> uncovering modern bot operations

this significantly overestimates how sophisticated the spam waves are compared to like ability. the 80% of spam filtering basically never was really done as far as i can tell.

> a thankless threadmill, and user engagement metrics from fake users are still user engagement metrics.

that's probably it tho

i think the guy had a like a keyword alert on his username because like one of my co-mods on a subreddit would talk about the guy and then we'd get reports for "It's targeted harassment against me" (which are reports that are sent to the admins) like a few hours later. much to the dismay of him, we had a chat with the admins later and it was like "as long as you're not saying to do vote manipulate or harass the guy it's fine."

i think a lot of it came from the fact that so like if you're modding a subreddit, a lot of people spend their time in the modqueue view rather than the comments so you see the targeted harassment reports on "xyz is a meanie head" and just click "remove" because it already is on the edge at best for most subreddits. this is how context gets lost. so people would see "unfavorable treatment" (not that it didn't happen, gallowboob's company's domain was soft-banned on reddit yet his subreddits had automod rules set to approve them) when if more people were as trigger happy on the report button a similar thing would happen

the admin problems with this are much worse because the comments tend to be looked at in isolation so saying "i'm gonna kill you", in isolation, looks without context pretty bad, but might be part of a joke chain or song meme that reddit likes to do every so often. take into account the fact that admins get whiny sometimes if your AEO removals are too high. then take into account the AEO guy's Tarot card reading and whether Mercury is in retrograde and you get a lot of mods who are a bit trigger happy, esp when people've gotten banned for approving stuff the AEO removed for dumb reasons

this somewhat led to a bit of an inflated ego with regards to reddit but eventually from what i see he left... at least under that username anyway.

basically the point is that it's not protected because it doesn't fall under any classification of IP (it's not copyright or patent since it's mathematical outputs of a mechanical system, it's not trademark because obvious, and it's not a trade secret because it's not a secret)

iirc it only got noticed at the time because of an argument between him and Ecka6 which led to the somewhat famous "here's the thing you said a jackdaw is a crow" copypasta

banned_by true is more accurate to say "admin or automatic". in "admin mode," you can see these although not sure the UX for these nowadays now that it is spewing a gazillion lines of text into them).

Anti-Evil Operations removals (nee Trust & Safety) are generally human(-assisted) actions (although these actions can be applied en masse). there's some more information nowadays in the API which was really nice. it also helped because people stopped blaming "the mods" for removals when the spam filter slopped all over the place. this was also annoying because previously you had to previously guess from the API how it was removed even if you were a mod.

the 3 ways to remove a post/comment (i.e. in reply to: train_spam):

- remove not spam: removes it but doesn't train the spam filter, obvious

- spam: removes it and trains the spam filter, obvious

- confirm spam: only happens when you remove after removing for any reason, *does not* train the spam filter

- reinforce spam: trains the spam filter even if the spam filter already caught it. *does* train the spam filter. you can do this by doing `action: spam` in automod. not sure if there have been any more in the last few years

also you can tell the legacy of "removals", back in the day stories were "banned" instead of "removed" by moderators and administrators.

also also also... you can see a lot of the stuff from this article in the `approved_by` side of it as well. if you hover over a checkmark of someone who has been unshadowbanned, you'll see it says "approved by Reddit (shadowban removed)"

if an admin manually unspams someones stuff (say someone who got accidentally shadowbanned and got hit with an overzealous spam filter multiple times >.>), it'll say "approved by (all)". there are some consequences to this. it approves stuff that has been "filtered" (as AutoMod filtering is a weird hack where it removes something but keeps in the modqueue).

> spammit

i believe this is the thing that is "pretty similar to a naive Bayesian classifier"[1][2] that reddit used. /u/Deimorz iirc was a reddit dev at the time and it was somewhat public info. i say somewhat because you kinda had to be both interested in the this and probably be around the metasphere

iirc from some other comments i pieced together there are also per-subreddit spam filters. in the olden days sometimes they'd get way out of whack and you could ask an admin to reset it for you... or something idk

> em

guessing em in this case btw refers to /u/hueypriest, who was reddit's GM at the time

> would’ve been catastrophic for Reddit’s spam issues

the thing that surprised me at the time was just how bad reddit's spam filtering is. i did a small little thing at the time where i'd just look at stuff following some basic spam filtering rules (like stuff you'd probably get out of an artisinal spamassassin ruleset) and even that deluge was amazing to see.

like the ML stuff is cool and all but seriously 90% of this could probably still be solved with some basic rules. the profile hiding stuff didn't help either but that was way after my time.

