Spam Bots

[Greg]

Someone asked me in a PM what I was going to do with the issue of spam bots. In the interest of keeping everyone informed, here is my response:

There isn't a very good way to filter the registrations. Right now, when someone registers, I'm sent an email notifying me. With spam bots, there is usually a one day delay between when they register and when the start to post. This delay occurs because this forum requires email verification - which means the spammer (the person, not the bot) must manually reply to the email to start the process.

This usually gives me enough time to log in and delete all the "validating members" - those members who have registered but not replied to the verification email.

However, if the spammers are quick enough, they can get the jump on me and start posting spam. I am considering placing all new members into a moderation queue, which I could set to hold the registrations until I could manually verify their IP addresses. I would grab the IP address and compare it to known spammer IP addresses.

Or

I could have the forum software dump all the new members postings into the moderation queue, which I could then preview, before letting them loose. That way if the first posting is spam, I could delete the member. If the first posting is legit, I could left the moderation queue and let'm free.

The last option is the one I'm leaning towards.

[Cameron]

I would like to see the last option. It takes away from the forum when spammers post. I would take it the cue would be only visible to you Greg?

[Higgly]

Another possibility would be to delegate responsibility for spambot posts to a trusted and experienced member. This member would only have delegated authority to deal with spambot posts, which are obvious to a human observer. The member would not have any authority to do anything else; if they stepped over this line, or used it any way to their advantage, they would of course lose the position. As a pre-condition, they could be required to give up the priviledge of posting to MLW.

I imagine Greg has enough to do just herding the livestock. Shooting the varmints may be something that someone else could do to lighten the load. Should be someone who is fairly savvy about things like worms and viruses, since the varmints have all sorts of quills and smelly stuff, and the varmint hunter would need to actually click on some of the links to see what is going on...

I am not intimately acquainted with the software, but perhaps there is a way to make this transparent - for example, to only give the varmint hunter the power to move posts to a particular folder that everyone can see. Would make it self-monitoring.

Just a thought.

[Who's Doing What?]

I don't remember if you already have this in place, but what about the jumbled letters and numbers that the bots aren't supposed to be able to read? Can they read them now?

A new one I have encountered is a simple question: 'Are you a human?' The default answer is set to 'no'.

Other than that monitoring the first post is likely the best solution.

[Higgly]

A new one I have encountered is a simple question: 'Are you a human?' The default answer is set to 'no'.

Good idea!

[Riverwind]

A new one I have encountered is a simple question: 'Are you a human?' The default answer is set to 'no'.

You could add an extra field that requires registrants to type in the name of the prime minister of Canada. The best questions are those that would be obvious to a real person that has an interest in MLW but would require some research on the part of a hacker/spammer.

[Higgly]

A new one I have encountered is a simple question: 'Are you a human?' The default answer is set to 'no'.

You could add an extra field that requires registrants to type in the name of the prime minister of Canada. The best questions are those that would be obvious to a real person that has an interest in MLW but would require some research on the part of a hacker/spammer.

Might stump a few of the posters we see here as well

[theloniusfleabag]

I think Greg's second option is the way to go.

I could have the forum software dump all the new members postings into the moderation queue, which I could then preview, before letting them loose. That way if the first posting is spam, I could delete the member. If the first posting is legit, I could left the moderation queue and let'm free.

The 'spammer' (or troll) has been manually signing in, I am guessing with a 'spoofed IP', so the only way to really defeat this problem is to waste their time by queueing all 'new member's posts' and deleting the spam before it hits the forum. They (he) likely won't have the time to create a legitimate post first, and then return with the same IP to spam on the second post.

On a side note, I think everyone should boycott all products hawked by spam.

[gerryhatrick]

Greg, does your forum content editor not allow for the inclusion of a confirmation/validation code?

You know those codes that are presented as a blury picture and need to be retyped accurately?

That gets rid of the bots.

[Charles Anthony]

You know those codes that are presented as a blury picture and need to be retyped accurately?

I am just throwing something out here: those are images and sometimes images in forums pose a security risk.

I do not know enough about those risks but images were a hole before, were they not?

[theloniusfleabag]

Greg, does your forum content editor not allow for the inclusion of a confirmation/validation code?

You know those codes that are presented as a blury picture and need to be retyped accurately?

That gets rid of the bots.

Good lord, you are either retarded or trolling as a bandwidth leech. Choose one, it can't be anything else. Greg himself has stated that the spammers are manually signing on.

This forum does have the validation code 'test', you would have taken it to sign up. Again, you are either incredibly thick or pretending to be.

[gerryhatrick]

Greg, does your forum content editor not allow for the inclusion of a confirmation/validation code?

You know those codes that are presented as a blury picture and need to be retyped accurately?

That gets rid of the bots.

Good lord, you are either retarded or trolling as a bandwidth leech. Choose one, it can't be anything else. Greg himself has stated that the spammers are manually signing on.

This forum does have the validation code 'test', you would have taken it to sign up. Again, you are either incredibly thick or pretending to be.

Actually Greg did not say that the spammers are manually signing on, he said that they are manually replying to the registration email.

See, you made a mistake. I would not now presume to call you a retard, as you called me. That would be ignorant/rude/small-minded - take your pick.

I see that the forum has a validation code test for registering now. In that case I was mistaken. If that is how you react to someone when they're mistaken then I pity your husband.

[August1991]

I could have the forum software dump all the new members postings into the moderation queue, which I could then preview, before letting them loose. That way if the first posting is spam, I could delete the member. If the first posting is legit, I could left the moderation queue and let'm free.

The last option is the one I'm leaning towards.

Please do this Greg, immediately. The spam is getting worse.

Under your proposal, there's a danger that spammers will post first to say "Hi. I'm new here." and then post their spam.

I feel that you should impose high costs on new posters. Make new posters jump through a few hoops (as long the hoops are low cost to you but high cost to them) before they get to join the club. I see no harm in making new posters wait a couple of days before seeing their first or even second post appear on the forum. Apart from spammers, people often act up and cause problems when they first post to the forum. How much work would it be for you to dump into a queue and then eyeball the first and even second post of all new posters?

[Greg]

How much work would it be for you to dump into a queue and then eyeball the first and even second post of all new posters?

No much, certainly less work than I spend manually searching new registrations for known spammer addresses and IPs.

I might enlist a few helpers in this cause, as partisanship certainly would not be an issue for reviewing new member registrations and postings.

Give me a few days to figure out the logistics of this new feature and I will report back here.

Thanks!

Greg