(Webmaster) - Recent Board Spam

[clpexco]

Members,

As you have probably noticed, within the last few days there have been a number of "spam" posts on the CLPEX message board. These are posted by "Board Bots" that surf the web looking for the hidden HTML pages that contain posting language, and then automatically using that language to create an automated spam-posting. What you may not know is that these posts are not a new occurrence to the CLPEX board. You don't always see them because through the excellent efforts of site administrators, the posts are almost always immediately deleted. However, lately it seems that there has been an increase in spam submissions, and it has been proposed that it is time to do something about it.

These bots work because they don't have to register in order to post. If we turn on one of the options in the board administration, we could avoid spam posts entirely becasue they could not post if they weren't logged in as a registered member. However, it would mean that everyone would have to log in prior to posting.

One thing I would like to emphasize is that this doesn't prevent posting under an alias. You would simply have to register as that alias, and log in prior to posting. You can still read the board without logging in and you can still register with several aliases if you wish.

This forum was never intended to be a completely controlled, moderated, filtered forum. Things posted on this board must be taken with a grain of salt, even if you recognize the name of the person posting... because it may not actually be that person (although I hope this practice is minimal on this board). However, log-in is password protected, so the move of this forum in this direction also adds a sense of security in some respects because you can be sure that the owner of the name has at least signed in with the associated password; and likewise, you can view their profile (if they have filled it in) and contact them off-line for further assurance of the validity of their identity.

Over the next few days, I would like to hear from the members whether they would mind helping eliminate spam posts simply through required registration and login to post. If we did this, the only required piece of information for registration would be "user-name". Please vote and reply with comments, if desired.

-Kasey

[Guest]

Before I vote I would like to know how hard it is to delete the spam.

I know of one site administrator who diligently tracks IP addresses to identify legitimate anonymous posters. This is all going on while spam is left in place. If it is that difficult to delete then I guess requiring a log on is a good measure. If it is easy to delete the spam why not do that?

[clpexco]

Guest,

Thank you for your question. It takes approximately as long to delete a post as it takes to complete a post after logging in.

I spent approximately 2 minutes signing in, going to your post, and replying. As an administrator, it also takes approximately 2 minutes to sign in, go to a post, look at an IP address, and hit "IP Lookup" to find out additional information.

It isn't the individual posts that are an issue... it's the volume over time and the constant stream of spam postings lately... and it's a growing issue because like traditional e-mail spammers, they probably share lists.

-Kasey

[Shane Turnidge]

While I can some some advantages to anonymity in this forum, scrutiny is something every LPE should just come to expect.

FWIW I have no problem with the login process or the scrutiny Kasey.

ps. Those Spam Bots can be a precursor to more malevolent web activities. I.e Hackers.

Shane

[Les Bush]

Hi Kasey,

I'm registered and support the need for controlled access to stop clogging the site. Regards Les

[Steve Everist]

To expand on what Kasey said regarding deletion of posts; deleting spam posts isn't a difficult task on its own - similar to deleting it in your email. But there is a lot of it.

All of the spam currently on the first page of the forum, was purposefully left behind to illustrate to the users how much is there. Other than disabling the links from the Russian sites, it has all been left since November 30th.

Just as you can put filters in place through your ISP and personal email programs, there are filters to assist in the reduction of spam on forums such as this one. Specific email addresses and IP's can be blocked. But as long as users are allowed to post as "Guest," there is still an easy way in. Originally there was a problem with many bots registering on the site. That seems to have been cured by adding a visual keyword to individual registries, similar to what Ticketmaster uses on their site.

Even with requiring posters to be registered, there's still nothing that can be done to keep individuals from sitting down, going through the registration process, then posting their spam. Since the visual keyword was added about a month ago, I'm not aware that there have been any spamming registrants.

The current Casino posts have now had their IP blocked, as they used the same one for each post. That doesn't mean that they can't easily use another one and continue with these posts. There have been days where 5 - 10 spam posts have been deleted, and times where there hasn't been one for five days.

The only thing that can be done as it stands is to keep deleting posts and adding the spamming IP's to the banned list. Currently there are something like 14 IP's in this list along with 15 ISP's that have been banned from registration.

By requiring posters (not readers) to register, much of this can be avoided. At the same time, those that wish to post under a pseudonym can continue to do so. The benefits to this are that the readers can identify posts with a specific pseudonym instead of try to figure out if Guest A is also Guest B, C, and D. And if you post something that you want to modify later, you can edit your posts at any time.

[Bill]

Agree. Passwords are needed.

Bill

[L.J.Steele]

I'm ok with requiring a log-in to post, which requires a password, tho won't prevent folks from having multiple identities or using stuff like bugmenot.com.

As a technical note, however, the log-in procedure interacts oddly with Netscape 7.02. I've had points where I've logged in, but the posting system still asks for a username (likely the cookie didn't take or got erased) or, once, it seemed to log me in as someone else.

[Steve Everist]

As you can see, the spammers are trying to make Kasey's point for him. This amount is not uncharacteristic over a period of just a few days.

[RL Tavernaro]

I see no problem with registration requirement to post, as long as the board may still be accessed and read without registration.

[Steve Everist]

Regarding the vote, you do need to be registered and signed in to post your vote at the top of this thread.

[clpexco]

I see no problem with registration requirement to post, as long as the board may still be accessed and read without registration.

[Mike French]

Board Bots sound alarming. I say we get them before they get us. Take any measures necessary Kasey.

[rdodge]

I vote yes to keep spamers and other possible problems out.

[Steve Skowron]

I vote yes.