Human-driven copy-paste spam

Let us know if you’re still seeing this today.

Yes, still seeing it.

For a while it died down, but then we recently increased the post edit time setting from 60 minutes to 24 hours, and within the first day we saw another instance of this edit spam.

6개의 좋아요

We’ve been seeing this on our site, too — or at least the precursor to it. Our users and staff have thus far been pretty quick to notice the out-of-place plagiarized material and flagged the posts as suspicious before the spammer linked spam.

Is this something that could be automated for first posts, though? It’d be great to flag new threads that contain exact copies of existing posts.

1개의 좋아요

Not at the moment, checking one post against the text of literally every other post ever made is .. quite expensive.

Any weird non-sequitur posts from new users should be looked at quite skeptically as a rule. This catches it for me most of the time.

1개의 좋아요

This works well for replies, but not as well for new threads. Since our forum offers support, most new users are asking questions that look fairly similar to other questions that have been asked (and sometimes the questions are copied from other sites, like reddit, though a lot are also copied from our own site).

4개의 좋아요

Yeah those are viciously hard to pin down. Have seen a few of them myself on a different Discourse.

Are they exact copies, or modified in any way?

1개의 좋아요

In our case, the body has been near-exact copies. Frequently formatting is lost, but not always. Sometimes it’s just been a portion of the post. They’ve also always been new threads. The title, for some reason, has sometimes been the same and sometimes it’s inexplicably been the original title with the word “name” appended to the end. I agree that this seems human driven — I think someone is actually control-c, control-v’ing it in manually, and this process is lossy. So no, a simple hash check isn’t gonna work in nearly all cases.

We have yet to see this scheme actually come to fruition, whatever that is. In one case we missed a post for 14 days and it never got followed up on. I found it through a shared IP with another account doing the same thing. We also have our spam settings dialed way down because, even with these odd posts, we almost never have any actual spam. TL0s can post outbound links and images immediately. They can edit posts. So why the charade? It’s all very strange.

Edit: ah, the charade is because they not only dodge the automatic spam filter, but they also dodge eyeballs (and flags) from the active community since edits don’t bump the topic unless it’s also the most recent post. Thus to be effective, they not only need to look innocuous, they need to garner a reply.

2개의 좋아요

Same as Matt, ours are mostly exact but commonly with some lost formatting or a subset of the post. We see this type of spam mostly on new threads, but also some off-topic replies on existing threads.

4개의 좋아요

I can’t remember the details, but I believe they sometimes modified the links or URLs that were contained in the original posts, too. I assume it was to work around the new poster link limits, and because nobody wants to spam someone else’s website.

(They’d modify the original links even more when editing the spam in later.)

(Edit: Three Matts!)

4개의 좋아요

Good news! We added a feature to help with this – lower trust levels have less time to edit posts. That should help mitigate the editing-related shenanigans.

As you can see, TL0 and TL1 users are limited to 1 day of edit time by default now @jsha @mnordhoff and @mbauman – you may want to ratchet that down that even further.

12개의 좋아요

Thank you! I’ve also modified a Data Explorer query to provide a nice table of “stale edits” that admins can occasionally review:

SELECT
    p.id AS post_id,
    p.updated_at,
    (p.updated_at - p.created_at) AS staleness,
    u.trust_level,
    (p.cooked LIKE '%href%') AS has_links
FROM posts p
    JOIN users u
        ON u.id = p.user_id
    JOIN topics t
        ON t.id = p.topic_id
WHERE p.last_editor_id = p.user_id
    AND p.self_edits > 0
    AND (p.updated_at - p.created_at) > INTERVAL '1 Day'
    AND p.deleted_at IS NULL
    AND t.deleted_at IS NULL
    AND t.archetype = 'regular'
ORDER BY p.updated_at DESC
LIMIT 500
6개의 좋아요

정말 멋진 소식입니다! 감사합니다. 저희는 "게시글 수정 시간 제한"을 1일(1440분)로 늘렸고, 당분간 이 설정을 유지할 것입니다. 하지만 방금 "tl2 게시글 수정 시간 제한"을 30일(43200분)로 늘렸으니, 이는 활동적인 사용자들에게 훨씬 나은 환경을 제공할 것입니다. Discourse 팀이 이 부분에 기울인 노력과 고민에 진심으로 감사드립니다.

8개의 좋아요

훌륭합니다! 진행 상황을 알려주세요. TL2 이상 버전에는 별도의 설정이 있으므로, 기본 편집 한도를 1일보다 더 짧게 줄이는 것도 고려해 볼 수 있을 것 같습니다.

7개의 좋아요

Where 절에 다음 줄을 추가하는 것을 제안합니다:

    AND p.cooked ~ 'href="http[s]?://'

이 조건은 링크를 포함하는 게시물만 검색합니다. 이 유형의 스팸의 특징 중 하나는 링크를 포함하는 것입니다.

2개의 좋아요

흥미로운 점은 스팸을 검토할 수 있는 "stale edits"를 검색하는 데이터 탐색기 쿼리가 있다는 것입니다. 해당 쿼리를 확인해 보았지만, 메타에서 명백히 문제가 있는 내용은 찾지 못했습니다. 이 쿼리는 이미 링크를 고려하고 있습니다.

현재 AI 스팸 탐지 기능이 있습니다. 강력히 추천합니다!

1개의 좋아요