5 ms·

It’s good that they’re thinking about the problem but I wonder if this will have an accidental negative effect due to it being honour based: 1. User1 reads som

It’s good that they’re thinking about the problem but I wonder if this will have an accidental negative effect due to it being honour based: 1. User1 reads something that sounds pretty spammy from Bot1 2. Bot1 is not a “good bot” and thus doesn’t disclose that it is a bot. 3. User1 checks if spammy post was from a bot and sees that it’s not declared itself as one. 4. User1 then assumes that Bot1 is a human and trusts its Tweet more than it would have before the bot status was a thing.

White_Wolf 5y ago
Another thing that will cause problems: "good bot" by whose standards?
- zpeti 5y ago
  I think this question has been answered already. Good by whoever decides things at Twitter. Obviously any bot mentioning hunter biden will not be a good bot.
rebuilder 5y ago
I was wondering why labeling bots isn't mandatory, and can't think of a reason not related to Twitter not wanting the moderation headache.
- timvdalen 5y ago
  How does Twitter tell which accounts are bots?
  - throwawayay02 5y ago
    I'm sure they have an API bots can use.
    - marcan_42 5y ago
      The API doesn't know whether there's a human behind it or not. It's the same API used for third-party clients.
      - zodiakzz 5y ago
        Easily detected by IP ranges.
        cerved 5y ago
        because obviously there's no way to obfuscate an IP address /s
        zimpenfish 5y ago
        If I'm using my VPN, my Twitter bots will be coming from the same IP range as me using Tweetbot or the Twitter website. Even without the VPN, I occasionally have a bot that posts from a home machine with the same IP range as Tweetbot et al.
    - timvdalen 5y ago
      How would you differentiate between a human sending a tweet via the API and a bot?
      - capableweb 5y ago
        User-agents
        hnlmorg 5y ago
        - User-Agent is an optional HTTP header - RESTful APIs don't even expect a User-Agent - User-Agent is customisable (ie bad bots can trivially use an array of seemingly authentic strings) - Even Google are moving away from using User-Agent for identification.
  - hihihihi1234 5y ago
    Politics
    - Applejinx 5y ago
      That does help at times, yes. When politics encompasses propaganda messaging to achieve a specific outcome or condition, it's possible to study the social media output and see when political messages all pop up in a coordinated way. And map out the network, particularly if you can sort out the provenance of key accounts and know where they're coming from, and identify which accounts are most disciplined about amplifying and laundering the messaging. As such, you can indeed spot bots through political agenda :)
  - pjc50 5y ago
    They can't, but repetitiveness of content and hours of posting are fairly good heuristics.
    - optimalsolver 5y ago
      Those heuristics apply to company twitter accounts controlled by humans.
  - sangnoir 5y ago
    There are a lot of heuristics Twitter could use to estimate likelihood of bot accounts: 1) Source IP range + number of accounts linked 2) interaction speed (some actions are too fast to be human, or show coordination like tweeting exact same tweet as a different account withing .2 seconds) 3) interaction times in a rolling window (individual humans need sleep, and usually around the same time) 4) IP packet fingerprinting: can flag discrepancies like a client seemingly tweeting from "Twitter for iPhone" but originating from a Linux/*BSD/windows host
    - maharajatever 5y ago
