Site moderation tools

[nic-hartley]

Blocked on #18

Goal

Build a bulwark against the trolls and spammers. Or, less poetically, standard protections against malicious users.

Description

This ties into #18 -- this requires being able to ban and modmail users.

Potentially contentious points are in quotes.

We need to implement at least a few features to help us catch and stop spammers, trolls, etc. That mostly consists of letting users flag any user-generated content.

• Every flag has to have a reason attached to it.

• Flagging should be ratelimited fairly heavily, and one user can flag a post once.

  • Otherwise people could just spam-flag the same post a dozen times on their own, or mass-flag everything on the site.
• Admins should be able to delete things through the same interface (i.e. an admin flag is binding)

• After a certain number of flags, something should automatically be hidden from feeds (not deleted)

  • Admins will only have so much time every day to dedicate to handling flags; the community should be able to self-moderate to some extent.
  • Maybe base the flag threshold on the popularity (number of supporters) of the post?
• Admins should have a panel showing all recent unhandled flags
• Flags can be handled by either invalidating or confirming flags
• Flags are never deleted by the handling process
  • If they're deleted on invalidation/acceptance, that makes it very difficult to track why things were deleted and notice bad actors sooner.
  • Flags older than some threshold (e.g. six months) can probably be deleted without consequence though.
• Too many invalidated flags leads to a ban

Alternatives

• Admins watching everything posted themselves.
  • We're putting up a website for an extremely popular organization, which is explicitly designed to involve as many people as possible. There will be a lot of trolls.
  • We're probably not going to have very many admins.
  • I'd rather not have the admins struggle under a massive load of posts and risk letting a lot of trolls slip through
• Admins approving everything before it goes live
  • This would similarly drown the admins in a lot of work, and probably end up extremely frustrating.
• Automated banning
  • I have no issues with this being used alongside flagging, but there are always cases where automation will fall short -- things like inserting zero-width spaces or other invisible characters to get around censoring, or overeager filters catching valid posts, etc. We need something along with this.
  • A lot of work, compared to user flagging.
  • This could be implemented through flagging, too -- have an automated process add an automatic flag to posts as they're uploaded, so admins can see potential trouble posts without a user having to flag them.