Spambots

[Ansan Gotti]

Just curious, is there any way to implement a system where if a post is "Report"ed (the exclamation mark toward the top right of each post) a certain number of times, the post is automatically deleted?

I could foresee instances (mostly on other boards) where an organized clique of users could try to abuse this, but I really don't think that would happen here (and if it did, attendant consequences could accrue to the clique). If this were possible, and the users were educated about it, I bet the spambot issue would disappear pretty quickly.

Then again, perhaps I am just incredibly naive.

[MarbitChow]

Just curious, is there any way to implement a system where if a post is "Report"ed (the exclamation mark toward the top right of each post) a certain number of times, the post is automatically deleted?

I could foresee instances (mostly on other boards) where an organized clique of users could try to abuse this, but I really don't think that would happen here (and if it did, attendant consequences could accrue to the clique). If this were possible, and the users were educated about it, I bet the spambot issue would disappear pretty quickly.

Then again, perhaps I am just incredibly naive.

I think it would be more useful to be able to report a user, rather than report a post, and let the admins investigate the posts from that user and mass-delete them along with the user.

[Gez]

Just like for the wiki, I'd recommend using a phpBB extension that queries the StopForumSpam database before allowing an account to be successfully registered.

As an admin (but not FTP-level admin so I can't install anything myself, unfortunately) of a phpBB forum who has already deleted hundreds of spambot accounts, I always look up IP address, email address and username in the SFS database whenever a new account is registered. Only twice have I seen a blatant spammer that was not yet in that database. Twice on hundreds upon hundreds. So yeah, if you automatize the SFS lookup, you can turn spambots from a constant aggression into an anecdotal issue.

[SteveMB]

Bumped because the spambot problem is steadily increasing -- it is now common to have several bots a day dumping about two dozen spam posts each. IMO, the problem is growing past the point where manual deletion by the admins can keep in in check, and calls for some additional automated lines of defense (perhaps something like a throttle-timer between the first N posts on a new account) to at least limit the accumulation between moderator check-ins.

EDIT: In the slightly more than half a day since I posted this, we've had two more large spamdumps....

[BLANDCorporatio]

Bumped because the spambot problem is steadily increasing -- it is now common to have several bots a day dumping about two dozen spam posts each. IMO, the problem is growing past the point where manual deletion by the admins can keep in in check

It has been suggested that spaminators be appointed. Ie, more mods, more coverage. If you can find some volunteers for the job, you'd reduce time between moderator check-ins.

and calls for some additional automated lines of defense (perhaps something like a throttle-timer between the first N posts on a new account) to at least limit the accumulation between moderator check-ins.

Indeed, the forum captchas are becoming so cunning that only bots can read them now. KittyAuth has been suggested as an alternative.

But what I'd like to point out is that a throttle-timer between posts on a new account has a disadvantage: it makes the spammer post less (*face-palm*, BLAND, duh are you stupid?)

No hear me out. If I see the same name splattered accross all forums as the most recent poster, I instantly know- spammer. I click on the user, apply banhammer, all those posts are gone. I don't need to remove each and every, individually. Whereas, if I were to limit posting to something like once per day (which would be an annoyance to legitimate new users) I'd have to go through each forum, and see who there looks new. I do that sometimes (which is how I ended up reporting a lot of spammers), but it's more of a chore. The thing is, the very fact that makes the spammer annoying- visibility- is what makes them easy to ban.

EDIT:

Anyways, since we are floating ideas on site improvement with regard to spam management, anyone else care to look at this thread?

[SteveMB]

No hear me out. If I see the same name splattered accross all forums as the most recent poster, I instantly know- spammer. I click on the user, apply banhammer, all those posts are gone. I don't need to remove each and every, individually.

Huh? Banning the spambot doesn't seem to do anything to the posts. Does it take a while to kick in?

[BLANDCorporatio]

Really? Well if that were the case then things should change, so as to allow banning to result in post removal.

I know banning did not automatically have post removal as a consequence. One of PlotArmour's avatars kept trolling the "Duel in the Somme" thread, and eventually got banned, but the posts remained. For a while, anyway. I guess a mod might have gone through and deleted each and every by hand, but that's just not smart. There should be, if there isn't already, an option to ban and remove all posts in one go.

[SteveMB]

I know banning did not automatically have post removal as a consequence. One of PlotArmour's avatars kept trolling the "Duel in the Somme" thread, and eventually got banned, but the posts remained. For a while, anyway. I guess a mod might have gone through and deleted each and every by hand, but that's just not smart. There should be, if there isn't already, an option to ban and remove all posts in one go.

According to the response I got last time I raised the issue there is, but it appears to be accessible only with full admin access, not at mod-level access. I can delete posts by hand one by one (a three-step process: open each individual post, click delete, click confirm) -- but that gets to be too unwieldy when the site is getting hit with multiple bots a day dropping two dozen spam posts each.

[BLANDCorporatio]

Aah. I see.

In a way it makes sense- you don't want newbie mods to abuse their power and start removing posters that they don't like. But you've been a mod here for ages now, and I really think a mod-level "delete poster and all posts from poster" action would really be helpful. IF there's no thought of adding mods ever again, there's little need to deny mod-level the delete poster action. IF there are plans to add more mods in the future, is it then possible to establish a two level system, with trusted veterans that can delete posters and newbie recruits that can't?

[MarbitChow]

And all it takes is one "trusted veteran" who has an incredibly bad day to decide to target you, BLAND, and suddenly 2000+ posts are gone.

Giving nuke capabilities to anyone that Rob doesn't personally know and trust (and who has a financial stake in the success of the site) has a potential for catastrophic consequences that far outweigh it's benefits.

[BLANDCorporatio]

"Trusted veteran" is supposed to mean "trusted veteran mod". Which SteveMB is. Well, at least, I trust him not to delete all my 2000+ posts on a whim anyway. Right, SteveMB? Right?

...

[raphfrk]

On vbulletin there is a "soft-delete" option. This hides the posts from general view, but for admins/mods the post is replaced by a "view/manage post" link.

This allows mods to restore the posts. I don't know much about phbbb3 software, but is there something like that available?

Depending on willingness to manually modify the source, maybe you could add a "soft delete user's posts" option. That would hide all the users posts.

I had a look and this is the kind of thing I am thinking of. It was last updated Nov 2009, so I guess out of date.

[Sieggy]

This has been fun! I've actually been following after this Gammerasniffer and Sweety flagging their spam as fast as they've been posting them . . . there really needs to be a 'flag user as spammer' function so that the mods can yank all a spammers post with a single click.

[SteveMB]

I have just come back to find over a hundred spambot posts, with no way to delete them other than a multistep process for each one. A bunch of them are gone; I have decided that the remaining ones are less important than the pins-and-needles I'm getting in my mouse hand.

The problem has grown beyond the point where relying on manual deletion is a viable strategy; something else needs to be done.

[BLANDCorporatio]

manual deletion

post by post, is not a good strategy, and I've said my piece that I think one extra nuke-capable mod would alleviate matters.

Barring that (but why?), would some change in the authentication policy help? KittenAuth has been suggested (customized for Erfworld).

[SteveMB]

manual deletion

post by post, is not a good strategy, and I've said my piece that I think one extra nuke-capable mod would alleviate matters.

The board is not even properly designed to facilitate it (i.e. the "delete post" control is missing from the "view all posts by X user" page, doubling the time and work required as each post must be pulled up one by one).

[SteveMB]

Barring that (but why?), would some change in the authentication policy help? KittenAuth has been suggested (customized for Erfworld).

Also, isn't it possible to add a "prove you're a human before being allowed to post something with a link" feature? That's what the wiki used to block (some of) the spam.

[Balerion]

As I said on another thread in Erfworld things, I think the proper solution is to
1) get a strong captcha system in place, either kittyauth or something similar
2) force all currently registered users to go through the captcha when making their first post or login since its implementation
-This should be fairly easy; add a new column to the database in the user table, called something like validated and default it to false.
-Then, any user that is not validated is redirected to the captcha on login. Upon successful completion of the captcha, change validated to true. Also, i would add the feature that the report spam button (after say three reports) will return validated to false, hopefully stopping the tide of spam in progress, or at least closer to its arrival.

I think with both of those features, new spambots won't be able to sign up, and old ones will be blocked from posting, with basically 0 impact on users. It shouldn't be very complicated technically either.

Edit: I will admit, I have never worked with phpBB, but I can't imagine it would be hard to customize it to accomplish this.

[SteveMB]

As I said on another thread in Erfworld things, I think the proper solution is to
1) get a strong captcha system in place, either kittyauth or something similar
2) force all currently registered users to go through the captcha when making their first post or login since its implementation
-This should be fairly easy; add a new column to the database in the user table, called something like validated and default it to false.
-Then, any user that is not validated is redirected to the captcha on login. Upon successful completion of the captcha, change validated to true. Also, i would add the feature that the report spam button (after say three reports) will return validated to false, hopefully stopping the tide of spam in progress, or at least closer to its arrival.

I think with both of those features, new spambots won't be able to sign up, and old ones will be blocked from posting, with basically 0 impact on users. It shouldn't be very complicated technically either.

Edit: I will admit, I have never worked with phpBB, but I can't imagine it would be hard to customize it to accomplish this.

There are less intrusive options, such as the Spam Hammer functions for selectively preventing new users from including certain spam-characteristic features (links, listed keywords, non-English characters) in their posts.

Relying on manual deletion one post at a time is simply not a viable option -- I just banned several more spambots this morning, and don't know when I'll have time to go through dozens of posts one at a time.

[Sieggy]

Since spammers annoy me down to the soles of my feet, I tend to shoot through the forum at least once a day flagging the spam for you. However, the system REALLY needs some kind of filter to keep out the 'bots. This is one of my favorite sites, so I really don't mind picking up the trash, but it would be better to keep the trash out to begin with.