# Designing For Evil

**URL:** <https://discourse.codinghorror.com/t/designing-for-evil/317>\
**Category:** blog\
**Created:** [May 28, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317 "2008-05-28T00:00:00Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![codinghorror](https://discourse.codinghorror.com/user_avatar/discourse.codinghorror.com/codinghorror/32/36371_2.png) [@codinghorror](https://discourse.codinghorror.com/u/codinghorror)\
**Post date:** [May 28, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/1 "2008-05-28T00:00:00Z")

</div>

Have you ever used [Craigslist](http://en.wikipedia.org/wiki/Craigslist)? It's an almost entirely free, mostly anonymous [classified advertising](http://en.wikipedia.org/wiki/Classified_advertising) service which evolved from an early internet phenomenon into a service so powerful it is often [accused of single-handedly destroying the newspaper business](http://blogs.vertigosoftware.com/jatwood/archive/2005/12/16/1747.aspx). Unfortunately, these same characteristics also make Craigslist a particularly juicy target for spammers and evildoers. Who knows; maybe it's karma.

* * *
This is a companion discussion topic for the original blog entry at: [http://www.codinghorror.com/blog/2008/05/designing-for-evil.html](http://www.codinghorror.com/blog/2008/05/designing-for-evil.html)

---

<div class="post-metadata">

**Author:** ![BCS](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/b/ecd19e/32.png) [@BCS](https://discourse.codinghorror.com/u/BCS)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/2 "2008-05-29T00:00:00Z")

</div>

1. follow the money. the spam must have away to find whoever is paying for it (or why would they pay)

2. spam the spammer. reply to the spam with as much useless information as you legally can. Give them 10M useless email addresses. If you can do it morally, DDOS them. Set up voluntary bot nets (nospam@home) that make it as costly as possible to get anything useful out of spam

---

<div class="post-metadata">

**Author:** ![Dubs](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/d/d6d6ee/32.png) [@Dubs](https://discourse.codinghorror.com/u/Dubs)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/3 "2008-05-29T00:00:00Z")

</div>

“Say goodbye to your two best friends! And I don’t mean your pals in the Winnebago!!” --Dark Helmet

---

<div class="post-metadata">

**Author:** ![MrGreg](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/m/8797f3/32.png) [@MrGreg](https://discourse.codinghorror.com/u/MrGreg)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/4 "2008-05-29T00:00:00Z")

</div>

It seems to me the only realistic way to prevent spamming is to have some sort of vigilante task force that identifies the root source of the spam and posts their contact info publicly.

If there was a known spammer who lived near me, even if they didn’t affect sites I use, I would gladly do things to make their life miserable. Maybe not the most legal of solutions, but probably effective. Of course we would need support around the world, too.

---

<div class="post-metadata">

**Author:** ![Sean](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/s/f0a364/32.png) [@Sean](https://discourse.codinghorror.com/u/Sean)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/5 "2008-05-29T00:00:00Z")

</div>

The real solution is to start charging.. 50 cents an ad isn’t burdensome to the public, but devastating for spammers.

Right now spammers see themselves in a gray area. Might be breaking the law, but odds of being prosecuted are small. Few spammers would cross the line into credit card fraud.

Why aren’t captchkas simple questions that would require AI far more complex than what we have right now? For example, What was the last name of the wife of the 41st President of the United States?

Or if that’s too easy, something more complex, but that would still be easily solved by a google search.

---

<div class="post-metadata">

**Author:** ![MarkT](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/m/c89c15/32.png) [@MarkT](https://discourse.codinghorror.com/u/MarkT)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/9 "2008-05-29T00:00:00Z")

</div>

> (my favorite at the moment is “no murderers please!”

