Hackers Are So Fed Up with Twitter Bots They’re Hunting Them Down Themselves

https://theintercept.com/2018/03/16/twitter-bot-detector-software/

by CrankyBear • 8 years ago

347 173 8 years ago

tuespetre• 8 years ago

LOUD NOISES

What’s with the all-caps title? Did they spit it out from the server using ToUpperCase instead of using CSS text-transform?

dang2• 8 years ago

No, it's that some article titles use all-caps typography and then HN users copy it.

We're going to write a bit of software to convert these, or at least ask submitters to revise them. In the meantime we've edited the title above.

reificator• 8 years ago

It's frustrating that the site markup is (almost) correct[1], because IMO the browser is in the wrong here. I think it makes more sense for the browser to copy the text as it is in the markup, because all-caps is a stylistic choice not a content choice.

I can see the argument the other way around, where the text the user selects should be the text they copy, and that makes sense. But I maintain that the same article with different stylesheets should produce the same text content on the page for the user to copy.

[1]: The markup is in something approaching title case, except that words like `with` are also capitalized. Then the element is using `text-transform: uppercase`.

dang2• 8 years ago

A related discussion from a couple days ago is https://news.ycombinator.com/item?id=16599802.

obblekk• 8 years ago

This is an interesting approach. Maybe Twitter shouldn't solve the fake accounts problem directly, maybe they should come up with an evaluation criteria and then create a market for identifying fake accounts.

If their evaluation criteria is good, they could get away with 0 cost to build the best possible system (motivated by competition on a market).

johnc1231• 8 years ago

I think Twitter's biggest problem with fake accounts is not that they are hard to identify, but that if they do identify them and shut them down, it'll hurt their "number of active users" stats

hinkley• 8 years ago

Their Perverse Incentive is probably to shut down fake accounts faster than they are created. Such that they are 90% effective in, say, 5 years so that the active users takes a haircut instead of a big drop.

CM30• 8 years ago

I suspect their big problem is more that their site is too big for the moderation staff they have at the moment. Identifying bots is easy for people sure, but it's hard to automate with AI and hiring people to proactively hunt out and shut down bots is expensive.

Of course, the fact doing it too well hurts the stats doesn't help either.

westurner3• 8 years ago

There's an open call for papers/proposals for handling the deluge. "Funding will be provided as an unrestricted gift to the proposer's organization(s)" ... "Twitter Health Metrics Proposal Submission" https://blog.twitter.com/official/en_us/topics/company/2018/...

mtgx• 8 years ago

If only Twitter didn't obliterate the "third-party market" that existed in the Twitter ecosystem in the early days. I imagine we'd be seeing all sorts of solutions against bots by now, especially in third-party Twitter clients.

But no, Twitter had to "take matters in its own hands" and "control the ecosystem". Much good that brought.

carlchenet• 8 years ago

A real hacker move would be to just leave Twitter and go to Mastodon https://joinmastodon.org

egypturnash• 8 years ago

Maybe even use your hacker powers to spin up a Mastodon instance of your own so your friends have somewhere to go where they know the person running it.

itomato2• 8 years ago

How is that anything but abandonment?

gaius• 8 years ago

You say that like Twitter declaring bankruptcy would be a bad thing

westurner3• 8 years ago

Are you suggesting that Mastodon has a better system for identifying harassment, spam, and spam accounts? Or that, given that they're mostly friendly early adopters, they haven't yet encountered the problem?

rhizome• 8 years ago

I have no opinion on its ability to replace Twitter, but the federated nature of Mastodon means that an instance can disconnect from the instances that are hosting spam accounts, much the same as many instances have disconnected from servers that host racist and alt-right communities and accounts.

r3bl• 8 years ago

It seems to me like you don't understand the crucial difference between Twitter and Mastodon.

There's no such thing as Mastodon, a singular social network. Mastodon is a series of instances that talk to each other. A sysadmin running the instance can do whatever he pleases in his instance, including closing the registration, banning entire instances from communicating with his instance, and enforcing whichever rules he wants to enforce.

Mastodon doesn't deal with such issues at all. It's sysadmins running Mastodon instances that are supposed to deal with such issues.

