5 ms·
A method used by a german community once was the troll throttle. The basic idea being that troll and spam content compressed better than average content. So yo
by zaarn 6y ago
A method used by a german community once was the troll throttle. The basic idea being that troll and spam content compressed better than average content.
So you point various compression algorithms against your community content to form an average/median/other statistical points. Try both compressing each post individually and compressing it as one giant text corpus and counting the size growth a post generates by being added. These are your measurement points.
An incoming post must solve a captcha to be able to post, however, the likelihood of solving it is tied to the compressability of your post.
A compressable post is likely to be spam or ascii art. The captcha fails even if the data was entered correctly. IIRC I used a relationship of 'min(1, sqrt(1/compress_factor)-1.05)'.
A non-compressable post is not only likely to succeed a captcha, they might succeed even if they actually failed it.
The entire point is that it shifts balances. Trolls will have to submit their posts a few times and resolve captchas, which slows them down. Making content that does not compress well across a variety of compression algorithms, especially if you also account for existing text corpus, is a very hard problem to solve. They'd have to start to add crap to the post to bloat it up, at which point you can counter with the next weapon.
Repeat all of the above, except instead of compression, you estimate entropy. High entropy blocking means you can block messages containing compression decoys.
- 0-_-0 6y agoThe best part about this is it's difficult to figure out how the detection mechanism works to counter it, and I really like the idea, but isn't it easy to just add random noise to the a post to give it the right amount of entropy?
- zaarn 6y agoIt would be quite an art to generate a legible post that contains both ASCII art and a consistent amount of entropy without containing too much entropy or being too compressible. And since posting it adds it to the compression dictionary, it's likely to only going to work some time before it gets compressed better. You'd be fighting yourself more than the captcha. Plus an attacker would now have to, in order to figure out if a post will work or not, attempt to compress the post over X number of compression algorithms (plus of course the unknown text corpus of the long-term compressor) as well as estimate entropy via Y algorithms. You'll be wasting a lot of CPU on these tasks. Meanwhile, humans have no issue because while english does compress somewhat, when we express unique ideas it's less compressible then when we do not.