This is meant to replace a question I ended up deleting regarding the advantages of displaying a haiku rather than a clearer message on spam detection for unregistered users (link for 10k users).

Many features intended to prevent or reverse abusive or undesirable behavior (such as spamming, serial voting, or repeatedly posting low-quality content) rely on security through obscurity. As I'm a fan of transparency, is there some sufficiently effective way these behaviors can be controlled without hiding implementation details? (What constitutes "sufficiently effective" is best determined by the community, rather than by Stack Exchange Inc. or its employees.)

As it presently stands, disclosure of these measures could greatly weaken the security of Stack Exchange against said undesirable behavior. Given that SE is so dependent on security through obscurity, it would be a good idea to rethink how we (both the community and Stack Exchange Inc.) control such behavior.

  • Do the spambots really care what error message is displayed to them?
    – animuson StaffMod
    Aug 24, 2012 at 1:36
  • @animuson: To answer your question (and my deleted question, for that matter), theoretically yes. A spambot could parse the message, find words like "spam", "detected", "filter", or "triggered", and use them to determine whether it has triggered a spam filter and act accordingly. Additionally, as the message is a single line of plain text, the impact of an automated attack against SE's servers is limited.
    – bwDraco
    Aug 24, 2012 at 2:05
  • 2
    I wouldn't really call this "security through obscurity" since the system actually does work. There's no point in publishing the info though, similar to DDoS prevention techniques there's really nothing good to get out of publishing exactly how you do it. Also anything involving vote patterns pretty much has to be secret since voting is supposed to be anonymous. It has to be automatic so that limits all sorts of manual review possibilities
    – Ben Brocka
    Aug 25, 2012 at 16:16

1 Answer 1


For a good look at the value proposition of these types of things, check out security.stackexchange.com - this instance really isn't security through obscurity though. The mechanism is not hidden, only the details of a couple of thresholds.

You have to take into account what is being protected here though, and the trade-offs. For providing an effective reduction in spam bots, it appears to do quite well, while not annoying users too much.

If the actual thresholds were revealed, the mechanism would still hinder a lot of spam bots, although there could be specific cases where the spam bot could be tuned more accurately for SE specific sites, but if that happened, it could be quite easy to spot, and change those thresholds.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .