Should we have special accounts for bots?

Question

Triggered by the question How should a bot earn enough reputation to perform the actions necessary for that bot?

Spam is increasing, and it appears current efforts towards it are linear – they require human action and interaction.

We have, up until now, allowed users to moderate the site through voting and flags, but this is a linear solution which cannot match the fact that spammers are using bots to abuse the system.

Our users are smart enough, trustworthy enough, and, gosh darn it – adorable enough – that we should permit them to create bot accounts to fight spam posted by bots.

I don't know what this would look like, but in my experience posting such questions without some proposed solution results in lackluster debates, so here's one possible solution:

A new account type that is meant only for robots. It's "owned" by a real user account, and is allowed to do everything that user is allowed to do, but with additional rate limiting and oversight, and statistics on its user page about its performance and correlation with real user voting.

This ability would only be given to users with, say, 50k reputation (so the number of robots is limited) but they could be running whatever code they want. so others can contribute at lower reputations, they just have to coordinate with a high reputation user.

If a user repeatedly deploys robots that fail spectacularly it should affect their reputation, probably significantly, as a measure of community trust and to encourage significant debugging and testing prior to deployment.

Bot source code must be available and open somehow to the stack overflow team.

Perhaps a simpler solution would be to allow "robot" slots on each user account, with more slots the higher the user gets, and not actually create a new user, just a new API key. Slots can be enabled and disabled, statistics are kept and tracked.

So, while the SO team screams in horror at the thought of such a big change to the system, let's discuss what problems this solution holds, and what other ways we might implement robot accounts and hold their owners accountable?

Answer 1

No, there should not be a special "bot" type of account. Stack Exchange provides an API that let's you do a lot of things automatically including:

• Upvote
• Downvote
• Flag
• Edit
• Accept/Unaccept an answer
• Ask a question
• Post an answer

All of these action require the user to have an API token, which ties the action to their account. This API is built so that users can perform these actions with their own account.

I don't think adding a "bot" account type does anything accept prevent users from helping in way they currently can. I certainly wouldn't be able to help if there were huge reputation requirements. As it currently stands, I can.

A new account type that is meant only for robots. It's "owned" by a real user account, and is allowed to do everything that user is allowed to do, but with additional rate limiting and oversight, and statistics on its user page about its performance and correlation with real user voting.

My automated actions are already owned by me. I follow the rate limiting guidelines the API requires me to follow and my stats are available on my profile (both publicly in terms of how many helpful flags and privately where I can see exactly what hasn't been helpful).

If a user repeatedly deploys robots that fail spectacularly it should affect their reputation, probably significantly, as a measure of community trust and to encourage significant debugging and testing prior to deployment.

There have been bots that haven't been well received (plus others I can't find on Meta right now). In these cases, the community and moderators already have tools to handle the owner and the bot user. The community can raise a meta post (like today's series of posts) to discuss current policies and suggest new ones. Moderators can suspend malicious users.

Bot source code must be available and open somehow to the stack overflow team.

No. For the simple reason you've already mentioned: "so the number of robots is limited". I was asked to not share all of my source/datasets for the comment flagging that I do to prevent the moderators from being overwhelmed by copycats. Even with that, users still took it upon themselves to use a portion of my meta post - less than a month later - to try and replicate my actions using only simple SEDE queries. I am all for open source and posting code, but adding a requirement that is has to be open is not something I agree with.

I like the idea of stats, but I don't know if it needs to be public. Stackapps already has a very (very) rudimentary stats page for applications with API keys. Currently, it only shows how many users are authenticating your app to do things though. More information in this area would be helpful to the bot owner.

---

My automated actions are my own. I don't need a special "bot" account when I can already associate the actions to my self. There are legitimate cases where using my own account wouldn't be appropriate though. Flagging a post, automatically, as spam on a site I moderate is one of those cases. A secondary account solves that problem.

Answer 2

Yes, we should. The fact that many (if not the overwhelming majority) of bots are run as sock puppets demonstrates that there is a need and a desire, and this is very much in line with sound principles of separation of roles and privileges.

I definitely think each bot needs to have its owner properly visible. The current arrangement with sock puppets obfuscates this goal.

I would hate to have users try to contact me as if I was a bot with infinite patience and 24/7 presence. If I create a bot with a public interface, this is bound to happen if I run it on my primary account.

There are other similar examples I could bring up, but again, I think we already have proof that there is a need for dedicated bot accounts.

This would also help us solve the follow-up question of how to allocate sufficient privileges to a bot. The owner's capabilities (through his or her reputation) is a good cap for what the bot could potentially be allowed, but again, soundness principles dictate that bot accounts should ideally not have all the privileges that their owners have. If my bot need to be able to talk in chat, I should be able to restrict it to only have that privilege if I want to, as a security measure.

I'm not familiar enough with the inner workings of Stack Exchange to describe exactly how this should work, but I think current practice already teaches us what's wrong with the current system. We should try to fix those problems (or outlaw bots if accommodating them properly is really not possible).