Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

351–358 of 358 posts

Re: Botspam apocalypse

#351

Post by account42 »

nixcraft wrote: post #168
toastal wrote: post #120

Earlier quoted context omitted.

Putting everything 'behind Cloudflare' isn't a panacea. By merely living outside the West, I'm getting Geo blocked from 'normal' news sites and constantly having to solve hCAPTCHAs to solve riddles for some AI algo without compensation. It's such a burden and I find myself giving up pretty often. GeoIP blocking is what prevented me from getting my voter information out of my last domicile. Running everything through…

I agree with you. But, what solution do you propose for independent solo developers or people who wish to run a blog instead of using FB, Twitter and co to create content? Cloudflare may not be perfect, but it prevented me from shutting down my solo operation without putting a massive cost burden on me. When the first time DDoS hit, I had to beg one of those large cloud companies to reduce bandwidth costs. It took th…

For commenting or forums the best solution IME is to require moderation review for all new users before showing the posts anywhere. You can also add a super simple "CAPTCHA" that is just a text field with a question easily answerable to any human looking at your site (e.g. name of $thing that your site is about without mentioning $thing in the question itself) to reduce load from non-targeted automated spam.

Re: Botspam apocalypse

#352

Post by account42 »

coldpie wrote: post #210
nicbou wrote: post #181

Earlier quoted context omitted.

Same job, same problem. I simply don't allow comments anymore. This is unfortunate, because they're amazing feedback if you write about bureaucracy. People won't take the time to write to you about their experience, but they'll leave a comment.

I came to the same solution, just disabling comments. There's a prompt to email me in the footer, but no one ever has. Shame, but that's the world we live in.

Just like with banners, nobody reads footers so that is not surprising. Your footer also makes no indication if you will publish replies via email in a way similar to comments so there will be people that won't bother if it is only you that will see their thoughts.

Have you considered an info box where the comments would be to push anyone interested to mail? Or allow comments but make them work more like mail with comments not being publicly visible until you approve them?

If you just want to cut down on non-targeted spam then it might be enough to have your comments work even slightly differently from the standard word-press solution, e.g. by adding a simple text field with a question that real human visitors of your site should be able to answer. This alone has worked for all of my sites that allow user contributions so far - won't stop anyone trying to spam your site specifically ofc but you can always take further measures WHEN that becomes a problem.

PS: Is your site supposed to have a default WordPress favicon?

Re: Botspam apocalypse

#353

Post by account42 »

sparkling wrote: post #47
BiteCode_dev wrote: post #31

It's not that bad. First, of course, you have cloudflare and recaptcha, which are free and very efficient, as the author say. But even if you don't want to use them (some of my services don't), most bots are very dumb: - require JS, and you lose half of the web ones - silly tricks like hidden input fields in forms that worked in 2000 still work in 2022. Use a bunch of them, and you can yet again halve the bot traffic…

Very nice list of countermeasures. I agree that doing these small things like hidden input fields really go a long way. I would add to that: - block signups/comments from known throwaway email domains - block known datacenter IP ranges, at least for POST requests. Honestly on our sites 50% of spam was coming from AWS EC2 IPs - use a proxy/vpn/bot detection service like https://focsec.com

> block signups/comments from known throwaway email domains

Throwaway email services have caught up to the point where even bigger players don't manage to block them, i.e. they rotate the domains used for the emails.

Re: Botspam apocalypse

#354

Post by coldpie »

account42 wrote: post #352
coldpie wrote: post #210

Earlier quoted context omitted.

I came to the same solution, just disabling comments. There's a prompt to email me in the footer, but no one ever has. Shame, but that's the world we live in.

Just like with banners, nobody reads footers so that is not surprising. Your footer also makes no indication if you will publish replies via email in a way similar to comments so there will be people that won't bother if it is only you that will see their thoughts. Have you considered an info box where the comments would be to push anyone interested to mail? Or allow comments but make them work more like mail with co…

> Have you considered an info box where the comments would be to push anyone interested to mail?

Not a bad idea, thanks. Maybe I'll try that. I suspect the "problem" is I just have approx. zero readers :)

> If you just want to cut down on non-targeted spam then it might be enough to have your comments work even slightly differently from the standard word-press solution, e.g. by adding a simple text field with a question that real human visitors of your site should be able to answer.

Yeah, I'd like to do that, but I don't have the time/interest in figuring out how to make Wordpress do that. I tried googling for plugins or whatever a while back, but never found anything pre-made.

> Is your site supposed to have a default WordPress favicon?

Never thought of changing it!

Re: Botspam apocalypse

#355

Post by account42 »

12907835202 wrote: post #109

For my forum with 500k users a month I just added a registration captcha related to my niche. E.g. for a Dark Souls forum it would say "what game is this forum about?" And if you got it wrong the validation would include "tip it's just two words D rk S*ls". This reduced spam by over 99% and didn't annoy people with recaptcha. If someone was unable to get past that captcha (it still happens I have logs!) I figured the…

This has worked greatly for me as well. Cuts out pretty much all automated spam that isn't targetted specifically to you.

Re: Botspam apocalypse

#356

Post by GTP »

david_draco wrote: post #350
GTP wrote: post #78

Earlier quoted context omitted.

But solving a BOINC task requires too much time while the average user rightfully expects a webpage to load within 5 seconds or so

Usually you have a landing page, and then you enter stuff there, and finally you get output. That gives you about 1 minute before returning first results. If the user is faster, you can show something like cloudflare does when you visit through Tor. On later submissions you can reuse the reputation from the cookie.

Still, 1 minute is far from enough to solve a BOINC task.

Re: Botspam apocalypse

#357

Post by birracerveza »

me_again wrote: post #348
birracerveza wrote: post #34

Earlier quoted context omitted.

Because you don't have experience with it. There's nothing complicated about SIWE, minting an NFT and checking its validity, certainly not to describe it "prohibitively convoluted" aside from being scared of web3 keywords. Come on now. Not commenting on op's solution's validity or effectiveness, just replying to your comment.

If you rounded up 100 regular web users and ran a usability test where they had to do this to post a comment, how many do you think would succeed?

A much higher percentage than 4 years ago, that's for sure

Re: Botspam apocalypse

#358

Post by Zak »

fariszr wrote: post #295
nixcraft wrote: post #95

I run a popular blog and confirm that spam is a massive issue. I am trying to keep the independent web alive with an old-school commenting system because it helps readers and myself improve outdated posts. My domain is over 20+ years old and attracts all sorts of threats, including monthly DDoS and daily spam. Using Cloudflare solved all of these problems. Next, you need to add firewall rules inside Cloudflare WAF to…

Hmmm, maybe offload your comments to something else ? Im thinking of using GitHub issues/discussions as a comment system. The website and everything will function normally without CloudFlare, but the comments are based on GitHub, which will deal with spam and hosting for me. And i personally think using it is better from centralizing the internet view, as you don't increase the absolutely crazy 20% that CF controls o…

I've integrated a static site and a Wordpress site with Mastodon for comments. I rarely get any comments, but I never get any spam.

I do generally think federated social networking (ActivityPub) is a good way to handle commenting. Comments are associated with identities separate from your site and there's plenty of opportunity to layer a reputation system on top of that, though I don't know if it's been done yet.

Post reply on HN