It is a funny thing to say, but unfortunately it’s also a valid concern. There are worse things than spammers. A girl I knew in high school was murdered as a result of responding to the wrong person’s ad on craigslist:

> **[Nanny Who Answered Online Ad Found Dead](http://www.cbsnews.com/news/nanny-who-answered-online-ad-found-dead/)**
>
> Man Police Believe Posted Wanted Ad Is In Custody In Minnesota

---

<div class="post-metadata">

**Author:** ![Larry\_H](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/l/2acd7d/32.png) [@Larry\_H](https://discourse.codinghorror.com/u/Larry_H)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/10 "2008-05-29T00:00:00Z")

</div>

Spam identification is a computationally difficult task, so use it as your CAPTCHA.

Present the use with 4 messages, 1 known spam, 1 known ham and 2 others, and have them classify them. So long as they get the known spam and ham correct, you have a reasonable chance that they are human and that they have classified the unknowns correctly.

---

<div class="post-metadata">

**Author:** ![Black\_Hate](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/b/b19c9b/32.png) [@Black\_Hate](https://discourse.codinghorror.com/u/Black_Hate)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/11 "2008-05-29T00:00:00Z")

</div>

How do the black hats avoid their own message boards filling up with spam? Is it just the “good is dumb” thing and we “good guys” refuse to get down to their level and mess up their forums for swapping hints about how to mess up others?

---

<div class="post-metadata">

**Author:** ![pookleblinky1](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/p/bcef8e/32.png) [@pookleblinky1](https://discourse.codinghorror.com/u/pookleblinky1)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/12 "2008-05-29T00:00:00Z")

</div>

Sometimes I think the only way to end spam would be to amass a private army of henchmen-hackers, capable of tracing down commenters’ locations and napalming the place unless innocence can be proved.

Remember that Russian spammer who got murdered, and the police admitted that literally millions of people have a motive? [http://www.securityfocus.com/news/11256](http://www.securityfocus.com/news/11256)

If only we organized our hate…

---

<div class="post-metadata">

**Author:** ![Dave](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/d/ee7513/32.png) [@Dave](https://discourse.codinghorror.com/u/Dave)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/13 "2008-05-29T00:00:00Z")

</div>

I find it amazing how many ideas were posted on this blog alone (ones I hadn’t thought of), yet there is some flaw in each and every one. Although the flash one or java one seem kinda convincing. Unfortunately, the better computer AI gets, the harder humans will have to work to prove their existence.

---

<div class="post-metadata">

**Author:** ![MaxK](https://discourse.codinghorror.com/user_avatar/discourse.codinghorror.com/maxk/32/75524_2.png) [@MaxK](https://discourse.codinghorror.com/u/MaxK)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/14 "2008-05-29T00:00:00Z")

</div>

I think one of the advantages that stackoverflow will have is that its subject matter is very limited–having a “discuss anything” area would be a bad idea, IMO, for exactly that reason.

In the Personals sections of websites, two things are problematic: it involves email, and it involves sex-related activities. Those are two things that spammers love and have.

Services also involves email, and is pretty easy to fake as certain services are often desired and you’re going to get a lot of hits on those.

“For Sale” is harder to fake–each individual ad is unlikely to get many hits (with the exception of concert tickets or currently-popular electronics).

stackoverflow postings will be less likely to contain URLs or require email, and will definitely not be sex-related (let’s hope)! I think the very nature of the site will make your job a lot easier than craigslist. It will also make it a lot easier for human beings to detect that something is spam.

The one thing to think about is attachments–if you allow anybody to attach anything, that allows people to attach redirects to websites and also to attach malicious JS that will operate in your domain.

-Max

---

<div class="post-metadata">

**Author:** ![AnonymousC37](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/a/22d042/32.png) [@AnonymousC37](https://discourse.codinghorror.com/u/AnonymousC37)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/15 "2008-05-29T00:00:00Z")

</div>

> Why aren’t captchkas [sic] simple questions that would require AI far more complex than what we have right now?

Because coming up with hard questions is even harder than answering hard questions. Click on my URL to see how a bot can answer your sample question automatically. You had to employ a human brain to _invent_ that question, and yet a machine cracked it in 0.27 seconds! Now imagine trying to make a question so hard that a machine couldn’t answer it… and then try to imagine _making a machine_ that could make questions so hard that a machine couldn’t answer them.

There’s plenty of research on questions machines can’t answer; Google “The balloon hit a branch and burst.” for more information. There’s much less (useful) research on coming up with these questions in the first place.

But this is all academic. The right solution, as others have said, is (1) stop frequenting sites where spam is indistinguishable from ham, and (2) use human moderators to mod down spam, optionally using (2) to train a filter at the same time. It works for Wikipedia, YouTube, most competent blogs…

---

<div class="post-metadata">

**Author:** ![Tony](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/t/ee7513/32.png) [@Tony](https://discourse.codinghorror.com/u/Tony)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/16 "2008-05-29T00:00:00Z")

</div>

Spam is a severe problem but I have noticed on a few occasions were otherwise secure systems have had holes in their spammer protection. I used to run a forum which revieved about 200 posts a day and the spam protection hadn’t failed. However I noticed a few months later that the software’s knowledge base feature (which barely anyone used or looked at) had been overrun with spam as the captcha was missing on submit link for the knowledge base. I ended up removing the section altogether as it wasn’t any use but if it had been a more public section such as the downloads db it would have caused a lot more trouble. (It was a gaming forum and it hosted a good few modifications)

---

<div class="post-metadata">

**Author:** ![vamsi](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/v/b38774/32.png) [@vamsi](https://discourse.codinghorror.com/u/vamsi)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/17 "2008-05-29T00:00:00Z")

</div>

i see that the problem that needs to be solve is to differentiate human from a bot/machine. I was thinking of a predetermined places to click on a flash and then use the sequence of positions on the screen (which again changes on every re-load for better spam protection. I believe this will give better protection since it will be a timed way of doing it

---

<div class="post-metadata">

**Author:** ![codinghorror](https://discourse.codinghorror.com/user_avatar/discourse.codinghorror.com/codinghorror/32/36371_2.png) [@codinghorror](https://discourse.codinghorror.com/u/codinghorror)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/18 "2008-05-29T00:00:00Z")

</div>

I’m a little disappointed this has turned into an extended discussion of CAPTCHA. If you have time, do refer to my previous articles on CAPTCHA, which covered all the suggestions (and more) I’ve seen outlined here:

CAPTCHA Effectiveness

> **[CAPTCHA Effectiveness](https://blog.codinghorror.com/captcha-effectiveness/)**
>
> If you’ve used the internet at all in the last few years, I’m sure you’ve seen your share of CAPTCHAs:
> 
> Of course, nobody wants to use CAPTCHAs. They’re a necessary evil, just like the locks on the doors to your home and your car.
> 
> CAPTCHAs are

Has CAPTCHA Been “Broken”?

> **[Has CAPTCHA Been “Broken?”](https://blog.codinghorror.com/has-captcha-been-broken/)**
>
> A recent Wall Street Journal describes Ticketmaster’s problems with online scalpers:
> 
> The Internet era has brought speed and convenience to all sorts of consumer transactions. For concertgoers, however, it has also led to ever-faster sellouts for hot...

CAPTCHA is Dead, Long Live CAPTCHA!

> **[CAPTCHA is Dead, Long Live CAPTCHA!](https://blog.codinghorror.com/captcha-is-dead-long-live-captcha/)**
>
> In November 2007 I called these three CAPTCHA implementations “unbreakable”:
> 
> 
> 
> Google
> (unbreakable)Hotmail
> (unbreakable)Yahoo
> (unbreakable)
> 
> 
> 
> 2008 is shaping up to be a very bad year indeed for CAPTCHAs:
> 
> \* Jan 17: InformationWeek reports Yahoo...

In short, the Google CAPTCHA still works – the amount of time necessary to get a response back from the “breaking” services is indicative of human intervention – although some of the lesser ones have definitely fallen.

