3. The First Defenders

Noise summons order. That is as close to a law as community moderation has: let the noise get loud enough and someone in the room builds a tool to make it stop. The moderation bot was not designed in a lab or specified by a standards body. It was a field response — improvised by admins who were tired, who had watched the same garbage scroll past at three in the morning for the hundredth night, and who decided they would rather automate their irritation than keep living inside it. The first defenders were not security professionals. They were group owners with a scripting habit and a grievance.

Understanding what they built matters because the assumptions baked into their tools defined the threat model that the entire defensive ecosystem would inherit for the next decade. That threat model was reasonable for its time. It was also, in a way nobody could see yet, structurally incapable of surviving contact with the era that crypto and machines were about to bring. The first defenders solved the problem in front of them with admirable speed and ingenuity. They just did not know which problem they were actually solving.

The shape of the enemy they could see

To appreciate the first generation of moderation tooling, you have to hold in your head the precise picture of the adversary it was built against. The spam of the pre-crypto era — the noise catalog of the previous chapter — had a specific texture. It was high-volume and low-sophistication. It announced itself. A spammer joined your group, dumped a link to a porn site or a pirated-software channel or a get-rich crypto-adjacent pitch, and either kept dumping it on a loop or moved on to the next room. The attacker's economics were built on reach, not deception — volume against indifference, as the last chapter put it. They were not trying to convince you they were your friend. They were trying to put a payload in front of as many eyeballs as cheaply as possible.

That texture matters because it dictated what detection could look like. When the enemy repeats itself, you can catch it by looking at the repetition. When the enemy floods, you can catch it by counting messages per second. When the enemy posts a link to a known-bad destination, you can catch it by checking the link against a list. When the enemy's account is three minutes old and has no history, you can catch it by asking it to prove it is a human before it can speak. Every one of these is a tell — an observable property of the message or the messenger that correlates strongly, in this era, with malice. The first defenders built their entire arsenal around harvesting these tells. And it worked, because in the pre-crypto era the tells were honest. The attackers were not yet investing in hiding.

This is the world the moderation-bot canon was born into: a world where spam looked like spam, behaved like spam, and could be caught by anything that paid attention to behavior. Hold onto that phrase — caught by paying attention to behavior — because it is the load-bearing assumption of the entire classical defense, and it is the assumption that Parts III and V of this book will watch collapse.

None of this was unique to one platform, and the last chapter showed how old the arc already was: Usenet answered the green-card lawyers with cancelbots and kill files; IRC operators banned by hostmask and watched hostmasks cycle as easily as accounts; email built Bayesian filters and shared blocklists of sending addresses — the Spamhaus model, which is, when you squint, exactly a shared banlist for chat accounts. Wherever you find an open space with weak identity and something worth reaching inside it, the same defensive reflexes appear in the same order: filter the content, then watch the behavior, then pool reputations across the network. What made the chat-bot instance worth studying is that its room would soon hold more crypto and more people, behind weaker identity, than any room before it.

The canon: Rose, Combot, GroupHelp

Three names became the backbone of community moderation in this period, and although dozens of bots came and went, these three are worth treating as the canon because between them they defined the template that everyone else copied.

Rose was, for a long stretch, the default — the bot you added when you did not know which bot to add, built on a clean declarative philosophy: you write rules, the bot enforces them, and the enforcement is consistent in a way a volunteer human moderator at 3 a.m. never could be. Combot came at the problem from the analytics direction, layering statistics and member tracking on top of moderation, so an admin could see not just that the room was being spammed but who was active, who was new, and how the group's health was trending. GroupHelp leaned into configurability and a friendly setup flow, making the same primitives accessible to admins who did not want to memorize a command syntax. There were others — Shieldy, ChatKeeper, a broader long tail — but the point is the shared DNA. Whatever their differences in interface or business model, these bots all implemented roughly the same set of primitives, because those primitives were the obvious answers to the visible enemy.

It is worth being honest about the craft here. These were not toys. The good moderation bots were genuinely sophisticated pieces of software, handling enormous message volumes across tens of thousands of communities, exposing fine-grained permission systems, and surviving the abuse that comes with being a high-value target. The engineering was real. What was naive was not the implementation but the model of the adversary — and that naivety was not a failure of the builders. It was the correct read of the threat at the time.

