Whitelisting of some sort is needed, as we've discussed on the P.H.P forum http://www.projecthoneypot.org/board/read.php?f=10&i=37&t=37.

Perhaps real human beings that are caught by P.H.P, for instance someone using a huge Saudi-Arabian proxy would be able to access the site after entering a captcha, + optional comment, but would not gain unlimited normal access; instead their connection would be limited in various ways; *throttled down, and their comments would have to be captchaed/moderated for instance.

*I'd really like to see a throttling/limiting/flood protection module too that throttles down (sleeps before serving the request) if a client requests too many pages per 10 seconds, and perhaps throttles down even more if it keeps requesting like that. It would probably work best silently. I've seen such a module on some forum once, and it didnd't do it silently but rudely told me that I've requested too man pages and refused to serve me the content.

Comments

praseodym’s picture

praseodym commented
Assigned: Unassigned » praseodym

Dev version has whitelisting through admin/user/access - add the IP there and http:BL will whitelist it. I'm working on session-based whitelisting where a user can request a whitelist for the length of the session.

cybe’s picture

cybe commented

Havn't read the API yet but it seems there are different threat levels, so the finegrained access levels, could depend on the threat level. Minor level spam harvester= throttle the connection, Major level = access denied.

praseodym’s picture

praseodym commented

That's the idea, with a customizable threat level threshold.

praseodym’s picture

praseodym commented
Status: Active » Fixed

Greylisting has been added to 0.9, 1.x-DEV and HEAD. Greylisting allows users with low-threat IP addresses to gain access to the site for the current session. It has a simple robot check: a comment has to be entered and another field has to be left blank. Of course this isn't completely secure, but once the first robots start to pass the check I'll add optional CAPTCHA checks and some other things that make it harder for bots to circumvent their http:BL blacklist entry. Disallowing comments for greylisted IPs and other limitations are also things that will be added in the future if necessary.

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)