6 ms·

I've been maintaining a community forum for more than a decade. We had some abusive users, so we introduced pre-moderation. Meaning, any new user is on probatio

I've been maintaining a community forum for more than a decade. We had some abusive users, so we introduced pre-moderation. Meaning, any new user is on probation for a few posts, and all anonymous posts have to be manually approved by an admin to be posted publicly. This has pretty much completely stopped the visible abuse. However, for about 10 years, there are bots registering every day, some of them even make realistic accounts with cool and unique username, email, even description. Strangely, the email and username never match... And they make post with html links embedded. They even know to actually select the 'HTML' content type, which is an extra select input. Some bots even make a few innocent posts, before the link spam. But just too few to get past probation. Obviously, the spam posts never get approved, and accounts never get out of pre-moderation queue and yet they're still trying every day... Not intelligent enough to make more than 2 dumb posts. Similarly, I have some work projects that have user registration with a human on-boarding process, where another person has to add the user to their group for them to share any data, none of which is ever public. So these bots are tirelessly registering, and staying in limbo forever. Thousands of useless accounts. It boggles the mind how much energy is wasted, but I guess it must my profitable enough.

nickjj 6y ago
> This has pretty much completely stopped the visible abuse. This process works well but it can also turn away a ton of people from ever joining. I know there's this one product that only offers support through public forums and new accounts need to be reviewed by a moderator and then you're not allowed to post any threads until you've made a few replies to other threads and it's been white listed by a moderator, and then on top of that and you also can't use links until you've met some other criteria. But in order to get proper support it requires linking to large files (videos) that aren't able to be uploaded directly through the forums. It becomes such a pain in the ass to open a support request. It could easily take over a week just to post your question and the worst part about it is the forum software orders posts by date, and your post will be buried on the 8th page before it's visible because it takes your original pre-moderated post date as when it was created.
- Demiurge 6y ago
  That’s a very good point. I have experienced this myself, but I don’t see another way to stop abuse except tweaking the requirements. It sounds like too many hoops in your example. On our site if the user makes just one relevant comment I instantly promote them. It’s that easy to tell. I wish this deterrent wasn’t justified by walls of spam as the alternative.
  - throwaway373438 6y ago
    The model used by https://lobste.rs/about#invitations https://lobste.rs/about#invitations seems to work well. Create a graph.
naveen_ 6y ago
Can we control this to a certain extent by including a Captcha in register page?
- Demiurge 6y ago
  Yes, somehow captchas gets solved... But yes, I think it helps.
  - wtracy 6y ago
    There are third-world sweatshops that solve capchas for a fraction of a penny. I imagine they provide an API, so your bot makes an http call and gets a solution back.
    - mr__y 6y ago
      quick search, and I've found a quote of $1.8 per 1000 recaptchas with average response time of ~10s.
- Normille 6y ago
  Captchas are the absolute spawn of the devil. Every time I see one on a website, I want to punch the face of the person who invented them, until my fists hurt. Unless I really NEED to use that site, I just go elsewhere, once I get a Captcha shoved in my face.
  - zbentley 6y ago
    But why? Seems like anti-abuse is a pretty good reason to use one.
    - Normille 6y ago
