6:46 a.m.
Hi,
Yet another spammer wants to be banned from the Wiki. See the
recent changes for details (if you're strong enough for this
kind of stuff).
Arpad Biro
__________________________________
Do you Yahoo!?
The all-new My Yahoo! - Get yours free!
http://my.yahoo.com
7:54 a.m.
The wiki is facing two different types of spammers :
- the ones that create some new pages flooded with spam (current case)
- some others that simply add parasite links/coontent to existing web pages
- and some other replacing the content of some pages with spam
Something interesting, most of the time the parasite content/spam is exactly
the same within a same or different spam campaign. Does anyone know about a
robot/script allowing to do some reverse spam (simply removing some identified
content) ?
Regards,
Matiphas
Selon Arpad Biro <biro_arpad@...36...>:
Hi,
Yet another spammer wants to be banned from the Wiki. See the
recent changes for details (if you're strong enough for this
kind of stuff).
Arpad Biro
__________________________________
Do you Yahoo!?
The all-new My Yahoo! - Get yours free!
http://my.yahoo.com
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Inkscape-devel mailing list
Inkscape-devel(a)lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/inkscape-devel
9:13 a.m.
I have an approach for how to solve this spam problem once and for all,
with a small amount of programming, however I haven't had time to look
into it.
Would someone be able to work on this over the holiday? I doubt it'd
be more than half a dozen lines of Perl coding, so probably could be
done in an afternoon.
The idea is basically to include a second edit box next to the comment
box, with the phrase, "Type NOSPAM here:" [________]
Any edits to a page must be accompanied with that value in the edit box,
else an error message will be returned. If we find spammers start using
this, we change the phrase (or replace it with an image).
The wiki.pl CGI can be checked out of the inkscape_project CVS module.
Can someone with Perl skills volunteer for this task?
Bryce
On Tue, 23 Nov 2004 matiphas@...8... wrote:
The wiki is facing two different types of spammers :
- the ones that create some new pages flooded with spam (current case)
- some others that simply add parasite links/coontent to existing web pages
- and some other replacing the content of some pages with spam
Something interesting, most of the time the parasite content/spam is exactly
the same within a same or different spam campaign. Does anyone know about a
robot/script allowing to do some reverse spam (simply removing some identified
content) ?
Regards,
Matiphas
Selon Arpad Biro <biro_arpad@...36...>:
> Hi,
>
> Yet another spammer wants to be banned from the Wiki. See the
> recent changes for details (if you're strong enough for this
> kind of stuff).
>
>
>
> Arpad Biro
>
>
>
>
> __________________________________
> Do you Yahoo!?
> The all-new My Yahoo! - Get yours free!
> http://my.yahoo.com
>
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://productguide.itmanagersjournal.com/
> _______________________________________________
> Inkscape-devel mailing list
> Inkscape-devel(a)lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/inkscape-devel
>
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Inkscape-devel mailing list
Inkscape-devel(a)lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/inkscape-devel
2:46 p.m.
New subject: Announce: Change to Inkscape Wiki
Everyone,
Due to rampant spammer abuse of the Inkscape wiki, we've been forced to
make a change to its usage.
From now on, whenever you edit a page, you must also type in the word
'NOSPAM' into a new entry box at the bottom of the page. If you do not,
an error message will display; you can click back and add the NOSPAM and
resubmit.
This change will fake out the spammers, because their spambots won't
know to do this step, so will be blocked. Possibly the spammers will
catch on to this defense; if so, we'll invent new countermeasures.
Thanks go to Kees Cook for implementing this for us. :-)
I apologize for the inconvenience of doing this; I know it's a hassle,
but if it eliminates the hassle of having to revert pages and delete
spam in order to use the wiki, I think it will be worth the trade. If
not, and you have an idea for a better solution, please let me know.
Bryce
On Tue, 23 Nov 2004, Kees Cook wrote:
On Tue, Nov 23, 2004 at 04:13:39PM -0800, Bryce Harrington wrote:
> The idea is basically to include a second edit box next to the comment
> box, with the phrase, "Type NOSPAM here:" [________]
>
> Can someone with Perl skills volunteer for this task?
