DistBB [PART II]

DistBB [PART I] got deleted (probably because my Tor used the same exit node as the spammer). I bear no resentment towards Admin for I understand how utterly shitty this board's software is.

To Admin: could you please not use the ``delete all posts by IP'' button or at least hack up some way to protect posts against such deletion? If you don't mind, I understand you're quite busy.

Here is an update on the moderation system:

SPECIFICATION

A moderation post MUST have the string "!!mod-v1" as its `email' field, and it MUST be digitally signed (see the `pk-data' field). The `body' MUST match the following grammar:

body = tags-line "\n" moderation-line*
tags-line = tag-name (" " tag-name)*
tag-name = (any-character - "\0" - "\n" - " " - "," - "%" - "$" - "#")+
moderation-line = post-id (" " tag-index)+ "\n"
tag-index = nonnegative-integer

`post-id' MUST be the base64-encoded H160 of the post that is being tagged. Each `tag-index' is the zero-based index of the `tag-name' in `tag-line' that should be used to tag `post-id'.

The actual process for deciding whether to keep or delete a post is left up to the implementation.

EXAMPLE

Post "AAAA" is being tagged as "spam" and "worthless", post "BBBB" is being tagged as "spam" and "good", and post "CCCC" is being tagged as "worthless".

--begin post body
spam worthless good
AAAA 0 1
BBBB 0 2
CCCC 1
--end post body

SUGGESTED TAG NAMES

The purpose of the tags is to classify bad posts and annoyances to help people filter and control the content on their nodes. Dividing "A" and "A+" (good post) into "funny", "insightful" and so on is counterproductive since there is no reason why someone would want to configure their client to treat "funny" posts differently from "insightful" ones. The point of tags is also NOT to classify posts into topics.

Here are some suggested tag names along with their meanings:

"A+" : Post is very good, and should be kept at all costs.
"A" : Post is good.
"off" : Post is offtopic (in the case of strict thematic communities) or simply does not fit in, socially. This is very vague.
"spam" : The post is part of a disruptive flood where the contents of posts are computer-generated (e.g. the content is always the same or is chosen from a list).
"mspam" : The post is part of a disruptive flood where the contents of every post seems to be crafted manually by a human.
"prng" : While the post is not part of a computer or human driven flood, its contents are unreadable and it seems to have come out of "/dev/random".

IMPLEMENTATION SUGGESTIONS

Here follows an example of moderation system that can be used to decide posts' fates.

Using a system of rules, each post is assigned an integer rating. The decision of whether to keep or delete a post can be done as follows:

if the post's rating is nonnegative:
keep it
else:
if max(ratings of posts that reference it) >= abs(rating):
keep it
else:
delete it

In table 1 we can see an example of this policy.
highest rating of
referencing posts

\ 3 2 1 0 -1 -2 -3 n/a
\-------------------------
3 | k k k k k k k k
|
2 | k k k k k k k k
|
1 | k k k k k k k k
|
post rating 0 | k k k k k k k k
|
-1 | k k k D D D D D
|
-2 | k k D D D D D D
|
-3 | k D D D D D D D

Table 1. Deciding whether to keep or delete a post
according to its rating and the ratings of
the posts that reference it.

An example of system of rules used to determine posts' ratings could be the following. First see if any rule with the "force" modifier matches; if there is, then apply it directly. Otherwise, if any rule with positive rating matches, then the maximum matching rule wins; otherwise, the minimum matching rule wins. For example, if the rules that match a post have ratings {-3,-5,-6}, then the winning rating is -6. However, if the rules that match have ratings {1,2,-3,-5,-6}, then the winning rating is 2.

By default, posts are deleted after two weeks, in order to give the user a chance to review the deletion queue; "immediate" indicates that the posts should be deleted immediately.

--begin example
%trusted self bob ken
%acquaintances john uriel
%all %trusted-users %acquaintances
%annoying off mspam
%delete spam prng
%kill-list bertrand winston
%A A A+

pk self 10
tag self %A 10
tag self %delete -11,immediate,force
tag self %annoying -5,hide

pk %kill-list -5,immediate

pk %trusted 10

tag %trusted %A 5
tag %trusted %delete -5,immediate
tag %trusted %annoying -2,hide

tag %acquaintances %A 3
tag %acquaintances %delete -3
tag %acquaintances %annoying -1,hide

tag john,ken particular-annoyance -4,hide,immediate
tag %all some-annoyance-which-I-find-amusing 10
--end example

is this another?

https://en.wikipedia.org/wiki/Syndie

This looks like it has most of the basic features we were planning for distbb. We could just use it and hack in the new stuff for moderation. Looks like hashcash is in there as well. The only problem is it's written in java. Should we use this or write an alternative?

https://syndie.de/
http://infoanarchy.org/en/Syndie

>>115

parallel attacks

forgive me if I'm being naive, but couldn't you just make each peer check if the attacker's ips are the same and ignore them if so?

>>123
One of the design goals is to allow anonymous networks, in which case there is no id to identity the source.

>>124
Oh, I see. Then couldn't you make a new id, a random string, created and saved locally and send it with every request as an identifier? It could be re-created every couple of days

>>125
A spammer could use modified local software to generate many ids to try multiple simultaneous posts. There needs to be some proof of work for an id. For instance the server could send a captcha to solve, the client can respond with a solution, and if it matches, the server could respond with an id created for that client. Other ways are for the id to be computational expensive to create, which gives the spammer a cost associated with excessive posting.

>>126
how computationally expensive? even if it is 1 minute, the attacker could simply open all the programs at once and wait
if you mean memory expensive, it could schedule to use all ram to id one program, then when it's done it flushes and starts the other and so on

>>127
That's a decent point. Proof of work systems are more effective against the scenario where a single spammer sends a spam email to millions of addresses. A forum can still be spammed pretty hard by a slow posting bot.

Ok, I've read the thread, how about this
a hash function that takes 512MB of RAM and 10 seconds to compute
then each guy generates his id easily, a random string, then computes this string's hash (and saves it locally, whatever)
then all he needs to do to authenticate is select a peer at random, get his id and compute his id's hash, then send it to everybody (who'd already know it because the peer sent it to them)
then the ids of everybody could reset every couple of days so nobody makes a dictionary of them

nvm, I think I'm wrong, those numbers still seem small
What'd you guys use the hash function on?

>>130
I haven't yet published the details of the memory-hard sequential proof-of-work system I came up with for DistBB (because I've barely had the time to sleep, let alone work on it).

>>11
That was clever.

Publish these dubs

Check em

Distbbs is gay

bump?