12 ms·
The Frustration Loop
- pavel_lishin 3y agoThere used to be a plug in for bulletin that would do something similar to users you hellbanned; it would render the site much more slowly, would show errors frequently, and in general made the forum a frustrating experience. (In addition to hiding anything they posted from others!)
- kareemm 3y agoThis reminds me of one of my former ESPN co-workers - Mike Davidson[1] - who founded of one of the first community news sites (Newsvine[2]) back in 2006. Newsvine had comments and upvotes and link submissions and posts - it was very reddit-esque except it was focused around the news. The team had to have a way to deal with spammers and trolls. They found the most effective way was to flag a user as a troll on the Newsvine backend. If the troll flag was set to true, Newsvine would add a random 10-60 second delay to every page load for the troll's account. IIRC it solved the problem pretty effectively. 1- http://mikeindustries.com/blog/ http://mikeindustries.com/blog/ 2- https://en.wikipedia.org/wiki/Newsvine https://en.wikipedia.org/wiki/Newsvine
- rmwaite 3y agoI loved Newsvine. It seemed so innovative and inviting.
- a_e_k 3y agoBy that standard, I think that the new Reddit mobile UI must consider everyone a troll.
- thomastjeffery 3y agoEveryone who doesn't just replace www with old
- pantalaimon 3y agoThere used to be i.reddit.com for the old mobile UI but they shut it down
- pwdisswordfishc 3y agoActually still accessible: https://reddit.com/.i https://reddit.com/.i
- adhamsalama 3y agoClicking on any post leads to the new design. :(
- pantalaimon 3y agoAppending the .i to any link works - it's clumsy, but still less so than the new design.
- edgyquant 3y agoJust stop using Reddit instead of fighting it
- paulryanrogers 3y agoSounds like an idea for a webextension
- deleted 3y ago[deleted]
- pea 3y agoI built a custom stylesheet which makes old reddit mobile friendly (basically to look like an app). I'll throw it up if anyone is interested, I was going to build a webview app which just uses old reddit to provide an app-like experience.
- tareqak 3y agoHow would this work for something like Twitter/X when accounting for individuals serving the US government? Someone could be flagged as a troll on the backend for unrelated reasons, but now their experience in communicating with someone in government is delayed. I understand that a delay is not the same thing as a block, but I wonder if the damage to the user’s experience is sufficiently similar for a federal judge.
- deleted 3y ago[deleted]
- petre 3y agoDon't use Twitter for government comms I guess? It's a private system with its own rules. They can degrade the experience as much as they like if the system flags one as a troll, regardless of their being part of an organization.
- tareqak 3y agoWell, here is the thing: maybe a troll can use the idea that a comments on a government official's account is a public forum and demand that the third party remove the troll flag, or demand that the troll flag be ignored for government accounts. > U.S. District Judge Naomi Reice Buchwald in Manhattan ruled on May 23 that comments on the president's account, and those of other government officials, were public forums and that blocking Twitter Inc TWTR.N users for their views violated their right to free speech under the First Amendment of the U.S. Constitution. https://www.reuters.com/article/usa-trump-twitter-idINKBN1KV2DP https://www.reuters.com/article/usa-trump-twitter-idINKBN1KV... In the above case, the block was executed by the account holder who was a government official. Having the service provider flag a user as a troll and degrading their experience might be acceptable for comments on non-government accounts, but if a federal judge "flags" government accounts as public forums in a US court of law, then the service provider is now creating additional friction for a user participating in a public forum. We have had political candidates and politicians like Alexandria Ocasio-Cortez doing AMAs on Reddit, so what I am describing is not a far-fetched hypothetical: https://old.reddit.com/r/SandersForPresident/comments/6ftvhu/hey_reddit_i_am_alexandria_ocasiocortez_us/ https://old.reddit.com/r/SandersForPresident/comments/6ftvhu... .
- ksey3 3y agoSpam and trolling even happens on a physical newspapers/radio/tv/books/magazines. Its just that you have to pay to do it. The rich/ceremonial/leisure classes have through out history been constantly spamming everyone with whatever shit occurs to their 3 inch brains, because they can afford to buy the largest amount of attention. To bad there is not enough attention for anything anymore cause production of content is happening at volumes that dwarf Consumption of content. If 99% of comments and links on HN are not read by anyone, do you think the great geniuses who run HN will tell you that? Whats the use of such systems no one asks. They want to just keep it alive like some dumb engineers in the control room of Jurassic Park after the children are lost and the T Rex is loose. The platforms, without knowing what the fuck they are building, have made it Free for everyone to Broadcast. So its now not just the rich who are spamming and trolling. Its everyone. For free. All you get is noise. Read the UN Report on the Attention Economy. One dimensional software engineers now have capability to build and scale systems quickly. Thats the only reason we have these dumb fucking mindless systems wasting everyones time and energy.
- skrebbel 3y agoSpam filter idea: posts with bad interpunction are likely content-free angry ramblings!
- hutzlibu 3y agoYeah, but in the long run (or very soon), you might have to use grammar misstakes as a captcha, to seperate bots from humans.
- YoshiRulz 3y ago> misstakes > seperate I see what you did there. Please never implement that idea though, it would be like the opposite of https://xkcd.com/810 https://xkcd.com/810.
- hutzlibu 3y agoI am pretty sure, it is already in use. But of course it would be trivial to modify the llm output, to include random misstakes, if this ever would become a standard way of dealing with bots.
- theknocker 3y ago[dead]
- myself248 3y agoCalm down, Satan. Go back to your job writing healthcare UI/UX.
- slater 3y agowtf?
- AnthonyMouse 3y agoPresumably one of the users who has personal experience with a false positive in one of these systems.
- netmare 3y agoThey were probably referring to the random delays, form field wiping, focus-jumping and silly back-end errors which are prevalent in "healthcare UI/UX".
- AnthonyMouse 3y agoOh of course, I thought that much was implied and the confusion was why someone would have strong objections to this. The answer being that it's extremely hostile to innocent people in the event of a false positive.
- wardedVibe 3y agoAmazing, this is better than a shadow ban even.
- Simran-B 3y agoInstantly reminds me of the creative piracy protection from the early days of video games. Nice video about how Atari frustrated people with purposeful memory corruption while making it look like software bugs: https://youtu.be/ewoDLDDgHkI?si=aY29WK_lrZ4jR3bt https://youtu.be/ewoDLDDgHkI?si=aY29WK_lrZ4jR3bt
- austinl 3y agoSpam teams at social networks typically shadow-ban spammers. The goal of this is to make it as difficult as possible for the spammer to determine that they've been caught (which is why I think the frustration techniques, or simply account suspension aren't widely used). The field of spam-prevention is fascinating because it's essentially an arms race between companies deploying tactics to detect spam and sophisticated spammers using increasingly complex methods to avoid detection. So there's an advantage gained by companies if spammers believe they don't need to evolve their methods.
- paint 3y ago[dead]
- sdenton4 3y agoDepending on the context, account suspensions can be weaponized. By making someone you don't like /look/ like they are doing something dodgy, you can get them banned.
- getrealyall 3y agoLike fail2ban. Nothing quite like the anxiety of almost locking yourself out of your own system because you mistyped a password one too many times. It's a delicate balance (although, for something like SSH, I wouldn't even bother, unless the traffic is measurable enough to cause issues. But then you're getting (D)DoS'd, and you probably have bigger problems).
- willcipriano 3y agoModern spam tools I've encountered accept a second account list to be used for verification purposes for this reason. They can automatically purge shadowbanned accounts by spot checking comments for visibility.
- yjftsjthsd-h 3y agoI wondered about that - it seems like an actual spammer would have an easy time checking from other accounts, so it adds at most a minor amount of extra work, while real users who are incorrectly flagged never even think to check.
- Aerbil313 3y agoI guess, yes, seems the best way if we don’t count centralized remote attestation.
