1. User1 reads something that sounds pretty spammy from Bot1
2. Bot1 is not a “good bot” and thus doesn’t disclose that it is a bot.
3. User1 checks if spammy post was from a bot and sees that it’s not declared itself as one.
4. User1 then assumes that Bot1 is a human and trusts its Tweet more than it would have before the bot status was a thing.
1) Source IP range + number of accounts linked
2) interaction speed (some actions are too fast to be human, or show coordination like tweeting exact same tweet as a different account withing .2 seconds)
3) interaction times in a rolling window (individual humans need sleep, and usually around the same time)
4) IP packet fingerprinting: can flag discrepancies like a client seemingly tweeting from "Twitter for iPhone" but originating from a Linux/*BSD/windows host
It's an arms-race that I've fought on both sides of: deploying anti-abuse measures and writing a very well-behaved scraper; unfortunately some sites block all scrapers despite their behavior, and you have to figure out how the detection is done empirically and enjoy your short-lived victories while they last. On the defensive side, you continually have to update your detection heuristics, and the short-lived victories.
1. I also have a read-only Twitter archiving bot that doesn't hide its nature (the handle is "${NOUN}bot"). It runs from a single VPS at regular cron intervals. It'd be trivial for Twitter to detect this and make it not worth my while.
Even without the VPN, I occasionally have a bot that posts from a home machine with the same IP range as Tweetbot et al.
/s
- RESTful APIs don't even expect a User-Agent
- User-Agent is customisable (ie bad bots can trivially use an array of seemingly authentic strings)
- Even Google are moving away from using User-Agent for identification.
As such, you can indeed spot bots through political agenda :)
The behavior of concern here is Twitter accounts operating in service of somebody or something else, which might or might not be operated by a human, script, AI, or what have you. If they're operated by a human but the human's following its own script or administering a farm of puppet accounts, it'd still qualify even if the human gets to improvise on its message a bit.
A more accurate term might be 'agent', which also describes the day jobs of some of the people working on Twitter as their primary job :)
> Item 4 already happens on a large scale,
The article states that some people are skeptical about whether to trust tweets because they don’t know whether it’s a bot or not. My post was expanding off that premise saying an optional label doesn’t solve that problem, it makes it worse.
> The behavior of concern here is Twitter accounts operating in service of somebody or something else, which might or might not be operated by a human, script, AI, or what have you.
The article puts puppet accounts under the same umbrella as “bots”. My post was continuing on from that premise.
> A more accurate term might be 'agent',
Maybe, but arguing semantics completely misses the point of the discussion.
> which also describes the day jobs of some of the people working on Twitter as their primary job :)
We aren’t talking about people who work for Pizza Hut managing their Twitter presence. We are talking about large scale use of accounts pretending to be an average Joe but who are controlled by a single entity as part of a larger misinformation campaign. It might be a human who posts the messages but the person controlling those accounts aren’t the same as the accounts report themselves as and neither is there a 1:1 relationship between account and human. Calling them an “agent” legitimises it as if it’s people representing an organisation but it’s not, it’s effective still a network of bots except you’ve replaced software with “fleshware”.
I mean sure, if you want a different term to make the distinction then I have no issue with that. But the point of the discussion isn’t what do we name these types of accounts, it’s how do we make readers aware of when they’re reading an opinion vs an undercover piece of promotion. It’s kinds of similar to when some jurisdictions mandate that paid promotions need to be labelled as an advert rather than a review.
I've got no quarrel with anything you've said, except: item 4. In the parent post, your exact criticism was:
user reads info, user checks to see if it's labeled 'Officially A Bot', user does NOT find that label, and then item 4, user trusts info that harms them.
I'm sorry, I have a darker view of all this. The whole point is to push info (whether it's secret paid product promotion, political propaganda, or literal advocacy of genocide) into normalized social discussions and past any initial network of bots, and the whole point is that it's unreasonably effective on social networks where strangers can seem like 'friends'.
Obvious bots vs. surreptitious or human-controlled 'bots' is an almost meaningless distinction here. Also, you're correct in that 'agent' can be like a corporate 'registered agent' but also can imply 'secret agent', as in hostile foreign spy who doesn't have your best interests at heart. An intelligent operative trying to hurt you, not simply a 'robot' with no interests at all.
We're talking about and agreeing on all the same things. I'm saying the real key to managing the damage of this is not 'label things a bot', the real key is to broadly communicate the idea, 'this whole platform is trying to maximize social contagion and make you feel like large numbers of strangers are your trusted personal friends'.
And they're not, they're really, really not.