Spambots getting through
 

Do the security procedures for a user account need to be changed? There are just too many spambot user names getting through and I'm sick of having to delete so many.

I'm going to do some research on this. What I don't get is how they are getting past the Captcha that is required when creating a new account. A Captcha is also required anytime you post a link to an external site... This leads me to believe that these aren't spam BOTS but actual individuals logging in to do these spam pages.

Usually a bot comes in, makes a page, and then that's it, but I've noticed a few that keep adding to the same page, even after the page has been cleared and a nuke tag applied. I would think if it were a person, they'd undo the change first.

There are companies that provide captcha solving services specifically for spammers. They charge something like a 75 cents per 1000 they solve, and work they just have a load of people in China solving them all day. Here is an article about them.

We may have to start doing it like big forums or bank pages. They register with an email address. The activation code is sent to the email address and they have to answer a bunch of questions and THEN put in the activation code. That and a CAPTCHA is a pain in the butt, but then it might remove the bots even more. Thoughts?

I know this means a TON of more work for anyone coming up with it and I barely have the time to answer people's queries (mostly I do not). Thoughts.

Looks like we are going to have to go that way MPM it seems that we get enough traffic to warent stricter membership procedures. Alas how things have changed around here.

I may have found a solution. I'm looking into User Rights and there is a way to limit who can create a page. The idea is to prevent new, unconfirmed users from creating a new page while allowing them to still edit existing pages. I would say that 99% of the spam is people creating a new page with a bunch of BS... Thoughts?

Although I haven't been on IMFDB much lately, I have noticed this problem, and I like Zach's suggestion. That being said, it doesn't preclude the possibility of spambots/users replacing page content (and I'm pretty sure I've seen this happen before).

I agree this isn't a cure all... But I think at the very least it is a step int he right directions and it has the change to limit the spam dramatically...

Even if they just replace existing content, that's easier to fix. Any of us can do that.

Update. There is a way to auto-promote members after they have either confirmed their e-mail address or made X number of edits. Until that point, they will not be able to CREATE any page.

How? The one problem is one you've already mentioned - members who are real should be able to create pages. How are they verified (without having one of us do it?) Just curious.

There is a setting built into the software called "$wgAutopromote". I'm going to write a custom script for it that will help us determine who is a real user and who isn't. It is going to take a little time to perfect, but once I get it right it will help significantly.

-Z

I'm in favor of requiring new users to have their edits approved by a moderator before they go on the page. Kind of like how you have the option of reviewing wall posts on facebook before allowing them.

That would be wonderful... Now find a way to actually do that...

If only I personally could, I'm just brainstorming.