Main index > Off the wall > The spamming issue, or why registration is disabled

By syfou (Core Developer & Desklet Author), on Tue Nov 21 01:01:10 2006, last edited on Wed May 16 13:42:21 2007: The spamming issue, or why registration is disabled.

I performed the day-to-day administration of this forum since its opening more than eighteen months ago, and I must say how amazed I have been by the civility and helpfulness of the adesklets community: in all my interactions with more than 350 different individuals so far, I honestly cannot recall a single occurrence where people have been rude: thanks to you all for your interest in adesklets, and the invaluable feedback you gave me.

Sadly, you may have noticed that in the last couple of weeks, people from outside this community have started acting in a ill-mannered fashion by polluting this space with completely irrelevant content, often pornographic in nature: deleting a bogus account once in a while with a home page full of sleazy materials is not fun, but is something I can cope with. Spending half a hour daily chasing senseless porn links put there by scripting kiddies trying to secure illegitimate pay-per-view or pay-per-click revenues at adesklets and sourceforge expense is not.

Lately, the ratio of legitimate messages versus spam has decreased to a point where I don't think keeping the forum tidy is worth the effort anymore, and that's why automated registration has been indefinitely disabled: my apologies to all the people out there that might be affected by this decision.

If ever you have sound technical advices or experience to share that would make possible to re-activate the CAPTCHA registration, I will be glad to hear from you, either below if you are already registered, or privately. Needless to say, anyone wanting a new account is welcomed to contact me: I will be glad to create one on his (or her) behalf -- those people should mention what user name they want (that's the only account info that cannot be changed later)... By the way, spammers are welcomed to write me as well: my filters will make sure I shall not hear from them again anytime soon.

_________________
Sylvain
syfou@users.sourceforge.net

By gnoomy (User), on Thu Dec 28 06:11:33 2006.

I'm administrator on another phpBB2 forum, and experienced spamming too.

We found a solution, a very custom captcha: in the registration form, one have to tell how much is two and two. Yes, four. But bots are not able to understand it.
You can see it here (the forum is in french - click on "j'accepte... j'ai plus de 13 ans" below the bold sentence)

now bots can't even register, and I'm happy.

Only a few lines have to be added, I can give more details here if you're interested.

By syfou (Core Developer & Desklet Author), on Fri Dec 29 03:16:49 2006.

Hi gnoomy,

You wrote:

We found a solution, a very custom captcha: in the registration form, one have to tell how much is two and two. Yes, four. But bots are not able to understand it.

Mmh... I was more under the impression that bogus accounts used for spamming were pretty much manually created (since accounts need to be activated by visiting a URI received by mail in addition to the CAPTCHA before any posting can be done)... I know this can also be scripted, but are these people harvesting so much money they can devote that much time on this (batch registering valid email addresses, reading their inbox, sending HTTP GET requests, etc.)?

I didn't think that merely modifying the CAPTCHA would do the trick, but I will take your word for it and try -- I find somewhat ironic I could defeat the involved mechanic needed to deceit phpBB complex anti spam with something that trivial, yet uncommon: oh the joy of standardization! ;-)

Thanks for the tip! Regards,

By DeathWishR (User), on Thu Mar 1 04:03:25 2007.

syfou wrote:

...something that trivial, yet uncommon: oh the joy of standardization!

I think you've hit it entirely on the mark. I believe the problem (a lot of the phpBB boards are starting to get spam-heavy) is that the so-called 'script kiddies' have coded routines specifically to break the php anti-spam measures. I assume they're either pulling the needed link out of the registration e-mail or have just amassed all the triggered responses required. Regardless, I bet gnoomy is probably totally correct in that ANY custom CAPTCHA, despite its complexity, will knock out the scripts hunting phpBB. The problem is not complexity, it's that everyone is using the exact same system with no customization.

edit: added sig


adesklets is proud to be hosted on:

SourceForge.net Logo

Back to adesklets.sf.net.