Sorry - no more anonymous posting - spammers destroyed that

[Husse]

Subject says it all
We got so much spam posted by "Guests" = Anonymous that we had to stop this possibility

[Fred]

Husse,

Is there any way you could combine that with a password that changes with each log-in. For example; make a small table of questions and answers and let the user add the answer to the randomly selected question to their password. Allow only three attempts and then lock the account for a specified length of time.

Let's say the user's password is "MintMan". The log-in screen would contain the randomly selected question., ie. "14 plus two equals what in base ten numbers?" The user would enter "MintMan16" in the password field. S/he would get three tries before a time lock of say 15 min.

Of course there is an old saying that applies here. "Anything one man can do, another can undo."

Fred

[Husse]

We have an even nicer "thingy" in the wiki - "What is the sum of 10 + 11" (numbers of course random) - not a spam post since that was introduced
Unfortunately we are limited to what phpBB has to offer and that is a CAPTCHA that is utterly cracked
I will spend some time in the phpBB forum if there's less spam - it has taken me around 3/4 hour daily lately to clean the spam dirt
I could enable a "black hole" check but I fear that it would make the forum slow and not help much as the spam comes form hijacked computers - varying IP

[Fred]

Husse,

Yes, I would urge you not to ban/block IPs. Not only will it not stop spam, it might even increase spam, but it will deny actual users too. IP ban/block set-ups are a nightmare to try to keep up with. The IP ban/blocks attract too much attention from the wrong quarters. Pushed to extremes, you could even talk yourself into DOS attacks. I went down that road one time and it isn't a trip you want to bother with.

Fred

[atlef]

Good to hear, never got the point of guest posting, seemed like a lot of extra work for admins and moderators.

atlef.

[Husse]

@ Fred
I never considered using blacklists - the risk of blacklisting a legit user is way too high

[merlwiz79]

Some people where waiting to get a registration emails.
I think some never got them and just keep using guest.
This sucks for people who couldn't get registered, but the spam was crazy.
Also what's with the url now being forums.linuxmint.com instead of linuxmint.com/forum

[Husse]

Also what's with the url now being forums.linuxmint.com instead of linuxmint.com/forum

It's the new server for the forum
If you encounter people with no activation email ask the to try again
I think all the 500 errors in the old server may have "swallowed up" some activation requests

[GrayWizardLinux]

I appreciate all of the heard work you are doing. Wish i had some helpful answers...

[rivenought]

I know that with Husse's adjustments to the posting situation and Clem's decision to move the forum server over to Canada, this forum has a muchly improved user experience. No more spam and no more server errors. I have my fingers crossed. So far, so good.

[exploder]

rivenought, has summed things up well. It's great to see the spam gone and so far no more server errors! Nice work!

[Fred]

So far so good on my end too.

Fred

[kanishka]

The forums are noticeably faster now. Nice move!

[stevefed5291]

ya forums definitly are faster, which is great for people (like me) who still have crap-ass dsl. Just want to add that I support any measures taken to reduce spam. Spammers are the most uncivilized people on the planet...

[Sorensei]

Yep, faster from my end too - I also support the anti-spam measure. Sorry it had to come to that, though.

[serola]

@ Husse - I'm moderating phpBB forum for Easy Peasy Linux OS and we have a huge problem with forum spams. Could you please share some ideas what can be done and what should not be done. For example, I noticed Fred said it's not a good idea to ban IPs. Any other suggestions?

Are you using some of these:
- Flood control to force users wait before they can post again.
- Limit the number of posts per day.
- Akismet or any other filtering service.

Have you considered:
- Not to allow signatures.
- Not to allow Web sites on profile.
- Using captcha for posts and comments as well.

[Husse]

The main reason is that the captcha is broken and Clem feels that phpBB has so many problems in itself that he does not want to add some mods - there are some nice mods if you dare install them.
We use flood control but I don't like the rest of your suggestions (like Limit the number of posts per day - on a busy day I can post up to 80 posts, so I'd be spam trapped )
We are of the opinion that once logged in you are logged and if the spammer bypassed the captcha to get registered they can surely bypass another captcha
Akismet would be an idea but honestly I don't know how to implement it
We don't get spam now (the odd post perhaps) and partly this is because I go through all new inactive users and delete those that are clearly spambots - anything with p orn or v iagra or buy
They seem to register and wait a while before posting
If we get lots of this crap again we have to seriously reconsider but for now no guest posting has done the trick for us

[serola]

We don't get spam now (the odd post perhaps) and partly this is because I go through all new inactive users and delete those that are clearly spambots - anything with p orn or v iagra or buy
They seem to register and wait a while before posting

Thank you very much Husse for quick reply Yes, I have noticed the same. Spammers seem to wait a day or two, after creating an account, and before they start posting spam. I try the same, aka I start to delete account that are clearly created by spammers. You say those spammers are spambots There's captcha used for registration at Easy Peasy forum ass well, but maybe it's not reliable if bots can register account and send spam. I thought they were "hard working, low paid humans" doing that.

[merlwiz79]

CAPTCHAs really don't work for spambots they can get right through it.
http://securitylabs.websense.com/conten ... /3306.aspx
http://www.itpro.co.uk/blogs/daveyw/200 ... 0-seconds/
http://arstechnica.com/security/news/20 ... -again.ars
http://www.cgisecurity.com/2009/02/bot- ... ptcha.html

[exploder]

The current solution fixes the spam problem! It does not take very much time or trouble to log on to post and it is a relief to see all of the spam gone! Thanks Husse for taking care of this problem!