Author Topic: Regarding Spambots  (Read 15167 times)

0 Members and 1 Guest are viewing this topic.

Offline Iss Mneur

  • 210
  • TODO:
@admins: Out of curiosity, does HLP take part in something like Project Honeypot to help classify incoming users?
CloudFlare would do that and much more too. The only reason why it was disabled shortly after it was tried out was that Starman01 was having weird issues. I'd suspect these are fixed by now. HLP CloudFlare account still exists with all but the newest (if any) domains already set up. Only GoDaddy DNS needs to be changed and it'd be good to go once again.
Yes they do.  I think they actually use Project Honeypot as part of their metrics or a similar service.

I understood there were other issues with CloudFlare as well, not just Starman01 having issues, which was why we dropped it.  Though you would know best as you were the one that implemented it :D.
"I love deadlines. I like the whooshing sound they make as they fly by." -Douglas Adams
wxLauncher 0.9.4 public beta (now with no config file editing for FRED) | wxLauncher 2.0 Request for Comments

 

Offline Talon 1024

  • 29
  • How do you turn this on?
    • Mods, Games, and Stuff
Should user registration be disabled temporarily because of all the spambots coming in?
To understand religion, you need to understand morality first. | WCSaga website | WCSaga Forum | 158th website | 158th forum | Project Leader: WC: Hostile Frontier | WCHF Thread at CIC | Wing Blender | Twist of Fate | Multipart turrets on angled surfaces, tutorial included. | My Google Drive stuff | To convert speeds from WC to WCS, multiply both the cruise speed and the Afterburner speed by 0.15625 (5/32)

FS2 Mods I'm waiting on: Inferno 10th Anniversary
Current Project: Contestant Android app, Learn4Life iOS app, Blender Commander (importer).
The FreeSpace Font Foundry is back in action!

 

Offline Goober5000

  • HLP Loremaster
  • 214
    • Goober5000 Productions
I've changed the registration process to require admin approval.  That will at least get rid of the bots registering with gibberish names.

Zacam is working on a more permanent solution.

 

Offline Flipside

  • əp!sd!l£
  • 212
Have noticed a huge drop in spam posts since this was done :)

 
Just to post my thoughts, being a brand new registered user.

The wait to get an account is quite annoying, I can completely understand your situation (I've got a couple forums myself, and numerous blogs), but, with the current system, it does appear you could be harming your chances of getting new users to stick about.

Just my $0.2

 

Offline Goober5000

  • HLP Loremaster
  • 214
    • Goober5000 Productions
The current system is temporary until Zacam finishes a forum mod.  You definitely have a legitimate concern, but unfortunately the spam registrants make it extremely difficult to come up with a satisfactory solution.  When I approved your membership, for example, I had to reject about 50 spam accounts that registered at about the same time you did.  In fact, right now there are 65 (edit: now 66) members awaiting approval, and I'll bet that almost every one of them is a spam attempt.

 
It's no problem.

Is there a plugin for SMF that checks account IP's against a database of known  spammers, like the StopForumSpam database? I've used a plugin like that for vBulletin, and it's helped a lot, though it does occasionally pick up a few false positives.

 

Offline Zacam

  • Magnificent Bastard
  • Administrator
  • 211
  • I go Sledge-O-Matic on Spammers
    • Steam
    • Twitter
    • ModDB Feature

There is indeed. And one that talks to Project Honeypot and a few others.

The problem, is that when more than one potential "check" system is available, they all have to work in a collaborative fashion, which none of the SMF Mods are initially created to do.

It also means some significant reworking of the database end as well as adding in new administration controls. And being able to build a history of our own that also allows us to undo any "false positive" rejections wouldn't hurt either.
Report MediaVP issues, now on the MediaVP Mantis! Read all about it Here!
Talk with the community on Discord
"If you can keep a level head in all this confusion, you just don't understand the situation"

¤[D+¬>

[08/01 16:53:11] <sigtau> EveningTea: I have decided that I am a 32-bit registerkin.  Pronouns are eax, ebx, ecx, edx.
[08/01 16:53:31] <EveningTea> dhauidahh
[08/01 16:53:32] <EveningTea> sak
[08/01 16:53:40] * EveningTea froths at the mouth
[08/01 16:53:40] <sigtau> i broke him, boys

 

Offline Fury

  • The Curmudgeon
  • 213
Like I've already mentioned, enabling CloudFlare and "nameplate" captcha in addition to SMF default captcha would reduce number of spam registrations. Nameplate images should still be there where they were left when it was removed. Nothing stops you from using different method if you so desire, but at least it would beat waiting for this mystical and magical solution Zacam has been said to be working on.

