444826 - spam found on labs forum

Status: RESOLVED FIXED

(Websites :: mozillalabs.com, defect)

Description

[chris hofmann]

reported to [e-mail].   we should get this cleaned off, and figure out captcha or bot protection mechanism.   maybe something along the lines that morgamic is thinking about for addons.mozilla.org


You have a spam profile on your forum at
https://labs.mozilla.com/forum/index.php?action=profile;u=4105

We are receiving form spam (see below) linking to this page.


-----Original Message-----
From: Website [mailto:[e-mail]] 
Sent: Thursday, July 10, 2008 6:29 PM
To: [e-mail]
Subject: Information Request


The following information request has been submitted from the website.

	From:	  Mr. Devidr Devidr
		  	Hello
		  	Home

	Address:  [e-mail]
		  	[e-mail]
		  	mexico, NY	 856414

	Phone:	  [phone]
	Fax:	  [phone]
	E-mail:	  [e-mail]

	INQUIRY:

	Hi! Nice place. My sites:
fake coach purses
discount kitchen cabinets
http://fakecoachpurses.blogs.experienceproject.com/49186.html
https://labs.mozilla.com/forum/index.php?action=profile;u=4105
[url=http://fakecoachpurses.blogs.experienceproject.com/49186.html]fake
coach purses[/url]
[url=https://labs.mozilla.com/forum/index.php?action=profile;u=4105]discount
kitchen cabinets[/url]


	==================== END ====================

Comment 1

[Myk Melez [:myk] [@mykmelez]]

I have removed this user's account, and cbeard has tightened up the account registration process to make it a bit harder to get an account.  We'll want to go through existing accounts and delete other spammers' accounts, though.  There appear to be quite a lot of them.  Leaving this bug open pending that.

Comment 2

[Dan Mills [:thunder]]

Alex, this is a serious problem.  With the new Vanilla forums, the tag cloud on the left is overrun with spam tags!

Comment 3

[Alex Buchanan [:abuchanan]]

I'm adding a reCaptcha to the register form.

If tags aren't important to you, then the simplest solution to a couple problems would be to disable the Discussion Tags extension. (problem 1: recent tags block is clutter, 2: site-wide spam entry in tags)

If tags are important than we can hack out the recent tags block (problem 1) and run a query to delete spam tags, since there is not way to delete them from UI yet.

Comment 4

[Alex Buchanan [:abuchanan]]

recaptcha added in r18580
tagged for prod in r18582

bug filed for push to production

I also decided to turn off discussion tags, cause they're being a pain.

there is an extension to verify membership application by email, but it's in
beta and won't work without modifying the theme.  
http://lussumo.com/addons/index.php?PostBackAction=AddOn&AddOnID=135

If spam problems continue, we can look into more options.

Anything I can do to clear out spam?  e.g. run a delete query on the DB?

Comment 5

[Alex Buchanan [:abuchanan]]

recaptcha is live

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

There are currently 200+ spam posts per day in the forum, can anybody care about this, please?

Comment 7

[Michael Morgan [:morgamic]]

Looks like someone turned down throttling to 3 posts a minute, 5 discussions a minute.  Now we have 2000+ spam messages and the forum needs to be taken offline and the DB needs to be scrubbed.

Short-term we can add reCAPTCHA to discussion creation and comment forms.  I'll post a patch for that shortly.

Long-term we can re-evaluate forum options if it continues to be a problem.

Comment 8

[Michael Morgan [:morgamic]]

Attachment: v1, adds recaptcha to spammer points of entry

Comment 9

[Michael Morgan [:morgamic]]

FYI - I'm having the forum temporarily disabled until Monday afternoon.  Before the 503 is removed:
* db will be sanitized and cleared of spam
* patch adding reCAPTCHA to discussion and comment forms will be checked in and deployed

Comment 10

[Myk Melez [:myk] [@mykmelez]]

The other change that would really help is a super-simple two-click process for deleting an account along with all of its posts and banning the IP address from which the account was registered.

For example, when an administrator is logged in, there could be an delete button next to the names of posters that brought the admin to a page listing all their posts and requesting confirmation of the delete account/delete posts/ban IP address.

Comment 11

[Michael Morgan [:morgamic]]

Yeah, that's essentially what we will have to do manually.  I'll see if I can improve this add-on: http://lussumo.com/addons/index.php?PostBackAction=AddOn&AddOnID=65

That'll be two extensions we've improved... I'll make sure the changes get submitted upstream.

Comment 12

[Michael Morgan [:morgamic]]

There's also some discussion about this:
http://lussumo.com/community/discussion/5238/want-to-be-able-to-delete-users/#Comment_65566

If I can find an extension that deletes user content, I can make the delete user extension stupider and less dangerous.

Comment 13

[Michael Morgan [:morgamic]]

Attachment: query to clean spam

Comment 14

[Michael Morgan [:morgamic]]

Comment on attachment 349712 [details] [diff] [review]
v1, adds recaptcha to spammer points of entry

I'm going to check this in.  Would like to get this taken care of today.

Comment 15

[Michael Morgan [:morgamic]]

r20212

Comment 16

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Resolving fixed, but captchas for logged-in users is suboptimal.