Also one account where I can see all the comments I've left on the various sites with their replies. And if I feel like it, I can easily remove old comments - even after my nickname and/or email changed, I've deleted all my cookies and/or got a whole new system. I just need to be able to log into my Disqus account. And the site I'm commenting on doesn't know my email address.

You could use a closed source spam protection API from an open source project. Best of both worlds. Oh that is actually what Wordpress does with Akismet

Yep There are privacy-friendly alternatives like OOPSpam API you could integrate to any comment systems.

Nice self promotion w/o any disclaimer

Could you (or anyone) give some insight into what spam protection really entails?

Talk about a useful open source chunk of software.

Abuse is an arms race, so I'm not certain it can entirely be "open source". Someone has to man the servers to adapt as the assault develops. There can be tools that are open source, but without a foundation that is running services, it's just a bunch of dead end code.

Absolutely. I agree the key is less code than rapidly updated data. Source networks, browser headers, client behavior, target links, content markers. Spammers may be awful, but some of them aren't stupid. IF they discover something isn't working, then they'll change up their approach. And it can't be an open service, because you're just helping the smart ones to hide better.

The main thing is training a model. Every time you mark something as spam or off topic, it trains a model so that it can identify similar things in the future. You can train your own model, but it will work better with a lot of data.

Open sourcing it would be hard, because you'd have to trust everyone else to classify things correctly, or you'd have to review every input yourself. A spammer could easily sneak in a lot of false positives or false negatives to throw the entire model off.

Why is spam score always weighted as a single outcome and never as a population-based result? I mean, you’re processing more data, I get it, but it feels like that would be a model much more resilient to tampering, bad actors, and just different social norms.

For example, if one set of users started rating a specific subset of posts as spam, then those users could be bucketed together into a “doesn’t want to see message type A” group while others, who minded other messages, would be bucketed into a “No B-messages” group.

This would need to be applied selectively, as it could easily result in an echo chamber for normal discourse, but I would’ve given my left arm to have that sort of filtering available in the game during my WoW days. Those city spammers were unbearable!

I, of course, would have fallen into the “I don’t care how great a deal your Thunderfury, Blessed Blade of the Windseeker, is, I’m just here to socialize” bucket.

> Open sourcing it would be hard, because you'd have to trust everyone else to classify things correctly, or you'd have to review every input yourself.

There's not a way you could choose which people/groups you trust (and don't) to classify spam correctly? Don't open source adblockers work like this?

Don't they use some reasonably reviewable methods, like regular expressions? And, more importantly, reviewable volumes? Also, an ad blocker can always have a debug mode, where it can show you a rule that removed the element.

With ad blocking you have none of that. Gigabytes of text go into training, kilobytes of inscrutable numbers go out. And all the debug info you get is how certain the computer sounded saying no.

Disqus has passable spam and toxicity detection (the latter via a third party) but many sites don't bother to make use of it. As a result a great many disqus comment sections are absolute cesspools of spam, bigotry, and threats of violence.

I can imagine implementing reCAPTCHA can prevent a lot of spam.

Sadly not anymore. There are click farms in third world countries that will solve 10 captchas for a penny. Not to mention how many people will just not leave a comment if presented with a captcha.

It's not that sad tbh, as a legitimate user I'm sick and tired of proving I'm not a robot 20 times a day. I'd love for recaptcha to become irrelevant.

I see, I was thinking about reCAPTCHA v3, working invisible in the background.

reCAPTCHA v3 just gives you a score, and you have to decide what to do with it. This means that you should never under any circumstances use reCAPTCHA v3 as a gate with no alternative—otherwise you will certainly be preventing real users from using the system with no recourse, which will regularly have at least theoretically dire legal consequences.

Also, I get the impression that reCAPTCHA v3 is waaaaay less smart than people think. At a small scale, it’s near trivial to tweak your browser so it’ll give scores at opposite ends of the spectrum.

reCAPTCHA is an accessibility and privacy nightmare.

There are better alternatives like OOPSpam API that gives a score and works in the backend so no interaction with the user.

ReCAPTCHA v3 gives a score and works in the background too.

That is not entirely true. If your threshold is low then it appears and you get accessibility issue. Not to mention tracking hell of out the users.

You’re confusing multiple badly named products by Google. You’re thinking of Invisible reCAPTCHA rather than reCAPTCHA v3.

reCAPTCHA v2 is the “I’m not a robot” checkbox widget followed by challenges if Google doesn’t like you.

Invisible reCAPTCHA is reCAPTCHA v2 but the site initiates verification instead of the user being given an “I’m not a robot” checkbox widget to click; but if Google doesn’t like you, it’ll still trap you in the purgatory¹ of puzzle solving. Site operators can then blame Google, for all the good that does. “Invisible reCAPTCHA” is a bad name for the product, because it’s not invisible.

reCAPTCHA v3 never presents a challenge for you to solve, but decides a score (in practice, I’ve only seen 0.1, 0.3, 0.7 and 0.9) where higher means Google’s feeling more friendly towards you, and it’s up to the site operator to decide what to do with that score—whether to simply deny access to people that Google doesn’t like (catastrophically bad and widely illegal, as it blocks legitimate users with no recourse) or to do something else. But now the liability for blocking real people is clearly with the site operator and not Google. But of course far too many people will ignore Google’s “don’t gate on this alone” direction and just see the higher version number and assume it must be better than reCAPTCHA v2. “reCAPTCHA v3” is a bad name for the product because it’s not a CAPTCHA, as there’s no challenge; it’s straight fraud detection.

—

¹ Some hold it’s hell, rather than purgatory.

such a mess.

As @j3th9n mentioned, reCAPTCHA v3 does have challenge and you can invoke it based on a score.

https://developers.google.com/recaptcha/docs/v3#programmatic...

They shouldn’t have called it a “challenge” there. It’s not a challenge; it’s just executing the verification function. Chalk up another one for harmfully incorrect terminology. (Admittedly “verification” is also an overloaded term, as it gives you a token which your backend subsequently needs to verify.)

(As they confirm near the start of the document, “reCAPTCHA v3 will never interrupt your users, so you can run it whenever you like without affecting conversion.”)

It doesn't appear automatically, it's programmable [1], you as a developer decide what to do with a low score, you could ask for extra verification for example. I agree with the tracking and privacy issues with ReCAPTCHA.

[1] https://developers.google.com/recaptcha/docs/v3#programmatic...

Thanks for the link. I didn't know the developer could prevent reCAPTCHA from appearing.

Not to rely on it, but I've implemented ReCAPTCHA v3 on a couple of websites and got under the impression spambots are detecting and skipping websites who have implemented it altogether.

Unsurprisingly, there are services for that now that provide a guaranteed minimum score.