Using RainRatBot for Moderation - Bot defense - Frequently Asked Questions

Q: When you say "looks like a bot" [Step 3], what does that mean? What if it has a false positive?

A: I won't give the exact method, because it's subject to change as new Rogue bot patterns are found. Legitimate bots are limited in what information they can retrieve from profiles. My bot looks at:

• The @username
• The First and Last name provided to Telegram
• The number of profile pictures

If there is a false positive, most users clear it just by introducing themselves, which they were likely going to do anyway. Group admins are also given a command they can send to RainRatBot, if they wish to vouch for the user. If it still gets as far as banning a user, the group admins can unban like any other ban. RainRatBot doesn't (yet) maintain any ban list of its own, so the unbanned user is treated as just another new user when they rejoin.

Q: What if the suspected Rogue bot adds the Telegram-recognized bot during the 5 minute watch period?

A: If any user adds any Telegram-recognized bot to a group that's using the bot protection, the admins will get a separate PM about that. Not all Telegram-recognized bots are bad, but the admins usually want to know about it.

This is what it looks like when RainRatBot notifies the admins about a Telegram-recognized bot (I blacked out the name because it's a legitimate bot used to test, and I don't want to give the impression it's a bad bot.)

Possibly a future version will allow group owners to set a policy about Telegram-recognized bots.

Q: What if the Rogue bot is the one that sends messages to the group, and it does it within the 5 minute watch period? Would RainRatBot accept it as a actual user then?

Yes. But then we're getting into a completely different problem than the one I set out to solve. The group admins will still have gotten a message from RainRatBot about it when it first joined, so they know something's up.

If Rogue bot behaviour changes, then I'll be updating my bot to keep up.

Using RainRatBot for Moderation - Bot defense - Usage

This is a continuation of the previous blog, which explains the background of the problem.

From what we've seen, these Rogue bots enter our Telegram groups, say nothing, and if they're left in the group, they add a Telegram-recognized bot that posts a stream of spam. I added a defense against these Rogue bots to RainRatBot:

1. Watch for new users joining the group
2. Look at the profile of the new user to see if it looks like a bot
3. If it doesn't look like a bot, nothing else happens, otherwise RainRatBot will send a message to the group asking them to introduce themselves.
4. Then it sends a message to the group admins that a suspected bot joined.
5. Then it starts a 5 minute timer and watches the group for new messages during that 5 minutes.
6. If the suspected bot sends a message to the group during the 5 minutes, RainRatBot will assume they are real, cancels the timer, and does nothing else.
7. If it is still silent after 5 minutes, RainRatBot will:
8. Ban the rogue bot.
9. Send a message to the group telling them that the Rogue bot was removed.
10. Send a message to the group admins telling them that the Rogue bot was removed.

This is how it looks in the group:

I do like my movie references; if you don't like the Robocop theme, the messages can be customized on a per-group basis.

All the moderation functions are locked to groups where the group owner requested them. If you just add RainRatBot to your group, it will only do the Fursuit Identification described in the rest of this blog. I made a form to make it easier to request the moderation functionality.

Using RainRatBot for Moderation - Bot defense - Introduction

A Telegram bot is a software program that sends commands to and receives messages from the Telegram network. It's programmed to take specific actions even when not directly supervised by a person.

When used as intended, a Telegram bot is a useful thing, supported by the Telegram developers, who even provide an interface for bots to talk to their Telegram servers. I will call these "Telegram-recognized bots". These bots:

• Always have a @username that ends in "bot".
• Can't join groups, they have to be added by a person.
• Can't initiate private conversations with users.

On the other hand, there are bots that don't follow these restrictions. The Telegram protocol is open enough that developers can write programs that talk to the Telegram servers exactly how a user using a Telegram client program would. I will call these "Rogue bots".

• Does not have a @username that ends in "bot" (or may not have an @username at all).
• Can join groups.
• Can initiate private conversations with users.

This is an example of a "Rogue bot". It joined the group on its own(circled at bottom), and its user name does not end in "bot".

Why am sure it's a Rogue bot and not just a new user? It follows a very predictable pattern that we've seen over and over:

• The last part of the @username, after "Gretta", "Zo0rs" is a random combination of letters and numbers. After seeing dozens of Rogue bots, that part of a username is always exactly 5 letters or numbers.
• They join groups with very specific audiences, yet never say a word, even when multiple users reply trying to get them to say something. If a Rogue bot was simply not programmed to reply to anything, this is the logical explanation for why they don't reply to even simple questions.

