Forums

Unfortunately no one can be told what FluxBB is - you have to see it for yourself.

You are not logged in.

Announcement

FluxBB 1.5.6 and 1.4.12 released

These releases fix a security issue - please update your forums! Download links: v1.5.6 | v1.4.12

#1 2013-03-09 19:36:31

Studio384
Developer
From: Belgium
Registered: 2012-04-11
Posts: 622
Website

FluxBB.org Anti Spam

Hello everyone,

You all know that out-of-the-box, FluxBB installations get a lot of problems with spambots. So I had the idea, why don't we build in the anti spam system that's used on this site? I mean: it works great. What's the reason this isn't part of FluxBB?

-- Studio384


FluxBB Community Benelux - ModernBB 3.1
Profile Plus: A new FluxBB profile interface

Offline

#2 2013-03-09 20:25:44

Reines
Lead developer
From: Scotland
Registered: 2008-05-11
Posts: 3,194
Website

Re: FluxBB.org Anti Spam

The honeypot primarily works well because it differs from the default setup, for someone to get past it they need to either be smart enough to handle honeypots, or target fluxbb.org directly. If it was built in, then a target at fluxbb in general would be enough.

The second thing we use is StopForumSpam, and the argument against that is building in reliance on a 3rd party service.

Don't take this as a "no", just a, "this is why we haven't already". Well, also combined with lack of time.

Offline

#3 2013-03-09 21:09:55

adaur
Developer
From: France
Registered: 2010-01-07
Posts: 676
Website

Re: FluxBB.org Anti Spam

What about a very light protection, such as an "username" field hidden via CSS ?


Please excuse my bad english, I'm french tongue.

Offline

#4 2013-03-09 21:32:31

Studio384
Developer
From: Belgium
Registered: 2012-04-11
Posts: 622
Website

Re: FluxBB.org Anti Spam

adaur wrote:

What about a very light protection, such as an "username" field hidden via CSS ?

Like Reinez says, it will work the first couple weeks, but spambots will change and know it is there. But still, we should do something against spambots, even if it is done with a third party service.


FluxBB Community Benelux - ModernBB 3.1
Profile Plus: A new FluxBB profile interface

Offline

#5 2013-03-10 03:51:24

quy
Developer
From: California
Registered: 2008-05-09
Posts: 843

Re: FluxBB.org Anti Spam

Following are changes in XRumer relating to FluxBB and other changes to consider in coming up with an antispam solution:
+ FluxBB (footprint "Powered by FluxBB")
+ Added a new database: LinksList FluxBB.txt
+ Fixed incorrect processing of HTML-content, which contains tabs in HTML code (as example: forums FluxBB)

+ Mechanism of login/password extraction from email activation links was improved
+ Added an universal recognition algorithm of arithmetical text captcha
+ Auto filling of unknown and random fields in the registration forms was improved
+ Algorithm of checking of checkbox “I agree with rules” was improved
+ Improved work with field types “radio” and “select”

Will it be a futile effort? XRumer will counter/patch with whatever we come up with.

For me, I plan to make minor tweaks to make my board be different from the default install:
* Change "Powered by FluxBB" to "Forum software by FluxBB"
* Change register.php to join.php
* Assign a random string to form_sent and check its value in register.php (join.php) and login.php (<input type="hidden" name="form_sent" value="1" />)
* Reword the activate_email.tpl

Maybe we can do an official StopForumSpam mod in the core, but disabled by default. As an added bonus, we will be listed here to get exposure to FluxBB:
http://www.stopforumspam.com/contributions

Offline

#6 2013-03-10 11:51:51

Franz
Lead developer
From: Germany
Registered: 2008-05-13
Posts: 5,612
Website

Re: FluxBB.org Anti Spam

The problems with "official solutions" have been mentioned. What makes them work is that they are custom solutions, combined based on people's preferences.

If we were to create easy-to-install mods for the measures you guys described and kept them up-to-date, that would be cool, I think.

Why is this discussion not public, by the way?


fluxbb.de | develoPHP

"As code is more often read than written it's really important to write clean code."

