Re: [Wiki-gang] Wiki vandal attack. Ongoing. Help in #olpc now if you can.

2 messages Options
Embed this post
Permalink
Samuel Klein

Re: [Wiki-gang] Wiki vandal attack. Ongoing. Help in #olpc now if you can.

Reply Threaded More More options
Print post
Permalink
Thanks for the heads up.

This is a useful view of recentchanges:
http://wiki.laptop.org/index.php?title=Special:RecentChanges&hideliu=1&limit=500&hideminor=0

It looks like cjl and I managed to revert all the bad anon edits from
the past 24 hours.
I turned on the Sorbs blacklist extension, which may automatically
block edits from IPs on that blacklist; and added the CommentSpammer
extension, which blocks edits from IPs caught by the wiki-commentspam
honeypot project.  This should help with the major categories of spam
we're still running into.

SJ

On Wed, Dec 17, 2008 at 1:25 AM, Mel Chua <[hidden email]> wrote:

> <mchua_> Hey, guys - we have a spam problem. cjl and joachimp are
> pitching in but we need extra hands if folks can spare them, now.
> (especially sysops, and people with vandal/spam fightin' experience.)
>
> <cjl> look at recent edits, I'm in rollback hell
> * mchua_ takes out the well-polished double-barreled shotgun (I've been
> noticing some IP spam over the last few days...)
> <cjl> look at IP addresseswith edit fields  'FIELD_MESSAGE
> <mchua_> joachimp, cjl: I'm looking at
> http://wiki.laptop.org/index.php?title=Special:RecentChanges&hideliu=1&hideminor=0
> <mchua_> cjl, if you're still rolling back pages, I'm going to focus on
> identifying and blocking IPs that are exhibiting only spam behavior.
> <joachimp> is it possible to revet all by ip X?
> <mchua_> joachimp: I hope so. Can you look at the mediawiki docs and
> find out? I'm just blocking spam IPs now....
> <mchua_> joachimp: I think that cjl and I can try to stem the tide if
> you can look at the mediawiki docs for a longer-term solution for this.
> I'm also going to send out a cry for help on wiki-gang right now.
> <mchua_> joachimp, cjl: I'm also going to move to #olpc so that folks
> not on s-g can help us
> _______________________________________________
> Wiki-gang mailing list
> [hidden email]
> http://wiki.laptop.org/go/Wiki-gang
> (_internal_name)s
>
_______________________________________________
Library mailing list
[hidden email]
http://lists.laptop.org/listinfo/library
Mel Chua

Re: [Wiki-gang] Wiki vandal attack. Ongoing. Help in #olpc now if you can.

Reply Threaded More More options
Print post
Permalink
Thanks, SJ. In the ticket I filed to sysadmin, I put a note to follow up
on the threads on this attack in the wiki-gang archives, so whoever
takes that ticket has up-to-date information.

Samuel Klein wrote:

> Thanks for the heads up.
>
> This is a useful view of recentchanges:
> http://wiki.laptop.org/index.php?title=Special:RecentChanges&hideliu=1&limit=500&hideminor=0
>
> It looks like cjl and I managed to revert all the bad anon edits from
> the past 24 hours.
> I turned on the Sorbs blacklist extension, which may automatically
> block edits from IPs on that blacklist; and added the CommentSpammer
> extension, which blocks edits from IPs caught by the wiki-commentspam
> honeypot project.  This should help with the major categories of spam
> we're still running into.
>
> SJ
>
> On Wed, Dec 17, 2008 at 1:25 AM, Mel Chua <[hidden email]> wrote:
>> <mchua_> Hey, guys - we have a spam problem. cjl and joachimp are
>> pitching in but we need extra hands if folks can spare them, now.
>> (especially sysops, and people with vandal/spam fightin' experience.)
>>
>> <cjl> look at recent edits, I'm in rollback hell
>> * mchua_ takes out the well-polished double-barreled shotgun (I've been
>> noticing some IP spam over the last few days...)
>> <cjl> look at IP addresseswith edit fields  'FIELD_MESSAGE
>> <mchua_> joachimp, cjl: I'm looking at
>> http://wiki.laptop.org/index.php?title=Special:RecentChanges&hideliu=1&hideminor=0
>> <mchua_> cjl, if you're still rolling back pages, I'm going to focus on
>> identifying and blocking IPs that are exhibiting only spam behavior.
>> <joachimp> is it possible to revet all by ip X?
>> <mchua_> joachimp: I hope so. Can you look at the mediawiki docs and
>> find out? I'm just blocking spam IPs now....
>> <mchua_> joachimp: I think that cjl and I can try to stem the tide if
>> you can look at the mediawiki docs for a longer-term solution for this.
>> I'm also going to send out a cry for help on wiki-gang right now.
>> <mchua_> joachimp, cjl: I'm also going to move to #olpc so that folks
>> not on s-g can help us
>> _______________________________________________
>> Wiki-gang mailing list
>> [hidden email]
>> http://wiki.laptop.org/go/Wiki-gang
>> (_internal_name)s
>>
> _______________________________________________
> Wiki-gang mailing list
> [hidden email]
> http://wiki.laptop.org/go/Wiki-gang
> (_internal_name)s
_______________________________________________
Library mailing list
[hidden email]
http://lists.laptop.org/listinfo/library