Ask HN: Is Hacker News under attack from spam bots?
Seeing a lot of spam comments in the last few minutes from accounts that all have similar names. Omitting name since it is NSFW.
Hopefully we don't see a 'Show HN: I created a spam bot service to advertise on every HN post' soon.
Claimed at the time to be working on HN support
The usernames of the spammers are "2genders<number>", "SEXMCNIGGA<number>", and "indianmilf<number>"; for some strange reason they keep the same prefix and just alter the number so it should be easy for admins to block them. Some of them are posting Twitter links as well.
Anyone from Cloudflare or Supabase care to remove your abusive customer? Also reported.
If I were a competitor to the linked account and wanted to cause then damage, I could run a bot campaign purporting to be from them in order to get them kicked off their provider.
Anyone who does business with this outfit has it coming.
Also the comments all seem to end with a 15 character random string, which I assume is just there to add entropy and avoid identical comment detection.
Shameful if true. But unsurprising.
It’s an elegant story arc.
For historical purposes
Edit: nope, it's still ongoing, there are spam comments on this very thread from 2 minutes ago. The new comments link doesn't show dead comments.
[0] https://docs.google.com/forms/d/e/1FAIpQLSe52_7L-JqY6OqhL0FJ...
Unfortunately I’ve had to pay for an extra cell phone line just to use the app for work. VOIP numbers are rejected and must be unique per account. In my case it was likely because I had the audacity to back up my chat messages with a script. After a few years I can make new accounts again but I feel like I’m playing Russian roulette every time I do.
If you don’t use separate accounts for privacy someone can dump a list of potentially any known server you’ve ever been in. I knew it would be only a matter of time until something like this would happen: https://www.reddit.com/r/privacy/s/A5nvuZBLab
Considering how many community groups and open source projects now use a Discord in place of a public forum this looks like a disaster going forwards since all the information in there will become locked up. And of course the chats and internal discussion threads aren't indexed by search engines.
It's very frustrating as a user to be region-locked on the supposedly open internet, but the real feeling of violation happens when companies layer phone number requirements on top of the region lock, which in many countries means that your government ID is now linked to the account, because you cannot buy a SIM without linking it to your ID. Truly a cyberpunk dystopia.
For me it’s worth it, but there’s no option either.
Discord sadly was pretty successful to lure in users and even a lot of devs build their community there. I think it is a bad choice because of lacking discoverability and the proprietary nature of the platform. It feels lively because it is a chat. But otherwise most projects are better hosted elsewhere.
https://support.discord.com/hc/en-us/articles/216679607--Ver...
> Verification Levels refer to the levels of security a user must meet before they're allowed to send text messages in a channel.
A lot of discord servers require you to send a message or add a reaction to indicate agreement with their rules before you can even see the list of actual channels. I wonder if reactions are also blocked?
Captchas don't do much, they're super cheap to solve with services like 2captcha, capmonster, etc.
You can get recaptcha solved for $0.6/1k, hcaptcha for $0.8/1k or cheaper. (email is pretty cheap too, but still more expensive than captcha solving)
Requiring phone verification would be the most effective out of those because it's pretty expensive for the attacker, something like $0.02-$0.11 per verification is usually what I see
You're right that it's laughably crude though. Says a lot about things that this hasn't happened until now.
But so what? The impact of that would be negligible, almost certainly less than that of having site performance go through the floor/become temporarily unreadable. It's not like a B2C product launch, and the target audience of HN is more or less optimally positioned to understand why one might deliberately interrupt service.
Which is also ironic because why would this guy reuse the same username for his little spam campaign when it can be nuked in one line of code…
Amateur stuff.
Never seen it happen before though!
And yet, he bested you, the supposedly experts at web dev and hyperscaling. You create trillions of dollars of value. And yet, your social hot spot is beyond laughably bad at handling that "incompetent" attacker.
It’s going to be interesting how spam evolves. At-least spammers who aren’t lazy.
Already many of the recruiting emails I get sound a lot human. They are bots though since they send at 9am everyday
Yeah, I was surprised by the amount, it feels like an attack rather than spam.
I hope this didn't interrupt Dang from something more important.
I'm honestly perplexed that HN doesn't have any kind of string filtering facility considering its centrality in the tech ecosystem.
The temporary solution is to shadow ban the comments, the usernames seems to follow 2 naming schemas. Banning them completely will alert the attacker to change the naming schema, or to make it more random, which will make stopping them even more difficult.
Is a certain threshold of users required to flag a comment before it's removed?
function modifyElements(pSel, cSel, rxStr) {
const regex = new RegExp(rxStr, 'i');
const pEls = document.querySelectorAll(pSel);
pEls.forEach(pEl => {
const fEl = pEl.querySelector(cSel);
if (fEl && regex.test(fEl.textContent)) {
pEl.style.display = 'none';
}
});
}
let rx = /(hi are u lonely|want (an )?ai gf?)/i;
modifyElements(".athing.comtr", ".comment", rx);
No, 1000s of bot accounts commenting 30+ per minute are quite obvious
> Is it some kind of coordinated flood attack?
Looks like it
> And is an AI girlfriend really a feasible idea?
It's the new penis enlargement and viagra spam
If some entity protests effectively (penetrates the spammer's own anti-spam, anti-communication precautions), threaten to spam them harder. Then follow through. We're seeing some follow through, I reckon.
Yeah this thread is full of spam.
There is a whole family of pwdisswordfish* accounts btw. The "b" account's "about" text even has a holier-than-thou attitude about it.
Also people flag strange threads, so the detection is not only automatic. If you notice something strange, you can send an email to dang: hn@ycombinator.com
https://www.wired.com/story/north-korea-amazon-max-animation-exposed-server/
https://www.cnn.com/2024/04/22/politics/us-animation-studio-sketches-korean-server/index.htmlIt might be a lot of spams, but it seems to come from a single account using a single sentence. Spammers are getting lazy these days.
I think that's actually multiple similarly named accounts with the same prefix. I believe there are rate limits on how fast a single account can post.