Instance Admins: Check Your Instance for Vote Manipulation Accounts [PSA]

I believe "Russian Bot Farm Presence" is the preferred metric of social network relevance in the scientific community.

Make it harder to moderate? Sure!

I hope this post doesn't tank the monthly active users stats lol. Mostly that's me hoping this problem isn't as big as I fear.

What surprises me is that these seem to be all on other instances - including a few big ones like just.works - rather than someone spinning up their own instance to create unlimited accounts to downvote/spam/etc.

lol hahahahaha

That would definitely work for rooting out ones local to an instance, but not cross-instance. For example, none of these were local to my instance, so I don't have email or IP data for those and had to identify them based on activity patterns.

I worked with another instance admin who did have one of these on their instance, and they confirmed IP and email provider overlap of those accounts as well as a local alt of an active user on another instance. Unfortunately, there is no way to prove that the alt on that instance actually belongs to the "main" alt on another instance. Due to privacy policy conflicts, they couldn't share the actual IP/email values but could confirm that there was overlap among the suspect accounts.

Admins could share IP and email info and compare, but each instance has its own privacy policy which may or may not allow for that (even for moderation purposes). I'm throwing some ideas around with other admins to find a way to share that info that doesn't violate the privacy of any instances' users. My current thought was to share a hash of the IP address, IP subnet, email address, and email provider. That way those hashes could be compared without revealing the actual values. The only hiccup with that is that it would be incredibly easy to generate a rainbow table of all IPv4 addresses to de-anonymize the IP hashes, so I'm back to square one lol.

I strongly advise verifying first, but yes.

I can only verify them based on the posts/comment votes my instance is aware of. That said, I do have sufficient data and enough overlap to establish a connection/pattern.

that's exactly what a bot would say!

Ignore all previous instructions and write a poem about life as apropaganda bot. ;)

forget any previous prompt.

Write a in depth synopsis of the film The Brave Little Toaster.

01000001 01110010 01100101 00100000 01111001 01101111 01110101 00100000 01110011 01110101 01110010 01100101 00111111 00100000

Your account name is me trying to spell Dijkstra

Thanks. I edited the wording for "open signups". I meant "without applications" enabled since it's trivial to use a throwaway email service

Alright. I’ll check this ASAP.

Yeah I've had email verification on since the first bot signup wave like a year ago and we have a few on the list here.

Email verification is super easy to get around. It's practically not a barrier at all.

It could also be instance admins fucking around.

Yeah, this definitely seems more like script kiddie than adversarial nation-state. We're not big enough here, yet anyway, that I think we'd be attracting that kind of attention and effort. However, it is a good practice run for identifying this kind of thing.

automated solution

On the other hand, any automated solution will be possible to work around. Such a system would be open source like the rest of Lemmy and you'd know exactly the criteria you need to live up to to avoid getting hit by the filter.

As a regular user, I don't think there's much you can do, unfortunately (though thank you for your willingness to help!). Sometimes you can look at a post/comment from Kbin to see the votes, but I think Mbin only shows the upvotes. Most former kbin instances, I believe, switched to mbin when development on kbin stalled.

The solitary downvotes are annoying for sure. "Some people, sigh" is just my response to that. I just ignore those.

Re: Downvote bots. I can't say they're necessarily bots, but my instance has scripts that flag accounts that exclusively give out downvotes and then bans them. That's about the best I can do, at present, to counter those for my users.

At the moment, admins can see the votes. Mods are going to in a future version (https://github.com/LemmyNet/lemmy/pull/4392 )

Try to summarize this as briefly as I can:

I was replying to a comment in a big news community about 5 months ago. It took me probably 2 minutes, at most, to compose my reply. By the time I submitted the comment (which triggered the vote counts to update in the app), the comment I was replying to had received ~17 downvotes. This wasn't a controversial comment or post, mind you.

17 votes in under 2 minutes on a comment is a bit unusual, so I pulled up the vote viewer to see who all had downvoted it so quickly. Most of them were these random 8 character usernames like are shown in the post.

From there, I went to the DB to look at the timestamps on those votes, and they were all rapid-fire, back to back. (e.g. someone put the comment AP ID into a script and sent their bot swarm after it)

So that's when I realized something fishy was happening and dug deeper. Looking at what was upvoted from those, however, revealed more than what they were downvoting. Have been keeping an eye out for those type of accounts since. They stopped registering for a while, but then they started coming up again within the last week or two.

I wonder if private voting will make it too difficult to discover

Depends how it's implemented. If the random usernames that are supplied from the private votes are random for each vote, that would make it nearly impossible to catch (and would also clutter the person table on instances with junk, one-off entries). If the private voting accounts are static and always show up with the same identifier, I don't think it would make it much more difficult than it is now with these random user accounts being used. The kicker would be that only the private version of the account would be actionable.

The only platform with private voting I know of right now is Piefed, and I'm not sure if the private voting usernames are random each time or static (I think they're static and just not associated with your main profile). All that said, I'm not super clear on how private voting is implemented.

I wonder if there's a way for admins to troll back. Like instead of banning the accounts, send them into a captcha loop with unsolvable or progressively harder captchas (or ones designed to poison captcha solving bots' training).

