Thursday, April 29, 2010

A reddit experiment: Help us catch spammers by verifying your email address (please?)

One of the most powerful tools for fighting spam is the humble verification email: If you force all new users to specify an email address, and then verify it by sending a test message, it makes the spammers' job dramatically harder.

However, reddit's always been about openness and privacy. I remember the day I created my account, back in 2005, and how impressed I was that all I had to do was type in a username and a password -- three tenths of a second later, my account had been created and I was logged into it. No annoying, "You must click the link in your email before you can do anything fun" message.

Further, there are plenty of occasions when reddit users wish to remain anonymous -- they're publishing controversial words, or sharing deeply personal stories on IAmA, or posting a photo of their... well, you get the point. It's a fine line to walk, crushing spammers without hurting our community.

After much careful consideration, we think we've found the right balance, so we're going to start an experiment today. Here's how it works:

First and foremost, nobody has to verify their email address. If you're paranoid about this sort of thing and would rather jump off a cliff than tell reddit your email address, you'll still be able to log in, vote, post crazy comments, submit links to bunker supplies and tinfoil hat designs, and everything else that you're used to.

In fact, we think (and hope) that normal, non-spammy users won't even notice any change. The only ones who should have a problem are people who submit one crummy link after another, as often as the site will let them. We're going to start limiting them to a certain number of crummy links per hour (and per day, per week, etc).

So what defines a crummy link? Well:
  • Links that are flagged as spam are crummy.
  • Links that fail deputy moderation are crummy.
  • Links that get more downvotes than upvotes are crummy.
  • Links with even a tiny positive score are successful.
  • Links that survive 24 hours without getting marked as spam are successful.
  • Links that get explicitly approved by a moderator are successful.
And what happens if you use up your "crummy-links" quota? If you haven't verified your email address, you'll be prompted to. Once you do, you'll be granted a lot more leeway.

But what if you're really hard on your luck, and despite making a good-faith effort, you use up even this larger crummy-links quota? Or if you don't want to verify your email address for some reason? You can try again in a little while, or you can message the moderators of the reddits you're submitting to and ask them to certify that you're not spamming. There's two ways they can do this: They can manually approve links you've already submitted, which as mentioned above will free up space in your quota, or they can add you to their reddit's whitelist, which will let you submit as often as you want within their community.

And just in case there was any doubt: reddit will never sell your address, bother you with unsolicited email, or anything remotely evil or annoying. But we really think it will make the spammers stand out if as many people as possible verify their email addresses. For best results, use the most prestigious address you have. In other words, throwaway addresses like g634c3Gssd2d@mailinator.com stink, free accounts like joe@hotmail.com and sue12345@gmail.com are so-so, and anything ending in, say, .edu.au, .gov.uk, or .mil is freaking outstanding.

As an added incentive, you may notice something new in your trophy case afterwards.

TLDR: It would help us fight spam if honest users verified their email addresses. But we're not going to make anyone do it.
discuss this post on reddit