[1]: https://reddit.com/r/TheoryOfReddit/comments/10ko5h/comment/... (2012)

[2]: https://www.reddit.com/r/modnews/comments/6bj5de/state_of_sp...

it's not IP, and it's certainly not their IP

> the TOS

oh no, the terms of service how dare people break those. you don't get to claim fair use while CFAAing everyone's actual IP then whine about the tos, and then when called out on spying on users point to it as if it being in the tos somehow justifies it

a lot of other malware has a tos too but we still call it for what it is

in any case, this isn't like "oh we don't want to build an apartment building because it might drop the value of a single family home halfway across town."

it isn't even like "we want to build this train line which will have some negative externalities but the positive effects (and externalities) are worth taking a hit in some areas"

the problems with the datacenters are that like (1) the service its providing (LLMs) has dubious societal value, (2) the direct negative effects such as noise pollution and such have been pretty well documented, (3) the indirect negative effects like massive strain on infra and (4) the people pushing them most heavily are effectively attempting to invade the communities, peddle conspiracy theories about "china" being behind the opposition, and demand to be specially treated because they were bankrolled by big tech, etc.

some people when this topic come up act like anyone opposed is some nimby who hates societal progress or smth and who is super concerned about that their home estimate might go down. but like communities do recognize the need for zoning and restricting certain things being built.

you need the thing being built to both (a) actually be a good that helps the community (or have a very very good reason why some damage to the community is justifiable (datacenter projects generally don't) and (b) need to contain negative externalities (which is why we don't put the chemical plant next to the elementary school even if it's the most economic option). people recognize these things on some level.

i mean if maintainers clearly spend much more time and effort on fraud than actually improving the project, why should I at all believe they would, let alone trust their judgement with regards to other things such as technical choices for example

patents protect ideas, copyright protects artistic expressions of ideas

it's that he has no ethics to speak of at all. it's not that he's out of touch, it's that he simply does not care.

(in original op's case, i clocked 197 requests using 20.60 MB while browsing their site for a little bit. most of it is static assets and i had caching disabled so each new pageload loaded stuff like the apple touch icons.)

honestly you could probably put it behind nginx for the statics and just use bog standard postgres or even prolly sqlite. nice bonus in that you don't have to worry about cold start times either!

it's 2025, for log files and a spicy cron daemon (you pay for the artifact storage), it's practically free to do so. this isn't like the days of Western Union where paying $0.35 to send some data across the world is a good deal

i think the big thing though is that it's a community and so people are actually willing to support that even if it means the amount of 9s of availability is slightly fewer (although in practice, many providers bust right through their "9s" SLAs without a care in the world) and given a migration from a VM provider to the dedi occurred, migrations obviously can happen if failure presents itself.

but if you want to build a social network and aren't dreaming of being gazillionaires for it (which is quite reasonable), then you can get by very easily. how do I know this? because... well it's being done successfully. not was done successfully, is done successfully.

you can probably even get people to help out on it.

you can build a social network with a dedi running nginx hosting your Python application running on a Linux box backed against Postgres (and redis for session storage, although even that is a bit overkill) for like $80/month deployed with a "deploy.sh" script that you run to kick the damn thing into running (Docker is used in dev only, but could easily work here). should you probably add health checks or whatever? yeah. it still works really well.

this scales well past the 100k users mark.

what about video/images/etc? well, this nginx server happily sends out user uploaded video storing them as files on a bog standard ext4 filesystem. backups exist of the site.

the "stack" i mentioned here isn't fancy or particularly tightly optimized, it's in fact pessimized in a lot of ways. hell I know there were a gazillion ways we could improve performance of our application. show the backend app to a game dev and they'd probably want to start strangling people with how poorly optimized most of the actual app is.

and still, it scales well.

again, I stress that this isn't some theoretical idea, this is actively being executed. the entire venture makes money for the team from the users who willingly (and unforcibly in order to use the service, the actual site is free to use in its full form) give money. this isn't ZFS. this isn't Rust. this isn't using some blue-green deployment. this isn't spending hours toiling away at which sysctl to set to squeeze every last cycle out of each box. this isn't behind some massive CDN with "internet scale" boxen or even (for the video serving part) behind any anti-DDoS service.

it's just a matter of doing actual engineering and being willing to actually build the things you want to build.

Mostly because that's, like the GPL, currently a way to get laughed out of court.