      Isn't it really amazing that no malicious bot author thought about these before...
      - sangnoir 5y ago
        I'm sure they have, but not all of them have the means (and time) to bypass some of the measures, defeating single-source-IP[1] bots and script-kiddies can cut down on the amount of bots. It's an arms-race that I've fought on both sides of: deploying anti-abuse measures and writing a very well-behaved scraper; unfortunately some sites block all scrapers despite their behavior, and you have to figure out how the detection is done empirically and enjoy your short-lived victories while they last. On the defensive side, you continually have to update your detection heuristics, and the short-lived victories. 1. I also have a read-only Twitter archiving bot that doesn't hide its nature (the handle is "${NOUN}bot"). It runs from a single VPS at regular cron intervals. It'd be trivial for Twitter to detect this and make it not worth my while.
Applejinx 5y ago
Item 4 already happens on a large scale, so I don't think it counts as a downside. Also, 'bot' implies it's a computer or machine. The behavior of concern here is Twitter accounts operating in service of somebody or something else, which might or might not be operated by a human, script, AI, or what have you. If they're operated by a human but the human's following its own script or administering a farm of puppet accounts, it'd still qualify even if the human gets to improvise on its message a bit. A more accurate term might be 'agent', which also describes the day jobs of some of the people working on Twitter as their primary job :)
- laumars 5y ago
  I’m not sure if you’ve read the article or not but a lot of what you’ve posted seems to miss the point of it (and thus my post too). Eg > Item 4 already happens on a large scale, The article states that some people are skeptical about whether to trust tweets because they don’t know whether it’s a bot or not. My post was expanding off that premise saying an optional label doesn’t solve that problem, it makes it worse. > The behavior of concern here is Twitter accounts operating in service of somebody or something else, which might or might not be operated by a human, script, AI, or what have you. The article puts puppet accounts under the same umbrella as “bots”. My post was continuing on from that premise. > A more accurate term might be 'agent', Maybe, but arguing semantics completely misses the point of the discussion. > which also describes the day jobs of some of the people working on Twitter as their primary job :) We aren’t talking about people who work for Pizza Hut managing their Twitter presence. We are talking about large scale use of accounts pretending to be an average Joe but who are controlled by a single entity as part of a larger misinformation campaign. It might be a human who posts the messages but the person controlling those accounts aren’t the same as the accounts report themselves as and neither is there a 1:1 relationship between account and human. Calling them an “agent” legitimises it as if it’s people representing an organisation but it’s not, it’s effective still a network of bots except you’ve replaced software with “fleshware”. I mean sure, if you want a different term to make the distinction then I have no issue with that. But the point of the discussion isn’t what do we name these types of accounts, it’s how do we make readers aware of when they’re reading an opinion vs an undercover piece of promotion. It’s kinds of similar to when some jurisdictions mandate that paid promotions need to be labelled as an advert rather than a review.

