Counter point (that I'm not sure I believe in): if your behavior is so similar to that of a bot, maybe Twitter would prefer you not on their platform.

(Assuming Twitter was actually incentivized to be anti-bot/bot-like behavior.)

Maybe they don't need to ban accounts, but instead put up a "bot check", sort of like their new editorial process? Something along the lines of "This account has been identified as likely being a bot. Read more." To remedy a false positive, the human could provide Twitter with a an official ID to remove the warning.

Then you get hate from the hn crowd about how they're violating everyone's privacy by deanonymizing them

Worse, Twitter can't be trusted to keep the IDs safe. They've suffered many data breaches in the past.

And it wouldn't even stop the bots, because Twitter isn't limited to Americans, so bot makers could easily send fake official IDs from someplace Twitter can't check. Or send stolen offical IDs from other data breaches.

I bet there are some ThisIDDoesNotExist websites that bots use to autogenerate vast majority of fake ids, probably by using ThisPersonDoesNotExist website.

You can generate realistc photos of IDs from countries that Twitter cannot positively verify those bc in USA there are ways to check authentity of your document. But IDs from Russia or Ukraine - no way.

> To remedy a false positive, the human could provide Twitter with a an official ID to remove the warning.

That would work only against casual bots. The big nation-sponsored botnets won't have issues with providing genuine government issued identities for bots. Which kind of defeats the whole purpose and wastes a lot of resources twitter would like to use elsewhere.

They already do that. Fun fact, I was never able to make and use a twitter account even after verifying it with my phone and email. Apparently I was a bot from the start, before even posting anything.

It's twitter, not people's healthcare.

Just put in a super basic unlock process that is costly to game for "non-real" people

> Just put in a super basic arbitration process that is costly to game for "non-real" people

I think your "just" is hand-waving away a lot of complexity. A person deployed these bots, and if a bot account gets put into an arbitration process, that person can go through the process themselves to pass the arbitration, then set the bot running again.

> that person can go through the process themselves to pass the arbitration, then set the bot running again.

That is not scalable, which is exactly the point.

It's far more scalable than the arbitration process itself. Arbitration will never win such an arms race.

All this bot stuff/millions of fake accounts amazes me.

Whenever I sign up at Twitter (entirely because some companies do support there) the account is flagged within a few minutes for "suspicious activity", such as making a coffee and coming back to the PC or searching for the company I want to contact.

Possibly because of your IP? Any ideas why that is happening?

I suspect it's because I don't give a phone number. I have no idea why they allow signups without a number though, if that's the case.

Allowing signups without phone numbers serves as a honeypot.

Well, you can put catchas in case you doubt there is a bot activity.

They also have so many phone number and email they can use that to do additional checks.

They you can use the network effect: bots usually have something in commons: topics, likes, ip, followers...

If you have millions at your disposal, something can be done.

They are not, so I'm more encline to assume there is benefit for them to avoid doing so.

Would it take millions?

At twitter scale, doing anything is costly.

I actually am trending towards the view that once a social network reaches a certain size, all users must register their real identities with the network owner to maintain their accounts.

This information would not need to be stored, it would just be needed to verify an account as belonging to a real person.

Once you add things like clickstream, email, ip address and user agent to the data used, it should be very easy to pick set with negligible false positives.

And you assume a company as big as Twitter doesn’t do all that because...?

There are a lot of statistics that can be analysed to indicate a bot. If you start with extreme cases and catch 'real' people it might be for the best.

Think about an account that is active 24/7 every day all year, or one that fires off multiple actions per second for long periods of time.

Beyond that, having a limited vocabulary, repetitive phrases, consistently accessing the same thing every few minutes, etc. are all low hanging fruit.

What are the technical hurdles to these bots? Is API access required?

No bots could use webpages or apps just like people

Many, many “bots” are just people paid to tweet

That's not a problem. If a person is indistinguishable from a bad/rogue/misbehaving bot, it's much better for everyone to ban them.

You’d ban half of Twitter. It’s pretty much impossible to differentiate an actual “person typing like a bot” from a legitimate user that, say, likes to tweet memes a lot. People that think this is an easy problem just don’t have the slightest idea of what it entails.

My point is it's an easy problem once you decide that you don't care about false positives, ie temporarily banning "legitimate" users whose behaviour is indistinguishable from that of bots.

Arguably, those "legitimate" users don't bring anything of value to the platform or society as a whole and should rightfully be shunned.

Most online forums or chats have automated rules whereby posting too fast or too often will get you slowed down or banned. Sometimes legitimate users get caught by the filters, no big deal. Twitter could make their existing rules much more stringent.

Sacrificing a few genuine accounts to save the sanity of millions and protect democracy is not much of an issue. The question is how does one revive such accounts without too much hassle while not reviving bots.

Easy: solve 5 captchas (all known captchas of course, not 2 knowns and 3 unknowns) a day for 2 days and you get authorized again. Next violation, solve 5 captchas per day for a week. Next one, 5 per day for a month.

That could work indeed. Annoying but necessary. Tho what does one do about real bots - people in spam farms that would manually login, post and logout.