CAPTCHAs and sign‑up quizzes annoy real people and barely slow down determined bots. As the fediverse grows, we need smarter, more humane defences, ones that don’t push away genuine newcomers. What creative, non‑intrusive ideas do you have? Trust‑based vouching, proof‑of‑humanity protocols, behavioural signals… what feels both effective and aligned with the open social web? I’m building a social media platform and I’d love to hear your thoughts on this topic.
I created a honeypot that creates a link only bots would think is a link. Then it gives them random words with another link. If they click the link 3 times they get ip banned by fail2ban. Works wonders! I can see my logs and the difference it made.
I also have bots.txt that only the big players care about like google.
I’ve seen a few Discord servers I’m on use some bot that creates a honeypot channel. It immediately bans anyone that posts in it. It’s so low tech that it perfectly handled the weird problem of people getting their account taken and posting spam in every channel. I can’t help but wonder if honeypots could appeal to the “loose with rules” nature of modern LLMs/AI tools.
Sometimes low tech is the best solution. Thats a good idea :)
Most bots are not sophisticated. If they were…they would just get a human being to do it. The whole point is to do something repetitive easy again and again.
liberal blocking and not worrying about not interacting with every single one of the 8 billion people on the planet.
https://xkcd.com/810/ was intended as a joke, but there is a kernel of truth to those thoughts…
I hate to use the example, but one of the worst places on the internet actually found a solution for this a long time ago. $10. By having a small, but meaningful, fee for the account people couldn’t have unlimited accounts and there was a cost to getting banned. If you are posting bot slop you will be banned quickly and lose your $10. If you are not being bot like and also not breaking tonnes of other rules many times then you will not be banned and can keep your account.
This works well enough most of the time. Getting a new account after your previous one has been banned can be done fairly quickly but that $10 adds up quickly and can fund the cost of reviewing and potentially banning bad actors. It doesn’t solve the problem in full, but another thing you can add is region gating. In your profile you set where you are going to be dialling in from, including which VPN providers and so on. This means you have a fairly specific pattern of behaviour that is white listed in advance. Now if your account is compromised and starts logging in from other places it can be blocked quickly, and also potentially the login attempts can be blocked and a password reset process initiated.
Another option would be to require a invite only process and have those you invite reflect on you. For example, if someone invites a friend and that friend invites not accounts then both people are impacted. If someone invites 9 good people and 1 abused account their ratio is 0.9, if they drop below some value then they lose invite privileges. If you consistently invite crappy people or abusive bots you get banned, but if it happens only occasionally then you lose your invite rights for a while. Those parameters are all tunable but should help to get things operating more smoothly.
Also, having invite periods but closing invites most of the time can also kill off many bots. People using bots are lazy, they don’t want to wait for months posting stuff and pretending to be a person to then use the accounts to post 3 junk things and then have the whole set banned. They want a large network of accounts they can throw away as needed. Make it slow, expensive, and consequential. Make botting 50 accounts cost $500 and also be a waste of time and the bots will stop coming.
Using money as a gate has some issues. If you don’t scale the amount to the region, you effectively exclude that region. But if you do scale to the region, it encourages the spammers to simply setup their operations (either physically or virtually) in the cheapest region (physically also has the benefit of cheap labour).
Requiring unique credit cards could mitigate that, but then there is PCI issues there, and its basically no different to requiring ID.
I assure you, paying for an account is a terrible idea simply because some of the moderators/admins in charge are awful at it and will cause an incredible amount of backlash with their unlimited ban hammers.
“I didn’t pay to get banned by a dumbass! Moderators must be elected and administrators must be held accountable for their poor decisions! As a shareholder, I cannot condone the misuse of my investments! … Etc”
