48

After a couple of years - most of the profiles that were getting my goat have been herded away from the sites I moderate. There's probably many more left and I'm looking at thwarting them in many different ways.

I suspect that 'traditional' spam lasts such a short time here thanks to community spam removal initiatives that spammers have switched to profile spam and that these spammers seem to 'only' log in twice - once to spam, once to check I presume.

While SE's generally been about low barriers to entry, I feel like a small investment in time to a site - to have any reputation at all would mean these fly by night spammers can't simply code a bot (or hire a human equivalent). I'd suggest we leave the "copy to all sites" option enabled, so you'd only need to get the reputation on one site, which feels none onerous.

It doesn't make the spammers go away, and we are going to get username spam. It does reduce the overall value of a spam profile. We can deal with username spam - At the moment I'm checking my sites about once a week and it seems good enough to keep these in check. It's been discussed here in general, but now that I've got a workflow that works well enough at dealing with the ones that got in - I'd like a way to make life interesting for the ones that aren't in yet, or are more difficult to find.

11
  • 16
    Since spammers aim to get the maximum visibility of what they post, I would start with making a low-reputation user profile visible only to logged-in users. This would stop a search engine from getting the list of their posts from the user profile.
    – apaderno
    Feb 5, 2022 at 10:09
  • Even better, make the posts from low-reputation users visible only to logged-in users.
    – apaderno
    Feb 5, 2022 at 10:21
  • I apologize for my first two comments if they are/seem off-topic or unrelated: I commented about which users should have their user profiles visible and which users should be able to see them; the latter comment suggested to extend the profile visibility also to their posts. Doing both could avoid spammers get their posts visible to search engines. They won't stop users who use the display name as way to spam, though. For that, Stack Exchange sites should show a generic display name for low-reputation user profiles, which isn't something I would suggest.
    – apaderno
    Feb 5, 2022 at 13:51
  • Display name as spam is semi trivial to deal with. I've been using the username search to find spammers and it's been fairly low effort past the initial backlog Feb 5, 2022 at 14:00
  • 13
    I'm pretty sure we have discussed this before but it was rejected because of the developer story (users needed publicly visible profiles because that feature is useless without). Now that it's going away, maybe hiding 1-rep profile info could be revisited...
    – animuson StaffMod
    Feb 5, 2022 at 16:54
  • 2
    @apaderno Make posts from low-reputation users visible only to logged-in users? No, that is a terrible idea. If such a post is spam, we already have a system for getting rid of it, which, in my experience, is highly effective (on the rare occasion I see a spam post, I am lucky if I can get my mouse pointer to the flag button before the post disappears). If such a post is not spam, why hide it? Arbitrarily hiding posts is confusing. Feb 6, 2022 at 12:06
  • @BrianDrake That is true on Stack Overflow, not on smaller Stack Exchange sites. I have also seen old links that became spam links just because the site changed owner and purpose; on small sites, those posts would be flagged very hardly.
    – apaderno
    Feb 6, 2022 at 18:54
  • @animuson Do you mean the developer story is going away?
    – apaderno
    Feb 6, 2022 at 19:32
  • 1
    Basically the whole jobs product is meta.stackoverflow.com/questions/415293/… Feb 6, 2022 at 19:39
  • I don't understand how you envision this would work. If I try to click on a one-rep user's profile, what happens? I get an error page?
    – TylerH
    Feb 14, 2022 at 14:20
  • Lock out the editing option.Alternatively just have it blank, as if nothing was there, until any rep is earned.. The user would see it, but with a small notice explaining the profile is hidden Feb 14, 2022 at 14:23

8 Answers 8

17

I feel we could pick either of two reputation levels where setting an about me could tie in.

5 reputation - This reputation level allows you the most basic interactions besides asking and answering, namely participation on a sites meta, and commenting on others' posts (on Meta sites).

It requires 2 suggested edits to be accepted, or one upvote on a post to reach this level.

or

10 reputation - This reputation level removes the new user restriction, which makes users able to post more links and inline images, the later ofcourse is also a protection against spam.

