11

I've noticed this morning a spam campaign that consist in editing posts that mention mails systems, portals like drupal, fb or related subjects to inject links to freeanalytics dot komfo dot com.

The problem I see is not that some spam could have be sent here, as I suppose SO due to its success it is a permanent target for spam, but that the spam has successfuly passed the reviewing process.

Only one or two reviewers rejected the edits, while the other accepted, and I reverted the edits after in the history.

Examples:

https://stackoverflow.com/q/21931417/317266

https://stackoverflow.com/q/21931474/317266

I have the feeling that SO attracts so much flow and that many people that gained the power user rights did not spent enought time on the review process and accept too quickly some wrong edits. I know that the suggested edits are the review that spent the less time in the voting flow and often when I am doing some review, the time I am checking the edit contents and the given links (if any), when I vote to reject I am told that the post is already accepted (and like for the given cases, wrongly).

I know that some "testing cases" are sometimes injected in the review flow to check that the reviewer is attentive, and maybe that the process could be augmented to check if the accepting is legit based on the time to perform the review? Also the check could be aimed to the "rookie reviewers", as I also noticed that the less level a reviewer has, the quickest he is to accept wrongly edits.

BTW, IIRC the edits were anonymously submitted, that could also be taken into account to flag spurious edits.

EDIT: I would just make clear that my intention is not to accuse anyone or to find who is guilty for spam acception, but just to improve the process for helping reviewers and show them clues saying "man, pay attention that edit smells crap".

As it emerges from the comments on the Tim Post answer, it could result on a feature request to make the raw url more evident when a spam link is displayed in rendered output instead of markdown, because it is easy to miss it.

  • 2
    One part of the problem is that links can be rather easily missed in the rendered view, I'm pretty sure there is already a feature request to make it more obvious when a suggested edit adds a link. – Mad Scientist Feb 21 '14 at 11:16
  • @MadScientist: I am not familiar with the SO feature requests process, but I would happily upvote such a proposal if it can apply. – Seki Feb 21 '14 at 11:31
  • 2
    Oh wow, it says: "Anonymous had 4 edit suggestions approved, and 0 edit suggestions rejected" -- there must have been more spam edits. – Qantas 94 Heavy Feb 21 '14 at 11:39
  • @Qantas94Heavy: how do you generally retrieve anonymous edits? I am curious to check for their contents... – Seki Feb 21 '14 at 11:42
  • @Seki: not sure, I haven't gone on an anonymous edit hunt. However, users with 10k are able to view the full suggested edit reviews, which could help. – Qantas 94 Heavy Feb 21 '14 at 11:45
  • all reviewers who approved spam edits should be manually banned by moderator for a week (for a month if they had bans before). Just let minitech know – gnat Feb 21 '14 at 11:45
  • Had one (and reverted) one just now as well: stackoverflow.com/review/suggested-edits/4122915 – Jeroen Vannevel Feb 21 '14 at 11:46
  • @gnat: Tim Post seems to disagree, check his answer. – Qantas 94 Heavy Feb 21 '14 at 11:46
  • @Qantas94Heavy TimPost seems to be unaware of the fact that there are enough reviewers out there to do thorough reviews. He could easily see that if he would at least occasionally visit SO review page and see the edits queue empty or single digits. In cases like this, it makes better sense to optimize for pearls not sand – gnat Feb 21 '14 at 11:50
  • @Seki: realised I could search for the link, found another one: stackoverflow.com/revisions/21881663/7 – Qantas 94 Heavy Feb 21 '14 at 14:03
  • @Qantas94Heavy: I talked about programmatic attack, but the edit you pointed is rather insidious. Along the injected link, the code sample is also changed, making the spam more stealth. Seems rather man driven spam. – Seki Feb 21 '14 at 14:18
  • 1
    BTW, just discovered the url:"*domain.com" search operator and found another one – Seki Feb 21 '14 at 14:23
  • 1
    This one is even smarter: the spam injection was done in 2 steps: 1) added the link markdown in text corpse and 2) added the link. I think the origin of these posts has gained a place in the ban list. – Seki Feb 21 '14 at 14:54
3

The problem of keeping these types of edits out in the first place has been pretty well addressed since we introduced honeypots for the spam system. Unfortunately, some of these still get through to grace the eyes of reviewers.

Approving of these edits was an absolute face plant, but I had to do a double take to see where it went in, and I knew something was there to find. Even without the links, they aren't that great as far as edits go, but one did seem to try and fix something. Clever.

The good thing is, if these kinds of edits come from an origin our spam system is tracking, reviewers get clear guidance to be extra careful while reviewing, and that seems to have made a positive impact. Had these spammers been seen before, I'm not sure these would have been approved as they were.

I don't think any individual reviewers need chastising over this, but man, those links are really hard to see if you don't know what you're looking for. The fix here might be to make them more prominent - until then, be wary of any inline code, which seems to be what helped them hide.

  • I used to visualize the suggested edits not in rendered mode but in markdown, so they look a lot more spurious when the url has nothing to do with the question subject at a first glance and that is probably why I noticed them, while I never work with mentioned tools (drupal and al). Maybe that forcing the display of the raw url even in rendered mode could help? – Seki Feb 21 '14 at 11:48
  • I pinged Jin (our designer) to have a peek, maybe making links contained inside inline code more easy to spot will be simple, and that'd be a nice fix. We'll figure something out, it's just too easy to miss, even if you are for all intents and purposes paying attention. – Tim Post Feb 21 '14 at 12:41
  • @Tim I had just made a feature request for this, do I need to keep it now that you pigned Jin? – Stijn Feb 21 '14 at 12:50
  • I almost missed one earlier myself. These spammers are getting smarter. They must be visiting Spam.SE. – Matthew Green Feb 21 '14 at 15:36
  • 2
    I'm not so sure about the statement "I don't think any individual reviewers need chastising over this", since a couple of the reviewers involved subsequently failed suggested edit audits. In fact, I think at least one of these would have been prevented if this was implemented: meta.stackexchange.com/questions/214541/… – Brad Larson Feb 21 '14 at 15:46
  • @BradLarson: The possibility to survey and / or train new reviewers would be very useful, and join my feeling about the fresher they as power users the most crap they accept in reviews. – Seki Feb 21 '14 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .