If you engage in discussion on the Internet long enough, you’re bound to encounter it: someone calling someone else a troll.
The common interpretation of Troll is the Grimms’ Fairy Tales, Lord of the Rings, “hangs out under a bridge” type of troll.
Thus, a troll is someone who exists to hurt people, cause harm, and break a bunch of stuff because that’s something brutish trolls just … do, isn’t it?
In that sense, calling someone a Troll is not so different from the pre-Internet tactic of calling someone a monster – implying that they lack all the self-control and self-awareness a normal human being would have.
That might be what the term is evolving to mean, but it’s not the original intent.
to fish with a hook and line that you pull through the water
to search for or try to get (something)
to search through (something)
If you’re curious why the fishing metaphor is so apt, check out this interview:
There’s so much fishing going on here someone should have probably applied for a permit first.
He engages in the interview just enough to get the other person to argue. From there, he fishes for anything that can nudge the argument into some kind of car wreck that everyone can gawk at, generating lots of views and publicity.
He isn’t interested in learning anything about the movie, or getting any insight, however fleeting, into this celebrity and how they approached acting or directing. Those are perfunctory concerns, quickly discarded on the way to their true goal: generating controversy, the more the better.
I almost feel sorry for Quentin Tarantino, who is so obviously passionate about what he does, because this guy is a classic troll.
He came to generate argument.
He doesn’t truly care about the topic.
Some trolls can seem to care about a topic, because they hold extreme views on it, and will hold forth at great length on said topic, in excruciating detail, to anyone who will listen. For days. Weeks. Months. But this is an illusion.
The most striking characteristic of the worst trolls is that their position on a given topic is absolutely written in stone, immutable, and they will defend said position to the death in the face of any criticism, evidence, or reason.
Look. I’m not new to the Internet. I know nobody has ever convinced anybody to change their mind about anything through mere online discussion before. It’s unpossible.
But I love discussion. And in any discussion that has a purpose other than gladiatorial opinion bloodsport, the most telling question you can ask of anyone is this:
Why are you here?
Did you join this discussion to learn? To listen? To understand other perspectives? Or are you here to berate us and recite your talking points over and over? Are you more interested in fighting over who is right than actually communicating?
If you really care about a topic, you should want to learn as much as you can about it, to understand its boundaries, and the endless perspectives and details that make up any interesting topic. Heck, I don’t even want anyone to change your mind. But you do have to demonstrate to us that you are at least somewhat willing to entertain other people’s perspectives, and potentially evolve your position on the topic to a more nuanced, complex one over time.
In other words, are you here in good faith?
People whose actions demonstrate that they are participating in bad faith – whether they are on the “right” side of the debate or not – need to be shown the door.
So now you know how to identify a troll, at least by the classic definition. But how do you handle a troll?
You walk away.
I’m afraid I don’t have anything uniquely insightful to offer over that old chestnut, “Don’t feed the trolls.” Responding to a troll just gives them evidence of their success for others to enjoy, and powerful incentive to try it again to get a rise out of the next sucker and satiate their perverse desire for opinion bloodsport. Someone has to break the chain.
I’m all for giving people the benefit of the doubt. Just because someone has a controversial opinion, or seems kind of argumentative (guilty, by the way), doesn’t automatically make them a troll. But their actions over time might.
So the next time you encounter someone who can’t stop arguing, who seems unable to generate anything other than heat and friction, whose actions amply demonstrate that they are no longer participating in the conversation in good faith … just walk away. Don’t take the bait.
Even if sometimes, that troll is you.
[advertisement] How are you showing off your awesome? Create a Stack Overflow Careers profile and show off all of your hard work from Stack Overflow, Github, and virtually every other coding site. Who knows, you might even get recruited for a great new position!
Building line-of-business mobile apps for Windows Phone that connect to Microsoft Azure for authentication, data storage and notifications isn’t much different from on-premises apps. Here’s what it takes.