      OK. Off the top of my head, some reasons I loathe Captchas: 1: You're working to train for free to train $megacorp's image recognition or OCR algorithms. 2: Even after [what seems like] eleventy billion Captchas and eleventy billion people pointing it out to them, they STILL don't tell you how to do the damned things properly. ie. If you ask me to click on any image with traffic lights, am I supposed to only click the lights?.. or the posts as well?.. what about a square that only has a wee part of one in? Does that count, or not? 3: As above with text based Captchas. Is it case sensitive? Do I have to include spaces between the words? What about the punctuation? Or the fragment of the previous or following word, peeping in at the side? 4: The Captchas never make allowances for the end user's language settings, so I'll often get American terms used, where the thing I'm meant to be identifying isn't called the same in real English. So I'm not 100% sure what I'm looking for. 5: If you have an ad-blocker, you'll usually be asked to solve about three Captchas in a row, thus cubing the annoyance. Thank god for 'Buster' is all I'm going to say! [I'm not going to link to it because the less people know about it the longer it'll keep working].
yvdriess 6y ago
Heavy moderation and a $10 registration barrier is what has kept the SomethingAwful forums around for so long.
Normille 6y ago
It's amazing how some people can't seem to spot a bot/spam post, no matter how obvious. One of the websites I host is for a retired elderly middle-aged academic who pens articles about his former field and invites comment. Almost every week I'll get an email from him along the lines of "Is this worth following up?" and attached will be either a comment reading something like "I love your article. So much good info and useful to me.." or an email from some g3gergergew@gmail.com address saying "We love your site. It has much good infos and is useful but we are notice your CEO could being better..." No matter how many times I tell him to look for the telltale signs... * Random gibberish email from address * Half a dozen links in the comment * Broken English * Generic text which could apply to ANY article or website in the bloody world ...he'll still forward them to me and ask if they're worth getting in contact with. Every time, I'm gobsmacked how he can fall for such inept spamming.
- criley2 6y ago
  The ineptitude of the spamming is actually a sign of eptitude -- they intentionally include the signs you look for because you're a waste of their time. They have figured out the precise line to walk where bad marks like you avoid them but easy marks like him engage.
  - Normille 6y ago
    I've heard that's the thinking behind the infamous and infamously 'reeking of scam' Nigerian Prince email scams too. And the fact that people still fall for them shows it's a seemingly a strategy worth pursuing. [But a discussion here on the ridiculously obvious scam that people fall for all the time is probably too off-topic --even for HN!] PS: Upvote for "eptitude". Even if it's not a real word, it ought to be. [And I'm not going to spoil things by looking it up]
    - alextheparrot 6y ago
      Aptitude and ineptitude are the now divergent pair, for your interest. Apt was turned into ept
MichaelApproved 6y ago
> They even know to actually select the 'HTML' content type, which is an extra select input. It's not surprising because spammers write scripts for all sorts of platforms (WordPress, vBulletin, etc.). There's probably no custom code written to attack your site. They detect your platform and use a script from their pre-existing library to post their spam. For realistic usernames, they can just reuse names they've seen on other platforms. Goes the same for emails. Any existing email list could be a source for genuine sounding names. Just throw a couple of numbers at the end of the name and you've got a unique name that a human already came up with.
bonestamp2 6y ago
There's one website I run where we were getting some spam through the "contact us" form. No problem, I'll just install captcha. I looked at the docs and realized it was more effort than I was willing to spend to kill a few spam messages a week. So, I just added an extra input field where the user has to type in "123". No spam since. I thought it was kind of funny how easy it was to defeat the spammers, but on the other hand, there are so many easy targets that it's not worth their effort to try to overcome something so elementary just for our site. Conversely, there are much higher value targets where captcha is very valuable and worth the effort to implement because it is worth it for the abusers to try to defeat them.

nickjj 6y ago

> This has pretty much completely stopped the visible abuse. This process works well but it can also turn away a ton of people from ever joining. I know there's this one product that only offers support through public forums and new accounts need to be reviewed by a moderator and then you're not allowed to post any threads until you've made a few replies to other threads and it's been white listed by a moderator, and then on top of that and you also can't use links until you've met some other criteria. But in order to get proper support it requires linking to large files (videos) that aren't able to be uploaded directly through the forums. It becomes such a pain in the ass to open a support request. It could easily take over a week just to post your question and the worst part about it is the forum software orders posts by date, and your post will be buried on the 8th page before it's visible because it takes your original pre-moderated post date as when it was created.

Demiurge 6y ago
That’s a very good point. I have experienced this myself, but I don’t see another way to stop abuse except tweaking the requirements. It sounds like too many hoops in your example. On our site if the user makes just one relevant comment I instantly promote them. It’s that easy to tell. I wish this deterrent wasn’t justified by walls of spam as the alternative.
- throwaway373438 6y ago
  The model used by https://lobste.rs/about#invitations https://lobste.rs/about#invitations seems to work well. Create a graph.

naveen_ 6y ago

Can we control this to a certain extent by including a Captcha in register page?

Demiurge 6y ago
Yes, somehow captchas gets solved... But yes, I think it helps.
- wtracy 6y ago
  There are third-world sweatshops that solve capchas for a fraction of a penny. I imagine they provide an API, so your bot makes an http call and gets a solution back.
  - mr__y 6y ago
    quick search, and I've found a quote of $1.8 per 1000 recaptchas with average response time of ~10s.
Normille 6y ago
Captchas are the absolute spawn of the devil. Every time I see one on a website, I want to punch the face of the person who invented them, until my fists hurt. Unless I really NEED to use that site, I just go elsewhere, once I get a Captcha shoved in my face.
- zbentley 6y ago
  But why? Seems like anti-abuse is a pretty good reason to use one.
  - Normille 6y ago
    OK. Off the top of my head, some reasons I loathe Captchas: 1: You're working to train for free to train $megacorp's image recognition or OCR algorithms. 2: Even after [what seems like] eleventy billion Captchas and eleventy billion people pointing it out to them, they STILL don't tell you how to do the damned things properly. ie. If you ask me to click on any image with traffic lights, am I supposed to only click the lights?.. or the posts as well?.. what about a square that only has a wee part of one in? Does that count, or not? 3: As above with text based Captchas. Is it case sensitive? Do I have to include spaces between the words? What about the punctuation? Or the fragment of the previous or following word, peeping in at the side? 4: The Captchas never make allowances for the end user's language settings, so I'll often get American terms used, where the thing I'm meant to be identifying isn't called the same in real English. So I'm not 100% sure what I'm looking for. 5: If you have an ad-blocker, you'll usually be asked to solve about three Captchas in a row, thus cubing the annoyance. Thank god for 'Buster' is all I'm going to say! [I'm not going to link to it because the less people know about it the longer it'll keep working].

yvdriess 6y ago

Heavy moderation and a $10 registration barrier is what has kept the SomethingAwful forums around for so long.

Normille 6y ago

It's amazing how some people can't seem to spot a bot/spam post, no matter how obvious. One of the websites I host is for a retired elderly middle-aged academic who pens articles about his former field and invites comment. Almost every week I'll get an email from him along the lines of "Is this worth following up?" and attached will be either a comment reading something like "I love your article. So much good info and useful to me.." or an email from some g3gergergew@gmail.com address saying "We love your site. It has much good infos and is useful but we are notice your CEO could being better..." No matter how many times I tell him to look for the telltale signs... * Random gibberish email from address * Half a dozen links in the comment * Broken English * Generic text which could apply to ANY article or website in the bloody world ...he'll still forward them to me and ask if they're worth getting in contact with. Every time, I'm gobsmacked how he can fall for such inept spamming.

criley2 6y ago
The ineptitude of the spamming is actually a sign of eptitude -- they intentionally include the signs you look for because you're a waste of their time. They have figured out the precise line to walk where bad marks like you avoid them but easy marks like him engage.
- Normille 6y ago
  I've heard that's the thinking behind the infamous and infamously 'reeking of scam' Nigerian Prince email scams too. And the fact that people still fall for them shows it's a seemingly a strategy worth pursuing. [But a discussion here on the ridiculously obvious scam that people fall for all the time is probably too off-topic --even for HN!] PS: Upvote for "eptitude". Even if it's not a real word, it ought to be. [And I'm not going to spoil things by looking it up]
  - alextheparrot 6y ago
    Aptitude and ineptitude are the now divergent pair, for your interest. Apt was turned into ept

MichaelApproved 6y ago

> They even know to actually select the 'HTML' content type, which is an extra select input. It's not surprising because spammers write scripts for all sorts of platforms (WordPress, vBulletin, etc.). There's probably no custom code written to attack your site. They detect your platform and use a script from their pre-existing library to post their spam. For realistic usernames, they can just reuse names they've seen on other platforms. Goes the same for emails. Any existing email list could be a source for genuine sounding names. Just throw a couple of numbers at the end of the name and you've got a unique name that a human already came up with.

bonestamp2 6y ago

There's one website I run where we were getting some spam through the "contact us" form. No problem, I'll just install captcha. I looked at the docs and realized it was more effort than I was willing to spend to kill a few spam messages a week. So, I just added an extra input field where the user has to type in "123". No spam since. I thought it was kind of funny how easy it was to defeat the spammers, but on the other hand, there are so many easy targets that it's not worth their effort to try to overcome something so elementary just for our site. Conversely, there are much higher value targets where captcha is very valuable and worth the effort to implement because it is worth it for the abusers to try to defeat them.