Re: plone.org spamming problem

[Wichert Akkerman]

Hi Balazs,

the website team and the admin group are the right people to tackle
this.  I've cc'ed them on this mail.

Wichert.


On 4/24/09 7:04 PM, Balazs Ree wrote:

> Hi Wichert,
>
> sorry bother you with this, I don't know who is the admin of plone.org
> to send this, so please help me to forward this to the right person if
> you are not involved.
>
> I noticed on the following page:
>
> http://plone.org/documentation/how-to/kss-on-plone-3.1
>
> the worst kind of spam appeared. I don't know how this happened, should
> commenting be only for authenticated users?
>
> I can delete this comment in a snap, but I'd like to wait until I show
> it to you and others.
>
> Best wishes,
>
>    

--
Wichert Akkerman<[hidden email]>    It is simple to make things.
http://www.wiggy.net/                  It is hard to make things simple.


------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Ricardo Newbery-2]

On Apr 24, 2009, at 12:09 PM, Balazs Ree wrote:

> 2009. 04. 24, péntek keltezéssel 20.52-kor Wichert Akkerman ezt írta:
>> Hi Balazs,
>>
>> the website team and the admin group are the right people to tackle
>> this.  I've cc'ed them on this mail.
>
> Thanks! Meanwhile I talked to some people on irc, and they informed me
> that it's known and the user has been deleted. So I went ahead and
> deleted the comment.
>
> Still, it worries me because if spammers start this, they will go on,
> and it can quickly infect the whole site. Don't know how to avoid this
> if signed-up users do it.
>
> Best wishes,

If this turns out to be more than just a one-time thing, we might be  
able to flag certain posters.  A spammer is probably going to create a  
bunch of comments in a short time span.  Perhaps a workflow script or  
event-triggered script can log a list of edits in a volatile memory  
bucket and flag any users creating edit floods?  A simple template can  
be constructed to list the flagged posts along with some simple  
actions like "delete this post", "delete all posts", and "delete this  
user and posts".

Actually, now that I think about this, wouldn't it be useful to have a  
search result page somewhere listing all comments on the site as a  
batched list along with some simple actions like the above?  Might  
help with comment gardening in general.

This http://plone.org/search?portal_type%3Alist=Discussion+Item gives  
a handy list but it would be more handy if we had some delete  
shortcuts next to each entry.

Ric



------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Ricardo Newbery-2]

On Apr 24, 2009, at 1:01 PM, Ricardo Newbery wrote:

>
> On Apr 24, 2009, at 12:09 PM, Balazs Ree wrote:
>
>> 2009. 04. 24, péntek keltezéssel 20.52-kor Wichert Akkerman ezt írta:
>>> Hi Balazs,
>>>
>>> the website team and the admin group are the right people to tackle
>>> this.  I've cc'ed them on this mail.
>>
>> Thanks! Meanwhile I talked to some people on irc, and they informed  
>> me
>> that it's known and the user has been deleted. So I went ahead and
>> deleted the comment.
>>
>> Still, it worries me because if spammers start this, they will go on,
>> and it can quickly infect the whole site. Don't know how to avoid  
>> this
>> if signed-up users do it.
>>
>> Best wishes,
>
>
> If this turns out to be more than just a one-time thing, we might be  
> able to flag certain posters.  A spammer is probably going to create  
> a bunch of comments in a short time span.  Perhaps a workflow script  
> or event-triggered script can log a list of edits in a volatile  
> memory bucket and flag any users creating edit floods?  A simple  
> template can be constructed to list the flagged posts along with  
> some simple actions like "delete this post", "delete all posts", and  
> "delete this user and posts".
>
> Actually, now that I think about this, wouldn't it be useful to have  
> a search result page somewhere listing all comments on the site as a  
> batched list along with some simple actions like the above?  Might  
> help with comment gardening in general.
>
> This http://plone.org/search?portal_type%3Alist=Discussion+Item 
> gives a handy list but it would be more handy if we had some delete  
> shortcuts next to each entry.
>
> Ric

Or perhaps even easier, add a "delete user and all comments" button  
action to the three buttons already available under each comment  
("Reply" and "Remove").  Then you can use the above search result  
link, navigate to a suspicious comment to confirm it's bogus, and then  
delete everything from the user in less than two clicks.

