Hi folks, as I'm sure some of you are aware, Drupal is now being investigated heavily by the spammers - those of you running larger Drupal sites will have seen as I have, the numbers of bot registrations, and other Drupal-specific invasive spam method testing increasing dramatically over the last couple of months.
I believe that this is perhaps the single greatest issue for Drupal now.
A coherent, flexible, and *rapid response* initiative is needed in my opinion, to ensure that systems such as Captcha and Textimage remain functional.
Of course, the spammers will always adapt their systems to hit newer more attractive targets like Drupal - which doesn't have the extensive use of nofollow tags OR captcha in place for the majority of its userbases websites. This of course makes it such a temptation that they will continue to more aggressively target Drupal as time goes on.
This only increases the very real need to put more testing and coding and PLANNING resources into the defense against this growing issue.
Comments
Are you talking about
Are you talking about Drupal.org or all sites built on Drupal? I think the script and contrib modules do a great job of repelling spam. As for the policies here on this site, that is another matter.
http://profitlabinc.com
There are several option to fight spam
There are several option to fight spam.
I myself use Akismet module and it works like a charm:
http://drupal.org/project/akismet
2houseplague;
Which contrib modules are you talking about ?
Akismet module is definitely
Akismet module is definitely something I will be testing in the near future - although this is purely to fight comment spam for anon users is it not?
In regards to a community site with say 10,000 users, the issue of bot signups becomes more of an issue, with a currently dysfunctional captcha module (as I understand it to be at least - with the number of current issues open it becomes a little hazy)
Akismet
Akismet.module automatically filters and blocks both comments, and (optionally) nodes from anon or registered users. You can 'white list' specific roles, allowing them to post without filtering. On one site I run, I allow contributing members who've been around for at least two months and who've participated in several threads post without spam filtering.
--
Lullabot! | Eaton's blog | VotingAPI discussion
--
Eaton — Partner at Autogram
How about users profile pages?
This presumably only applies to content nodes or comments?
One thing I'm not sure this covers is user profile pages, for example musicians who all want to be able to write a bunch about themselves on their profile page, and link to their Myspace page etc, from their user profile page. So therefore, a URL field is added to the profile.
Then a bunch of spam bots can easily come along and signup new accounts everyday, and place whatever URL they like in their profiles. (Which I presume is hardcoded as a straight link, not nofollow). This URL addition may be done immediately, or several weeks/months down the track, to avoid new spam accounts being noticed.
What do you see as the best course of action to eliminate this, while maintaining a relative ease of signup for humans, and allowing the profile URL to remain?
spam bots need to know the
spam bots need to know the field names in order to post in strings from what I undestand. If these are self created fields, you should be safer from spam then say, drupals default user registration. When I think I've been tagged by possible spam bot, I alter my user registration form a bit Although that hasn't been necessary since I altered the user registration form by adding a TOS required checkbox to the registration and this seemingly prevented much of my spambot type problems. A simple required check box :) I wrote up directions on how to do this (HERE) and included them in the handbook, It has only been recently that I have become aware of how its altered the amount of spam hits I recieve. Unless someone specifically writes a bot, that checks this required checkbox, it can't register. For the most part, The only PITA's i've run into are ACTUAL human spammers. they register just to post their spam. I've had quite a few repond back to emails I've sent.
comment spam is sometimes helped by requiring preview of comments before posting them. Though now I use akismet, which gives users of my community the ability to flag spam and send it to the moderation query, where I or tusted users, sort through the spam and determine whether its spam, or ham and if ham republish.
Thanks for that, I'll try it
Thanks for that, I'll try it and see how it goes. The Akismet system sounds like its got some cool features too, so I might look to that if I'm still having issues.
I do wonder about the Akismet system relying on a 3rd party, which is the case is it not? Ever notice any degradation of your websites performance at all since applying akismet?
The 3rd party in this case
The 3rd party in this case is wordpress. Thus it doesn't worry me. There have been times where I've seen a comments take a tad longer to be submitted, then without akismet, but in the end, that small delay is the protection added.
TOS doesn't stop my profile spammers
Someone wrote a bot that specifically checks for a TOS agreement box. And they have broken through my Captcha module too. Its obnoxious since I can delete the 20 new profile spam accounts but within five minutes they come right back.
Is there a module that allows profiles to be edited only after they have been verified with an email account?
Sean
Cambridge Community Television
http://www.cctvcambridge.org
unfortunately none that I am
unfortunately none that I am aware of. A temporary fix would be to maybe move the TOS check box, so that the bot doesn't find it in the same position, or add a double box, another required check box that asks, Are you human ? yes or no ?
LoginToboggan + User Protect
Create an "unauthenticated" role and link it to LoginToboggan. Then disallow unauthenticated users from editing their account details with User Protect.
