First, this excellent module is not listed here:
http://www.stopforumspam.com/contributions

Second, this module allows for reporting users without any shred of evidence.
See:
http://www.stopforumspam.com/forum/viewtopic.php?id=4468

We find ourselves spending more time dealing with false positives. As of right now, anyone that adds a record to the DB where the user has not spammed *their* forum/blog/wiki (etc), will have their API key removed, all their records removed and their forum account banned.

Someone having their email address in the DB, is not evidence of spamming on your forum. Do not add it. If in doubt, do not add it.

We will be implementing a zero tolerance policy, effective now.

According to the above, the option in /admin/settings/spambot to "Report blocked user registrations as spammers " should be removed altogether.

Also, in user/%user/spambot, the option "Report this account to www.stopforumspam.com as a spammer" should be disabled if there is no evidence (e.g. nodes, comments, private messages, etc.) The presence of evidence should be required just like the presence of IPs. The module shouldn't permit reporting users as spammers without any evidence.

This issue can be considered a critical bug as per stopforumspam.com's policies, highlighted above.

CommentFileSizeAuthor
#9 1817292-spambot-9.patch1.19 KBhansfn
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

jennifer.chang’s picture

What I mean is that, as a rule, the evidence should be submitted at the same time as the user is being reported as a spammer.

jennifer.chang’s picture

http://www.stopforumspam.com/forum/viewtopic.php?id=4562

Until we implement mandatory evidence, you still have the (lazy) option to do so. However, those of you who enter data without evidence will result in those submissions being purged upon removal request without any form of "investigation". If you're going to "accuse" someone of spamming without supplying any form of proof, and I receive a removal request, be it a moment later or next year, it gets purged without concern; the benefit of the doubt to the removal requester, not you.

We're not going to hold people "hostage" because you can't be bothered to prove your claim and provide the slightest amount of evidence. And we're not going to spend time investigating submitted data that's entered without backing it up.

bengtan’s picture

Hi jennifer.chang,

Thanks for bringing this to my attention.

I haven't been keeping up with the latest developments on stopforumspam so I wasn't aware of this change in policy.

I'll have a look into changing the behaviour of spambot.module to match when I have time, but in the meantime, as a workaround, users can simply not tick the box which enables automatic reporting.

> Also, in user/%user/spambot, the option "Report this account to www.stopforumspam.com as a spammer" should be disabled

Since this is a manual option, I'll leave this in, and rely on the user to decide whether there is evidence. It would be too tricky for the module to determine what constitutes evidence since it usually requires human judgement.

Thank you.

bengtan’s picture

Title: Reporting "spammers" without evidence?? » Important: Don't report spammers without evidence.

Change title to make this issue more visible.

jennifer.chang’s picture

Thanks for the quick response. I am very grateful both for this module and for the service provided by stopforumspam. Using this module is already restoring my sanity! :)

Yes, I've already changed the settings in my sites and changed my own behaviour, not reporting spammers where not appropriate.

> Also, in user/%user/spambot, the option "Report this account to www.stopforumspam.com as a spammer" should be disabled

What I mean is that the option can be disabled if there are 0 nodes and 0 comments by this user. In such situations, by definition, there is no evidence to submit. The node and comment count is already provided, so it should be trivial to disable the option. If there are nodes and comments, then, obviously, human intervention should be required to make the difference between spam and non-spam.

Anyway, since apparently evidence will be required some day (soon?), we'd need a list of nodes or comments to submit as evidence, just like we have a list of IPs that we can report. The current stopforumspam api apparently already support submitting evidence, although it's not yet mandatory.

bengtan’s picture

Status: Active » Fixed

This issue has been addressed in spambot.module 6.x-3.3 and 7.x-1.2.

jennifer.chang’s picture

Thank you very much for the update.
:)

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

hansfn’s picture

Status: Closed (fixed) » Needs review
FileSize
1.19 KB

I'm sorry to reopen this, but I think the "no evidence" situation still can be improved.

The first time I used this module, I was trying to report some spammers after I cleaned up their spammy comments. I just didn't understand that there should be a list of nodes/comments to select from below "Report this account to www.stopforumspam.com".

The attached patch makes this much clearer. (Tested on my own site of course.)

bengtan’s picture

Status: Needs review » Fixed

Hi,

Thanks for the suggestion. I haven't merged your patch per se, but I've taken the ideas and made similar changes.

Commits:

http://drupalcode.org/project/spambot.git/commitdiff/6fa3e97
http://drupalcode.org/project/spambot.git/commitdiff/9f1f886

These will be incorporated into the next spambot release, whenever that is ... or you can patch your own site using the commits listed above.

Thank you.

hansfn’s picture

Thx. Your fix is better since it also fixes the API key message.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.