It requires 1 upvote on a post or 5 suggested edits to be accepted to reach this level.

In conclusion it boils down to how much of a barrier we want to be put in place. I think 5 reputation could be sufficient, as that requires some form of positive contribution to the site, which isn't something most of the spammers are willing to invest in.

3
  • 7
    I'm fine with even a 3 rep minimum. 5 seems fine too Feb 5, 2022 at 8:56
  • 2
    That would be fine too @JourneymanGeek, but adding another privilege level just for that feels a bit too much.
    – Luuklag
    Feb 5, 2022 at 9:41
  • 10
    Since there is already the remove new user restrictions privilege, I would use its reputation (10), instead of 5.
    – apaderno
    Feb 5, 2022 at 10:16
3

I suppose it would be safe to have the minimum reputation of "more than 1" to unlock the full profile editing feature. So, for example, an accepted edit can unlock it. Or even asking a question and accepting an answer. Or any upvote.

Although, I feel maybe rep is golden hammer-shaped. What the positive reputation means is that the user has had positive interaction with the site. For example, they have made an edit, or have asked a non-spam answerable question.

I do not like tying privileges to reputation because it is not very meaningful and only rewards one type of behaviour. Yes, that is how almost all extra features on the sites work, however, it might be time to look beyond reputation.

Therefore, my suggestion is to unlock the edit feature after a user has interacted with the site in a way that shows they are not a spammer. Accepted edits do count here. An example of non-reputation based interaction would be asking a question which is not flagged and removed as spam within X amount of time. 24 hours seems appropriate (spam content tends to last a lot less than that) but it can be adjusted as needed.

With this approach, there is no need to go for rep hunting just to unlock a minor feature on the site. The barrier to entry is lowered, yet for spammers it remains relatively high.

6
  • 1
    Well - I'd say 'any' meaningful interaction. Rep is 'cheap', and simple to suggest. I guess a badge like trigger could work - or the trigger for specific badges like teacher,student or editor. Feb 5, 2022 at 9:19
  • 2
    How about people that post what appears to be a legitimate question and come back a day later to edit in a spamlink, you'd be amazed how often that happens.
    – Luuklag
    Feb 5, 2022 at 9:43
  • 2
    In which case they're forced to post, edit, and then get flagged. It goes from low effort to some effort, and that increases the work they need to do and puts them on the radar. Then we can smash em like a potato. Seems like a net win. Feb 5, 2022 at 9:53
  • @Luuklag yes, that already happens. What's the issue, then? It does get detected very often. Because you're aware of it. Proceed exactly as now - flag, nuke, no more spam in the profile.
    – VLAZ
    Feb 5, 2022 at 10:20
  • 2
    There's no way to flag a post without a post, or to search inside profiles. My current workflow is by usernames, and that used to be several thousand users a site on both sites I mod Feb 5, 2022 at 10:23
  • 1
    I've locked the comments on this cause they got heated. I'd recommend the folks involved take a breather . Feb 5, 2022 at 12:34
3

I upvoted as I agree these profiles need less visibility, but I still have concerns about hiding new user profiles completely. It needs to be done with care.

When a new user posts something suspicious, I often look at their profile to help determine if it's spam. In fact I just came here after doing just that. An answer was posted along these lines:

Q: What's the name of this manga?

A: This is my favorite manga: [link 1] [link 2]

A poor answer yes, a non-answer yes, but is it spam?

Believe it or not but link 1 was to their favorite manga (I assume), on a reputable site. Link 2 was spam, but I could only definitely tell that because it was plastered over their profile, where they admitted they were a contributor.

By all means filter "new users" (the list) and "recent badges", or even prevent 1 rep profiles from being viewed when you're completely logged out. Just don't hide the information a flagger needs to do their job. (The same goes especially for moderators, even on sites they don't have a diamond on.)

