Search options (Page 124 of 307)

Smartys wrote:

MattF wrote:

If you modded your installation to use that method, it probably would kill your spam off either completely or to a negligible level. However, was not the point of this thread with regards to including standard spam prevention techniques within PunBB? If, for example, that mod was incorporated within 1.3 when it finally leaves R.C status, the thing would be cracked within a week. It is then not a deviant technology, but a core mainstream one. The fiscal benefit for the bot scripters would mean that it was viable to concentrate on it once that occured.

I wouldn't say cracked, since unless there's a flaw bots shouldn't be able to automatically crack something like the VIP code mod or a question mod. They would need a human to find the code/answer in the first place and THEN they can spam all they want (until it's changed, rinse and repeat).

I agree, but to attack all the forums in the world, searching the answer in each annoucement area or in rules text or elsewhere, or searching an encyclopedia/logical/thematic answer... in all languages? Don't you think spammer need an international army?

With the VIP Code, I hadn't looked at any demos of its implementation. My thought was that if people are simply posting a number/word on register.php, the bots can parse the HTML and get it from there. However, obviously that's not the case there.
So, lets assume automated grabbing of the code is not the issue. Spammers will still use humans to register for them. And the small and medium forums will not be protected: in large forums you're more likely to have an active moderator team that will delete your spam in minutes. The small/medium forums, where the spam lingers for days, are where spammers want to target.
That doesn't mean that the idea is worthless: far from it, I think it would make a wonderful extension. However, I personally think it puts too much of a burden on the admin. Plus, as I've said before, with fighting spam what works for one forum might not necessarily be right for another. A more modular approach helps make that a non-issue.

It is our difference You say "mod"; I think that a real protection to spam *must* be included in the software, as not all users are able to find/do the needed modifications. For a lot of people, even the word (source) "code" is not understandable. Ok, in 1.3 version, open a source file will not be mandatory, it will be easier, but first the current version is 1.2, then even in 1.3 it will be mandatory to search, read, and understand in english forum (here or punres). Do you think that to have a good protection, one must be able to understand english and to edit/modify a source file? It will excludes a large part of the world, and it would be too bad.
Nevertheless, thank you for your responses. And I do not desesperate

this is the only thing that I'd have to reproduce on my side if I wanted to sign up with an invalid email.

//
// Generate a random password of length $len
//
function random_pass($len)
{
    $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';

    $password = '';
    for ($i = 0; $i < $len; ++$i)
        $password .= substr($chars, (mt_rand() % strlen($chars)), 1);

    return $password;
}

when I delete these accounts I research the domains that the emails use, and 100% of them do not exist.   yea they could sign up with one email, sign in, and change it, then post spam, but that type of critical thinking might lead to some sort of progress in the way of fixing the issue and is therefore dangerous.

at the very least, adding logging to the forum for actions like registration, password, and email changing would help narrow down the point of attack, and would allow you to "fix" the area of exploitation.

Just FYI.

There is apparently a very effective yet simple mod that is available for phpBB discussed here:

http://www.phpbb.com/community/viewtopic.php?t=435702

It works by allowing the admin to specify a 'VIP code' or pass-phrase, essentially, that users need to enter when they register. The variability of this across phpBB boards makes it effective against scripted bots.

Judging from the feedback in the thread above, it seems to work well. Some forum admins even report being able to turn off their CAPTCHAs.

It's similar to some of the approaches already discussed here.