I was experiencing the same types of "spam," or whatever it is. I started to enforce a captcha on every edit, which bothers me, but stopped the junk. I hope there's a better solution out there! Thanks, Ben ---- OpenOffice and open source blog: http://www.solidoffice.com/ Wiki business directory: http://www.wikipages.com/ On Thursday, October 11, 2007, at 01:04PM, "2007(a)gmask.com" <2007(a)gmask.com> wrote:

Yea I don't want to stop anonymous users but it seems like that might be neccessary.. or it would be great if you could captcha new posts from either new users or unfamiliar IP's. -Adrian --- Chuck <chuck(a)mutualaid.org> wrote:

dKosopedia admin wrote: I know it's not a solution, but since I've seen a few edits on my wiki in such cases, I zapped all users with the FooooBaarr name format. I did a MySQL query to grab all the 10 character user IDs where the user ID and the real name were the same (and where it wasn't the one real user who just happened to get caught with this same general format name). With these IDs, I created a script to run changePassword.php (in the /wiki/maintenance/ directory) for every such user. This replaced all the passwords with one I know so these bots can't sign in. I then used SQL to rename the users to zzFooooBaarr so they sort to the bottom in the User List page. Still there, but unusable by the spammers and not interfering with regular users. I put the reCaptcha extension in place to try to defeat the bots from making new user IDs. Mike

On 16/10/2007, Chuck <chuck(a)mutualaid.org> wrote: Not here. I set anonymous edits to false and installed reCaptcha. Installing reCaptcha doesn't really constitute a big change to the wiki (its quite unobtrusive really), but disallowing anonymous edits is a pain. This is especially true of pre 1.11.0 MW versions where 'view source' doesn't seem to work 'out of the box'. In theory there should be a simple SQL query to detect these kinds of spam (one nonsense word at the start of a page) - However, it seems better to code a general solution that highlights potential spam for review. Its keeping track of the potentially spammed pages that I find most difficult. Anyone handy with Bayesian filters? If we could rank edits by 'spaminess' using a Bayesian filter, and be given the option to review the top n most spammy revisions (with feedback training) ... well... that would be great! Send all your edits to a gmail account and only allow those that get forwarded back? -- hello

On 16/10/2007, Eric K <ek79501(a)yahoo.com> wrote: I like the idea. Not currently. I think a 'review for spam' feature would work very well for most small sites. -- hello

I agree, you're right, to be more accurate, captcha only makes certain that a human is editing the page (then to get more technical, complex bots can solve the captcha). Throttling is also necessary - anything to prevent bots from doing the things they do good. Rob Church <robchur(a)gmail.com> wrote: On 16/10/2007, Eric K wrote: I have to point out the flaw in that statement, tenuous thought it is - a CAPTCHA does *not* constitute an anti-spam acid test; all it does is confirms that, to the best of the test's ability (which might not count for anything), that we are dealing with a human being, rather than an automated program. A human could quite well post spam to his/her heart's content, and would be able to pass a CAPTCHA (we hope). The default configuration settings for ConfirmEdit, which CAPTCHA extensions are based upon, allow registered users to skip these tests, so in theory, one could set up a spam bot with a few minutes of initial human assistance, which is why we supplement such things with throttles, "heuristics" (regular expressions aren't that great in terms of configurability, but I cling to the hope that one day we'll have decent spam-edit detection heuristics, even if just for the basics). Rob Church _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/mediawiki-l --------------------------------- Don't let your dream ride pass you by. Make it a reality with Yahoo! Autos.

Shah, Nikhil wrote: With JavaScript: http://en.wikipedia.org/wiki/Wikipedia:NavFrame