If you can’t avoid storing the password – the first two items I listed above are both about avoiding the need for the user to select a ‘new’ password altogether – then showing an estimation of password strength as the user types is about as good as it gets.
The easiest way to build a safe password is to make it long. All other things being equal, the law of exponential growth means a longer password is a better password. That’s why I was always a fan of passphrases, though they are exceptionally painful to enter via touchscreen in our brave new world of mobile – and that is an increasingly critical flaw. But how short is too short?
When we built Discourse, I had to select an absolute minimum password length that we would accept. I chose a default of 8, based on what I knew from my speed hashing research. An eight character password isn’t great, but as long as you use a reasonable variety of characters, it should be sufficiently resistant to attack.
By attack, I don’t mean an attacker automating a web page or app to repeatedly enter passwords. There is some of this, for extremely common passwords, but that’s unlikely to be a practical attack on many sites or apps, as they tend to have rate limits on how often and how rapidly you can try different passwords.
What I mean by attack is a high speed offline attack on the hash of your password, where an attacker gains access to a database of leaked user data. This kind of leak happens all the time. And it will continue to happen forever.
If you’re really unlucky, the developers behind that app, service, or website stored the password in plain text. This thankfully doesn’t happen too often any more, thanks to education efforts. Progress! But even if the developers did properly store a hash of your password instead of the actual password, you better pray they used a really slow, complex, memory hungry hash algorithm, like bcrypt. And that they selected a high number of iterations. Oops, sorry, that was written in the dark ages of 2010 and is now out of date. I meant to say scrypt. Yeah, scrypt, that’s the ticket.
Read the “Massive Cracking Array” result, which is 2.2 seconds.
Go lay down and put a warm towel over your face.
You might read this and think that a massive cracking array is something that’s hard to achieve. I regret to inform you that building an array of, say, 24 consumer grade GPUs that are optimized for speed hashing, is well within the reach of the average law enforcement agency and pretty much any small business that can afford a $40k equipment charge. No need to buy when you can rent – plenty of GPU equipped cloud servers these days. Beyond that, imagine what a motivated nation-state could bring to bear. The mind boggles.
Even if you don’t believe me, but you should, the offline fast attack scenario, much easier to achieve, was hardly any better at 37 minutes.
Perhaps you’re a skeptic. That’s great, me too. What happens when we try a longer random.org password on the massive cracking array?
The random.org generator is “only” uppercase, lowercase, and number. What if we add special characters, to keep Q*Bert happy?
That’s a bit better, but you can’t really feel safe until the 12 character mark even with a full complement of uppercase, lowercase, numbers, and special characters.
It’s unlikely that massive cracking scenarios will get any slower. While there is definitely a password length where all cracking attempts fall off an exponential cliff that is effectively unsurmountable, these numbers will only get worse over time, not better.
So after all that, here’s what I came to tell you, the poor, beleagured user:
Unless your password is at least 12 characters, you are vulnerable.
That should be the minimum password size you use on any service. Generate your password with some kind of offline generator, with diceware, or your own home-grown method of adding words and numbers and characters together – whatever it takes, but make sure your passwords are all at least 12 characters.
Pick your new password hash algorithms carefully, and move all your old password hashing systems to much harder to calculate hashes. You need hashes that are specifically designed to be hard to calculate on GPUs, like scrypt.
Even if you pick the “right” hash, you may be vulnerable if your work factor isn’t high enough. Matsano recommends the following:
scrypt: N=2^14, r=8, p=1
PBKDF2 with SHA256: iterations=86,000
But those are just guidelines; you have to scale the hashing work to what’s available and reasonable on your servers or devices. For example, we had a minor denial of service bug in Discourse where we allowed people to enter up to 20,000 character passwords in the login form, and calculating the hash on that took, uh … several seconds.
Now if you’ll excuse me, I need to go change my PayPal password.
[advertisement] What’s your next career move? Stack Overflow Careers has the best job listings from great companies, whether you’re looking for opportunities at a startup or Fortune 500. You can search our job listings or create a profile and let employers find you.