It's more like reddit, where mods of subreddits have nearly complete authority over their own space on the social network, than it is like Twitter, in which a single entity is in charge.

cornholio• 8 years ago

Regardless of the technical measures, I think we can all agree something called 'Mastodon' will be safe from spam bots in perpetuity simply by virtue of not having any non-geek users.

"Hey Melissa, here's my Mastodon handle, hit me up."

"Your... what?"

"My Mastodon, it's a federated social network free from any corporate overlord!"

"Whatever, freak..."

sandov3• 8 years ago

Why do we need to identify and ban those in the first place?. When I used Twitter I never thought "oh man, these spam bots are ruining my twitter experience". It was more like "Oh, another bot is following me". Didn't waste more than 2 seconds of my day.

kzrdude2• 8 years ago

A real activist would pull out in the forest and start their own society. :)

Sometimes we need to fix the things that are broken instead of leaving.

philipwhiuk2• 8 years ago

Would Twitter be allowed to federate if it implement the Mastodon protocol.

Think carefully.

jnbiche• 8 years ago

Yes, of course. However, if I'm not mistaken, each Mastodon server instance creates their own policies regarding what other servers can tweet to their users. So it would be trivial for any Mastodon server to "ban" Twitter users from posting in their instance.

kzrdude2• 8 years ago

(“jakten” means “hunt” in Norwegian)

I don't mind the confusion, it's just a fact that we can use knowledge of Norwegian to understand Swedish.

Fun fact, same word as yacht, which is borrowed from dutch jacht with the same meaning as Swedish and Norwegian jakt.

stochastic_monk• 8 years ago

It’s also related to Jagd, hunt in German. Depending on your taste in references, you can think of Jagermeister or Liszt’s Wilde Jagd.

gerdesj• 8 years ago

Is it just a coincidence that jakten means both hunt and yacht in Norge? (I think I unpicked that chain correctly)

Also, now I come to think about it, it is a bit embarrassing that we (en) pronounce yacht as "yot". I look forward to reading a future man page describing yacht as an archaic form of the correct usage. The man page for the ls command used to describe colour as an archaic term for the "modern" form - color!

yorwba• 8 years ago

Wiktionary says that yacht stems from the Dutch word for a hunting ship (one you use to pursue other ships), so various Germanic languages having similar or identical pronunciations for the words for yacht and hunt is no coincidence.

https://en.m.wiktionary.org/wiki/yacht#English

lokedhs2• 8 years ago

It's odd that they mentioned Norwegian at all. Nothing wrong with Norwegian of course, but the researchers are Swedish, and "jakten" means "the hunt" in Swedish just like Norwegian.

downandout2• 8 years ago

The profile of fake porn accounts the guy in the first part of the story developed is that they "liked more tweets than they retweeted, had fewer than 1,000 followers, and directed readers to click the link in their bios."

If that is the only criteria he's using, many legitimate accounts will be falsely accused.

abhishekjha• 8 years ago

I have an account like that. I just retweet and like stuff sort of like a public bookmarking system. I just go through them when I get enough leisure. I wonder if having a profile photo would help avoiding false positives.

stuartd• 8 years ago

Well, they're obviously not the only criteria, as the text you mention was immediately preceded by "Not only did these Twitter accounts typically include profile photos of adult actresses, but they also had similar bios, followed similar accounts... "

downandout2• 8 years ago

There are many adult actresses, camgirls, etc. on Twitter that are trying to build a following that would still meet this criteria. Not all of them are bots.

jeffwass2• 8 years ago

I’m a total Twitter n00b.

But are we really supposed to retweet more than we like? I was treating retweets as a stronger version of ‘like’, in a sense. Assuming too much retweeting will clog my followers’ feeds, and make them more likely to mute or unfollow me.

So yeah, I like far more than I retweet. I also have well less than 1000 followers, being a n00b.

I DO have a link in my profile, but don’t actively request people visit. But figure they eventually might (I do much tweeting within the aspiring author community, mentioning my WIP, or Work In Progress, so figure potentially-interested parties could click. But no, not actively marketing, yet...)

stordoff• 8 years ago

But are we really supposed to retweet more than we like? I was treating retweets as a stronger version of ‘like’

I'm in the same boat, but I'm not sure you could take it any other way. At least in my usage, 'like' is a signal to the poster that I liked their comment/it was a beneficial contribution, whereas 'retweet' is that AND I think it would be useful/interesting to a weirder audience. Retweeting more than likely seems backwards, and more like spam.

Nition• 8 years ago

Assuming too much retweeting will clog my followers’ feeds.

You can choose to mute retweets from an account without muting the whole account, so that's not too much of a problem. If you retweet too much they can mute your retweets.

Recently something changed though, and now things you Like can also show up in your friend's feeds, and I haven't found any way on the default twitter site to mute those. So Likes can actually be more spammy than retweets now!

thaumasiotes• 8 years ago

But are we really supposed to retweet more than we like?

HN itself suffers from this problem. There is apparently a heavy "controversial" penalty applied to articles that get too many comments relative to their upvotes.

But, commenting is most of HN's functionality. I comment fairly frequently; I certainly don't upvote articles anywhere near as often.

cookiecaper4• 8 years ago

Assuming too much retweeting will clog my followers’ feeds, and make them more likely to mute or unfollow me.

If there's one thing I've learned about social media, it's that this totally considerate, natural thought pattern is anathema to the platform vendors.

In the real world, you expect a high Signal-to-Noise ratio, and want to reward people who speak less often because their words become more weighty/significant. Social platforms work on the exact inverse of this principle! They reward high Noise-to-Signal accounts because that keeps the psychological engagement hooks going. The platforms actively punish accounts that aren't continuously, repetitively pushing those buttons. If you ever wonder why the spammiest crap floats to the top, this is why.

We're all just flashing bulbs in the social media slot machine. If we're not frantically flashing, blinking, or otherwise making it difficult for the consumer-gambler to look away, we're not serving the platform's purpose, and we'll be replaced with a bulb that does.

zaarn• 8 years ago

On mastodon I use boosts (similar to retweet) when I want everyone who follows me to see a specific post. Like is when I find the specific toot interesting but not something I want to bother other people with.

heavenlyhash• 8 years ago

We have so many better systems with tons of literature. We -- us, the humans in bulk, as a species with brains -- have so, so many things figured out for this.

Googling for "random walk" and "sybil attack" will dump so many solid research papers in our laps it's just a tragedy nobody can be arsed to do something useful.

jtokoph• 8 years ago

Forgive me, as I don't use twitter much, but what is the problem with twitter bots? If I don't follow them, aren't they essentially invisible to me?

I guess they might pollute search results? Is there something else I'm missing?

hellbanner• 8 years ago

Did you read the article? It's political.

"n October, Twitter’s general counsel told a Senate committee investigating disinformation that Russian bots tweeted 1.4 million times during the run-up to the last presidential election, and such bots would later be implicated in hundreds of tweets that followed a school shooting in Florida."

some of these bots, were not bots btw

sandov3• 8 years ago

"Our citizens are too stupid to have a personal opinion and distinguish between a bot and a real person"

douglaswlance• 8 years ago

"...hundreds of tweets..."

You realize how few that is right?

Do you have proof that Twitter bots influence opinion?

If Russian bots influenced elections, what about the millions of real live humans from countries around the world who comment on USA politics?

orng• 8 years ago

They can still follow you, comment, like and retweet your posts. You can block them but if you are popular enough it might be a problem. They also make search a lot worse and the hashtag system for some tags completely useless since all the posts you'll find under that tag are spam posts.

TheSmiddy• 8 years ago

If you follow any billionaires and read their comments they are full of crypto scams.

Things like @elommusk replying to @elonmusk saying "to celebrate this awesome news I'm going to hand out some free bitcoins!, just send 0.1BTC to <address> and i'll return 1BTC!" then 100 replies from other accounts saying "thanks Elon, you're the greatest!"

always_good• 8 years ago

And if you check the address, you can often see thousands of dollars scammed.

Not as lucrative as it seemed to be the first time I noticed them a month ago where a Coinbase tweet had a spam response with an address that made 80k USD in <1 hour, but it's still clearly lucrative.

This is going to force Twitter to finally do something about all the bots since they'll have to deploy countermeasures that generalize across pretty much all bots.

It's clear that Twitter has held a Laissez-faire or blind-eye philosophy towards bots, but it's hard to keep procrastinating once you can trivially verify that your platform is a lucrative tool for scammers.

