3 ms·

99% of spammers can be stopped simply by IP and email bans. For which I find this one of the best providers of up to date lists... oh, and they have an API I u

by buro9 14y ago

99% of spammers can be stopped simply by IP and email bans. For which I find this one of the best providers of up to date lists... oh, and they have an API I use at registration time: http://www.stopforumspam.com/ http://www.stopforumspam.com/ The last 1%, I let my other users flag, and then I ban them and add their data to the site above. This isn't a big problem anymore, it just sounds like the author hasn't integrated his forum with the site above.

latitude 14y ago
The principal difference is that Stopforumspam is a blacklisting method, and what I described is a whitelisting one. Theirs is an effective approach, and it works great for dedicated forum sites. But I think it's an overkill for simpler setups for two reasons. First, it creates an obvious dependency on an external service. Second, if I want to allow unregistered posting, it leaves me only with an IP address as a data point and here I wouldn't bet that their by-IP detection is too accurate. It's a simple, self-contained, virtually maintenance-free way to detect humans trying to post. I don't argue it's a superior to other methods, but it is simple and it helps simplifying the user experience of real visitors.
- Jhsto 14y ago
  I've been developing this 'invisible-catpcha' thing for a while now, which is basically meant to block bruteforce attacks and spammers alike from posting comments and registering accounts etc. The visual difference to the end-user is - as said - invisible, which obviously should be a good thing. Now that I read your comment I start to wonder would anyone really even use my service, as then their site's spam blocking would be dependent on me? Is there other people ho see it this way?
  - latitude 14y ago
    FWIW I'm pretty sure that my views on external dependencies aren't very common or popular. I think you'd have no problem finding users for your service.
    - moepstar 14y ago
      IMO, this depends - i'm sure quite a few factor this into their decision on using or not but in the end it depends on your reputation being stable/online 99.XX% or being flakey...
  - krapp 14y ago
    Unless you're google, I would much prefer to have something I can read the source code of and install myself.
- deleted 14y ago
  [deleted]
- buro9 14y ago
  But yet, if they are using Google over https, searched the issue there and found your forum... the lack of referrer header on your http site and no other activity for the user would have you falsely identify the user as a spammer. The cost of a false positive is great... you may lose a customer. By adding an email field to your form you'd get to use the blacklist and avoid false positives and the risk of offending an already aggravated customer.
  - latitude 14y ago
    Ah, no. Of course, he's not identified as a spammer. Instead, he is identified as someone who needs to go through additional checks when posting. This can be combined with the stopforumspam check, and that would yield 3 categories of visitors - white, gray and blacklisted. It's just that in my own setups I haven't come across for the need to blacklist people. PS. If they searched the issue, they were presumably having it with my software, so it's quite likely they were on the site before and I can recognize them. That's not to say that direct hits into an appropriate threads from https://google https://google aren't possible. But they aren't that common either.
deleted 14y ago
[deleted]
ck2 14y ago
We use stopforumspam on few large sites. It misses about 50% of the spammers, there are too many fresh IPs for it to know them all. It also does "false positives" in that spammers are now using email addresses from legit users, so an email match alone is no longer good enough (if you don't do email verification). The cookie method described by the post also won't work in the realworld - many times people drop into the very article they are looking for directly from a search engine, read it on the same page, and then leave a comment, so no crawl history.

by buro9 14y ago

latitude 14y ago

The principal difference is that Stopforumspam is a blacklisting method, and what I described is a whitelisting one. Theirs is an effective approach, and it works great for dedicated forum sites. But I think it's an overkill for simpler setups for two reasons. First, it creates an obvious dependency on an external service. Second, if I want to allow unregistered posting, it leaves me only with an IP address as a data point and here I wouldn't bet that their by-IP detection is too accurate. It's a simple, self-contained, virtually maintenance-free way to detect humans trying to post. I don't argue it's a superior to other methods, but it is simple and it helps simplifying the user experience of real visitors.

Jhsto 14y ago
I've been developing this 'invisible-catpcha' thing for a while now, which is basically meant to block bruteforce attacks and spammers alike from posting comments and registering accounts etc. The visual difference to the end-user is - as said - invisible, which obviously should be a good thing. Now that I read your comment I start to wonder would anyone really even use my service, as then their site's spam blocking would be dependent on me? Is there other people ho see it this way?
- latitude 14y ago
  FWIW I'm pretty sure that my views on external dependencies aren't very common or popular. I think you'd have no problem finding users for your service.
  - moepstar 14y ago
    IMO, this depends - i'm sure quite a few factor this into their decision on using or not but in the end it depends on your reputation being stable/online 99.XX% or being flakey...
- krapp 14y ago
  Unless you're google, I would much prefer to have something I can read the source code of and install myself.
deleted 14y ago
[deleted]
buro9 14y ago
But yet, if they are using Google over https, searched the issue there and found your forum... the lack of referrer header on your http site and no other activity for the user would have you falsely identify the user as a spammer. The cost of a false positive is great... you may lose a customer. By adding an email field to your form you'd get to use the blacklist and avoid false positives and the risk of offending an already aggravated customer.
- latitude 14y ago
  Ah, no. Of course, he's not identified as a spammer. Instead, he is identified as someone who needs to go through additional checks when posting. This can be combined with the stopforumspam check, and that would yield 3 categories of visitors - white, gray and blacklisted. It's just that in my own setups I haven't come across for the need to blacklist people. PS. If they searched the issue, they were presumably having it with my software, so it's quite likely they were on the site before and I can recognize them. That's not to say that direct hits into an appropriate threads from https://google https://google aren't possible. But they aren't that common either.

deleted 14y ago

[deleted]

ck2 14y ago

We use stopforumspam on few large sites. It misses about 50% of the spammers, there are too many fresh IPs for it to know them all. It also does "false positives" in that spammers are now using email addresses from legit users, so an email match alone is no longer good enough (if you don't do email verification). The cookie method described by the post also won't work in the realworld - many times people drop into the very article they are looking for directly from a search engine, read it on the same page, and then leave a comment, so no crawl history.