3

Seems a valid alternative. As I said in the chat when this was discussed some days ago, another option is to lock the profile editing privilege (setting the "about me" info) behind a minimal reputation requirement - let's say just 5 or 10 rep point. That way you still lock out spammers from being able to use the user profile about me field to promote inappropriate services, while standard users should feel almost no difference.

That said, browsing the answers here show that some users still have concern with both proposals. Therefore, I will also reference for sake of visibility another option that was suggested in the past: preventing user profiles for being indexed by search engines and - optionally - hide them completely from anonymous users.

See also Shog comment back then:

This is definitely a good approach. Based on what I've seen in the past, these groups are using search engines as their proof of work - so if they can't get the pages they've spammed into Google, they're not gonna get paid. That's eventually gonna make this a waste of time no matter how cheaply they're able to post it - but if we also take steps to make it more expensive (that is, more tedious: IP-blocks / rate-limits, content checks, automated account deletions would all slow them down to a degree) then we may actually discourage further abuse

2

I think the first step here should be to figure out what the purpose of any measures against profile spam is. Profile spam has very low visibility, it's almost entirely irrelevant. Users that don't post don't get their profile linked on any question or answer, and search engines don't index these profiles as far as I remember.

The only places I can think of that expose profile spam are

  • the users list when going to "new users" and sorting by date
  • autobiographer badges in the "recent badges" sidebar

These are really obscure places, I strongly doubt that the vast majority of users ever looks at them. So a typical user will almost never encounter any spam profiles while using the site.

It's still a bit untidy to leave them around, and it does give a bad impression of the site if someone actually manages to navigate to the new users list sorted by date if most of them are obviously spam. But I would also really expand the problem here in that not only the profile is the issue here, but spammy user names as well. The names are always visible one step earlier than the profiles.

So while I don't think it's worth spending much effort on this because this is not very visible, I do think that some measures might be possible here. The big problem is that I don't think it's reasonable to just bump up the rep threshold for editing the profile. SE wants users to engage with the site and fill out that profile, putting roadblocks in here is likely to reduce engagement. And I think that would be a reasonable stance, SE is weird enough about hiding abilites behind rep and I don't think we should make that worse. Spam profiles are such a minor issues that I would not consider this enough justification to interfere with the new user experience like this.

Hiding the profile information without telling the user about it would also be weird, asking the user to put effort into something that isn't shown at all. I still think the least invasive version would simply be to make new users without any participation on the site even less visible than they're now. Don't show their autobiographer badges and change the users page so that you won't see those users there. There still can be mod or 10k tools to view all users, but in the end the user profiles and names don't matter if you can't reach the from the main site.

1
  • 2
    Well - usernames is a different problem, and one I don't have a solution other than periodic obliteration Feb 5, 2022 at 19:57
0

Maybe something could be added so people can't do anything except edit, ask questions or answer unless they have at least one upvoted question/answer... but it feels wrong somehow.

If it's possible to block phone numbers on profile pages, that might work, but it would crash some people's About Me pages as well.

1
  • 8
    Well - the wrong somehow is a combination of assuming the best intentions of a new user, and SE's general philosophy of letting folks engage fully from the moment they find the site, even without an account. I feel like its not working. We got phone numbers after we blocked websites. Rather than playing whackamole with the next silly thing spammers try, I feel like its better to take away the value of spamming by removing their ability to spam. Feb 5, 2022 at 8:17
-2

Minority opinion here. I don't want a few spammers to cause about 99% of the users to suffer, or have fewer privileges.

That's just not fair. Most users sit with 1 rep, and that's fine. Such a sudden and major change won't be fair for them.

I prefer the users to keep their privileges, and find other ways to fight spam. Maybe a list of bad words in profiles, that when present will raise auto flag, but that's off-topic in this question, and it might be worth starting a "How can we detect spammers and nuke them faster?" discussion.