 

Offline Zacam

  • Magnificent Bastard
  • Administrator
  • 211
  • I go Sledge-O-Matic on Spammers
    • Steam
    • Twitter
    • ModDB Feature

Awww, but I wanted there to be Ponies and Rainbows and glittery confetti.

I'm a bit at a loss to understand where you are coming from with that derisive statement. The "mystical and magical" solution seems more like using CloudFlare rather than developing our own supportable Module that has it's own database capabilities that it can build and refer to in the event of an outage or change in service type from any external source.

But sure, I guess we can just close our eyes and let somebody else do it for us and not bother with asking how or why. Or having ANY control over when it decides to false-positive block somebody.

Okay, that last part is a bit of a stretch. They do have a control panel that is pretty nice for what they offer on their Free Services side. And none of it is anything that we can't do or have for ourselves.
Report MediaVP issues, now on the MediaVP Mantis! Read all about it Here!
Talk with the community on Discord
"If you can keep a level head in all this confusion, you just don't understand the situation"

¤[D+¬>

[08/01 16:53:11] <sigtau> EveningTea: I have decided that I am a 32-bit registerkin.  Pronouns are eax, ebx, ecx, edx.
[08/01 16:53:31] <EveningTea> dhauidahh
[08/01 16:53:32] <EveningTea> sak
[08/01 16:53:40] * EveningTea froths at the mouth
[08/01 16:53:40] <sigtau> i broke him, boys

 

Offline karajorma

  • King Louie - Jungle VIP
  • Administrator
  • 214
    • Karajorma's Freespace FAQ
That said, why aren't we using the nameplates stuff? No bot is getting through that one.
Karajorma's Freespace FAQ. It's almost like asking me yourself.

[ Diaspora ] - [ Seeds Of Rebellion ] - [ Mind Games ]

 

Offline mjn.mixael

  • Cutscene Master
  • 212
  • Chopped liver
    • Steam
    • Twitter
IIRC, there was some discussion about the STOP font being too difficult for people.
Cutscene Upgrade Project - Mainhall Remakes - Between the Ashes
Youtube Channel - P3D Model Box
Between the Ashes is looking for committed testers, PM me for details.
Freespace Upgrade Project See what's happening.

 

Offline Fury

  • The Curmudgeon
  • 213
I'm a bit at a loss to understand where you are coming from with that derisive statement. The "mystical and magical" solution seems more like using CloudFlare rather than developing our own supportable Module that has it's own database capabilities that it can build and refer to in the event of an outage or change in service type from any external source.

But sure, I guess we can just close our eyes and let somebody else do it for us and not bother with asking how or why. Or having ANY control over when it decides to false-positive block somebody.

Okay, that last part is a bit of a stretch. They do have a control panel that is pretty nice for what they offer on their Free Services side. And none of it is anything that we can't do or have for ourselves.

It's been quite a long while since it was first mentioned publicly you were working on a solution of your own. A time at which any other readily available solution(s) could have been used to lessen the impact of spammers and anything else malicious. If you really feel like reinventing the wheel and using the solution you're cooking up, please do but why are you not making use of temporary solutions that may or may not be just as effective at stopping spammers?

And least we forget, any external service beats local service when it comes to stopping malicious traffic. Why? Because in ideal scenario such traffic never reaches the server that is hosting actual content. In many cases CF has managed to reduce http traffic of their customers by several times. CF is efficient in blocking denial of service attacks as well.  As the server serves far fewer http requests, it can focus on serving real visitors all that much quicker. Not to mention that CF also works as CDN, reducing loading times of static content which should help visitors from other continents quite a bit all the while reducing bandwidth usage of the server. CF also features many tools, one of which is support for Google Analytics. Since it works for all http traffic on specified domains, it is way more accurate than it would be if you just add the code to select few pages such as HLP forums and mainpage. With CF you'd be able to monitor all hosted project sites too without editing their files and so on. Available tools doesn't end there, but you should be able to research it yourself should you feel inclined to do so.

