On comment spam [LWN.net]

On comment spam

Posted Jul 29, 2010 21:49 UTC (Thu) by nix (subscriber, #2304)
In reply to: On comment spam by ortalo
Parent article: On comment spam

Honestly, I would not mind giving you more personal information about myself if it can help you spot abuses and build a more trusted environment

You are forgetting the Second Rule of Antispam: 'spammers lie'. They'll hand you lots of personal information happily: someone else's.

(Unfortunately with the advent of organized crime, the First Rule, 'spammers are stupid', no longer appears to be so true, if it ever was. They're not stupid, just evil.)

(Log in to post comments)

On comment spam

Posted Jul 30, 2010 10:26 UTC (Fri) by ortalo (subscriber, #4654) [Link]

Cross-certification ala PGP sounds interesting for me to explore as a way to defeat such malicious information, while simultaneously building a network of trust.
Spammers may try to cross recommend themselves but, first it raises the bar for them; and second I suppose legitimate users would not be so easy to trick into recommending a comment spammer. (Unless someone recommends everyone without thinking - which is certainly a problem to solve too - like in key-signing.)

On comment spam

Posted Jul 30, 2010 13:58 UTC (Fri) by farnz (guest, #17727) [Link]

On that note, the Advogato trust metric is interesting. In the LWN case, you could treat the staff as the seeds, and have the staff certify all subscribers at a low level.

On comment spam

Posted Jul 30, 2010 15:18 UTC (Fri) by ortalo (subscriber, #4654) [Link]

Thanks for the link!

Note that I was probably thinking even further; possibly to extend to other aspects than simply the integrity of the identifier [1] - a sort of multi-dimensional trust graph.

Well, maybe I inconsciously try to reach the highest level in the "computer dreamer" metric dimension. More useful dimensions I can think of may be e.g.: kernel programmer, security tester, company X employee, non-spam commenter, etc. The kind of things that social networking sites like to display albeit weakly verified and without user control. A further difficulty is to draw a line between public facts - suitable for certification - and opinions or privacy-related facts - things you must leave out of scope...

[1] Not so simple of course, but still leaves room for improvement: see comment starting by "User Foo is certified but..." on the FAQ page of Advogato.