Mmm, I like the idea but it scares me a bit. It does seem as though the system is awfully open to abuse, which means that everyone doubts the results and takes away some of the pleasure for the winners…

But I’d like RE to get an award, and since a bondage awards ceremony is the only place where it could ever be recognised, I’d like to see the awards happen. Though surely big sites just sort of win by default? Or models with their own websites?

I dunno. I am ambivalent about the whole awards thing, really. From a business point of view I guess I should say any publicity is good publicity, and what’s the harm.

But I’m too much of a scientist still to feel like endorsing and asking people to vote for RE in a competition where the statistical uncertainties are so massive.

Allowing one vote per IP address per day is no help at all, because that means even legtimate votes count between 1 and N (where N is number of days the voting runs for) depending on how interested the voter is, and how early he or she finds out about the vote. Say the voting runs for a couple of weeks- they are saying that any one person’s vote counts between one and fourteen votes depending on whether they can be bothered to vote every day.

Add more IP addresses: one at home, one at work. I suspect most people have at least that. Your mobile makes three. I can vote from at least eight IP addresses without breaking a sweat. You’re talking about each person voting between once and probably a hundred times. And if you get a dynamically allocted IP address from your ISP you can probably double that and STILL be within what the system is actually ALLOWING you to vote.

If you are a motivated voter (like you are running for one of the awards and want to win) you can probably organise ten people to vote for you regularly from each IP address they have access to. So now you can start to mobilise HUNDREDS of votes. This starts to make a “real” voter’s single vote look pretty damn insignificant compared with the votes a motivated candidate can generate entirely legitimately just by voting once a day from every computer they can log on to and asking their Mum, Dad, significant other and few friends to do so, too.

Is this significant? You betcha. Say that 2000 people vote every day, and the voting runs for 14 days. That’s 28,000 votes. But they will be spread across all the candidates. Let’s say that there are ten front runners who get all the votes. That’s 2800 each. The standard deviation on that number is probably around 50 (with wild and unjustified assumptions about the distributions, but it helps get a handle on it). Suddenly if you have a few people all getting similar numbers of votes with a standard deviation of around 50, the ability of a motivated candidate to add a hundred votes in person, and a few hundred with their best mates, starts to make a *very* significant difference to the final rankings. It won’t make a difference if there is a clear front-runner, but if it is at all close or the votes are widely spread over a lot of candidates, it can completely skew the results and overwhelm the real vote.

Then add a botnet or faked IP addresses, a simple script to vote once per IP address per day at a random time and with random other votes thrown in so you only stuff the ballot for the one you care about, voting at random on the other polls and maybe even voting randomly 50% of the time on the target poll, to help conceal the fakery and make it look like lots of people are casting legitimate votes. I’m not any sort of hacker, but even I could probably figure out a way to do this, especially if the voting is by web page.

It sounds like the guy running it is aware of proxy servers which is why they are watching for funny voting patterns from clusters of IP addresses.. and interesting how they will cope with ISPs who run proxy servers. Like AOL and NTL. I don’t know how good their drilldowns are. Trouble is, if you make your scripts look up the X-Forwarded-For variable so that AOL, NTL (and many other ISPs using transparent proxies) users can vote, you immediately open the door to people faking those headers.

But you only need a proxy server if you care about two way communication with the voting script. It may well be that a single HTTP request is all that’s needed to register a vote, and the fact that the reply goes to some random unaware computer in Outer Mongolia doesn’t matter at all so long as the voting script has registered the vote. You might be able to spoof IP address to send the HTTP request. If you can do that, you can easily set up a pattern which is not immediately obvious as being fake but which has a distinct bias to the contest you want to rig.

Sure, you can police it, but I can think of so many ways to conceal the voting pattern that it seems like a pretty hopeless task. Especially when the allowed range of voting even for legitimate voters is within a factor of 30 or more, it becomes much more a test of who can get a few hard core fans to vote every day from every IP address they can, because their votes are likely to overwhelm the “real” voters who don’t care enough to vote every day from every IP address they can. It is a VERY skewed voting system, and very vulnerable to being ballot stuffed.

The fact that the votes are then flagged for review adds an extra layer of human bias to the process as well. If they’ve told you you can vote once a day, but they disallow some multiple voting, are they going to disallow all multiple voting? If so, why make it one per IP per day? And what about shared IPs, dynamic IPs and proxy servers? How many legitimate votes is the review going to remove? How many people are going to slip just under the radar screen with “semi-legitimate” votes? Secrecy of review procedures doesn’t actually add any legitimacy to the voting, it just makes it even more arbitrary and less likely to reflect any actual body of public opinion.

The fact that people did start to take these things seriously makes me a bit disinclined to ask people to vote. I thought about them quite a bit when looking into voting scripts for RE sets. There’s no incentive to cheat there, so I doubt people do. It was a bit different for Bondage X factor with a bit of cash at stake for the winner, which is why I decided to reserve the right to award that as I saw fit, just guided by the vote.

Sorry, I know I am being a killjoy. By all means link the site and we can say the contest is running. But it only takes a few people to start ballot stuffing with friends and family to totally skew the results, despite what the organiser thinks about “a few extra votes” not making a difference.

Up to you, Kate. Forgive me if I don’t make a big song and dance about this, it grates on my pathological honesty and scientific sensibilities!

:stiffdrink :stiffdrink

Hywel.

Edited By Hywel on 1202614226