1000 members

[Mike Richardson]

Sometime recently 68kMLA passed 1,000 registered members.

We are also close to 10,000 threads according to phpBB. We already passed the 10,000 thread according to database ID.

 

[LCGuy]

Congratulations ray11 on being our 1000th member

 

[John8520]

It's too bad most of those members never post. One has to wonder why they register in the first place...

 

[Mike Richardson]

It's too bad most of those members never post. One has to wonder why they register in the first place...

I wonder if maybe they are spam bot registrations, but something is preventing them from actually making the spam post. (I have seen a few spam posts before the mods delete them, I assume they also delete the fake member that the bot created).

 

[Dog Cow]

Congratulations ray11 on being our 1000th member

I reported his one and only post as spam. So, no congratulations from this user. xx(

 

[Mike Richardson]

Does the forum registration here not employ use of a CAPTCHA?

 

[Osgeld]

phpbb has really loose security and a captcha system a blind mand could break without a keyboard

i am a member of a phpbb forum for a game engine, it got so bad over there i had suggested adding a dumb question (ie whats 3+ 8) and it stopped 99% of them dead in their tracks

its a shame about phpbb, i like the software, but every time ive used it, its almost instantly flooded with bots, So I personally just dont bother with it anymore

 

[Dog Cow]

It does, but the captcha can be beaten using crafty image manipulation techniques and the use of OCR. The achilles' heel of captcha is that it must be possible to be read by humans, so it can't be overly dastardly. Thus, a programmer with enough time on his hands can develop algorithms to beat it.

 

[~tl]

Does the forum registration here not employ use of a CAPTCHA?

It does. But there are two types of forum spam – automated and human. The CAPTCHA should stop automated spam (i.e. a script automatically signing up accounts and posting spam). It's pretty ineffective here, since phpBB is so widely used and hence the CAPTCHA has been broken. The next version of phpBB (3.0.6) is going to add more CAPTCHA types, including reCAPTCHA and a full API, so it should be a lot easier to customise each forum's CAPTCHA which will improve security. We also have a couple of anti-spam questions added to the registration form (basic maths questions) which have pretty much eliminated the automatic registrations here, since they're unique questions that automatic scripts aren't expecting to be on the registration form.

CAPTCHAs cannot stop spam posted by humans though, which a high majority of forum spam is, since the CAPTCHAs are supposed to be easily solvable to a real person. I would guess this is a case of a human spammer and their account has been deleted, as per forum policies. We actually get these sort of posts fairly often, but they're usually deleted fairly quickly.

 

[Mike Richardson]

Most phpBB bots are pretty basic. Even if you have a bot that can beat the CAPTCHA, the bot will be confused if you make a simple modification to the sign up form.

On the actual sign up form you would put something like this:

Then in the PHP code that processes the form you have some simple code like this:

if($_POST['f23dfg56er2r'] != "2r3e6f3x2s30") {
  die("Go to hell");
}

The bots don't actually parse the sign up form as far as I can tell (perhaps except to get the CAPTCHA), they just attempt a registration using the pre-defined variable names which are expected.

EDIT: Of course this still does not stop human spammers.

Does the forum have e-mail verification? I suppose that's easily broken.

What about asking the person a question about Macs? Something simple that almost anyone interested in this forum would know, but something that a chinese kid getting 10¢/hr to spam forums wouldn't.

Q: A Power Macintosh 4400 contains what kind of CPU?

1. 68K (the chinese might see this in the name of the forum and pick this choice and fail)

2. PPC

3. SPARC

4. POWER4 (they might equate POWER Macintosh 4400 with this)

5. INTEL (maybe they know the latest Macs have Intel chips.)

If the user fails the question then they are directed to email blablabla@68kmla.org for moderator assistance.

 

[Dog Cow]

That suggestion you have about the input form has merit. In fact, you don't even need to put a value in it. Just leave it blank by default, and it if gets filled in, then abort the registration. A few months ago, I ran a honeypot board which had 5 hidden form fields. They were in a

tag marked as hidden, so the only way to see them was to view the page source code. Every bot which signed up filled out these hidden fields.