The primitives: CAPTCHAs, locks, anti-flood

Strip the canon down to its working parts and you find a handful of mechanisms that, in various combinations, constituted nearly the whole of classical defense.

The CAPTCHA was the gate at the door. When a new account joined a group, the bot would restrict it from posting until it completed some challenge — click a button, solve a puzzle, answer a math question. The logic was elegant: most early spam was delivered by simple scripts that joined and immediately dumped a payload, so even a trivial interactive step filtered out the dumbest bots before they got a word in. The join CAPTCHA was a tiny tax on entry that only a present, attentive entity could pay — the first appearance in this story of an idea that will turn out to be the whole answer, the idea that you defend an open space by making entry cost something — but in this era the cost was set absurdly low, low enough to stop a script and nothing more.

That is worth sitting with, because the CAPTCHA is the closest the classical toolset ever came to the right idea, and the precise way it fell short is instructive. A CAPTCHA is a cost-of-entry mechanism: it demands that whoever wants to participate spend a scarce resource — a few seconds of human attention — before being allowed to act. The academic work on trust in open systems had already, by this era, concluded that cost-of-entry is the structural defense — that you keep a single actor from flooding a system with fake identities by attaching a real cost to each one, so that minting a thousand is a thousand times as expensive as minting one. The CAPTCHA gestures at exactly this. Its problem is one of magnitude, not direction. The cost is paid once, per join, and it is laughably small — easily defeated at scale by humans hired for pennies to solve challenges in bulk, and increasingly by software that solves them automatically. A defense that taxes entry at a few seconds raises the price of an attack from nearly free to slightly-more-than-free, which against a determined adversary is no defense at all. The whole arc of this book, in one sense, is the search for a cost-of-entry mechanism whose price is set high enough, and attached to something scarce enough, to actually matter — and the recognition that the seed of that idea was sitting in the humble join CAPTCHA the entire time.

Locks were the bluntest and in some ways the most effective primitive. A lock simply forbade an entire category of message: lock URLs and no one can post a link; lock forwards, stickers, media, inline bots, messages from channels. Locks did not try to distinguish good links from bad. They removed the capability that spam depended on, eliminating an entire class of attack at a stroke, with zero detection logic required. The cost was paid by legitimate members who now could not share anything — and that tradeoff, capability versus safety, is one the genre never escaped. Every lock is an admission that the bot cannot tell the difference between a good actor and a bad one, so it disables the action for everybody.

Anti-flood was the response to volume. The bot counted messages per user over a time window, and when the count crossed a threshold it muted or kicked the offender. Flood control directly attacked the raid — the coordinated burst of messages designed to bury a channel or make it unusable — and it attacked the loop-spammer who pasted the same pitch on repeat. Anti-flood is pure behavior detection in its simplest form: it does not read the messages, it only counts them, and it assumes that a real person and a flooding script have measurably different rhythms. In the pre-crypto era, they did.

Around these three sat a constellation of smaller tools: blocklists of banned words and domains, restrictions on new accounts, warning systems that escalated from mute to kick to ban, night modes that locked down a sleeping community, and report commands that let trusted members flag abuse for the bot to act on. None of this was conceptually deep. All of it was practically essential. Together it formed a competent perimeter against an adversary who did not yet bother to disguise himself.

It is worth dwelling for a moment on the experience of running one of these systems, because the texture of the work reveals the worldview behind the tools. An admin in this era spent his configuration time tuning thresholds. How many messages in how many seconds counts as a flood? How aggressive should the new-account restriction be — mute for the first hour, the first day, the first ten messages? Which words go on the blocklist, and which of those words are also things real members say in innocent contexts? Every one of these knobs is a guess at where the line falls between a real member and an attacker, and every guess is a tradeoff between two kinds of failure. Set the flood threshold too low and you mute the enthusiastic regular who fires off six excited messages about the thing he loves; set it too high and the raid gets through. Lock too much and the community goes quiet and resentful; lock too little and the spam returns. The admin lived on this tradeoff curve, and the central truth of the curve is that it exists only because the bot cannot see who anyone is. Every threshold is a proxy. The admin is not actually trying to catch fast typing or new accounts or the word "free." He is trying to catch bad actors, and because he has no way to see the actor, he is forced to infer the actor from a smear of weakly correlated behaviors and pray the correlation holds. The whole craft of classical moderation is the craft of guessing at identity from its shadow. The tools were good. The shadow was all anyone had.

