14

Triggered by the question How should a bot earn enough reputation to perform the actions necessary for that bot?

Spam is increasing, and it appears current efforts towards it are linear – they require human action and interaction.

We have, up until now, allowed users to moderate the site through voting and flags, but this is a linear solution which cannot match the fact that spammers are using bots to abuse the system.

Our users are smart enough, trustworthy enough, and, gosh darn it – adorable enough – that we should permit them to create bot accounts to fight spam posted by bots.

I don't know what this would look like, but in my experience posting such questions without some proposed solution results in lackluster debates, so here's one possible solution:

A new account type that is meant only for robots. It's "owned" by a real user account, and is allowed to do everything that user is allowed to do, but with additional rate limiting and oversight, and statistics on its user page about its performance and correlation with real user voting.

This ability would only be given to users with, say, 50k reputation (so the number of robots is limited) but they could be running whatever code they want. so others can contribute at lower reputations, they just have to coordinate with a high reputation user.

If a user repeatedly deploys robots that fail spectacularly it should affect their reputation, probably significantly, as a measure of community trust and to encourage significant debugging and testing prior to deployment.

Bot source code must be available and open somehow to the stack overflow team.

Perhaps a simpler solution would be to allow "robot" slots on each user account, with more slots the higher the user gets, and not actually create a new user, just a new API key. Slots can be enabled and disabled, statistics are kept and tracked.

So, while the SO team screams in horror at the thought of such a big change to the system, let's discuss what problems this solution holds, and what other ways we might implement robot accounts and hold their owners accountable?

  • 2
    In general, I agree with other folks that robots should be run on their owner's accounts. If you're not willing to put something on your account, you probably shouldn't be running it. Of course, there are some instances where it simply doesn't make sense (or isn't safe) to do that, which is what this proposal seems to be targeting. – Undo - Reinstate Monica Dec 15 '16 at 17:52
  • Is your question about any bots in general, or just spam-prevention ones? – JAL Dec 15 '16 at 18:00
  • I don't think this is necessary - how many bots are there, really, compared to how many real users there are? 'Sides, any conscientious bot owners running on separate accounts will keep track of any necessary statistics themselves. – ArtOfCode Dec 15 '16 at 18:02
  • @JAL The bots could be for anything, but if we want SO to implement this sort of system we have to make it worth their while, and I believe focusing on spam bots is appropriate. – Pollyanna Dec 15 '16 at 18:04
  • 1
    @ArtOfCode That's kind of the point - we don't have enough bots, we need to encourage people to build useful bots. Right now bot owners are skirting the edge of the rules on sock puppets and asking how to legitimize their robots - if SO provides a legitimate method for this it will encourage bot builders. Further, by providing a framework of sorts it gives SO more control over the bots. Right now they probably can't answer how many bots are running on their site. Legitimize them and not only can they count them, but they can track and disable them when required. – Pollyanna Dec 15 '16 at 18:07
  • I would just embedded more moderator if the task become a burden, not rewrite another piece of code that would be maintained by the SO' team, as they got already too much job to do. – yagmoth555 Dec 15 '16 at 20:53
9

No, there should not be a special "bot" type of account. Stack Exchange provides an API that let's you do a lot of things automatically including:

  • Upvote
  • Downvote
  • Flag
  • Edit
  • Accept/Unaccept an answer
  • Ask a question
  • Post an answer

All of these action require the user to have an API token, which ties the action to their account. This API is built so that users can perform these actions with their own account.

I don't think adding a "bot" account type does anything accept prevent users from helping in way they currently can. I certainly wouldn't be able to help if there were huge reputation requirements. As it currently stands, I can.

A new account type that is meant only for robots. It's "owned" by a real user account, and is allowed to do everything that user is allowed to do, but with additional rate limiting and oversight, and statistics on its user page about its performance and correlation with real user voting.

My automated actions are already owned by me. I follow the rate limiting guidelines the API requires me to follow and my stats are available on my profile (both publicly in terms of how many helpful flags and privately where I can see exactly what hasn't been helpful).

If a user repeatedly deploys robots that fail spectacularly it should affect their reputation, probably significantly, as a measure of community trust and to encourage significant debugging and testing prior to deployment.

