You are here

Increased spam around here? (Reports and Ideas)

41 posts / 0 new
Last post
alpha1
alpha1's picture
Offline
Last seen: 9 years 2 months ago
Joined: 2007-07-08 20:02
Increased spam around here? (Reports and Ideas)

Anyone else notice the increase of spam around here? Like what's up, and can't we do something to make it harder to spam? Maybe don't allow users to post in the first hour after they sign up. I doubt it will happen but anyone have any good suggestions?

silentcon
silentcon's picture
Offline
Last seen: 12 years 2 months ago
Joined: 2008-05-31 05:37
We got to know who is the

We got to know who is the culprit behind all these....

Oni-Neoxes
Oni-Neoxes's picture
Offline
Last seen: 11 years 5 days ago
Joined: 2008-08-02 12:02
I Don't Know. the Other

I Don't Know.
the Other Forums I go to there is a lot of spam lately too

gluxon
gluxon's picture
Offline
Last seen: 3 years 10 months ago
Developer
Joined: 2008-06-21 19:26
Um...

I'm pretty sure there's something called an IP-ban?

The Statics Module that comes with drupal has the power to do that.

Jacob Mastel
Offline
Last seen: 3 years 9 months ago
Developer
Joined: 2007-06-13 19:36
What about something like LifeHacker?

Anyone here a member of LifeHacker? If your not you sign up but when you post it's only viewable to staff members. So if you're not an idiot they okay you. If you are an idiot they either deny you or ban you depending on the circumstances. I'm sure we could EASILY implement a user acceptance team...or maybe just have the release team/mods do it.

Release Team Member

gmbudwrench
gmbudwrench's picture
Offline
Last seen: 4 months 2 weeks ago
Joined: 2007-06-25 05:00
Isn't there

like a time limit delay on Lifehacker as well? Where your posts aren't displayed immediately, but delayed for example, like 30 minutes. The webs version of the 5 second tape delay of t.v.? Maybe a Mod could catch it during that specified delay?

alpha1
alpha1's picture
Offline
Last seen: 9 years 2 months ago
Joined: 2007-07-08 20:02
that's what i was thinkin,

that's what i was thinkin, like don't allow them to post within the first hour or something, which would force them to sit there and read/search the forums, and maybe not say something stupid

Lead, Follow, or get out of the way.

TaffinFoxcroft
TaffinFoxcroft's picture
Offline
Last seen: 10 years 7 months ago
Developer
Joined: 2006-12-14 17:24
unless they're just bots set

unless they're just bots set up by some spam company, in that case they would move on somewhere else.
I was thinking about posting the 1-hour no-post time, but you beat me to it Blum I can see it working quite well actually.
(possibly also a notice on the signup page with "If you are signing up to ask for support, IRC may be a better option as you will get it quicker. https://portableapps.com/support/chat/live")

But there’s no sense crying over every mistake,
You just keep on trying till you run out of cake.

whibo
Offline
Last seen: 3 years 7 months ago
Joined: 2006-11-23 16:00
Afghanistan

The spammers are all from "Afghanistan" and their prefered app language is Afrikaans so ban the Afghanistan :P.

App Guy
Offline
Last seen: 10 years 8 months ago
Joined: 2008-03-16 14:24
Not Exactly

"Afghanistan" is the first Location in the location chooser and "Afrikaans" is the first language in the language chooser. This could be anyone.

May the Shwartz be with you

whibo
Offline
Last seen: 3 years 7 months ago
Joined: 2006-11-23 16:00
Men

Did you noticed the ( Blum ).

BrianAll
Offline
Last seen: 6 years 2 weeks ago
Joined: 2008-02-13 13:44
Well

I'd say going from maybe one, if any, spam topics a month to over 10 in less than 2 days is a substantial increase. I've noticed that the spam posts are all about 3-5 hours apart, so if I am correct we could expect a new one anytime within the next 2 hours.

*dramatically* There must be something done to bring these spammers to justice!!! *raises fist into air commandingly*

Well seriously, cant we get enable something that was mentioned above, or at least get a captcha on the create account page?

BTW, this should be in the general discussion forum, it'll get more attention (Rumor has it John avoids OT ;).

horusofoz
horusofoz's picture
Offline
Last seen: 10 months 1 week ago
Joined: 2008-04-03 22:45
Rather than causing delays I

Rather than causing delays I think captchas would be better. Still gives security and doesn't hamper discussion.

PortableApps.com Advocate

John T. Haller
John T. Haller's picture
Offline
Last seen: 19 hours 51 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Captchas

Captchas exclude visually impaired visitors and are not an option.

Sometimes, the impossible can become possible, if you're awesome!

horusofoz
horusofoz's picture
Offline
Last seen: 10 months 1 week ago
Joined: 2008-04-03 22:45
I hadn't thought of that.

I hadn't thought of that. Maybe have a logical question that any human can answer but a computer cannot and have it plain text for a screen reader to interpret. Could think of it as a logicial and pro-accessibility type captcha?

Could be anything from Q: How to spell portableapps? A: portableapps - to - Q: Two plus two = ? A: 4 or four

PortableApps.com Advocate

José Pedro Arvela
Offline
Last seen: 5 years 6 months ago
Joined: 2007-07-10 07:29
I agree

Actually, one Drupal module available from the Drupal site is the captcha module, and captcha extras, that include several extra captchas, including the ones you say in the middle. As said below, these are easier to break, but, will limit the spam a little bit. This together with the report spam button below (although I don't know any Drupal module that does that yet) could work very well to limit spam on these troubled periods.

Also, I think it ism ore important to get to the root of the problem, and see if we can figure out who, and more importantly, why (if for same reason as all spammers or for a specific reason) are we getting more spam. Cutting the problem on the root may be the solution (although a lot more hard).

Blue is everything.

Zach Thibeau
Zach Thibeau's picture
Offline
Last seen: 1 year 8 months ago
Developer
Joined: 2006-05-26 12:08
you could always try recaptha

you could always try recaptha which does have a function to sound out the captcha for the visually impaired

your friendly neighbourhood moderator Zach Thibeau

sergentsiler
sergentsiler's picture
Offline
Last seen: 1 year 3 months ago
Joined: 2007-02-28 11:37
i second this...

also, it would be good if accounts required administrator permission to be activated. althogh it would be a hassle, it would be a fool proof way to nab a lot of spammers. and may i suggest a throwaway account that all admins/mods can accsess daily.

Zoop

gluxon
gluxon's picture
Offline
Last seen: 3 years 10 months ago
Developer
Joined: 2008-06-21 19:26
I aggree.

I think a reCapacha module for the site would be great.

Imagine if somebody created a bot and posted about 1000 posts?

NathanJ79
NathanJ79's picture
Offline
Last seen: 4 years 5 months ago
Joined: 2007-07-31 15:07
Few solutions

Hey, I've ran a board before, though not one using the software this board uses.

An IP ban is a good quick solution but not without fault. As many of you know the IP is four numbers from 0 to 255 separated by three periods. You can ban an IP explicitly, but this is only good for banning one person with cable internet and a static IP. Everyone else (with dialup and DSL) has a dynamic IP. Their IP changes every time they connect to the Internet, from a pool assigned to their ISP. So you can ban the pool by replacing the last number (or for large ISPs, the last two numbers) with stars. But this bans not just the offender, but the offender's neighbors.

Captchas are good but Mr. Haller said they're out, so they're out.

The math problem or spelling problem ideas are good, but like the most basic captchas, they can be defeated by spammers. Spammers don't use the web like you do. They have tools which facilitate the process. They probably have a program that they feed forum URLs to and it goes to work. Work from home, they tell you. Let your computer make your money while you sleep. That's spam recruitment right there.

My solution, but I'm not sure if your board supports it. Might have to code it in. You already have at least three classes of members: Banned, Members, Admins. Maybe you also have Mods who can do some things Members can't but not everything Admins can. And maybe you even have Developers who have a private forum for discussing development. I don't know, but it seems like every board out there has classes.

Make a new class called New Members, and by default any newly created accounts are New Members. New Members' posts aren't posted directly, but are put into a queue to be reviewed and approved by mods and/or admins. During the review, the mod or admin can ban a New Member, deny/delete the post, approve the post, or promote the New Member to a Member.

You might also allow new accounts to be promoted straight to Members if they use their ISP email. If they use their ISP email you can send an email to ABUSE [at] [their domain] with their IP and put them in some hot water in addition to banning them, whereas you have much less recourse if they use Hotmail, Gmail, or Yahoo.

mubed
Offline
Last seen: 14 years 2 months ago
Joined: 2009-01-26 23:52
Moderation is good but...

I'd been moderating some Yahoo and Google groups before. Of course it works, but it is too time-consuming, so you must first find volunteers for it. If no volunteers are found, an alternative way is to implement a [Report as SPAM] button, everyone can click on. If a post reaches a specific number of clicks, it's removed automatically. The disadvantage of this is, that a bot can be used to delete complete forums by continuously "reporting as SPAM" all posts! Maybe this could be combined with the member classes and moderation in a way that the mods just decide to grant or not to grant the status change from new member to member, based on the number of "survived" post from that user. This is much less work than reading each new post and evaluating it (may even be automated). Being accepted as a member lets then using the SPAM Report button.

NathanJ79
NathanJ79's picture
Offline
Last seen: 4 years 5 months ago
Joined: 2007-07-31 15:07
No.

No. You never put a button that, if pressed enough times, invokes moderation. That's just asking for trouble, as you pointed out.

GameFAQs is highly secretive about how its proprietary forum technology (coded by founder CJayC and others) works, but loose-lipped moderators and other staff have let enough slip that some things are known while others are assumed. It's quite impressive. Their reporting system is quite remarkable. Moderators have access to a report queue and most members have access to a report function. When reporting, they can choose from about half a dozen "topics" to report for. Illegal activities, such as posting warez links; or trolling, such as saying "PortableApps.com sucks, use CeeDo instead" here. There's also a space for a comment that can be used regardless of what you check, to elaborate. The category helps determine how high up on the queue it goes - for example, on a basis of first come, first serve, by default something would go to the bottom, but we might send it to the top if it's, say, illegal activities. And if you have a troublesome user who just reports messages because he doesn't like someone, well in that case every user has a secondary Karma they call MMA (marked message accuracy) which means that the higher your MMA is, the more likely your marks will be seen. If it's terribly low, your marks will be ignored.

Of course, a slick system like that is probably more work than y'all want to do, but that might be among the most perfect ways of implementing a snitch system.

Ed_P
Offline
Last seen: 5 years 8 months ago
Joined: 2007-02-19 09:09
new 'bot software

Last fall a new 'bot was developed that could read CAPTCHAs and as such was running thru the major forums. As a result forums had to create expanded Ban lists, IP and email, and then they acquired newer CAPTCHAs so the 'bots have been pushed to newer forums on which to prey.

One source of SPAM comes from InternetServices IPs and a quick search will show many seemingly scattered IP addresses.

A pattern was found with one bot where there was always a Z between the first and last names of email addresses. And there was a limited number of first and last names being used. So addresses like email@example.com could get trapped with filters emai*@* and *ail@*. I think I had about a dozen 1st and last names filtered. One SPAMmer was creating email addresses in China, so for a while *.@*.cn addresses were banned. And massive amounts of SPAM have gmail.com addresses so it got banned also. Both of these were removed when the new CAPTCHA was implimented.

Many CAPTCHA apps provide for handicap overrides so dismissing them out of hand is short sighted. Of course it's possible Drupal doesn't support the higher level CAPTCHA apps.

Banning individual member names is limited but can help. *p*rn* and *viagara* being the two that come to mind.

Banning individual IP addresses is only effective if the same address is found to be used repeatedly. Usually that's not the case.

[Fake email address changed to example address - JTH]

Ed

Ed_P
Offline
Last seen: 5 years 8 months ago
Joined: 2007-02-19 09:09
It was a spammer's fake

It was a spammer's fake address. No need to change it.

Ed

John T. Haller
John T. Haller's picture
Offline
Last seen: 19 hours 51 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Domain

Yeah, but that domain could have real email accounts on it. Or it could change hands a year from now. And having that address here could cause someone else problems. Always best to use email@example.com, personally.

Sometimes, the impossible can become possible, if you're awesome!

jimmy72
Offline
Last seen: 13 years 2 months ago
Joined: 2008-09-21 07:25
I had an idea...

What if anyone who could "fix" the website stopped developing apps and focused on that?

