Hacker News new | ask | show | jobs
by goda90 129 days ago
What are some strategies a platform like this can take against spam or influence bots? Tying real life identities to users would certainly limit that(though identity theft and account selling could still happen), but that adds friction to joining, poses security risks, and many people might feel less comfortable putting their opinions openly online where backlash could impact real life.
6 comments

eID is the obvious answer here in Europe. Right now it's kinda scattered with different providers, but I believe EU is working on a more universal protocol. Unfortnately there are rumors it will require official Google/Apple play stores, unrooted devices, and all that it does today already.

But it should be treated as a relatively safe ID, it's even used for voting. If you feel uncomfortable, just have one device for eID, and one for everything else.

I think it's a great tool if we want to implement some sort of liquid democracy feature.

I really want this to be as simple as forwarding the user through a gov website and receiving a hash on a webhook. All I really want to know is that it is a citizen and the same hash as last time
So a local ballot box.

Host a platform like this at city hall, county building, capitol building, schools.

Only a human can access a terminal. Have humans monitor ingress/egress.

A more generalized solution that solves the specific problem inherent to all these digital ones.

If it requires me to leave the house, that increase in friction will mean I will vote maybe on 1/100th what I would otherwise vote on. I suspect pretty much everyone is the same
This is true of methods that don't require you to leave the house as well. Internet forums of all types are dominated by frequent users (by definition). People who are doing other things (working, raising families, living with disabilities that make participation difficult) are under-represented. Most of us just want someone with culturally normal values and competency to take care business. Many democratic systems do not select for people with culturally normal values and competency, unfortunately.
"Culturally normal values" is such a crazily loaded phrase. I personally don't have a strong desire to see people with culturally normal values be in charge, since, as far as I can tell, the "normal" person is neither very smart nor very thoughtful.
The lack of ambition is terrifying.
It's "culturally normal" for first worlders like us to thoughtlessly dump production of material needs on 12 year old sweatshop workers in Asia.

You have a point but I am not sure it is the one you intended.

In my experience, neighborhood and municipal governance often works unreasonably well with life-long public servants who, even if not be the most brilliant of us, diligently work every day like the rest of us.

Technology must assist local, bottom-up governance, rather than being supplanted.

Makes it hard for those with disabilities, overbearing work hours and family commitments, folks in the most need to have their voice heard?
And this is different from current town halls how? If you have an important issue to you, there are ways to be heard, and they aren't always convenient.

This is how representative democracy is meant to work... you work/talk with your local representatives who work as part of a larger body on your behalf. Part of the problem in the US is we stopped growing the House of Representatives, which should be about 4-5x the size that it currently is, so you have much closer local representatives.

My experience with my local town hall is that they are realestate developers looking to green light their nepo-projects, they don't even know the basic nomenclature of a committee. And when they want to borrow $90,000,000 to make a survailance center at a bad interest rate for a population of ~100,000 and the locals lose their shit over it, the first thing they try to do is ditch the process that allowed the people to petition to say no to the project. The last city manager and then the CFO -> inturm manager have been fired for inapproprate use of city funds (or being a different skin color in one case, I can't tell from the news reports.) And town hall meetings are held adjacent to a rough homeless hangout and an elevator or two deep for those with mobility issues. So I have hope that things like polis can help, my local system needs a flush out. Bots are a scourage for stuff like this as well, so deffinetly a complex problem space!
And this is why it's important to actually be involved in local politics... And probably a prime example of why libertarian values and limitations are probably better.

We've lost our sense of culture, purpose, pride and nationality with each generation. And while a lot of it may have been mostly propaganda, there's something to be said for civic cohesion.

We really need proof of soul systems to exist, extended to also have a proof of citizenship. While the proof of soul systems can plausible be done in a decentralized manner, proof of citizenship is much harder, and in my opinion this is one of (the few) things the government should really do.
What about Zero-Knowledge Identity? Use zero knowledge proofs to prove that I have an eID without actually providing my identity.
EFF has a good write-up about zero-knowledge: https://www.eff.org/deeplinks/2025/07/zero-knowledge-proofs-...

> What ZKPs don’t do is mitigate verifier abuse or limit their requests, such as over-asking for information they don’t need or limiting the number of times they request your age over time. They don’t prevent websites or applications from collecting other kinds of observable personally identifiable information like your IP address or other device information while interacting with them.

The arguments they make is a good example of "Don't let perfect be the enemy of good".

If we allow incumbents to make photo age verification and upload of ID to third-parties to be the solution, we will have a much worse solution.

Exactly. And I do think that a world where zkp ids are taken for granted is one where the issues they point to will be more surmountable than today.
Interesting. While that is true I don't see how it's an argument against. Over-asking + ZKP certainly seems superior to over-asking + without ZKP. Without ZKP in a world where you constantly need to identify yourself you have absolutely no privacy.

And going forward I think that any communication without establishing some kind of trust boundary will just be noise.

Something like a cert chain, but it would need to be both simple to use and secure. Those two requirements are greatly at odds with each other.
Yeah one reason I think the government has to offer this is usability. While you can imagine a purely p2p protocol between cypherpunks, for everyone else there needs to be a way to social workers, DMV staff, etc can deal with edge cases (such as your id being stolen and needing a reset). Furthermore it helps if it's super illegal to tamper with this network (consider how rare check fraud is, despite being easy).
Check fraud is easy to commit but not easy to get away with while also benefiting financially.

It's also illegal to steal things but that happens much more frequently because it's often fairly easy to get away with.

Yes that's the idea, once you have the soul-bound eID the ZK part is trivial, but the eID with the guarantees I outlined is not at all trivial.
Either I'm not sure what you mean by soul, or you are all-in on dualism.
Sorry the term of art is really soulbound identity right now, I use POS but it's less common. Definitions vary but I say a useful system must allow people to endorse statements with evidence they are a) alive b) not able to be represented by more than one identity (id is linked to your entire soul, not a persona or facet of your being) c) a kind of socially recognized person (human in the expected case)

and then layer on citizenship on top if you want to use this for polling, voting, etc.

How would this work considering that the soul is an entirely fictional concept?
“Empirically unprovable” and “fictional” are not synonymous.
Do you believe you are capable of doing that yourself?
All you have to do is flip the tortoise back over.

> You’re in a desert walking along in the sand when all of the sudden you look down, and you see a tortoise, it’s crawling toward you. You reach down, you flip the tortoise over on its back. The tortoise lays on its back, its belly baking in the hot sun, beating its legs trying to turn itself over, but it can’t, not without your help. But you’re not helping. Why is that?

The point of the test is to see if the subject has had life experience enough that they could restrain their own empathy.

Wanting to flip the tortoise back over was why he failed the test.

Meaning you have specified a SOUL.md at user- or project-level
Worldcoin tried to solve that. Any solution for this will be similarly creepy.
The casual ginger hate is disgusting. smh.

It's funny to think of how the US government is effectively a decentralized web of trust system. Building one that works, that has sufficient network effects, auditability, accountability, enforcability, so that when things are maliciously exploited, or people make mistakes, your system is robust and resilient - these are profound technically difficult challenges.

The US government effectively has to operate IDs under a web of trust, with 50 units sitting at the top, and a around 3,000 county sub-units, each of which are handling anywhere from 0 to 88 sub-units of towns, cities, other community structures.

Each community then deals with one or more hospitals, one or more doctors in each hospital, and every time a baby is born, they get some paperwork filled out, filed upward through the hierarchy of institutions, shared at the top level between the massive distributed database of social security numbers, and there are laws and regulations and officials in charge of making sure each link in the chain is where it needs to be and operates according to a standard protocol.

At any rate - ID is hard. You've gotta have rules and enforcement, accountability and due process, transparency and auditing, and you end up with something that looks a bit like a ledger or a blockchain. Getting a working blockchain running is almost trivial at this point, or building on any of the myriad existing blockchains. The hard part is the network incentives. It can't be centralized - no signing up for an account on some website. Federated or domain based ID can be good, but they're too technical and dependent on other nations and states. The incentives have to line up, too; if it's too low friction and easy, it'll constantly get exploited and scammed at a low level. If it's too high friction and difficult, nobody will want to bother with it.

Absent a compelling reason to participate, people need to be compelled into these ID schemes, and if they're used for important things, they need a corresponding level of enforcement, and force, backing them up, with due process. You can't run it like a gmail account, because then it's not reliable as a source of truth, and so on.

I don't know if there's a singular, technological fix, short of incorruptible AGI that we can trust to run things for us following an explicit set of rules, with protocols that allow any arbitrary independent number of networks and nodes and individuals to participate.

> they need a corresponding level of enforcement

Yes 100%, that's why the government needs to offer it, make tampering a serious offense, and dynamically defend its integrity from attackers.