- thdc 3y agoI'm missing the part on how op determines valid users for the frustration loop. > Enter Akismet... Blocking spam on signup worked somewhat, but was easily circumventable > some spammers found ways to parade as legitimate blogs... which I would have to manually sniff out and flag. > This lead me to an idea: The Frustration Loop... When spam is detected... Waste their time and make them give up. > "Now hold up there Herman! Won't this be triggered by valid users?"... it's been running in production for the past 3 months and I've only had one user report this as an issue. imo that would be the most interesting part of the article. It's cool that the action that's being taken is to frustrate the spammer but I wished there was more info on separating spammers from real users, figuring out false positives and false negatives and the like. I understand that giving details on detection is probably not a good idea and that the article is about The Frustration Loop, though.
- kyle-rb 3y agoDoes Akismet detect spammers when they sign up? afaik its main feature is an API to detect whether a given comment is spam: https://akismet.com/developers/comment-check/ https://akismet.com/developers/comment-check/
- ncruces 3y agoMy guess? Akismet is metered, and he submits only the first few posts to lower costs. Once you have some reputation, you can post anything. So spammers noticed being blocked on account 1, created account 2 with legitimate content, and then started spamming. New process is detecting spammers on first post but instead of immediately sending them away (or throwing their content into the void), go to some length to pretend the website irreparably broken in subtle ways. The point is to waste their time before they realise they've been flagged, and have them give up.
- thdc 3y agoI assumed that the two paragraphs were connected > Enter Akismet. This is a spam detection tool by the Wordpress people and is pretty accurate and easy to use. > Blocking spam on signup worked somewhat, but was easily circumventable by spammers who are well versed in dealing with these kinds of barriers. But now that I look at Akismet's description, it sounds like Akismet does a lot more than block on signup. Perhaps they use it after signups but apply the frustration loop instead of blocks because it's less accurate there.
- alehlopeh 3y agoIf you’ve already determined the signup request to be spam, and you want the spammer to think the site is broken, just return a 500?
- Bu9818 3y agoI've seen sites like discogs do this for tor exits. You quickly realize what they're doing. Same with shadowbans, I verify by accessing the post in a clean session.
- giantg2 3y ago"Frustration Loop" It's a loop? I thought frustration is a constant state? It is for me at least.
- stevage 3y agoI think the key here is when you detect that someone is in a bad category, you shouldn't alert them to the fact you know that, because then it just becomes an arms race. Another approach might be to make it look to them like they managed to create their blog, but just quarantine the content so no one else can ever see it.
- bluetidepro 3y agoThe author mentions that they were basically already doing that by no-indexing the content. Plus, that can end up costing you more money hosting the quarantined content.
- throwaway14356 3y agoAkismet has no working appeal mechanism. What seems like 1000 years ago I got banned by it for posting comments on my own blog. (haha!) If I comment any place using it my comment are silently filtered out. I got banned by disquss too! for posting many useful links in comments on blogs by people I know. They resolved the issue in 2 days and were wonderfully polite about it. Akismet should at least clear wordpress users banned countless years ago and wp should replace it with something less well... insane. I don't mind not being able to reply on my own wp blog. It is fairly amusing actually. Ill just use some other blog engine. Its easy for me. but it seems bad for wp to refer to their users as uhh lets kill some spam??? Im not impressed.
- barryrandall 3y agoWhat I usually do for situations like this is give up on the site altogether. It takes me one click to add a domain to my uBlock list and search Google for the title. No appeals process will ever be that easy or reliable.
- cfinke 3y agoI'm an Akismet developer; the best thing to do would be to email us at support@akismet.com with your info and we can look into why your comments are getting caught.
- chefandy 3y agoSeems like this could be abused. A script wouldn't get frustrated, but it might have a handy way to test what content triggers Akismet. I presume I'm overlooking some mitigation strategy.
- ChrisMarshallNY 3y agoThe best spam protection I ever had, was a bunch of hidden text input fields on my mail contact form, with names like “blindcopy”, “bcc”, “cc”, “additional address”, etc. They all had default values. If the submitting handler detected any values in these fields that were different from the default, the submission was rejected. I don’t think I ever got a single bogus email from that form.
- mc10 3y agoI've heard this concept described as a "honeypot field" before and it works pretty well as you've said. I'm curious how password managers/autofill avoid tripping up though; are they able to detect that the field is not visible?
