For anyone like me, unable to figure out how to do that - you click Reply, and then there's a 'flag' link.

I tried at first. It's a losing game against this number of spammy comments.

The temporary solution is to shadow ban the comments, the usernames seems to follow 2 naming schemas. Banning them completely will alert the attacker to change the naming schema, or to make it more random, which will make stopping them even more difficult.

For a bot-based DDOS attack it's easier to to do blanket shutdowns then it is for the attacker to whip up new randomization code. If it gets really bad just shutting down new account creation for 24 hours or making a timelag beween creation and posting is effective.

Or click the timestamp.

All these approaches increase server load. You're likely not the only one doing so, so the server has to respond to a read and flag request for every person. I'm not sure how many flags it takes to kill a post, something like 6 iirc. When you multiply that by the number of spam posts it adds up to a lot.

I'm honestly perplexed that HN doesn't have any kind of string filtering facility considering its centrality in the tech ecosystem.

it's never needed it before, and it's not being run by a huge team. it's hard to make time to prepare for a thing that hasn't happened before when you're busy dealing with everything else.

This isn't the first spam/DDOS attack on HN, although it's one of the more severe. This is basic stuff for any kind of user-driven forum, going back to the BBS days. You are going to have periodic problems with trolls and spammers so you need to have some sort of mitigation process in place. That doesn't need to be some sort of top-heavy new technology, it can be as simple as the ability to add a few new scripting rules or wildcard matches on a few minutes notice, or hit the pause button on new account creation.

    function modifyElements(pSel, cSel, rxStr) {
        const regex = new RegExp(rxStr, 'i');
        const pEls = document.querySelectorAll(pSel);
        pEls.forEach(pEl => {
            const fEl = pEl.querySelector(cSel);
            if (fEl && regex.test(fEl.textContent)) {
                pEl.style.display = 'none';
            }
        });
    }
    
    let rx = /(hi are u lonely|want (an )?ai gf?)/i;
    
    modifyElements(".athing.comtr", ".comment", rx);

People can add onto the regex as needed, I guess. I haven't seen enough of the comments to be more specific since that seemed to get them. :-/

I flagged several hundred and can't find anything more to flag right now. Massive.

Hopefully after this is all over, Dan can tell us if I'm wrong, but I don't know that flagging is actually useful, since it's all so obvious. it causes additional db hits to load the page and then flag it, when a search on the back end will easily find them without us doing anything.

I'm doing so, but sometimes I can still see/reply to the comment despite me flagging it.

Is a certain threshold of users required to flag a comment before it's removed?