Ask Slashdot: Using a Sandbox To Deal With Spambots? 167
shellster_dude writes "Slashdot is certainly no stranger to the problem of spam bots. While blocking a spam bot may seem like the best solution, it is likely that the spammer will simply re-register with a different name. While trying to solve this dilemma on my own forums, I had an epiphany. What if, instead of blocking a spam bot, I could mark a spammer, and then hide all their comments from everyone else? The spammer could continue to go their merry way, spamming to their heart's content. When they visit the forum, they see their spam comments correctly placed in the threads, but their comments would only be visible to them. Thus, an effective sandbox which would prevent them from registering a new user once they had been 'blocked.' Are any other Slashdotters familiar with this technique? Does any software currently use this technique?"
Well, it would be easily detectable (Score:4, Interesting)
It would certainly prevent spam temporarily but
a) the spammer would notice rather quickly if their spam doesn't show up in Google
b) the spammer could easily defeat the system by simply re-registering with another username
c) one mistake on implementing the system (eg. allowing users to read 'sandboxed' comments through a link) could maybe hide it from your users but not from the other bots that crawl your site (again Google and security bots) which would then mark your site as spam.
The problem is that spamming is usually automated so you have to have the end-user jump through hoops in order to defeat them. One of the forums I moderate actually requires a legitimate introduction on the topic of the forum before they are allowed to post in the general forums. Defeats most spammers as it's somewhat of a niche forum and automated spam is immediately recognized and user/ip banned.
Re:Shadow Ban (Score:4, Interesting)
I believe miserable users is a different trick or at least it is on Vbulletin. Miserable users adds a lengthy delay to all of the user's actions, kicks them to error pages, etc.
Nice functionality, or it would be if it didn't do unfortunate things to server load on 3.x.
Re:Old Idea (Score:5, Interesting)
I wouldn't say it "doesn't work." I experienced this shadow banning after I mentioned I not only own a Hybrid electric car, but also a diesel car that gets similar mileage (49MPG). Well the environmentalists furiously attacked me for daring to use the word "diesel" in their forum, and the group owner (also anti-diesel) made my posts invisible.
It took me a few weeks to realize that none of my posts were being responded too. Rather than waste time with another account, I just left the place. So the shadow-ban worked.
Re:I will sell you this solution already debugged! (Score:5, Interesting)
Because it will be trivial for a spammer to check his posts from another account?
I remember reading an article on Joel on Software some time ago that talks about this kind of approach. The difference was that instead of only showing those posts to the spammer/troll's account, they were also shown to that poster's /8 or /16 subnet (or something like that). This goes far in solving the problem for multiple accounts (but still fails for proxy servers).
The downside is that the troll's "local Internet" sees the spam/troll, but the greater Internet doesn't. It always seemed like a good tradeoff to me.
Wish I could find the article now, but not having any luck.
Re:I will sell you this solution already debugged! (Score:5, Interesting)
Easy solution. Make it so that spammers can see posts by everyone, including other spammers. That way spammers will think they are being successful, especially if you do an IP block on them.
Until the 2nd, 3rd, 4th account is identified and marked as a spam account, it won't be able to see the posts of the 1st account.
I think you overestimate spammers. 99.9999999% of them aren't people, they're bots. I doubt they're even checking from other accounts.