Is my reputation system secure?

Question

BOUNTY: To get bounty either show me how to play the system, or explain why you think it's impossible to play it.

I'm developing a reputation system for a site that allows you to start your own blog of sorts, and to comment and have favorites etc.

I aim for a very short ruleset that is easy to understand for the users and can't be "played". Note: when I write "answers", I mean answers to comments, which is the equivalent of Stack Overflow's comments to answers.

1. To create an account you need one Mojo. Without it you can only answer other people's comments.
2. When you have an account, you get one Mojo a day.
3. Each day you can only post as many posts and comments as you have Mojo. You can answer as many comments as you like. You don't lose Mojo when you post.
4. You can give one Mojo to someone who has less, but only once to each person.
5. Alternatively, you can burn one Mojo to take one Mojo away from someone who has less, but only once.
6. You can't have your Mojo back.

The site is supposed to be invite-only, but non-members can answer member's comments, and maybe they'll be able to start their own blogs too, I'm not sure yet. The idea is for a system based mainly on seniority, where power can be transferred between users only in a very limited manner so basically there's no way to inflate your reputation (Mojo only flows down.)

Giving and taking Mojo is supposed to be an act on the level of marking someone as a friend or as an enemy.

I don't want Mojo itself to be a motivator for people to be part of the community. I want them to use it to influence how other people behave on site. By burning someone with your Mojo you effectively limit how much they can post on the site. By giving someone Mojo you allow them to express more.

I'm also planning to add ways to get extra Mojo, like "Post of the Day" or "Favorite Blog of the Week" contests with prizes of around 3-10 Mojo. But one of my main goals is to avoid inflation.

Answer 1

It looks pretty good, but remember that some users will eventually find ways to game any system.

Hopefully you can get a vague idea about the effectiveness of your reputation system after the public beta.

So that is about security.

A problem (may be it is how you designed it to be) I see with the system is that unlike SO or any other similar community site, you need to burn your points to contribute to the system rather than gaining points for those actions.

This decision may harm the growth of content in the site. Users will think like "I have a small number of points. So I will keep it and let my reputation grow". This means that your current system does not promote growth of content in the system.

Answer 2

Here are some consequences of your design. These may or may not be what you intended, but I point them out so that you're aware of them.

• A very Mojo-ful user who has been mostly quiet is not going to care at all about stepping on some toes, because they have a huge bank of Mojo from which to draw. This seems to go against your goal of limiting negative behavior.

• Likewise, users who contribute absolutely nothing to your site still get Mojo just by virtue of having an account. But an otherwise valuable contributor who makes one off-color post that's disliked by the community will be silenced until he has enough Mojo to post again.

• If someone has something very valuable to contribute, he has to make sure to have "reserve Mojo" at all times -- that is, he must ensure that he isn't at his posting limit. If he doesn't, he might lose the opportunity to say something useful that would earn him more Mojo.

• The rate at which people can accrue Mojo is limited by the size of the community. If there are few people who are handing out Mojo, pretty soon they won't be able to hand out Mojo anymore, since there won't be anyone left who hasn't already received Mojo from them.

• The oldest users will effectively become an invincible cabal whose ideas may define and shape your site. Since you can only reduce someone else's Mojo if they have fewer Mojo than you, these users can make statements your community vehemently disagrees with and have their Mojo ratings remain intact.

• In general, by restricting the supply of Mojo, you have created an economic system in which people will probably be more hesitant to contribute to a discussion. They will need to more carefully weigh what they say, since a post that is disliked by the community may prevent them from speaking further if they get too much negative Mojo.

---

Playing the system

Either show me how to play the system, or explain why you think it's impossible to play it.

Suppose we define "playing the system" as "artificially changing the value or quantity of one's Mojo in ways you didn't intend". I would say your system is safe from artificial inflation of Mojo, but at the cost of stifling discussion that would have otherwise taken place. You must be able to make the following guarantees:

• Flow condition. Mojo only "flows down"; it is not possible for a lower-ranked user to transfer Mojo to a higher-ranked user.
• Creation condition. It is difficult for users to take actions which can generate their own Mojo. Also, it is either impossible to make new accounts, or they carry such a heavy penalty that no one will want to do it.

For example, if you cannot satisfy the creation condition, then malicious early users will simply make an army of new accounts. They keep a number of these new accounts in reserve, quietly accruing Mojo. They then use them as a "bury brigade" to drain Mojo of factions or ideas they disagree with. Although they will lose Mojo when they do so, the collective Mojo of the bury brigade will be constant as long as they don't go hitman on more than a single hated foe per day.

This is clearly not what you intended.

Artificial deflation

However, your system is not safe from artificial deflation of Mojo. To see why, imagine that users stream into your site to accept their invitations. Imagine a user, Mallory, with k Mojo points. Because Mojo can only flow down, there is no way for a user with k or fewer Mojo points can express their disagreement with Mallory. Only users with k+1 or more Mojo can do so.

Mallory's reign of terror will continue unchecked unless there are enough users with k+1 or higher Mojo. In fact, if Mallory is an early enough user, there may not be any users who have the power to reduce her Mojo. Indeed, because you've artificially made Mojo scarce, they may not want to burn a Mojo to express their opinion, given how precious each Mojo point is -- since that also weakens them and makes their opinions more vulnerable to attack.

In short, if there are enough (or maybe even just a few) Mallorys, you will be reduced to playing traffic cop and cleaning up after Mallorys instead of improving your site. The system can no longer be self-policing. Each Mojo point has now become worth much more than before, because people will see from the example of Mallory and her ilk that it is better not to burn a Mojo to open oneself to attack. Thus, Mojo deflation.

This is also clearly not what you intended.

Answer 3

When you have an account, you get one Mojo a day.

i don't know but getting paid for doing nothing does not make much sense

overall, i would say your system will not work out. a reputation system should be primarily based on the (good or bad) things people do and not on the number of days people have an account.

Mojo is not a currency, it's determines your status among other users.

that's exactly what money does ;)

Answer 4

I have a long answer, but the summary is: your system does not get rid of the bad users, but only delayed them from doing harm.

---

...can't be "played"

Giving and taking Mojo is supposed to be an act on the level of marking someone as a friend or as an enemy.

I want them to use it to influence how other people behave on site.

The only way to see if your system is secure is to be evil and game it. Stackoverflow is full of nice people, but for this question to be answered, its best to think evil thoughts.

/me wears goatee

To create an account you need one Mojo. Without it you can only answer other people's comments.

Hi, I'm MrValdez. I'm a nice guy. Here's some friendly answers to your comments.

When you have an account, you get one Mojo a day.

You can give one Mojo to someone who has less, but only once to each person.

Hey, this is a cool site. I'll invite my friends over.

/me creates dummy accounts and give them Mojo.

Hey, here's a blog post. What do you guys think?

/me logins into dummy accounts and post like crazy.

You can only post as many posts and comments as you have Mojo.

You can answer as many comments as you like.

You can't have your Mojo back.

Via a post or private message: Awww man, I'm out of Mojo. Hey guys, can you give me some so I can answer [dummy account #1]'s post? His post is awesome and I got a great response which I think he'll enjoy.

"Post of the Day" or "Favorite Blog of the Week" contests with prizes of around 3-10 Mojo.

I'll make a post and have my dummies vote me.

10 days later, I would have mojo = (number of dummy accounts) * 10 + (Number of users fooled into giving me Mojo).

/me gives the Mojo to dummy account who goes into a flaming spree. /me washes hands of the deed.

What happens next depends on your current community. They could start flaming back or they could ignore me and my dummies until we go away.

The worst case is that they will fight back and all of your planing and system would go to waste.

The best case is that they would be mature enough not to entertain the bad guy. BUT, if your current community is mature enough, why would you still need such a complicated system to encourage people to be nice?

---

I recommend that you should spend time building the community. In my opinion, if you want a good community, you should spend more time with the community and helping set the tone for the rest to follow.

Case-in-point: StackOverflow started with a community of programmers who are genuinely interested in helping other people. We got a great sense of community because we all have the same interest. We know the top users won't abuse their moderator's power because we explicitly gave them our trust over a long period of time (in contrast with your system where time and trickery are used to rank a person's status). And finally, the developers of the site actually posts questions and answers as well as "talk" to us via a weekly podcast.

As a (pretend) bad guy, I don't have the heart or the resources to destroy such a tight community.

---

updates:

To avoid having people create multiple accounts to boost their main account you can only give Mojo to people with less Mojo (and each user can only give another user Mojo once).

