this post was submitted on 24 Jun 2023
117 points (95.3% liked)

Lemmy

13486 readers
79 users here now

Everything about Lemmy; bugs, gripes, praises, and advocacy.

For discussion about the lemmy.ml instance, go to !meta@lemmy.ml.

founded 5 years ago
MODERATORS
nutomic@lemmy.ml
117
Proof that bots are manipulating content (lemmyonline.com)
submitted 2 years ago* (last edited 2 years ago) by xtremeownage@lemmyonline.com to c/lemmy@lemmy.ml
81 comments fedilink hide all child comments
 

See THIS POST

Notice- the 2,000 upvotes?

https://gist.github.com/XtremeOwnageDotCom/19422927a5225228c53517652847a76b

It's mostly bot traffic.

Important Note

The OP of that post did admit, to purposely using bots for that demonstration.

I am not making this post, specifically for that post. Rather- we need to collectively organize, and find a method.

Defederation is a nuke from orbit approach, which WILL cause more harm then good, over the long run.

Having admins proactively monitor their content and communities helps- as does enabling new user approvals, captchas, email verification, etc. But, this does not solve the problem.

The REAL problem

But, the real problem- The fediverse is so open, there is NOTHING stopping dedicated bot owners and spammers from...

  1. Creating new instances for hosting bots, and then federating with other servers. (Everything can be fully automated to completely spin up a new instance, in UNDER 15 seconds)
  2. Hiring kids in africa and india to create accounts for 2 cents an hour. NEWS POST 1 POST TWO
  3. Lemmy is EXTREMELY trusting. For example, go look at the stats for my instance online.... (lemmyonline.com) I can assure you, I don't have 30k users and 1.2 million comments.
  4. There is no built-in "real-time" methods for admins via the UI to identify suspicious activity from their users, I am only able to fetch this data directly from the database. I don't think it is even exposed through the rest api.

What can happen if we don't identify a solution.

We know meta wants to infiltrate the fediverse. We know reddits wants the fediverse to fail.

If, a single user, with limited technical resources can manipulate that content, as was proven above-

What is going to happen when big-corpo wants to swing their fist around?

Edits

  1. Removed most of the images containing instances. Some of those issues have already been taken care of. As well, I don't want to distract from the ACTUAL problem.
  2. Cleaned up post.
top 50 comments
sorted by: hot top controversial new old
[–] tugg@lemmyverse.org 23 points 2 years ago* (last edited 2 years ago) (3 children)

I dont have much to add other than I am an experienced admin and was dismayed at how vulnerable Lemmy is. Having an option to have open registrations with no checks is not great. No serious platform would allow that.

I dont know of a bulletproof way to weed put the bad actors, but a voting system that Lemmy can leverage, with a minimum reputation in order to stay federated might work. This would require some changes that I'm not sure the devs can or would make. Without any protection in place, people will get frustrated and abandon Lemmy. I would.

[–] Martineski@lemmy.fmhy.ml 5 points 2 years ago* (last edited 2 years ago)

When I made a post saying that 90% (now ~95%) of accounts on lemmy are bots the amount of people saying that there's no proof and/or saying to me that there's a lot of people joining from reddit right now was astonishing.

Edit: one person said me that noone would make 1.6mln bots when there are only 150k-200k users on the platform, like WTF.

[–] bren42069@thelemmy.club 2 points 2 years ago

that's a problem with democracy itself as a concept

load more comments (1 replies)
[–] xtremeownage@lemmyonline.com 22 points 2 years ago* (last edited 2 years ago) (2 children)
What, corrective courses of action shall we seek?

(Tagging large instance owners)

I sent messages to these users, notifying them to come to this thread.
  1. https://startrek.website/u/ValueSubtracted (startek.website)

They were able to get back with me- and provided this comment:

Thank you - we increased our security and attempted to purge our bots three days ago - if further suspicious activity is detected, we want to hear about it.

  1. https://oceanbreeze.earth/u/windocean (oceanbreeze.earth)
  2. https://normalcity.life/u/EuphoricPenguin22 (normalcity.life)
I blocked / defederated these instances:
  1. https://lemmy.dekay.se/ (appears to just be a spambot server)
[–] AlmightySnoo@lemmy.world 12 points 2 years ago* (last edited 2 years ago) (1 children)

Just wanted to point out that according to your stats, unless I don't understand them well, only 26 bots come from lemmy.world (which has open sign-ups, and uses the "easy to break" (/s) captcha) and 16 from lemmy.ml (which doesn't have open sign-ups and relies on manual approvals).

