Comment and moderation policy
Comments are open because corrections and first-hand experience make the writing better. They are moderated because an unmoderated comment section on a security and compliance site becomes a spam channel within a week. This page says exactly how that moderation works, including where a language model is involved and where it is not.
Last updated 2026-09-05
How a comment gets published
- Step 1 / automatic screening. Every submission is checked against a fixed set of deterministic rules, listed below. No model is involved at this point and no third party sees your comment. Clean, plain, link-free text publishes immediately. Anything that trips a rule is either held for review or refused, and you are told which.
- Step 2 / AI review. Published and held comments are then classified by a language model that runs locally on our own hardware. Your comment is not sent to any external AI service. The model can recommend that a comment be removed or escalated; it can never publish one.
- Step 3 / human decision. A person reviews the queue and makes the final call on anything held or flagged. Held comments stay invisible until a human approves them.
What the automatic screening checks
Rate limits
A single connection can post a small number of comments per hour and per day. Beyond that, submissions are refused until the window resets.
Length and shape
Comments must be at least a sentence and no more than 4000 characters. Names must be real names, not URLs.
Links
A comment with no links can publish immediately. One link is held for review. Two or more is refused, because that is what almost all comment spam looks like.
Hidden characters
Zero-width and bidirectional-override characters are stripped, and their presence holds the comment. These are the standard way to hide text from a human reviewer.
Prompt injection
Text that tries to issue instructions to a language model is detected, flagged and held. It is never passed to a model unreviewed.
Duplicates and spam terms
Repeated text and a short list of unambiguous spam phrases are refused outright.
Where AI is and is not used
The model assists a human reviewer. It does not decide what appears on the site. Three constraints hold, and they are enforced in code rather than by policy alone.
- / The model can hide or escalate a comment. It has no ability to approve or publish one. That path does not exist in the API.
- / Comment text is passed to the model as data inside explicit delimiters, never as instruction, and text that looks like an attempt to instruct a model is flagged and held before it gets that far.
- / The model runs locally. If it is unavailable, or returns anything other than a valid verdict, the comment is left for a human instead of being auto-actioned. It fails toward review, not toward removal or publication.
What we remove
Spam and undisclosed promotion, abuse or harassment of any person, anything defamatory or unlawful, other people's personal information, and content designed to manipulate an automated system rather than communicate with a reader. Disagreement is not on that list. Telling us we got something wrong, with reasoning, is the most useful comment you can leave and it will not be removed for being unflattering.
What a comment stores
Your name
Published with the comment. Use whatever name you want to be known by.
Your comment
Published as plain text. Formatting and markup are not rendered.
Your email, if you give one
Optional, never published, never sold, and used only to contact you about the comment itself.
A hash of your IP address
Not the address itself. Used for rate limiting and abuse handling, and it cannot be reversed to identify you.
A timestamp
Published as the comment date.
Comment data is stored on our own server, never sold, and never shared with an advertising network. To have a comment removed, email hello@aestech.com.au from the address you used, or quote the comment text if you did not give one. See the privacy notice for the full picture.