5 ms·

Most websites probably don't. If you're one of those people, congratulations! Stick a honeypot input into your form and call it a day. However, if you're worki

Most websites probably don't. If you're one of those people, congratulations! Stick a honeypot input into your form and call it a day. However, if you're working on anything with non-insignificant amounts of traffic, you'll get hit with some customized spam. I've been dealing with these spammers, and if you do nothing, your forum will be filled with korean ads. We implement Akismet, StopForumSpam, Project Honeypot, and ReCAPTCHA, with the latter being the most effective (sadly). I'm pretty sure some of these spam agencies have customized tooling to handle NodeBB (they're using websockets to submit the posts, instead of HTTP POST). Outside of these strategies, the most effective by far is reputation restrictions. Post queues if you're new or don't have enough upvotes, etc. However it does require manual effort, of course. Would definitely love an alternative.

ordu 7y ago
> We implement Akismet, StopForumSpam, Project Honeypot, and ReCAPTCHA Did you tried some techniques from the article? Like hidden form fields, simple javascript checks or simple captcha?
- sroussey 7y ago
  I used to run a forum hosting service. After a while you try everything. Honeypot fields, incorrect field names, etc. You will notice things like CSRF tokens generated by one IP and used by another. When stuff fails, they send 100 real people and record what worked, and it fixes their script. It’s all pretty automated. IP reputation can be helpful for some players, but most snowshoe. Spam attempts would grow exponentially. So every time we cut it down by 90% via one of these tricks, it only gave us a bit of time. None of this stops the determined troll though.. they can have all day to manually add offensive content. Shadow banning was good for this (1999) and group shadow banning was the best (bifurcated forum posts so all the banned people saw each other, but no one else did). Ah, memories. So good.
  - dennisgorelik 7y ago
    > all the banned people saw each other What did happen with that strategy?

ordu 7y ago

> We implement Akismet, StopForumSpam, Project Honeypot, and ReCAPTCHA Did you tried some techniques from the article? Like hidden form fields, simple javascript checks or simple captcha?

sroussey 7y ago
I used to run a forum hosting service. After a while you try everything. Honeypot fields, incorrect field names, etc. You will notice things like CSRF tokens generated by one IP and used by another. When stuff fails, they send 100 real people and record what worked, and it fixes their script. It’s all pretty automated. IP reputation can be helpful for some players, but most snowshoe. Spam attempts would grow exponentially. So every time we cut it down by 90% via one of these tricks, it only gave us a bit of time. None of this stops the determined troll though.. they can have all day to manually add offensive content. Shadow banning was good for this (1999) and group shadow banning was the best (bifurcated forum posts so all the banned people saw each other, but no one else did). Ah, memories. So good.
- dennisgorelik 7y ago
  > all the banned people saw each other What did happen with that strategy?