I should say plainly that I am not reconstructing this from documentation. I lived on that tradeoff curve for years, in the communities I helped look after in the Polkadot ecosystem, and there is a particular night that has happened, in some variation, in every large community I have ever watched — often enough that I can give you the composite from memory. It is around two in the morning. A member pings the admins: obvious spam, a freshly joined account pasting the same link. You ban it. The interface makes this satisfying — one tap, gone, a small administrative death. Before you put the phone down, another report. A different account, the same link, the display name changed by one character. You ban that one too. You raise the new-member restrictions a notch, the way you might close a window against rain, and you lie there knowing exactly what you have done: the next legitimate newcomer — the curious developer in a distant timezone, the person the community exists to welcome — will now hit a wall of mute timers and challenge prompts and may simply leave. Meanwhile the third account is already typing. You are not stupid; you can see the shape of the thing even at 2 a.m. The accounts cost the attacker nothing. The thresholds cost you your newcomers. Whatever knob you turn, you are taxing the people who are real, precisely because you have no way of knowing who is real. I did not have the vocabulary for it then. But that is the tradeoff curve from the inside: a war you can only fight by taxing the innocent, refereed by a platform that cannot tell you who anyone is.

And notice what every single one of these primitives has in common. CAPTCHAs inspect behavior at the door. Locks inspect the content of the message. Anti-flood inspects the rhythm of posting. Blocklists inspect the words and the links. They are all, without exception, examinations of the artifact — the message, the action, the observable trace. Not one of them asks the question that, two decades later, will turn out to have been the only one that mattered: who is this? They could not ask it. An account was a username and an avatar and a join date, and behind that thinness there was nothing to interrogate. So the defenders did the only thing the platform let them do. They watched what accounts did, because they had no way to know what accounts were.

The first move toward identity: CAS

Then somebody made a move that broke the frame, and did not fully realize how much it broke it.

The problem with per-group, behavior-based defense is that it has no memory beyond its own walls. Every community fights the same spammers independently, learns the same lessons independently, and bans the same accounts independently. A spammer banned from one group at noon is a stranger to the group next door at 12:01, free to walk in and start over. The defense resets to zero at every threshold. From the attacker's point of view this is wonderful: getting caught in one room teaches no other room anything about you. You are punished, if at all, one door at a time, and there are infinitely many doors.

CAS — Combot Anti-Spam, run at cas.chat — was the first serious attempt to fix this, and it is the most important development in this chapter even though it looked, at the time, like a modest convenience feature. The idea was simple to state and quietly radical in its implications: maintain a single shared list of accounts identified as spammers, accept reports and detections from across the ecosystem, and let any bot in any community check incoming members against that central list and refuse the ones already known to be bad. A spammer banned via CAS in one place would now be turned away everywhere CAS was consulted. The local punishment became global. The cost of getting caught, for the first time, followed the account out the door.

Stop and look closely at what CAS actually is, underneath the framing of "shared banlist," because the framing undersells it. CAS is a system that answers a question about an account that no single community could answer on its own: what is this entity's standing across the whole network? It is not asking whether this particular message is spam. It is asking whether this particular identity has a history, somewhere, of being spam — and it is letting that history travel with the account. That is not content detection. That is not behavior detection. That is the beginning, however crude, of reputation. CAS took an account's record in one room and made it portable to every other room. It turned identity — thin, fragile, platform-native identity — into something that carried consequences across boundaries.

This is the first foreshadowing of where the entire book is heading, and it is worth naming the instinct precisely, because the people who built and adopted CAS had it exactly right. They understood, at some level they may not have articulated, that the durable way to defend an open community is not to keep re-deciding whether each message is bad. It is to decide whether each actor is bad, once, and to make that decision stick everywhere the actor goes. CAS is a reputation system. A primitive, centralized, one-bit reputation system — you are either on the list or you are not — but a reputation system nonetheless, and the first one this ecosystem produced. The instinct was sound. The tooling was not ready. That gap is the spine of this book.