For stackoverflow, it’s likely we’ll use a lightweight “invisible” JavaScript captcha.

---

<div class="post-metadata">

**Author:** ![PaulW](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/p/e56c9b/32.png) [@PaulW](https://discourse.codinghorror.com/u/PaulW)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/19 "2008-05-29T00:00:00Z")

</div>

The thing I’ve always thought about spam is that whilst software struggles to recognise it, humans can almost always spot it immediately. So I figure your best bet is to make it as easy as possible for humans to flag spam. I speak from no experience.

I do, however, have experience of using SpamSieve on my Mac. It does the heuristic thing of learning from what I flag as spam. Very few false negatives or false positives, although admittedly my spam traffic is peanuts compared to what a popular forum might receive.

---

<div class="post-metadata">

**Author:** ![BSD](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/b/e95f7d/32.png) [@BSD](https://discourse.codinghorror.com/u/BSD)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/20 "2008-05-29T00:00:00Z")

</div>

Your suggestions (and more) have either already been implemented to no effect by Craigslist, or were not applicable in the first place.

What is a developer to do when there’s nothing left to fight with and/or your resources are far outmatched by the spammers?

---

<div class="post-metadata">

**Author:** ![Mecki](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/m/ecccb3/32.png) [@Mecki](https://discourse.codinghorror.com/u/Mecki)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/21 "2008-05-29T00:00:00Z")

</div>

Well Jeff, with all that knowledge, when will you change the keyword to enter? ;) It has been the same ever since my first comment to the page. I could write a SPAM tool right now. Actually I don’t even need a tool for that. A simple BASH shell script with curl to post text to the page in a for-loop will do :P

Those CAPTCHAs are getting more and more useless. The better OCR software will get, the more useless these will get. And one day the only way to make them unreadable for OCR software will be to make them unreadable for human beings, too. Despite that, they don’t work well for people with disabilites.

The biggest problem is: I’m a spammer and I want to spam a forum with CAPTCHAs that no OCR software can handle. No problem. I make a simple porn page and ask people on every access to the page to first solve the CAPTCHA. In fact this is not my capture, but the one of the forum I want to spam. That way people are helping me to solve the CAPTCHA and spam the forum. Pretty easy, isn’t it? Would also work on your page. The problem here is, that the CAPTCHAs don’t tell people where they come from (what page or service they try to secure). A capture should contain the URL of the page to that it belongs to!

Still, CAPTCHAs are not the way to go. Anyone thinking about alternatives to these? It must be something a human being can easily solve, but that’s almost impossible for a computer to solve. Not a trivial task.

---

<div class="post-metadata">

**Author:** ![RahulC](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/r/9de053/32.png) [@RahulC](https://discourse.codinghorror.com/u/RahulC)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/22 "2008-05-29T00:00:00Z")

</div>

I have to ask .  
I mean( I know it is going to sound insanely naive) I get that spam is incredibly lucrative but how exactly  
what is the revenue model( not just craigslist but mail, trackbacks,comments whereever they spam)  
I dont know anyone who responds to a spam ad  
who is the customer in all this money that spammers are making  
clearly theres tons and tons of money in it for it to be such a concerted effort but um how  
Thanks

---

<div class="post-metadata">

**Author:** ![ballmer](https://discourse.codinghorror.com/letter_avatar_proxy/v2/letter/b/a4c791/32.png) [@ballmer](https://discourse.codinghorror.com/u/ballmer)\
**Post date:** [May 29, 2008, 12:00am UTC](https://discourse.codinghorror.com/t/designing-for-evil/317/23 "2008-05-29T00:00:00Z")

</div>

If you’re going to include CAPTCHA verification on stackoverflow, you should think about using [http://en.wikipedia.org/wiki/Recaptcha](http://en.wikipedia.org/wiki/Recaptcha) . It’s as great way to combine the verification with getting actual work done.

[Next page](https://discourse.codinghorror.com/t/designing-for-evil/317.md?page=2)