Rob St. Amant

Rob St. Amant
Birthday
December 31
Bio
My roots are in San Francisco and later Baltimore, where I went to high school and college. I stayed on the move, living for a while in Texas, several years in a small town in Germany, and then several more in Massachusetts, working on a Ph.D. in computer science. I'm now a professor at North Carolina State University, in Raleigh. My book, Computing for Ordinary Mortals, will appear this fall. www.amazon.com/author/robertstamant

MY RECENT POSTS

SEPTEMBER 13, 2010 9:36AM

How to spam OS

Rate: 39 Flag

So you'd like to be a spammer. It's not a career path your parents would be proud of, I suppose, but if you're going to do something, do it well. Here are three strategies for successfully spamming OS.

Shoping spam: Create an account on OS1. (For this strategy to work, it helps to be named Mary Lin.) Write a script to do the following, automatically:

  • Visit a random OS blog post.
  • Find the Comment button and click it.
  • Paste in a bit of text that begins, 
Hello,everybody,the good shoping place,the new season approaching, click in. Let's facelift bar!
  • Don't forget to include the Web addresses2 of your good shoping place.
  • Post the comment.

Repeat a million times.  Also, find several hundred other people named Mary Lin to do the same.

Sports spam: Create an account on OS1. Write a script to

  • Create a new post.
  • Paste in a title related to an upcoming sports match.
  • Paste in a set of pointers2 to some shady video streaming Web site, in the body of your post.
  • Publish the post.

Repeat, filling in different titles and pointers, ad infinitum.

Porn spam: Create an account on OS1. Write a script to

  • Randomly generate sentences by stringing together words and phrases from a large repository of documents.
  • After the first line of your generated text, include a long list of pointers2 to pornography Web sites. Wrap a tag around the list indicating that it should be hidden rather than displayed.
  • Create a new post.
  • Paste in a randomly generated title.
  • Paste in your text for the body of the post.
  • Publish the post.
Repeat indefinitely.
 
That's all it takes! May you attract hordes of people whose lives would be enriched by shoping, watching game after game after game of professional sports on their computers, and enjoying pornography. 
 

1 Creating a new account on OS takes less than a minute. The email address and all the other information you provide don't need to be real. There's only one weak safeguard: you have to pass a CAPTCHA challenge. This means typing in a word or phrase that's presented to you in a distorted image. Some CAPTCHAs can be solved automatically by computer programs; if not, labor is cheap.

2 It's entirely possible that no one will ever click on the Web addresses you include in your text. These Web addresses don't even need to be visible. This is okay because of the way modern search engines work. When people type a word or phrase into Google or Bing, they see a list of Web pages and other documents related to that phrase. The ranking in this list is based partly by how popular the page is,  determined by how many times it's referenced by other Web pages. The more spam you put out, the higher your Web pages can potentially rise in a search engine's ranking. (Of course, the people who build search engines are aware of all this and take measures to combat this strategy, so it's an ongoing battle.)

Your tags:

TIP:

Enter the amount, and click "Tip" to submit!
Recipient's email address:
Personal message (optional):

Your email address:

Comments

Type your comment below:
You were prescient, Cindy. OS hasn't become a content farm, but it's kinda worse.
Wait. You mean all the warnings about Don Emans and his 82 Great Comets lead to porn? How? Where? I don't understand what you mean about wrapping tags and hiding lists. I don't want it to be true. It takes all the interesting mystery away. But could you explain this more?
Oh, but Cindy Ross - you were way too optimistic. I reread your post just the other day. I mention it in my Don Emans post, which nobody has seen, since we are traveling 26 posts an hour.
Hi, Mumbletypeg. Try this: Visit one of those mysterious posts. Look through the menu options that your browser provides you for viewing the page, to see the underlying code. (For example, "View Source" in Safari or "Page Source" in Firefox, under the View menu.) Scroll down past all the HTML tags until you see the body text of the post. Right after the first line of the body text you'll see something along the lines of [div style="display: none"], in angle brackets rather than square brackets. What this means is that the text that follows (until that "div" block ends) is present on the Web page but isn't displayed. Search engines will pick up the included information even if you can't see it. So these posts aren't as innocuous as they look.
You are the man, Mr. St. Amant . . . this explains so much!
Thanks, Owl. I wrote this because of comments I've seen here and there basically saying, "What's going on?" It's not entirely obvious without knowing something about how things work on the Web. My explanation (in the footnotes) isn't very detailed, but I think it gives a reasonable picture.
What did you do in school today, Johnny? . . . .
And make sure you run your anti-mal/spy/virus scan several times a week....
Probably one of the OSrs could easily write a blocking program for TPTB, for free just to get rid of the spam overflow, but somehow that doesn't happen.
OK Rob. I did what you suggested. I created a new account with a nonexistent email address, then posted the 3 posts. I listed your blog as one of the porn sites in my hidden text. You should be getting lots of new hits! right? or did I misunderstand ...
You mean they do this to bump up their google status? And we're just collateral damage?
Damnation! There goes my fabulous theory. Unless aliens are setting up "Indian hidden cameras" to capture "nude daddies." Ew.

I am so disappointed. But thank you for enlightening me.
Great post! And some good responses, too, particularly Boanarges' advice "And make sure you run your anti-mal/spy/virus scan several times a week...."

