84

The question really is that simple. There's a lot of discussion about what is allowed in user profiles, but nothing that actually covers this. I removed a link to a GitHub repository with code to run, to create sock puppet accounts and instructions on how to increase reputation points and what to do to gain reputation points.

Although many people can work these things out for themselves, it still gives some people the tools they may not have. Linking it on the site it's intended to harm, to me, is not a good idea.

Thoughts?

Related:

13
  • 2
    Could you post an anonymized version of the profile text? Or is it just the link to the repo? Imho, instructions and links to do something that is illegal, against the CoC or against the site rules should be removed.
    – BDL
    Commented Mar 20, 2019 at 20:32
  • 1
    @BDL it was a link to the repo. I'm not keen on linking it to the actual user profile or repo, as it will be a goto way to find it for people wanting to mess with the site.
    – user3956566
    Commented Mar 20, 2019 at 20:33
  • 4
    Since such things directly subvert the site's principles, I would say it isn't ok. Commented Mar 20, 2019 at 20:33
  • 22
    The less is said/documented about it the better. This just doesn't need a hard rule carved out on a stone tablet but can be entirely left to a moderator's judgement. If anybody complains about it then the mod can direct them to meta to make their case. Woof, imagine the spectacle. Commented Mar 20, 2019 at 21:00
  • 12
    @HansPassant Ironically, this is in response to a flag and a subsequent complaint. Could you believe it? Instead I brought it to meta to save the person linking said repo into a meta post.
    – user3956566
    Commented Mar 20, 2019 at 21:02
  • 2
    (Good to see you back, with your diamond icon)
    – Raedwald
    Commented Mar 21, 2019 at 7:07
  • 6
    I'm somewhat curious now as to what that github is and if there's anything I can extract from their recommendations for sock puppet owners to find some more of them ....
    – Magisch
    Commented Mar 21, 2019 at 8:40
  • 8
    @Magisch Reverse engineer, and use it to strengthen the vote fraud script. "Your workarounds have made us stronger!"
    – fbueckert
    Commented Mar 21, 2019 at 13:00
  • I always had the impression that most of the photos of 1rep accounts seem to be google-stock things - probably some generic list of usa/canada/german universities and "I am student at {x}" with a random.choice(piclist) script. Would'nt mind to take a look at the repository myself though Commented Mar 21, 2019 at 17:42
  • 1
    Thanks for creating this post. I wish you had pinged me about it, but thanks for creating it. Now it's time to for me to lose some useless meta rep. Commented Mar 21, 2019 at 21:42
  • 3
    @CiroSantilli新疆改造中心六四事件法轮功 There's no such thing as meta rep, and be aware that I am unhappy that you have done this. At the very least you should've told SE staff so they could proof the system against your code. The techniques are known, and there's no way to easily protect against them without compromising the system for everyone else.
    – wizzwizz4
    Commented Mar 21, 2019 at 21:59
  • @wizzwizz4 ah OK meta rep got abolished at some point? That's good. BTW, I had posted this long ago on StackApps where it got deleted, I'm pretty sure they were alerted then. In any case, certainly SO devs are aware of such matters before my script. Instead of hiding it, we should acknowledge it and search for a real algorithmic solution. Commented Mar 21, 2019 at 22:14
  • 3
    @CiroSantilli新疆改造中心六四事件法轮功 Any algorithmic solution would harm real users. Unless you mean added heuristics, in which case that'd harm real users behind NATs.
    – wizzwizz4
    Commented Mar 22, 2019 at 7:06

3 Answers 3

72

Removing content from user profiles that describe how to circumvent or cheat the site (and would, when noticed, lead to suspensions or account deletions) is fine.

Same goes for content that is illegal or against the CoC.

