How about limit new accounts?

kaartjesman · 2023-09-02T18:03:51.443Z

grin:

I would like to disagree, either in whole or in the interpretation of the phrases “cyber” and “security”.

We are getting a lot of traffic and interest in this topic because it is clearly surpassed the level of moderation and the amount of people actively working against the one bot is showing this is an attack.

The terms cyber-security is apt and appropriate to mention here, security the login system and indeed the actual data all our volunteers put into OSM is something that could very much be improved upon.

I’m very happy to see small steps being taken, the rate-limiting features added by Tom are great and make total sense. I doubt you’ll find anyone going against that. Well, other than those that are doing the vandalism anyway

This post (and I’m the post-starter) was indeed aimed at the foundation and I guess the board as the decision making people there. The goal is to get the ball rolling on essentially the same thing we’ve seen now. Rate-limiting at a bit more advanced level than we’ve seen so far.

A new account having the editing rights that match the account age. A zero day mapper will do a LOT less than one that has logged a lot of mapping days. This is a natural rate-limiting that would not have anyone actually complain as the limits will likely never be set so low as to cause zero-day mappers to hit them.

But I’m not entirely sure if the board and the foundation have even considered this approach. The actual replies on this topic here are positive about the idea. But are we ever going to see this? Or is this idea dismissed as not having majority consensus?

So, apart from this needing a coder, what is the chances of “limiting new accounts” being actually implemented?

grin · 2023-09-03T10:24:08.399Z

kaartjesman:

So, apart from this needing a coder, what is the chances of “limiting new accounts” being actually implemented?

Would you care to exactly define limiting please?

Mateusz_Konieczny · 2023-09-03T11:08:47.109Z

kaartjesman:

So, apart from this needing a coder, what is the chances of “limiting new accounts” being actually implemented?

Very high. In fact, it is already partially implemented and released.

Rate limits are part of limiting new accounts as new accounts have lower limits.

See say openstreetmap-website/app/models/user.rb at 75bde83a138226179059551e386561640adc285d · tomhughes/openstreetmap-website · GitHub - new users have lower allowed limits, that grow (up to some point) as users made more comments.

As result brand new account with normal activity is fairly unlikely to be impacted, accounts with more activity have higher limits and brand new vandal account will hit limits earlier.

mikmach · 2023-09-03T14:00:49.398Z

Please remember that limits will have some unobvious result - it will make vandalism harder to detect.

Mateusz_Konieczny · 2023-09-03T15:05:37.970Z

mikmach:

it will make vandalism harder to detect.

Can you be more specific which measures will have such effect? (except that reducing volume of vandal attacks results in the less vandalism to be found in the first place)

kaartjesman · 2023-09-03T16:53:49.279Z

grin:

Would you care to exactly define limiting please?

The 10km altitude idea is that a user-account of a certain age (or maturity) belongs to a person mapping matching that maturity. This means that an account that is 1 day old will be limited in mapping a whole new forest. But being active as day-1 mappers will be well within limits; normal users should not even know these limits exist.

What specific limits would be best should likely be the result of some data-mining in account history over the last couple of years. Any numbers I state on what I think will work will be pure guesswork. So I’ll skip numbers.

Limits that would be very useful are:

number of changesets per hour/day.
number of new points per changeset / day.
number of updated / added properties per changeset / day.
number of comments the user can make (this looks done).
Limiting the area which a single changeset can cover. Meaning you can’t edit Russia and New Zealand in the same changeset.
Notice that this one requires editors to also add such features in order to avoid upsetting users.

kaartjesman · 2023-09-03T16:55:54.702Z

mikmach:

Please remember that limits will have some unobvious result - it will make vandalism harder to detect.

We’ll probably need more bots with (secret) rulesets to find and flag anything that looks weird for human introspection.

But I also disagree on some level, about it being harder to detect. It is like graffiti under the bridge, the trick is not making authorities detect them, the trick is to empower the citizens in fixing it.

grin · 2023-09-03T17:06:37.921Z

Mateusz_Konieczny:

Can you be more specific which measures will have such effect?

