4 ms·

For anyone like me, unable to figure out how to do that - you click Reply, and then there's a 'flag' link.

by paranoidrobot 2y ago

consp 2y ago
Or click the timestamp.
- anigbrowl 2y ago
  All these approaches increase server load. You're likely not the only one doing so, so the server has to respond to a read and flag request for every person. I'm not sure how many flags it takes to kill a post, something like 6 iirc. When you multiply that by the number of spam posts it adds up to a lot. I'm honestly perplexed that HN doesn't have any kind of string filtering facility considering its centrality in the tech ecosystem.
  - fragmede 2y ago
    it's never needed it before, and it's not being run by a huge team. it's hard to make time to prepare for a thing that hasn't happened before when you're busy dealing with everything else.
    - anigbrowl 2y ago
      This isn't the first spam/DDOS attack on HN, although it's one of the more severe. This is basic stuff for any kind of user-driven forum, going back to the BBS days. You are going to have periodic problems with trolls and spammers so you need to have some sort of mitigation process in place. That doesn't need to be some sort of top-heavy new technology, it can be as simple as the ability to add a few new scripting rules or wildcard matches on a few minutes notice, or hit the pause button on new account creation.
Bilal_io 2y ago
I tried at first. It's a losing game against this number of spammy comments. The temporary solution is to shadow ban the comments, the usernames seems to follow 2 naming schemas. Banning them completely will alert the attacker to change the naming schema, or to make it more random, which will make stopping them even more difficult.
- anigbrowl 2y ago
  For a bot-based DDOS attack it's easier to to do blanket shutdowns then it is for the attacker to whip up new randomization code. If it gets really bad just shutting down new account creation for 24 hours or making a timelag beween creation and posting is effective.

For anyone like me, unable to figure out how to do that - you click Reply, and then there's a 'flag' link.

consp 2y ago

Or click the timestamp.

anigbrowl 2y ago
All these approaches increase server load. You're likely not the only one doing so, so the server has to respond to a read and flag request for every person. I'm not sure how many flags it takes to kill a post, something like 6 iirc. When you multiply that by the number of spam posts it adds up to a lot. I'm honestly perplexed that HN doesn't have any kind of string filtering facility considering its centrality in the tech ecosystem.
- fragmede 2y ago
  it's never needed it before, and it's not being run by a huge team. it's hard to make time to prepare for a thing that hasn't happened before when you're busy dealing with everything else.
  - anigbrowl 2y ago
    This isn't the first spam/DDOS attack on HN, although it's one of the more severe. This is basic stuff for any kind of user-driven forum, going back to the BBS days. You are going to have periodic problems with trolls and spammers so you need to have some sort of mitigation process in place. That doesn't need to be some sort of top-heavy new technology, it can be as simple as the ability to add a few new scripting rules or wildcard matches on a few minutes notice, or hit the pause button on new account creation.

Bilal_io 2y ago

I tried at first. It's a losing game against this number of spammy comments. The temporary solution is to shadow ban the comments, the usernames seems to follow 2 naming schemas. Banning them completely will alert the attacker to change the naming schema, or to make it more random, which will make stopping them even more difficult.

anigbrowl 2y ago
For a bot-based DDOS attack it's easier to to do blanket shutdowns then it is for the attacker to whip up new randomization code. If it gets really bad just shutting down new account creation for 24 hours or making a timelag beween creation and posting is effective.