Collect spam data in a smart way

[schlessera]

Anonymously collect non-detected spam comments.

What data to collect:

Comments that were not detected as spam and for which the site user manually clicked the "Spam" button.

When to collect:

When the site user first clicks this "Spam" button, we should ask the permission to anonymously send the comment data to a centralized database, in order to improve Antispam Bee.

How to collect:

At first, send to a HTTPS endpoint that stores everything in a simple database (probably NoSQL). We may need to evaluate a more scalable solution in the future. The collected data must not contain any mention of the sender or information about their user or system. It should contain as much information as possible about the actual spam content and where it originated.

[timse201]

are we or the user allowed to do that?
are there some copyright/law issues?
and if we do it everytime there could be some false positives because someone dislikes an user and marks them as spam or its only because someone posted a comment several times by misklicking or caching issues etc.

but i agree
if we are allowed to (no law issues) then we should make it simpler to submit spam

[websupporter]

I think, its a great idea. We should also include false positives.

I do not really see legal issues. In my understanding, if someone posts a comment, he gives the website owner the right to publish it. But honestly, I do not know how far this right can be stretched.

there could be some false positives

Yes, but right now, we have the same issue with our Google document. I think its worth a shot.

There should be an option in the settings like (send always, never send), maybe instead but as a addition to the question "do you want to send this specific comment?" to guarantee a quicker work flow.

[schlessera]

An alternative would be to add a separate button besides the Spam & Trash buttons. Something like Send for Analysis or similar. If they just want to get rid of their uninteresting newsletters, they will probably not click on Send for Analysis for these...

[schlessera]

And, yes, the original idea was to ask for permission once on clicking Spam and then have this be the new default.

[Zodiac1978]

We could use the transformation action hooks comment_unapproved_to_spam and comment_approved_to_spam or we could provide a button / action link for this.

Possible problems: Privacy concerns (IP, Mail, Content, etc. from Comments) are submitted to us (or a Third-Party-Service like Google Forms).

This feature needs consent from the user:
https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/#7-plugins-may-not-track-users-without-their-consent

[krafit]

In my opinion the best way to collect non-detected spam would be to add a link alongside “Mark as spam” — something like “report to Antispam Bee”. When a user clicks that link, they'll have to confirm that they are about to disclose the comment and its metadata to the ASB team for further investigation and to improve ASBs filters before its sent.

[Zodiac1978]

To get even more data, we could use the action hooks if someone marks a comment as spam and then ask for the data (like PoEdit does this):

With an opportunity to opt-in to have this as the default.

[krafit]

I thought about an opt-in, but I didn't like the privacy implications of having this as a default for everyone after someone opted-in.
But we could handle the opt-in the way PoEdit does, by handling it on a per user basis. This way every user has the opportunity to give informed consent before sharing data (for the first time).

[Zodiac1978]

If we stay with our workflow (using the Google Form) we could pre-fill the form like this:

https://docs.google.com/forms/d/e/1FAIpQLSeQlKVZZYsF1qkKz7U78B2wy_6s6I7aNSdQc-DGpjeqWx70-A/viewform?c=0&w=1&entry.437446945=name%20of%20the%20commenter&entry.462884433=IP&entry.1346967038=Host&entry.121560485=email%20of%20the%20commenter&entry.1210529682=website%20of%20the%20commenter&entry.1837399577=content%20of%20the%20comment

URL encoded data.

The user just needs to hit the "Send" button at the end of the page.