Reddit's response seems to be to take away the cheese in order to make the site less appealing to the rats. Its one strategy.

So far I've found that making it seem to the bad actors that nothing has changed is most effective at keeping them from getting worse. The first time we tried returning a straight error code for a robot search we got to see how fast a robot could send requests (pretty damn fast!) but we can send them the same 10 bogus serps again and again and again and they will chew their robot cud all day.

Right. The quality of feedback information is one of the biggest factors in development cost. The bugs you can't reliably recreate are the biggest problems, sometimes by one or two orders of magnitude.

This should be used as a weapon in the security battle. Seems like not enough people use it.

In all likelihood, the scam initiator is not the same person as the scam implementor, so "making it seem to the bad actors that nothing has changed" is likely to inflate their costs tenfold. This also works when the scam is entirely the work of one person, but it's especially effective when multiple parties are involved.

    Seems like not enough people use it.

Relevant Coding Horror http://www.codinghorror.com/blog/2011/06/suspension-ban-or-h...

I hope it's the case.

Do you guys know of any other techniques that waste the malicious actor's time making it think everything is a-okay?

This usually fails because someone isn't strong enough to not respond. Or someone engages because it's a fun conversation for them. Examples of this on HN are some of the political discussions (eg Palestine) where people really should just flag and ignore but often people engage.

Reddit does do this, through shadowbans. Apparently, they felt that they weren't effective enough in discouraging antisocial behaviour.

Does anyone know if reddit has tried extending silent bans to domains?

I then talked to the moderators about it and they said that my link submission history contained multiple items from my blog, so the automatic spam filtering kicked-in, with my domain being blacklisted. Because the submission was good and ontopic, one moderator proceeded to whitelist my domain again.

I don't know if the key for this silent ban was just the domain name or the combination of (username, domain name), but it was a silent ban.

Now we do sell API access to our index, but not for stuff like this.

When I was at Google there is a new hire class that talks a bit about security and 'bad' queries. There is an admonishment in the class notes to 'not' experiment with those queries unless you were a member of SecOps. They claimed they would notice, and they would track you down.

So to answer the meta question, all search engines have this problem. I know this is true because of the new hire class at Google (largest search engine) and because we (Blekko) offer our index through API access to a number of smaller brands you may have tried and by doing that we see what they see in terms of search queries.

Generally there is someone in an operations role at those partners with whom I can share notes and pass along the latest fashion in terms of scams.

Criminals attempt to exploit that, using search engine results to figure out likely targets.

There are also people who try to exploit keyword searches and the advertisers who buy advertisements on them but that is less obviously criminal.

I know that big telcos have internal security goups and British Telecoms had/has a ferocious rep.

BT got even stricter after some one got a temp job and looked up the x diretory numbers for one of the Queens residences.

After that they started doing posative vetting for team leads on major projects - that is the equivelent of TS clearance in the USA

http://news.ycombinator.com/item?id=4074345

-- and --

http://news.ycombinator.com/item?id=4074230

These point, respectively, to the following url's. Notice the slight url difference in what is actually the same article.

http://www.theatlantic.com/business/archive/2012/06/what-cou...

http://www.theatlantic.com/business/archive/2012/06/what-cou...

www.theatlantic.com/business/archive/2012/06/this-part-actually-does-not-matter/258139/

Feel free to change the next-to-last part to whatever you like.

  http://www.amazon.com/Cryptonomicon-ebook/dp/B000FC11A6/

  http://www.amazon.com/Snow-Crash/dp/B000FC11A6/

The Atlantic is in the content business, and in case you hadn't heard, that space is having its lunch eaten. It's part of the job to produce content and figure out how to have it read. That involves playing around with things.

I don't really find it reprehensible that people write and then promote their own content, whether that's music, movies or the written word. What else should be done? Establish centralized "distribution" centres? Wait a minute...

Submitting your own articles once to a place like HN or reddit is pretty shady in the first place; since that's not the intent of these sites. The intent of these sites is sharing stuff you found, not stuff you created.

Submitting your own article twice is just a dick move.

I just disagree. These sites operate pretty well as martkets. If your stuff sucks, I likely won't stumble on it.

>"since that's not the intent of these sites"

Ironic, since we have a "Show HN" topic here, the sole purpose of which is to do what you're saying shouldn't be done.

>"The intent of these sites is sharing stuff you found, not stuff you created."

I want to read good content; I don't care who submits it. I'd rather risk people submitting their own crap sometimes than never getting a chance to read something good that nobody "found".

Spamming is one thing, and obnoxious. But I find it a tad hypocritical to accept A/B testing colours on a button to squeeze another buck from someone, but reject someone A/B testing content to find out what combination of words in the title creates the most page views. It's the same business.

Oh come on. It's clearly not the changing of the URL in and of itself that I was objecting to. It's the doing it for the express purpose of submitting it twice to a site which has a filter set up in order to prevent that behavior.

I can't believe you didn't understand that from the get go, so I can only conclude that you are being deliberately obtuse which is annoying.

Even if you remember to implement a canonical tag pointing to the "real" page, you risk people linking to these dummy pages (producing a minor loss of link value according to Cutts) or weird mangled versions coming into existence (think escaped referrer logs that make their way public and crawlers find, etc), and then bots have to take the time to request incorrect URL's and find out they're junk. Better to return a 404 or 301 to the correct page (if you know what it should be).

See, this is actually the kind of sh*t that SEO is about: usability for bots.

If you're going to have slug-type Urls, they should at least be unique, and if they do change, the old version should at least show a canonical link and/or 301 to the new one.

Usually this means keeping a record of every variation the Url has ever been for a piece of unique content.

I can understand spammers, kind of and even trolls in their own logic. But karma whores, in my understanding WANT to belong. So such a move would be quite, well, stupid.

I think I'd be a bit more worried if someone posted a variety of link-baity slugs to the same story.

The rest, I agree! Pando and TechCrunch in particular.

Don't hold your breath, though. Banning those sites would do a disservice to YC's portfolio; one of the tangible benefits of being in YC is easier access to the trade press. I really don't expect to see 'pg do anything to alienate anybody who could potentially write a useful story about a YC company.

(I'm fine with that as a cost of "not having to run a site like HN myself".)

But banning what one could call mainstream media from HN wouldn't do it favour. My impression is that I'm no the only non-hacker around here, so not strictly tech issues have their justification as far as I'm concerened. And if some content shows up that just doesn't fit, well simply don't vote for it or simply flag it. I for my part don't care who submitted a certain article or from which source as long as it's a good read or a good discussions. Perfect if it's both. Just my 5 cents.

Disclaimer: Not working for any of the above mentioned news outlets, and I don't even have a wired subscription. :-)

They really clog up the science subreddits with wildly hyperbolic titles that get debunked in the first comment.

Isn't the whole point that people can submit what they find of interest and what they believe will interest others? All it takes to "ban" them is to not vote them up.

http://www.reddit.com/r/TheoryOfReddit/comments/v03qc/physor...

They would have to be barking mad to think they would benefit from trying to control the site in favor of Advance.

https://gist.github.com/461a1a7ab5cc82df02d5

I don't personally think it's a bad thing to submit one's own stuff (who doesn't like DanielBMarkham's agile posts or Jeff Barr's AWS stuff?); I just like to keep lists.

What if I want to submit one of my own links one day--will I wind up on your list? And if someone out the loop happens to stumble upon your list, will they think that I am a self-promoting spammer due to my inclusion?

You should probably change this list a little. Adding a comment or two about its purpose would be welcome, and including statistics such as submission ratios by each username would be nice and help to avoid such confusion I have mentioned.

Finally, how does someone get 'off' your list?

How do you define "regular" and "sometimes"? At what point do you decide someone is "participating"?

If someone submits, say, 10 links to other (presumably interesting) sites for every 1 link to his own site, is that kosher? What if it's 4:1? 1:1?

How interesting do the other sites need to be? At one extreme is neat stuff that everyone likes and makes it to the home page (which benefits the "my own stuff" not at all, but certainly helps with karma). At the other is junk thrown in as filler to make that 10:1 ratio.

These are not idle questions. Especially when I think everyone in the HN community is aware of journalists' and bloggers' need to attract attention to their articles (which they, at least, believe are relevant). The question is how one can be an accepted member of the community _and_ also let people know what he created.

I'm not sure what the solution is, but I think innovation on this front could help to preserve and enhance HN's vibrancy.

When you are hellbanned on HN, here is what happens: nothing. And for sure you are not informed about this in any sort of way: no popup, no messages, nothing. You think everything is normal and you still can write comments, but they appear only to you, which is confusing because you assume others can see them too. You can upvote (and as usual arrow disappears) but your vote does not count. Another thing is that you are being thrown at some sort of non-cached, low-priority server that is as slow as hell. It then takes about 10-15 seconds to open any comments' page (this is confirmed by me, because once I got my account resurrected, everything start working as fast as my internet goes, same moment with no changes on my end). Another thing noticed: after your account is resurrected, your score can go up/down like before, but average score does not change (mine stays .65 for a while now). During dead period I wrote some long and, in my opinion, interesting comments, that were not displayed (especially spent some time on this one: http://news.ycombinator.com/item?id=4068798 ). A nice fellow from England noticed how silly I am for keep participating in HN community but really being a ghost. I emailed info@ couple times and told them I barely get massive downvotes and my karma stay positive for a long period of time. I don't spam or troll. Nothing happened. After couple days I start emailing PG and about 12 hours later got email from someone else apologizing about being killed and my account got resurrected.

I hope that PG/HN/team will add some features so that someone killed can know about it.

edit: sorry didnt answer: as of HN, no, the system is not that hellish. Score does not go up just for you (so you would assume everything is fine).

Every once in a while, right click the link to one of your comments and "open link in incognito window".

Adding features that tell you you're hellbanned defeats the purpose of hellbanning people.

If I would get some sort of warning of what I am doing wrong, I may be given a chance to learn. Isn't that the purpose behind coming to HN? To learn?

Hellbans are only intended for spam accounts and trolls, neither of which is going to change their behavior. Sometimes people that aren't spammers or trolls get hellbanned, but that's an unfortunate side-effect of imperfect algorithms and moderators, not intentional.

Reddit uses an "upvote fuzzing" algorithm. All up votes you see anywhere on reddit are approximations influenced by the shadowban system. Only after a story has become old and locked, do the upvote totals truly stabalize to their actual levels.

The stories position on the site is based on the actual numbers. The numbers next to the story are just approximate though, to help fool banned accounts.

This is why things like Reddit Enhancement Suite that show upvote/downvote totals for comments are largely incorrect, and nothing more than a novelty.

Disclaimer: I have no idea how effective the user banning methods are, but I assume they can be outsmarted more than domain ban.

Not that it banning domains is ideal, but effective implementation is often more important.

One of the worst examples of that is the so-called Global Fund to fight AIDS etc - actually burring any critics on a scandal where billions of your tax payers' money earmarked for development aid disappeared with some of the worst criminals on this planet - and dozens of millions continue to die from that.

There is no perfect world with social networks - you have to take everything happening there with a "grain of salt"

This type of action would merit some type of direct contact with the individuals or company who run the domain.

http://www.reddit.com/r/TheoryOfReddit/comments/v03qc/physor...