Not to mention, the top N responses to every high profile tweet are now these scammers and it makes their platform look absolutely uncontrolled.

jeffwass2• 8 years ago

Do people actually fall for this?

I thought this is the whole reason to use the blue check mark, so you can immediately tell real Elon from bot Elon.

But there are weird celebrity bots too. Eg, I followed Adam Sandler, and within a few hours a couple Adam Sandler bots started following me. They just had retweets of Adam Sandler tweets, but also a few hundred followers. Makes me wonders who are the people that follow these back, maybe just other bots?

itomato2• 8 years ago

As a system, Twitter is easy to "game", if your goal is to spread information.

It's trivial to boost the apparent "credibility" of a given account with followers, likes, and retweets.

There is essentially no barrier to exploiting these "commodities" with networks of bots artificially boosting these stats.

Soon, the synthesized noise from bot accounts drowns out the organic signal of genuine accounts.

Waves of content reverberate through the Twittersphere, into and from other channels like 4chan, Facebook and Instagram.

orbitingpluto• 8 years ago

The obvious answer is to restrict some API usage, specifically posting, to verified accounts.

This obviously conflicts with Twitter's incentive to maximize their profit and brand. So the next obvious solutions are token measures.

edit: And apparently to downvote anyone who calls them out.

lorenzhs• 8 years ago

I got fed up with Twitter's lack of enthusiasm in blocking these accounts so I whipped up a quick proof of concept a while ago. The amount of trivial-to-detect cryptocurrency scams in replies to popular accounts was so high that I put together a hacky PoC: https://gist.github.com/lorenzhs/864353c202112a38de17ed054f3... -- the scammers' messages have changed now, the messages no longer match that particular filter, but it worked for weeks without Twitter doing anything.

1337biz• 8 years ago

Are you aware that many ICOs give free torkens to people who share a specific tweet or tweet a specific url?

donarb• 8 years ago

I would say that conversations that need an incentive to retweet are worthless.

lazugod• 8 years ago

Is this a reason to not block them?

bigiain• 8 years ago

I got fed up with Twitter's lack of enthusiasm in blocking all sorts of shitposts that I stopped using it. I've been significantly less angry ever since...

aaachilless2• 8 years ago

Is it for some reason not a viable solution to just stop following people who shitpost? Or does Twitter push random users' posts at you? I ask because I've been circling around Twitter for a month or so, but if you can't isolate yourself from public tweets, I'm definitely not going to jump in.

jackgolding• 8 years ago

I wouldn't call it shitposting but snarky identity-politics (all left, right, up and down) driven replies/tweet storms (which generally have nothing to do with the original post) are why I only look at "what you've missed" every few days on Twitter.

zeth___2• 8 years ago

Honest question: what's the point of twitter?

sat_nam• 8 years ago

This is a great effort. I wrote about this at the end of January (https://research.satnam.co/2018/01/30/scammers-impersonating...) and was working on a script last month that did the same thing but I was searching the Streaming API for specific keywords that I knew were triggers for their tweets. I set-up a Twitter account to also identify and report these scammers accounts. The problem I was having was I did not account for the variety of currencies that were being utilized, so I had to write new regexes for the different address types. By then, they had switched up tactics and I hadn't followed up on it since.

tracker1• 8 years ago

I frankly don't use twitter much anyway... I mostly post things that I like, and in the end use my own account to re-find stuff I posted later... it's a bad bookmark manager is how I use it, but at least then other people might find it useful to.

thinkloop2• 8 years ago

finding these accounts is pretty easy, he used advanced google search and google reverse image search

All Twitter has to do is develop the most intelligent software ever created and make sure it keeps inching towards generalized AI over time.

chrisweekly• 8 years ago

FWIW I read gp as "_use_ Google", not "_be_ Google".

thinkloop2• 8 years ago

That's why the piece is cute, it presents some personal fiddling as a possible solution. Twitter can't simply use a competitor's technology at scale, and if they did they would be opening a massive risk vector to their core business. The only takeaway is that Twitter has to replicate the most intelligent "ai" in the world.

nsaaass• 8 years ago

Hypocritical news from twitter.

goerz• 8 years ago

I'm not sure I understand the point. So they identify bots. Then what? How can one get rid of these accounts?

lokedhs2• 8 years ago

They report them. And then nothing happens because its in the interest of Twitter's business to not do anything about it.