Abuse is less obvious/visible if it’s streched evenly through multiple days or weeks.

grin · 2023-09-03T17:12:45.474Z

kaartjesman:

Limits that would be very useful are:

Thank you!
Now, look back two steps, look at your list and tell me which one would help anything on the current problem?

As far as I see none of them, that’s why I’m asking. (Making one edit per zombie account would trigger none of these.) If that’s right I’m wondering why this topic even exist if it’s not serving the solution to the problem in the OP at all. Mixing one problem with a solution to a different problem is not very easy to follow and debate., especially since half of the people talk about the former and the other half about the latter.

mikmach · 2023-09-03T17:23:46.401Z

At the moment primary tool to detect this type of vandalism is its scale. We should not be complacent because such vandalism - especially motivated ideologically - will not stop. It will just become smarter.

kaartjesman · 2023-09-03T17:24:02.914Z

grin:

Now, look back two steps, look at your list and tell me which one would help anything on the current problem?

All of them. Just check out the actual changesets that are being reverted if you have any such doubt.

grin:

I’m wondering why this topic even exist if it’s not serving the solution to the problem in the OP at all

Interesting. Seems you didn’t read OP, or who is OP.

grin · 2023-09-03T17:24:36.706Z

…I often see the case when there is a problem where people start to suggest “solutions” which are not helping the problem; they may try to solve a different problem, or more often than not they are not solve anything but give the false sense of having more control.

Limiting “new users” is not an obvious “solution” to “some” problems. Also it is obvious that the “limiting new users” phrase is pretty loosely defined here. It may well mean:

Limiting registrations (based on various metrics, but there are a few which is reliable).
Limiting already registered accounts based on activity, age, and various metrics which are not very reliable.
Deciding what and how to limit is not very obvious (and it’s not friendly to throw API errors to new users)
Manual oversight. All such mechanisms need continuous control, supervision and lot of manual handling the false positives (and false negatives as well); without that it quickly become a tool blocking new users generally.

I believe that it is good to ask the developers to consider various limit methods, but I don’t believe that any of those should be pushed without extensively thinking about the consequences (not for the established editors and not for the abusers) and matching it up with the data we already have about historical usage patterns. I strongly believe that OSMF does that, maybe it’s not well communicated. But I see little point in handing out advices without examining all of that.

grin · 2023-09-03T17:25:38.826Z

mikmach:

We should not be complacent

You seem to imply that nobody does anything about it. Maybe it’s just a lack of information?

grin · 2023-09-03T17:30:59.076Z

kaartjesman:

Interesting. Seems you didn’t read OP, or who is OP.

I have read it and I see you believe that your proposed “solution” would resolve your mentioned problem.
If you carefully read what I wrote you may realise that I believe this whole thread has no merit since your solution will not resolve your mentioned problem. Also I wanted to point out that your “solution” was only narrowly examined and have not considered the wider context and consequences.

Also it usually does not matter who wrote something; I am debating the message, not the messenger.

kaartjesman · 2023-09-03T17:41:45.535Z

Limiting accounts rights on our database is a common approach industry wide. You’re honestly the first one that I hear say it doesn’t go towards solving the problem. I’d love to know why you think so.

Here is my rationale:
A new account would be useless to do any real damage if sufficiently limited. Nothing a local maintainer could not fix in short order.
Creating many new accounts is equally useless, it multiplies a blunt instrument leaving you with an equally blunt instrument. You’d need 100000 accounts to do what the attacker has been doing.

What is the problem and how would you solve it?

grin · 2023-09-03T17:52:34.242Z

kaartjesman:

I’d love to know why you think so.

It is rather simple: about 30 years of experience.

