2

I've noticed StackOverflow allows non-registered users to ask questions by simply requiring the person to enter in their Name and Email.

How does StackOverflow prevent (or reduce) spam from bots?

Right now, I'm using bbPress as a web forum. It requires my users to create an account to participate in the forum.

I would really like the ability to allow non-register users to participate in my forum ... because I strongly believe I'll have more participation (requiring a user to create an account is a pain in the ass for them ... so they just move on).

So know moring about how StackOverflow allows non-registered user activity while also reducing spam would be excellent to know.

Thanks P.S. I also want to state that I realize there probably is no "silver bullet". But if an effect method exists that dettors or reduces spams, while not eliminating, but does a good job reduces/prevents - I'm all ears.

Update:

I found Jeff answer here. Jeff mentions

"script detection heuristics and "honeypots""

I would be interested in learning more about what he means and what is implemented.

|improve this question
  • I cannot edit on Meta and "So know moring about how StackOverflow" is killing me. Please fix it. – Sinan Ünür Dec 15 '09 at 14:17
  • Do you want to spam SO, unknown googler? – Ladybug Killer Dec 15 '09 at 18:30
6

A "honeypot" is a hidden text field, if it contains any information at all your input is ignored completely. The idea being a bot will mindlessly fill every box in the hopes of getting through.

Script detection heuristics look for the way the post is formatted, such as having a lot of randomly placed links, or no punctuation marks. if you're detected as a script, and you're not? You're given a captcha, so it doesn't significantly harm human users!

Plus, of course, any spam that does get through can be pretty quickly taken care of by the community.

|improve this answer
4

There is also an fkey parameter in each form containing 128 bits of random-looking data. This may be a simple token or more likely an MD5 hash of some kind of user- or IP-specific information which will have to match for the post to succeed.

This would be doing duty against both XSRF (can't submit as a particular user without reading a valid fkey from the page, which an external attack can't do) and the dumb but most-prevalent kind of bot that just hits the target form again and again without requesting new tokens.

Personally between spoiler fields (‘honeypots’) and user/time-limited authorisation hashes of this variety I've cut down automated posting on sites I run to zero. Naturally, if one particular implementation of a solution becomes popular enough to warrant the spammers' time, an automated break for it will be written. But with SE's links all being nofollow they'd have little to gain by doing that.

|improve this answer
3

This question is a double edged sword. If answered, it gives a way for people to sneak past them.

If not answered, it leaves potentially good ideas locked up.

I suggest you go ask this question in a very generic way on SO or SU (re-write the question so it fits the audience, of course) and ask for suggested ways of implementing such heuristics and honeypots.

It is unlikely that you'll get actual implementation details for these sites, though.

|improve this answer
  • How about this ... is there a simply way to detect if a user simply 'types' in the content vs a robot injecting content. Seems to me that JavaScript timers etc could detect this and that would prevent like 80% of spam alone – user137934 Dec 14 '09 at 17:32
  • Any code you expect the client to run to check things out can be subverted by spammers, including any javascript. Even if you added server side stuff (ajax) to detect keypress timings, that can be simulated by a spam script. – Adam Davis Dec 14 '09 at 17:41
  • The site works without JS, though. – Phoshi Dec 14 '09 at 17:41
  • 4
    You have just described security by obscurity - I'm sure if asked Jeff would be quite happy to share details on how anti-spam works on SO. – Justin Dec 14 '09 at 17:45
  • 3
    Security by Obscurity is an awful thing to rely on. Eventually, somebody'll crack it, and then you're screwed. – Phoshi Dec 14 '09 at 18:48
  • 6
    Security through obscurity alone is stupid. However, even banks don't post CAD drawings of their floor plans, vaults security, locations and schedules of officers, location and resolution of each camera, etc. You use good security methods, and then you make it hard for attackers to understand grasp the complete system so they have to work harder to 'win.' Obscurity is NOT security, but providing full details of your security does NOT make you any more secure. Raising the effort for attackers is a good thing. – Adam Davis Dec 14 '09 at 19:39
  • 3
    However, I too am interested, so if you can get Jeff to spill the beans, go right ahead! – Adam Davis Dec 14 '09 at 19:42
1

SO stops spam more through social engineering than technical engineering. Mainly:

  • All links are nofollow, so there's no way to use SO to build PageRank at another site.
  • Ordinary users can earn some moderator privileges, such that there are enough moderators to quickly kill any spam that targets SO users directly.
  • Rate limits on how fast you can post to help keep a spammer from overwhelming the site

The end result is that it's not profitable to spam on SO, and when you take the money out of the picture a spammer will get bored and move on. There's nothing technical stopping a spammer from posting a bunch of junk on SO, but it wouldn't be profitable for them.

|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .