Forbid anonymous comments for notes

[Zverik]

We in Russia have encountered a person that is leaving anonymous one-letter comments to all of the notes. That got me thinking, why do we do that, allowing anonymous comments? I understand anonymous reports: people can help improving the map without registering. But comments cannot add anything helpful: reporters who commit, register.

[HolgerJeromin]

I had seen in the past anonymous comments like: "yes, shop xy is really closed". This was useful data. But on the other side there are many comments "oh, in the last comment i forgot got login. It was me."

[VladimirSlavik]

What happens if the anonymous reporter comes back to answer a question?

[TakutoRU]

Of hundreds closed by me notes I found maybe 5 when really anonymous reporter answered question. Others were OSM users who forget to login, or "hit and run" notes, which was never revisited again by author. Maybe some captcha on comments help with mass bot spamming? False alarms from spam comments to my notes start to be annoyance.

[RicoElectrico]

While I've seen these single character comments in Gdańsk, in my experience legitimate anonymous comments are not that rare.

Still, the system is too loose indeed. We could require a captcha for more than a few comments from the same person.

[amandasaurus]

IME i haven't seen many anonymous comments, it's rare in Ireland. But I have seen cases where there has been follow up feedback provided in an anonymous comment.

[gravitystorm]

From the above comments it looks like there are both unwanted anonymous comments along with useful ones. So it's not clear to me that we should block them. Rather than basing it on the experiences of a few people it might be worth examining the wider situation.

We publish all the notes including comments at http://planet.openstreetmap.org/notes/ . Someone might be willing to run some analysis of these, to see how many anonymous comments vs regular comments, whether there's any correlation between types (or lengths) of comments vs how quickly they are resolved, and so on.

Alternatively, we can approach this a different way, and instead make it easier for users to flag unhelpful comments, whether anonymous or not, see e.g. #1576

I realise the originally reported problem is genuine, I just don't want us to throw the baby out with the bathwater.

[Zverik]

Well, until you've all started receiving one-letter anonymous comments for every note you left, you won't get what we are experiencing here in Russia. In case of seemingly helpful answers, you cannot know if the comment was left by the same mapper, or just by a passing-by troll. Actually I can set up a bot that replies "Yes, I confirm that" to most of the notes, and 99% of mappers will consider that a legitimate comment.

Anonymous notes are okay, since they are annotated with "don't trust this blindly", but anonymous comments turn our notes system into a 4chan.

[simonpoole]

While I believe it has been suggested before, just to re-iterate: we could copy Wikipedias pseudo-anonymous approach here and store and display the IPv4/v6 address in lieu of a user name. This might work as a bit of a deterrent to not all too clued up spammers that I suspect is what we are seeing.

The downside is that we would need to have specific ToU for the Notes subsystem and that it could legally be problematic from a privacy pov (naturally as deep pocketed WMF has a vested interest in the system it is likely that we would get support if it ever came to real trouble).

[tomhughes]

We do store the IP address!

[Zverik]

Instead of IP addresses we could display them hashed, essentially giving anonymous users temporary user names.

But the next question is, will that help banning anonymous users, and deleting all of their comments?

[matkoniecz]

How complicated it would be to enable captcha that would make spam more obnoxious also for our single letter spammer commenter?

And yes, I can confirm that single letter comment spam on Russia is obnoxious. For now I set mail route that deletes all notifications that anonymous user commented on my note.

[tomhughes]

How does one "enable captcha" for an api exactly?

Not that we want to - captchas are hopeless. Plus the main source of captchas actively aids an OSM competitor.

[joostschouppe]

In 2016, there were 37687 comments by logged in users, and 16336 anonymous comments. In May to June of 2017, there was a normal amount of logged in comments, but 89.458 anonymous comments. From the conversation here, I guess they just stopped spamming in Russia? Since August of this year, anonymous comments are back to normal. Do you guys still think it's worth seeing if useful anonymous comments have real added value? I made the numbers above unrelated to this thread, see this diary post for some more stuff (with links to my scripts). If there's still interest related to this issue, I could give it a go.

[MaartenDeen]

I think anonymous comments should have to be treated the same as anonymous wiki edits. Editor known by IP adress so spammers have less obscurity and can be addressed by their actions. So a comment should not come from "Anonymous", but from IP 1.2.3.4 (Anonymous)" or so. We are all anonymous to some degree and having a name does not mean that you're that person, but this way you can attribute different comments to the same person. And I think that is a valuable tool.

[woodpeck]

I have personally been fighting a very persistent vandal over the last year or so, who has created thousands of anonymous notes with bogus content. It is relatively easy to detect and remove them in a somewhat automated fashion. However, this user increasingly takes to vandalising existing notes (typical example: https://www.openstreetmap.org/note/799041), effectively making the notes system unusable in their area of interest. Policing these edits is difficult because there's no real-time feed of note comments and no way of deleting individual note comments. Hence the only remedy available is either hiding the note altogether (losing valuable information), or hiding it and creating a new, "cleansed", version, which also loses information about when and by whom the note was first created.

I am therefore, once again, proposing that anonymous users should not be allowed to comment on notes. (I am ok with anonymous users creating new notes.)

I realize that I am trying to introduce a general change to fight a very specific issue but I think that the abuse pattern we're seeing here could easily happen, and has apparently happened, elsewhere.

[dieterdreist]

2018-07-17 12:54 GMT+02:00 Frederik Ramm notifications@github.com:

I am therefore, once again, proposing that anonymous users should not be allowed to comment on notes. (I am ok with anonymous users creating new notes.)

+1, it will also avoid that registered mappers leave anonymous comments by accident because they haven't been noticing they weren't logged in (happens occassionally to me). If you remove this functionality I would expect your vandal to move to creating new notes (if he is insistent).

An alternative idea could be to hide anonymous comments and/or notes from people that are not logged in (any logged in user could moderate to either delete them or make them visible). So vandals like this would not have the "satisfaction" of seeing the results of their actions.

[harry-wood]

I noticed this today around Denver (not all of the notes there, but a lot of those have these junk single letter replies).

Is there an IP address we can block related to this vandal? That's a question only sysadmins can answer. @tomhughes said we are storing IP addresses of commenters, so my question is: did this vandal stick to a reasonably fixed IP address? and could we block it? Presumably we do do some general web server IP blocking already for heavy traffic abusers.

I appreciate that's a short-term fix, because they may just swap to a different IP address, and if they don't, other future vandals surely will begin a cat n mouse game that way, but... seems like a first thing to try if we didn't already.

(I think conventional web security wisdom is that you shouldn't play IP address blocking games, but if we're serious about allowing anonymous text contributions in the long run, then we may need to go down wikipedia's "soft security" route, and so maybe it does make sense to start doing some policing by IP address)

[matkoniecz]

conventional web security wisdom is that you shouldn't play IP address blocking games

Maybe it changed, but Wikipedia had some more or less successful IP-based blocks. It is not very helpful with dedicated vandals willing to pay for private VPNs, but it blocks at least bored teenagers.

[tomhughes]

It's quite interesting - the address behind that note has opened about 500 notes, with sensible-ish descriptions (often one word) in Russian.

It has also commented 5000 times all them just a single character.

I have blocked the address and hidden all the one letter comments.

[matkoniecz]

I have blocked the address and hidden all the one letter comments.

Thanks!

[harry-wood]

Cool. Let's if that works as a solution in this case at all.

More generally with the "Forbid anonymous comments" idea suggested here I think it's OK-ish, but I'm tempted to dream up a more subtle ramping up of restrictions. @RicoElectrico suggested "require a captcha for more than a few comments" which doesn't work because we can't put a captcha on an API. However the hybrid of these ideas would be....

Forbid anonymous users from making more than a few comments per day.

[MaartenDeen]

Can the anonymous user that posted the last 3 comments here also be blocked. It is bullying what he does. And no doubt it is the same person as the one who made the other spam comments.

[Zverik]

How much work would you put on admins to avoid blocking anonymous commenters? How many people would need to be affected by these malicious anonymous people? Does it need to be Tom or Harry? Are there examples of reliably useful comments that you would like to keep receiving?

[woodpeck]

Side note: I wrote "there is no way of deleting individual note comments". While this is true, I noticed that the data model actually already supports the deletion (hiding) of individual note comments and there are even tests for ensuring they are indeed hidden, but there is neither an API nor a web user interface for this at the moment. I created a wishlist issue #1934 for that.

[ligfietser]

Can the anonymous user that posted the last 3 comments here also be blocked. It is bullying what he does. And no doubt it is the same person as the one who made the other spam comments.

The same Troll is now commenting on notes he created himself or every other note in the area (Utrecht Province) with words like "how long does it take to put it on the map?" or even commanding "Mapper X, do something!" This is so frustrating that I dont use or look on the note reports anymore.

[matkoniecz]

"how long does it take to put it on the map?" or even commanding "Mapper X, do something!"

My approach in cases like this is to close note and recreate it (I skip recreation of original reporter was insulting and complained about minor unimportant missing things - like one unmapped shop among thousands of other unmapped).

[ligfietser]

That will trigger the Troll even more, and I will get all those spam in my email box, no thank you.

"how long does it take to put it on the map?" or even commanding "Mapper X, do something!"

My approach in cases like this is to close note and recreate it (I skip recreation of original reporter was insulting and complained about minor unimportant missing things - like one unmapped shop among thousands of other unmapped).

[Zverik]

I wonder if forbidding anonymous edits back in 2009 was met with similar reluctance.

Repeating myself: while anonymous notes might have some value, anonymous comments absolutely do not. You do not know if a commenter is a note reporter, you do not have any continuity, absent security restrictions make it easy to spam, and absence of moderation turns it into a 4chan.

[harry-wood]

It's too extreme to say anonymous comments have absolutely no value. Repeating VladimirSlavik's question "What happens if the anonymous reporter comes back to answer a question?" ...but maybe they're causing too much pain for the value they add.

Is the single character commenter back again? Does it look like the same person or a small number of people causing a problem? I'm wondering if my idea still looks like it would help:

Forbid anonymous users (identified by IP address) from making more than a few comments per day. It could show a message "Thanks contributing to OpenStreetMap via notes. If you wish to add more, please create an account to identify yourself"

[Zverik]

Repeating my answer, "In case of seemingly helpful answers, you cannot know if the comment was left by the same mapper, or just by a passing-by troll. Actually I can set up a bot that replies "Yes, I confirm that" to most of the notes, and 99% of mappers will consider that a legitimate comment."

That imaginary bot can leave only a couple comments a day, and still would contribute to breaking the feedback for mappers.

[harry-wood]

OK but this is posing theoretical problems in the event of a ratcheting up of hostilities. I agree it's worth thinking about, because this might be regarded as inevitable in the long run. If we picture what abuse might happen e.g. by a disgruntled blocked user, with sufficient determination to mess things up... all anonymous features look pretty untenable actually.

Or rather we would have to move towards a wikipedia's approach to anonymity, which is to display IP addresses, thus making un-logged-in users actually less anonymous than logged in users.

[HolgerJeromin]

Forbid anonymous users (identified by IP address) from making more than a few comments per day.

One ip can be one person or all customers of one internet provider (carrier grade nat)

[bhousel]

It's a very bad idea in 2018 to allow anonymous users to upload notes, especially given that notes don't have the same character limitation that other entities in OpenStreetMap. Anybody on the internet could just start uploading gigabytes of garbage without even signing in.

Seems like it would be easy to overwhelm the OSM database servers using this attack vector, but I'm not about to try. Please put an end to anonymous notes and comments before someone does try it. Or at least implement a note creation rate limit or limit the size of the note (if it doesn't have these things already).

[SomeoneElseOSM]

@harry-wood

Is the single character commenter back again? Does it look like the same person or a small number of people causing a problem?

No, it looks like a different issue. The occurrences that caused this issue to wake back up again were examples of straightforward trollery in the Netherlands. I don't want to go into much more detail to avoid bringing them more attention.

It's too extreme to say anonymous comments have absolutely no value.

Maybe, but only just. About the only thing I could get from one would be "maybe I need to take a detour and see what is really there". I believe that I could count on my thumbs the number of times I have found anonymous note comments useful.

[woodpeck]

This is anecdotal but: I have created quite a few anonymous comments myself because I had simply forgotten to log in. If I am not the only person to do this, then it is likely that many of the useful anonymous comments are not really made by people without accounts or people who made a conscient decision to be anonymous, but by people who had forgotten to log in ;)

[Zverik]

OK but this is posing theoretical problems in the event of a ratcheting up of hostilities. I agree it's worth thinking about, because this might be regarded as inevitable in the long run. If we picture what abuse might happen...