- pavel_lishin 3y agoPassword managers typically only fill specified fields - username & password - and leave others alone.
- mc10 3y agoMaybe I'm thinking specifically of 1Password which can store your previously-filled out form fields as well as autofill fields like address or credit card number.
- ChrisMarshallNY 3y agoIt would store the defaults, I suppose. I got the idea from a book. Can't remember which, but it may have been in the early oughties, or even last century (and the book called it "Honeypot Fields"). The nice thing was, the user didn't have any friction at all. They had a subject and message. No CAPTCHAS, no math problems. Nothing. The form was on a site with a fair bit of exposure and traffic. Another similar site used Contact Form 7 (or whatever the predecessor to it was), and we would get fairly regular spams. This was a plugin that I hand-crafted.
- 3y ago
- Dungenesst 3y ago[dead]
- killjoywashere 3y ago> somehow I don't think they read my blog But they read Hacker News....
- apodolny 3y agoWe've found that rolling our own spam model can be very effective (especially at improving precision). Many sites have their own quirks around what material counts as spam which leads to false positives or negatives wherever your site differs from the norm. No need to go to GPT4 though. We've found even low compute algorithms like random forest perform quite well at the task. You do have to create your own training set, but even a few hundreds or thousands of manually sorted examples can work pretty well.
- wahern 3y agoA pre-existing term for this is tarpit: https://en.wikipedia.org/wiki/Tarpit_(networking) https://en.wikipedia.org/wiki/Tarpit_(networking)
- deleted 3y ago[deleted]
- novok 3y agoDo you sample the content put into 'frustration' users and see if it's actually legit? Do you have a false positive / false negative rate? Have you seen your total legit signup count go down or up? You're not the only one to do this, many pages do it whenever you do a vpn, they fail in silent and annoying ways not displaying any errors or otherwise. Turn off the vpn and everything magically starts working. Etsy for a long time would return blank pages if you were on VPNs. Extremely irritating.
- quickthrower2 3y agoJust make all links nofollow? Only spammers really care about follow links. Maybe you get follow links when you upgrade to a paid plan? This doesn’t completely solve it since people pay for any kind of link but it might reduce it.
- everfree 3y agoIf all blog hosts make all links nofollow, nofollow will cease to be a meaningful signal and search engines will start ignoring it.
- new_here 3y agoA.K.A Hellbanning. You either die an MVP or live long enough to build content moderation: https://news.ycombinator.com/item?id=28684250 https://news.ycombinator.com/item?id=28684250 Congrats on the milestone!
- calcsam 3y agoSimpler than implementing heavenbanning. Well done.
- edg5000 3y agoHow about disabling robot crawling on all blogs by default (and adding nofollow, as you mentioned). Then, manual moderation will allow people to earn to have their blog allowed for crawlers. To make this clear to users, when posting content, the following is displayed: "Note: This content will not be indexed by search engines unless it has passed our manual review process."
- pqwEfkvjs 3y agoWhat's the false positive rate i.e the percentage of legit user getting stuck in the loop?
- boneitis 3y agoTHANK you.
- deleted 3y ago[deleted]
- markx2 3y agoI worked inside Akismet for some 6+ years. Akismet is very good at detecting comment spam. If it were any good at detecting signup spam then wordpress.com would not have so many spam blogs. I also would track down spam blogs there. Sometimes manually through search engines and a curated list of known terms and sometimes with tools that one of the devs created for me. I suspended thousands of genuine spam blogs. Sometims mistakes were made but they were rare. Then, although some automated tools were created to try and stem the tide, that hunting and suspending was deemed not to be a priority. It was important at the start that wordpress.com was seen to be clean so it could grow but once deemed big enough, it was stopped. While I know I was using a supersoaker to put out a burning car it didn't take long and I found it satisfying This time of year I'd be hunting hunting Halloween spam blogs and would start to see Christmas spam blogs too.
