51

While testing an answer to What happens to pending flags when an account is deleted?, I discovered something else: it's possible to serially downvote a single post using only one account.

Steps to reproduce:

  1. Have an account with enough reputation to qualify for the association bonus but no other activity on the site where you want to perform this trick (this is necessary for immediate account deletion in step 4).
  2. Join the community (if you didn't do so already).
  3. Cast a spam flag on a post.
  4. Delete your account. This will remove the pending flag, but not the implicit downvote by the Community user.
  5. Repeat steps 2 to 4.

Using a sockpuppet I did this on one of my posts on Chess Stack Exchange:

enter image description here

Since all flags have been resolved:

enter image description here

there is no option in the mod menu to clear spam flags (which would dispute them and AFAIK remove the implicit downvotes):

enter image description here

The serial voting reversal script won't detect and repair this case, which is consistent with it not reversing six Community-owned downvotes on real spam posts. The daily reputation recalculation doesn't seem to fix it either.

Improve this question
11
  • 4. Delete your account. Doesn't this step require action by the moderation team? Or is it different if the account is brand new(ly associated)?
    – Frédéric Hamidi
    Nov 4, 2019 at 14:52
  • 11
    If you have never posted or voted more than once on your profile, your account will be immediately deleted. (from the FAQ)
    – Glorfindel Mod
    Nov 4, 2019 at 14:53
  • Good chance daily rep recalc will take care of this and get rid of those "zombie" votes, so worth waiting a day and see how big the bug is. :)
    – Shadow Wizard Is Sad And Angry
    Nov 4, 2019 at 14:54
  • @Glorfindel, thanks for the heads-up. I'm not familiar with that part of the FAQ for some reason.
    – Frédéric Hamidi
    Nov 4, 2019 at 14:55
  • 5
    @ShadowThePrincessWizard it doesn't, see the self-inflicted downvote on October 30th: chess.stackexchange.com/users/7297/glorfindel?tab=reputation
    – Glorfindel Mod
    Nov 4, 2019 at 14:56
  • So, what happens if you do this 6 times? Is the post going to be deleted as spam?
    – double-beep
    Nov 4, 2019 at 15:04
  • 1
    @double-beep-ReinstateMonica no; that depends on the flags, and those are cancelled.
    – Glorfindel Mod
    Nov 4, 2019 at 15:05
  • 2
    This is too old to say it applies today, but this is current: "If mass voting continues to happen between two certain IP addresses (voting each other up) or from a single user, ... Every night around 03:00 UTC, a voting fraud detection script is run ... Even if all the posts are flagged and further removed, some time later one can find a series of +1 undownvote entries in their reputation history marked by the time when ...".
    – Rob
    Nov 4, 2019 at 15:12
  • 21
    Gotta give a hat tip to the science here! And a few aspirin to the person on bug duty.
    – Tim Post
    Nov 4, 2019 at 15:47
  • 3
    Now the real question is: can you get the community user vote-banned (for serial voting) this way? :thinking:
    – Draco18s no longer trusts SE
    Nov 5, 2019 at 0:16
  • @Draco18s there is no auto vote ban, just serial votes removal. And yeah, good chance that enough of those will cause the auto removal script to remove them all. :)
    – Shadow Wizard Is Sad And Angry
    Nov 5, 2019 at 11:39

1 Answer 1

Reset to default
14

Yeah, good catch - thanks for the report, Glorfindel!

This fortunately hasn't been abused much - I found 102 votes across the network that should've been removed. I've removed them. That includes the votes on your Chess answer.

After the next build, these will automatically be removed along with the pending flags when a user is deleted. Reputation will be corrected immediately, and post scores will be rectified daily. This should effectively limit griefing and other forms of abuse that were possible here.

Improve this answer
3
  • 1
    Might as well require the user to wait 24 hours to delete their account if they've cast flags, so as to make this type of abuse easier to catch by moderators.
    – Sonic the Anonymous Hedgehog
    Jan 7, 2020 at 21:56
  • 1
    In this particular case, that wouldn't necessarily help. One could conceivably request deletion, then wait 24 hours and flag stuff, leaving moderators with less than an hour to dismiss the flags. That's why I was careful to do the invalidation during deletion.
    – Shog9
    Jan 7, 2020 at 22:00
  • Yeah, that should be in addition to, not instead of, this. But in any case, requiring the 24-hour wait time in many more (or all) cases would make more types of abuse by account deletion much harder to get away with and reduce cases of it.
    – Sonic the Anonymous Hedgehog
    Jan 7, 2020 at 22:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .