Hi,
Of late, Ask Fedora is being badgered by spam. They seem to open multiple accounts and post as many as 50 spam questions at a time. Is there something we can do to tackle this? For the time being, we're manually blocking the user and deleting each question one by one. It's a lot of work and one needs to keep an eye out on the forum all the time.
I've asked upstream a question here: http://askbot.org/en/question/12506/how-do-i-mass-delete-all-questions-from-...
This is a work around to clean up the mess. Can we do something to avoid it altogether?
I've asked upstream another question: http://askbot.org/en/question/12507/alternatives-to-akismet/
Hi
FWIW, I have deleted well over a dozen accounts and hundred questions in the last few days and several new user accounts even after this mail was posted. It is likely a single persistent spammer and perhaps scripted. Some serious measures are needed at this point since some of us constantly deleting users accounts and postings just isn't scalable.
Possible options
* Block by IP address * Limit open id signs to just Fedora accounts * https://pypi.python.org/pypi/stopforumspam/ * https://www.djangopackages.com/grids/g/anti-spam/
Rahul
On Thu, 29 May 2014 06:11:36 -0400 Rahul Sundaram metherid@gmail.com wrote:
Hi
FWIW, I have deleted well over a dozen accounts and hundred questions in the last few days and several new user accounts even after this mail was posted. It is likely a single persistent spammer and perhaps scripted. Some serious measures are needed at this point since some of us constantly deleting users accounts and postings just isn't scalable.
Yeah, I have blocked a number of their accounts and deleted rafts of posts too. ;(
Possible options
- Block by IP address
I looked at this a few days ago, and it didn't seem they were coming from any IP in particular. :( I can look again tho.
- Limit open id signs to just Fedora accounts
We could. How much outcry would this get from the people that use other providers though? I think there's lots of people using google/etc...
When I looked at a few of this spammers accounts they seemed to all be yahoo? I'd be perfectly fine blocking yahoo auth, but then they could just use another one.
Would need packaging and testing...
kevin
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 05/29/2014 10:29 AM, Kevin Fenzi wrote:
On Thu, 29 May 2014 06:11:36 -0400 Rahul Sundaram metherid@gmail.com wrote:
Hi
FWIW, I have deleted well over a dozen accounts and hundred questions in the last few days and several new user accounts even after this mail was posted. It is likely a single persistent spammer and perhaps scripted. Some serious measures are needed at this point since some of us constantly deleting users accounts and postings just isn't scalable.
Yeah, I have blocked a number of their accounts and deleted rafts of posts too. ;(
Possible options
- Block by IP address
I looked at this a few days ago, and it didn't seem they were coming from any IP in particular. :( I can look again tho.
- Limit open id signs to just Fedora accounts
We could. How much outcry would this get from the people that use other providers though? I think there's lots of people using google/etc...
When I looked at a few of this spammers accounts they seemed to all be yahoo? I'd be perfectly fine blocking yahoo auth, but then they could just use another one.
Would need packaging and testing...
If they're all coming in through Yahoo, then disabling that would be a stopgap at least until we can find a more effective anti-spam solution.
Hi
On Thu, May 29, 2014 at 12:39 PM, Rahul Sundaram wrote:
Hi
On Thu, May 29, 2014 at 11:15 AM, Stephen Gallagher wrote:
If they're all coming in through Yahoo, then disabling that would be a stopgap at least until we can find a more effective anti-spam solution.
I have done that now. Lets see if it helps
Second reply: it appears that disabling the yahoo login did work, atleast for now. I haven't seen the spammer re-appear after that point.
Rahul
On Sat, 31 May 2014 00:42:03 -0400 Rahul Sundaram metherid@gmail.com wrote:
Hi
On Thu, May 29, 2014 at 12:39 PM, Rahul Sundaram wrote:
Hi
On Thu, May 29, 2014 at 11:15 AM, Stephen Gallagher wrote:
If they're all coming in through Yahoo, then disabling that would be a stopgap at least until we can find a more effective anti-spam solution.
I have done that now. Lets see if it helps
Second reply: it appears that disabling the yahoo login did work, atleast for now. I haven't seen the spammer re-appear after that point.
Sadly they just did twice. ;(
I blocked them in less than a minute, but they are definitely not gone.
kevin
Hi
On Sat, May 31, 2014 at 1:43 AM, Kevin Fenzi wrote:
Sadly they just did twice. ;(
I blocked them in less than a minute, but they are definitely not gone.
I jinxed it! In any case, is it feasible for us to consider recaptcha support? About six patches we can cherry pick from upstream
https://github.com/ASKBOT/askbot-devel/commits/master/askbot
I understand the concerns about the non-free nature of the service but this will atleast slow them considerably even if it is done temporarily
Rahul
On Sat, 31 May 2014 02:23:49 -0400 Rahul Sundaram metherid@gmail.com wrote:
Hi
On Sat, May 31, 2014 at 1:43 AM, Kevin Fenzi wrote:
Sadly they just did twice. ;(
I blocked them in less than a minute, but they are definitely not gone.
I jinxed it! In any case, is it feasible for us to consider recaptcha support? About six patches we can cherry pick from upstream
https://github.com/ASKBOT/askbot-devel/commits/master/askbot
I understand the concerns about the non-free nature of the service but this will atleast slow them considerably even if it is done temporarily
Do you know what the 'Enable content moderation' setting does?
If this just moderates all new questions, perhaps we could do this? Then, their spam wouldn't ever get out of the moderation queue at all.
It's not fully clear to me what it does tho...
I'd prefer to avoid recapcha, or askimet if we can... if we must tho, askimet is already in, so it would be much easier to enable it seems like.
kevin
Hi
On Sat, May 31, 2014 at 12:49 PM, Kevin Fenzi wrote:
Do you know what the 'Enable content moderation' setting does?
If this just moderates all new questions, perhaps we could do this? Then, their spam wouldn't ever get out of the moderation queue at all.
Yes, I have done this earlier today.
I'd prefer to avoid recapcha, or askimet if we can... if we must tho,
askimet is already in, so it would be much easier to enable it seems like.
I thought askimet is only free for personal use
Rahul
On Sat, 31 May 2014 17:09:00 -0400 Rahul Sundaram metherid@gmail.com wrote:
Hi
On Sat, May 31, 2014 at 12:49 PM, Kevin Fenzi wrote:
Do you know what the 'Enable content moderation' setting does?
If this just moderates all new questions, perhaps we could do this? Then, their spam wouldn't ever get out of the moderation queue at all.
Yes, I have done this earlier today.
Has it changed anything? Doesn't seem to have...
I'd prefer to avoid recapcha, or askimet if we can... if we must tho,
askimet is already in, so it would be much easier to enable it seems like.
I thought askimet is only free for personal use
Not sure, it's not really clear... Are we a 'non-commercial site'?
kevin
Hi
On Sat, May 31, 2014 at 5:26 PM, Kevin Fenzi wrote:
Has it changed anything? Doesn't seem to have...
It does. I found some spam and regular posts in the moderation queue and
had to approve/reject them explicitly. Not all posts go through the queue however. Perhaps it is based on karma value. Not sure
Not sure, it's not really clear... Are we a 'non-commercial site'?
That sounds like a question for Fedora legal
Rahul
On Sat, 2014-05-31 at 15:26 -0600, Kevin Fenzi wrote:
On Sat, May 31, 2014 at 12:49 PM, Kevin Fenzi wrote:
Do you know what the 'Enable content moderation' setting does?
If this just moderates all new questions, perhaps we could do
this?
Then, their spam wouldn't ever get out of the moderation queue at all.
Yes, I have done this earlier today.
Has it changed anything? Doesn't seem to have...
The askbot moderation UI is quite wonky. Sometimes it shows me things as "none", so I really have no idea if they're spam or not:
http://askbot.org/en/question/12526/entries-in-moderation-queue-just-show-no...
Other times, there aren't any accept/reject buttons. Sometimes there are a lot of posts that I think have already been approved. It's quite difficult to keep this up IMO. Should we disable this? It might be affecting the usability of the site. :/
On Thu, 2014-05-29 at 08:29 -0600, Kevin Fenzi wrote:
Would need packaging and testing...