Done!
9:34 p.m.
Maybe instead of text, do what some e-shopping
sites do. Have a pass phrase displayed on an image,
and let the person type that in. Then the pass cannot
be harvested.
Bob
Kees Cook wrote:
On Tue, Nov 23, 2004 at 04:13:39PM -0800, Bryce Harrington wrote:
>The idea is basically to include a second edit box next to the comment
>box, with the phrase, "Type NOSPAM here:" [________]
>
>Can someone with Perl skills volunteer for this task?
>
>
Done!
12:33 a.m.
On Wed, Nov 24, 2004 at 06:34:25AM -0600, Bob Jamison wrote:
Maybe instead of text, do what some e-shopping
sites do. Have a pass phrase displayed on an image,
and let the person type that in. Then the pass cannot
be harvested.
If it comes to that, yeah. The problem is that is hinders any visually
impaired contributors. craigslist.org added "hear this word" links too.
That's more coding, etc, since it requires some added libraries, etc.
We can see how well this works.
--
Kees Cook @outflux.net
1:31 a.m.
On Wed, 24 Nov 2004, Kees Cook wrote:
On Wed, Nov 24, 2004 at 06:34:25AM -0600, Bob Jamison wrote:
> Maybe instead of text, do what some e-shopping
> sites do. Have a pass phrase displayed on an image,
> and let the person type that in. Then the pass cannot
> be harvested.
If it comes to that, yeah. The problem is that is hinders any visually
impaired contributors. craigslist.org added "hear this word" links too.
That's more coding, etc, since it requires some added libraries, etc.
I should also note that the state-of-the-art as far as speech recognition
and OCR is pretty far along, for these purposes anyway, too.
To give you a sense of where CAPTCHA OCR stood a year ago:
http://www.cs.berkeley.edu/~mori/gimpy/gimpy.html
Also, let's not forget the age-old tactic of hooking the back-end of the
spamming tool to a porn site that requests CAPTCHA solutions of its users:
free distributed human labor (and probably far more motivated than your
own users, too).
My point is that fancy verification mechanisms are an arms race we can't
really win, and the fancier or more difficult, the more legitimate users
we would hurt.
I think it's more important that our verifier be unique than that it be
particularly difficult. If spammers can't exploit economies of scale by
utilizing off-the-shelf software, it becomes much less economical for them
to spam us in particular.
-mental
4:25 a.m.
On Wed, Nov 24, 2004 at 11:31:47AM -0500, MenTaLguY wrote:
Also, let's not forget the age-old tactic of hooking the back-end
of the
spamming tool to a porn site that requests CAPTCHA solutions of its users:
free distributed human labor (and probably far more motivated than your
own users, too).
Oh man, that's terrific. Kinda like gathering entropy in a kernel.
--
Kees Cook @outflux.net
4:40 a.m.
On Wed, 24 Nov 2004, MenTaLguY wrote:
My point is that fancy verification mechanisms are an arms race we
can't
really win, and the fancier or more difficult, the more legitimate users
we would hurt.
I think it's more important that our verifier be unique than that it be
particularly difficult. If spammers can't exploit economies of scale by
utilizing off-the-shelf software, it becomes much less economical for them
to spam us in particular.
Agreed. Also, I am only aiming to get 80-90% out of the software, and
count on the Inkscape community for the remaining 10-20%. As long as we
have the tools at our disposal to get rid of the most repetitive,
high-hassle stuff, the rest can be taken care of by just ensuring we
have good participation from Wiki users.
A few weeks ago I met with some Wikipedia editors/admins and asked how
they handled spam in Wikipedia. They said they have some code to
measure time between edits, but beyond that they fish the spam out
manually, the same way we've been doing. They just have a lot more
eyeballs on it.
Anyway, I figure as long as we help keep the hassle of using wiki under
control, we can depend on our community to help maintain it. :-)
Bryce
1:09 a.m.
On Wed, 24 Nov 2004, Bob Jamison wrote:
Maybe instead of text, do what some e-shopping
sites do. Have a pass phrase displayed on an image,
and let the person type that in. Then the pass cannot
be harvested.
I think the text-based verifier should be sufficient: the important thing
is that it should no longer be possible to spam our wiki using
*off-the-shelf* automated tools.
I realize that tools can be customized, but we can always change the form
of the verifier again if countermeasures to it becomes widespread, and I
think most spammers wouldn't see it as worth the effort initially, just
for one wiki.
Additionally, to be effective, an image-based CAPTCHA would need to be
heavily distorted (many spamming tools have OCR), which is really cruel to
folks with less-than-perfect eyesight, or those who are not using
graphical browsers for whatever reason.
I probably fall into both categories somewhat; I wear glasses and have
problems with eyestrain, and it's also not unusual for me to do quick wiki
bits from lynx or w3m rather than hauling out Mozilla. If we adopted an
image-based CAPTCHA I would probably stop posting.
-mental
1:32 a.m.
On Wed, Nov 24, 2004 at 11:09:48AM -0500, MenTaLguY wrote:
bits from lynx or w3m rather than hauling out Mozilla. If we adopted
an
image-based CAPTCHA I would probably stop posting.
Just to check: does this current solution deter you? We need to keep
the wiki usable. :)
--
Kees Cook @outflux.net
10:33 a.m.
MenTaLguY wrote:
On Wed, 24 Nov 2004, Bob Jamison wrote:
>Maybe instead of text, do what some e-shopping
>sites do. Have a pass phrase displayed on an image,
>and let the person type that in. Then the pass cannot
>be harvested.
>
>
I think the text-based verifier should be sufficient: the important thing
is that it should no longer be possible to spam our wiki using
*off-the-shelf* automated tools.
Did everyone catch the hashcash story involving wiki's on Slashdot recently?
Beat Spam Using Hashcash
http://it.slashdot.org/article.pl?sid=04/11/10/1811251&tid=111&ti...
12:25 p.m.
On Wed, 2004-11-24 at 20:33, Jon A. Cruz wrote:
Did everyone catch the hashcash story involving wiki's on
Slashdot recently?
Beat Spam Using Hashcash
http://it.slashdot.org/article.pl?sid=04/11/10/1811251&tid=111&ti...
Ok. Any suggestions how to implement it without requiring the client to
have Javascript?
-mental
5:20 a.m.
A quick update on the wiki situation:
In the past 4 days since the change, spamming has nearly disappeared.
The NOSPAM change has delt a solid blow to the spammers. :-)
However, there has been two cases of spam, to the PastMilestones page,
on Nov 26 and again on the 27th. These were by spammers in the .bn.by
and .bas-net.by domains, both of which are now blocked. Thus, we're not
completely immune. I surmise they may be manually spamming us; this is
good because it is something we can deal with effectively through
administrative actions (banning, etc.)
A number of pages were added on Nov 23 that need to be deleted. Scislac
could you tackle these?
Bryce
On Wed, 24 Nov 2004, Jon A. Cruz wrote:
MenTaLguY wrote:
>On Wed, 24 Nov 2004, Bob Jamison wrote:
>
>
>
>>Maybe instead of text, do what some e-shopping
>>sites do. Have a pass phrase displayed on an image,
>>and let the person type that in. Then the pass cannot
>>be harvested.
>>
>>
>
>I think the text-based verifier should be sufficient: the important thing
>is that it should no longer be possible to spam our wiki using
>*off-the-shelf* automated tools.
>
>
>
Did everyone catch the hashcash story involving wiki's on Slashdot recently?
Beat Spam Using Hashcash
http://it.slashdot.org/article.pl?sid=04/11/10/1811251&tid=111&ti...
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Inkscape-devel mailing list
Inkscape-devel(a)lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/inkscape-devel
9:29 a.m.
would someone be able to give me a link to the Wiki?... it'd be much
more helpful for me to read there rather than ask old uuestions on-list ;)
thanks,
Miriam
--
99% of aliens prefer Earth
--Eminem
www.iriXx.org
www.copyleftmedia.org.uk
2:42 p.m.
Here you go:
http://inkscape.org/cgi-bin/wiki.pl
On Mon, 29 Nov 2004, miriam clinton (iriXx) wrote:
would someone be able to give me a link to the Wiki?... it'd be
much
more helpful for me to read there rather than ask old uuestions on-list ;)
thanks,
Miriam
12:17 a.m.
New subject: web site: Mod Rewrite? [Re: Wiki again]
On Sun, 28 Nov 2004, Bryce Harrington wrote:
Date: Sun, 28 Nov 2004 21:42:28 -0800 (PST)
From: Bryce Harrington <bryce@...260...>
To: "miriam clinton (iriXx)" <iriXx@...568...>
Cc: inkscape <inkscape-devel(a)lists.sourceforge.net>
Subject: Re: [Inkscape-devel] Wiki again
Here you go:
http://inkscape.org/cgi-bin/wiki.pl
Is mod_rewrite available on the webserver? (And ideally mod_spel too)
Is there any chance the webmaster could clean things up so that cgi-bin is
hidden from users?
In case you are wondering why I think this kind of detail is important
Jakob Neilsen provides plenty of reasons and suggestions how to improve
URLs in this article:
http://www.useit.com/alertbox/990321.html
There are other things that could be tweaked to make the site even easier
for users that are geussing at Locations, but mod_spel alone would make a
massive difference.
We have a page at http://inkscape.org/faq.php but nothing at
http://inkscape.org/faq/ or http://inkscape.org/faq.html
The Inkscape website uses the default Apache 404 messages.
It would be good if we could include the search tool on the 404 page,
and a linkback to the front page. Ideally the 404 page would be styled
and have the standards includes like every other page. This is something
I might be able to help with.
http://www.useit.com/alertbox/404_improvement.html
Sincerely
Alan Horkan
Free SVG Clip Art http://OpenClipArt.org
Inkscape, Draw Freely http://inkscape.org
Abiword is Awesome http://abisource.com
3:25 a.m.
New subject: web site: Mod Rewrite? [Re: Wiki again]
On Mon, 29 Nov 2004, Alan Horkan wrote:
> Here you go:
>
> http://inkscape.org/cgi-bin/wiki.pl
Is mod_rewrite available on the webserver? (And ideally mod_spel too)
Is there any chance the webmaster could clean things up so that cgi-bin is
hidden from users?
In case you are wondering why I think this kind of detail is important
Jakob Neilsen provides plenty of reasons and suggestions how to improve
URLs in this article:
http://www.useit.com/alertbox/990321.html
There are other things that could be tweaked to make the site even easier
for users that are geussing at Locations, but mod_spel alone would make a
massive difference.
We have a page at http://inkscape.org/faq.php but nothing at
http://inkscape.org/faq/ or http://inkscape.org/faq.html
The Inkscape website uses the default Apache 404 messages.
It would be good if we could include the search tool on the 404 page,
and a linkback to the front page. Ideally the 404 page would be styled
and have the standards includes like every other page. This is something
I might be able to help with.
http://www.useit.com/alertbox/404_improvement.html
Alan, these all sound like good ideas - why don't you take them on?
I've granted you CVS and shell access.
You can log into your shell account via ssh shell.sf.net. Our stuff is
in /projects/i/in/inkscape.
The website itself is in CVS in the inkscape_web module. Wiki is stored
in the inkscape_project module.
Go ahead and log in and see what can be done. The amount of configuring
that can be done is limited, but it's worth a shot. The 404 error
message replacement is an excellent idea.
Thanks,
Bryce
3:39 a.m.
Still catching up on the 100+ inkscape messages from vacation...
A quick update on the wiki situation:
In the past 4 days since the change, spamming has nearly disappeared.
The NOSPAM change has delt a solid blow to the spammers. :-)
However, there has been two cases of spam, to the PastMilestones page,
on Nov 26 and again on the 27th. These were by spammers in the .bn.by
and .bas-net.by domains, both of which are now blocked. Thus, we're
not
completely immune. I surmise they may be manually spamming us; this
is
good because it is something we can deal with effectively through
administrative actions (banning, etc.)
A number of pages were added on Nov 23 that need to be deleted.
