RE: [Axiom-developer] spam attack

[Page, Bill]

On Wednesday, August 02, 2006 7:47 AM Antoine Hersen wrote:

> Thank you very much for fighting spam for us.

Thanks for the encouragement to continue the fight against
these web site abusers.

> I like to point how important it is not only because it is
> annoying but also because it will make the axiom web page a
> so called "farm link" meaning loosing rating or not even showing
> up in Google and co. 

Yes you are right, this could happen if we let too much spam
accumulate.     

The spam attach is still continuing at the rate of more than 60
attempts per minute. Uncaught spam arriving at this rate could
easily overwhelm our server and cause it to fail.

My first attempt at a remedy for this problem was to configure
the wiki to require user preferences to be set before permitting
comments and then left the ban on http external links. This works
but unfortunately the spam robots are smarter than I thought and
actually do set the cookies necessary to indicate valid preferences.
So when I tried it a few hours ago, we got another burst of spam
that got through and ultimately (partly my fault) it resulted in
having to reboot the axiom-developer.org server.

My second attempt to control this threat is to continue the ban
on http external links for unauthenticated (i.e. non Zope) users.
This is the way the ban was originally supposed to work - users
who have a specially assigned user id - over and above that set
in their preferences - are allowed to ignore the ban. If they
are editing a page or adding a comment that contains banned
content, then they will be prompted to enter their user id and
password. If it is valid, the edit will be allowed to continue.
If not, then they (and all those damned robots!) will receive
a 401 Unauthorized return code.

This seems to be working now. Would those of you who have the
Zope user accounts, i.e. Ralf, Marten, and Bob McElrath, please
try this and confirm that it is working the way it is supposed
to.

It might be possible to lift the ban on external links at some
point in the future if these spam attacks stop, but in the
mean time, if you are an Axiom developer or Axiom user and you
want to be able to freely edit and post comments to the Axiom
Wiki, please contact me by email and I will provide you with a
Zope user id. If you would like just to make one or two simple
pages and you get caught by this ban, maybe the best approach
would be for you to send your changes to one someone who already
has a Zope user id.

Regards,
Bill Page.