5 ms·

The easiest way to do it in my experience is to write your own simple forum software. This should only be a few hours work in a framework and will have the adde

by jiggy2011 14y ago

The easiest way to do it in my experience is to write your own simple forum software. This should only be a few hours work in a framework and will have the added bonus of being more specialised to your needs and probably simpler to use. If it's a small forum you probably don't need any actual moderation features (stuff you do need you can do through a scaffolding interface). Bots seem to be attracted to phpBBs like flies to shit so not being fingerprinted is a huge bonus. Also helps to do weird stuff, like instead of having a <input type="submit" /> for a form submit use an IMG tag with an onclick that reads data from the form fields in the most roundabout way possible. Also make the URL of each thread change when there is a post so it makes it harder for the bots to tell if their posts are working or not. Better yet don't display the results on the post on the site itself for 30 seconds or so but use JS to make them appear to the submitting user. Some of those tricks can of course hurt usability and accessability though but I managed to reduce spam to 0 on one forum.

alxndr 14y ago
"Some of those tricks can of course hurt usability and accessability though but I managed to reduce spam to 0 on one forum." Did the number of non-spam posts also get to 0? </snark> Sorry, had to.
- jiggy2011 14y ago
  Nope, it increased because people actually started to use the forum :)
citricsquid 14y ago
The sort of forums you're talking about won't be what spammers really care about. If they can hit a small forum with no work needed they may as well but the targets that they'll work for are the high traffic forums that can't sacrifice usability, SEO or accessibility in any meaningful way to stop spam. If you want to stop spam on a small forum you don't need to break usability because nobody is going to spend time looking at how you're doing things to get around your spam prevention.
- jiggy2011 14y ago
  I suppose it depends upon how sophisticated the spam bots you are dealing with are and whether they have human assistance. We originally used phpBB and applied various anti-spam plugins, including some modifications that were made manually to the php code (including honeypot fields that were hidden with CSS) but the bots kept spamming it regardless. I guess there is a sense of "we know this is a phpBB therefor we must be able to spam it so keep trying" vs "I don't know what this is","can I POST this form and see instant results?","no?","give up then". If it had been a larger forum then I'm sure these tactics would not have been effective regardless since we would have suddenly become worthy of having a custom spam bot written just for us. Those tactics are somewhat extreme, in many cases just giving form fields weird names has good results. Of course there is the problem of "what is bad for spam bots can be bad for screen readers".
krapp 14y ago
I've tried having forms generated by javascript over a honeypot, and hashing the field names to make them impossible to memorize. I don't know yet how effective those would be but i'm sure people are going to complain about the js forms.
- jiggy2011 14y ago
  Depends on your audience, the HN crowd definitely would. Doing weird stuff like <IMG /> instead of submit buttons will hurt people who use keyboard shortcuts so this is an area where having a less tech savvy audience can be an advantage since they will use the mouse for everything.
  - krapp 14y ago
    It's already bitten me because I can't use a password manager to login to my own admin panel. Still though there is something to be said for your forms not having a static fingerprint maybe. Nothing can be done about targeted attacks I think, besides not being worth the effort, or having moderators and constantly adapting. I wonder how much randomness you can introduce into the posting process, though, before it's no longer worth the effort. Add a csrf value to the form action? Rearrange the order of the fields? Add a captcha based on an average of the edit distance of an IP's previous posts, with a random threshold?
    - jiggy2011 14y ago
      CSRF won't usually work unless the spam bot is dumb enough to try and change the token. They usually won't touch hidden fields, the things they like most are <textarea />. Doubt re-ordering would make much difference either since they probably work on field names and tags. CAPTCHA can work but you need a difficult one which will also be difficult for humans. Plus spammers can outsource captcha breaking to humans via injecting them into free porn/torrent/movie sites (solve the captcha to get the content) or just by paying someone in india a few cents.
      - krapp 14y ago

alxndr 14y ago

"Some of those tricks can of course hurt usability and accessability though but I managed to reduce spam to 0 on one forum." Did the number of non-spam posts also get to 0? </snark> Sorry, had to.

jiggy2011 14y ago
Nope, it increased because people actually started to use the forum :)

citricsquid 14y ago

The sort of forums you're talking about won't be what spammers really care about. If they can hit a small forum with no work needed they may as well but the targets that they'll work for are the high traffic forums that can't sacrifice usability, SEO or accessibility in any meaningful way to stop spam. If you want to stop spam on a small forum you don't need to break usability because nobody is going to spend time looking at how you're doing things to get around your spam prevention.

jiggy2011 14y ago
I suppose it depends upon how sophisticated the spam bots you are dealing with are and whether they have human assistance. We originally used phpBB and applied various anti-spam plugins, including some modifications that were made manually to the php code (including honeypot fields that were hidden with CSS) but the bots kept spamming it regardless. I guess there is a sense of "we know this is a phpBB therefor we must be able to spam it so keep trying" vs "I don't know what this is","can I POST this form and see instant results?","no?","give up then". If it had been a larger forum then I'm sure these tactics would not have been effective regardless since we would have suddenly become worthy of having a custom spam bot written just for us. Those tactics are somewhat extreme, in many cases just giving form fields weird names has good results. Of course there is the problem of "what is bad for spam bots can be bad for screen readers".

krapp 14y ago

I've tried having forms generated by javascript over a honeypot, and hashing the field names to make them impossible to memorize. I don't know yet how effective those would be but i'm sure people are going to complain about the js forms.

jiggy2011 14y ago
Depends on your audience, the HN crowd definitely would. Doing weird stuff like <IMG /> instead of submit buttons will hurt people who use keyboard shortcuts so this is an area where having a less tech savvy audience can be an advantage since they will use the mouse for everything.
- krapp 14y ago
  It's already bitten me because I can't use a password manager to login to my own admin panel. Still though there is something to be said for your forms not having a static fingerprint maybe. Nothing can be done about targeted attacks I think, besides not being worth the effort, or having moderators and constantly adapting. I wonder how much randomness you can introduce into the posting process, though, before it's no longer worth the effort. Add a csrf value to the form action? Rearrange the order of the fields? Add a captcha based on an average of the edit distance of an IP's previous posts, with a random threshold?
  - jiggy2011 14y ago
    CSRF won't usually work unless the spam bot is dumb enough to try and change the token. They usually won't touch hidden fields, the things they like most are <textarea />. Doubt re-ordering would make much difference either since they probably work on field names and tags. CAPTCHA can work but you need a difficult one which will also be difficult for humans. Plus spammers can outsource captcha breaking to humans via injecting them into free porn/torrent/movie sites (solve the captcha to get the content) or just by paying someone in india a few cents.
    - krapp 14y ago