Offline

#7 2013-03-10 12:24:19

Studio384
Developer
From: Belgium
Registered: 2012-04-11
Posts: 622
Website

Re: FluxBB.org Anti Spam

Actualy, I've no idea. I think because others arent verry objective about this website's protection. You can move it if you which.

However, can I use the code that's used by FluxBB.org to create a plugin (that's easy to install, I was thinking about a system I'm already using with FluxSmile an Jojaba uses with EZBBC)?


FluxBB Community Benelux - ModernBB 3.1
Profile Plus: A new FluxBB profile interface

Offline

#8 2013-03-10 12:42:52

Franz
Lead developer
From: Germany
Registered: 2008-05-13
Posts: 5,612
Website

Re: FluxBB.org Anti Spam

Okay, moved.

I think it would be very cool indeed if you could create a mod for one of these solutions (just note that there's SpamBarrier already - maybe you can collaborate). Making it compatible with one of the mod installers is probably also a good idea.


fluxbb.de | develoPHP

"As code is more often read than written it's really important to write clean code."

Offline

#9 2013-03-14 20:58:25

sklerder
Member
From: Brittany
Registered: 2012-11-06
Posts: 116
Website

Re: FluxBB.org Anti Spam

Hi all.

Yes, "HoneyPot + StopForumSpam" (from Koos) and "SpamBarrier" (enhanced version of "HoneyPot + StopForumSpam", including check of DNSBL) do the work already.

"SpamBarrier" is already compatible with Daris' "Patcher" (shouldn't be a lot of work to make it compatible with "Mod Installer"), and lets way to enhancement(s).

In order to be less standard, in "SpamBarrier", I added a parameter to assign a customized name to the new field, thus aiming to have differents versions of the mod. This name can be modified at every moment with the admin plugin. 

Another way of improvment would be to make various versions, changing the modified field name (new field for password, for e-mail, ...).

Another idea I had was to generate a challenge (by JavaScript ?) on reading of the rules page, that should be submitted while submitting the registration form.

But, as Franz, I think it really wouldn't be a good idea to make one of them a "standard" hmm

IMHO, it would be a better idea to have multiple mods to install out of the standard FluxBB, with fields to be customized at installation time (and why not once every week/month/year).

Last edited by sklerder (2013-03-14 21:00:03)

Offline

#10 2013-04-01 03:25:23

sopato
New member
From: GuangZhou , China
Registered: 2013-04-01
Posts: 3

Re: FluxBB.org Anti Spam

How about plugin reCAPTCHA and other public solutions ?


It's up to you .  blog.thislinux.com

Offline

#11 2013-04-01 07:04:28

Trace
Member
From: Poland
Registered: 2012-06-21
Posts: 154
Website

Re: FluxBB.org Anti Spam

reCaptcha sometimes fails and IMO is really really hard to read it.
I am in favor of Q&A Captcha.


My FluxBB 1.5.3 styles:
DarkAce | Sadness

Offline

#12 2013-07-03 08:54:31

Askelon
Developer
From: Bretagne − France
Registered: 2010-06-09
Posts: 158
Website

Re: FluxBB.org Anti Spam

Hi,

I saw this topic lately so maybe this won't be of any use here, but still, I think this should be mentioned somewhere. My own forum and some others I participate to had lots of problems due to spambots, pretty much every antispam trick get bypassed one way or another… We came up with a nice way to block spambots that proved 100% efficient on my board at least, and I think on others to.

1/ Add a paragraph to the forum rules, telling new registering users they will be asked to add some magic word before their email in the registration form, in my forum I use the forum's nickname, "oeag".
2/ Add an explanation in the registration form label for email, stating that user shall find a magic word to add before their mail address in the first mail input.
3/ When checking the email address in registration process, check that the first email address contains the magic word. If magic word, register, if not, remind it: most likely the user just didn't read the rules nor the registration label and missed the magic word.

Done. I've been using this for almost a couple years now, never seen a single bot registration. All they get is an invalid email error. I sometimes have users stating they had trouble registering, meaning they actually rushed through the registration process without reading anything and got themselves an error, asking them to use the magic word, but this is more pebkac than antispam issue smile

Some screens to illustrate:

1372841769.png

1372841777.png

1372841782.png


I use a magic word that is set directly in the code; that's cheap work but since I spent hours on this forum every day I didn't see the point in adding code to the admin section as I can access the sources pretty much every time I want to. An improvement would be to set randomly on the install and edited by admins in the options, changed periodically, there's a lot of possible adaptations.

Now I don't know if this match the philosophy of FluxBB, but that's the simpler antispam I found, so I thought I would share it here wink

Last edited by Askelon (2013-07-03 08:59:24)

Offline

#13 2013-07-31 05:12:13

RobinKiwi
Member
Registered: 2013-07-13
Posts: 5

Re: FluxBB.org Anti Spam

I am already getting meaningless spam on a BB set up only 3 weeks ago. Is it possible for me as admin to register only those people who email me personally? I can let them know my email address as the BB is meant for local folk only. (I'm a rank beginner so please try not to bewilder me!)

Offline

#14 2013-07-31 07:09:45

sklerder
Member
From: Brittany
Registered: 2012-11-06
Posts: 116
Website

Re: FluxBB.org Anti Spam

Hi.

Yes, of course you could proceed by this method.
On a forum on which you have not much registering (like 2 or 3 every day), it is, in term of time of work, feasable.
On a bigger forum, it could become a lot of work.

On the other hand, you could give a try to a HoneyPot method like "SpamBarrier" or "Honeypot + StopForumSpam", but they are rather long to install ...

Offline

#15 2013-07-31 18:38:00

LakeXeno
Member
From: La Crosse, WI, USA
Registered: 2013-07-05
Posts: 65
Website

Re: FluxBB.org Anti Spam

Setup at my site, I get maybe 3 spams a week. tongue

Easy-peasy once you figure out something to do.


The Dragon 13 Society Become a Dragon today and take your world back.

Offline

#16 2013-07-31 21:07:14

sklerder
Member
From: Brittany
Registered: 2012-11-06
Posts: 116
Website

Re: FluxBB.org Anti Spam

Hi.

If the ditto site is the one pointed by your profile's "website field", you seem to have some active spammers registered hmm
If I were you, I had banned them since the beginning ...
But maybe I miss a good reason to not ban them ?

Offline

#17 2013-07-31 21:07:56

RobinKiwi
Member
Registered: 2013-07-13
Posts: 5

Re: FluxBB.org Anti Spam

LakeXeno, thanks, I like your method but how do I go about copying it please??

Offline

#18 2013-07-31 23:56:58

Squiggles
Member
Registered: 2012-12-14
Posts: 246

Re: FluxBB.org Anti Spam

Definitely give Honeypot + StopForumSpam a try, since installing this mod my forum receives less than 2 successful spammer registrations a week. Its blocked over 50,000 attempts in just 8 months.

Offline

#19 2013-08-01 20:47:17

RobinKiwi
Member
Registered: 2013-07-13
Posts: 5

Re: FluxBB.org Anti Spam

I've now selected "Verify Registrations" which I hadn't noticed before, and at least so far the spammers don't get to enter the user list or post messages. I'm aware however that they will be putting their details somewhere in my account, and eventually will choke the server or so I would think. How would I clean it out from time to time?? I'm just an everyday user and not an enthusiast for bulletin boards as many people here seem to be (and nothing wrong with that I agree!)

Last edited by RobinKiwi (2013-08-01 20:48:53)

Offline

#20 2013-08-02 06:55:46

sklerder
Member
From: Brittany
Registered: 2012-11-06
Posts: 116
Website

Re: FluxBB.org Anti Spam

HI.

Post #16 was firected to LakeXeno ...

@RobinKiwi : As Squiggles said, you could/should install "Honeypot + StopForumSpam" or "SpamBarrier" ...
Even if it is rather long to install, it will simplify the work later smile

Last edited by sklerder (2013-08-02 06:56:02)

Offline

Board footer

Powered by FluxBB 1.5.6