Same problem. I'll just have the main account give Mojo to the dummy accounts until I get almost even Mojo across the different accounts. In addition, that rule can be easily circumvent by making more dummy accounts.

The scoring on "Post of the day" type of things is something I have yet to work on.

If you want us to comment on the scoring, update your post and we'll update our answers. But my opinion still haven't changed, you're just applying band-aid to the wrong problem.

Other posters have mentioned that your system encourages idle accounts. From the point of view of a bad guy, I wouldn't want to have an idle account. I would want to get as many account recognized by the community as a legitimate account. This would cause more damage when I finally decide to attack.

Answer 5

far too complicated. KISS

Answer 6

As far as I understand, no one can have as much mojo as someone who joined on the first day and never "burned" any. He can even do nothing and still be at the top of the mojo list. I wouldn't call this reputation, just something like seniority, and it doesn't have much correlation with achievements.

Answer 7

say the maximum posts anyone wants to do is 15 in a day - that's a lot, but you only have to be a member for 2 weeks, and then there's no point in accruing more mojo because you've maxed out what you can do with it.

So at this point you don't care too much if you get more, and you'd need quite a lot of coordination to knock someone down.

Answer 8

The flaw in your system is that it focuses on length of membership, not quality of contribution. An inactive user who contributes nothing gains status simply by virtue of having joined a long time ago.

Why do you want to limit the amount of content users can post? I'd suggest a simple system that lets other members flag a post as "bad" (just like SO). Once a certain number of members (say 5) all mark the post as "bad," it is automatically removed. Members with too many "bad" posts are booted off.

Answer 9

I can see where you are coming from, but as long as you hand out free Mojo(s), it will be possible to game the system.

But aside from that, your system has a side effect that you probably haven't thought of:

1. You launch the service on Dec 31st.
2. MrFirstUser registers as your first user, followed by MrSecondPlace and a few others
3. In the following days, a bunch of others register users
4. On January 3rd, everyone from the first day has 3 Mojo, and everyone else has fewer. MrFirstUser writes a comment, and MrSecondPlace gives him a Mojo for it (they have the same amount of Mojo, so I assume he is allowed to do that).
5. Now, MrFirstUser has 4 Mojo, and everyone else has 3 or fewer.

Now, MrFirstUser has exactly (numberOfDaysRunning + 1) Mojo, and he can never get any more, since all other users have too little Mojo to give him more. The only way he could get another Mojo, would be if User 3 gave 1 Mojo to User 4, who then gave a Mojo to MrFirstUser. Beyond that, it becomes even more involved: the number of other users who would have to participate in this human pyramid of Mojo contributions increasing exponentially.

In other words, the first thing I would definitely do to game the system, would be to create as many first-day users as humanly (robotically) possible, or at least make sure my own account was created on the first day, since that would make me an automatic Jon Skeet -- since noone would ever go significantly higher than 1 or 2 above me (only prizes could help them).

To fix your system, I would do three things:

• No more automatic Mojo; Mojo is earned through upvotes, gifts and special prizes only
• Allow giving Mojo to all other users (if there must be a limit, cap the gifts so no more than 10% of one's total Mojo can be given to one user)
• Keep the system invite-only, and penalize users whose invitees misbehave or get too many downvotes/'report user's

Answer 10

There are a lot of good answers here, but I think what you are looking for is a way to "game" the system such that no user, no matter how powerful, can limit how you behave. Thus this is my attempt to game the system in this way.

Necessary precondition: Someone invites you to the site/gives you one mojo, since it takes one mojo to create an account.

Then,
I have my one mojo account.
Each day, I use my one mojo to create a new account (I "invite" them and give them one mojo).
Then each day, I use the mojo of my created accounts to create another account for each account I already have (obviously burning each accounts Mojo down to zero each day).
IE Day 1
1 account creates another account - so I have 2
Day 2 - Each account creates another account - so I have 4
Day 3 - 8
Day 4 - 16 accounts
Day 5 - 32 accounts
Day 6 - 64 accounts
Day 7 - 128 accounts
Day 8 - 256 accounts
Day 9 - 512 accounts
Day 10 - 1024 accounts
Day 11- 2048 accounts

I repeat until I have enough accounts that even the highest ranked user won't have enough mojo to silence me - instead of competing by increasing my individual mojo, I compete by increasing my "group's" mojo - If I post something and you don't like I just repost under another one of my thousands of accounts. Instead of being a bigger dinosaur I would be a swarm of mosquitoes.