Sorry yes I meant Drupal
Sorry yes I meant Drupal sites in general.
When you say the script and contrib modules do a great job, which modules are you referring to?
For example to stop bots signing up fake user accounts? As far as I understand, the Captcha module is currently not usable for this, as it has several ongoing bugs at the moment which stop it from being deployed.
While these will probably be fixed at some point, my main concern is that I just don't think the coherent rapid response is present in the the Drupal community to actively identify and resolve spam bot issues. This is not a critical issue at the moment, due to the fact that until now we (drupal sites) haven't been heavily targeted and researched by the spammers - but this has most certainly begun, and if more attention is not paid to this, it will severely impact on Drupal as a functional CMS platform.
I'm certainly not saying all this to bash the great work of the contributing coders and testing community, not at all, but I do want to raise awareness of this important issue, as I believe it has generally been pushed aside in favor of the more exciting new bells and whistles that keep getting added, both to Drupal core and in the form of contributed modules.
Congratulations!
You are the Drupal community. You are, as of now, a leader in championing the cause of pro-active preventative measures to combat emergent spam bots. :-) However, if your statements are true and this is not a problem that many sites are facing yet, you will find it difficult to find many skilled developers willing to donate time for free to build advanced spam fighting systems for Drupal in anticipation of a coming wave.
I'll repeat: I ported Akismet and Badbehavior modules to Drupal 5. Other skilled devs are in the process of porting Spam.module. Another dev has added integrated support for Akismet to the Trackback module, greatly enhancing its usefulness. You've run into bugs specifically related to Textfield and Captcha when used to prevent user registration. More troublesome to me is the fact that captchas -- both textual and image -- are becoming increasingly unreliable in stopping spam. Combinations of server-side filtering methods (like Spam.module and Akismet) are in my experience far more reliable and less troublesome for disabled users.
If, though, there are specific bugs in TextImage and/or captcha that you'd like to see fixed, helping test and troubleshoot can be a major help. In addition, raising money -- or even setting up a smallish fund -- can help. Even raising fifty bucks to toss to any developer willing to fix a particular troubling issue can help quite a bit if there's only a small number of users interested in/needing it.
--
Lullabot! | Eaton's blog | VotingAPI discussion
--
Eaton — Partner at Autogram
Thanks! ;)
Yes I hear what you're saying, and the reason I do try and bring some things like this up for discussion is that I DO care about Drupal, and would like to be able to perhaps spark renewed interest in important issues like this by coders or other "movers and shakers" in the Drupal community.
I'm happy to test modules which enable me to combat the bot armies, both for my own peace of mind, the happiness of my many users, and the overall effectiveness of Drupal for everyone :)
As I'm not a developer, perhaps my own knowledge of the dev/CVS process is lacking, but at face value I sometimes find the system of identifying a specific problem, and developing a specific solution, a little hard to follow, with random forum threads pointing to module issue nodes, pointing to several other issue threads, pointing to .... ad infinitum
...
Heine has a new approach to the captcha issue that you may want to investigate.
http://heine.familiedeelstra.com/math-captcha-form-store
Still in the early stages but may prove of use to you in the interim.
-Steven Peck
---------
Test site, always start with a test site.
Drupal Best Practices Guide -|- Black Mountain
-Steven Peck
---------
Test site, always start with a test site.
Drupal Best Practices Guide
Akismet? Spam.module? User registration controls?
There are a lot of options out there, and the right one depends on what your site's community is, what its needs are, and what kinds of barriers to entry are considered too invasive.
I get hundreds of pieces of spam each day posted to my Drupal blog. Every week or two, a piece of spam slips through the filtering and I manually delete it. Your milage may vary. Nofollow links are already available. I ported BadBehavior.module and Akismet.module to Drupal 5. Spam.module is in the process of being ported. Those back-end systems have proven more effective over the long haul than Captcha based systems, which have a serious negative impact on accessibility. What kind of "coherent, flexible, rapid response" did you have in mind?
--
Lullabot! | Eaton's blog | VotingAPI discussion
--
Eaton — Partner at Autogram
You're right that there are
You're right that there are several methods, often situation dependent as you mention. You guys are doing some great work, please don't take offense at my comments.
After using Drupal to power several of my sites for some time I guess the impression I have is that almost due to the number and variety of contrib modules, and additional core features, that the spam issues can tend to be pushed aside almost as non critical. Thats my primary concern here.
As far as a real world example goes, I have a community site with several thousand users, for which anon commenting is disallowed. It has many bot user signups everyday. From my study of these it appears that some are sleepers, to be used at a later date, while others immediately begin posting/audio uploads.
I do a lot of reading around the Drupal.org site, and almost all the solutions I have come across have turned out to be "currently not stable" or have issues which mean I can't deploy them, for instance a Captcha on the user registration form.
How would you guys recommend I combat this?
By any other name
http://drupal.org/project/Modules/category/69 & http://drupal.org/node/60891
But I would say that Input Formats (a core module for good reason) is probably one of Drupal's most important spam-fighting features.
http://profitlabinc.com
that list doesn't actually
that list doesn't actually show them all. there are quite a few missing off that page. ex: akismet spamspan and badbehavior
There is a dedicated Drupal
There is a dedicated Drupal commenting software on the market - Came across it last week.
Once a site is "found" by a spammer(s), it will probably be years before the pages it targets stops being hit... even if you remove the pages, still, they'll come.
The key is to avoid getting in their radar before the site is live. The best advice is to change as many drupal, or blog-looking footprints as you can think of.
This is the area that took me into hacking Drupal core.
I looked for as many hard-coded error messages as I was bothered to find, and changed them (Take an error msg and whack it into Google... see a list of Drupal sites!).
Change all words with "comment", "Post", "Reply" in subtle ways.
Change class and ID names that might be give-aways on divs or form elements etc...
Don't post your site here, or in the showcase section. Don't mention Drupal on your site unless it's in image form.
Mike
------------------------------------------------------------------------------------------
A simple thanks to those that help, a price worth paying for future wealth.
User registation - html validation in profile fields?
What I have experienced and done in response.
1. I have experienced comment spam - In response I have disallowed anonymous comments.
2. I have experienced user registration bots - In response I now moderate all user registrations (I recognize this is not possible with large numbers of registrations per day but I have a small community.)
This has eliminated all spam except Human entered profile spam. Because I moderate users this spam does not reach the anonymous or authenticated user. As far as my users are concerned, they see no spam. I just don't activate the accounts. I don't delete the accounts, this way another user can not register with the submited username or email.
The number of human entered spam in user registrations greatly out weighs the number of legitimate user registrations. What I need now is to run validation against profile fields for html code. Can some one explain how I might add validation to profile fields so I might disallow user registration if they enter html code in a profile text field?
It seems the only thing the spammers want is to create referral links in their profile. Even though I have only text fields in the profile they still enter html code.
I've been working on a
I've been working on a (very) simple profile field validator because my sites are getting spam-botted on the registration side of things.
I've only got a couple of rules right now, a) fields may not have duplicate entries and b) no html
If either criteria are met, the registration fails. I'll expand this to include other validation rules if anyone would care to post and request those--anti-spam rules only, of course. I'll also create settings where you can run whatever rules you think are of value.
Of course, it's also quite easy to code things up yourself. Just create a module w/hook_user implemented and just use the "validate" type. As a bonus, this runs during any user/x/edit submission as well, so you don't have to code rules in two places.
Has anyone tried using css to stop form spam
I read an article today in the April 2007 issue of sysadmin written by Johannes Ullrich called Minimizing Contact Form and Forum Spam. In it he talks about the different combatant methods such as Captcha, kittenauth, session tracking, filtering javascript, and stylesheets.
He list the positives and pitfalls of each method and the results he has experienced. One of his findings that interested my fancy was the use of style sheets to minimize spam bots. It seems like a fairly easy approach that doesn't hinder site visitors and takes up very little system over head.
If this might be of interest read the article (devs). I'm a novice at drupal and its api's but it appears a few lines of code just might do the trick to at least stop the spam bots. Then with the use of the other spam modules, webmasters might finally get a handle on spam until the a more advanced round of bots come out.
I'm going to try it on one of my forms and see it it helps. It will require me digging into the docs a bit and a mod to a module. If it helps I'll report back. If any one has already tried this then I would be interested in your results.
Chuck Mattice
I am not a developer
I am not a developer, so I hearby waive any liability for accuracy in my train of thought, but...
If I conceptualize this right, does this mean that renaming form items via CSS is one potential way to break the spam botting? Maybe an additional module we could develop is one that allows us to rest the form id tags into something randomly generated by the module. Then I imagine when we get a burst of spam we can manually reset the form field titles and break their robots function - and use other spam modules to fire off a reset function each time it suspects spam activity. Hey, maybe even randomize the form field ids with each page load.
Of course, like you said, this will work until the apparently massively profitable erectile dysfunction spam business figures out a new trick.
Ned Batchelder: Stopping spambots with hashes and honeypots
This is a nice article about using hashed form field names and honeypots to defeat spam bots posting any forms.
It would be very nice if the Drupal could do this: http://www.nedbatchelder.com/text/stopbots.html
remove all indicator that tell spambots that is Drupal best way
In drupal 7 we have in header
And tell all spammers in the world - came in :) we are Drupal site with all knowing issue
A site that runs Drupal runs
A site that runs Drupal runs Drupal. What is your point? Do you have a constructive, practical suggestion here?
.dan. is the New Zealand Drupal Developer working on Government Web Standards