ConwayLife.com

Due to major spam attacks in the wiki in July 2016, the wiki has been locked down against accounts with no trusted flag. You can request that your account be trusted by replying to this thread.

----
Original message:

Some spam accounts are rapidly creating and editing new pages, so much so that it's hard to fit in a speedy deletion template in edgeways without getting an edit conflict and having it being removed by the bots anyway.


Not to mention they're also clogging the living hell out of Special:RecentChanges

Aaaaand now they're on the forums too.

viewtopic.php?f=7&t=2302

viewtopic.php?f=3&t=2301

What a surprise. I thought we had successfully filtered out spambots. (After all, you need to know who discovered the Game of Life to start new pages.)

Maybe these are just especially smart spambots, or maybe they're being directly controlled by a person.

Well this sucks.

If it is a person controlling them, I would like to do things to them I would rather not mention here. However the rate the bots register accounts at is far too fast to be a single person...

Isn't John Conway the only question/answer there is? We should probably vary it a bit more to slow down the spammers.

Slightly more ambitious approach: block users from creating new pages until both 7 days have passed and they have made 10 edits to pages (and if any of these are spam, the account can be blocked within those 7 days).


Because seriously, this is the most impressive spam attack I have seen in my life.

For now I've restricted LifeWiki editing access to "trusted" users until we can figure out what the hell happened and a more proper fix. Sorry about this -- this is by far the most ridiculous spam attack this site's ever had.

Edit: I changed the SPAM-prevention questions, but the spammers were not hindered even a little bit -- more new accounts started being made within 5 minutes. Thus the spammer is unfortunately a human (or group of humans), so I will have to leave the trusted-only editing on at least for a little while.

Nathaniel wrote:For now I've restricted LifeWiki editing access to "trusted" users until we can figure out what the hell happened and a more proper fix. Sorry about this -- this is by far the most ridiculous spam attack this site's ever had.

Edit: I changed the SPAM-prevention questions, but the spammers were not hindered even a little bit -- more new accounts started being made within 5 minutes. Thus the spammer is unfortunately a human (or group of humans), so I will have to leave the trusted-only editing on at least for a little while.

Yuck. x.x And there's 5000+ spam pages still lingering about.

If you need any help mopping up, I'll be happy to lend a hoof.

Maybe just restoring all the data from a backup would be a better option? (We do have a backup, don't we?)

I feel like people should have to post on these forums enough to have their wiki account set to trusted.

Also, Special:NewPages is a fresh picking ground for spam pages to delete.

codeholic wrote:Maybe just restoring all the data from a backup would be a better option? (We do have a backup, don't we?)

Oh, no, let's not do that. There's really no reason to lose the (good) edits have been done since then.

Looking at the list of new pages, it seems that all the spam has been pretty much removed (this, unfortunately, has the unwanted side effect of clogging up Recent Changes with deletion log entries).


Now seems like the time to put some better security features into action.

muzik wrote:Looking at the list of new pages, it seems that all the spam has been pretty much removed (this, unfortunately, has the unwanted side effect of clogging up Recent Changes with deletion log entries).

There were a couple more spam pages left which I've tagged for speedy deletion now. Most of these were in the various Talk: namespaces, which is why Special:RandomPage wouldn't return them.

I believe I got all of 'em now.

There's still a bunch of recently-registered user accounts that haven't been merged into the "Spam User" account. Minor house-cleaning, but it's probably a good idea to do it anyway.

Now seems like the time to put some better security features into action.

I agree with this. mediawiki.org has some good suggestions; myself I'll particularly recommend the AbuseFilter extension. Used with the right rules it's really powerful, and you only need to add to/update the rules if you get new kinds of spam (or any sort of abuse, really).

My approach would be this:

Keep the trusted-only editing restriction forever.

The user must join these forums first. There would be a thread named something along the lines of "Want to edit the wiki? Post here first" which would highlight a few basic rules and act as a sort of sign-up thread. If a user with 10 or more posts, posts in this thread, then their wiki account will be set to trusted. And since most bots post purely spam, any accounts which are spambots kind of won't be able to get trusted access.


Kind of a harsh approach but it works out.



EDIT: as a side effect of the spam attacks, the speedy deletion pages have been cleared out and the Waterbear and Demonoid infoboxes are fine now!

I think placing Google's reCAPTCHA (using this extension?) on the account creation and article creation/deletion/edit pages might be sufficient on its own.

Yeah, I really don't want to permanently lock down the wiki to only trusted users. If Wikipedia can manage to let anyone and everyone edit, surely we can too.

I'll look into AbuseFilter. If for nothing else, it can be used to slow down spammers if they do get through our spam-blocking measures (e.g., we can set it so that new accounts are limited in how often they can edit). And I'll look into reCAPTCHA again (I looked at it a while ago but decided against it, but can't remember why anymore). I've also taken some other measures that I won't discuss publicly, since there is at least one real human involved in the SPAM attack.

How about putting a limit on page title lengths, and anything that exceeds that number blocks the user (if not a trusted account)?

I think it can be bypassed easily, especially because you already said it here...

Can you trust me on the wiki? My username is drc.

drc wrote:Can you trust me on the wiki? My username is drc.

Done!

Can you add me to the list of trusted users as well? User:Gmc_nxtman

gmc_nxtman wrote:Can you add me to the list of trusted users as well? User:Gmc_nxtman

Done!

May I request access to the "trusted" group in the Wiki? I was about to correct a typo in Octagon 4, and I'm pretty sure that I won't spam in any article (or, for that matter, create irrelevant pages).
http://www.conwaylife.com/wiki/User:Rhombic

I made a quick edit to LifeWiki:Editor pages just to let any (legit) newcomer know how they can get a trusted account.

Not neccesarily a spam attack, but some users with 0 posts have links to external websites, which appear to be kind of spammy.

May I (User:LegionMammal978) be added as a trusted user?

Why not enforce Scrypt proof of work on new users? This would make it computationally difficult for spammers to make new accounts, and the few they create can be banned quickly. Also, post rate limits can be imposed on new users, to ensure they do not spam too much. Someone who actually wants to join can wait a few minutes for PoW to be solved.