There have been bots that haven't been well received (plus others I can't find on Meta right now). In these cases, the community and moderators already have tools to handle the owner and the bot user. The community can raise a meta post (like today's series of posts) to discuss current policies and suggest new ones. Moderators can suspend malicious users.

Bot source code must be available and open somehow to the stack overflow team.

No. For the simple reason you've already mentioned: "so the number of robots is limited". I was asked to not share all of my source/datasets for the comment flagging that I do to prevent the moderators from being overwhelmed by copycats. Even with that, users still took it upon themselves to use a portion of my meta post - less than a month later - to try and replicate my actions using only simple SEDE queries. I am all for open source and posting code, but adding a requirement that is has to be open is not something I agree with.

I like the idea of stats, but I don't know if it needs to be public. Stackapps already has a very (very) rudimentary stats page for applications with API keys. Currently, it only shows how many users are authenticating your app to do things though. More information in this area would be helpful to the bot owner.


My automated actions are my own. I don't need a special "bot" account when I can already associate the actions to my self. There are legitimate cases where using my own account wouldn't be appropriate though. Flagging a post, automatically, as spam on a site I moderate is one of those cases. A secondary account solves that problem.

  • I didn't mean to suggest that the code be open to all, just SO. – Pollyanna Dec 15 '16 at 18:37
  • 3
    A secondary account solves that problem. And how does that one gain reputation? What if we get a bot that smart it can close questions with 100% accuracy, how will it gain 2000 reputation? – Patrick Hofman Dec 15 '16 at 22:19
  • The same way any other account would? Or, use the account of the bot owner who already has the rep. – Andy Dec 15 '16 at 22:24
5

Yes, we should. The fact that many (if not the overwhelming majority) of bots are run as sock puppets demonstrates that there is a need and a desire, and this is very much in line with sound principles of separation of roles and privileges.

I definitely think each bot needs to have its owner properly visible. The current arrangement with sock puppets obfuscates this goal.

I would hate to have users try to contact me as if I was a bot with infinite patience and 24/7 presence. If I create a bot with a public interface, this is bound to happen if I run it on my primary account.

There are other similar examples I could bring up, but again, I think we already have proof that there is a need for dedicated bot accounts.

This would also help us solve the follow-up question of how to allocate sufficient privileges to a bot. The owner's capabilities (through his or her reputation) is a good cap for what the bot could potentially be allowed, but again, soundness principles dictate that bot accounts should ideally not have all the privileges that their owners have. If my bot need to be able to talk in chat, I should be able to restrict it to only have that privilege if I want to, as a security measure.

I'm not familiar enough with the inner workings of Stack Exchange to describe exactly how this should work, but I think current practice already teaches us what's wrong with the current system. We should try to fix those problems (or outlaw bots if accommodating them properly is really not possible).

  • I posted a comment on a related question with an outline for a possible design: meta.stackexchange.com/questions/288144/… – tripleee Dec 16 '16 at 9:39
  • One of the issues I have with this is that this proposal basically allows you to clone yourself repeatedly. As a 20K SO user, if I want to create a bot it'd have all of my privileges and not be me. So, I can now close/delete vote twice as many questions. Add in a third and I can triple my effectiveness. If the bot is forced to gain rep, like a regular user, then they have to work their way up to those privileges and the community gets the benefit of good contributions. – Andy Dec 16 '16 at 14:18
  • 1
    @Andy That would be a great answer to this question, please consider posting it as one. – Pollyanna Dec 16 '16 at 21:03
  • @Andy An account explicitly marked as secondary could easily be prevented from doing this, whereas a sock puppet with no connection to the main account currently exhibits pretty much the problem you describe (though without inheriting all the access privileges of the main account, of course). – tripleee Dec 19 '16 at 5:26
  • I'll grant you that my proposal is sketchy in how exactly to curb abuse, but I don't think the problem you point to is unsurmountable. While I don't think creating a secondary account should cost you rep, perhaps adding more than one or two privileges to a bot account should; or perhaps some specific bot actions should consume owner rep? – tripleee Dec 19 '16 at 5:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .