I'm sure you've all seen the spam comments lately.

I know when I sign in to my account, I have to do a human test that ranges from "which of these objects would fit in a microwave" to "indicate which of these colours remind you of your birthday."

Has AI just gotten that good or have the spammers been forced to hire a human to do the test before turning the reins over to the bot?

I'd say something close to the latter. Maybe people make the accounts and then bots do the rest?

The detection method CloudFlare uses is pretty deceptive. Artificial intelligence(of many kinds, not just the generative stuff) could detect what to click for a while now. In fact, user input from these captchas had been sold and used as training data for various kinds of models.

The Captcha itself isn't completely sure what's on the picture. That's where you come in. You do the work as a price of admission, and it sells your results.

What it Actually does to prevent bots from getting in is detect How you solve it. Human input is irregular. Your cursor twitches or veers off target before correcting, you fiddle with placement, you type, erase and re-type five times until you get it right, and so on.

It has been very hard for machines to mimic the human ability to fuck up simple tasks like moving their mouse around. That is also why it might seem like you get it right half a dozen times but are still asked to do it again - 'getting it right' is not the point. As you get frustrated, you fuck up more, until it is reasonably sure you are a person.

Has AI gotten better at mimicking that? To a point, sure.

But it is mostly just that the site has fewer barriers than the average website today, and the ones it does have are pretty outdated. This late 90s type of registration just isn't up to snuff.

The fact that it's the same 2-3 base usernames makes me think it is not a botnet but rather specific individuals repeatedly doing this. This is why I was inquiring about IP bans because banning at the username or email level probably isn't going to be enough.

The problem with ip ban is that they can still do it with a VPN or a Dynamic IP, and you could end up banning an innocent person because of tracing a random IP registered in the Dynamic IP sessions.
For those who don't know, Dynamic IP means you get a different IP everytime you turn on the modem/device. A lof of internet services in latin america works like that instead of giving you a fixed IP.

If may ask a silly question, what's the point of the spam posts, anyway?

Scam, they spam horny messages sending people out of the page (telegram, discord, etc) and prooced to hack your accounts, steal your money, blackmail you, etc.

And often, they deliberately sound rather obvious. Like these ones.
If the pitch was good enough to hook in the average person, many of those average people may take steps that threaten the operation, once they do realize something fishy is going on.

The goal is to reel in the dumbest rubes you can find who wouldn't know how to fight back. They're preying on the most vulnerable>:(

I hate that I can't think of an obvious solution to this besides much higher moderation effort or a higher barrier for account creation.

Maybe make it so that you have to upload an image before you can comment

As someone who was here for 10 1/2 years before uploading a pic, I think that's an incredibly stupid idea.

Yeah that'd just result in a bunch of low effort low quality uploads.

Well nevermind ig

That would happen, yes, but if you create a big enough barrier to participate, people will just leave. (If you thought the site was dead now...)

The thing is there are tools that are extant in spaces like ours that can mitigate spam and flood commenting from new users. I don't know if they exist here because a) I don't work here and 2) it's not an area of expertise for me. Not knowing what is available, I'd test temporarily suspending new user registration to see if the spammers would move on to lower-hanging fruit, but that's just me and how my brain works.

I don't know what the non-spambot new user registraton numbers are like right now, but yeah manual account approval / requesting to register might be the way to go if it's feasible for site staff.