Ric



------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Ricardo Newbery-2]

On Apr 24, 2009, at 1:15 PM, Balazs Ree wrote:

> 2009. 04. 24, péntek keltezéssel 13.01-kor Ricardo Newbery ezt írta:
>
>>
>> If this turns out to be more than just a one-time thing, we might be
>> able to flag certain posters.  A spammer is probably going to  
>> create a
>> bunch of comments in a short time span.  Perhaps a workflow script or
>> event-triggered script can log a list of edits in a volatile memory
>> bucket and flag any users creating edit floods?  A simple template  
>> can
>> be constructed to list the flagged posts along with some simple
>> actions like "delete this post", "delete all posts", and "delete this
>> user and posts".
>
> Another thing that comes to my mind, is to reject comments that  
> contain
> more then say, 20 links. The spam I saw contained only a huge row of
> links.

Which I think shows how stupid these spammers can be.  The autolinking  
function adds a nofollow attribute to the links so these link spams  
aren't going to help their google link juice at all.  Did someone  
really go to the trouble of crafting a robot to create users and post  
spam on plone.org without checking this?  Sigh.

I agree.  It seems a link-heavy filter would be useful to filter out  
the more stupid spammers.

Ric




------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Ricardo Newbery-2]

On Apr 24, 2009, at 1:10 PM, Ricardo Newbery wrote:

>> This http://plone.org/search?portal_type%3Alist=Discussion+Item 
>> gives a handy list but it would be more handy if we had some delete  
>> shortcuts next to each entry.
>>
> Or perhaps even easier, add a "delete user and all comments" button  
> action to the three buttons already available under each comment  
> ("Reply" and "Remove").  Then you can use the above search result  
> link, navigate to a suspicious comment to confirm it's bogus, and  
> then delete everything from the user in less than two clicks.


I guess this might be better if sorted by create date...
http://plone.org/search?portal_type%3Alist=Discussion+Item&sort_on=created&sort_order=reverse

Ric



------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Godefroid Chapelle]

Ricardo Newbery wrote:
> On Apr 24, 2009, at 1:10 PM, Ricardo Newbery wrote:
>
>>> This http://plone.org/search?portal_type%3Alist=Discussion+Item 
>>> gives a handy list but it would be more handy if we had some delete  
>>> shortcuts next to each entry.
>>>
>> Or perhaps even easier, add a "delete user and all comments" button  
>> action to the three buttons already available under each comment  
>> ("Reply" and "Remove").

Done TTW.

deleteUserAndComments python script
     - in portal_skins custom layer
     - protected to be callable only through POST

plone.app.layout.viewlets/comment.pt
     - customized in portal_view_customizations
     - button "Remove author and all comments" shown only if user has
"Manage portal" permission.

>>  Then you can use the above search result  
>> link, navigate to a suspicious comment to confirm it's bogus, and  
>> then delete everything from the user in less than two clicks.
>
>
> I guess this might be better if sorted by create date...
> http://plone.org/search?portal_type%3Alist=Discussion+Item&sort_on=created&sort_order=reverse

Was a great idea : recent spam cleaned up now.

I disabled the button for now as it would be too easy to delete a non
spammer by clicking the wrong button... :-S

>
> Ric
--
Godefroid Chapelle (aka __gotcha) http://bubblenet.be

------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Balazs Ree-2]

Resend, this time properly signed up to the website list. Sorry for the noise.


Bad news: the saga continies. This time with _more_ new users at the
same time.


wbmxuawth
Posted byKhansaat Apr 25, 2009 12:00 PM


nutfkwq
Posted byAmiciyahat Apr 25, 2009 11:59 AM

Same link fest as before. I remove these straight away.

I propose a simple version of the "reject if too many links" script
immediately.


--
Balazs Ree
--
Balazs Ree                 Greenfinity LLC.
Python, Zope, Plone        http://greenfinity.hu


------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Balazs Ree-2]

2009. 04. 25, szombat keltezéssel 17.43-kor Balazs Ree ezt írta:

> Resend, this time properly signed up to the website list. Sorry for the noise.
>
>
> Bad news: the saga continies. This time with _more_ new users at the
> same time.
>
>
> wbmxuawth
> Posted byKhansaat Apr 25, 2009 12:00 PM
>
>
> nutfkwq
> Posted byAmiciyahat Apr 25, 2009 11:59 AM
>
> Same link fest as before. I remove these straight away.
>
> I propose a simple version of the "reject if too many links" script
> immediately.

Something like the following would be sufficient I think:


    if text.lower().count('<a') > 20:
        raise RuntimeError, """Your comment contains illegal html
            markup. If you think this is an error, please file a
            ticket to http://foo.bar/blah with the exact text of the
            comment you wanted to add."""

--
Balazs Ree


------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Ricardo Newbery-2]

On Apr 25, 2009, at 8:56 AM, Balazs Ree wrote:

> Something like the following would be sufficient I think:
>
>
>    if text.lower().count('<a') > 20:
> raise RuntimeError, """Your comment contains illegal html
>            markup. If you think this is an error, please file a
>            ticket to http://foo.bar/blah with the exact text of the
>            comment you wanted to add."""
>
> --  
> Balazs Ree

You probably need to change '<a' to 'http://'.  Links are autogenerated.

