AI bots infiltrating the forum - reply or just click on 'report'?

[plancashire]

Thanks for the discussion. I'll report anything suspicious I see. I haven't noticed anything yet.

Added 2 seconds later: I saw this split thread because I had contributed to its parent. It confused me as the notification still had the original thread title, as do some contributions here, but the top post has a new title. Is there a way to make this less confusing?

[slowster]

I saw this split thread because I had contributed to its parent. It confused me as the notification still had the original thread title, as do some contributions here, but the top post has a new title. Is there a way to make this less confusing?

I've amended the remaining posts which still had the title of the original thread. As far as I am aware I cannot do anything about what title appears in your notifications, or about the fact that you are getting notifications for this split-off thread.

[plancashire]

I saw this split thread because I had contributed to its parent. It confused me as the notification still had the original thread title, as do some contributions here, but the top post has a new title. Is there a way to make this less confusing?

I've amended the remaining posts which still had the title of the original thread. As far as I am aware I cannot do anything about what title appears in your notifications, or about the fact that you are getting notifications for this split-off thread.

Thanks.

[Cowsham]

Are there any tools or processes that can be used by the administrators to weed out the bots before they get approved to the forum or is that impossible to do? ( I'm assuming it's not an automatic process. )

I happen to know these bots have been around in a sophisticated form for at least the last 6 years so by now it'll be getting near impossible to tell what is human and what is not.

[Vorpal]

Are there any tools or processes that can be used by the administrators to weed out the bots before they get approved to the forum or is that impossible to do? ( I'm assuming it's not an automatic process. )

I happen to know these bots have been around in a sophisticated form for at least the last 6 years so by now it'll be getting near impossible to tell what is human and what is not.

There are a number of tools available to us. A few are automated, such as blocking IP addresses. Others are solely manual. But I would say that we get 99.99% of them using a combination of approaches. I don't keep statistics. admin might have them.

The spammers/bots who make it onto the forum are the ones that are generally the hardest to catch.

As slowster said, we are not posting all of our secrets here That would be like handing out a template for how to get around them.

[Cugel]

As slowster said, we are not posting all of our secrets here That would be like handing out a template for how to get around them.

That's "security by obscurity" which is the least effective method of keeping things secure. "The thiefses won't steal my precious because they don't know where the door to the hoard-place is". The thiefses will explore until they find it.

Good security tools are good because they're hard to defeat. They're also a good deterrent if they can be clearly seen as such by would-be thiefses, who will go elsewhere.

[Vorpal]

As slowster said, we are not posting all of our secrets here That would be like handing out a template for how to get around them.

That's "security by obscurity" which is the least effective method of keeping things secure. "The thiefses won't steal my precious because they don't know where the door to the hoard-place is". The thiefses will explore until they find it.

Good security tools are good because they're hard to defeat. They're also a good deterrent if they can be clearly seen as such by would-be thiefses, who will go elsewhere.

Well, spammers & bots aren't the only folks who want to know what deterrents are in place.

[Jdsk]

Dear Moderators

Thanks for describing those policies. They look sensible and are pretty similar to what we use on other sites which I help to manage and moderate.

For posters I totally support reporting rather than responding and opening issues in Using the Forum rather than the existing thread.

Jonathan

[slowster]

All new members must have their first post approved by a moderator. According to the Moderator Logs, of ~26,100 first posts since 2013, ~9,200 have been disapproved. So on average 35% of first posts do not get approved. In the past I think a majority of those will have been simple obvious spam. We still get those, but I think they are less common than they used to be.

As DevonDamo notes, some 'spammers' will try to access to the forum by composing a seemingly genuine first post, and if that gets approved they will edit their post(s) later to add a spam link. The number of those is small, as you can probably appreciate: how often do you come across a spam link embedded in a post?

So it's not a major problem, certainly not currently. But keeping it like that takes moderators' time and care when vetting first posts. Inevitably the odd one will slip through occasionally (or an account will get hacked - viewtopic.php?t=160154). When that happens, it is likely to be a member that first gets suspicions of the new poster: moderators do not have the time to keep an eye on every new member.

[Cowsham]

Are there any tools or processes that can be used by the administrators to weed out the bots before they get approved to the forum or is that impossible to do? ( I'm assuming it's not an automatic process. )

I happen to know these bots have been around in a sophisticated form for at least the last 6 years so by now it'll be getting near impossible to tell what is human and what is not.

There are a number of tools available to us. A few are automated, such as blocking IP addresses. Others are solely manual. But I would say that we get 99.99% of them using a combination of approaches. I don't keep statistics. admin might have them.

The spammers/bots who make it onto the forum are the ones that are generally the hardest to catch.

As slowster said, we are not posting all of our secrets here That would be like handing out a template for how to get around them.

Completely agree - and good to know new users are not just routinely approved.

[Psamathe]

I assume that Spammers and BOTs main aims are to get to post links to whatever web sites or scams they are currently trying.

Might be a bit of a customisation of phpBB which I know admin hates/resists (for valid reasons) but, whilst 1st post needs to be approved why not add the (automated) constraint that no links in posts or signatures until eg 30 posts made. Most BOTs/spammers would be spotted within eg 30 posts (or 20 or 50 or whatever).

Links to external info can be useful but for new members I'm sure they'll survive without such functionality until they've participated for a bit.

Ian

[plancashire]

I assume that Spammers and BOTs main aims are to get to post links to whatever web sites or scams they are currently trying.

