www.digitalmars.com         C & C++   DMDScript  

digitalmars.D - Spam attack on the Wiki

reply "Marc =?UTF-8?B?U2Now7x0eiI=?= <schuetzm gmx.net> writes:
Could one of the Wiki admins have a look, please? There is a spam 
attack ongoing on wiki.dlang.org. Nothing massive, just a handful 
of pages so far, but better to stop it. Thanks!
Aug 11 2014
next sibling parent reply "H. S. Teoh via Digitalmars-d" <digitalmars-d puremagic.com> writes:
On Mon, Aug 11, 2014 at 08:23:13AM +0000, via Digitalmars-d wrote:

 Could one of the Wiki admins have a look, please? There is a spam
 attack ongoing on wiki.dlang.org. Nothing massive, just a handful of
 pages so far, but better to stop it. Thanks!


Also, looking at the recent changes log, it seems the spammer has been
registering a whole bunch of spam accounts over the past few days. Most
of them look rather spammy, though it's hard to say whether some of them
are actually legit. Perhaps there's a way to tell based on server logs?


T

-- 
The best compiler is between your ears. -- Michael Abrash
Aug 11 2014
parent reply Orvid King <blah38621 gmail.com> writes:
On 8/11/2014 9:17 AM, H. S. Teoh via Digitalmars-d wrote:

 On Mon, Aug 11, 2014 at 08:23:13AM +0000, via Digitalmars-d wrote:

 Could one of the Wiki admins have a look, please? There is a spam
 attack ongoing on wiki.dlang.org. Nothing massive, just a handful of
 pages so far, but better to stop it. Thanks!


 Also, looking at the recent changes log, it seems the spammer has been
 registering a whole bunch of spam accounts over the past few days. Most
 of them look rather spammy, though it's hard to say whether some of them
 are actually legit. Perhaps there's a way to tell based on server logs?


 T


I noticed one of these about a week ago, is there any way currently to 
mark a page for review by an admin and eventually deletion?
Aug 11 2014
parent "Marc =?UTF-8?B?U2Now7x0eiI=?= <schuetzm gmx.net> writes:
On Monday, 11 August 2014 at 18:02:19 UTC, Orvid King wrote:

 On 8/11/2014 9:17 AM, H. S. Teoh via Digitalmars-d wrote:

 On Mon, Aug 11, 2014 at 08:23:13AM +0000, via Digitalmars-d 
 wrote:

 Could one of the Wiki admins have a look, please? There is a 
 spam
 attack ongoing on wiki.dlang.org. Nothing massive, just a 
 handful of
 pages so far, but better to stop it. Thanks!


 Also, looking at the recent changes log, it seems the spammer 
 has been
 registering a whole bunch of spam accounts over the past few 
 days. Most
 of them look rather spammy, though it's hard to say whether 
 some of them
 are actually legit. Perhaps there's a way to tell based on 
 server logs?


 T


 I noticed one of these about a week ago, is there any way 
 currently to mark a page for review by an admin and eventually 
 deletion?


MediaWiki supports "flagged revision" [1]. This extension can 
make changes to articles invisible to non-logged-in users, as 
long as they have not been acknowledged by a group of privileged 
users (for example, any logged-in user).

But I don't think it is necessary. Up until now, there wasn't a 
lot of spam on the Wiki. It's probably fine to remove it manually 
when it appears.

[1] https://www.mediawiki.org/wiki/Extension:FlaggedRevs
Aug 12 2014
prev sibling parent reply "Vladimir Panteleev" <vladimir thecybershadow.net> writes:
On Monday, 11 August 2014 at 08:23:15 UTC, Marc Schütz wrote:

 Could one of the Wiki admins have a look, please? There is a 
 spam attack ongoing on wiki.dlang.org. Nothing massive, just a 
 handful of pages so far, but better to stop it. Thanks!


The CAPTCHAs in use on the forum and wiki successfully block all 
of the fully-automated spam coming from spam-bots. However, 
unfortunately, they are not very effective against humans who are 
paid to post spam by hand (usually low-paid workers from 
developing countries).

During registration or when adding new links to external sites, 
the D Wiki would ask for one of two questions:

* Who is the creator of the D programming language?
* Who is the author of the book "The D Programming Language"?

The idea was to have questions with non-obvious answers, which 
would be obvious to experienced D users, Google-able for others, 
but still presenting too much of a bother for spammers. 
Unfortunately, as we've seen, this has turned out to be not 
enough.

I've now implemented a new CAPTCHA for the D wiki, which 
challenges would-be editors with randomly-generated questions (so 
that they are not Google-able). Basic programming knowledge is 
required for all of them, and some require some familiarity with 
D syntax. Hopefully, this should still be inclusive enough for 
most editors.

You can demo the CAPTCHA on the following page, so you don't have 
to clutter the wiki with test accounts or edits:

http://wiki.dlang.org/extensions/DCaptcha/demo.php

Source code:

https://github.com/CyberShadow/dcaptcha

https://github.com/CyberShadow/DCaptcha-MW (MediaWiki adapter)

Pull requests for more challenges are welcome. I plan to 
integrate the CAPTCHA into DFeed (forum.dlang.org) as well.
Aug 12 2014
next sibling parent reply "H. S. Teoh via Digitalmars-d" <digitalmars-d puremagic.com> writes:
On Tue, Aug 12, 2014 at 10:25:34PM +0000, Vladimir Panteleev via Digitalmars-d
wrote:
[...]

 I've now implemented a new CAPTCHA for the D wiki, which challenges
 would-be editors with randomly-generated questions (so that they are
 not Google-able). Basic programming knowledge is required for all of
 them, and some require some familiarity with D syntax. Hopefully, this
 should still be inclusive enough for most editors.
 
