Mahz's Dev Journal

[Ellri]

He's alive?

RUN FOR THE HILLS!!!!

[LegendBegins]

@Mahz

Did you take that picture? If so, excellent view. Additionally, do you still approve github coding changes? That could allow others to work on the Guild for you.

[ArenaSnow]

Is there a system in place to record the IP's of the spambots?

[BBeast]

@ArenaSnow, the trouble is that even if bots were IP banned, it is generally trivial for the bot producers to send the bots through a new IP. It might help slow the influx, but I think enhanced reporting measures would help more.

@Mahz, unrelated to bots, but I thought I would mention it anyway. I am quite a fan of your search engine for the Guild. Being able to search a specific thread, even a specific tab, with ease, including filtering by username, is extremely useful when you want to find something that was written somewhere under a few million words of posts. Thank you.

[ArenaSnow]

@ArenaSnow, the trouble is that even if bots were IP banned, it is generally trivial for the bot producers to send the bots through a new IP. It might help slow the influx, but I think enhanced reporting measures would help more.

@BBeast

Not the intent.

Even old spambot IP's can be useful for analysis. Recording them and then sending them to certain parties could help at least get a better understanding of the issue.

[NuttsnBolts]

IP banning can be dangerous. I remember on my old site we were looking through IPs and noticed a few members had the same address. Turns out that they had a shared community with a suburb like wifi zone.

So you can set up something that could where you took the address and banned them, but you don'tknow how many others may be affected.

A better option might be an email blacklist seeing as your bots tend to use custom sites and/or temporary emails. However again, blacklisting is dangerous.

[ArenaSnow]

Again, not the intent - knowing the IP's or at least sending them to someone who can analyze them could be a first step towards attempting to cut the problem down from another angle.

[Shienvien]

IP filtering can be very useful, but more often than not it handles ports, or letting only a single server/node with a specific static IP address to access a service, or only your intranet (devices that are connected to your local, non-public net), or...
IP bans for public websites, especially if the IPs under question belong to public leased ranges, are generally pointless and usually harm lawful users.

IP addresses are not set, and can be very easily changed to almost any currently available number. Even if you don't knowingly IP-hop, your IP address will most likely not stay for very long, since your address doesn't typically "belong" to you - it's leased; static IP addresses are something you pay your net provider extra, and you generally don't want one unless you have a server to host. (By default, whenever you connect to wifi after being disconnected for a bit - or when the old IP address expires -, your computer will go "Hey, DHCP, I need an IP address to talk to the net!". And the DHCP will give you a random currently free one.) And it's leased from a company - some range of IP addresses will be clients of a net provider, another to an university, etc. Oh, and a single IP address can mean thousands of simultaneous devices (due to different NATs).
In the end, banning a non-static IP will mean that whoever currently has the IP will not be able to access - and with larger leasers, it just about might be that you might have made half a million people play a roulette of who gets the bad one. Which is not particularly effective by any stretch of the imagination. And if you get an unit with one static public IP for everyone, you now have punished a hundred, thousand, ... people at once.

So ... yeah. It might be worth banning the static IP of a particularly troublesome server for a set amount of time (surprise-surprise, a server might decide to hop IPs, too, especially if too many places have banned them, and then the IP goes back into the pool). The IP leased to some random home PC? Never worth banning.

Ehh... Sure, we could follow the bots' IP addresses for a bit, see whether they map back to a server pretending to be many people, or some subset with a common public IP, but if it is paid "human bots", or infected computers, or anything of the sort, that'll lead nowhere.

[NuttsnBolts]

@Mahz
Seen a message on Facebookabout the sign ups being down for a few hours. I logged out and checked it myself but the message it gave me said it had been down for about 14 hours.

Just checking in case this was a glitch somehow or if there's some work being done to the site.

[Meth Quokka]

@Mahz
Seen a message on Facebookabout the sign ups being down for a few hours. I logged out and checked it myself but the message it gave me said it had been down for about 14 hours.

Just checking in case this was a glitch somehow or if there's some work being done to the site.

@NuttsnBolts

I just re-enabled regristrations. It was just an unfortunate case where no-one had been online to enable regristrations after our closed period.

[Legend]

I fear that the bots may actually have the potential to kill RPG. Is this a major concern?

[Hank]

I fear that the bots may actually have the potential to kill RPG. Is this a major concern?

@Legend

We'll mobilize Mahz if it really becomes a problem but it's not a major concern right now. RPG is still maintaining healthy levels of activity and new registrations. The decision to disable registrations at those hours was a pretty easy one to make after we learned that basically the only accounts made during those hours are by the bots. 95% of genuine registrations happen during the American daytime/evening.

That we're sometimes not around to re-enable them is an unfortunate but unavoidable side effect.

[Ailyn Evensen]

We'll mobilize Mahz if it really becomes a problem but it's not a major concern right now. RPG is still maintaining healthy levels of activity and new registrations. The decision to disable registrations at those hours was a pretty easy one to make after we learned that basically the only accounts made during those hours are by the bots. 95% of genuine registrations happen during the American daytime/evening.

That we're sometimes not around to re-enable them is an unfortunate but unavoidable side effect.

@Hank

Maybe we should be changing/altering the registration block window? In the short period of time I've been here, I've noticed a chunk of bot registrations that usually happens between 02:00 - 05:00 GMT.

[Elize]

I'm just curious but could there be a username change feature or request?

I know one forum does it but only a limit of two times per year.

Just thought I'd ask!

[NuttsnBolts]

I'm just curious but could there be a username change feature or request?

I know one forum does it but only a limit of two times per year.

Just thought I'd ask!

@Elize

Time restricted limits are only in place so people don't abuse the system, or so some admins will believe. It doesn't matter if it's 1 change a year or 100 as it's just a database update.

Unfortunately the Guild doesn't have that feature implemented yet so the only way is to make a new account under a new name.

[Mahz]

I'm looking into some performance issues that Hank pointed out to me.

[Dion]

@Mahz Any chance you'll be able to give us insight into what is going on behind the scenes? Purely out of curiosity, because last time we received a small update on the issue and I actually found that rather entertaining to read, lol.

[NuttsnBolts]

@Mahz!!!
We miss you!

[Mahz]

@Buddha I'm not sure what the issue is, yet.

The database upgrade I did a while back was so effective that I didn't have to do any performance work on the Guild for some time.

So I'm not sure it's directly related to user load.

[LegendBegins]

@Mahz

It is good to see you once again, Mahz.