Might be a bit of a customisation of phpBB which I know admin hates/resists (for valid reasons) but, whilst 1st post needs to be approved why not add the (automated) constraint that no links in posts or signatures until eg 30 posts made. Most BOTs/spammers would be spotted within eg 30 posts (or 20 or 50 or whatever).

Links to external info can be useful but for new members I'm sure they'll survive without such functionality until they've participated for a bit.

Ian

A very similar rule exists for nebenan.de, which is similar I believe to nextdoor.co.uk. There is a time delay after joining before you can post links. I know this because I tried to post one and a message popped up. If you never try you would never know.

I do not know much about how nebenan.de is moderated, but in my experience the content is exactly what it should be: neighbour chat. The standard is similar to here. Well done both teams of moderators!

[rareposter]

To make sense of the 5 posts above, you'd need to read them along with the other now-split-off thread - see link in first post. The specific issue on this occasion is a user posting stuff which may well be AI-generated. This isn't a threat in itself, but the internet is being overwhelmed with 'bot' accounts that use AI to blend in, before dropping their 'payload', i.e. links which are either spam or IT security threats. Obviously, with AI becoming so convincing, it's hard to spot this, so here's what caught my eye about this user:

- They posted 'vanilla' content, i.e. on-topic, but really doesn't add anything that you couldn't find from a quick Google search.
- They made a few gross mistakes, e.g. recommending a product which has absolutely nothing to do with the initial query.
- Their brief post history consisted of nothing but the above.

I don't doubt that some of the stuff on here is AI generated / bots / spammers but actually my LBS gets emailed questions like that on a near-daily basis and I've experienced it when working in shops too.

Examples:
My hydrolic dik breaks have stopped working, can you fix them? (that was an email to my LBS, written in that exact spelling)
The wheel has stopped turning, what's wrong with it?
Do you stock brake pads? (there followed an in-depth discussion about which brakes ("err...they're on a road bike"), which bike, what brakes (err, it's a green bike with silver brakes")...

They're vanilla questions precisely because you can't really google that and many people don't understand the options anyway. They want a simple answer like "yes I can fix your hydraulic disc brakes" but what they get is an email back saying:
what bike, what brakes, what is actually wrong with them, how much are you willing to spend?

I've made this point before - most people have NO knowledge whatsoever of the workings of their bike. They'll ask a simple question (cos bikes are simple, right?!) on here, presumably having stumbled across it via said internet search and the Forum Nerds leap into action and start talking about efficiencies and how the OP should just make their own [thing] or effect their own repair using nothing more than epoxy resin and some tools they can knock up from spare bits of rod and bolts and why these tyres are 0.1W faster than those, how they should keep a detailed spreadsheet of their bike kit... And within that will be tangents of complete uselessness as the thread veers off into a sub-topic.

And the average punter asking the average question wonders what kind of hell hole they've wandered into and disappears sharpish, never to return.

The actual answer to most posts of that nature on here should be:
Go to a reputable bike shop.

With a strong side order of understanding that most people don't know a bearing from a bushing, many people don't even know if they have rim or disc brakes, no-one understands that LH pedals unscrew clockwise (this is laughably common in my LBS - "I got this one off fine but this side is really stuck!" - 8 seconds and a long wrench later the mechanic has turned the pedal the correct way and freed it), vanishingly few people have the slightest clue about how many gears they have and the ratios and absolutely no-one cares about cross chaining (other than occasional questions in a shop going "my gears make a funny sound when I pedal, what's wrong?")

Excellent thread by DevonDamo though, it really needs to be somewhere a lot more prominent than down here - up on the main board with a "before you answer a question, have a read of this..." title.

[DevonDamo]

They're vanilla questions...

Thanks for that. I know what you're referring to regarding vanilla questions, as that's another bugbear of mine, i.e. new users who register to post one pointless question and are then never to be seen again despite pages and pages of helpful replies from the rather-too-credulous regulars. My assumption here is that either (1) there's a delay in the way that new users' posts are approved and published, resulting in them giving up and moving on to Google or another forum or (2) they're just bad internet users who don't understand when Google is the most appropriate source. I don't, however, think these posts are malicious - I just find it frustrating that users continue to reply to them long after it's obvious they were never coming back!

However, the specific content I flagged up in this thread is a completely different animal. It wasn't posing questions - it was giving answers. And although those answers were superficially on-topic, if you actually think about the content you quickly realise that it's too bland and pointless for a thinking human to have posted. Then you have the other issues in my list, e.g. the 'gross error....' In this case, a user was asking for advice on mounting a kickstand, and the AI bot recommended a chain guard. This was manufactured by a company which also manufactures kickstands, and that's the type of mistake an AI bot would make but a thinking human wouldn't.

(By the way, despite all these discussions, the bot in question is still amongst us, continuing to post content. That's why my response will continue to be these occasional heads-up posts. I don't subscribe to the idea that relying on a small group of clued-up users is the most effective strategy. Far better to do what other younger, more tech-savvy forums do, and have a bit of public fun with the bots. This helps bring the whole forum up to speed to the point that any dodgy posts are always greeted with a broadside of sarcasm and memes.)

[Jdsk]

I don't subscribe to the idea that relying on a small group of clued-up users is the most effective strategy. Far better to do what other younger, more tech-savvy forums do, and have a bit of public fun with the bots. This helps bring the whole forum up to speed to the point that any dodgy posts are always greeted with a broadside of sarcasm and memes.

I don't think that anyone has proposed relying on that. It's only a useful tool along with other useful tools.

But I totally disagree about piling in with sarcasm and the like. Because some posters' thresholds are far too low, and it's doing enough harm to the good manners of the forum already. Much better to leave any forceful intervention to the Moderators.

Jonathan