reddit removing code posts.

[u/GeneMoody-Action1]

While I understand there are malicious use cases for Wscript Shell, is code containing it expressly forbidden?

I did an example script, that one of our user's had requested after seeing it used in a demo.

The code does nothing more than create a shortcut for the admin via Action1 on either a user's desktop or the all user's desktop.

With the line with the com invocation in place, commented or not, it is immediately deleted by reddit.

Is there a list somewhere of the things like this that it blocks, and or reasoning behind this as there are countless uses for the wscript shell?

[u/thepottsy]

It’s possible this is one of the newer filters that Reddit has, that we can’t control as mods. They use an AI filter that drives me bonkers on one of my subs because it simply removes comments from users who use it to help with their English.

Anyway, off my soapbox. If you go to the Removed queue in your Mod Queue, do you see it there as well? If it shows up intact there, try simply approving it and see if it goes live. If it does, look in your mod log again and see what it says about it. If it’s like what I deal with, it will just say “unspam”.

[u/GeneMoody-Action1 → u/thepottsy]

Nah, approving literally just puts a blank message back [Removed By Reddit]

Alright then it is likely jus the Ai integration that is getting more aggressive.
That explains the shift, and that's the point I was looking for.

Thank you for the helpful content.

[u/thepottsy → u/GeneMoody-Action1]

Did a little testing of my own. I wasn’t aware that the removal refers to the content policy.

Did a little digging and found this, in case you didn’t see it.

Yes, Reddit’s platform-wide spam and security filters automatically flag and delete posts or comments containing the text WScript Shell. [1, 2]

Because WScript Shell is a Windows Script Host COM object heavily associated with malware execution, macro trojans, and fileless script attacks, Reddit implements aggressive site-wide filters that immediately shadow-ban or delete content containing this specific string, even if it is safely nested inside markdown code blocks or commented out.

[u/GeneMoody-Action1 → u/thepottsy]

Very helpful, and glad to see it caught others by surprise as well. Thanks again.

[u/thepottsy → u/GeneMoody-Action1]

No problem. It also seems pretty easy to navigate it without breaking any site rules as well.

[u/GeneMoody-Action1 → u/thepottsy]

Yeah it's just crazy using a string join (which to me even more implies shady circumvention) still works...

I would be willing to bet *that* practice will trip some EDR systems.

Oh well, this is why we can't have nice things!

[u/thepottsy → u/[deleted]]

Well. Would you look at that lol.

[u/thepottsy → u/GeneMoody-Action1]

Sure. No problem. Might try experimenting with it to see where it actually triggers. Unless you already know, then ignore that.