Harry, this whole issue was opened a year and a half ago because of a major anonymous comments abuse. Multiple OSM members were complaining about these on several communication channels. But this is the same as with other privilege issues: until you've experienced them personally (which may never happen), it's hard for you to believe they are real.

Sadly these comments were restricted to Russia and, iirc, some South American countries, but there was nothing in Western Europe. Which means, "OSM mainland" was not affected indeed, no reason to do anything.

[matkoniecz]

I have created quite a few anonymous comments myself because I had simply forgotten to log in

The same for me

[MaartenDeen]

The "forgotten to log in" argument is moot because you have the ability to log in and make the comment.

@Zverik it is not only in Russia. In the Netherlands there is or are users (it looks like just this single person) that likes to add notes to order people to do things and then complain and bully people when it does not happen fast enough for his taste. Even when logged in mappers explain why they can not map it.

[matkoniecz]

is moot

It was not supporting keeping anonymous notes allowed, it was about fact that some (significant?) part of useful anonymous comments are from people who forgot to log in.

[matkoniecz]

And there is one benefit of forced log in - there will be a better chance to communicate with people who left notes.

[jaapdevries1]

Hello,

I came here via https://forum.openstreetmap.org/viewtopic.php?id=64366. Since an anonymous claims me to do something see> The same Troll is now commenting on notes he / she has created himself / herself in the area (Utrecht Province) with words like "How long does it take? " or even commanding "Mapper X, do something!" This is so frustrating that I dont use or look on the note reports anymore.

Mapper X is me Jaap de Vries and I can not respond to comments since. ( https://www.openstreetmap.org/note/1147122#map=13/52.0930/5.2346&layers=N or https://www.openstreetmap.org/note/1556104#map=12/51.9818/5.1183&layers=N) This is very irritating and I would like this block to be undone. My Ip address is 90.145.225.154 thank you!

[mmd-osm]

I like the idea by @dieterdreist:

An alternative idea could be to hide anonymous comments and/or notes from people that are not logged in (any logged in user could moderate to either delete them or make them visible). So vandals like this would not have the "satisfaction" of seeing the results of their actions.

Let's start replacing actual anonymous comments by something like "Anonymous comment only visible to logged in users.". You could still ask questions back to that anonymous user (just in case), and they could even add some further comments on their own. But other users won't be able to see them (including themselves). This is quite deliberate, if people want to see more, they should sign up.

Then there's the harassment topic mentioned above: once GDPR is in place, anonymous users also won't see which user is responding to their comments.

[Zverik]

to hide anonymous comments and/or notes from people that are not logged in

How does it solve any of the issues outlined above?

You could still ask questions back to that anonymous user

How would they get these questions and how can you be sure the original anonymous person answered?

[HolgerJeromin]

You could still ask questions back to that anonymous user

How would they get these questions

Comments from logged in users are public, so the stranger can see the question of an osm user

and how can you be sure the original anonymous person answered?

Is this important?

[mmd-osm]

@Zverik : I don't think there's a perfect solution to this issue, each option has some pros and cons. The idea is to balance different opinions a bit and see if this is any better than the current situation.

imagine all the pointless stuff on https://www.openstreetmap.org/note/799041 would be condensed to a few "Multiple comments by anonymous contributors only visible to logged on users" lines. It would immediately take away the "graffiti wall" effect.

As a logged on user, you can always see both sides of the conversion. Ideally you can ask some "intelligent" questions, which the original anonymous user can relate to (if they happen to revisit the note, exactly as it is today), but that don't make much sense to some other anonymous user. I don't know how well this works in reality, it's just an idea.

Still you would need additional moderation options like hiding comments, etc. Banning anonymous comments seems like the ultimate step, and I'm getting the impression from the discussion here that there's no clear consensus yet. I may be wrong here, though.

