Here's a re-post of what I posted in the soon-to be deleted thread:
Quote:
Originally Posted by DampRobot
Here's an idea, verify that all new accounts are humans by adding an image verification thingy?
|
I would be surprised if they don't already, as they require one for every search if you are not logged in.
Quote:
Originally Posted by Koko Ed
A better one would be track these jerks down by their IP address and zapping their computers into oblivion so they can't terrorize anyone else with their useless nonsense!
|
I agree. Minus the zapping and oblivion business.
A thought experiment: the problem becomes that the spammer will simply look at the image verification for the bot account they set up; e.g., do it manually. Also, to evade IP address detection, wouldn't they just go to some other public network?
Security-wise, every measure you take is breakable – take hashing, for example. Even though it's designed to be a one-way street with next-to-zero odds of collision, breaking them is still possible. However, it is designed to only brake under an insane amount of computational effort and expenditure of resources.
The problem with the current methods used to prevent bots is that they are all easily defeated with a small cost in resources – it takes a minute for the spammer to write down the image verification. IP address blacklisting is perhaps an order of magnitude harder to break – it probably takes, on average, 40 minutes to get to a local library plus the cost in time to generate an account. You could improve this by adding a cookie to the browser that generated the post the next time they come to CD (with a nice, graciously professional ban message, of course) that tells vBulletin to exclude the new account they are creating. But this would end as soon as the spammer cleared their cookies.
That's the problem with spamming – the more security you put in for prevention, the harder it is for your actual users to get stuff done.
One feature that I would suggest is having a team contact that has to approve all accounts that are attempting to register for the team, in a manner like TIMS/STIMS. While it certainly wouldn't apply to bots without a team, it would help the Juggernauts' number from being abused all the time.
------------------------------
And my response to Joe Ross' link to spam detection software:
Quote:
Originally Posted by Joe Ross
|
Has this been relaxed lately? This particular bot in question was created this month. And has only posted once.