65

So today I came across this answer, and I was sort of taken aback. The tool being recommended here has a very long history of being spammed on this site; to date, we have recorded over 90 occurrences of this particular type of spam, usually on questions matching keywords "path too long" or variations of this. It is widely known that the software being recommended here is known malware, and as such, the recommendation is dangerous for users who happen upon it.

I have never heard of this product outside of it being spammed, so I was actually a bit surprised to see it as a recommendation from a legit user with otherwise fine contributions. So I decided to do a little digging:

For the deletion of those folders, see https://github.com/npm/npm/issues/7768, which leads us to [redacted link].

So, as I have to assume good faith on this user's part, it seems plausible that he found the linked issue on github and from the overwhelmingly positive (seemingly) comments about this product over there inferred that it would be worthy to recommend. Now, the problem I have with this is that the vast majority of comments recommending the product are ridiculously spammy. Here is a list of examples from the github issue linked in the problematic answer:

comment by yuliareea, github user joined on the day of the comment, inactive since:

I had this problem for a long time. My friend recommended me [redacted] for fixing this. I am skeptic with this kind of tool but I was wrong. This tool can do anything.

comment by maximjo, github user joined on the day of the comment, inactive since:

I also have faced the same problem and “[redacted]” software sort out my problem easily. Try it, It is easy and very much user friendly.

There are a couple more like this. It seems to me that the company conducting the spam for the product is also targeting github, and the github admins and moderators of this page just did a poor job of catching and nuking it, leading our legit user to be deceived by this.

Now, to my actual question, since I don't know and can't infer the answer to this:

What to do in such a case?

Things I have considered:

  • Spam Flag: This doesn't seem appropriate because it seems to be a good faith effort to answer, and punishing a user for not noticing source spam with the nuke seems to be harsh. (Especially since a validated spam flag carries a hefty -100 reputation administrative penalty and can lead to a quick Q/A ban)

  • Moderator Flag: This issue takes more text to explain than would fit into one, the links alone.

  • Raise on meta: This is what I've done, in deference to the other options being unviable to me

  • Edit it out: I would, but the entire answer is based around recommending it, so I would be in essence defacing someone's answer

  • Do nothing: I'm not comfortable with a company getting away with second-hand spam on here.

  • Ping a moderator in chat and explain: I've been told not to do this.

So what's appropriate here?

2
  • 2
    There's many more spam comments on GitHub recommending it: github.com/… Jun 13, 2016 at 11:59
  • Note that the spammy comments on that particular issue have since been deleted.
    – pppery
    Jun 19, 2016 at 11:47

1 Answer 1

45

Your first step should be comment. Educate the author about the malicious nature of the link they posted.

If at all possible, edit to remove the link without changing the meaning of the answer (this was not possible in this case). If not possible, raise a moderator flag.

If a comment was left and no response from the author came for a while (say, a week), or the response from the author was not sympathetic, feel free to also downvote and cast delete votes against the answer.

I believe we must all think well before we cast red flags against a post whose author has significant reputation on the site (both because such a user posting spam is unlikely, and also because of the -100 penalty resulting from it).


As for the specific answer, I cleared the spam flags against the post and deleted it, leaving a comment for the author. I always like to assume good faith unless it's a really obvious case.

6
  • 20
    We've had many products that spammers pushed on the site which regular users unwittingly recommended, so this does happen on a regular basis. In fact, this isn't the first time that a good user has recommended this tool based on outside astroturfed promotion by these folks. Before casting a spam flag on someone with over 200 points of reputation, I'd recommend looking at their other posts to see if any of them promote a product. The odds of someone like that being a true spammer are very low.
    – Brad Larson Mod
    Jun 13, 2016 at 14:34
  • 33
    I agree about commenting, but I was troubled by part of your comment on the post in question: "Please don't spread AIDS on Stack Overflow." Malware is not AIDS, and we shouldn't conflate the two. Jun 13, 2016 at 17:34
  • 2
    That's fair, it was hastily written. But the likeness between the two is uncanny. You don't know you have it, and you spread it to others who then continue not knowing. I'll remove it though. Jun 13, 2016 at 18:44
  • When you say significant reputation what number do you have in mind? Brad says 200 rep, and the user in question has ~1000
    – Tas
    Jun 14, 2016 at 5:36
  • 9
    @Tas I personally take a closer look whenever a user has more than 100 or so rep. It's very unlikely for a spammer to get further than 2-3 posts before being detected, so if they have successful posts on their accounts, I suspect that something is up. Jun 14, 2016 at 7:05
  • 6
    I usually take a closer look when the spammer has any reputation at all. If the user has a couple legit posts, I tend to comment first before firing the spam flag,
    – Magisch
    Jun 14, 2016 at 8:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .