Death to Link Spammers!

[Igm]

I don't see why we shouldn't start sifting through accounts right away... I'm currently looking at "our newest user", "Paydaybess" who is obviously a spambot, and wonder why don't we do anything about it... Actual new accounts don't appear every day, so some the sifting could even be done manually at this stage... Any idea how to get your hands on that sourcecode?

[Dutch_man]

You also can -just like on other websites when registering- ask the new user to retype a deformed code that spambots can't read...

[ScottyDM]

Originally Posted by Dutch_man

You also can -just like on other websites when registering- ask the new user to retype a deformed code that spambots can't read...

We do that now -- but either because of a possible flaw in the way vBulletin passes the expected answer between page 3 and page 4 of the signup process, or because one of the leading professional spam-bot tools has a really, really good method of recognizing distorted characters -- bots are still able to create accounts. Yep, you read that right, some bots can read some captchas.

Besides playing Whack-A-Mole here at TF Central, I'm hand coding a my own system at one of my websites for a user account creation and login system. My needs are different than a typical forum, which is why I've not simply downloaded and installed something like vBulletin or one of their competitors.

The proper way to think about the problem of separating the silicon-based site visitors from the carbon-based, becomes hampered when we limit ourselves to thinking "captcha". It really is a Turing test, in the fullest sense of the word. I feel the proper approach is that the test starts from the moment the visitor downloads their first page, continues through the signup process, then ends when they logoff and leave. A captcha is only one factor, and I'd even pass someone who only got close on that particular test -- say 5 out of 6 characters.

Like a bank deciding whether or not to give someone a loan, the process produces a score based on a plethora of factors. If your score is high enough you can have instant access, if it's intermediate your account is passed to a moderator for review, and if it's too low your account is simply tossed.

This is interesting... While researching techniques, I found several methods to penetrate the masking a proxy server does, and can even give you the private IP address of someone behind a router or firewall set up in NAT configuration. Now there are several types of proxy server and the technique is worthless against true anonymizing proxies, but there aren't that many of those and they tend to stay up at a particular IP for awhile. This could make the IP filtering of the public IP address for proxies practical.

Finally, we don't really have any rules against having a bot as a member here. Some things should go without saying, such as you shouldn't shout through a bullhorn in a grocery store, but some people seem to lack common sense so we need to spell it out. In writing Terms of Service for my site I've come up with a couple of rules that might be useful here:

Originally Posted by ToS

Terms of Service

Please read and understand all parts of this section before you sign up for an account. If you think some of this does not apply to you, we'll both be unhappy.

Membership Restrictions

Membership in {site name} is only open to natural persons. It is not open to corporations, trusts, AIs, bots, or automated programs. You should not share an account with another person. I reserve the right to refuse an account to anyone.

You may only have one account on {site name}. There should be enough flexibility in redefining almost every aspect of that account so opening a new account should never be necessary, and it isn't necessary that you use your legal name when applying for an account. However, if you still feel the need to create a new account, contact a manager first: {manager name}{link} (manager).

Persons sharing an account, except in the case of COPPA accounts, or attempting to open multiple accounts may have all their accounts deleted and be banned from the system.

Permanent accounts only deleted on request. Contact a manager for help.

...

Spamming

Link spamming is act of posting links on forums, guest books, blogs, and other websites that allow visitor-posted content, for the purpose of advertising the linked-to site. Link spamming is not tolerated. Here's an interesting article at The Register {link}.

You may post links on your profile page if they are personal in nature and/or applicable to the subject of {site name}. But, for example, if you have a small business selling toner cartridges online then a link to that site is not appropriate.

If you wish a public link on our Links page, then see the rules there {link}.

E-mail spamming is the sending of unsolicited commercial/bulk e-mail, also known as UCE/UBE, although some will define spam as any e-mail they didn't want. You may not send spam through {site name}'s contact system and you may not attempt to harvest e-mail addresses from {site name}'s website. You may not use {site name}'s contact system to harass or intimidate others.

I reserve the right to take appropriate action against any member who violates the no spamming rules, and I cooperate with the legal authorities. See: Response to Legal Demands {link}, below.

...

Food for thought.

Scotty

[DogBoy]

isn't the entire point of the number verification part at the end of the application to keep bots from signing up for stuff like this???

[ScottyDM]

Exactly so, DogBoy. But it does not work!

Link spamming is a big business and there is professional link spamming software which claims to be able to automatically read and respond to the distorted text in captchas.

If link spamming were limited to people saying, "Come look at my cool website," (and the site is off topic) it might be annoying, but I could live with it. If the poster is on topic then it becomes a service. For example some of our members keep us up to date on the status of their websites.

However, link spamming is a business. Professional link spammers charge real money to a client to splatter links to the client's website across thousands or tens of thousands of sites that offer public posting. The spammer gets money and the site owner and users get to deal with the ugly problem. It's not much different than gang members tagging the side of someone's building--at least in terms of ugliness. Some sites are so hammered with link spam that the forum, or blog, or whatever becomes useless. The link spammer is not necessarily looking for site visitors to follow the link, but they are targeting the search engine spiders. Link spamming is sold on the basis that it will raise the client's page rank.

Sux, eh?

Scotty