How to Be an Amateur Bot Hunter | Hacker News Reader

How to Be an Amateur Bot Hunter

bellmar.medium.com

95 pointsmbellotti24 comments

"Instagram is actually pretty hostile to security researchers studying their platform. ... Which is unfortunate because Instagram is one of the platforms most useful to bad actors."

Hmm, perhaps those two facts are more related than Belotti's wording suggests.

this, social media platforms really have minimal incentive to ban bots until it starts hurting their bottom line.

I liked to assume destabilising democracies would hurt their bottom line, but reality seems to be the opposite.

I wonder if their thought-process is "if we don't, someone else will". But the fact that Gab, Parlor, et al. haven't gotten significant traction, I think, is proof against that.

Gab preaches to the choir - everyone there is already gone. Parler seems to be something between catastrophe and fraud against its investors.

They don’t differentiate from the dominant players enough to be considered categories on their own, the audience already has the desired views, and they aggressively moderate against conflicting discourse.

Parler was incredibly useful for uncovering the January 6th attack, however.

Eventually some service will take over Facebook and Twitter, but I doubt that it’ll be something that’s so targeted to the far-right.

It isn't until we have proper laws against that, and politicians themselves use these platforms to further their own agenda (if not spread outright misinformation) so it's unlikely to happen. Plus with the control that these platforms nowadays have on public discourse it's likely that any attempt at such a law will have public opinion swayed against it immediately.

kind of. it doesn't look good when all of the top comments on a famous person's posts are all bot spam.

Only if people recognize it as such though

This is true.

Back when I was still on Twitter, I remember folks in the office were having a game to see who had the most bots following them. I guess there was some online form that evaluated the people following you and determined if they were real or not.

I'm sure bots have gotten much better at avoiding detection, but it would be interesting to see if these programs could still ferret them out as real or fake. Likewise, to your point, it would be interesting if the users themselves could tell either.

Maybe also related, I've also found Instagram to be the easiest service to create extra accounts on. Facebook, Google, Twitter, etc all demand phone numbers to create an account, if not immediately than within minutes of opening. They're all set up to make it as hard as possible to use any kind of fake phone number. And all quick on the trigger to ban new accounts if anything looks the least bit odd, or require even more elaborate confirmation and security.

Instagram meanwhile seems to be, just give it an email on any service and a password, and poof you've got a new account. Post away with anything you want, follow and DM anyone, and no bans, locks, or requests for more info. Maybe they'll lock you out if you misbehave enough, but it seems to be actually hard to hit any limits like that without actually doing something they don't like.

Not sure what I do differently. But I do get banned after a few minutes making an Instagram account without phone or Facebook verification.

Not to mention that Instagram is useless for business of not linked to a Facebook acc.

I can't even create an Instagram account with my home IP and real phone number. It says something about suspicious activity...

There is a well funded and well organized COVID-19 misinformation and smear campaign targeted at citizens of the small country I live in. The same is probably true for pretty much any country right now, but in this case we're talking about a target audience of single digit millions with a language that isn't spoken anywhere else.

To make matters worse, this does not seem to be bots but sock puppet accounts and the tweets they put out seem to be written by humans. This campaign has some ties to certain political parties too.

What are some means that I could, as a technical person, assist my journalist friends in digging out some info about these actors and their connections? This article gave some pointers, but did not go into specifics.

I am mostly interested in Twitter activity. The situation is similar on Facebook but I am less interested in that side. Any tools for digging out some Twitter statistics, given a handful of accounts and suspicious tweets to start with?

What makes you believe that what you're observing is a misinformation campaign, and not just the usual crop of zealous conspiracy nuts?

What makes you believe the two aren't overlapping to some degree?

Here is a Guardian article talking about German zealous conspircay nuts organizing a anti-vax protest in Australia: https://www.theguardian.com/australia-news/2021/jul/27/who-b...

Not exactly a bot misinformation campaign, but interesting, thanks.

I think of QAnon types as being a bit muddle-headed. I doubt they're capable of creating a bot campaign. Russia could, but they don't need to: we do it to ourselves.

An Occam/Hanlon's Razor corollary: don't attribute to bots or shills that which idiocy can fully explain.

The Q movement has all the hallmarks of an astroturfing campaign. Don't assume it's just a bunch of idiots.

I wouldn't count that as misinformation; it is sincere advocacy. A misinformation campaign would be organized by intelligency agency for the purpose of weakening another country.

A misinformation campaign is a campaign (=concerted communication effort) to spread misinformation.

Whether the people who spread it know it is in fact misinformation is a different discussion. Whether someone just fed into existing grievances in a clever way another one altogether.

There are some useful idiots in the mix but some of the individuals do it obviously as a full time job. They are also more skilled at it than the average nutcase. It seems to be their job to put the words into the mouths of these conspiracy nuts.

I'm have a suspicion that some of them are funded by an entity backed by a nation state actor. These individuals have connections to some earlier ops whose backing has been revealed.

Build a reputation network.

Don't know how to message users on hackernews, so posting as a reply here hope you don't mind. Saw your comment from 5 years ago about wishing Orbiter was open source. https://news.ycombinator.com/item?id=12943028 The author has now made it open source! https://www.orbiter-forum.com/threads/orbiter-is-now-open-so...

>Don't know how to message users on hackernews, so posting as a reply here

I love this. JWZ eat your heart out!

There's a great resource on the techniques the bots and the bot detectors use, beside rate limiting IP addresses (creepjs is a personal favorite). [1]

[1] https://bot.incolumitas.com/ Expand all Sources/Links under 'More Sources/Information'

Reply on news.ycombinator.com