For some perspective, lemmy.world has almost 48k users right now. Speaking of "corrective action" is a bit of a stretch IMO.

[–] xtremeownage@lemmyonline.com 9 points 2 years ago* (last edited 2 years ago) (1 children)

This post isn't about lemmy.world, nor am I blaming lemmy.world!

I am trying to drag in the admins of the big instances, to come up with a collective plan to address this issue.

There isn't a single instance causing this problems. The bots are distributed amongst normal users, in normal instances.

WIth- the exception of a instance or two with nothing but bot traffic.

[–] AlmightySnoo@lemmy.world 7 points 2 years ago* (last edited 2 years ago) (1 children)

I'm just saying that context and scale matter. If an anti-spam solution is 99% effective, then chances are that on an instance with 100k users you are still going to have around 1k bots that have bypassed it.

[–] xtremeownage@lemmyonline.com 6 points 2 years ago (3 children)

Your right- But, the problem is-

At a fediverse-level, we don't really have ANY spam prevention currently.

Lets assume, at an instance level, all admins do their part, enable applicant approvals, enable captchas, email verification, and EVERY TOOL they have at their disposal.

There is NOTHING stopping these bots from just creating new instances, and using those.

Keep focused on the problem- the problem, is platform-wide lack of the ability to prevent bots.

I don't agree with the beehaw approach, of bulk-defederation, as such, a better solution is needed.

[–] fubo@lemmy.world 5 points 2 years ago

Some older federated services, like IRC, had to drop open federation early in their history to prevent abusive instances from cropping up constantly, and instead became multiple different federations with different policies.

That's one way this service might develop. Not necessarily, but it's gotta be on the table.

[–] Kichae@kbin.social 3 points 2 years ago (2 children)

The beehaw approach wasn't "bulk defederation". They blocked two Lemmy instances they were having trouble with. The bulk of their block list are Mastodon and Pleroma instances well known for trolling other sites and stirring up shit.

Edit: Autocomplete refuses to accept that I talk a lot about federation and defederating, and is desperately trying to convince me I'm talking about anything else that states with "de".

load more comments (2 replies)
[–] o_o@programming.dev 2 points 2 years ago (2 children)

There is NOTHING stopping these bots from just creating new instances, and using those.

I read somewhere that mastodon prevents this by requiring a real domain to federate with. This would make it costly for bots to spin up their own instances in bulk. This solution could be expanded to require domains of a certain “status” to allow federation. For example, newly created domains might be blacklisted by default.

load more comments (2 replies)
[–] Martineski@lemmy.fmhy.ml 2 points 2 years ago (2 children)

You may also want to block lemmit.online

[–] xtremeownage@lemmyonline.com 2 points 2 years ago (2 children)

Eh- its not really a spam instance.

They are very straightforward with what their instance does- It crossposts reddit to lemmy, in that instance's communities.

In that case, its as simple as don't subscribe to it. Don't subscribe, and it won't popup on your feed.

[–] Martineski@lemmy.fmhy.ml 1 points 2 years ago* (last edited 2 years ago)

Comments under this post describe the problems with something like that pretty well.

https://lemmy.fmhy.ml/comment/378514

[–] Martineski@lemmy.fmhy.ml 1 points 2 years ago (5 children)

Yeah, but the problem is that you don't have to subscribe yourself, once someone else from your instance interacts with communities from that instance it will flood the "new" feed on your instance making this feed useless.

load more comments (5 replies)
load more comments (1 replies)
[–] Rottcodd@kbin.social 21 points 2 years ago (1 children)

The place feels different today than it did just a couple of days ago, and it positively reeks of bots.

I'm seeing far fewer original posts and far more links to karma-farmer quality pabulum, all of which pretty much instantly somehow get hundreds of upvotes.

The bots are here. And they're circlejerking.

[–] xtremeownage@lemmyonline.com 10 points 2 years ago* (last edited 2 years ago) (2 children)

Yup. And, I would bet money, it will get progressively worse, unless steps are taken to prevent it.

[–] towerful@beehaw.org 5 points 2 years ago (1 children)

Theres some that aren't just money.
There are bots that mirror content from Reddit, just linking to them.
I've seen posts that are 3 or 4 crossposts (between community/instances) deep.

I want content.
I don't want bot content

[–] xtremeownage@lemmyonline.com 4 points 2 years ago

Give it a week or two, and you will start to see the emergence of tools to assist with combating these issues.

I am working on trying to build a GUI for one project to help combat spam.

There is also lemmy_helper And- its only a short matter of time before we gain access to much more powerful tools to help.

load more comments (1 replies)
[–] ikiru@lemmy.ml 20 points 2 years ago

Why can't we just have nice things?

[–] o_o@programming.dev 19 points 2 years ago* (last edited 2 years ago) (1 children)

Honestly, I’m interested to see how the federation handles this problem. Thank you for all the attention you’re bringing to it.

My fear is that we might overcorrect by becoming too defederation-happy, which is a fear it seems that you share. However I disagree with your assertion that the federation model is more risky than conventional Reddit-like models. Instance owners have just as many tools (more, in fact) as Reddit does to combat bots on their instance. Plus we have the nuke-from-orbit defederation option.

Since it seems like most of these bots are coming from established instances (rather than spoofing their own), I agree with you that the right approach seems to be for instance mods to maintain stricter signups (captcha, email verification, application, or other original methods). My hope is that federation will naturally lead to a “survival of the fittest” where more bot-ridden instances will copy the methods of the less bot-ridden instances.

I think an instance should only consider defederation if it’s already being plagued by bot interference from a particular instance. I don’t think defederation should be a pre-emptive action.

load more comments (1 replies)
[–] lukas@lemmy.haigner.me 7 points 2 years ago
  1. Hiring kids in africa and india to create accounts for 2 cents an hour.

Heads up that this depends on the operation size. Captchas are a solved problem. Commercial software exists that can solve Captchas automatically. You migrate from pay on demand services to computer vision software when it's financially beneficial.

Computers are cheaper and better at solving Captchas than humans atm, and it doesn't look like that's going to change any time soon. As long as you pay attention to your proxies, it's rare to see solution attempts fail.

Some pay on demand services no longer employ people.

[–] xtremeownage@lemmyonline.com 7 points 2 years ago

Does appear, a few of these are common hosts though-

lemmy.dekay.se, bbs.darkswitch.net. normalcity.life. etc.

[–] db0@lemmy.dbzer0.com 6 points 2 years ago (4 children)

I noticellot of instances which were flooded with bots due to the open registration. I have most of them degenerated for this reason.

[–] xtremeownage@lemmyonline.com 9 points 2 years ago* (last edited 2 years ago) (5 children)

We need a better solution for this, rather then mass-bulk defederation.

In my opinion- that is going to greatly slowdown the spread and influence of this platform. Also IMO- I think these bots are purposely TRYING to get instances to defederate from each other.

Meta is pushing its "fediverse" thing. Reddit, is trying to squash the fediverse. Honestly, it makes perfect sense that we have bots trying to upvote the idea of getting instances to defederate each other.

Once- everything is defederated- lots of communities will start to fall apart.

[–] db0@lemmy.dbzer0.com 7 points 2 years ago (1 children)

I agree. This is why I started the Fediseer which makes it easy for any instance to be marked as safe through human review. If people cooperate on this, we can add all good instances, no matter how small, while spammers won't be able to easily spin up new instances and just spam.

[–] xtremeownage@lemmyonline.com 2 points 2 years ago (2 children)

What- is the method for myself and others to contribute to it, and leverage it?

[–] db0@lemmy.dbzer0.com 5 points 2 years ago (1 children)

First we need to populate it. Once we have a few good people who are guaranteeing for new instances regularly, we can extend it to most known good servers and create a "request for guarantee" pipeline. The instance admins can then leverage it by either using it as a straight whitelist, or more lightly by monitoring traffic coming from non-guaranteed instances more closely.

The fediseer just provides a list of guaranteed servers. It's open ended after that so I'm sure we can find a proper use for this that doesn't disrupt federation too much.

[–] xtremeownage@lemmyonline.com 4 points 2 years ago (1 children)

So- the TLDR;

Essentially a few handfuls of trusted individual voting for the authenticity of instances?

I like the idea.

[–] db0@lemmy.dbzer0.com 3 points 2 years ago (1 children)

Actually, not a handful. Everyone can vouch for others, so long as someone else has vouched for them

[–] xtremeownage@lemmyonline.com 3 points 2 years ago* (last edited 2 years ago) (1 children)

One recommendation- how do we prevent it from being potentially brigaded?

Someone vouches for a bad actor, bad actor vouches for more bad actors- then they can circle jerk their own reputation up.

Edit-

Also, what prevents actors in "downvoting" instances hosting content they just don't like?

ie- yesterday, half of lemmy was wanting to defederate sh.itjust.works due to a community called "the_donald", containing a single troll shit-posting. (The admins have since banned, and remove that problem)- but, still, everyone's knee-jerk reaction was to just defederate. Nuke from orbit.