[Adamant36]

Personally, I don't think banning anonymous comments outright is a good idea. Its been a useful feature for adding notes to places asking for their names where there might not be an "official" mapper, but someone passing through the sight can give an answer. Its also been useful for me to have anonymous comments when I am out and about or during taking a quick break from something to leave a quick response without having to login. Especially if its on a public computer like at college. Id also say there is "graffiti" or rubbish comments by logged in users. Its not something confined to anonymous ones. I think there is a bit of sampling bias going on that just makes seem that way. Sometimes the "graffiti" is useful also. A lot of times serves a purpose or it wouldn't be there.

I think the best answer to the issue of spam posters is to limit how many messages a person can send in a short time period. I don't think anyone really minds a few random characters here and there by an anonymous vandal. Its the 300 within a few minutes that is annoying. Also, it might help deter some people from junk messaging if their IP address is visible, or at least help create the feeling that we know who they are. Even if we really don't. I agree with @mmd-osm that there are pros and cons to every way of dealing with it though. So, I don't think there is one ultimate solution. Its more about just reducing the number of junk messages down to a manageable, none obnoxious amount. Both of which can be done without banning anonymous messages outright.

[jaapdevries1]

Hello,

I came here via https://forum.openstreetmap.org/viewtopic.php?id=64366. Since an anonymous claims me to do something see> The same Troll is now commenting on notes he / she has created himself / herself in the area (Utrecht Province) with words like "How long does it take? " or even commanding "Mapper X, do something!" This is so frustrating that I dont use or look on the note reports anymore.

Mapper X is me Jaap de Vries and I can not respond to comments since. ( https://www.openstreetmap.org/note/1147122#map=13/52.0930/5.2346&layers=N or https://www.openstreetmap.org/note/1556104#map=12/51.9818/5.1183&layers=N) This is very irritating and I would like this block to be undone. My Ip address is 90.145.225.154 thank you!

Hallo, Ik heb een tijdje geleden hier een berichtje geplaatst omdat ik sinds anoniem mij opdrachten geeft zoals hierboven beschreven. Ik kan bestaande opmerkingen wel sluiten maar niet op reageren. Ik kan ook geen opmerkingen aanmaken. Dit is heel vervelend! Eerder kon ik het wel tot dat er een anoniem kwam die vervelend ging doen. Ik wordt van het kastje naar de muur gestuurd. Ik heb graag hulp nodig om dit ongedaan te maken, wie kan mij hier helpen.

Hello, I posted a message here a while ago because since a anonymous have given assignments as described above. I can close on existing comments but I can not respond these. I can not make any comments either at myself. This is very annoying! Earlier I was able to create answers and remarks until anonymous. I am sent from the box to the wall (Dutch proverb) I would like to get help to undo this, who can help me here.

[bdxd111]

There is one very active anonymous user in my general area. He keeps on making new notes. When these are not fixed the same day he demands specific local mappers to fix them, calling them out like "BDXD111, I know you can do it!", "Good excuse to go outside for once", etc. This is the same guy as @jaapdevries1 mentioned. Most other anonymous users generally do leave useful comments.

As a way to tell different anonymous users apart, would it be possible to show a unique/random ID next each anonymous user? You would still be anonymous, but you would have a post history. You can't see who a person is, only what he/she did.

[matkoniecz]

each anonymous user

You may give each IP a random ID, but not to each user (one user may use many IPs - in extreme separate for every action, many users may use one IP - school or in some cases entire country may use single IP)

[jaapdevries1]

Anoniem is nog steeds bezig met nieuwe opmerkingen en het geven van vervelende reactie. Zie een reactie van hem https://www.openstreetmap.org/note/1542596#map=15/51.7054/5.3373&layers=N en https://www.openstreetmap.org/note/1578045#map=13/52.1294/5.3699&layers=N

Ik kan nog steeds geen opmerkingen of een reactie plaatsen. Ik betreur dat niemand mij kan helpen met mijn probleem. Zelfs de DWG helpt mij niet 👎 . Mijn ip adres is: Netherlands 90.145.225.154

Jaap de Vries

---

Anonymous is still working on new comments and giving annoying reaction. See a comment   from him https://www.openstreetmap.org/note/1542596#map=15/51.7054/5.3373&layers=N and https://www.openstreetmap.org/note/1578045#map=13/52.1294/5.3699&layers= N

I still can not comment a note or post comment. I regret that no one can help me with my problem. Even the DWG does not help me 👎. My IP address is: Netherlands 90.145.225.154