To be fair, I'm sure some will be blocked but the problem with Twitter bots is that the only way to get rid of the problem is to ignore false positives. That will fix the issue but replace it with a different problem, as it clearly won't make for happy users.

I've been using Mastodon quite heavily recently and the "ban first" approach is taken by many instances. They can do that since the network is decentralised. Twitter, on the other hand can't do the same thing.

aphextron• 8 years ago

This whole problem could be solved by opening account verification up to everyone. Twitter would be amazing if every profile were guaranteed to be a verified human being with government issued ID. Leave it open to those who want to stay anonymous, but give users the option to filter those people out.

retox• 8 years ago

I refuse to create accounts on site that require even a phone number, let alone government ID. It will eventually get lost and things like passports being faked can land you in prison or watchlists if someone like Israel decides to steal your identity while committing an extra-legal assassination.

AaronFriel• 8 years ago

That escalated quickly. Are you sure if Israel wanted to pin an extra-legal assassination on you, they couldn't do so already?

scottmf2• 8 years ago

Perfectly sane reason for not signing up with Twitter.

realusername2• 8 years ago

They could use Google Captcha and create two kind of verified account, you don't necessary need an ID.

taurath• 8 years ago

Human / not human is probably worthwhile, but a ton of twitters value would go away if everyone had to use their real identity to post.

spdustin• 8 years ago

I upvoted because I assume you meant that verification would be optional. I believe Twitter is actually moving toward that solution.

I'd be on board. Anonymous users would stay anonymous; users that are comfortable confirming their identity would get a blue badge. I don't see a downside, and I see plenty of upsides.

jshevek2• 8 years ago

I don't see this working well as long as Twitter us also using the badge as a means of punishment

dbetteridge• 8 years ago

I like this idea, a simple tag on an account that says "we have verified this person is real" and a filtering mechanism in the UI would do wonders.

JonasJSchreiber2• 8 years ago

I couldn't agree more. If there are more accounts than people in a region, you know you have robots registering. They need to employ better captcha and verification for registering new accounts.

I wouldn't go as far as to require government ID, (some folks have issues getting government IDs for voting purposes) and many undeveloped nations have large portions of their populations that have no birth certificates.

I would however require that a human be present to create a new account and that it be tied to a phone number for 2FA or something along these lines that makes mass registration cost prohibitive.

cookiecaper4• 8 years ago

Suppose someone has divergent interests. Maybe they are interested in computing and hunting. If they want to discuss things and cultivate a following in each of these communities, should they be required to tweet both from the same account?

What if there isn't a lot demographic overlap? Twitter doesn't provide any kind of tooling that would allow one to follow only the relevant tweets in a given account. This is especially relevant if the interests/communities at issue not only don't have a lot in common, but actually spend a lot of time at odds, which is the case for many interests. It'd be impossible to have some followers from such groups who wanted to hear about the one thing without simultaneously alienating them by talking about the other thing. Computing and hunting are good examples because your average cypherpunk's opinion and worldview is much different from your average hunter's opinion and worldview.

I have personally started a handful of different Twitter accounts intended to engage with different communities. None of these perform any automatic activity at all and I basically use them for a couple of days and then give up because it's too much effort (recently, more because Twitter blocks the accounts almost-immediately).

More accounts than people is absolutely not a reliable indicator that "you have robots registering" (especially when businesses etc. are expected to register). That may be a better metric if Twitter provided useful filtration tools, but even then it'd be shoddy.

duxup4• 8 years ago

I could go for a service like that. Even without the anonymous option.

bossx• 8 years ago

Facebook desperately needs this feature.

jonny_eh3• 8 years ago

I think there should be two potential badges for twitter users: 1) Verified identity (as you described) 2) Suspected bot

And you should be able to filter out posts accordingly, like "only showed verified" or "don't show suspected bots".

And by default, Twitter should hide suspected bots in reply/hashtag threads, so they don't get increased exposure.

bond• 8 years ago

Maybe something like Selfkey would be useful...

https://selfkey.org/

extweep• 8 years ago

In the early days of twitter, Trust&Safety was considered the second-lowest team on the totem pole of engineering career advancement possibilities (sorry Internal Tools aka Developer Productivity).

