Shireroth

... has a simple solution. If a post contains a link, and it's the first post of an account, send both the link and the account to the bit bucket. Add in a big fat note telling new users not to post any links (for convenience, we could create a "registration" thread in MiniImNat and redirect new users to a prefilled add-reply screen for that thread).

If anyone's wondering, I don't actually know if we're getting spam from human operators or spambots. I find the latter to be more likely, though, since there's software that can defeat phpBB's visual confirmation 97% of the time, and I don't think there's a spammer with the resources to pay people to go through so many forums manually that they'd be hitting us. This fix is a question of resources too, of course - if we were a big forum and for some reason worth a spammer's attention, my simple scheme would get defeated sooner than I could implement it, but we're not, and I don't think many other people would use this specific scheme.

If people don't have any complaints, I'll implement it in a bit. Unlike porting Cash Mod on Categories Hierarchy, which I never got done in the end, this change would actually 1) be rather little work and 2) solve a real problem...

Actually, considering this as a question of resources (our multiple PHP-competent people vs. their clock cycles) we can start out even smaller and play by ear if simple things don't seem to work. A spambot should be foiled by merely adding a confirmation page with two buttons - one saying "I am a legitimate human being" and another one "I am a spambot and should not get an account" right after the registration page... heck, it should be enough to just change the names of the variables that the registration page uses (and perhaps frobnicate the HTML structure of that page if they're actually screen-scraping instead of just sending in the registration request directly). That would be a very minor change and totally invisible to any human users.

Sounds simple and good by my standards.

I really need to learn PHP.

Sounds good to me, Ari. Go for it.

...frobnicate? I hate these wierd terms for jumbling stuff. :P

Either way, the "I am a human" button would probably be the most effective test.

Ari, you rock.

http://shireroth.kuroshiro.net/forum2/v ... php?t=6895

That thread needs to be deleted.

Definitely. It has no place in our fora.

Personally, I find it offensive.

Idea: Add into the registration process a disclaimer, like you see in most registration processes. In this disclaimer, add a clause stating that by registering you are attesting to the fact you are human, and that youo not intend to post to the forum with the sole intent of advertising. And that if you are a bot, that you are signing on behalf of your owner, and they shall be held responcible for this contract. And that if you break this agreement you will owe the organization known as the Imperial Republic of Shireroth $100. You never know, we might be able to track the creator somehow, and threaten to sue if they do not pay up.

I see we don't require account activation... well, not that it'd be any good anyway, I guess. If the spambots can deal with the usual phpBB captcha, they can answer an activation email, too.

WolvinX84 wrote:Idea: Add into the registration process a disclaimer, like you see in most registration processes. In this disclaimer, add a clause stating that by registering you are attesting to the fact you are human, and that you do not intend to post to the forum with the sole intent of advertising. And that if you are a bot, that you are signing on behalf of your owner, and they shall be held responcible for this contract. And that if you break this agreement you will owe the organization known as the Imperial Republic of Shireroth $100. You never know, we might be able to track the creator somehow, and threaten to sue if they do not pay up.

Impractical and legally ambiguous.

Yes. Indeed. Quite. Fwa-ha-ha!

But it would be amusing.

I emailed GregDean with StupidSpambotFoilage patch #1. I'll have to ask him for the board's access logs to be able to research how our antagonists are actually behaving if that one doesn't work. It's pretty much the most minimal patch I could think of - it only affects two lines in the board code, and is invisible to human users.

I forgot we allow unregistered users to post. If I recall correctly, that was not our policy on the old forum. The patch I emailed to GregDean can only foil spambot registration, not posting by unregistered bots. I'm rather paranoid about changes to live code, though, so I'll just continue waiting for Greg to show up, so we can test the ultra-minimal patch first.

Als Moose or Conglacio, could you be so good and clean out the spam that's gathered up so far? It makes the forum look like there's nobody to care for it...

I am removing it!

Thanks, Ari and David. I don't yet have any admin. powers, so I appreciate your help here.

Help, David! I still don't know how to get rid of all the garbage fouling our fora. Please give me the power, and tell me what to do with it. Thanks so much!

I just deleted four or five threads. Unfortunately, I don't have the authorization to go making the Kaiseress an admin. I hope someone besides Greg does.

By the way, there's no point in replying to the threads as they're probably all posted by bots that don't come back to check if anyone's said anything.

gave it last night, and it looks like you are using it!

David, I am not the one who has deleted these threads. I have no idea how to use the powers you say I have. Help, please. btw, thanks, Scott, for deleting those items.

I am writing up summat

The email got through to Greg Dean, he said he'd look at it today at work, but I don't see any changes so I'm going to assume he was too busy to remember to do it. However, it seems Fax Celestis has FTP access to shireroth.kuroshiro.net, too, so I'm going to poke him next...

Cool.

I've decided to ask users registering on a board I administrate whether they are a spambot or not, requiring the response to be yes, as opposed to no or 'not specified'. I'll let you guys know if it's successful.

Mind, it's not an entirely accurate experiment, as I have phpBB visual confirmation required, too, and so that'll catch a lot of the spambots, too. (Those that don't bother, mainly)

The code snippets:

templates/[template of choice]/profile_add_body.tpl

Under...
...(or comparable), add:

profile.php

Under...
...add:
Don't use it until I can confirm it works, though.

Edit:

There is also this mod, which you can install: [2.0.13] disable spambots. The author claims it works, which is more than I can do about my little hack. In general, this MOD category ought to be of interest.

The method that I WOULD ALREADY HAVE IMPLEMENTED MYSELF LONG AGO IF I HAD FRICKING FTP ACCESS TO THE SITE FFS is pretty much equal in power to yours, I think. It's very easy to code a bot to beat either, but we're just counting on being small enough that nobody has the time and determination to spend human time figuring out what's wrong with our forums that the bots don't understand.

However, IMO my method is simpler, slightly more devious, and above all, completely invisible to human users. I'll just change the name of the variable "username" to "usernarne" on the registration page (and do the corresponding change in profile.php). It should cause at least some frustration, perhaps enough to deter the antagonists we can expect, assuming they made a bad choice of fonts .

Ari Rahikkala wrote:The method that I WOULD ALREADY HAVE IMPLEMENTED MYSELF LONG AGO IF I HAD FRICKING FTP ACCESS TO THE SITE FFS is pretty much equal in power to yours, I think.

Figures. This tends to happen when I spend time with stuff.

Ari Rahikkala wrote:However, IMO my method is simpler, slightly more devious, and above all, completely invisible to human users. I'll just change the name of the variable "username" to "usernarne" on the registration page (and do the corresponding change in profile.php). It should cause at least some frustration, perhaps enough to deter the antagonists we can expect, assuming they made a bad choice of fonts .

Hopefully it'll work. ^_^

Just a head's up - no spambot registrations on the board I put that onto since. I'll keep you updated, though.

SPAM'D

(Just deleted another spam topic)