The spam problem...

[Ari Rahikkala]

... has a simple solution. If a post contains a link, and it's the first post of an account, send both the link and the account to the bit bucket. Add in a big fat note telling new users not to post any links (for convenience, we could create a "registration" thread in MiniImNat and redirect new users to a prefilled add-reply screen for that thread).

If anyone's wondering, I don't actually know if we're getting spam from human operators or spambots. I find the latter to be more likely, though, since there's software that can defeat phpBB's visual confirmation 97% of the time, and I don't think there's a spammer with the resources to pay people to go through so many forums manually that they'd be hitting us. This fix is a question of resources too, of course - if we were a big forum and for some reason worth a spammer's attention, my simple scheme would get defeated sooner than I could implement it, but we're not, and I don't think many other people would use this specific scheme.

If people don't have any complaints, I'll implement it in a bit. Unlike porting Cash Mod on Categories Hierarchy, which I never got done in the end, this change would actually 1) be rather little work and 2) solve a real problem...

[Conglacio]

[Ari Rahikkala]

Actually, considering this as a question of resources (our multiple PHP-competent people vs. their clock cycles) we can start out even smaller and play by ear if simple things don't seem to work. A spambot should be foiled by merely adding a confirmation page with two buttons - one saying "I am a legitimate human being" and another one "I am a spambot and should not get an account" right after the registration page... heck, it should be enough to just change the names of the variables that the registration page uses (and perhaps frobnicate the HTML structure of that page if they're actually screen-scraping instead of just sending in the registration request directly). That would be a very minor change and totally invisible to any human users.

[WolvinX84]

Sounds simple and good by my standards.

I really need to learn PHP.

[hypatias mom]

Sounds good to me, Ari. Go for it.

[osmose1000]

...frobnicate? I hate these wierd terms for jumbling stuff. :P

Either way, the "I am a human" button would probably be the most effective test.

[Gman Russell]

Ari, you rock.

[WolvinX84]

http://shireroth.kuroshiro.net/forum2/v ... php?t=6895

That thread needs to be deleted.

[hypatias mom]

Definitely. It has no place in our fora.

[WolvinX84]

Personally, I find it offensive.

[WolvinX84]

Idea: Add into the registration process a disclaimer, like you see in most registration processes. In this disclaimer, add a clause stating that by registering you are attesting to the fact you are human, and that youo not intend to post to the forum with the sole intent of advertising. And that if you are a bot, that you are signing on behalf of your owner, and they shall be held responcible for this contract. And that if you break this agreement you will owe the organization known as the Imperial Republic of Shireroth $100. You never know, we might be able to track the creator somehow, and threaten to sue if they do not pay up.

[Ari Teh Tester]

I see we don't require account activation... well, not that it'd be any good anyway, I guess. If the spambots can deal with the usual phpBB captcha, they can answer an activation email, too.

Idea: Add into the registration process a disclaimer, like you see in most registration processes. In this disclaimer, add a clause stating that by registering you are attesting to the fact you are human, and that you do not intend to post to the forum with the sole intent of advertising. And that if you are a bot, that you are signing on behalf of your owner, and they shall be held responcible for this contract. And that if you break this agreement you will owe the organization known as the Imperial Republic of Shireroth $100. You never know, we might be able to track the creator somehow, and threaten to sue if they do not pay up.

Impractical and legally ambiguous.

[Gman Russell]

Yes. Indeed. Quite. Fwa-ha-ha!

[WolvinX84]

But it would be amusing.

[Ari Rahikkala]

I emailed GregDean with StupidSpambotFoilage patch #1. I'll have to ask him for the board's access logs to be able to research how our antagonists are actually behaving if that one doesn't work. It's pretty much the most minimal patch I could think of - it only affects two lines in the board code, and is invisible to human users.

[Ari Rahikkala]

I forgot we allow unregistered users to post. If I recall correctly, that was not our policy on the old forum. The patch I emailed to GregDean can only foil spambot registration, not posting by unregistered bots. I'm rather paranoid about changes to live code, though, so I'll just continue waiting for Greg to show up, so we can test the ultra-minimal patch first.

Als Moose or Conglacio, could you be so good and clean out the spam that's gathered up so far? It makes the forum look like there's nobody to care for it...

[Conglacio]

I am removing it!