5
  • 7
    That's the counterargument - that new users can't immediately fill out their profiles and have to actually do something on the site. I'm not sure how to pull out statistics on userprofiles tho Feb 5, 2022 at 9:52
  • 7
    I'm in favour of restricting the customisation on the profile. Users can sit on 1 rep all they want. Maybe they can even add their GitHub repo and set an avatar. It's mostly the bio that's a problem. Well, and a link to website/username but less of an issue.
    – VLAZ
    Feb 5, 2022 at 10:23
  • @JourneymanGeek that's true, maybe worth asking a CM/dev for help with stats. :) Feb 5, 2022 at 16:52
  • @VLAZ doesn't matter, think of employee. It's like taking away some benefits the employee has, out of the blue, even if minor benefits. Feb 5, 2022 at 16:52
  • I think it would be useful to have some actual data here too– is filling out the about me actually a valuable privilege to new users? How many active single rep accounts have an about me?
    – zcoop98
    Feb 7, 2022 at 16:30
-6

Perhaps it's time to re-examine: "Why does reputation start at 1, and have a lower bound of 1?".

  • The negative reputation should be limited to a maximum of -5.

  • The downvotes should be divided by 5 (20 on metas) when applied to calculate a negative result. Example 13 total downvotes (loss of 26) would show as -5 if they never had a positive contribution, and one upvote would get you out of the hole.

  • A user with all posts downvoted, but less than -5 total, would show as zero.

  • Suspended users would have a red colored 1 reputation, which distinguishes them from other reputation 1 users without having to check the profile.

I don't object to different numbers above, that's just a suggestion; and a limit to how far we express our displeasure.

The negative reputation profile could cause information to be added to the new user banner prompting people to assist the poor person with a helpful comment or to report a user who is obviously not here to help or be helped.

It could also cause a caution banner for the user, with helpful links to read about providing better answers or asking better questions; much like the result of a "not helpful" flag cautions the user next time they flag, and asks them to review their prior flag.

This would help both the user to avoid a question and answer ban (a common complaint) and to highlight problem accounts, allowing quicker identification and flagging. The ability to have the user profile visible to search engines and for links and images to show only to logged in users would both prevent spamming and increase positive participation.

7
  • 1
    Surely, that would provide even more encouragement for people to delete their account and start again and that means it's harder for them to get out of question bans since they lose control of their previous questions. Feb 5, 2022 at 15:51
  • 1
    @RobertLongson - It’s trivial to identify users recreating their profile to ask similar questions. If they got question banned once it will happen again. Writing styles are so easy to identify
    – Ramhound
    Feb 5, 2022 at 16:07
  • 1
    @Ramhound sure but that's not the point, we'll get more people doing something they think helps them but actually makes things worse. Feb 5, 2022 at 16:09
  • 1
    @RobertLongson - When a user matching a certain criteria, hits the delete button on their account, they should be warned of the ramifications of deleting their contributions.
    – Ramhound
    Feb 5, 2022 at 16:13
  • Robert, not only would the helpful links explain that but the supportive comments offering advice to improve legitimate efforts would avoid that problem; as explained in my suggestion above. --- There's other posts at MSE have called for people not to pile-on the downvotes. --- There's a limit to how detailed an explanation can be and how much will be absorbed. Reputation to participate has previously been discussed many times, if someone won't accept free help they probably won't offer free help to obtain enough reputation to be able to fill out their profile; obtain a semblance of belonging.
    – Rob
    Feb 5, 2022 at 16:25
  • 1
    This doesn't do anything for profile spam. These spammers don't do anything other than edit their profile. You can't downvote someone without posts.
    – Laurel
    Feb 5, 2022 at 21:58
  • @Laurel, as you can see from the last time JG asked this identical question, there's a link to Tim's post that says that without reputation spam profiles are very limited. --- So it's a matter of making them stand out and encouraging the appropriate actions, help those who deserve it and flag accounts created solely for the purpose of advertising or trolling. --- Profiles that link to nowhere have to be actively sought out for anyone to see them, and there's no clickable links to follow.
    – Rob
    Feb 5, 2022 at 22:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .