Massive Spambot invasion 4/16/2016

[Mahz]

Okay, Recaptchas should be off now.

Update: Ok, I think we've nuked the forum back into a tolerable state.

I hate that new-user registrations are now disabled, but tomorrow I'll begin the process of fleshing out some new system ideas for preventing this sort of spambot vandalism in the future. The sooner I figure out the next steps, the sooner new people can join the guild again.

For instance, maybe it's worthwhile to build a quick invite system so that existing, trusted members can let their friends join the forum if they know them off-site. Something like that in the meantime. Dunno yet.

I still have some straggler spambots to delete and possibly some bugs that have emerged during today's server hot-fixes.

[VKAllen]

Okay, Recaptchas should be off now.

Update: Ok, I think we've nuked the forum back into a tolerable state.

I hate that new-user registrations are now disabled, but tomorrow I'll begin the process of fleshing out some new system ideas for preventing this sort of spambot vandalism in the future. The sooner I figure out the next steps, the sooner new people can join the guild again.

For instance, maybe it's worthwhile to build a quick invite system so that existing, trusted members can let their friends join the forum if they know them off-site. Something like that in the meantime. Dunno yet.

I still have some straggler spambots to delete and possibly some bugs that have emerged during today's server hot-fixes.

@Mahz

If there's nothing else that the community can do to help, then we leave it to your capable hands.

[Mao Mao]

I think that we should leave registrations disable and do what other roleplaying sites are doing. Install an invite system and open registrations to the general public once a month or every two-three months.

[Shienvien]

Advanced seems to have a number of pages composed of only bot-posts left, composed by only the following bots:
woonbae
laraphot112
vqqvhydkg
qkzkfk3
qkzkfk2

Invites seem to be a good short-term idea (once-valid codes generated from server timestamp seed that users can send out?).

I think that we should leave registrations disable and do what other roleplaying sites are doing. Install an invite system and open registrations to the general public once a month or every two-three months.

@The Spectre

Far too drastic. We're not intending to keep our site artificially small like some out there.

[Mao Mao]

<Snipped quote by The Spectre> Far too drastic. We're not intending to keep our site artificially small like some out there.

@Shienvien

I think we have a good enough size and daily activity to do this. Plus, we can have an open registration date every month. And we would have a reduced amount of spam-bots forever.

[ClocktowerEchos]

<Snipped quote by Shienvien>

I think we have a good enough size and daily activity to do this. Plus, we can have an open registration date every month. And we would have a reduced amount of spam-bots forever.

@The Spectre

I see no reason why such dramatic measures are needed. New blood is always needed to replace the old that have left to gone inactive. There is no reason that people should have to go out of their way to mark down something on a calendar just to sign up for a RPing site, its plain stupid. RPGuild isn't built to be an elitist platform and I sure as hell it doesn't end up like that.

Also, I'm not sure about you, but I actually had a bit of fun during the spamvasion. Outside of fill up boards, it didn't affect RPs that were already in progress that much, of which I can like to your saying of "they had a good enough size and daily activity to do that".

If it happens again, I have faith that Mahz and the Mods will be able to fix it without resorting to measures that remind me of Trump's mexican wall delusions.

tl;dr - the "registration date" idea is plan stupid and I don't see any point in doing it unless you really got that scared shitless from spambots.

[Shienvien]

I only know of one non-closed-circle (so publicly available) RP site and one pet site that have employed such tactics to begin with - the first specifically because they're trying to keep the amount of users low (and I can see it's causing tangible problems like cliqueing and people's inability to find interest for more niche ideas), the second because their servers did not tolerate the amount of concurrent users.

[Mao Mao]

RPGuild isn't built to be an elitist platform and I sure as hell it doesn't end up like that...

@ClocktowerEchos

So, having registration disable and open registration dates is going to suddenly turn the RPGuild into a place for elitists to hang and chill... And I don't really see it as a dramatic measure, many other roleplaying sites have this system in place and none of them have turned into elitist hubs.

Plus, we have sections based on your writing, grammar, etc. so I don't think that having the system added would immediately turn this site into a place for elitists (hell, we don't even have any here so I wouldn't worry much about it).

[ClocktowerEchos]

@The SpectreYou have cherry picked my statement, do you not have a suitable response for the rest of what I said or what @Shienvien said?

I have already said beyond that bit about elitism, that its completely unnecessary and quite the illogical conclusion.

Seriously, did the spambots spook you so much that we have to basically wall off RPGuild for "protection"?

Whose to say that the spambots wouldn't just rush in on the day registration was open and fuck stuff up then if such a proposal was implimented?

[Hank]

Alright, I think we got most of them. If you see any stray spambot posts, please report their accounts here.

[Shienvien]

So, having registration disable and open registration dates is going to suddenly turn the RPGuild into a place for elitists to hang and chill... And I don't really see it as a dramatic measure, many other roleplaying sites have this system in place and none of them have turned into elitist hubs.

@The Spectre

Which "many"? Of the handful I'm semi-regular visitor of, and the dozen more I've at least looked at, only one employs such tactic (and that one started around a couple of months ago, and by my observations, is actually suffering for it).

[Ellri]

RPers in general generally don't go looking for places to RP on specific dates. Muses are often fickle creatures, so chances are that someone who would join might not be in possession of an active muse at such a registration date.

Far easier to have a demand on introduction thread and/or approval/invite from another user with >n post count. The latter would help those who get panicked by the idea of writing such a thread join.
If you need to have been registered for 1 months and have at least 200 posts to approve a user, chances are pretty high you're not a spambot. We thought of suggesting higher numbers, but not everyone posts a lot even while being active. if a bot manages to get to 200 posts and 1 month of life, its a pretty good bot.

Our cost-benefit evaluation of just 1-3 days per month with registration puts the costs at far higher than the benefits.

[Chronothesis]

They are coming! WE MUST BE READEHHHHHH.

[AtomicNut]

My two cents here.

To be honest one of the most effective ways i have seen to stop a bot is simply ask the new user to perform an open ended answer task before joining, such as "write us an rp sample, or just tell us about yourself". Chances are, spambots are nowadays too stupid to write coherent sentences who are not made of rehashed words.

[Shienvien]

If you need to have been registered for 1 months and have at least 200 posts to approve a user, chances are pretty high you're not a spambot. We thought of suggesting higher numbers, but not everyone posts a lot even while being active.

Some members don't even pull off 200 posts in a year of running an active RP, for starters...

In any case, we do not want a non-automated or needlessly restrictive/limiting approval process. "Just tell about yourself" is about as far from ideal as it gets. It cannot be automated, it's potentially time-consuming, and will put pressure on those seeking to join.

[VKAllen]

Every option we have will have its drawbacks. It's a matter of which one Mahz will take. Any of the suggested options could work but at the expense of another not working. All that matters is that the bots are rid of. Leave security to the man who knows the inner workings of this site.

[Shienvien]

If we had, say, five more mods (so at least one will probably be on at all times to nuke any bot that sneaks through, as opposed for them posting freely for four hours before a single mod shows up as happened during my morning-periods this time around) and a measure that sort of works, then it's good enough. We don't need a "No bot will ever come through again, EVER" measure at the cost of users. We need enough for them to stay at easily manageable levels.

[Ellri]

Not many we've seen of those, @Shienvien.

Sample post or somesuch would work for many too.

It doesn't take a lot to rack up 200 posts. A bit of ooc chatter, participation in a spam section thread or three, a few IntCk posts, the rare IC posts...

Mind you, these were suggested parameters for being allowed to approve new users as non-bots. Most of the guild members who don't rack up a post count like that tend not to care overmuch about reviewing new members, wethinks.

[Shienvien]

That's mostly advanced slow-posters who don't do much chatter, Ellri. The GM of my main game here has less than 400 posts after being here since NewGuild was created, and our RP has several with even less. Mind, he's also the one who invited me here on OldGuild... And I know quite a few people who'll just gather up their friends, join a site, and play.

Point being, do not force people to do things they don't want to for arbitrary reasons. Not everyone's behaviour is similar to your own. Many people avoid spam like plague. Some don't chat. Some just tag along with friends. Some will sooner not join than post an intro thread.

[Hank]

Alright, I think we got most of them. If you see any stray spambot posts, please report their accounts here.

@Hank

To reiterate. In the meantime, thank you all for your patience the past three days. As the current crisis is over, I will be locking and unstickying this thread. Further discussion about how to handle the spambot problem can be taken to Mahz's Dev journal.