Submitted stopforumspam for review:
https://bugzilla.redhat.com/show_bug.cgi?id=1103034
On Fri, 2014-05-30 at 16:01 +1000, Ankur Sinha wrote:
Submitted stopforumspam for review:
The package has been approved. I've built for F20 and rawhide. It builds on EL too, but I haven't requested a branch yet. Could someone please take a peek at the spec to confirm if it's EL ready? I don't maintain many packages for EL, and I'm unsure of the differences in the django packaging scheme between EL and F20+ at the moment.
http://pkgs.fedoraproject.org/cgit/python-django-stopforumspam.git/tree/pyth...
Hi
On Mon, Jun 2, 2014 at 5:21 AM, Ankur Sinha wrote:
http://pkgs.fedoraproject.org/cgit/python-django-stopforumspam.git/tree/pyth...
Before you branch for EPEL, you can use a scratch build perhaps in the staging environment and confirm that it works as intended? We don't want to end up maintaining things that don't suit our needs
Rahul
On Mon, 2014-06-02 at 21:45 -0400, Rahul Sundaram wrote:
Before you branch for EPEL, you can use a scratch build perhaps in the staging environment and confirm that it works as intended? We don't want to end up maintaining things that don't suit our needs
I've built successfully for el5 on mock:
http://ankursinha.fedorapeople.org/python-django-stopforumspam/el5/
I'll install it on staging when I get the time. How would I create spam to test it, though?
Hi
On Mon, Jun 2, 2014 at 11:04 PM, Ankur Sinha wrote:
http://ankursinha.fedorapeople.org/python-django-stopforumspam/el5/
I'll install it on staging when I get the time. How would I create spam to test it, though?
https://pypi.python.org/pypi/stopforumspam/ claims that you can add your
own ip address to the db using django admin. If that is feasible, that gives you a quick way to test it
Rahul
On Tue, 2014-06-03 at 10:26 -0400, Rahul Sundaram wrote:
https://pypi.python.org/pypi/stopforumspam/ claims that you can add your own ip address to the db using django admin. If that is feasible, that gives you a quick way to test it
I've installed the package and made the required changes to settings.py etc. I haven't been able to login to django-admin to test it, though. Can someone with access please test to see if it works? You need to:
- ensure puppet etc didn't mess up my changes (I've made them locally) - login to django admin and add an IP to the block list - try to access ask.stg from that IP and see if stopforumspam does anything
On Sun, 15 Jun 2014 15:06:31 +1000 Ankur Sinha sanjay.ankur@gmail.com wrote:
On Tue, 2014-06-03 at 10:26 -0400, Rahul Sundaram wrote:
https://pypi.python.org/pypi/stopforumspam/ claims that you can add your own ip address to the db using django admin. If that is feasible, that gives you a quick way to test it
I've installed the package and made the required changes to settings.py etc. I haven't been able to login to django-admin to test it, though. Can someone with access please test to see if it works? You need to:
- ensure puppet etc didn't mess up my changes (I've made them locally)
- login to django admin and add an IP to the block list
- try to access ask.stg from that IP and see if stopforumspam does
anything
Sadly, I am not sure this will work at all for us. Our application servers are behind a bunch of proxies. So, the application servers only see the IP addresses of the proxies connecting to it. ;(
If we can get the package to look at a header, we might be able to add a proxied-for header with the real ip in it?
kevin
If we can use askimet we should go that route, I talked to suehle and we can get a membership $5 for the commercial site license. It works wonders on the Fedora Magazine.
- Chris Roberts
----- Original Message ----- From: "Kevin Fenzi" kevin@scrye.com To: infrastructure@lists.fedoraproject.org Cc: ankursinha@fedoraproject.org Sent: Sunday, June 15, 2014 11:45:30 PM Subject: Re: Ask Fedora being badgered by spam
On Sun, 15 Jun 2014 15:06:31 +1000 Ankur Sinha sanjay.ankur@gmail.com wrote:
On Tue, 2014-06-03 at 10:26 -0400, Rahul Sundaram wrote:
https://pypi.python.org/pypi/stopforumspam/ claims that you can add your own ip address to the db using django admin. If that is feasible, that gives you a quick way to test it
I've installed the package and made the required changes to settings.py etc. I haven't been able to login to django-admin to test it, though. Can someone with access please test to see if it works? You need to:
- ensure puppet etc didn't mess up my changes (I've made them locally)
- login to django admin and add an IP to the block list
- try to access ask.stg from that IP and see if stopforumspam does
anything
Sadly, I am not sure this will work at all for us. Our application servers are behind a bunch of proxies. So, the application servers only see the IP addresses of the proxies connecting to it. ;(
If we can get the package to look at a header, we might be able to add a proxied-for header with the real ip in it?
kevin
_______________________________________________ infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
Hi
On Mon, Jun 16, 2014 at 12:29 AM, Chris A. Roberts wrote:
If we can use askimet we should go that route, I talked to suehle and we can get a membership $5 for the commercial site license. It works wonders on the Fedora Magazine.
Interesting. Fedora Magazine is hosted within Fedora infrastructure and my understanding is that as per current policy, one is not allowed to use a third party proprietary service.
Rahul
Hi Rahul,
The Fedora magazine is not hosted within Fedora I nfrastructure it is hosted on the Red Hat OpenShift Network.
Chris Roberts
----- Original Message -----
From: "Rahul Sundaram" metherid@gmail.com To: "Fedora Infrastructure" infrastructure@lists.fedoraproject.org Sent: Monday, June 16, 2014 9:22:41 AM Subject: Re: Ask Fedora being badgered by spam
Hi
On Mon, Jun 16, 2014 at 12:29 AM, Chris A. Roberts wrote:
If we can use askimet we should go that route, I talked to suehle and we can get a membership $5 for the commercial site license. It works wonders on the Fedora Magazine.
Interesting. Fedora Magazine is hosted within Fedora infrastructure and my understanding is that as per current policy, one is not allowed to use a third party proprietary service.
Rahul
_______________________________________________ infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
On Tue, 17 Jun 2014 14:23:42 -0400 Rahul Sundaram metherid@gmail.com wrote:
HI
On Sun, Jun 15, 2014 at 11:45 PM, Kevin Fenzi wrote:
If we can get the package to look at a header, we might be able to add a proxied-for header with the real ip in it?
So, what is the solution here? File a RFE upstream for functionality?
Yeah. If it supported X-Forwarded-For headers we could have it use those to get the users real address.
kevin
Le mardi 17 juin 2014 à 20:47 -0400, Rahul Sundaram a écrit :
Hi
On Tue, Jun 17, 2014 at 5:29 PM, Kevin Fenzi wrote:
Yeah. If it supported X-Forwarded-For headers we could have it use those to get the users real address.@Ankur, would you mind filing this request upstream?
I pushed directly a PR for that: https://github.com/benjaoming/django-stopforumspam/pull/7
However, I didn't test it, so that likely mean it is buggy and I forgot something :)
HI
On Sat, Jun 21, 2014 at 11:32 AM, Michael Scherer wrote:
I pushed directly a PR for that: https://github.com/benjaoming/django-stopforumspam/pull/7
However, I didn't test it, so that likely mean it is buggy and I forgot something :)
Thanks!
Rahul
Le samedi 21 juin 2014 à 17:32 +0200, Michael Scherer a écrit :
Le mardi 17 juin 2014 à 20:47 -0400, Rahul Sundaram a écrit :
Hi
On Tue, Jun 17, 2014 at 5:29 PM, Kevin Fenzi wrote:
Yeah. If it supported X-Forwarded-For headers we could have it use those to get the users real address.@Ankur, would you mind filing this request upstream?
I pushed directly a PR for that: https://github.com/benjaoming/django-stopforumspam/pull/7
However, I didn't test it, so that likely mean it is buggy and I forgot something :)
This was merged upstream, and released as 1.4.2 : https://pypi.python.org/pypi/stopforumspam/
Hi
On Sat, Jul 12, 2014 at 11:21 AM, Michael Scherer wrote:
This was merged upstream, and released as 1.4.2 : https://pypi.python.org/pypi/stopforumspam/
Thanks Michael! Ankur, can you take a look at this, please? Appreciate your help.
Rahul
On Thu, 2014-07-17 at 08:58 -0400, Rahul Sundaram wrote:
Hi
On Sat, Jul 12, 2014 at 11:21 AM, Michael Scherer wrote: This was merged upstream, and released as 1.4.2 : https://pypi.python.org/pypi/stopforumspam/
Thanks Michael! Ankur, can you take a look at this, please? Appreciate your help.
Rahul
I've filed a trac ticket to track this:
https://fedorahosted.org/fedora-infrastructure/ticket/4483
Hi
On Sun, Aug 10, 2014 at 5:44 AM, Ankur Sinha wrote:
I've filed a trac ticket to track this:
Thanks. FWIW, I have disabled content moderation in Ask Fedora since the persistent spammer we had seems to have given up (one can hope!). Please keep an eye out for any spam issues as we get close to deploying this module
Rahul
On Thu, 2014-05-29 at 08:29 -0600, Kevin Fenzi wrote:
Would need packaging and testing...
Is captcha worth using? I can look at packaging that up too.
On Fri, May 30, 2014 at 11:34 AM, Ankur Sinha sanjay.ankur@gmail.com wrote:
On Thu, 2014-05-29 at 08:29 -0600, Kevin Fenzi wrote:
Would need packaging and testing...
Is captcha worth using? I can look at packaging that up too.
I don't think captcha will work, these are not bots, these are the normal human who is intentional posting adds n all kinds of marketing material
Thanks, Warm regards, Ankur (FranciscoD)
http://fedoraproject.org/wiki/User:Ankursinha
Join Fedora! Come talk to us! http://fedoraproject.org/wiki/Fedora_Join_SIG
infrastructure mailing list infrastructure@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/infrastructure
On Fri, 2014-05-30 at 15:22 +0530, Akshay Vyas wrote:
I don't think captcha will work, these are not bots, these are the normal human who is intentional posting adds n all kinds of marketing material
I'd expect them to be bots. A human wouldn't be able to post 50 questions in 3 minutes :/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 05/30/2014 06:23 AM, Ankur Sinha wrote:
On Fri, 2014-05-30 at 15:22 +0530, Akshay Vyas wrote:
I don't think captcha will work, these are not bots, these are the normal human who is intentional posting adds n all kinds of marketing material
I'd expect them to be bots. A human wouldn't be able to post 50 questions in 3 minutes :/
No, but a human can do the signup and then point a bot at the site once the sign-up is complete. (Not saying this is what happened, just that it can)
On 30 May 2014 06:14, Stephen Gallagher sgallagh@redhat.com wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 05/30/2014 06:23 AM, Ankur Sinha wrote:
On Fri, 2014-05-30 at 15:22 +0530, Akshay Vyas wrote:
I don't think captcha will work, these are not bots, these are the normal human who is intentional posting adds n all kinds of marketing material
I'd expect them to be bots. A human wouldn't be able to post 50 questions in 3 minutes :/
No, but a human can do the signup and then point a bot at the site once the sign-up is complete. (Not saying this is what happened, just that it can)
Actually some places can do 50 questions in 3 minutes with humans. The humans sit behind a proxy and use a shared users login. They do all the captcha stuff for a bot to post the ad. In the end, you can only do so much to stop this. Captcha stuff works for the less sophisticated bots but won't stop the forced labour spam operations.
I would say finding throttle software which allows one post per minute to make it more expensive for them to post a lot. The goal is to make it expensive enough that they will want to go somewhere else versus keep at it here.
Hi
On Fri, May 30, 2014 at 11:07 AM, Stephen John Smoogen
I would say finding throttle software which allows one post per minute to make it more expensive for them to post a lot. The goal is to make it expensive enough that they will want to go somewhere else versus keep at it here.
I have filed a RFE
http://askbot.org/en/question/12508/rate-limit-user-postings/
Rahul
infrastructure@lists.fedoraproject.org
-
Akshay Vyas -
Ankur Sinha -
Chris A. Roberts -
Kevin Fenzi -
Michael Scherer -
Rahul Sundaram -
Stephen Gallagher -
Stephen John Smoogen