quoting_mungo
Well-Known Member
Working on it, kiddos. But I can only click buttons so fast.
Why do we keep being raided by bots?
- Thread starter Azrion/Zhalo
- Start date
Azrion/Zhalo
The Felynes have arisen!
Yay!
Ricky
Well-Known Member
This site has a lot of exposure for web crawlers.
It has safeguards for Tor, but I'm not sure what is in place for the internet in general.
IIRC, it was a word guess during registration, IDK if that is sufficient.
My guess would be it's bots with a simple latency, I am 98% sure that is the case.
The other problem is there are no active members with permissions to be able to respond when this happens.
It has safeguards for Tor, but I'm not sure what is in place for the internet in general.
IIRC, it was a word guess during registration, IDK if that is sufficient.
My guess would be it's bots with a simple latency, I am 98% sure that is the case.
The other problem is there are no active members with permissions to be able to respond when this happens.
Simo
Professional Watermelon Farmer
Huh, but Tor hasn't been a popular comic book hero in ages, as far as I know. Plus, would he want here? Plus, he's on the prehistoric side, I dunno if he'd even know about the inter-webs. I guess it is good to safeguard against him, though, just in case.
Ricky
Well-Known Member
No, I don't think so.
It probably should, and maybe even posts in general up to a certain number of posts, at least.
Ricky
Well-Known Member
Geeze, MORE??? >.<
Even a simple regexp for thread titles with obfuscated URL's in them, or % characters in that UTF-8 range.
People don't usually post threads in Chinese here.
It looks like most just add whitespace to obfuscate the URL.
I'm not behind the wheel, so I can't look at patterns of IP's, posts, etc. but it all looks like a common source and should be pretty easy remediation.
Even a simple regexp for thread titles with obfuscated URL's in them, or % characters in that UTF-8 range.
People don't usually post threads in Chinese here.
It looks like most just add whitespace to obfuscate the URL.
I'm not behind the wheel, so I can't look at patterns of IP's, posts, etc. but it all looks like a common source and should be pretty easy remediation.
Multoran
Active Member
Our lord, Cthulhu, is punishing us for our wicked ways!
We must repent!
Take your children, and your children's children, and slit their throats upon the beaches!
Take your neighbor's children, and have your way with them, spilling your seed into the oceans!
Do this, and Cthulhu shall forgive all your sins and your wicked transgressions!
Repent!
We must repent!
Take your children, and your children's children, and slit their throats upon the beaches!
Take your neighbor's children, and have your way with them, spilling your seed into the oceans!
Do this, and Cthulhu shall forgive all your sins and your wicked transgressions!
Repent!
reptile logic
An imposter among aliens.
Thanks for your efforts. It's not only a task that I'm not capable of doing (moderator/admin) but one I would be reluctant to do. Your efforts are appreciated.
ArielMT
'Net Help Desk
Senior Member permissions got screwed up in the database migration. I had to post a help thread about the edit link in order to get it back.
TidesofFate
Your friendly neighborhood Executioner
Can we motivate you to go faster?
Wolveon
I swear I will not kill anyone
Maybe he's mad someone stole his OC, even though he said not to steal it.Maybe because Kim Jong Un is a closet furry, and frustrated he can't make friends?
Pillownose
New Member
will that be enough though?!
Saiko
GTWT Survivor
Yeah, they're gonna have to add CAPTCHAs and probably timers to thread creation and posting. As is, you could create ten accounts from ten different IPs and then use Selenium or perhaps curl with a spoofed user agent to send out spam. The only things I know of that distinguish the spam accounts from real ones in this scenario would be post content and post frequency. The current protections would be (and have been) completely useless.
I suggest a CAPTCHA for thread creation, a timer for consecutive posting, and a mechanism for flagging accounts which trigger those breaks many times in rapid succession. That flag might also automatically hide the account and all its posts pending moderator review.
Azrion/Zhalo
The Felynes have arisen!
As it is right now, I'm having to constantly block these shitheads plaguing the forums with their Korean bullshit or whatever it is.
speedactyl
Eccentric Friendly Aviator
I could suggest a bit of modification to the login/signup page but would the members want to take the extra effort to login. I know some forums review register new members.
Saiko
GTWT Survivor
The security hole isn't in account creation, though. It's in thread creation. Once you have the confirmation email and browser cookie, the gate's wide open.
speedactyl
Eccentric Friendly Aviator
would captcha work on thread creation?
Ozriel
Inglorious Bastard
Perhaps, but to make it stronger it should be relevant to the site instead of a bunch of jumbled numbers and letters. Bots can and already have figured out to bypass it.
That hurt to read
Popular site and sign up requires no authentication.
Then again authentication is pretty useless since F4L's "authentication" is easily passed by writing generic shit and filling everything else with "In edit"
Zipline
Noodle Fish
I was not aware that kim also enjoys shipping huskies and Doraemon. Such a naughty dictator.