- laserbeam 3y agoI see people claiming that spam detection is creativity warfare between spammers and spam detectors. That may be true if you're Akismet, but when you're a website that provides a place where spammers may gather that is no longer the case. It's a race between your blog/website and other blogs/websites. If you're better protected than your neighbor, the spammers will go and haunt your neighbor instead. Especially when it comes to protecting against click farms, not against bots. As the joke goes, you don't have to outrun the bear in a forest, you have to not be the slowest in your group.
- Nevermark 3y agoI came up with a simple way to eliminate spam in my email, without any third party filtering. I have my own domain name for email. My email box accepts anything that goes the domain. I.e. a catchall email account. However, I give a different email address to every site and service. I.e. sitea@mydomain.com, site2@mydomain.com This lets my email reliably get auto sorted by who its from. But I also use a consistent form to the names I hand out, so that random email that comes to my domain gets deleted instantly and I never see it. I almost never get spam. But sometimes some service leaks my email somehow and I start getting some. So I change my email with that service (or cancel it) and add that email to a manual list of incoming addresses to block. It's so dead simple, I feel like all email programs should have the option of working with a whole domain this way.
- tofurocks 3y agoYou can do something similar with Gmail - if your email is matt@gmail.com you can receive to Matt+1@gmail.com, matt+2 etc. Although some websites reject this format.
- philihp 3y agoI've never understood the appeal of guestbooks and commenting on Wordpress. Static HTML is a wonderful medium for getting your message out, do we need the validation of visitors commenting?
- illwrks 3y agoI think.... just like reality, some people love the attention feedback loop. They are hardwired for it.
- pjc50 3y agoNobody like talking into a void. Audience feedback is necessary for most people to bother continuing to do it.
- dgb23 3y agoPerhaps there are better methods for that, like email. Another one is to require a paid subscription to comment. It’s a filter for low effort spam.
- rchaud 3y agoEmailing comments is possible even with a comment system, assuming the site owner discloses it. But it is invisible to others, as most blogs are not going to curate emails into a "Letter to the Editor" section of the website. Substack is an email newsletter platform and even that has a comment system.
- ricardobeat 3y agoThe internet used to be a place to interact with other humans. Would you rather send your content “into the void”? Who are you publishing for?
- onysamawa 3y ago[dead]
- jstanley 3y ago> In my tests I haven't managed to trigger it without explicitly performing a dodgy action. But that just means it doesn't flag you. What is a "dodgy action"? Other people might do things that you think are dodgy, without any malicious intent at all. A common one: if I sign up using Tor, is that dodgy? It is very frustrating to get caught in these frustration loops.
- survivorBias 3y agoImagine beeing a user accidentally caught up in this hell.
- deleted 3y ago[deleted]
- agent327 3y agoInstagram has a frustration loop. I know that, because it is triggered on my account: for every action I take, no matter how minor, it makes me log in again. Every link I click, everything I do, I get to make a detour through the login screen. It started with "suspicious activity detected on your account", followed by "your account has been disabled", and while it won't state the actual reason for this, the only realistic reason listed in their official rules would be that I posted something that offended someone. There is one problem with this explanation though: I never posted _anything_. I follow a few people, that's all I do on instagram. So I filled in codes, sent them photos of myself, and eventually received access to the account again - but now it makes me log in again for absolutely everything I do. I can't believe they would do this by accident, or that it would be a bug. Clearly they identified me as a miscreant, and while they couldn't get enough evidence for an execution, they can sure as hell punish me for whatever misdeeds they imagine I committed. I suspect what caused the problem was that occasionally you come across links to pictures on instagram. Apparently following those is suspicious enough that it warrants triggering a frustration-experience. Of course, being part of Meta also means that if they decide to shut down my instagram for good, I'll also lose access to my Facebook account, which I use to communicate with a few faraway friends. Of course the world moved on from Facebook, and everybody is now on Instagram. I suppose I would be as well - if only it let me...
- tornato7 3y agoSounds like they have identified you as a crawler / scraper and don't want another Cambridge analytics incident.
- agent327 3y agoCould be, but I'm an extremely minimal user. Surely volume counts for such a thing? I check the site once or twice a week, and look at some holiday pics of friends for a few minutes, for crying out loud...