ikiwiki/doc/todo/anti-spam_protection.mdwn

The spammers have just found my ikiwiki.  I have my main pages locked but allow open changes to my discussion pages and in the last few days one page in particular has been overwritten by spam about nine times, each edit was from a different IP address.

<http://adam.shand.net/iki/recentchanges/> (sorry for the funny formatting, I upgraded to the latest version and haven't tracked down what changed yet)

I'll probably lock down my discussion pages to require a login of some sort and hopefully that will slow them down.  Is anyone else seeing problems on their wiki? 

As far as techniques for reducing spam I've found the [MoinMoin technique](http://moinmo.in/HelpOnSpam) of refusing to allow page saves with [known spam URLs](http://moinmo.in/BadContent) combined with a group maintained list of URLs to be fairly effective.

Cheers,
[[AdamShand]]

> I have yet to hear of any spammer using openid.. --[[Joey]]


>> Mh.. well. I know this problem, too. I leave the Discussion sites open for no registrations, so that visitors can easily write a comment to this specific blog entry without the need for registration. (This would be the same behaviour, as many blogging engines are using). Maybe it is possible to wrote a plugin that would scan the text which is submitted via spamassassin or something similar. (Using this combined with known spam URLs would maybe reduce the load of the server if there are many webpages which are getting editted by someone). If you like this idea Joey I might be interested to write such a plugin after my exams this and the next month. :) -- [[Winnie]]

You might look at the Wikipedia page on "Spam\_in\_blogs" for more ideas.  In particular, would it be possible to force a subset of the pages (by regex, but you'd choose the regex to match those pages which are publicly writable) to use rel="nofollow" in all links.

> I just wanted to leave a link here to the [[todo/require_CAPTCHA_to_edit]] plugin patch.  Unfortunately that plugin currently interacts badly with the openid plugin. -- [[Will]]


---

Ikiwiki now has a checkcontent hook that plugins can use to see content
that is being entered and check it for spam/whatever.

There is a [[plugins/blogspam]] plugin that uses the blogspam.org service
to check for common spam signatures. --[[Joey]] 

[[done]]

----

I am sorry to say that neither those solutions are sufficient for a site that allows anonymous comments. blogspam lets thousands of commits through here, as i described in [[todo/commandline_comment_moderation]]. Now, maybe I didn't configure blogspam correctly, I am not sure. I just enabled the plugin and set `blogspam_pagespec: postcomment(blog/*) or */discussion`. I have also imported the blocklist from this wiki's ikiwiki.setup, generated from [[spam_fighting]]. I have had to add around 10 IPs to that list already.

It seems to me a list of blocked URLs or blocked IPs as mentionned above would be an interesting solution. blogspam is great, but the API doesn't seem to support reporting IPs or bad content back, which seems to be a major problem in working around false negatives. I'm tempted to just remove the `done` tag above, because this is clearly not fixed for me here... --[[anarcat]]
web commit by http://adam.shand.net/ 2008-02-15 09:59:20 +01:00			`The spammers have just found my ikiwiki. I have my main pages locked but allow open changes to my discussion pages and in the last few days one page in particular has been overwritten by spam about nine times, each edit was from a different IP address.`

			`<http://adam.shand.net/iki/recentchanges/> (sorry for the funny formatting, I upgraded to the latest version and haven't tracked down what changed yet)`

			`I'll probably lock down my discussion pages to require a login of some sort and hopefully that will slow them down. Is anyone else seeing problems on their wiki?`

			`As far as techniques for reducing spam I've found the [MoinMoin technique](http://moinmo.in/HelpOnSpam) of refusing to allow page saves with [known spam URLs](http://moinmo.in/BadContent) combined with a group maintained list of URLs to be fairly effective.`

			`Cheers,`
			`[[AdamShand]]`
response 2008-02-24 21:44:39 +01:00
			`> I have yet to hear of any spammer using openid.. --[[Joey]]`
web commit by PatrickWinnertz: my comment to spam 2008-02-24 22:58:55 +01:00

			>> Mh.. well. I know this problem, too. I leave the Discussion sites open for no registrations, so that visitors can easily write a comment to this specific blog entry without the need for registration. (This would be the same behaviour, as many blogging engines are using). Maybe it is possible to wrote a plugin that would scan the text which is submitted via spamassassin or something similar. (Using this combined with known spam URLs would maybe reduce the load of the server if there are many webpages which are getting editted by someone). If you like this idea Joey I might be interested to write such a plugin after my exams this and the next month. :) -- [[Winnie]]
web commit by http://willu.myopenid.com/: Add note about rel="nofollow" as an anti-spam suggestion 2008-03-25 04:23:52 +01:00
			`You might look at the Wikipedia page on "Spam\_in\_blogs" for more ideas. In particular, would it be possible to force a subset of the pages (by regex, but you'd choose the regex to match those pages which are publicly writable) to use rel="nofollow" in all links.`
2008-08-09 13:05:44 +02:00
			`> I just wanted to leave a link here to the [[todo/require_CAPTCHA_to_edit]] plugin patch. Unfortunately that plugin currently interacts badly with the openid plugin. -- [[Will]]`
blogspam: New plugin, adding spam filtering for page editing / comment posting using the BlogSpam.net API. 2009-01-17 04:39:11 +01:00

			`---`

			`Ikiwiki now has a checkcontent hook that plugins can use to see content`
			`that is being entered and check it for spam/whatever.`

oups! fix link sorry! 2012-11-08 21:27:00 +01:00			`There is a [[plugins/blogspam]] plugin that uses the blogspam.org service`
blogspam: New plugin, adding spam filtering for page editing / comment posting using the BlogSpam.net API. 2009-01-17 04:39:11 +01:00			`to check for common spam signatures. --[[Joey]]`

			`[[done]]`
link to comment moderation and whine 2015-07-23 23:23:56 +02:00
			`----`

			I am sorry to say that neither those solutions are sufficient for a site that allows anonymous comments. blogspam lets thousands of commits through here, as i described in [[todo/commandline_comment_moderation]]. Now, maybe I didn't configure blogspam correctly, I am not sure. I just enabled the plugin and set `blogspam_pagespec: postcomment(blog/) or /discussion`. I have also imported the blocklist from this wiki's ikiwiki.setup, generated from [[spam_fighting]]. I have had to add around 10 IPs to that list already.

			It seems to me a list of blocked URLs or blocked IPs as mentionned above would be an interesting solution. blogspam is great, but the API doesn't seem to support reporting IPs or bad content back, which seems to be a major problem in working around false negatives. I'm tempted to just remove the `done` tag above, because this is clearly not fixed for me here... --[[anarcat]]