I don't have a short attention span. I just...oh look a kitty!

m-p-3
m-p-3's picture
Offline
Last seen: 2 months 2 weeks ago
Joined: 2006-06-17 21:25
Why not put all new account

Why not put all new account on "probation", I mean that all new posts from a user would need to be approved by a super-user until the account has reached a certain time (4 days)?

After that time, I'm pretty sure all the spammers would get intercepted before they do any harm to the community. A human supervision will always be better than an automated system.

kai.inouye
kai.inouye's picture
Offline
Last seen: 12 years 7 months ago
Developer
Joined: 2008-02-03 20:12
Hmm, thats a good idea.

Hmm, thats a good idea.

mubed
Offline
Last seen: 14 years 2 months ago
Joined: 2009-01-26 23:52
That's what he already wrote!

What you're suggesting is what NathanJ79 already wrote:

Make a new class called New Members, and by default any newly created accounts are New Members. New Members' posts aren't posted directly,...

John T. Haller
John T. Haller's picture
Offline
Last seen: 19 hours 51 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Implemented

I've implemented a text-based math CAPTCHA that should snag any automated account creation attempts. Unfortunately, it looks like we're dealing with a smalltime manual spammer, so that won't really help.

I also implemented rel="nofollow" on all forum links. It hadn't been setup quite correctly before and should have been enabled since we upgrade to Drupal 6 but hadn't been due to the order of the filtering on forum posts and comments. Not it is enabled. What this means is that any links will gain a spammer nothing in terms of Google PageRank or similar search engine rankings. So, the only reason that the spamming would continue is if the spammer is dumb and doesn't realize that he gets nothing (not pagerank, not visits) by posting. Of course, spammers are dumb...

For people who have made some suggestions, note the following:

- We can't create a new class of user that doesn't have direct posting abilities and then later gets the ability to post directly after say a week as this feature doesn't exist in any module for Drupal. It would have to be handled manually by admins, so that ain't gonna happen.

- We can't filter out new accounts based on specific criteria as the spammers use the same mail providers as real users (like gmail, etc).

- We can't filter out new accounts based on any other criteria as they also look like normal users (people always leave the defaults for country, pick silly account names, etc).

- We can't put new accounts on hold for administrative review as they look the same as others and this would put another undue burden on admins.

- We can't add a "report spam" button as none of the 3 anti-spam/anti-abuse modules in Drupal have been updated to Drupal 6 stably. As Drupal 6 has been out a year, any modules not yet updated can be considered dead.

Sometimes, the impossible can become possible, if you're awesome!

NathanJ79
NathanJ79's picture
Offline
Last seen: 4 years 5 months ago
Joined: 2007-07-31 15:07
one vs. the other and such

Actually three of your five "can't" bulleted items are "won't", I think (e.g. "We WON'T filter out new accounts based on specific criteria as the spammers use the same mail providers as real users (like gmail, etc)." but point taken. I was going to say that that's five knocks against the Drupal platform but it's really only two and the other three being a personnel issue. I used to be VERY critical of forum platforms, and, well, I guess I still am.

I would have suggested phpBB, as, like I noted Drupal is, it's open source as well, which fits with PortableApps, but then, looking at phpBB's latest work, the topic view and forum view pages still look cluttered as hell. Drupal seems to present a clean interface, just the facts and nothing more, real elegant and simple. Not a big fan of the indented/tree reply system (and I liked how Invision 2.x would let you switch between that and the flush/uniform/flat view, as well as a third view) but hey, can't win 'em all.

Long story short it sounds like, despite a couple limitations, you got it sorted. It did seem like just one bonehead dropping affiliate links... I don't know, I didn't read the posts, but it seemed to be an isolated incident and that the bigger threat to PA.com and what you guys are trying to accomplish is the portable warez sites, especially that one with the gold PA.com icon trying to pass itself off as the warez arm of this site.

John T. Haller
John T. Haller's picture
Offline
Last seen: 19 hours 51 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
reCaptcha

I forgot to mention, I implemented reCaptcha on the registration form soon after I realized the text-based captcha wasn't working and this seems to have handled it quite well. We'll be keeping an eye on things to be sure the forums stay nice and spam free.

Sometimes, the impossible can become possible, if you're awesome!

Ed_P
Offline
Last seen: 5 years 8 months ago
Joined: 2007-02-19 09:09
You'll be happy that you did.