 

[Mike Richardson]

That suggestion you have about the input form has merit. In fact, you don't even need to put a value in it. Just leave it blank by default, and it if gets filled in, then abort the registration. A few months ago, I ran a honeypot board which had 5 hidden form fields. They were in a tag marked as hidden, so the only way to see them was to view the page source code. Every bot which signed up filled out these hidden fields.
Ooh, that's interesting - so the bots are parsing the registration for form fields.

The div idea sounds better. Have a secret field and if it's filled in then it's a bot. Also have the input type=hidden to catch bots that aren't as smart (who don't parse the form).

 

[~tl]

Hmm, sounds like an interesting solution. However, as I said above, we have had virtually no spam-bot registrations since adding the anti-spam questions to the registration form, therefore I see no reason to go messing about with the code to add further measures...

 

[Mike Richardson]

Hmm, sounds like an interesting solution. However, as I said above, we have had virtually no spam-bot registrations since adding the anti-spam questions to the registration form, therefore I see no reason to go messing about with the code to add further measures...

If the anti-spam questions are a built-in phpBB feature, the bot writers will begin to parse those questions and provide the correct answers automatically, and those questions will lose their efficacy. At that time (when spam bot registrations are increasing) - you should consider some of these other ideas.

Any thoughts on the Mac question idea? I thought that was pretty good.

 

[joshc]

Any thoughts on the Mac question idea? I thought that was pretty good.

Hell yes, definitely if it's a 4400-related question.

 

[~tl]

Hmm, sounds like an interesting solution. However, as I said above, we have had virtually no spam-bot registrations since adding the anti-spam questions to the registration form, therefore I see no reason to go messing about with the code to add further measures...

If the anti-spam questions are a built-in phpBB feature, the bot writers will begin to parse those questions and provide the correct answers automatically, and those questions will lose their efficacy. At that time (when spam bot registrations are increasing) - you should consider some of these other ideas.

Any thoughts on the Mac question idea? I thought that was pretty good.

They are implemented using the "custom profile fields" feature of phpBB, but they're not a standard feature when used in this way. The specific questions and the names of the fields that they use (etc) are unique to this forum, which should make writing something to solve the questions significantly more difficult (and I don't think we're a particularly high profile target). I'll see how it goes. I don't see any reason why a Mac specific question would provide that much more security than a basic maths one... but we may well try it if the number of registrations starts to increase!

 

[Mike Richardson]

Hmm, sounds like an interesting solution. However, as I said above, we have had virtually no spam-bot registrations since adding the anti-spam questions to the registration form, therefore I see no reason to go messing about with the code to add further measures...

If the anti-spam questions are a built-in phpBB feature, the bot writers will begin to parse those questions and provide the correct answers automatically, and those questions will lose their efficacy. At that time (when spam bot registrations are increasing) - you should consider some of these other ideas.

Any thoughts on the Mac question idea? I thought that was pretty good.

They are implemented using the "custom profile fields" feature of phpBB, but they're not a standard feature when used in this way. The specific questions and the names of the fields that they use (etc) are unique to this forum, which should make writing something to solve the questions significantly more difficult (and I don't think we're a particularly high profile target). I'll see how it goes. I don't see any reason why a Mac specific question would provide that much more security than a basic maths one... but we may well try it if the number of registrations starts to increase!

OK. I would say you probably have no bot registrations and are looking at about 100% human spam registrations right now, most likely Chinese or Russians. The Mac question might help in this respect as I doubt they are to know the answer.

 

[~tl]

OK. I would say you probably have no bot registrations and are looking at about 100% human spam registrations right now, most likely Chinese or Russians. The Mac question might help in this respect as I doubt they are to know the answer.

Yeah, but it depends how determined they are... it doesn't take much effort to look up something on Wikipedia, etc. The situation isn't dire now, since it's easy enough to handle to odd spam message manually, so I'm not too worried about changing things at the moment.

 

[Cory5412]

I would agree with TL that handling the spammers as it currently stands is not so difficult. Many of them do post one or two things within an hour or so of having signed up, but even then I'd say the sign-ups are at a rate of less than once per week.

As another thought, please continue to be vigilant with the "report post" button, shown here highlighted in red, which is its mouse-over sate.