Bot activity?

MattF · 2009-05-01 15:31:22

Just wondered if anyone had noticed an increase in bot attempts at registration over the last week or so? I keep seeing requests for register.php on the webroot, (which has never had an active registration file there, if I remember correctly). Just trying to figure out whether there may be a screwed link on some website out there somewhere or whether it's just some thick bots having a run at registering.

Gil · 2009-05-01 22:07:51

MattF wrote:

Just wondered if anyone had noticed an increase in bot attempts at registration over the last week or so? I keep seeing requests for register.php on the webroot, (which has never had an active registration file there, if I remember correctly). Just trying to figure out whether there may be a screwed link on some website out there somewhere or whether it's just some thick bots having a run at registering.

As usual. Some russian registration each day, at this time. But we we were forced to definitively ban all gmail.com adresses.

I still say that fluxBB can not be used ("in a real world") as it is delivered, and that is sad

FSX · 2009-05-01 22:47:42

I've got my board running for a while now (a month or 2) and no bots have registered yet. Only a few in the beginning. Guest posting is enabled and Akismet is enabled.

MattF · 2009-05-02 11:30:13

None of them have actually registered. The fact they're trying to access a nonexistent file won't help their cause. There just seemed to be far more attempts than usual over this last week. Looks like they've been having a splurge.

I did go through the logs later on yesterday and check some of the I.P's against the spam DB's. It would appear that they are bots.

MattF · 2009-05-02 11:31:48

Gil wrote:

As usual. Some russian registration each day, at this time. But we we were forced to definitively ban all gmail.com adresses.

I still say that fluxBB can not be used ("in a real world") as it is delivered, and that is sad

Do you run any extra registration checks on your board, or is it still just a plain register file?

Last edited by MattF (2009-05-02 11:32:00)

Gil · 2009-05-02 12:01:42

FSX wrote:

Guest posting is enabled

I know where this option is...

... and Akismet is enabled.

But I don't know where this option is

I don't say that there is no solution, I just say that FluxBB can not be used "as it is delivered" (in a real world, of course).
Such an add-on should be (if not in the core), installable with only one click...

FSX · 2009-05-02 12:16:15

I shouldn't have said that my board was spam free... Luckily Akismet cought all of it.

There is an Akismet mod on Punres. You have to change some code to get it working properly, but after that it does really work.

Gil · 2009-05-02 12:18:26

MattF wrote:

Gil wrote:
As usual. Some russian registration each day, at this time. But we we were forced to definitively ban all gmail.com adresses.

I still say that fluxBB can not be used ("in a real world") as it is delivered, and that is sad
Do you run any extra registration checks on your board, or is it still just a plain register file?

Only "Verify registrations" option selected. No sure that it is useful nowadays!

Gil · 2009-05-02 12:24:46

FSX wrote:

I shouldn't have said that my board was spam free... Luckily Akismet cought all of it.
There is an Akismet mod on Punres. You have to change some code to get it working properly, but after that it does really work.

So, a fluxBB team member is currently saying me something like "Our software is not totally working as is it, but if you change the source code, it is OK" Don't you think it is a little bit strange?

FSX · 2009-05-02 12:29:15

Akismet is a mod made by someone on Punres.org who hasn't anything to do with FluxBB.

MattF · 2009-05-02 12:52:28

Gil wrote:

So, a fluxBB team member is currently saying me something like "Our software is not totally working as is it, but if you change the source code, it is OK" Don't you think it is a little bit strange?

'Not totally working' is completely wrong and out of context. It's not strange, either. Mods are there so that the site owners may decide what best suits their needs. For one, I personally would detest the thought of something like Akismet being a default inclusion, the same as you obviously think external options should be an inclusion. Different strokes and all that.

Last edited by MattF (2009-05-02 12:53:11)

Smartys · 2009-05-02 14:07:06

Gil: Spam prevention is a very complex issue and your post trivializes that to the point of trolling (I'm not saying that was your intent, only how your post sounds to me).

As I have said many times before, there is no magic bullet for spam prevention. Not only are there multiple techniques that can be effective, but there is also the fact that certain techniques may be entirely unsuitable for certain use cases (eg: CAPTCHAs on a forum for the blind, Akismet on a forum where people post one-liners, any protection at all when running the forum over an internal network, etc).
It is also a game of cat and mouse: if FluxBB were to add certain anti-spam features, the next version of whatever spamming software is being used would bypass it. Rather than mandate a certain technique (and require certain site owners to "rip out" the feature if it doesn't suit them), FluxBB allows the site owners to choose which techniques are appropriate for their forums. There are pros and cons to this approach, one major con being that people complain about FluxBB not having super magical, 100% working spam protection out of the box.

Now, if you have constructive criticism (eg: how about FluxBB adds some basic support for a blacklist of terms which can't be used: like the censor but active instead of passive), that's fine. But please don't claim the software doesn't work because you get spam. This isn't spam blocking software, it's forum software.