Another idea.  These look automated.  How about a captcha on the  
account form?

Ric



------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Ricardo Newbery-2]

On Apr 25, 2009, at 2:18 AM, Godefroid Chapelle wrote:

> Ricardo Newbery wrote:
>> On Apr 24, 2009, at 1:10 PM, Ricardo Newbery wrote:
>>
>>>> This http://plone.org/search?portal_type%3Alist=Discussion+Item
>>>> gives a handy list but it would be more handy if we had some delete
>>>> shortcuts next to each entry.
>>>>
>>> Or perhaps even easier, add a "delete user and all comments" button
>>> action to the three buttons already available under each comment
>>> ("Reply" and "Remove").
>
> Done TTW.
>
> deleteUserAndComments python script
>     - in portal_skins custom layer
>     - protected to be callable only through POST
>
> plone.app.layout.viewlets/comment.pt
>     - customized in portal_view_customizations
>     - button "Remove author and all comments" shown only if user has
> "Manage portal" permission.
>
>>> Then you can use the above search result
>>> link, navigate to a suspicious comment to confirm it's bogus, and
>>> then delete everything from the user in less than two clicks.
>>
>>
>> I guess this might be better if sorted by create date...
>> http://plone.org/search?portal_type%3Alist=Discussion+Item&sort_on=created&sort_order=reverse
>
> Was a great idea : recent spam cleaned up now.
>
> I disabled the button for now as it would be too easy to delete a non
> spammer by clicking the wrong button... :-S
>
>>
>> Ric
> --  
> Godefroid Chapelle (aka __gotcha) http://bubblenet.be

Thanks Godefroid!

Just went through and deleted the latest batch of stupid.  Noticed  
that the delete failed a few times and had to try again.  Nothing  
showed up in the error_log.  Shrug.

Ric




------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Balazs Ree-2]

2009. 04. 25, szombat keltezéssel 09.32-kor Ricardo Newbery ezt írta:

> On Apr 25, 2009, at 8:56 AM, Balazs Ree wrote:
>
> > Something like the following would be sufficient I think:
> >
> >
> >    if text.lower().count('<a') > 20:
> > raise RuntimeError, """Your comment contains illegal html
> >            markup. If you think this is an error, please file a
> >            ticket to http://foo.bar/blah with the exact text of the
> >            comment you wanted to add."""
> >
> > --  
> > Balazs Ree
>
>
>
> You probably need to change '<a' to 'http://'.  Links are autogenerated.
>
> Another idea.  These look automated.  How about a captcha on the  
> account form?

Good too, but please act quickly or we'll be covered with spam faster
than you can imagine.

Note I'm not admin on plone.org, but if you need my help, find me on
irc.

ps. Godefroid, I did not follow the list before yesterday, just jumped
in because I saw the spam on the kss pages.


--
Balazs Ree


------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam

[Ricardo Newbery-2]

On Apr 25, 2009, at 9:46 AM, Balazs Ree wrote:

> 2009. 04. 25, szombat keltezéssel 09.32-kor Ricardo Newbery ezt írta:
>> On Apr 25, 2009, at 8:56 AM, Balazs Ree wrote:
>>
>>> Something like the following would be sufficient I think:
>>>
>>>
>>>   if text.lower().count('<a') > 20:
>>> raise RuntimeError, """Your comment contains illegal html
>>>           markup. If you think this is an error, please file a
>>>           ticket to http://foo.bar/blah with the exact text of the
>>>           comment you wanted to add."""
>>>
>>> --  
>>> Balazs Ree
>>
>>
>>
>> You probably need to change '<a' to 'http://'.  Links are  
>> autogenerated.
>>
>> Another idea.  These look automated.  How about a captcha on the
>> account form?
>
> Good too, but please act quickly or we'll be covered with spam faster
> than you can imagine.
>
> Note I'm not admin on plone.org, but if you need my help, find me on
> irc.
>
> ps. Godefroid, I did not follow the list before yesterday, just jumped
> in because I saw the spam on the kss pages.

I added a link filter to /portal_skins/custom/validate_talkback

Ric





------------------------------------------------------------------------------
Crystal Reports - New Free Runtime and 30 Day Trial
Check out the new simplified licensign option that enables unlimited
royalty-free distribution of the report engine for externally facing
server and web deployment.
http://p.sf.net/sfu/businessobjects
_______________________________________________
Plone-website mailing list
[hidden email]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam