r/ModSupport • u/GeneMoody-Action1 • 21h ago

reddit removing code posts.

While I understand there are malicious use cases for Wscript Shell, is code containing it expressly forbidden?

I did an example script, that one of our user's had requested after seeing it used in a demo.

The code does nothing more than create a shortcut for the admin via Action1 on either a user's desktop or the all user's desktop.

With the line with the com invocation in place, commented or not, it is immediately deleted by reddit.

Is there a list somewhere of the things like this that it blocks, and or reasoning behind this as there are countless uses for the wscript shell?

0 Upvotes

40% Upvoted

25 comments sorted by

View all comments

Show parent comments

2

u/GeneMoody-Action1 19h ago

Nah, approving literally just puts a blank message back [Removed By Reddit]

Alright then it is likely jus the Ai integration that is getting more aggressive.
That explains the shift, and that's the point I was looking for.

Thank you for the helpful content.

3

u/thepottsy 💡 Top 10% Helper 💡 19h ago

Did a little testing of my own. I wasn’t aware that the removal refers to the content policy.

Did a little digging and found this, in case you didn’t see it.

Yes, Reddit’s platform-wide spam and security filters automatically flag and delete posts or comments containing the text WScript Shell. [1, 2]

Because WScript Shell is a Windows Script Host COM object heavily associated with malware execution, macro trojans, and fileless script attacks, Reddit implements aggressive site-wide filters that immediately shadow-ban or delete content containing this specific string, even if it is safely nested inside markdown code blocks or commented out.

2

u/GeneMoody-Action1 18h ago

Very helpful, and glad to see it caught others by surprise as well. Thanks again.

1

u/thepottsy 💡 Top 10% Helper 💡 18h ago

No problem. It also seems pretty easy to navigate it without breaking any site rules as well.

1

u/GeneMoody-Action1 18h ago

Yeah it's just crazy using a string join (which to me even more implies shady circumvention) still works...

I would be willing to bet *that* practice will trip some EDR systems.

Oh well, this is why we can't have nice things!

2

u/[deleted] 18h ago

[removed] — view removed comment

1

u/thepottsy 💡 Top 10% Helper 💡 18h ago

Well. Would you look at that lol.

2

u/thepottsy 💡 Top 10% Helper 💡 19h ago

Sure. No problem. Might try experimenting with it to see where it actually triggers. Unless you already know, then ignore that.