice and useful service.

bilater 6y ago

Firebase has a email verify feature You should use that so spam emails can be blocked from using your service.

codezero 6y ago

For most bad actors, a small amount of work is all that's needed to block them from a new platform like this. 1. Use email verification / captchas 2. Block mailinator/throwaway account addresses 3. Use something like Cloudflare/Akamai to protect against egregious bad actors 4. Add some other level of social validation like a major OAuth provider 5. Simple pattern matching - as the author noted, these are rarely sophisticated, and once you put even a small barrier up, they usually trickle down. You can even go further and just limit the features your product has specifically to hurt their use case, or you can actively shadow ban the users yourself, so they don't know their links aren't working.

munificent 6y ago

Paying for bouncers is an understood part of the cost model for a nightclub. If you provide any sort of real or virtual venue that allows unvetted participants, you have to factor in the cost of dealing with bad actors. If you have a virtual venue, you have to factor in the cost of dealing with automated bad actors. It's just how human nature works. 90% of people are great, but 10% can do a lot of damage.

mrwww 6y ago
great analogy

guenthert 6y ago

Pics or it didn't happen!

r0rshrk 6y ago

No offence to you but this is why I hate PH so much. Any product launched there goes down in <6 months.

sas41 6y ago

Ow boy, my first real comment on HN, please be gentle! Okay, so I have something related to this. two paragraph back-story was cut... So I built SASRip[1], an Open Source website with an API that allows you to download audio or video from any web-page that is supported by youtube-dl (I use youtube-dl and ffmpeg to do muxing/transcoding). I also built a browser addon for it called Media Reaper[2] (chromium version available on SASRip's website[3]). Now, I wanted to build a no BS, no tracking website, so all I have is internal logs, these logs keep incoming requests like so: Time, URL, ID string, success/fail, the ID is just to tell where the request came from, web site, API call or the browser addon, I keep no IP data or anything like that, and boy do people download the nasty stuff, there is all kinds of nasty stuff, taboo stuff, feet stuff and stuff I didn't even know existed. Now I live in constant fear that someday, looking trough those logs I will find CP and I am not sure what I should do, I know implementing tracking methods goes against both my morals and the philosophy of the service, but at the same time I am not sure if I can keep on going, knowing I could do something about it but I am not. Ultimately I think it is very likely that I will shut the service down if I find CP on it, with no way of tracking the person down, perhaps leave a message with why I shut down. ---------------------------------------- P.S. I make no money on this service, it's purely donation based. P.P.S I know I can do muxing and transcoding via some really cool JS libraries, but I wanted to sharpen some of other skills with this project. ---------------------------------------- [1] - https://sasrip.cf/ https://sasrip.cf/ [2] - https://addons.mozilla.org/en-US/firefox/addon/media-reaper/ https://addons.mozilla.org/en-US/firefox/addon/media-reaper/ [3] - https://sasrip.cf/Home/MediaReaper https://sasrip.cf/Home/MediaReaper

fl0wenol 6y ago

Everyone just want to be horny on main and I think the internet needs to get over / accept this so we can focus and making that profitable and safe.