Federations: reputation, federated

If CAS was reputation imposed by a central service, federations were reputation built from the bottom up by communities themselves. The federation feature, popularized by Rose and adopted across the canon, let a set of related groups link their ban lists together. Ban an account in the federation and it is banned across every group that belongs to it. A network of communities run by the same team, or aligned around the same topic, or simply trusting one another, could now act as a single defensive surface. An attacker ejected from one had been ejected from all of them.

Federations are reputation with the trust model made explicit. CAS asks you to trust a central operator's judgment about who is a spammer. A federation asks the member groups to trust each other's judgment instead. Both are answering the same underlying question — what is this account's standing beyond the walls of this one room? — and both are doing it by pooling local decisions into a shared verdict that travels with the account. It is also, in miniature, the debate that will dominate Part VI of this book — should reputation be anchored in a single authority, or emerge from a web of mutually trusting parties? — being had two decades early, with far lighter tools, by people who just wanted to stop fighting the same enemy five times.

It is also where the first defenders ran straight into the limits of their own instinct, even if they did not stop to theorize about it. Because the moment you build a reputation system, you create the incentive to defeat the reputation system. And the way you defeat a banlist — whether CAS or a federation — is embarrassingly simple. You make a new account.

The crack in the foundation

Here is the flaw, and it is not a flaw in the implementation. It is a flaw in the entire ground the defense was standing on.

CAS, federations, new-account restrictions, the join CAPTCHA — every one of these systems makes the same bet: that an account is expensive enough, or persistent enough, or scarce enough, that punishing the account meaningfully punishes the human behind it. A banlist only deters you if landing on it hurts, and landing on it only hurts if the identity you lost was worth something to begin with.

But on an open platform, an identity is worth almost nothing, because it costs almost nothing to create. A new account is a phone number — and phone numbers, even then, could be rented in bulk for pennies through services purpose-built for exactly this. Banning a spammer's account did not ban the spammer. It banned one disposable face out of an effectively unlimited supply, while the actor behind it shrugged, registered another number, and walked back in through the same door wearing a different name. CAS could remember the face. It had no way to recognize the person.

The defeat played out as a quiet, grinding routine, and anyone who ran a busy community in this period watched it happen. You report a spammer. The banlist absorbs the report. The account vanishes from your room and, if the list is consulted widely, from a great many others too. And then, within minutes or hours, a freshly minted account with a slightly different username and a stock-photo avatar joins and begins the same routine. You report that one. It vanishes. A third arrives. The banlist is not failing — it is doing exactly what it was built to do, removing each identified spammer the instant it is identified — and yet the spam does not stop, because the thing being removed was never the source. You are bailing water out of a boat whose hole you cannot reach. Each individual ban is a success and the aggregate is a stalemate, and the reason for that maddening gap is the single fact that the whole architecture refused to confront: the supply of faces is unlimited and free, so removing faces, however efficiently, never reduces the number of actors. This is not a tuning problem you can fix with a better threshold. It is the structure of the thing. You cannot win a war of attrition against an enemy who pays nothing per soldier.

The first defenders had stumbled onto the right question — who is this, across communities? — and had built a genuinely useful first answer to it. What they could not do was make the answer mean anything, because the platform underneath them offered no way to bind an account to a costly, persistent, hard-to-fabricate identity. They were keeping a careful ledger of reputations attached to identities that the adversary could mint for free — the Sybil problem from Chapter 1, which Chapter 19 will state as a theorem and show dooms every behavioral defense in this book. For now it is enough to see it lurking, quietly, inside CAS: a reputation system whose reputations sat on a foundation of free, infinite identity.

Why it worked anyway

And yet — it worked. For years, it genuinely worked. This is the part that is easy to lose in hindsight, and it matters, because it explains why the entire field was so unprepared for what came next.