Gil · 2009-05-02 16:43:10

Mattf: "Not totally working, as it is, in the real world" is wrong? No, it's totally true as I cannot use it, when guest authorised to post or without registering option by mail. And even without guest and with mail, spam registering exists. It just becomes more acceptable. At least, you should admit this, even if you have your reasons to exclude all spam tools of the core.
I don't think that all extensions must be included, "because I think it must be". You can use FluxxBB without PM, without join, without a lot of functions offered by others forum software; it's different. Spam fighting is not "extensions" among others extension. You cannot say that.

Smartys: Troll? No. And I don't say that you must add a solution like Askimet in the core (excepted if all FluxBB team members are using it...) but that at least the possibility to add easily Askimet (amonf some solution) during installation of after should be included. This is different.
Complex? Of course. But if there is no perfect solution, maybe to choose the best or the best ones is a good idea, no? Even if it is not perfect, even if a better solution will be found in some months or year. Don't you want that FluxBB is used, more and more? I don't think you want to exclude some people category, but with such an attitude, the exclusion occurs. Some persons are testing FLuxBB then abandon it to use another one. It is sad.

If you think that spam fighting is an extension exactly like another one, I think

Smartys · 2009-05-02 16:53:06

Gil: What we have here is a fundamental difference of opinion.

The premise of your argument is that FluxBB should add whatever spam fighting tools are necessary to counter the spammers and that the tools should be added to, removed, or tweaked as necessary as the spammers evolve. The premise of the argument I'm making is that mandating certain anti-spam features makes FluxBB inappropriate for certain uses and that we should encourage a heterogeneous environment (in terms of spam prevention tools) rather than a monolithic one.

Both arguments have pros and cons. Your argument has the pro that spam can be dealt with easily out of the box. The con is that many anti-spam tools (eg: Akismet, reCAPTCHA) require some setup and that a constantly shifting set of anti-spam tools in the core would frustrate administrators as well as users. My argument has exactly the opposite set of pros and cons: although FluxBB does not have anti-spam tools (other than basic posting controls and email verification) out of the box, it does allow the administrator to choose to set up only what they feel works best for their community.

Now, I did suggest somewhat of a compromise in my previous post. A blacklist is a fairly standard, basic, reactive kind of anti-spam measure. It happens to complement the current censoring system very well. I notice you didn't comment on it. Do you feel that such a system would be insufficient?

MattF · 2009-05-02 17:07:38

Smartys wrote:

A blacklist is a fairly standard, basic, reactive kind of anti-spam measure. It happens to complement the current censoring system very well. I notice you didn't comment on it. Do you feel that such a system would be insufficient?

Would a blacklist system be feasible though? That would, I assume, suffer the same type of drawbacks the likes of which were apparent in e-mail content filtering. You'd end up with complex regex'es and the spammers would merely adapt to bypass the latest incarnations. Plus, different boards will have different levels regarding what they class as normal. One would constantly be aiming at a moving goalpost using a blacklist.

MattF · 2009-05-02 17:09:56

Gil wrote:

Mattf: "Not totally working, as it is, in the real world" is wrong? No, it's totally true as I cannot use it, when guest authorised to post or without registering option by mail.

You can use the BB software perfectly well. The fact that spammers can target it with a certain amount of ease in its basic form is a totally separate subject.

Smartys · 2009-05-02 17:11:51

I didn't mean FluxBB would provide a blacklist. I meant the censoring tools currently in place would be extended. So, for instance, you would have a checkbox that determines whether the word is checked at submission time (in which case it's rejected) or at viewing time (which would be the current behavior). Then, a forum can blacklist websites that spam them so the spammers can't make the posts in the first place.

Is it a perfect solution? No. Does it fit well within the current feature set? Yes. Does it provide some benefit? Yes. Is it needlessly complex and hard to turn off if you want to use better systems? No.
I don't really see a downside to adding blacklist functionality to the current censor system.

MattF · 2009-05-02 17:14:15

Smartys wrote:

I didn't mean FluxBB would provide a blacklist. I meant the censoring tools currently in place would be extended. So, for instance, you would have a checkbox that determines whether the word is checked at submission time (in which case it's rejected) or at viewing time (which would be the current behavior). Then, a forum can blacklist websites that spam them so the spammers can't make the posts in the first place.

Right. I get it now. I'd missed the point a tad there. That does sound like a good idea, btw.

Last edited by MattF (2009-05-02 17:15:07)

hcgtv · 2009-05-02 17:28:28

Oh, a spam thread!

From my personal experience, Akismet works great to keep out the spammers. Though I wish that the plugin was brought over from Punres, updated and placed in a prominent place on a Spam Fighting Wiki page.

