Before

This was originally posted by myself on 12 May 2019 as a response to the then–current astonishing volumes of “wfgz spam” & “vip spam” affecting these Diary pages (upto 30,000 spam-posts each day, starting 25 April). That existential threat appears to have receded (see the first part of the Bot-Flood Stats page), but the continual background trickle of spam– & nonsense–posts (upto 10 a day) continues.

It should be possible to easily shut off that vile flow without badly affecting valid OSM users. This post reflects on the current situation, and seeks to present my own suggestions and to provoke comments to perhaps obtain even better methods.

Institute a “No-edit, No-diary” rule.

All current spam & abuse would stop the instant that the privilege of posting to this Diary was restricted to those that have added to the map. My suggestion would be a parameter of ‘10 changesets’ to relax that rule.

There are further steps that would need to be taken to make sure that such a rule would not cause collateral damage to the map:

1. Moderate New-User Map Edits
   Map edits by new users should be human-moderated by being placed into a hidden queue. A team of volunteers that are seasoned mappers can then be assigned Moderator rights to accept/reject map-edits within the hidden queue. Such moderation should only be lifted once the user has shown themselves to be a human with (say) 10 useful map edits. Diary posts would be auto-prevented until the statutory number of Map edits was completed. Once completed that restriction would be auto-removed.

2. Auto-remove Unused Accounts
   Auto-remove all those that acquire an OSM account but never update the map within (say) 2 weeks.

Background

OSM Diary pages both share features in common with blogs, forums, etc. and at the same time are different. The features shared in common are:–

• Any member of the public can create an OSM account
• That account can be used to make public posts into the Diary pages
• The above is highly attractive to both those that spam & those that write graffiti

Neither Spam nor Graffiti are unusual, and all blogs/forums/etc. have to get to grips with it or stop trading. As an electronic medium, there are 2 aspects for every blog/forum/etc. to consider:–

1. Bot spam/graffiti
2. Human spam/graffiti

The first can NOT be handled by human means (intervention needs to be scripted, and this is where Firewall rules often appear, amongst other methods including the use of external services such as Cloudflare), whilst the second can NOT be handled by scripted methods, and normally requires human Moderators.

Stats

The OSM Admin reported on 18 May:–

• ~6% of currently active posts are from an account which has never edited
• ~10% posts were made before the user had any edits

Map-spam & Map-abuse

The OSM map is currently subject to considerable spam. That ranges from folks dropping nodes at their current business location with nothing but a website in it, to random map spam, to extensive Notes spam (possibly using a bot). Moderating new users would stop all that spam instantly, and OSM existing users are enthusiastic to get involved in helping new users map responsibly.

Bot-spam

The Bot Stats page gives conclusive proof that these OSM Diary pages have been included within bot-spamming software such as XRumer (Wikipedia, History). That fact does not actually make any sense!

Spam-bots such as XRumer are a commercial Franchise (exactly like McDonalds) that recruit hundreds of franchisees to use the Franchisor bots to farm hundreds of thousands of Forums using open-source software. The commercial model depends upon the existence of all those blogs, forums, guestbooks, boards, BBS, CMS and other platforms using the same, identical software. OSM is a tiny backwater compared to those, and should be uninteresting. Nevertheless, for some reason both OpenClipArt and OpenStreetMap got hit at the same time by bots.

Human-abuse examples

karolparkitny is a non-mapper that signed up to OSM on 26 May & made a nonsense post in Polish the same day (that is not an insult, that is what Karol says in a reply to a comment to his post asking “What is the point of this?”). Karol complains that he can post but not remove his post:–

And what’s the point in this post?

Totally for nothing, you can delete and I would gladly do it, but I do not have permission. It turned out that in OSM you can only add a journal entry without being deleted … a bit strange.

c0077w (a spammer username if ever I have seen one) signed up on 18 May. To this day it has never edited the map. On the same day as signing up — and possibly within 2 micro-seconds of doing so — it posted the following in Arabic (I’ve translated it into EN and copied both Title & post-text in full):

Abu Dhabi Al Shamheh
….

That is just 2 Unicode characters for the post text:–

• “…” (U+2026 HORIZONTAL ELLIPSIS)
• “.” (U+002E FULL STOP)

There is zero point in leaving all these nonsense posts in place.