White_Wolf 5y ago

Another thing that will cause problems: "good bot" by whose standards?

zpeti 5y ago
I think this question has been answered already. Good by whoever decides things at Twitter. Obviously any bot mentioning hunter biden will not be a good bot.

rebuilder 5y ago

I was wondering why labeling bots isn't mandatory, and can't think of a reason not related to Twitter not wanting the moderation headache.

timvdalen 5y ago
How does Twitter tell which accounts are bots?
- throwawayay02 5y ago
  I'm sure they have an API bots can use.
  - marcan_42 5y ago
    The API doesn't know whether there's a human behind it or not. It's the same API used for third-party clients.
    - zodiakzz 5y ago
      Easily detected by IP ranges.
      - cerved 5y ago
        because obviously there's no way to obfuscate an IP address /s
      - zimpenfish 5y ago
        If I'm using my VPN, my Twitter bots will be coming from the same IP range as me using Tweetbot or the Twitter website. Even without the VPN, I occasionally have a bot that posts from a home machine with the same IP range as Tweetbot et al.
  - timvdalen 5y ago
    How would you differentiate between a human sending a tweet via the API and a bot?
    - capableweb 5y ago
      User-agents
      - hnlmorg 5y ago
        - User-Agent is an optional HTTP header - RESTful APIs don't even expect a User-Agent - User-Agent is customisable (ie bad bots can trivially use an array of seemingly authentic strings) - Even Google are moving away from using User-Agent for identification.
- hihihihi1234 5y ago
  Politics
  - Applejinx 5y ago
    That does help at times, yes. When politics encompasses propaganda messaging to achieve a specific outcome or condition, it's possible to study the social media output and see when political messages all pop up in a coordinated way. And map out the network, particularly if you can sort out the provenance of key accounts and know where they're coming from, and identify which accounts are most disciplined about amplifying and laundering the messaging. As such, you can indeed spot bots through political agenda :)
- pjc50 5y ago
  They can't, but repetitiveness of content and hours of posting are fairly good heuristics.
  - optimalsolver 5y ago
    Those heuristics apply to company twitter accounts controlled by humans.
- sangnoir 5y ago
  There are a lot of heuristics Twitter could use to estimate likelihood of bot accounts: 1) Source IP range + number of accounts linked 2) interaction speed (some actions are too fast to be human, or show coordination like tweeting exact same tweet as a different account withing .2 seconds) 3) interaction times in a rolling window (individual humans need sleep, and usually around the same time) 4) IP packet fingerprinting: can flag discrepancies like a client seemingly tweeting from "Twitter for iPhone" but originating from a Linux/*BSD/windows host
  - maharajatever 5y ago
    Isn't it really amazing that no malicious bot author thought about these before...
    - sangnoir 5y ago
      I'm sure they have, but not all of them have the means (and time) to bypass some of the measures, defeating single-source-IP[1] bots and script-kiddies can cut down on the amount of bots. It's an arms-race that I've fought on both sides of: deploying anti-abuse measures and writing a very well-behaved scraper; unfortunately some sites block all scrapers despite their behavior, and you have to figure out how the detection is done empirically and enjoy your short-lived victories while they last. On the defensive side, you continually have to update your detection heuristics, and the short-lived victories. 1. I also have a read-only Twitter archiving bot that doesn't hide its nature (the handle is "${NOUN}bot"). It runs from a single VPS at regular cron intervals. It'd be trivial for Twitter to detect this and make it not worth my while.

Applejinx 5y ago

Item 4 already happens on a large scale, so I don't think it counts as a downside. Also, 'bot' implies it's a computer or machine. The behavior of concern here is Twitter accounts operating in service of somebody or something else, which might or might not be operated by a human, script, AI, or what have you. If they're operated by a human but the human's following its own script or administering a farm of puppet accounts, it'd still qualify even if the human gets to improvise on its message a bit. A more accurate term might be 'agent', which also describes the day jobs of some of the people working on Twitter as their primary job :)

laumars 5y ago
I’m not sure if you’ve read the article or not but a lot of what you’ve posted seems to miss the point of it (and thus my post too). Eg > Item 4 already happens on a large scale, The article states that some people are skeptical about whether to trust tweets because they don’t know whether it’s a bot or not. My post was expanding off that premise saying an optional label doesn’t solve that problem, it makes it worse. > The behavior of concern here is Twitter accounts operating in service of somebody or something else, which might or might not be operated by a human, script, AI, or what have you. The article puts puppet accounts under the same umbrella as “bots”. My post was continuing on from that premise. > A more accurate term might be 'agent', Maybe, but arguing semantics completely misses the point of the discussion. > which also describes the day jobs of some of the people working on Twitter as their primary job :) We aren’t talking about people who work for Pizza Hut managing their Twitter presence. We are talking about large scale use of accounts pretending to be an average Joe but who are controlled by a single entity as part of a larger misinformation campaign. It might be a human who posts the messages but the person controlling those accounts aren’t the same as the accounts report themselves as and neither is there a 1:1 relationship between account and human. Calling them an “agent” legitimises it as if it’s people representing an organisation but it’s not, it’s effective still a network of bots except you’ve replaced software with “fleshware”. I mean sure, if you want a different term to make the distinction then I have no issue with that. But the point of the discussion isn’t what do we name these types of accounts, it’s how do we make readers aware of when they’re reading an opinion vs an undercover piece of promotion. It’s kinds of similar to when some jurisdictions mandate that paid promotions need to be labelled as an advert rather than a review.