The other situation are bot signups. From what I can see, many forums don't really care if 80% of their members are bots that signed up and never verified the email sent to them. More members means a more popular board, but when you look at their member names, you can immediately see that they are mostly bots.

Yes, opinions vary as to what to do, evidenced in this thread. But sitting back and saying that one day we'll get to it is in my opinion not the best approach. It's better to direct new users to available methods, than have them hunt and peck around for a solution.

Smartys · 2009-05-02 17:29:17

hcgtv wrote:

Yes, opinions vary as to what to do, evidenced in this thread. But sitting back and saying that one day we'll get to it is in my opinion not the best approach. It's better to direct new users to available methods, than have them hunt and peck around for a solution.

100% agree. Spam fighting solutions should be made much more prominent than they are now.

Gil · 2009-05-09 08:45:52

MattF wrote:

Gil wrote:
Mattf: "Not totally working, as it is, in the real world" is wrong? No, it's totally true as I cannot use it, when guest authorised to post or without registering option by mail.
You can use the BB software perfectly well. The fact that spammers can target it with a certain amount of ease in its basic form is a totally separate subject.

Imho, "To work" is not only "to be well coded, without software bugs". "To work" is "to be usable in the target environment" first.

Even if FluxBB team is thinking that spam solutions is totally outside the forum software scope, spam problems using FluxBB in the real world should not be outside scope of the team: why not to have a sticky post and an entry in the wiki, explaining possible solutions depending on the forum usage (guest posting or not) and the differents problems (post spam, bot registering...). I still think that the team is best placed to advise and guide about the subject , no?
It may be useful to avoid such http://fluxbb.org/forums/topic/2723/ton … -and-porn/ post.

I suppose that FluxBB target hearing is not only developers and geeks. So I cannot understand a short answer such as "there are a lot of spam extension in punres". Searching Askimet in wiki: nothing; in forum: only two answers. It is strange. Searching "spam" in wiki: nothing; in forum: a lot of question and answers, but no sticky subject, in announcements, blog or support forums. Strange again.

And no mistakes: I love FluxBB (and previously PunBB), I use it for 4 years and I gave money for it. I just would like it is even easier to use, more accessible to everybody.

Last edited by Gil (2009-05-14 22:09:43)

joe.banana · 2009-05-31 22:26:45

i dont get it.. how can bots? get around captcha and logical questions?

well i think implementing spam stoping feature like that will take of flux's spirit.. lightweight and simple. let stick with mods..

sirena · 2009-05-31 22:56:10

PunBB v1.3 has had an official anti-spam extension for a while now:

http://punbb.informer.com/extensions/

It was a positive development Flux might emulate.

It may not be the best, foolproof anti-spam solution etc etc but the availability of at least one standard or 'official'' anti-spam addon solves the problems Gil and other users face in having to trawl these forums and punres for something that works once they need a solution...

FSX · 2009-06-01 06:46:14

I'm planning to make/update some mods and old mods for 1.4 like Akismet.

hcgtv · 2009-08-31 15:20:36

FSX wrote:

I'm planning to make/update some mods and old mods for 1.4 like Akismet.

Oh, how I hate bots!

Yesterday, I had 113 signups on one of my forums, this kind of activity has been the norm for some time now. I was going to apply one of your mods but I'm going to wait to see what you have to offer for 1.4.

Forums

#1 2009-05-01 15:31:22

Bot activity?

#2 2009-05-01 22:07:51

Re: Bot activity?

#3 2009-05-01 22:47:42

Re: Bot activity?

#4 2009-05-02 11:30:13

Re: Bot activity?

#5 2009-05-02 11:31:48

Re: Bot activity?

#6 2009-05-02 12:01:42

Re: Bot activity?

#7 2009-05-02 12:16:15

Re: Bot activity?

#8 2009-05-02 12:18:26

Re: Bot activity?

#9 2009-05-02 12:24:46

Re: Bot activity?

#10 2009-05-02 12:29:15

Re: Bot activity?

#11 2009-05-02 12:52:28

Re: Bot activity?

#12 2009-05-02 14:07:06

Re: Bot activity?

#13 2009-05-02 16:43:10

Re: Bot activity?

#14 2009-05-02 16:53:06

Re: Bot activity?

#15 2009-05-02 17:07:38

Re: Bot activity?

#16 2009-05-02 17:09:56

Re: Bot activity?

#17 2009-05-02 17:11:51

Re: Bot activity?

#18 2009-05-02 17:14:15

Re: Bot activity?

#19 2009-05-02 17:28:28

Re: Bot activity?

#20 2009-05-02 17:29:17

Re: Bot activity?

#21 2009-05-09 08:45:52

Re: Bot activity?

#22 2009-05-31 22:26:45

Re: Bot activity?

#23 2009-05-31 22:56:10

Re: Bot activity?

#24 2009-06-01 06:46:14

Re: Bot activity?

#25 2009-08-31 15:20:36

Re: Bot activity?

Board footer