Scislac
could you tackle these?
If they have not been handled yet, will do!
Bryce
4:09 a.m.
allready done last week, but they still appear in history
Selon "Joshua A. Andler" <joshua@...533...>:
Still catching up on the 100+ inkscape messages from vacation...
> A quick update on the wiki situation:
>
> In the past 4 days since the change, spamming has nearly disappeared.
> The NOSPAM change has delt a solid blow to the spammers. :-)
>
> However, there has been two cases of spam, to the PastMilestones page,
> on Nov 26 and again on the 27th. These were by spammers in the .bn.by
> and .bas-net.by domains, both of which are now blocked. Thus, we're
not
> completely immune. I surmise they may be manually spamming us; this
is
> good because it is something we can deal with effectively through
> administrative actions (banning, etc.)
>
> A number of pages were added on Nov 23 that need to be deleted.
Scislac
> could you tackle these?
If they have not been handled yet, will do!
>
> Bryce
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Inkscape-devel mailing list
Inkscape-devel(a)lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/inkscape-devel
3:41 a.m.
I've thought of that; we'll keep that in our back pocket in case this
doesn't work. If spammers are specifically looking at and targetting
our site, that'd be a way to stop them, however I think we're getting
hit by random robots that are striking wiki's in general. If I'm right,
then even this simple change will throw them off.
If not, I've also added Geraud as an admin, so he can catch anything
that gets by this initial block.
Bryce
On Wed, 24 Nov 2004, Bob Jamison wrote:
Maybe instead of text, do what some e-shopping
sites do. Have a pass phrase displayed on an image,
and let the person type that in. Then the pass cannot
be harvested.
Bob
Kees Cook wrote:
>On Tue, Nov 23, 2004 at 04:13:39PM -0800, Bryce Harrington wrote:
>
>
>>The idea is basically to include a second edit box next to the comment
>>box, with the phrase, "Type NOSPAM here:" [________]
>>
>>Can someone with Perl skills volunteer for this task?
>>
>>
>
>Done!
>
>
>
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Inkscape-devel mailing list
Inkscape-devel(a)lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/inkscape-devel
9:20 a.m.
Actually, the easiest thing is for me to deputize a few of y'all to be
wiki admins. If you are willing to take this role, email me offline and
I'll select a couple people and provide the info. Obviously, only ask
if you've been active in Inkscape for a while, and expect to continue to
be keeping an eye on the wiki.
Powers will include page deletion, updating the spammer ban list, and
locking/unlocking pages.
Even if we implement the wiki.pl change, we probably still could use
another couple admins, just in case.
Bryce
On Tue, 23 Nov 2004 matiphas@...8... wrote:
The wiki is facing two different types of spammers :
- the ones that create some new pages flooded with spam (current case)
- some others that simply add parasite links/coontent to existing web pages
- and some other replacing the content of some pages with spam
Something interesting, most of the time the parasite content/spam is exactly
the same within a same or different spam campaign. Does anyone know about a
robot/script allowing to do some reverse spam (simply removing some identified
content) ?
Regards,
Matiphas
Selon Arpad Biro <biro_arpad@...36...>:
> Hi,
>
> Yet another spammer wants to be banned from the Wiki. See the
> recent changes for details (if you're strong enough for this
> kind of stuff).
>
>
>
> Arpad Biro
>
>
>
>
> __________________________________
> Do you Yahoo!?
> The all-new My Yahoo! - Get yours free!
> http://my.yahoo.com
>
>
>
>
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://productguide.itmanagersjournal.com/
> _______________________________________________
> Inkscape-devel mailing list
> Inkscape-devel(a)lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/inkscape-devel
>
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Inkscape-devel mailing list
Inkscape-devel(a)lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/inkscape-devel
6765
days inactive
6772
days old
inkscape-devel@lists.inkscape.org
22 comments
10 participants
participants (10)
-
unknown＠example.com -
Alan Horkan -
Arpad Biro -
Bob Jamison -
Bryce Harrington -
Jon A. Cruz -
Joshua A. Andler -
Kees Cook -
MenTaLguY -
miriam clinton (iriXx)