I've been doing that daily, and finding anywhere from 8 to 45 malware spybot cookies regurgitated. And that on some occaisions after visiting no other sites, but OS only.
I'm laughing and wincing at the same time at this.
Your explanation here is the best one I've found so far.
Like some of us here, I wonder what our staff's time must be taken up with, as there seem to be too many spam posts to report, let alone keep track of. It did occur to me before, in a more acid mood, how staff itself might receive a payoff for the latest rash of lousy spambotting here. Sadly, Myriad's point is not lost on me or anyone rethinking why staff would WANT any spammers taking up space. Do we stand to lose anything by the continual nonsense here? Would they like our ranks to get thinner, suddenly, via uses of spam? In other words, what's their payoff?
I just don't see this as pointless. There would have to be a very good reason for staff to allow and/or encourage such a glut to their setup. Perhaps it's meant to give us something more to think on other than any further dustups. I'm waiting for an answer that would strike home as only the truth will do.
Rated
Great post! I'm certain that most of the spammers are people behind computers (located in China). Why can't they put a temporary hold on new accounts, especially on weekends and at night?
Hilarious, you got spammed!
Thanks for this post. I have one question, what does "Let's facelift bar!" mean anyway?
I knew you were behind this whole mess.
What Ann just said...but my comment was created from auto texting previous comments.
so that's what's going on. Thanks for the explanation.
Wait, you mean Mary Lin didn't really see my profile on OS and fall instantly in love with me?

Pfft. You suck, Rob St. Amant, burster of bubbles.
I've been dying for detailed instructions. I can't tell you how much I appreciate this. And, when I hit "rate" you got two from me! Ain't OS technology wonderful?
At times, PMs here land in the spam file of my inbox.
Very curious.
Not one so far could be considered as spam.
Go figure.
I KNEW there had to be more to it than annoying the hell out of me! I love learning about the workings of cyberworld. Thanks Rob.

Lezlie
Rated. DEATH TO SPAM!
Hey, thanks for all the comments! (Including some very clever ones.) Unfortunately I won't be back until this evening or later... Work calls.
I say it's more than coinkydink that OS and SEO have only one degree of separation.
This weekend they seemed to be flooding us with posts about advanced mathematics. Are we attracting a better class of spammer?
A really clever entrepreneur might combine the technique you've revealed with a better script, such as, "Stolen electronic products - cheap..." So long as their merchandise isn't really stolen, they shouldn't have much problem with the law. At least those ads would be more entertaining.
@Norwonk - The spam blitz is something the Pentagon is trying on us as part of a psyops R&D program.
But I really, really want a pair of Uggs.
So easy an OSer can do it...
Now, can you explain those PMs asking for a pic and a private email address?
Those scare me. Truly.
Thanks for all the comments! I'll just respond in general (sorta breaking OS protocol; sorry about that--I don't intend any offense.)

My post was about why spammers take the approach they do, rather than how to fix the problems. But given what I've written, along with what other OSers have written, a few solutions suggest themselves.

First, there's putting up more automated barriers in different places. That could mean, for example, asking new bloggers to respond to an email sent out by OS on registering; or CAPTCHAs for commenting, as some blog sites require; or filtering out posts and comments with specific content (e.g. links to shopping or porn sites), as some posters indicate may be happening already; or blocking ranges of IP addresses of posters; or instituting delays on posting or commenting, especially on weekends. There are ways of getting around all of these barriers, though I think they do tend to eliminate some spam.

Second, there's applying human intelligence to the problem. This could be done by the OS technical staff (that's presumably what's being done now, with limited success). This could alternatively be done by what's called crowd sourcing: getting a lot of people to solve the problem collaboratively. Some Web sites deal with vandalism, in part, using this method--any registered user can eliminate changes back to an earlier version of a Web page. This might work here on OS, with the danger being that people might misuse the facility. But it's worked elsewhere, with appropriate rules for granting privileges to users. This approach involves fixing problems as they arise; some OSers have suggested the alternative of requiring new OSers to "prove" themselves or be kicked out automatically after some period of time.

So, lots of possible solutions. They all require lots of work on the technical side. My impression is that OS support is stretched very thin, though, so it's hard to say if anything will be done. Some solutions would probably change the character of OS significantly (think about the flame wars that have arisen based on the perception of the differences between older and newer OS members, and think about what would happen if new OSers had to pass tests to be admitted to the OS community). I imagine that's a concern for TPTB.
Rob, ty 4 the tips. I still this is an inside job. R
I still like the IP blocking approach. Seems straightforward to me.
Can I pick a username with only vowels in it.....? You are so cool, Rob.
One thing I don't understand -- the vast majority of spam posts are easy (for a person) to identify. Why doesn't OS hire a minimum-wage student for a few hours a day to delete spam accounts?

Also, there is one other kind of spam that is less common, but does happen. The spammer creates an account and then adds spam links to the sidebar of the account. These are difficult to identify because there's nothing "public" about it. The creation of the account doesn't indicate that it's a spam account. And then there are no comments or posts -- just the account with the spam links.
Why doesn't OS hire a minimum-wage student for a few hours a day to delete spam accounts?

This would be a good low-tech solution. I like it.

(I'm coming back to this post just because I have a bit of free time this morning, and somehow it seems relevant again.)

Thanks for the comments, everyone.
Damn, somehow I missed this when it first came out, I am now in the process of building my Spam Empire, which I will now name Rob St. Spam!! ;D