I'm sure that's changed recently, but IMO a lot of the trouble that Twitter/FB/Reddit have had with bots has to do with trying to get good engineers rationally interested in being part of T&S organizations.

Now T&S is sexy, but there's got to be lag time effectively changing the leadership and team structures of these large, established teams.

nkg• 8 years ago

Hey I run a bot and people love it. It adds value and regularlt triggers conversation. All bots are not about porn and mixtapes!

dmix• 8 years ago

This whole bot thing is turning into a classic hysteria.

I really hope it doesn't end up harming a bunch of the 'good guys' like most of the quickly assembled shoddy 'solutions' most public hysterias generate, rather than stopping the legit 'bad guys'.

There have been countless examples of well-intentioned but heavy-handed intervention being a net-negative for society [1].

There could very well be some really interesting legitimately useful bots that will get swept up in this. Or platform limitations added which cripple the utility of all bots...with some an unmeasurable potential loss via future bots which were never created as a result. ....Meanwhile the 'bad guys' find a hundred loop holes to keep operating.

The key is keeping this to a case-by-case enforcement...whether at an individual or specific use-case based level. Not some overarching limitation or stigmatization of bots (across all social media).

[1] See: the drug war, 1970s NYC/Toronto rent control laws resulting in a far lower supply of affordable housing and more dilapidated tenements, anti-oil pipeline activism resulting in more environmental harm via rail and truck transit, pro-poverty housing regulation creating isolated urban ghettos, wage laws reducing total long-term net income for all low-income workers than it gains employed workers in the short term, etc, etc.

makomk• 8 years ago

What gets me is that most news organisations are probably heavy Twitter bot users themselves.

fabianhjr• 8 years ago

I just hope something similar to a follow graph/follow range comes up as a solution. It gives _way_ more control to individuals to limit the reach of bad actors.

For example: https://ssbc.github.io/scuttlebutt-protocol-guide/#follow-gr...

staticelf2• 8 years ago

I tried to start a twitter account, a few minutes later I got blocked: https://imgur.com/suSH1Qn

I didn't tweet anything, just followed some people I found interesting.

I don't want to verify my phone number. Fuck you twitter.

nasredin4• 8 years ago

I haven't been able to create a Twitter account for over a year now. Home IP.

(Not giving Twitter my phone number)

I think it's deliberate b/c bots seem to be exempt from this phone number requirement.

staticelf2• 8 years ago

Yeah exactly, is registering an account really automated behavior? It's so obvious they just want my phone number and they are never getting it.

Twitter is dying anyway, at least that is the feeling I have about the website.

Aissen• 8 years ago

As I told @fs0c131y (cited in the article), they're very easy to find. My bot found many of them without even looking: https://anisse.astier.eu/what-do-you-find-when-you-search-tw...

jordan801• 8 years ago

Isn't this self defeating? As everyone has pointed out, it's not hard to detect a bot. So, why can't Twitter just do it? Maybe their review and moderation team is just too backed up. In that case, instead of helping the twitter team, these detection bots, are probably making it worse. Reviews and considerations have to be more thorough, since most of the reports are from automated systems. Systems, they probably have already engineered.

I built a chrome plugin that filtered out Facebook posts by a set of keywords. It took less than an hour. Maybe these "hackers" should do it for Twitter. It would reduce the load on the moderators, while making these bots far less effective. Then, reach out to the Twitter team, and see if there's a way to go about this, that isn't destructive.

Bartweiss2• 8 years ago

it's not hard to detect a bot. So, why can't Twitter just do it?

Presumably a significant part of that is that Twitter cares more about false positives than random third parties do; they're going to get some vicious criticism if they start flagging/closing real accounts as bots. They might also worry more about false negatives, because as soon as they act on bots they'll be accused of bias and only targeting certain positions. (That accusation will hit regardless, but presumably they'd like it to not be true.)

It's easy to whip up a tool that gets lots of true positives, but much harder to get a success rate good enough to use.

Hackers Are So Fed Up with Twitter Bots They’re Hunting Them Down Themselves

Related Stories