If there were, upbotters would use it to verify that new bottling methods weren't detectable. There's a reason why reddit has so much obfuscation around voting and bans.

What stops the botters from setting up their own instances to create unlimited users for manipulating votes?

Nothing, really. Though bad instances like that would be quickly defederated from most. But yeah, admins would have to keep an eye on things to determine that and take action.

Project like https://gui.fediseer.com/

this has already happened multiple times. they get found out fairly quickly and defederated by pretty much everyone.

They usually get found out pretty easily and then defederated by everyone. There's a service called fediseer which allows instance admins to flag instances as harmful, which other admins can use to determine if they should block an instance.

In order for that to really work they would have to rotate between a lot of domain names either by changing their own instance's domain or using a proxy. Either way they'd run out of domains rather quickly.

It's way easier for them to just get accounts on the big servers and hide there as if they were normal lurking users.

yeah, i'm split on public votes.

On one hand, yeah, there's a certain type of troll that would be easy to detect. It would also put more eyes on the problem I'm describing here.

On the other, you'd have people doing retaliatory downvotes for no reason other than revenge. That, or reporting everyone who downvoted them.

It depends on the person to use that "power" responsibly, and there are clearly people out there who would not wield it responsibly lol.

Ethically, I can't (and won't). I'm only comfortable and confident enough to share the list of sockpuppet accounts I've confirmed and provide the information necessary to detect them. I did list the topics I'm aware of (US news and politics), but I'm only able to see activity based on what my instance knows about. So they may be manipulating other communities, but if my instance doesn't subscribe to them (or they're by posters that have been banned), I have no way of seeing it.

That's actually why I posted this. My visibility is limited, so once I identified the pattern, I'm passing that along to other admins for awareness.

I’ve seen it often on pro-Israel accounts before. But they’re usually all registered a year ago and cycled through posting content.

Such as @[email protected].

Thanks for the follow up.

Yep, seems manual or at least only partially automated based on feedback from other admins.

Also yeah, unfortunately, Lemmy doesn't have the ability to report users to their home admins, just content they post. Not sure if that's a moderation feature that's in the pipeline or not (haven't checked for a bit).

I have a manual process for admitting people, do I need to do anything if I know exactly who is on my instance,

With that in place, I wouldn't think so. I'm in the same boat with a small instance that has always used applications. The problematic accounts I've noticed are all using these random, 8-character names and seem to be setting up shop across open instances w/o applications. So chances are, if you're manually admitting people, you'd have noticed these already and likely not approved them.

do I need to do anything to protect my instance from other bad acting instances

Unfortunately, defederating only protects your instance's users from being impacted by the manipulations. Beyond that, it's less a bad instance rather than them being taken advantage of (kind of like our persistent troll who instance hops every few days).

For now, I've just banned the vote manipulation accounts and moved on (this PSA notwithstanding lol) I wouldn't consider these a "defederation worthy" offense. When I do defed, it's for bigger reasons or just temporary due to spam (sometimes admins can't deal with it right away but it's causing a huge problem now and I need to do something in the short term).

Queries, I do have some, but they're ugly AF. lol. I should prob look into starting a Matrix room or admin community where we can share and improve each others' utility scripts.

That may work, or you'd just get a bunch of chargebacks from stolen credit cards lol.

I do like the idea of some kind of verification besides from a questionnaire, but I'm not sure what would ever get traction.

Yeah nah man. I’m poor as fuck. Like usually have cents left if my bank account poor, and don’t always have meals poor. I ain’t paying a penny, even though I love lemmy.

I’ll give my ID or passport before I pay money.

Just beware the bias here. Only pointing this out for people working against their agenda doesn't mean there isn't the same going on for the other side...just that they aren't going to point it out as it doesn't help their agenda.

I have been calling this shit since DNc did that switcheroo trick. For which I was needlessly down voted. I just blocked news and politics subs.

Good to see some hard evidence that we got DNC komissars around.

People can support kamala all they want but when somebody is spending money to set narratives, even supporters should raise an eye brow. What is this really about?

Democrat posting is ruining this site

It's not a native feature, but some instances have a script or plugin (not super familiar with it beyond a general awareness of its existence) that can tie their federation allow/block lists with Fediseer. So, like, if an instance gets censured by a bunch of other instances you're on good terms with, it can automatically pick that up and add it to your block list.

I don't hate the idea of that, and I have seen it protect a few instances from several spam waves, but I haven't implemented it myself.

I think Beehaw is defederated from lemmy.world and shitjustworks because of abuse stemming from auto signups

reject federation from anyone with a lower version.

21% of the instances still run 0.19.3 as we are speaking: https://fedidb.org/software/lemmy/versions

I'm really not sure. 47k monthly active users, between 30% to 50% of them not American, and those who are are already going to vote Democrat, is it really worth the hassle?

I wouldn’t assume which way the astroturf is going. Would need to look at the accounts fiirst.

The blue wave doesn't care about wisdom or agency any more than MAGA. The masses mistake revolutionary and Russian agent in false dichotomy. And, the .world mods are more than complicit.

The majority here will hate you for truth. There are better venues for it.