Answer 11

Is there any good reason why your reputation system exist? Joel Spolsky's Building Communities with Software mentioned that if you want your users to participate, you shouldn't be making it hard. By setting up a complicated reputation system, aren't you limiting your community too much?

In software, as in architecture, design decisions are just as important to the type of community that develops or fails to develop. When you make something easy, people do it more often. When you make something hard, people do it less often. In this way you can gently encourage people to behave in certain ways which determine the character and quality of the community. Will it feel friendly? Is there thick conversation, a European salon full of intellectuals with interesting ideas? Or is the place deserted, with a few dirty advertising leaflets lying around on the floor that nobody has bothered to pick up?

Answer 12

Your system is basically a popularity contest with feedback, so expressing popular sentiments will be rewarded and expressing unpopular sentiments will be penalized. This will discourage intelligent conversation and encourage the echo chamber effect that has occurred on Reddit around issues such as Ron Paul.

Also, as Paul Graham noted in a recent essay, a joke or a slogan is easier to understand and upvote than a research paper, so your system encourages simple posts.

Answer 13

No reputation system is secure, without real life verification. If anonymous people can be invited then it can always be gamed, with sufficient effort and false identities.

Your aim should be to increase the cost of such gaming above the potential gain, which will depend on what your system gets used for.

The main cost you can use to inhibit power gains is forcing users to contribute positively reviewed contributions before you increase their standing.

How you do this, and how you make it difficult for them to leverage existing identities to falsely rate as positive the contributions of new identities they are trying to give power to, is the nuts and bolts of the system; and should make use of an existing user base to spot and penalise spurious false positives.

You can make use of game theory by rewarding people for being in the majority. So if A accuses B of wrong-rating, it is highlighted and lots of people get to vote on it. Those who cast their mojo on the side of the vote that ends up winning, get it back and increase in reputation for reliability (it is worth having more than one type of reputation), while those in the minority, lose a triangle number of mojo (one the first time, 2 the next, 3 the next, 6 the next, 10 the next, and so on)

Answer 14

Your system is impossible to game, because it is impossible to join it in the first place.

You say a user needs one mojo to join. How do they get that one mojo if they are not already a member?

Answer 15

Pies, I've been thinking about reputation algorithms (that's how I found this thread).

You have to model your reputation algorithm after real world:

1) Older people are not necessarily better or more interesting, or should have more reputation points

2) Very young people can't have much of a reputation as they are new and did not contribute anything to the community that they can get reputation points for

3) Opinion / vote of a truly respectable / reputable person weighs more than that of some Joe Schmo.

4) If a bunch of Joe Schmos gang against a truly reputable individual, their combined mob opinion still should not prevail this individual's opinion

5) Possessing a lot of money (or mojos) does not translate into having a better reputation score (otherwise rich people would ALWAYS ultimately prevail over smart people).

6) Associating with more reputable members of a community passes some of their reputation juice to their friends and family (and it doesn't matter how much these friends and family contribute -- they are cool just because they know or related to someone cool).

Thus, my conclusions:

1) You can't increase reputation score based on age

2) You can "penalize" very young accounts (same as Google Sandbox), which will at least solve a problem of creating a number of accounts and immediately voting something up or down. Some time should pass until user account "matures". Maybe even as little as 24 hours.

3) Same actions (that can cause your or other members reputation score to increase or decrease) can't be same for all members. Value of up or down vote of a more reputable member should be more than of a member with low reputation, and opposite for low reputation member.

4) Even an army of members with average reputation score way below targeted member's reputation score, they should not be able to decrease this member's score. Though it would sort of make sense if their average reputation score was closer, in which case the mass effect should trigger something that we can call a revolution. (Though in history revolutions have not always result in a good thing for the communities where they happened).

5) Reputation can't be the "currency" of your site. Something else can, but not reputation.

6) If you have a friendship concept, than being friends with someone with higher reputation should automatically pass some of that reputation to you. And that should be happening if you become friends with someone you know (at least on your web site), not befriending anybody and everybody.