> incorruptible AGI

Not a lot of alpha in planning for scenarios where we get that

The invite-tree they discuss is likely an effective measure. It provides a way of tracking back influxes of bots to responsible pre-existing account(s) and banning them too. And if someone is responsible for inviting many of the pre-existing accounts them too... Making the game of whac-a-mole winnable.

I'm assuming it's equivalent to lobste.rs implementation: https://lobste.rs/about#invitations

The cost of this is adding a ton of friction to joining.

I'm also somewhat curious about how "hateful content" is defined... I mean having a serious discussion on policies around children in schools and sport regarding trans issues has been labelled in some circles as hateful content if it doesn't blindly support the most progressive views.

I'm just using this as a specific example. Not saying that there aren't hateful sentiments or people behind comments or positions... only that depending on how such policies are interpreted you can't even debate sensitive issues.

Sigh... you know there's single digits number of trans athletes in the entire NCAA. The fact that this is even discussed at all is absurd given what else is going on in the country. Yes, intelligent people can have a conversation about it but even if you think it's a problem it's problem #43,948 on the list. Let's solve the other 43,947 problems first. It's really hard to believe people when they say it's not about bigotry. And it in every instance I've encountered people talking about it I would easily, and correctly, classify it has "hateful".
If I identify as a dog, should you be required to acknowledge and endorse that?

Now, scratch my belly and pay for my hair and tall implants with your taxes.

It's discussed because it's representative of a broader disagreement. People are rejecting the idea that 'woman' is nothing more than an identity that men can choose to appropriate, and are opposed to having this idea imposed upon society in law and policy.

It's such an unpopular idea for so many different reasons that this has managed to unify some very different groups of people in opposition: feminists, conservatives, disaffected liberals, and many others.

Exactly... And the reaction above is exactly why it's become difficult to even discuss because so many just dismiss the concern.
For many purposes, we need anonymous authentication. I haven't heard about much innovation on that and similar privacy fronts in awhile.

Off the top of my head, a possible method is a proxy or two or three, each handling different components of authentication and without knowledge of the other components. They return a token with validity properties (such as duration, level of service). All the vendor (e.g., Polis) would know is the validity of the token.

I'm sure others have thought about it more ...

You could do it now with OpenID SSO that only takes passkeys. The downside is that losing the passkey would lose the account. The problem is that OpenID leaks the authenticating sites to authentication site.

The problem is that lots of sites need/want email address. So would need system for anonymous email, and that would either need real email to forward, or way to read email.

I mean I can prove with a zero-knowledge-proof that have solved a Sudoku puzzle without actually giving away the solution so this seems possible?
There are so many things here that can work:

- Not having just upvote or downvote, but upvote as funny or insightful (slashdot)

- Not allowing to vote or comment until some karma has been reached (new accounts inflame topics and disappear later, having influenced).

- Invite only so one can block while chain of accounts.

- Not allowing to vote or comment every day or every hour, but randomly (more difficult for bots)

- Automatically downvoting posts with grammatical or low-effort errors.

- Having a way to allow replies only from the account you are answering to (so that bots do not switch places while moving the topic).

- Post history public (on reddit it can be made private, so a bot is posting hate in many communities and one cannot cross-check)

- Some sort of graph of statistics of accounts that comment together.

- Paying a small amount as friction for bots (linked to card, etc.)

I guess with AI there would be even more. These are some from the top of my head.

Slashdot didn't allow you to vote and comment on the same topic. (If you voted, then commented, your votes on the post were rescinded.)
> Automatically downvoting posts with grammatical or low-effort errors.

So allow only LLM generated posts?

People are capable of writing correctly. Source: your post.

If someone cannot be bothered, why should we bother to read what they have to say? I think it is a good signal.

EDIT: plus it is not an allow or not allow. The more errors the more downvoted, so it is a small adjustment.

You shouldn't care about presentation but others will.

I think an llm approach could be good. You make suggestions in however insane language and it converts the format to something boring and mundane accepted by all clients.

Some people are to brief, some elaborate more than necessary.

> You shouldn't care about presentation

Says who? Having good grammar is a signal that the person cares enough. I am surprised more forums do not use this signal.

milton h. erickson developed conversational hypnosis to bypass the conscious mind. This is of course a great accomplishment in the field.

It also had me completely convinced that one should only listen to what is said rather than how.

So, (lol) with me you score extra points if you properly em dash but not the kind of points one would want.

Of course, that excludes 90% of word plays.
If you provide some example word plays we can verify if that is true. I disagree personally.