8
  • 12
    I would argue on illegal, as we have to know the scope. People using Chinesse banned words came to my mind. Commented Mar 21, 2019 at 8:56
  • 5
    @xdtTransform if by "Chinese banned words" you're referring to words/phrases that are alleged to trigger internet bans for anyone trying to access them from within the great firewall, I'd argue they're every bit as abusive as a tirade of profanity and should result in the user being smacked down just as hard by moderation. Commented Mar 21, 2019 at 13:33
  • 3
    @DanNeely: Already discussed in Are political profiles that could possibly affect the participations of other users allowed?
    – BDL
    Commented Mar 21, 2019 at 13:50
  • 6
    @xdtTransform Good point. I've come across a fair few profiles (mostly by higher-rep users) protesting against the Communist Party of China, which would likely be illegal or have severe social repercussions if viewed or expressed within the PRC. For example, would I be violating the CoC if I appended 臺灣不在中國 (Taiwan is not a part of China) to my display name, even though it's perfectly valid for me to express in my country of residence? Commented Mar 21, 2019 at 14:03
  • 2
    For the record I know that point has been discussed to death in the link BDL posted, but just stating that the definition of "illegal" can vary wildly outside of the "obvious" global laws Commented Mar 21, 2019 at 14:04
  • 3
    Guys, are you looking for the definition of "illegal" for the purpose of this site? I can help ! Just scroll down, click on link named "Legal", Ctrl-F, type "jurisdiction", Enter, here we are: "comply with the obligations set forth in these Public Network Terms, and to the extent that use of the public Network does not conflict with the applicable laws, rules and regulations of the user’s jurisdiction. Stack Overflow reserves the right to refuse, suspend or terminate your access to the public Network if it determines, in its sole discretion ...". It's that simple.
    – artem
    Commented Mar 21, 2019 at 17:42
  • Interesting problem. I would not look upon someone favourably if their profile/ posting signature, etc... contained content that put some schlimazel on a watchlist in a repressive country. Or a free country, for that matter. Commented Mar 21, 2019 at 22:01
  • 3
    @DanNeely allowing a dictatorship to become technologically advanced and start WW3 might be even more abusive. Commented Mar 22, 2019 at 8:07
26

There's already established precedent for posts which do something like this. I would imagine that the user profile doesn't diverge too much from this heuristic.

Since there's no material value from showing users how to defraud the Stack Exchange network, its removal is perfectly acceptable.

2
  • 4
    There is one material value: without transparency, there can be no trust: meta.stackoverflow.com/questions/381577/… Commented Mar 21, 2019 at 21:43
  • 6
    Defrauding a system isn't the same as compromising a system. Also, Stack Overflow's a fairly open book; there's no new exploits to be had in creating tens or hundreds of sock puppets to upvote your content. All this does is package this process up in something convenient for someone who really cares about these unicorn points enough to cheat their way to a few thousand.
    – Makoto
    Commented Mar 21, 2019 at 21:53
-20

It should be allowed, security by obscurity only makes things worse

It is a well established principle that trying to secure a system by trying to hide how it works only makes things worse:

If the system is vulnerable to sock puppets, and those puppets are easy to bootstrap and conceal, then it has certainly already been breached by black hats without us knowing it.

Instead of trying to hide the fact that the system is flawed, we should instead improve the post / user rating with a better algorithm, e.g. PageRank-like. This would require sock puppets to vote between themselves to have any weight, and then it would be easier to find and take down entire sock puppet nets in one go.

Without transparency, in particular of the fraud detection algorithms, Stack Overflow reputation will never be truly trustworthy.

Since upvoter data is private, it is not possible for the public to develop such algorithms. Therefore, the only alternative for the public to explore the opaque system is by trying to create the puppets and see if they are caught. White hats will then reveal their actions eventually, while black hats won't.

White hats won't have the patience to set things up and provide a better algorithm as it stands.

It does not make any difference if such content is banned on Stack Overflow alone

Any highly ranked Google PageRank GitHub repository will be found by anyone trying to attack a website.

Black hats are highly specialized at finding sources with the newest exploits, and they certainly know how to Google.

46
  • 5
    In reading this answer, I think you are grossly misinterpreting the situation. There are no exploits being discussed here.
    – Makoto
    Commented Mar 21, 2019 at 21:53
  • 8
    I'd argue it's the difference between unethical social engineering and penetration testing.
    – Makoto
    Commented Mar 21, 2019 at 22:00
  • 5
    To put a finer point to it, the exploit is well-known - a user creates dozens of sock puppets to upvote their content. This can be detected by moderators and action can be taken against them at scale. There's no inherent vulnerability in allowing users to create accounts or vote on posts, but there is a ToS violation if you create two or more accounts to interact with one another. In other words, the system is as open as it can be. The main issue at hand is allowing someone the convenience of automating that process.
    – Makoto
    Commented Mar 21, 2019 at 22:02
  • 4
    I think you're over-emphasizing the "security through obscurity" aspect of removing this information from a profile. See this answer for why removing blatant links to breaking site rules is fine. It's relying on obscurity as the only defense that is bad, not the removal of ToS breaking content.
    – ryanyuyu
    Commented Mar 21, 2019 at 22:04
  • 9
    To be clear. I've looked at your repo and your ethics and I deeply admire you. I just don't think it's ok to put a link to it in your profile. Yes it can be found elsewhere, but that's not SO's concern. I understand your convictions about security through obscurity. Still handing people who otherwise could not manage to do this a way to do it, just doesn't help the site. There will always be challenges in managing a site like this and much of it is based on community participation. Seeing and flagging suspicious activity, on top of any algorithms. So you can decide to help or impede that. 1/2
    – user3956566
    Commented Mar 21, 2019 at 23:48
  • 7
    2/2 Creating repos on how to circumvent it is actually impeding that. Instead create a repo to help people detect it. The site is what it is, so no matter what your views are on security, it's only helping people break the site rules, not find people breaking them. I really wasn't sure how to go about letting you know about this post. I ended up deleting my Twitter account after this (not your fault) and a mod message seemed over the top. I probably should have stalked you and left a comment. I figured you would find it and am glad you did.
    – user3956566
    Commented Mar 21, 2019 at 23:49
  • 3
    Imho, there is a huge difference between describing a way to cheat the system and providing a tool so that every SkriptKiddy can do it.
    – BDL
    Commented Mar 22, 2019 at 7:15
  • 5
    So, how exactly would SO be better off if we all knew exactly what to avoid when wanting to commit vote fraud?
    – Cerbrus
    Commented Mar 22, 2019 at 7:46
  • 2
    @YvetteColomb developing detection is too hard possible for non SO employees because we don't have data about who upvoted whom to test the algorithms. Commented Mar 22, 2019 at 8:05
  • 2
    @Cerbrus everyone would clearly see that the voting system is broken, and that would force devs to fix it. Commented Mar 22, 2019 at 8:05
  • 5
    @CiroSantilli新疆改造中心六四事件法轮功: so you did it the white hat ethical way? First informed the company about your tool, then gave them some time to fix the problem, and only afterwards published the code? Everything else would be just abusive.
    – BDL
    Commented Mar 22, 2019 at 8:10
  • 2
    @BDL the problem is obvious, SO devs must already know about it. This was discussed in moderation chat at least once in the past. The only thing left to do is to let the general public see it as well to force their hand. Commented Mar 22, 2019 at 8:11
  • 3
    @BDL things must burn for new ones to come up. Commented Mar 22, 2019 at 8:17
  • 4
    The network has its ways of improved detection beyond what the algorhitm reverses. They have a few layers of protection against vote fraud, and the whole thing is more sophisticated then you think. Also, instead of providing a way people can commit vote fraud, you could focus on finding more vote fraud and making the reputation system more trustworthy yourself. It's not that hard, people are doing it. The algorhitm in exactness isn't public, but if you spend some time with it, you can figure out to catch some of what it misses even from public data and make a positive impact that way. throwi
    – Magisch
    Commented Mar 22, 2019 at 8:26
  • 6
    ing your hands in the air and going "I guess I'll help burn this system to the ground then so they'll have to make something better" is unhelpful and I'd argue unethical. Instead of trying to harm the site to in some roundabout way allegedly force positive change, how about if you truly care about vote fraud (I'm not mocking that, I do) you help make the defenses more robust and help identify it yourself.
    – Magisch
    Commented Mar 22, 2019 at 8:28

You must log in to answer this question.