Can your module do that? It very much sounds like it's SMF module, which does jack squat for the wiki and any other sites being served on this server. If I am mistaken and it works for the whole server, awesome but you still could make use of what's available until it is done.
« Last Edit: September 06, 2011, 11:32:10 pm by Fury »

 

Offline Zacam

  • Magnificent Bastard
  • Administrator
  • 211
  • I go Sledge-O-Matic on Spammers
    • Steam
    • Twitter
    • ModDB Feature

Okay then, so what's the process for turning CF back on then, seeing as how it was on before? If you're going to say "turn it back on" including -how to- at some point would probably be a good idea.

You know, just in case anybody else wants to do it.
Report MediaVP issues, now on the MediaVP Mantis! Read all about it Here!
Talk with the community on Discord
"If you can keep a level head in all this confusion, you just don't understand the situation"

¤[D+¬>

[08/01 16:53:11] <sigtau> EveningTea: I have decided that I am a 32-bit registerkin.  Pronouns are eax, ebx, ecx, edx.
[08/01 16:53:31] <EveningTea> dhauidahh
[08/01 16:53:32] <EveningTea> sak
[08/01 16:53:40] * EveningTea froths at the mouth
[08/01 16:53:40] <sigtau> i broke him, boys

 
IIRC, there was some discussion about the STOP font being too difficult for people.

Seriously? Someone who can't make out perfect English words in a somewhat stylized font either
A. doesn't know English whatsoever
B. is a complete idiot

I wouldn't bother about blocking that 0.01% of possible HLP members out, TBH, even if it makes us look like a secret bunch of incommunicado reclusives :P

But that might be just me. If STOP is unreadable, there's still BSG and UEF (and TBP?) nameplates we can use...

 

Offline MatthTheGeek

  • Captain Obvious
  • 212
  • Frenchie McFrenchface
Last time I checked, "Aquitaine" isn't really an English word :p

That's probably the case for some of the others, I don't remember which ones were there.
People are stupid, therefore anything popular is at best suspicious.

Mod management tools     -     Wiki stuff!     -     Help us help you

666maslo666: Releasing a finished product is not a good thing! It is a modern fad.

SpardaSon21: it seems like you exist in a permanent state of half-joking misanthropy

Axem: when you put it like that, i sound like an insane person

bigchunk1: it's not retarded it's american!
bigchunk1: ...

batwota: steele's maneuvering for the coup de gras
MatthTheGeek: you mispelled grâce
Awaesaar: grace
batwota: oh right :P
Darius: ah!
Darius: yes, i like that
MatthTheGeek: the way you just spelled it it means fat
Awaesaar: +accent I forgot how to keyboard
MatthTheGeek: or grease
Darius: the killing fat!
Axem: jabba does the coup de gras
MatthTheGeek: XD
Axem: bring me solo and a cookie

  

Offline The E

  • He's Ebeneezer Goode
  • 213
  • Nothing personal, just tech support.
    • Steam
    • Twitter
Neither is "eökrgqserg", and yet normal captchas have no problem spitting word salad at people.
If I'm just aching this can't go on
I came from chasing dreams to feel alone
There must be changes, miss to feel strong
I really need lifе to touch me
--Evergrey, Where August Mourns

 

Offline mjn.mixael

  • Cutscene Master
  • 212
  • Chopped liver
    • Steam
    • Twitter
Neither is "eökrgqserg", and yet normal captchas have no problem spitting word salad at people.

This.

I kinda want to find that thread.. but I can't really be arsed to search right now.

EDIT: I lied, here it is.
« Last Edit: September 07, 2011, 10:13:37 am by mjn.mixael »
Cutscene Upgrade Project - Mainhall Remakes - Between the Ashes
Youtube Channel - P3D Model Box
Between the Ashes is looking for committed testers, PM me for details.
Freespace Upgrade Project See what's happening.

 

Offline Rodo

  • Custom tittle
  • 212
  • stargazer
    • Steam
yeah I remember it, type Nyarlathotep ftw... and forum entrance.

It was the best captcha evar, and I mean it.
el hombre vicio...

 

Offline Fury

  • The Curmudgeon
  • 213

Okay then, so what's the process for turning CF back on then, seeing as how it was on before? If you're going to say "turn it back on" including -how to- at some point would probably be a good idea.

You know, just in case anybody else wants to do it.

I think I posted CF login details in the admin board (I may have changed pw since then though) and Sandwich should know how to change DNS. In any case, I've PM'ed you step-by-step instructions on it. While you're at it, request Sandwich to remove my permissions to HLP domain on GoDaddy. It's nothing more than a liability for me to have those anymore.