 You can demo the CAPTCHA on the following page, so you don't have to
 clutter the wiki with test accounts or edits:
 
 http://wiki.dlang.org/extensions/DCaptcha/demo.php


Wow. :-O  This is truly impressive. Could this be the beginnings of a
Turing Test? :-P (Or anti-Turing test, since ostensibly a machine
equipped with a D interpreter would be able to find the answers faster
than a human can. :-P)



 Source code:
 
 https://github.com/CyberShadow/dcaptcha
 
 https://github.com/CyberShadow/DCaptcha-MW (MediaWiki adapter)
 
 Pull requests for more challenges are welcome. I plan to integrate the
 CAPTCHA into DFeed (forum.dlang.org) as well.


Very nice! I'll see if I can cook up a few challenges.

OTOH, are these tests triggered only when the wiki/forum post contains
suspicious content (like links to questionable sites)? We wouldn't want
to discourage legit participation by forcing everyone to solve
programming puzzles every time they try to contribute / ask something.
We definitely don't want to turn newbies off by making challenges that
require too much in-depth knowledge of D.


T

-- 
"You know, maybe we don't *need* enemies." "Yeah, best friends are about all I
can take." -- Calvin & Hobbes
Aug 12 2014
next sibling parent "Vladimir Panteleev" <vladimir thecybershadow.net> writes:
On Tuesday, 12 August 2014 at 22:56:16 UTC, H. S. Teoh via 
Digitalmars-d wrote:

 OTOH, are these tests triggered only when the wiki/forum post 
 contains
 suspicious content (like links to questionable sites)? We 
 wouldn't want
 to discourage legit participation by forcing everyone to solve
 programming puzzles every time they try to contribute / ask 
 something.
 We definitely don't want to turn newbies off by making 
 challenges that
 require too much in-depth knowledge of D.


Yes. As I understand, the CAPTCHA will only be triggered:

1. On registration;
2. After several failed login attempts;
3. When adding links to external sites.

Registered users can bypass CAPTCHAs by confirming their email 
address.
Aug 12 2014
prev sibling parent reply "Kagamin" <spam here.lot> writes:
On Tuesday, 12 August 2014 at 22:56:16 UTC, H. S. Teoh via 
Digitalmars-d wrote:

 We definitely don't want to turn newbies off by making 
 challenges that
 require too much in-depth knowledge of D.


dpaste should make it less challenging for newbies.
Aug 13 2014
parent reply "H. S. Teoh via Digitalmars-d" <digitalmars-d puremagic.com> writes:
On Wed, Aug 13, 2014 at 03:06:25PM +0000, Kagamin via Digitalmars-d wrote:

 On Tuesday, 12 August 2014 at 22:56:16 UTC, H. S. Teoh via Digitalmars-d
 wrote:

We definitely don't want to turn newbies off by making challenges
that require too much in-depth knowledge of D.


 
 dpaste should make it less challenging for newbies.


And spammers. :-(

Although, if they have to do *that*, perhaps it's troublesome enough to
serve as a deterrent.


T

-- 
Life is unfair. Ask too much from it, and it may decide you don't
deserve what you have now either.
Aug 13 2014
parent reply "Vladimir Panteleev" <vladimir thecybershadow.net> writes:
On Wednesday, 13 August 2014 at 15:24:51 UTC, H. S. Teoh via 
Digitalmars-d wrote:

 On Wed, Aug 13, 2014 at 03:06:25PM +0000, Kagamin via 
 Digitalmars-d wrote:

 On Tuesday, 12 August 2014 at 22:56:16 UTC, H. S. Teoh via 
 Digitalmars-d
 wrote:

We definitely don't want to turn newbies off by making 
challenges
that require too much in-depth knowledge of D.


 
 dpaste should make it less challenging for newbies.


 And spammers. :-(


You still need to know:

1. that DPaste exists;
2. what DPaste does;
3. how to write a program which prints the return value of a 
given function.
Aug 13 2014
parent "H. S. Teoh via Digitalmars-d" <digitalmars-d puremagic.com> writes:
On Wed, Aug 13, 2014 at 07:40:58PM +0000, Vladimir Panteleev via Digitalmars-d
wrote:

 On Wednesday, 13 August 2014 at 15:24:51 UTC, H. S. Teoh via Digitalmars-d
 wrote:

On Wed, Aug 13, 2014 at 03:06:25PM +0000, Kagamin via Digitalmars-d wrote:

On Tuesday, 12 August 2014 at 22:56:16 UTC, H. S. Teoh via Digitalmars-d
wrote:

We definitely don't want to turn newbies off by making challenges
that require too much in-depth knowledge of D.


dpaste should make it less challenging for newbies.


And spammers. :-(


 
 You still need to know:
 
 1. that DPaste exists;
 2. what DPaste does;
 3. how to write a program which prints the return value of a given function.


True.

And if a spammer is willing to go through all that trouble to learn D,
then perhaps he will reform his ways. :-P


T

-- 
MACINTOSH: Most Applications Crash, If Not, The Operating System Hangs
Aug 13 2014
prev sibling parent Walter Bright <newshound2 digitalmars.com> writes:
On 8/12/2014 3:25 PM, Vladimir Panteleev wrote:

 I've now implemented a new CAPTCHA for the D wiki, which challenges would-be
 editors with randomly-generated questions (so that they are not Google-able).
 Basic programming knowledge is required for all of them, and some require some
 familiarity with D syntax. Hopefully, this should still be inclusive enough for
 most editors.


This is actually quite an awesome idea!
Aug 13 2014