[–] db0@lemmy.dbzer0.com 2 points 2 years ago (2 children)

Someone vouches for a bad actor, bad actor vouches for more bad actors- then they can circle jerk their own reputation up.

There's a chain of trust. If a bad actors lets in all their friend, withdrawing the guarantee from that bad actors, withdraws it from all their friends.

Also, what prevents actors in “downvoting” instances hosting content they just don’t like?

There's no "downvote", but even if I add it, I would add filter so you can ignore "downvotes" from people you don't agree with, or only see "downvotes" from instances you agree with.

load more comments (2 replies)
[–] db0@lemmy.dbzer0.com 2 points 2 years ago

For contributing, it's open source so if you have ideas for further automation I'm all ears.

load more comments (4 replies)
load more comments (3 replies)
[–] dedale@kbin.social 6 points 2 years ago (2 children)

Hello. The post you mentioned was made as a warning, to prove a point. That the fediverse is currently extremely vulnerable to bots.

user 'alert', made the post then upvoted with his bots. To prove how easy it was to manipulate traffic, even without funding.

see:
https://kbin.social/m/lemmy@lemmy.ml/t/79888/Protect-Moderate-Purge-Your-Sever

It's proof that anyone could easily manipulate content unless instance owners take the bot issue seriously.

[–] xtremeownage@lemmyonline.com 2 points 2 years ago

I did update my post, shortly before you posted this, to include that- as well as- removing a lot of the data for individual instances as it derives from the point / problem I am trying to identify.

The data, however, is quite valuable in exposing that this WILL be a problem for us, especially if we do not identify a solution for it.

[–] db0@lemmy.dbzer0.com 2 points 2 years ago

Absolutely. Me and a couple of others have been warning against this for a week now.

[–] AnarchoGravyBoat@kbin.social 5 points 2 years ago (1 children)

@xtremeownage

I think that one of the most difficult things to deal with more common bots, spamming, reposting, etc.

Is that parsing all the commentary and dealing with it on a service wide level is really hard to do, in terms of computing power and sheer volume of content. Seems to me that do this on an instance level with user numbers in the 10's of thousands is a heck of a lot more reasonable than doing it on a 10's of millions of users service.

What I'm getting at is that this really seems like something that could (maybe even should) be built into the instance moderation tools, at least some method of marking user activity as suspicious for further investigation by human admins/mods.

We're really operating on the assumption that people spinning up instances are acting in good faith, until they prove that they aren't, I think the first step is giving good faith actors the tools to moderate effectively, then worrying about bad faith admins.

load more comments (1 replies)
[–] Ataraxia@lemmy.world 2 points 2 years ago (1 children)

Lol well it was fun while it lasted! Man there are some really greedy assholes out there.

[–] xtremeownage@lemmyonline.com 2 points 2 years ago

Well- I have not seen much evidence that supports this is actively being used... yet.

Just- bringing more attention to how easy it is to do.

[–] bikesarethefuture@kbin.social 2 points 2 years ago

If Twitter can't avoid bots how will the fediverse avoid it, using some captcha maybe?

[–] bren42069@thelemmy.club 2 points 2 years ago (1 children)

the problem is that activity pub is dumb and bad

[–] xtremeownage@lemmyonline.com 4 points 2 years ago

This, isn't a problem specific to activity pub, lemmy, or any individual platform in general.

Reddit faces this problem every day. Facebook faces this problem. Twitter faces this problem.

They all do.

And, each platform has to determine the best method for that platform to deal with this issue.

[–] Cinner@kbin.social 1 points 2 years ago (1 children)

Reposting this in comment from a reply elsewhere in the thread.

If anything there should be SOME centralization that allows other (known, somehow verified) instances to vote to disallow spammy instances from federating. In some way that couldn't be abused. This may lead to a fork down the road (think BTC vs BCH) due to community disagreements but I don't really see any other way this doesn't become an absolute spamfest. As it stands now one server admin could spamfest their own server with their own spam, and once it starts federating EVERYONE gets flooded. This also easily creates a DoS of the system.

Asking instance admins to require CAPTCHA or whatever to defeat spam doesn't work when the instance admins are the ones creating spam servers to spam the federation.

[–] xtremeownage@lemmyonline.com 6 points 2 years ago* (last edited 2 years ago)

I'm working to build a simple GUI around db0's project.

Its simple enough- allows instance owners to vet out other instances.

Edit-

@nohbdyuno@sh.itjust.works you going to continue just blindly downvoting everything? lol.

load more comments
view more: next ›