Hacker News Reader

Comment by marginalia_nu | Hacker News Reader

Botspam killed blog comments, same way it killed discussion boards. Even if it's not link spam, the bots are using comment fields for C&C for botnets.

Besides that, I think there is a point in removing comments and interactivity in general. They hardly ever invite any interesting discussion. Comments are generally impersonal and low effort and invite a lot of shitty behavior.

If you have something substantive to say, respond in a blog post of your own.

If you have something personal to say, send an email. This is scary and intimate, but also permits you to actually talk to a person without the performative aspect of doing it in public.

View on HN

> Botspam killed blog comments, same way it killed discussion boards.

The discussion boards I'm on that are still active do not have a spam problem. The usual methods of limiting new accounts and giving established accounts a bit of moderation power (e.g. several accounts flagging a post as spam hides it from other users) seems to be sufficient as long as the traffic is there.

I think the bigger problem in most cases is that people have left for more centralized platforms because the barrier to entry is lower, or some parts of the user experience are better. One part of the UX that centralized platforms do better is allowing users to get updates on more conversations in one place. Polling a large number of sites gets annoying, and email is not a great notification system (web push notifications are improving this).

More federated systems could help here, though I haven't been especially impressed with Matrix or ActivityPub-based social networking so far.

Why doesn’t HN have botspam then?

Larger forums like HN and Reddit have the economies of scale on their side. They have a lot more time and money to throw on solving the problem than a blogger or someone who runs a phpBB-forum as a hobby.

> They have a lot more time and money to throw on solving the problem

No, they get others to do it

Traffic + downvotes. A blog may have downvotes but not the human traffic to utilize them

Beyond downvotes. there's flagging. It doesn't take many flags from higher-karma accounts to kill a comment from a new account, nor does it take many killed comments to shadowban a new account.

To protect against false positives, accounts with enough karma can vouch for dead comments to bring them back to life.

HN have a different approach. Here in HN, new accounts are restricted to comments only, the restriction will slowly remove as the account get older and have amble "karma" (sorry, I am not sure what term for here in HN) then they will gain the ability to vote later on.

Also HN prevents people from voting on parent comments if they respond to it. So if they commented it, then it is considered as voted. If they up/downvote the comment and then posted a response to that, HN automatically replace the vote to comment response.

I like this approach because it is a great way to have engaging discussion than trying to drive meaningless and irrelevant comments as top comments.

HN has @dang!

> Even if it's not link spam, the bots are using comment fields for C&C for botnets

Any examples of this that aren’t just PoCs?

It's very hard to actually demonstrate without a doubt, but a lot of the blog spam you see basically has a very clear numbers station vibe. No links, just fairly obviously machine generated word salad.

It should be as easy as linking a malware sample, no?

I think the spam you’re referring to is usually targeting the “Website” field of Wordpress comments, which turns the username of the commenter into a hyperlink.

I can absolutely confirm that as a thing, but I can't confirm my employment history.

How do you use comment fields for a botnet?

Hosts can check a specific URL for instructions, which can be in the form of a blog comment

Reply on news.ycombinator.com