short question: how do you protect your board from automated bot spamming? i cant see any captcha! normally, from my expirience, a board would be instantly spammed to death without captcha or such protective measures. but 4ch board seems to be free of those problems... how do you do that ?
Name:
Anonymous2007-08-20 16:48 ID:vz7537ir
Read the fucking HTML source. It's not hard to figure out.
Name:
Anonymous2007-08-20 16:58 ID:rI8ZDcGf
all i can see in the html source is an added ID to some form elements. but how is that supposed to prevent some automatic form fill in - tool from spamming the forum?
>>18 OKAY YOU FUQIN ANGERED AN EXPERT PROGRAMMER
GODFUCKIGNDAMN
FIRST OF ALL, YOU DON'T FUQIN KNOW WHAT A MAN PAGE IS
SECONDLY, THIS IS /prog/ DO NOT DEMAND USEFUL ANSWERS THE WAY YOU WANT THEM TO BE
THIRDLY PROGRAMMING IS ALL ABOUT PHILOSOPHY AND ``ABSTRACT BULLSHITE'' THAT YOU WILL NEVER COMPREHEND
AND FUQIN LASTLY, FUCK OFF WITH YOUR BULLSHYT
EVERYTHING HAS ALREADY BEEN ANSWERED IN>>3,4,10
99% of the time, hidden fields, and maybe some really simple and straightforward heuristics are all that you need. (For example: dump any message containing "[url=" or "<a href=", or any message containing the same text in more than one of the fields -- a lot of spambots just fill in the same text in every field, because they generally suffer from amazingly clumsy programming.)
That's really all it takes. I've been running a board for over a year, and have yet to see one single successfully posted spam message since I added these checks. Stupidly obvious or not, spammers haven't bothered to adapt to this technique yet.
For a while, I logged the IP address and post data (just the form field text, no attached files) for every foiled spambot attempt. The logfile would take up more than a megabyte *per day*.
Captchas are a stupid way to prevent spam. They're easier to break than one might expect (have a look at PWNtcha), and they do more to annoy legitimate posters than to curb spam. Simple tactics like adding a hidden field are just as effective and don't get in the way of normal posting. About the only thing they're useful for is slowing down flooders, and a "delete all posts and ban IP" button -- even as short a ban as 15-30 minutes -- is still more effective.
Captchas are a stupid way to prevent spam.
If spammers can't be bothered to circumvent dummy fields, why would they try to circumvent captchas?
Like you say, captchas help slow flooding. Some of us other board admins don't live to moderate the boards. It's sink or swim, &c.
(also, proxies)
Name:
Anonymous2007-08-22 3:22 ID:RDHV19NT
>>24
Proxy checker and a list of known proxy IPs. I don't live to moderate my board either; I just have other measures in place. (And, another simple check -- which most boards already have -- is a post delay, which also helps to slow posting down. All the captcha is doing if you have a post throttling mechanism is keeping the flooders busy while their time window resets.)
I'm not saying that the average spammer is *going* to circumvent captchas. All I'm suggesting is, why go to the trouble of implementing a captcha system when tossing a dummy field and two if statements in the code will accomplish essentially the same effect?
Name:
Anonymous2007-08-22 4:02 ID:JvtSXO1A
>>25
I had forgotten about the proxy detection system Wakaba has. It's supposed to be rather air-tight. Had any complaints?
I guess with automated backup that'd be workable, although there's still certain (more involved) workarounds.
Name:
Anonymous2007-08-22 4:09 ID:umPPmUfT
>>26
Wakaba just executes a unix program to check for proxies.
I don't care how it does it. Does it cause problems?
Name:
Anonymous2007-08-22 14:15 ID:RDHV19NT
>>32
If you have a shitload of open ports, it might give you a false positive. Solution? Don't use condoms with holes in them.
But the best, simplest method I've come up with is simply leaving everything disabled until someone comes along and tries to spam the board. Then ban the IP. He knows how to use a proxy? Get your continually-updated known proxy and tor node lists and run them through the banpanel. (After doing that, use a bit of SQL to delete all posts by currently banned IPs that were made within the last 'n' minutes. Much simpler than deleting the posts by hand.) Still having problems? Turn the proxy checker on. STILL getting flooded? Well then, you have a first-class hate machine... then enable the captcha, increase the time-between-posts to something like 5 minutes, and keep your finger on the ban button.
This way, the average user doesn't have to deal with captchas at all, unless they're really and truly necessary, anyone using a proxy legitimately is only minimally inconvenienced, and as an added bonus, you'll get a nice fat collection of proxy IPs for future reference. If they come back later and discover that you've gone back to normal operating mode, all you'll need to do is re-add those IPs to the ban list. Chances are, they'll try the same proxies again.
Name:
Anonymous2007-08-22 17:13 ID:oJhDnKz5
>>33
Uh... that sounds like far more effort than I'm willing to put up with, plus it leaves the board hosed in the meantime (I only check every few days since it's well-behaved).
Thanks for the details though. I'll think about it.
Name:
Anonymous2007-08-22 22:30 ID:bH65W6Ul
Ban 0.0.0.0/0. Keeps shit real quiet.
Name:
Anonymous2007-08-22 22:53 ID:loNFBfQ+
>>35
except a netmask of 0 matches nothing, nubcakes
sucks to crack such an unfunny joke and then even fuck ip up