This gibberish spam doesn't make much sense, pardon the pun. The spambot isn't inserting any actual links. My wikis are getting spammed with short text strings like "copasnotra" and "romonboel". Based on my limited understanding of spambots, it seems like the bots are making these changes as a prelude to doing something else. After some further investigation, some interesting clues emerge. This "gibberish spambot" is evidently generating fake user accounts. I deleted hundreds of fake accounts last night from the four wiki databases that we run. The spambot is surprisingly doing something that should make it easy to stop them: all of their fake user accounts include an email address from the ".ru" domain. The user names are all different, but the spambot only uses a limited number of fake email addresses from the .ru domain. Would it be possible to reject user registrations with code that rejects anything from a certain domain? Another facet of this problem is that this spambot is using proxy ISPs or rotating fake IP addresses. In my experience, this is a common method that spambots use to defeat easy anti-spam measures like server level IP blocking. Now that I think about it, I may have thwarted the final stage of this bot's activities by implementing that spam hack that stops hidden DIV spam. But our wikis are still getting hit hard by the "gibberish spam". It's unclear if the hidden DIV spam and the gibberish spam are part of the same spambots suite of attacks. Chuck

2007(a)gmask.com wrote: Right. This is the same bot we're having problems with. Chuck

How about similar to this? $text = explode("\n", $revision->getText()); If (preg_match($gibberishRegex, $text[0]) ) { Return "bad user"; } else { Return "ok"; } -----Original Message----- From: mediawiki-l-bounces(a)lists.wikimedia.org [mailto:mediawiki-l-bounces@lists.wikimedia.org] On Behalf Of 2007(a)gmask.com Sent: Tuesday, October 16, 2007 2:34 PM To: mediawiki-l(a)lists.wikimedia.org Subject: Re: [Mediawiki-l] jibberish REGEX syntax help So what would the syntax be to match something that begins at the start of the page? Sort of what I'm thinking is to try and match anonymous users who post under a certain number of characters to the beginning of a page. But it seems like regex is limited to matching the beginning of a line. -Adrian --- Chuck <chuck(a)mutualaid.org> wrote: _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/mediawiki-l

2007(a)gmask.com wrote: I was thinking that this could be checked against a dictionary. If the first "word" inserted is not in the dictionary (for the page's language), require the user to confirm the save. A bot won't confirm. This would have to be smart enough to skip wikitext (e.g. don't worry about "[[Image:"). Similarly, it would choke on obscure acronyms, but a real person would not likely complain too much. This could be a hook into the "save" code and only need check for the first word. However, the bot writer can switch to posting at the end of the article... Possibly, a scan of the entire page to reject exceptionally bad spelling might suffice, but will put off some contributers (and annoy US vs Canadian vs British spellers if the bad spelling algorithm isn't smart enough to think honour vs honor isn't that bad). Mike

Dan Bolser wrote: Look at bogofilter. There is no reason you couldn't pipe all changes through it - and creating HAM and SPAM files for sorting and training. I use it for email with very good results. ---------------------------------------------------------------- Karl Schmidt EMail Karl(a)xtronics.com Transtronics, Inc. WEB http://xtronics.com 3209 West 9th Street Ph (785) 841-3089 Lawrence, KS 66049 FAX (785) 841-0434 Why are so many spending time watching dark movies about hopelessness, the macabre, and perversion; why are they reading books about unfaithfulness and self destruction? Why is nothing uplifting, also considered 'cool' or entertaining? -kps ----------------------------------------------------------------

Hello, If you can attach a snap of "what appears to be chinese spam", I can help you identify if it is chinese and what does it say if it is in chinese. Nelson Computer Sciences Corporation Registered Office: 2100 East Grand Avenue, El Segundo California 90245, USA Registered in USA No: C-489-59 ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- This is a PRIVATE message. If you are not the intended recipient, please delete without copying and kindly advise us by e-mail of the mistake in delivery. NOTE: Regardless of content, this e-mail shall not operate to bind CSC to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose. ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- &quot;2007(a)gmask.com&quot; &lt;2007(a)gmask.com&gt; Sent by: To mediawiki-l-bounc mediawiki-l(a)lists.wikimedia.org es(a)lists.wikimedi cc a.org Subject [Mediawiki-l] chinese spam 10/11/2007 12:09 PM Please respond to 2007(a)gmask.com; Please respond to MediaWiki announcements and site admin list <mediawiki-l@list s.wikimedia.org> I'm still getting spammed with what appears to be chinese spam. Can I use the regex filter to block all non western characters, or specifically chinese ones? -adrian _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/mediawiki-l

Hmm... that doesn't seem to block the simplified chinese characters. --- jidanni(a)jidanni.org wrote: