Preventing Spam in 3.0.5 and Lower [*Read First Post*]

krisCrash · Post by **krisCrash** » Wed Jun 03, 2009 7:43 am

So!
Zero bots after adding custom fields + upgrading to 3.0.5 + disabling CAPTCHA, not even the usual 15 signed up bots that fail to activate their accounts daily. These were only a problem for my personal irritation anyway.

bbrunnrman wrote:Meanwhile, regarding your use of the custom "Numbers" field, you ought to edit the language file, as indicated near the end of the Knowledge Base article so the error message doesn't give away the correct answer.

Do you mean if a bot can at some point learn to parse the number out of the error message? Yes you have a big point here. And the text-dropdown question it could get right by trial and error as there are only 2 options. A human I am not worried about, a human spammer WILL be able to answer the current bot questions I have easily

Well, right now I will give it a go and see what happens, tweak things along the way. 99% of bots can't even use an email activation

hbridge55 wrote:I would actually really like to see this feature expanded, when and if it makes it into official distribution. The ability to have two or three questions with mulitple answers (5 or 6?) could make this approach very flexible with the ability to weed out almost all spammers. Users could just get two of three questions (or whatever) correct and be admitted.

Hmm, can the custom profile fields be utilized in such a way? If in the future it is easy to make a question with several incorrect answers, for instance.

QUIV3R · Post by **QUIV3R** » Thu Jun 04, 2009 1:24 am

How do I delete all (1386) users which are bots anyway without painstakingly sifting through every single bot on me forum and deleting them one at a time lol??

also, my URL 'www.sub-merge.org.nz/sublife'.... how do I change the URL to 'www.sub-merge.org.nz' without the forward slash sublife please.

Phil · Post by **Phil** » Thu Jun 04, 2009 2:03 am

Given the size of this topic you'd be much better off posting a new topic to garner support.

dieck · Post by **dieck** » Thu Jun 04, 2009 4:28 pm

Like Kitties? Try my new Asirra POST-intercepting approach.
http://www.phpbb.com/community/viewtopi ... &t=1632005

Seraphic · Post by **Seraphic** » Fri Jun 05, 2009 6:46 pm

QUIV3R wrote:How do I delete all (1386) users which are bots anyway without painstakingly sifting through every single bot on me forum and deleting them one at a time lol??

also, my URL 'www.sub-merge.org.nz/sublife'.... how do I change the URL to 'www.sub-merge.org.nz' without the forward slash sublife please.

Easy, if all the bot users have zero posts, you can do a mass delete of all users with zero (0) posts.
It is what I did to remove the 235 bots from my forum.

tffnguy · Post by **tffnguy** » Fri Jun 05, 2009 8:02 pm

Seraphic wrote:Easy, if all the bot users have zero posts, you can do a mass delete of all users with zero (0) posts.
It is what I did to remove the 235 bots from my forum.

If I did that on my board I'd delete half the active users. If its an informational site there will likely be a ton of people who only read.

vwenberg · Post by **vwenberg** » Mon Jun 15, 2009 4:46 am

You know what would be sweet? If phpBB had more flexibility in banning masks. While phpBB can ban IPs entire octets, banning hostnames isn't as flexible. If phpBB followed the same flexibility as IRC does in banning host masks, it would be much easier to really drill down to a specific part of the network/ISP. While there may be arguments about how well this would actually prevent spam, it is nonetheless an option that administrators should have whether it is used or not. Banning host masks in phpBB is simply not flexible enough to be of any use.

QUIV3R · Post by **QUIV3R** » Tue Jun 16, 2009 4:49 am

Seraphic wrote:
QUIV3R wrote:How do I delete all (1386) users which are bots anyway without painstakingly sifting through every single bot on me forum and deleting them one at a time lol??

also, my URL 'www.sub-merge.org.nz/sublife'.... how do I change the URL to 'www.sub-merge.org.nz' without the forward slash sublife please.
Easy, if all the bot users have zero posts, you can do a mass delete of all users with zero (0) posts.
It is what I did to remove the 235 bots from my forum.

How and where do I delete these bots... Its one thing say what you've done but, you need to be a little more specific as to how you got it done... I can't mind read!

momentum · Post by **momentum** » Tue Jun 16, 2009 4:51 am

ACP->Users tab->Prune Users.

Craig.

QUIV3R · Post by **QUIV3R** » Tue Jun 16, 2009 5:11 am

how do I mass delete worthless bot spam? 3645 posts actually?

momentum · Post by **momentum** » Tue Jun 16, 2009 5:21 am

Delete the BOTs and make sure you have the "delete posts" option checked as well.

Craig.

QUIV3R · Post by **QUIV3R** » Tue Jun 16, 2009 5:27 am

cool thanks... what if I've already deleted the bots without deleting the posts as well... Am'I screwed?

QUIV3R · Post by **QUIV3R** » Tue Jun 16, 2009 5:52 am

Did it by pruning the forums lol

t-p · Post by **t-p** » Tue Jun 23, 2009 11:28 pm

Hi iWisdom,

Excellent summary!

I am testing 3.0.5

All works just fine.

Issue: I tried to implement suggestions recommended in "Custom Profile Fields" knowledge base article.
1. I created two custom profiles exactly as suggested in the article.
2. modified en/ucp.php as suggeste in the article.
3. perged cachy.

But none of the fields appears in the registration. Am I supposed to disable GD for these to show up?

Am I supposed to do something else in addition to the three steps I described above?

p.s.: I also tried without modification to en/ucp.php file. Nothing!

Thanks for help in advance.

--tara

bbrunnrman · Post by **bbrunnrman** » Wed Jun 24, 2009 1:13 am

Hi tara,

I am somewhat amazed that the Knowledge Base article on Custom Profile Fields still hasn't been updated. That article was posted in October 2008, when phbBB 3.0.2 was the current version. Since then, the custom profile field functionality has changed a number of times, with the result that screenshots in the article are out-of-date. For updated settings that work in 3.0.5, see my post at http://www.phpbb.com/community/viewtopi ... 5#p9778455

Meanwhile, once you get your custom fields working, the change to en/ucp.php suggested in the Knowledge Base article is important because it stops the error message from giving away the answer when using the "Numbers" type field. (It's conceivable that a bot could make use of that answer in the error message, although I don't know if any have been programmed to do it yet.)

Also, instead of using exactly the two examples suggested in the Knowledge Base article, it would be helpful to be a little more creative in designing your custom fields. Note that the last paragraph of my post referenced above includes links to two earlier posts - at http://www.phpbb.com/community/viewtopi ... 5#p9659965 and http://www.phpbb.com/community/viewtopi ... 5#p9660415 - that describe simple code changes enabling you to create a custom text field with a single required answer, or custom dropdown box with one correct option instead of one incorrect option.

advertisements