(My most notorious example is Waze: new users can do nothing (including edits), and losing new user status requires a large amount of edits. It is a rather funny IRL catch-22. But there are numerous projects limiting new users to the extent that they have killed themselves due to the lack of fresh energy, while the old people lose (have lost) their motivation in the long run. Also the mood of the community erodes, become unwelcoming, and inflexible. But you don’t have to believe me at all, I am just shaing my memoirs.)

kaartjesman:

A new account would be useless to do any real damage if sufficiently limited.
….
Creating many new accounts is equally useless

You may remember my question about specifics. Either new accounts are limited to the complete uselessness or they can do editing. If they can your suggestion will not stop bots creating whatever amount of new accounts and do whatever actions they want. Bots can create accounts by hundreds a minute, if you have not seen that it’s not because they cannot, it’s just because they haven’t tried. Other [more spam-popular] projects see that already, and they are trying more tailored approaches, usually concentrating the specific problems instead of “general solutions” (which doesn’t work well).

kaartjesman · 2023-09-03T20:08:53.650Z

grin:

new users can do nothing

That is a very valid concern. Which is why it bears repeating that we should keep above natural limits. This has been echo’d by various people in this thread. I also wrote just a couple of hours ago:

kaartjesman:

This means that an account that is 1 day old will be limited in mapping a whole new forest. But being active as day-1 mappers will be well within limits; normal users should not even know these limits exist.

grin:

Either new accounts are limited to the complete uselessness or they can do editing.

I think its a bit more nuanced. Look at the actual vandalism changesets. They have a LOT of changes, all over the world. Nothing that any natural person would make, nothing that a mapper that is only actually mapping for a couple of days (as per their account age) would make.

So were are not talking about black and whites. Instead we are talking about a normal beginning user making 100 edits in a changeset and these guys making changesets (like 140428044) that have 4000 changes over a huge area 6000km horizontal. This is not black/white, its mostly gray with a bit of black and white on the outer edges.
The limiting of a fresh user to the extend that they never actually notice will still have a huge limiting effect on spammers.

So, again, this is a valid concern. Thank you for prodding me to share my view on it.
I think the problem of limiting people to a painful amount is easy to avoid without losing the benefit that limits give. One way has been suggested in the OP (original post) with levels, and the intention clarified with the 10KM overview in my reply 157. The intention is something to agree on and maintainers can adjust limits to better suit what people actually use.

Have a nice day!

Spatialia · 2023-09-08T03:35:18.539Z

A lot of the recent criticisms here seem to come in without the context that this thread started before the most severe parts of the recent vandalism wave, but understandably discussions merged. The arguments also seem to boil down to “that’s not a perfect approach, therefore don’t do it” rather than recognizing that defenses against abuse are always necessarily layered (see defense in depth). The existence of windows on my house does not make my doors unworthy of locks. They just need nuanced controls, which is what OP is asking for and what Mateusz is saying the operations team is working on. If anything, this thread has proven that the community is full of ideas of potential approaches that could be taken. Even if none of them is perfect, some blend of them will probably help.

mikmach:

At the moment primary tool to detect this type of vandalism is its scale. We should not be complacent because such vandalism - especially motivated ideologically - will not stop. It will just become smarter

This item in particular stuck out to me. Surely, if the smarter solution is to do many smaller edits, the vandals would already be doing that rather than making mass edits? To keep going with my locks analogy, it’s like saying that the best way to detect that someone has broken into my house is if my furniture is all gone. I’d personally prefer they do less damage in one go. We should lock out (and maybe have?) the largescale edits and invest in our QA tools in response, and we should have community dialog about what controls are appropriate.

Hungerburg · 2023-09-08T22:38:50.803Z

Spatialia:

the best way to detect that someone has broken into my house is if my furniture is all gone. I’d personally prefer they do less damage in one go.

In the end, it would not matter much, how many accounts were used to take the furniture out when you return home, a single one, a dozen? If I understand correctly, accounts have been made more expensive to mitigate that.

TrickyFoxy · 2023-09-16T22:52:13.171Z

@SomeoneElse Again saidThat | OpenStreetMap