[Kaiseress Carol]

Thanks, Ari and David. I don't yet have any admin. powers, so I appreciate your help here.

[Kaiseress Carol]

Help, David! I still don't know how to get rid of all the garbage fouling our fora. Please give me the power, and tell me what to do with it. Thanks so much!

[Scott of Hyperborea]

I just deleted four or five threads. Unfortunately, I don't have the authorization to go making the Kaiseress an admin. I hope someone besides Greg does.

By the way, there's no point in replying to the threads as they're probably all posted by bots that don't come back to check if anyone's said anything.

[Conglacio]

gave it last night, and it looks like you are using it!

[Kaiseress Carol]

David, I am not the one who has deleted these threads. I have no idea how to use the powers you say I have. Help, please. btw, thanks, Scott, for deleting those items.

[Conglacio]

I am writing up summat

[Ari Rahikkala]

The email got through to Greg Dean, he said he'd look at it today at work, but I don't see any changes so I'm going to assume he was too busy to remember to do it. However, it seems Fax Celestis has FTP access to shireroth.kuroshiro.net, too, so I'm going to poke him next...

[Gman Russell]

Cool.

[Neike Taika-Tessaro]

I've decided to ask users registering on a board I administrate whether they are a spambot or not, requiring the response to be yes, as opposed to no or 'not specified'. I'll let you guys know if it's successful.

Mind, it's not an entirely accurate experiment, as I have phpBB visual confirmation required, too, and so that'll catch a lot of the spambots, too. (Those that don't bother, mainly)

The code snippets:

templates/[template of choice]/profile_add_body.tpl

Under...

Code: Select all

	<tr> 
		<td class="row2" colspan="2"><span class="gensmall">{L_ITEMS_REQUIRED}</span></td>
	</tr>

...(or comparable), add:

Code: Select all

	<tr> 
	  <td class="row1" width="38%"><span class="gen">Are you a Spambot?: *</span></td>
	  <td class="row2">
		<input type="radio" name="amspam" value="0" />
		<span class="gen">{L_YES}</span>&nbsp;&nbsp; 
		<input type="radio" name="amspam" value="1" />
		<span class="gen">{L_NO}</span></td>
	</tr>

profile.php

Under...

Code: Select all

$mode = htmlspecialchars($mode);

...add:

Code: Select all

// --- Start spambot killer ---
if (    ($mode == 'register')
     && (empty($_REQUEST['amspam']))
     && (!empty($_REQUEST['username'])) ) {
	echo "Sorry, we don't allow registration by spambots. ^_^";
	die();
}
// --- End spambot killer -----

Don't use it until I can confirm it works, though.

Edit:

There is also this mod, which you can install: [2.0.13] disable spambots. The author claims it works, which is more than I can do about my little hack. In general, this MOD category ought to be of interest.

[Ari Rahikkala]

The method that I WOULD ALREADY HAVE IMPLEMENTED MYSELF LONG AGO IF I HAD FRICKING FTP ACCESS TO THE SITE FFS is pretty much equal in power to yours, I think. It's very easy to code a bot to beat either, but we're just counting on being small enough that nobody has the time and determination to spend human time figuring out what's wrong with our forums that the bots don't understand.

However, IMO my method is simpler, slightly more devious, and above all, completely invisible to human users. I'll just change the name of the variable "username" to "usernarne" on the registration page (and do the corresponding change in profile.php). It should cause at least some frustration, perhaps enough to deter the antagonists we can expect, assuming they made a bad choice of fonts .

[Neike Taika-Tessaro]

The method that I WOULD ALREADY HAVE IMPLEMENTED MYSELF LONG AGO IF I HAD FRICKING FTP ACCESS TO THE SITE FFS is pretty much equal in power to yours, I think.

Figures. This tends to happen when I spend time with stuff.

However, IMO my method is simpler, slightly more devious, and above all, completely invisible to human users. I'll just change the name of the variable "username" to "usernarne" on the registration page (and do the corresponding change in profile.php). It should cause at least some frustration, perhaps enough to deter the antagonists we can expect, assuming they made a bad choice of fonts .

Hopefully it'll work. ^_^

[Neike Taika-Tessaro]

Just a head's up - no spambot registrations on the board I put that onto since. I'll keep you updated, though.

[osmose1000]

SPAM'D

(Just deleted another spam topic)