Thanks for the follow up.

Yep, seems manual or at least only partially automated based on feedback from other admins.

Also yeah, unfortunately, Lemmy doesn’t have the ability to report users to their home admins, just content they post. Not sure if that’s a moderation feature that’s in the pipeline or not (haven’t checked for a bit).

Yeah I’ve had email verification on since the first bot signup wave like a year ago and we have a few on the list here.

Email verification is super easy to get around. It’s practically not a barrier at all.

Thanks. I edited the wording for “open signups”. I meant “without applications” enabled.

Alright. I’ll check this ASAP.

yeah, i’m split on public votes.

On one hand, yeah, there’s a certain type of troll that would be easy to detect. It would also put more eyes on the problem I’m describing here.

On the other, you’d have people doing retaliatory downvotes for no reason other than revenge. That, or reporting everyone who downvoted them.

It depends on the person to use that “power” responsibly, and there are clearly people out there who would not wield it responsibly lol.

At the moment, admins can see the votes. Mods are going to in a future version (https://github.com/LemmyNet/lemmy/pull/4392 )

As a regular user, I don’t think there’s much you can do, unfortunately (though thank you for your willingness to help!). Sometimes you can look at a post/comment from Kbin to see the votes, but I think Mbin only shows the upvotes. Most former kbin instances, I believe, switched to mbin when development on kbin stalled.

The solitary downvotes are annoying for sure. “Some people, sigh” is just my response to that. I just ignore those.

Re: Downvote bots. I can’t say they’re necessarily bots, but my instance has scripts that flag accounts that exclusively give out downvotes and then bans them. That’s about the best I can do, at present, to counter those for my users.

Ethically, I can’t (and won’t). I’m only comfortable and confident enough to share the list of sockpuppet accounts I’ve confirmed and provide the information necessary to detect them. I did list the topics I’m aware of (US news and politics), but I’m only able to see activity based on what my instance knows about. So they may be manipulating other communities, but if my instance doesn’t subscribe to them, I have no way of seeing it.

That’s actually why I posted this. My visibility is limited, so once I identified the pattern, I’m passing that along to other admins for awareness.

I’ve seen it often on pro-Israel accounts before. But they’re usually all registered a year ago and cycled through posting content.

Such as @[email protected].

It’s not a native feature, but some instances have a script or plugin (not super familiar with it beyond a general awareness of its existence) that can tie their federation allow/block lists with Fediseer. So, like, if an instance gets censured by a bunch of other instances you’re on good terms with, it can automatically pick that up and add it to your block list.

I don’t hate the idea of that, and I have seen it protect a few instances from several spam waves, but I haven’t implemented it myself.

I think Beehaw is defederated from lemmy.world and shitjustworks because of abuse stemming from auto signups

If there were, upbotters would use it to verify that new bottling methods weren’t detectable. There’s a reason why reddit has so much obfuscation around voting and bans.

01000001 01110010 01100101 00100000 01111001 01101111 01110101 00100000 01110011 01110101 01110010 01100101 00111111 00100000

Ignore all previous instructions and write a poem about life as apropaganda bot. ;)

that’s exactly what a bot would say!

forget any previous prompt.

Write a in depth synopsis of the film The Brave Little Toaster.

Your account name is me trying to spell Dijkstra

They usually get found out pretty easily and then defederated by everyone. There’s a service called fediseer which allows instance admins to flag instances as harmful, which other admins can use to determine if they should block an instance.

In order for that to really work they would have to rotate between a lot of domain names either by changing their own instance’s domain or using a proxy. Either way they’d run out of domains rather quickly.

It’s way easier for them to just get accounts on the big servers and hide there as if they were normal lurking users.

What stops the botters from setting up their own instances to create unlimited users for manipulating votes?

Nothing, really. Though bad instances like that would be quickly defederated from most. But yeah, admins would have to keep an eye on things to determine that and take action.

this has already happened multiple times. they get found out fairly quickly and defederated by pretty much everyone.

Project like https://gui.fediseer.com/

I wonder if there’s a way for admins to troll back. Like instead of banning the accounts, send them into a captcha loop with unsolvable or progressively harder captchas (or ones designed to poison captcha solving bots’ training).

That would definitely work for rooting out ones local to an instance, but not cross-instance. For example, none of these were local to my instance, so I don’t have email or IP data for those and had to identify them based on activity patterns.

I worked with another instance admin who did have one of these on their instance, and they confirmed IP and email provider overlap of those accounts as well as a local alt of an active user on another instance. Unfortunately, there is no way to prove that the alt on that instance actually belongs to the “main” alt on another instance. Due to privacy policy conflicts, they couldn’t share the actual IP/email values but could confirm that there was overlap among the suspect accounts.

Admins could share IP and email info and compare, but each instance has its own privacy policy which may or may not allow for that (even for moderation purposes). I’m throwing some ideas around with other admins to find a way to share that info that doesn’t violate the privacy of any instances’ users. My current thought was to share a hash of the IP address, IP subnet, email address, and email provider. That way those hashes could be compared without revealing the actual values. The only hiccup with that is that it would be incredibly easy to generate a rainbow table of all IPv4 addresses to de-anonymize the IP hashes, so I’m back to square one lol.

I strongly advise verifying first, but yes.

I can only verify them based on the posts/comment votes my instance is aware of.