If you're interested in seeing the patterns of bot activity, feel free to join the read-only channel @rainratbotreports 

What's the purpose of these Rogue bots joining groups? If it is not removed from the group, we've seen cases where the Rogue bot adds a Telegram-recognized bot to the group, which then quickly filled the group with spam messages. In theory, the Rogue bot could also spam the group directly, but adding the second account is how we've seen it happen so far.

Using RainRatBot for Moderation - Plain text

This is related to the previous blog about using the bot to moderate images posted to groups.

It's not as interesting as looking at the content of images, but group owners don't want a moderation bot that looks at images, but not text.

I decided it was going to be:

• Locked to groups where the group owner requested the mode.
• Only going to notify the group owner, not delete the message or say anything to the user.
• Just basic keyword-matching, nothing fancy.

I started out by downloading about ten different profanity and keyword-blocking lists from the web. Then I used a script to combine them, sort them, and remove the duplicates. Then I realized it was way too conservative for what I intended. The list was too long to go through manually, and contained many references I didn't get, like profanity in other languages. I decided I was only going to be able to look into keywords that actually came up in groups

I left it running in report-only mode in a Safe For Work group I own:

• You don't realize how much people use profanity like "shit", "fuck", "ass" all the time for emphasis unless it's pointed out to you. I don't take moderator action on people in my groups for language like that, and wouldn't want to get notifications for words like that, so I actually removed those words from my profanity filter.
• The lists I built my list on contained names of groups of people, like "mexican". Probably because they're often used as a slur or combined with a slur. My users were being respectful with them, so I removed many things like that from the keyword list.
• It contained words like "dirty" or "drunk" that were too mild, or had multiple uses, so I removed those.
• I removed dozens of other entries that triggered because the lists were too restrictive, but I couldn't check them all.

It's a bit unusual as a profanity list right now, because while I removed some actual profanity because it was just too common, it still contains many keywords that would be extremely restrictive to try to control. I'm still removing keywords from the list as they come up.

If you want the Moderation in your group, you have to message me on Telegram with the Group ID of your group, and the User or Group ID of where you'd like notifications to be sent. I'll be actively taking feedback to refine the list further.

And if you do run a tightly controlled group and want the more restrictive list including "shit", "fuck", "ass", etc, etc, to be applied in your group, I did save a list of what I removed from the main list; I could code up some different moderation levels.

Photos for training fursuit model - Suggested poses

This is a follow-up to a previous post about adding a new fursuit to the recognition model.

This is a list of suggested poses for photographing a fursuit for the recognition model. There's no secret sauce here; often candid shots from a convention are sufficient if you have enough of them. If you have a photographer though, here's a list of suggestions:

-Head-only, front view
-Full-body, front view
-Head-only, side view
-Full-body, side view

-Head-only, other side view
-Full-body, other side view

-2 Full-body, active poses (suggestions to pick from: tilt your head, hold your hand(s) near your head, crouch, curl up, sit, show your paws, lay down, on one foot, curve whole body)

Do each of these with:

-A light-coloured background (doesn't have to be a professional backdrop, A light-coloured wall will do)

-A dark-coloured background (A dark-coloured wall will do)

-A natural background (greenery and sky)

-Busy background (unrelated things, like people)

-Patterned background (ie. interior or exterior of buildings)

That should bring you to 40 (8*5), which is enough to start a new entry.

Patreon - Contribute if you find this blog and bot interesting

I've started a Patreon to collect contributions for this and other projects of mine.

https://www.patreon.com/rainrattie

If you find any of the features of the Telegram bot useful, or want to support other creative endeavours, this is where to contribute.

RainRatBot - Frequently Asked Questions

Are you going to open source your program or data set?

I'm not planning to release them. For the program, remember that I am using Clarifai for the recognition. Reading my code wouldn't tell you anything about AI. You would learn more about the Clarifai API from reading their docs than trying to understand what my code does.

If I released the data, there would be a lot of photos separated from any credit to their photographers. It wouldn't be fair to them to release it myself. Perhaps one day if I can't provide this service any more, I'll pass them on to a single successor, who I would ask they also keep them out of general distribution.

What if I don't want my fursuit recognized?

I'm pretty sure I'm be on solid legal ground have it recognized even if the owner doesn't want it, since the only thing it replies with is a public name; the users don't even see the photos used to train it.

But, I don't really want to spend CPU cycles and storage on someone not interested, so I'd remove someone who didn't want to be included.

I don't like it replying to my photos in a group that I'm in. Can you have it not do that?

It's up to the group owner whether they add the bot, and they can remove it if they choose.

Now, if you don't like it replying to your photos because its reply is wrong, I can help with that. Just report it to me (including the photo that triggered it), and I'll fix it in the next update. I don't know if it's giving wrong results unless someone reports it.