John T. Haller (Homepage) - February 9, 2009 - 6:30pm
Captchas exclude visually impaired visitors and are not an option.

John T. Haller (Homepage) - February 22, 2009 - 9:33pm
I forgot to mention, I implemented reCaptcha

Good choice.

Ed

John T. Haller
John T. Haller's picture
Offline
Last seen: 19 hours 51 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
reCaptcha Audio Alternative

Unlike most captchas, reCaptcha implements an alternative audio method for visually impaired users. And unlike most captchas with an audio alternative, it's well thought out, allows you to replay it, and even allows you to download it as an MP3 if you don't have a plugin in your browser to allow audio to be played. Done being a wise ass now?

Sometimes, the impossible can become possible, if you're awesome!

Ed_P
Offline
Last seen: 5 years 8 months ago
Joined: 2007-02-19 09:09
As I said

Good choice.

Initially you rejected all CAPTCHAs out of hand. As you have found they are not all alike.

I didn't realize this forum advocated name calling.

Ed

John T. Haller
John T. Haller's picture
Offline
Last seen: 19 hours 51 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
It Changed

Actually, reCaptcha changed the way they present the audio file, probably from community feedback, between the time I first mentioned it (and rightfully rejected it) and when I implemented it. Originally, it was using a file embed so it was played as Quicktime or whatever else you have configured to play MP3s in the browser (which will not work for a lot of people). Now, they're using a flash object (which is pretty universal) with text links to play it again (which retriggers the flash object) and a link to download it as an MP3 if you can't hear it in the browser, which should let just about everybody hear it no matter their configuration.

Those changes make it the only captcha I've ever seen that properly handles most accessibility issues. And, as there are only a handful of captchas that work with Drupal, it was easy to quickly evaluate them all and realize that, originally, none of them made the cut. reCaptcha is close enough and I added a notice to the registration page about getting email assistance for users who can't use the captcha just in case we get any deaf-blind members.

I thought you were posting those quotes side by side to be a wiseass Blum

Sometimes, the impossible can become possible, if you're awesome!

Jacob Mastel
Offline
Last seen: 3 years 9 months ago
Developer
Joined: 2007-06-13 19:36
I don't mean to be rude or anything but

I'm sorry I don't mean to offend anyone but I must honestly ask this question. Okay I can understand people that don't see well maybe even not at all but seriously deaf and blind? If you have that combination I don't see why the person would need to even have a login. They wouldn't be able to read/hear the forums or interact with them. Again I don't mean to be an ass but I don't think we we need to worry about people that are deaf and blind.

Release Team Member

reepicheep
Offline
Last seen: 12 years 1 week ago
Joined: 2008-04-29 11:32
Ummmmm...

Jacob Mastel...we need to worry about people that are deaf and blind.

Such wonderful disability awareness. Some of us are very concerned with deaf and bljnd people; some of us work with/for them.

Jacob Mastel
Offline
Last seen: 3 years 9 months ago
Developer
Joined: 2007-06-13 19:36
Sorry

I really didn't know that people that were deaf & blind (I mean both at once) had any ability to read a webpage or really interact with a computer at this level. I didn't mean to be offensive, again, I apologize.

Release Team Member

John T. Haller
John T. Haller's picture
Offline
Last seen: 19 hours 51 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Possibilities

There's always the possibility that someone with some disability or another will need to use a resource you've provided. So, if you can do so without impacting other things, I'm all for doing it. Especially since it can wind up benefiting everyone. There are deaf and blind people in the world. It doesn't necessarily mean no sight and hearing, but it can (read more). And, like anyone with sight issues, they can use a refreshable Braille display to gain access to technology. They just don't have audio to go along with it.

Sometimes, the impossible can become possible, if you're awesome!

SONofSAM
Offline
Last seen: 15 years 3 months ago
Joined: 2009-03-01 19:47
New Here

Hello all... After reading this thread and only signing in an hour a go myself, it makes me feel like I'm walking on egg shells... Been here for a few months but just joined. Must add that the work done here an the programs made possible for the end user is fantastic... Just wanted to say HI to everyone and to let folks know that I'm a good folk meaning no harm to anyone... Look forward to meeting some of the folks here over the coming months... Smile

Log in or register to post comments