It all depends if we're trying to solve the worlds forum spam problem or not.  We need a quick fix for now, restricting new users might or not work.  In my experience it's pretty easy to spot a spam bot's first post.  It just doesn't make any sense, so you can spot them and keep the restrictions in place.

 

Longer term it's not really viable and IPS's spam filtering needs to identify this scripts signature and/or close the exploit.  The days of forum admins manually controlling spam are no gone, thankfully.

A few more updates to this issue:

 

#1: We have applied limits to forum search and posting.  Users must now wait 30 seconds between created new posts and 10 seconds between searches.  Unfortunately we have noticed a lot of bots indexing the forum using search and eating up a lot of system resources.  These limits should curtail some of that.

 

#2: We have implemented a secondary spam protection service.  Now we have TWO systems in place to try and thwart would-be spammers.

 

Lastly, I just want to say thanks to our moderators this week for helping stomp out these spammers for us.  Automated anti-spam protection is very important, but there is no anti-spam system that can systematically prevent all forum spam.  Some folks are very creative in working around the anti-spam systems and when that happens, we rely on our mods to help combat the issue in real-time.  We think they've done an amazing job and for that, we thank you all.

I should add that we are also investigating setting post limits on new members, but we haven't done that just yet.  We really want to be careful about maintaining a balance between good anti-spam measures while not being too restrictive on those who legitimately want to post in here.

Honestly as long as everybody continues to report when they can it really helps out so we can take action. Obviously we can't all be online all the time or schedule who can cover what at, but with member help it really does go along way in combating this issue. 

On 9.1.2018 at 5:53 PM, jonp said:

I should add that we are also investigating setting post limits on new members, but we haven't done that just yet.  We really want to be careful about maintaining a balance between good anti-spam measures while not being too restrictive on those who legitimately want to post in here.

 

@jonp

It's time you either implement those new members posting limits, or maybe have some moderators in the European region to clean up when you guys are sleeping.

I'm almost at the point where I just log out when I see the first page of unread posts are spam. 

On 13/01/2018 at 10:44 AM, saarg said:

 

@jonp

It's time you either implement those new members posting limits, or maybe have some moderators in the European region to clean up when you guys are sleeping.

I'm almost at the point where I just log out when I see the first page of unread posts are spam. 

+1

 

This is getting really old...

Is there any way to have 2 tiers of initial users?

 

I'm thinking of a non-published sign up that exists inside the unraid GUI, so people running unraid can sign up and post immediately, but people who access the web site normally get a trial single post per day account until moderator approved.

I've whacked at least a dozen in last day. Still seem to be posting messages several a minute. Is there something additional happening to shut this down?

It certainly got less since the time-based post limit is in place, but there are still many different users coming through.

Maybe a character limit for the first post can help blocking those posts.

Those posts were often very lenghty - just an idea...

What about a mandatory "introduction" post in a dedicated (sub)forum before full posting rights are given?

Dunno how technically feasible that is, but I really want to see the last of Baba-ji......

Sent from my LG-H815 using Tapatalk

@jonp

I'm going to ping you until you answer... You need to do something about the spam, not only say you monitor it closely, as it's obvious you don't.

Maybe I should ping you for each spam post made 

There are some internal discussion happening about how to address this. Obviously spam protection isn't yet adequate enough, but it does have the attention of jonp.

 

It doesn't take long to keep us informed. For now I would say it's better to close down on rights for new users and then figure out what is optimal later.

I'm on -5GMT and willing to commit to daily scrubbing, around 10/11GMT, if you go that route

2 hours ago, bonienl said:

There are some internal discussion happening about how to address this. Obviously spam protection isn't yet adequate enough, but it does have the attention of jonp.

 

There is money in spam, so they have the best code for processing Captcha etc. Lots of spam engines solves Captcha I fail to solve, because computers have better color vision than humans.

Just add better spam protection.

 

E.g.

 

-Add a question like "Whats the best storage solution" -> unraid

-Better captcha

 

-easy would be to change the form, so they cant register. Even smal changes from standard register form prevent them 99%.

 

Never ever do prevent new users from posting, this is a complete no go, if i wouldnt be able to post here when i was new, youll never see me again... 

Edited January 20, 20188 yr by nuhll

Just add better spam protection.
 
E.g.
 
-Add a question like "Whats the best storage solution" -> unraid
-Better captcha
 
-easy would be to change the form, so they cant register. Even smal changes from standard register form prevent them 99%.
 
Never ever do prevent new users from posting, this is a complete no go, if i wouldnt be able to post here when i was new, youll never see me again... 

I suspect@jonp has thought about spam protection and even considered the use of a simple question.

Sent from my LG-H815 using Tapatalk

1 hour ago, nuhll said:

Add a question like "Whats the best storage solution" -> unraid

That's how the old forum was set up.  Problem with that is that it's language specific, and many people complained that they would have to google the results.  And I recall myself having to google an answer for that kind of challenge.  Annoying and a put-off

 

Additionally, Tom has stated that this current batch of spammers are creating a user manually (ie: a person is doing it), and then the bot goes to work.

Yeah, but it would be easy to fast implement it. I would not suggesting it, bc everything what makes it harder for humans, is a fail point and annoying. Best is probably recaptcha, while it can be beaten, not automaticly (solving it cost money). And for humans its not that annyoing. Bc sometimes you might get pictures.

Edited January 20, 20188 yr by nuhll

5 hours ago, nuhll said:

Yeah, but it would be easy to fast implement it. I would not suggesting it, bc everything what makes it harder for humans, is a fail point and annoying. Best is probably recaptcha, while it can be beaten, not automaticly (solving it cost money). And for humans its not that annyoing. Bc sometimes you might get pictures.

 

We've had recaptcha on this forum since we migrated to it.  We even upgraded to recaptcha v2.  Now we are considering implementing keyCAPTCHA as IPS is recommending it, but I'm not 100% sold on that idea just yet.

 

We are still looking into more solutions for anti-spam.  As much as we all want this to be a quick and easy fix, it might not be...

Are you sure they are actually filling out recaptcha? Doin recaptcha is very expensive. Not that they just bypass it someway?

 

Best way is change the forms used for registration, so only ppl who directly want to harm will hit you.

Edited January 21, 20188 yr by nuhll

 

[mention=62528]jonp[/mention]

It's time you either implement those new members posting limits, or maybe have some moderators in the European region to clean up when you guys are sleeping.

I'm almost at the point where I just log out when I see the first page of unread posts are spam. 

I'm doing the same ... first sign of a few spam posts indicate that either i persist in trying to read or i'm going to waste an awful lot of my time so i log out. I'm UK based and certainly think more 'spam' mod abiluties are needed before this forum begins to suffer badly. There are more than 3hrs of spam posts this morning.

 

Sent from my LG-D855 using Tapatalk

 

 

 

I'm on -5GMT and willing to commit to daily scrubbing, around 10/11GMT, if you go that route

Ditto .. uk based +0:00 gmt

Sent from my LG-D855 using Tapatalk

There are lots of EU-based visitors. So it should be easy to find a couple of people who can help clearing spam.

 

But in the long run, this forum needs a not-so-mainstream solution. The spam robots tends to quickly learn the new mechanics of the more common Captcha and query-based solutions.

As a short-term fix, please put something in like first post needs approving - just logged on and it's the worst it's ever been