It worked because the stakes were low, and low stakes forgive a weak foundation. When the prize for getting past the defenses is the chance to show a porn link to a few hundred people, the attacker's willingness to invest is correspondingly small. Re-registering accounts costs something — pennies, minutes, mild annoyance — and against a payoff that thin, even pennies and minutes are enough friction to keep the volume tolerable. The classical toolset did not have to be Sybil-proof. It only had to make spamming slightly more annoying than the spam was worth, and against an adversary chasing eyeballs rather than money, slightly annoying was very nearly enough.

A join CAPTCHA stopped the lazy script. A lock removed the obvious capability. Anti-flood broke the raid. CAS and federations imposed enough cross-community friction that the most persistent offenders eventually moved to softer targets. None of it was sound at the foundations, but all of it was sufficient — for an enemy who was not trying very hard, because there was not yet very much to try for. The defenders were not winning because their architecture was correct. They were winning because the adversary had no reason to spend what it would have taken to beat them. The difference between a defense that holds because it is strong and a defense that holds because nobody is pushing on it hard is invisible right up until the day the pushing starts — and the whole defensive ecosystem mistook the second kind for the first.

There is a further, subtler reason the era held together. The defenders had latitude to be blunt because being blunt was cheap. Lock all the links and the community barely notices, because nobody in a hobby group urgently needs to share a URL; slap a CAPTCHA on every join and the friction is an afterthought, because joining a chat about model trains is not a high-stakes transaction. The false-positive cost of aggressive moderation was low when the value passing through the room was low. That latitude will evaporate the moment crypto enters the room and every legitimate user the blunt instrument turns away is a real transaction lost. Bluntness, like the rest of the classical toolset, was a luxury underwritten by low stakes.

What the first defenders actually built

So let us be precise about the inheritance, because the rest of this book spends a great deal of time inside it.

The first defenders built a perimeter-and-behavior model of community safety. Inspect entities at the door with a cheap challenge. Inspect messages for forbidden content and capabilities. Inspect behavior for floods and repetition. Pool the verdicts into shared lists so that being caught in one place follows you to the next. It was a coherent, competent, genuinely useful system. They diagnosed the visible enemy correctly and beat it.

But the model carried two assumptions it never examined, because in its own era there was no reason to. The first was that you can tell good from bad by looking at the artifact — at the message, the link, the rhythm, the behavior. Part III of this book is the story of machines learning to make the artifact lie, until inspecting it tells you nothing at all. The second was that an account is a meaningful stand-in for a person — that punishing the account punishes the human, so a banlist deters. That assumption is the Sybil problem wearing everyday clothes, and Parts II and V are the story of attackers exploiting the gap between the face and the actor until the entire behavioral defense collapses under the weight of free, infinite identity.

Both assumptions were fine while the stakes were low. Both were about to be tested by stakes higher than anyone in a model-train chat could have imagined.

The instinct, and the missing tool

What I most want you to take out of this chapter is not the catalog of bots, useful as it is to know the canon. It is the shape of the instinct buried inside CAS and the federations — and the precise nature of the tool that was missing.

The instinct was right. Confronted with an open space and a hostile world, the first defenders reached, without quite naming it, for reputation — for some way to make an account's standing in one room mean something in every other room, to make being known as bad a portable, durable cost rather than a fresh fight at every door. Stop deciding whether each message is spam and start deciding whether each actor is trustworthy; decide it once; make it stick everywhere. CAS was reaching for exactly that, two decades before the tools to do it properly existed.

But the tool was missing, and its absence was total. Reputation is only as strong as the identity it is attached to, and the identity available to the first defenders was a username, an avatar, and a phone number you could rent by the hundred. You can build a ledger — and CAS was a ledger — but you cannot make the ledger bite, because the thing it records can be discarded and replaced faster than you can write the entry. The first defenders had the right answer to the wrong layer of the problem. They built reputation on sand, because sand was the only ground the platform gave them to build on. And it held, for a while, because no one was yet willing to spend what it would take to wash it away.

CAS was the first reputation system — centralized, fragile, a single bit of standing carried on identities that cost nothing to forge. It was the right instinct in the wrong era, the correct answer reaching for a layer that would not exist for another twenty years. It worked because the stakes were low.

The stakes were about to change.