spam report

[Tim Slagle]

The "uncategorized pages" link is a good spam report:
http://wiki.hacdc.org/index.php/Special:UncategorizedPages
9/9=100% spam, although humorously the MIG welding page might be worth
keeping once scrubbed of external linkage.
--Tim

[Katie Bechtold]

On Mon, May 7, 2012 at 3:49 PM, Tim Slagle <t...@slagle.org> wrote:
> The "uncategorized pages" link is a good spam report:
>  http://wiki.hacdc.org/index.php/Special:UncategorizedPages

My preferred method is subscribing to the feed of recent changes
(http://wiki.hacdc.org/index.php?title=Special:RecentChanges&feed=atom),
which of course includes legitimate changes as well as spam - I like
to keep an eye on both.

--
Katie      http://about.me/katiebechtold

[Tim Slagle]

So since you are the main spam remover these days, are you okay with the current level (a couple pages a day maybe?)   Or would you want to reduce the amount of spam we get?
--Tim

[Katie Bechtold]

On Tue, May 8, 2012 at 8:45 AM, Tim Slagle <t51...@gmail.com> wrote:
> So since you are the main spam remover these days, are you okay with the
> current level (a couple pages a day maybe?)   Or would you want to reduce
> the amount of spam we get?

I'm fine with the current level of spam we get. Sometimes I don't get
to it for a few days because I'm away from my computer(s) or otherwise
distracted, but I don't think it's the sort of spam that's visible to
ordinary users of our wiki.

--
Katie      http://about.me/katiebechtold

[Katie Bechtold]

Lately we've been getting more spam on the wiki; it isn't unusual to see several dozen new (bot) users a day, and while not every one of those adds spam to the wiki, many do, to the point where it's now an annoying chore to remove it all manually. It seems our CAPTCHA for new users isn't effective (who would've thought computers would be good at simple math?! :) ). I'd like to suggest we install an effective CAPTCHA to filter new user signups.

--
Katie      http://about.me/katiebechtold

[Alberto Gaitán]

To wit, http://www.mediawiki.org/wiki/Extension:ReCAPTCHA

[Tim Slagle]

I still think we should lock the wiki down a bit more.  If we made wiki accounts for all the HacDC members and anyone who requested one on Blabber, but made the general public email an admin to get an account, the spam problem would be solved and Katie could devote her time to increasing HacDC awesomeness in more productive ways.  Any idea how many legit contributions come from the general non-member or -friend public?  Have there been any?

--Tim

[ITechGeek]

I would make it case insensitive or put a note that it is case sensitive

What about a math CAPTCHA? www.mediawiki.org/wiki/Extension:VisualMathCaptcha

I would leave the default of ^[0-9](\+|-)[0-9]$ (I think I'm doing this right)

On Wed, Nov 14, 2012 at 5:26 PM, Bradford Barr <bradfo...@gmail.com> wrote:
> I always thought this landing screen was a clever idea. Perhaps we
> could do similarly.
>
> http://wiki.openframeworks.cc/

[Matthew Hines]

I have had zero spam on my wiki since adding the following lines to
LocalSettings.php .

This does not hamper legitimate users and guests from contributing in
any way.

#ConfirmEdit
require_once("$IP/extensions/ConfirmEdit/QuestyCaptcha.php");
$wgCaptchaClass = 'QuestyCaptcha';
$wgCaptchaQuestions[] = array( 'question' =>
'_do_you_speak_fax_?-2_char_answer', 'answer' => 'no' );
$wgCaptchaQuestions[] = array( 'question' =>
'_do_you_LIKE_spam_?-2_char_answer', 'answer' => 'no' );

$wgCaptchaTriggers['edit'] = true;
$wgCaptchaTriggers['create'] = true;
$wgCaptchaTriggers['addurl'] = true;
$wgCaptchaTriggers['createaccount'] = true;
$wgCaptchaTriggers['badlogin'] = true;

[Katie Bechtold]

Any of the proposed remedies is fine with me. Does this discussion need to go to the admin list (which I'm not on) so something can happen?

--
Katie      http://about.me/katiebechtold

[Alberto Gaitán]

Yes, I think so. I no longer have the SFTP credentials so I cannot edit
LocalSettings.php (I like the look of the last solution, below.)

Alberto

On 11/21/12 4:47 PM, Katie Bechtold wrote:
> Any of the proposed remedies is fine with me. Does this discussion need
> to go to the admin list (which I'm not on) so something can happen?
>
>
> On Thu, Nov 15, 2012 at 9:03 AM, Matthew Hines
> <spamfree...@gmail.com <mailto:spamfree...@gmail.com>> wrote:
>
> I have had zero spam on my wiki since adding the following lines to
> LocalSettings.php .
>
> This does not hamper legitimate users and guests from contributing
> in any way.
>
> #ConfirmEdit

> require_once("$IP/extensions/__ConfirmEdit/QuestyCaptcha.php"__);

> $wgCaptchaClass = 'QuestyCaptcha';
> $wgCaptchaQuestions[] = array( 'question' =>

> '_do_you_speak_fax_?-2_char___answer', 'answer' => 'no' );

> $wgCaptchaQuestions[] = array( 'question' =>

> '_do_you_LIKE_spam_?-2_char___answer', 'answer' => 'no' );

>
> $wgCaptchaTriggers['edit'] = true;
> $wgCaptchaTriggers['create'] = true;
> $wgCaptchaTriggers['addurl'] = true;

> $wgCaptchaTriggers['__createaccount'] = true;

> $wgCaptchaTriggers['badlogin'] = true;
>
>
> On 11/14/2012 11:05 PM, ITechGeek wrote:
>
> I would make it case insensitive or put a note that it is case
> sensitive
>
> What about a math CAPTCHA?

> www.mediawiki.org/wiki/__Extension:VisualMathCaptcha
> <http://www.mediawiki.org/wiki/Extension:VisualMathCaptcha>

>
> I would leave the default of ^[0-9](\+|-)[0-9]$ (I think I'm
> doing this right)
>
> On Wed, Nov 14, 2012 at 5:26 PM, Bradford

> Barr<bradfo...@gmail.com <mailto:bradfo...@gmail.com>>

> wrote:
>
> I always thought this landing screen was a clever idea.
> Perhaps we
> could do similarly.
>
> http://wiki.openframeworks.cc/
>
> On Wed, Nov 14, 2012 at 4:52 PM, Tim Slagle<t...@slagle.org
> <mailto:t...@slagle.org>> wrote:
>
> I still think we should lock the wiki down a bit more.
> If we made wiki
> accounts for all the HacDC members and anyone who
> requested one on Blabber,
> but made the general public email an admin to get an
> account, the spam
> problem would be solved and Katie could devote her time
> to increasing HacDC
> awesomeness in more productive ways. Any idea how many
> legit contributions
> come from the general non-member or -friend public?
> Have there been any?
> --Tim
>
>
>
> On Wed, Nov 14, 2012 at 4:04 PM, Katie

> Bechtold<bokun...@gmail.com <mailto:bokun...@gmail.com>>

> wrote:
>
> Lately we've been getting more spam on the wiki; it
> isn't unusual to see
> several dozen new (bot) users a day, and while not
> every one of those adds
> spam to the wiki, many do, to the point where it's
> now an annoying chore to
> remove it all manually. It seems our CAPTCHA for new
> users isn't effective
> (who would've thought computers would be good at
> simple math?! :) ). I'd
> like to suggest we install an effective CAPTCHA to
> filter new user signups.
>
>
> On Wed, May 9, 2012 at 1:34 PM, Katie
> Bechtold<bokun...@gmail.com

> <mailto:bokun...@gmail.com>>

> wrote:
>
> On Tue, May 8, 2012 at 8:45 AM, Tim
> Slagle<t51...@gmail.com

[ITechGeek]

There are people on the admin list on this mailing list (=

I can make the needed changes tomorrow night or Friday. Which changes
do people want made?

[Alberto Gaitán]

Please add the lines, below, to LocalSettings.php. I think it's a good
first try. Or give me access to the server and I'll do it!

Thanks!
A

On 11/22/12 12:06 AM, ITechGeek wrote:
> There are people on the admin list on this mailing list (=
>
> I can make the needed changes tomorrow night or Friday. Which changes
> do people want made?
>

> On Wed, Nov 21, 2012 at 11:02 PM, Alberto Gait�n

[ITechGeek]

I got it working (I had to remove all the underscores from the file path).

I tried it out, the create account is working.
Edit, addurl, badlogin, & create all seem to be dependent on the user's access.

I found out the confirmedit.php file had some default settings which
exempted sysop and bot (registered authorized type bots).

I went ahead and removed all those default lines so now the only
skipcaptcha lines are in our localsettings file and is currently set
to * (anonymous users) and user (logged in users) are skipcaptcha =
false.

So everyone receives it right now. Are there any classes of users who
shouldn't receive the CAPTCHA? I would be fine w/ sysop (admin users)
and maybe a HacDC members group (and make it so members of that group
can add/remove new members).

Badlogin still doesn't seem to work. According to
http://www.mediawiki.org/wiki/Extension:ConfirmEdit MainCacheType has
to be something other than None (which our's is set to). I also tried
ANYTHING & DB and it still didn't work.

On Thu, Nov 22, 2012 at 8:32 AM, Alberto Gaitán
<alberto...@gmail.com> wrote:
> Please add the lines, below, to LocalSettings.php. I think it's a good
> first try. Or give me access to the server and I'll do it!
>
> Thanks!
> A
>
> On 11/22/12 12:06 AM, ITechGeek wrote:
>> There are people on the admin list on this mailing list (=
>>
>> I can make the needed changes tomorrow night or Friday. Which changes
>> do people want made?
>>

>> On Wed, Nov 21, 2012 at 11:02 PM, Alberto Gaitán

[Alberto Gaitán]

On 11/22/12 10:23 AM, ITechGeek wrote:
> I got it working (I had to remove all the underscores from the file path).

> <snipped>

>
> So everyone receives it right now. Are there any classes of users who
> shouldn't receive the CAPTCHA? I would be fine w/ sysop (admin users)
> and maybe a HacDC members group (and make it so members of that group
> can add/remove new members).
>

I think it would be prudent to exempt members, or just admins.

[Tim Slagle]

The Hacdc Secretary needs to be able to create accounts and designate them as members, do the admins do it for now?
--Tim

[ITechGeek]

There is nothing in the wiki designating people as members.

[Alberto Gaitán]

On 11/23/12 4:15 AM, ITechGeek wrote:
> There is nothing in the wiki designating people as members.
>

Correct me if I'm misunderstanding, but I think point is that it now
makes sense to create groups with commensurate permissions and put
secr...@hacdc.org in the admin group.

Alberto

> On Thu, Nov 22, 2012 at 12:46 PM, Tim Slagle <t51...@gmail.com> wrote:
>> The Hacdc Secretary needs to be able to create accounts and designate them
>> as members, do the admins do it for now?
>> --Tim
>>

[Tim Slagle]

Yup, thanks for reading my mind Alberto. Right now we have groups
EmailConfirmed (12 real uses, mostly long gone) and Users (thousands
of spammers), could we make a HacDCMembers group and give it rights to
edit without Captcha? Or are the groups predetermined? If so we
could make EmailConfirmed the members group.
http://wiki.hacdc.org/index.php/Special:ListGroupRights

Is the "Bureaucrats" group useful any more? It's mostly the same
folks as Administrators, could probably get nuked.
--Tim

[Alberto Gaitán]

I think Bureaucrats is one of MediaWiki's default group names.

https://www.mediawiki.org/wiki/Manual:User_rights#List_of_Groups

A

On 11/23/12 2:30 PM, Tim Slagle wrote:
> Yup, thanks for reading my mind Alberto. Right now we have groups
> EmailConfirmed (12 real uses, mostly long gone) and Users (thousands
> of spammers), could we make a HacDCMembers group and give it rights to
> edit without Captcha? Or are the groups predetermined? If so we
> could make EmailConfirmed the members group.
> http://wiki.hacdc.org/index.php/Special:ListGroupRights
>
> Is the "Bureaucrats" group useful any more? It's mostly the same
> folks as Administrators, could probably get nuked.
> --Tim
>

> On Fri, Nov 23, 2012 at 2:11 PM, Alberto Gait�n

[ITechGeek]

Bureaucrats is, but it doesn't mean we need to keep it (or stick w/ that name).

EmailConfirmed is suppose to be anyone who confirmed their email
address (I'm not sure if the system is sending out the confirmation
emails which is something we can look into).

AutoConfirmed can be based on how long someone has been a member of
the wiki and/or how many edits they've made. Right now our's is set
to 0 posts and 0 seconds.

I've also thought about getting a plugin to merge accounts.

If we can get email confirmed working, maybe make it where anyone that
is emailconfirmed and older then 1 month is exempt from the CAPTCHA?
Anyone who doesn't meet those requirements, can be added to a group by
verified HacDC Members.

It would be possible for someone w/ a list of email addresses to dump
the list into a script that would add everyone whose email address
matches an email address in the wiki's database to a certain group.

On Fri, Nov 23, 2012 at 3:12 PM, Alberto Gaitán
<alberto...@gmail.com> wrote:
> I think Bureaucrats is one of MediaWiki's default group names.
>
> https://www.mediawiki.org/wiki/Manual:User_rights#List_of_Groups
>
> A
>
>
>
> On 11/23/12 2:30 PM, Tim Slagle wrote:
>> Yup, thanks for reading my mind Alberto. Right now we have groups
>> EmailConfirmed (12 real uses, mostly long gone) and Users (thousands
>> of spammers), could we make a HacDCMembers group and give it rights to
>> edit without Captcha? Or are the groups predetermined? If so we
>> could make EmailConfirmed the members group.
>> http://wiki.hacdc.org/index.php/Special:ListGroupRights
>>
>> Is the "Bureaucrats" group useful any more? It's mostly the same
>> folks as Administrators, could probably get nuked.
>> --Tim
>>

>> On Fri, Nov 23, 2012 at 2:11 PM, Alberto Gaitán

[Matthew Hines]

Has there been any further _actual_ spam on the wiki, or just user
accounts? If just the latter, it may be better to leave the wiki open to
public editing, with the Q&A CAPTCHA enabled.

FYI, the default Math CAPTCHA seems broken. Changing the Q&A pool would
be much more effective.

On 11/24/2012 03:22 AM, ITechGeek wrote:
> Bureaucrats is, but it doesn't mean we need to keep it (or stick w/ that name).
>
> EmailConfirmed is suppose to be anyone who confirmed their email
> address (I'm not sure if the system is sending out the confirmation
> emails which is something we can look into).
>
> AutoConfirmed can be based on how long someone has been a member of
> the wiki and/or how many edits they've made. Right now our's is set
> to 0 posts and 0 seconds.
>
> I've also thought about getting a plugin to merge accounts.
>
> If we can get email confirmed working, maybe make it where anyone that
> is emailconfirmed and older then 1 month is exempt from the CAPTCHA?
> Anyone who doesn't meet those requirements, can be added to a group by
> verified HacDC Members.
>
> It would be possible for someone w/ a list of email addresses to dump
> the list into a script that would add everyone whose email address
> matches an email address in the wiki's database to a certain group.
>

> On Fri, Nov 23, 2012 at 3:12 PM, Alberto Gait�n

> <alberto...@gmail.com> wrote:
>> I think Bureaucrats is one of MediaWiki's default group names.
>>
>> https://www.mediawiki.org/wiki/Manual:User_rights#List_of_Groups
>>
>> A
>>
>>
>>
>> On 11/23/12 2:30 PM, Tim Slagle wrote:
>>> Yup, thanks for reading my mind Alberto. Right now we have groups
>>> EmailConfirmed (12 real uses, mostly long gone) and Users (thousands
>>> of spammers), could we make a HacDCMembers group and give it rights to
>>> edit without Captcha? Or are the groups predetermined? If so we
>>> could make EmailConfirmed the members group.
>>> http://wiki.hacdc.org/index.php/Special:ListGroupRights
>>>
>>> Is the "Bureaucrats" group useful any more? It's mostly the same
>>> folks as Administrators, could probably get nuked.
>>> --Tim
>>>

>>> On Fri, Nov 23, 2012 at 2:11 PM, Alberto Gait�n

[Eric Miller]

Everyone *hated* having to fill out a captcha to edit the wiki so I removed it.  I advise against putting it back.

On Sat, Aug 10, 2013 at 10:13 AM, Matthew Hines <spamfree...@gmail.com> wrote:

Has there been any further _actual_ spam on the wiki, or just user accounts? If just the latter, it may be better to leave the wiki open to public editing, with the Q&A CAPTCHA enabled.

FYI, the default Math CAPTCHA seems broken. Changing the Q&A pool would be much more effective.

On 11/24/2012 03:22 AM, ITechGeek wrote:

Bureaucrats is, but it doesn't mean we need to keep it (or stick w/ that name).

EmailConfirmed is suppose to be anyone who confirmed their email
address (I'm not sure if the system is sending out the confirmation
emails which is something we can look into).

AutoConfirmed can be based on how long someone has been a member of
the wiki and/or how many edits they've made.  Right now our's is set
to 0 posts and 0 seconds.

I've also thought about getting a plugin to merge accounts.

If we can get email confirmed working, maybe make it where anyone that
is emailconfirmed and older then 1 month is exempt from the CAPTCHA?
Anyone who doesn't meet those requirements, can be added to a group by
verified HacDC Members.

It would be possible for someone w/ a list of email addresses to dump
the list into a script that would add everyone whose email address
matches an email address in the wiki's database to a certain group.

On Fri, Nov 23, 2012 at 3:12 PM, Alberto Gaitán
<alberto...@gmail.com> wrote:

I think Bureaucrats is one of MediaWiki's default group names.

https://www.mediawiki.org/wiki/Manual:User_rights#List_of_Groups

A



On 11/23/12 2:30 PM, Tim Slagle wrote:

Yup, thanks for reading my mind Alberto.  Right now we have groups
EmailConfirmed (12 real uses, mostly long gone) and Users (thousands
of spammers), could we make a HacDCMembers group and give it rights to
edit without Captcha?  Or are the groups predetermined?  If so we
could make EmailConfirmed the members group.
   http://wiki.hacdc.org/index.php/Special:ListGroupRights

Is the "Bureaucrats" group useful any more?  It's mostly the same
folks as Administrators, could probably get nuked.
--Tim

On Fri, Nov 23, 2012 at 2:11 PM, Alberto Gaitán

[Matthew Hines]

Personally, I think it is NOT OK to jeopardize our increasingly extensive tool documentation just to save two mouse clicks. Even with regular pruning, massive spam (AFAIK hundreds/month) was ruining our documentation. The captcha eliminated this spam entirely.

Please re-enable the captcha and/or fix it now.

[Eric Miller]

The captcha has been disabled for 6 months now and there've been no complaints.

[Eric Miller]

Also we've never had a spam problem on the wiki because you have to be approved to edit it.  I'm not sure where you're getting these big ideas from.

[Matthew Hines]

Oh, I think we're mistaking the old captcha for the Q&A system currently in use. The latter asks things like "do you speak fax?" and has been highly successful in stopping spam.

[Eric Miller]

The only spam I saw were user signups.  Do you have a solution for that?

[Matthew Hines]

To clarify, I'm ok with an approved set of wiki users having permissions to edit without captcha (as is now setup).

I had thought that capability was being given to guests or users without any track record (ie. spambot accounts). Historically, that has been associated with havoc.