16

I see a fairly high amount of spam that takes the following form (pardon the italics, my DejaVu Sans is broken and drupal.se ends up italicized):

enter image description here

That is, a body of text that ends with a raw (no markdown) hyperlink (and no punctuation after it - the very last thing in the body). Sometimes (although not in the above example) there are hyperlinks elsewhere in addition to the one at the end.

Here is another example from right here on MSE:

enter image description here

If you hang out in chat you will see a lot of these, particularly on drupal.se for some reason. Maybe a dozen or so per day.

Does it make sense to enact a spam filter that blocks questions that end with a non-markdown hyperlink? There are some considerations that I do not have any real knowledge about:

  • Are there legitimate posts that take this form? At a glance I am unable to find any although this is made difficult by performance issues in queries against Posts.Body.
  • Would this actually help or would it likely just be a short matter of time before the spammers changed the format?

Even with those in mind I wonder if it would be worth a shot for a while. Spam of this form is the overwhelming majority of the spam that I see come up in chat, at least.

Another option might be to require a captcha for questions of this form.

  • 7
    "Are there legitimate posts that take this form?" -- probably not, but I can imagine one saying: "here's my site, in case you want to see it live: " – John Dvorak Aug 10 '14 at 18:00
  • 6
    "Would this actually help or would it likely just be a short matter of time before the spammers changed the format?" - they probably would, but it depends on when they find out. Which bots probably never will. – John Dvorak Aug 10 '14 at 18:01
  • @JanDvorak Re: Your first comment. Good point, that could be a legitimate question; perhaps a captcha instead of a straight up block. – Jason C Aug 10 '14 at 18:01
  • These spam posts never have any code blocks: no code and a link => VLQ? – John Dvorak Aug 10 '14 at 18:02
  • 1
    @JanDvorak Well, "no code" only applies on code-oriented sites, though. But white-listing ones that do have a code block could prevent some false positives, maybe? – Jason C Aug 10 '14 at 18:05
  • 1
    no code and a trailing link = vlq, then? I like that – John Dvorak Aug 10 '14 at 18:08
26

We've experimented with this sort of thing in the past, and it hasn't been very successful for any appreciable amount of time. This is for two reasons:

  • We have to tell users why something can't be submitted, although we can be kind of vague as to what's wrong, to avoid users 'fixing' only the stuff they think will get it submitted rather than making better improvements

  • Spammers are robots with masters, or assimilated humans being paid by the link planted. They see this, they alter tactics, they alter text and then it's a game of pin the regex on the (new) pattern.

We block an enormous amount of this, a fresh graph:

Holy Spamballs!

The drop for today is due to no data for the day to speak of, as it rolls over during a very inactive period.

Notice, the amount of work users have to do in order to keep it out isn't commensurate with the amount we actually block, but this particular wave that you're mentioning is in fact changing that perception, even though it's not the case.

The SE quality project ML has yet to be really tested on this type of stuff, and I think it might end up being the perfect companion to the spam system if our goal is to make sure this stuff never hits the front page, thus bringing the perceived effectiveness of the system as a whole a bit close to reality.

I don't want to start poking and prodding at a better blacklist until and if that proves to be insufficient, and even then, I think we're looking at something a bit more Bayesian.

And, whatever is doing this is freaking huge, I've been battling it for a few weeks now, and quite sick of it along with everyone else. I just don't want to start taking flailing, wild stabs at simple pattern matching that aren't going to ultimately get us anything - I'd rather our next move be closer to end-game.

Update

I've spent a considerable amount of time looking into this, and I have made some changes network wide. I can't go into too many specifics, but here's the gist of it:

  • We hold a grudge longer than we used to.
  • We're much quicker to block outright when 1 moderator, or 6 users indicate the presence of a spammer using spam flags
  • If a moderator destroys a spammer, it's a near instant block on most sites, or an instant one on others. I'm not saying which is which, it's prone to changing during a bi-weekly maintenance cycle where I turn knobs and pull levers after analyzing activity
  • Tripping honeypots is now considerably easier to do, and doing so deals an instantly blocking blow (which hasn't changed, they're just more sensitive)
  • Stuff we've got baking in the quality initiative project is now showing promise of augmenting the spam system, I'll have more on that as it solidifies.

We can't hope to block 100% if we're going to remain a network that trusts you until you give us a reason not to trust you any longer, and that's a premise we're very inclined to cling to. However, the vast majority of networks that we track only hit us with spam, so we're now working considerably faster.

  • +10, totally makes sense, and good luck! One question: Maybe I just need coffee but I'm having trouble parsing "Notice, the amount of work users have to do in order to keep it out isn't commensurate with the amount we actually block ...". My brain can't handle prepositions in the morning. Is this essentially saying: "We block a lot. The remaining fraction, handled by users, is very small."? I think it is, and this makes sense in context, just making sure. – Jason C Aug 11 '14 at 13:42
  • 1
    @JasonC It's just saying that the work required from users is the same to block 5k, or 50k spam attempts network-wide daily. More spam doesn't mean more work, the same amount of flags (on average) just have a bigger effect when there's more to deal with. – Tim Post Aug 11 '14 at 15:23
0

A better route might be to flag this or automatically add it to the Low Quality review queue (as suggested in the comments) - or even create a new queue (but only if the volume of posts warrants it).

This way we get eyes on these posts very quickly and the spam can be flagged up and removed, people innocently adding a link as a signature educated and other posts edited into shape.

The only danger with this is a possible pile on effect of down-votes and inappropriate comments so either this queue would need to be restricted in some way or only require one user's action to remove it from the queue. Actually this sounds OK as the point is that the system has said "I think this is spam" and all that's happening is that a human is saying "yes"(at which point it gets spam flagged) or "no" (at which point it's ready to be treated like any other post).

  • 3
    The new quality system will (effectively) do that. I won't block if the post ends in a link, but I will log it, and the presence of it will influence the quality score (built from dozens of different signals we get as posts are written and submitted). We're doing some pretty exciting stuff. – Tim Post Aug 11 '14 at 8:02
  • 1
    @TimPost - ah - excellent. I agree with you that automatically blocking stuff just leads to an "arms race" type situation. – ChrisF Aug 11 '14 at 8:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .