NodeBB anti spam

[Chris]

Any updates on a recaptcha for sign ups? Had to delete a few users today - they didnt actually post anything but there were a few random signups that were clearly fake.

E-Mail verification on new accounts would be handy as well.

[julian]

Hey @theepiphany -- right now, my focus is on overhauling the email system. After that is done, we can add the ability to lock down posting for unverified accounts.

[trevor]

+1 on email system.

[julian]

Working on it as we speak...

#newyearsproblems

[StuartH]

rather than using rechatcha which most people hate myself included, I use questions relevant to the forum on my xenforo site and so far not one spam bot has got through, would this be easier to implement?.

[julian]

Oh most likely. You'll notice my first reply to this topic was 3 months prior

I hate CAPTCHAs as much as the next guy. If there's a way for me to not have to use one, I'd go for it.

[kamov]

@julian said:

Oh most likely. You'll notice my first reply to this topic was 3 months prior

I hate CAPTCHAs as much as the next guy. If there's a way for me to not have to use one, I'd go for it.

Check this: http://www.stopforumspam.com/

API usage: http://www.stopforumspam.com/usage

the service is free, you have 20k API queries per day.

I hope you can integrate it asap, as the spammer are a big problem for my sites

Thanks!

[datagutt]

If the NodeBB developers choose to implement stopforumspam.com, here is a node module for it: https://github.com/dkleehammer/node-stopforumspam

[julian]

@datagutt :

here is a node module for it: https://github.com/dkleehammer/node-stopforumspam

Now that's what I like to hear...

[bentael]

@datagutt said:

If the NodeBB developers choose to implement stopforumspam.com, here is a node module for it: https://github.com/dkleehammer/node-stopforumspam

taking a shot at that today if no one beats me to it.

Stay tuned.

[bentael]

hmm ....

doesn't really provide post.content analysis, just username, email and IP, is that really what we need?

EDIT: unless you want this check on User creation. @julian can we sneak in a filter:user.create but where do I get the req.connection.remoteAddress from? is the express.req available anywhere at this point?

I was thinking something like that in User.create .. async.parallel call

			function(next) {
				plugins.fireHook('filter:user.create', {username: username, email: email, /* req: req, and probably leave the password out, or not? */}, function(err){
					next(err);
				});
			}

[bentael]

or should that filter live in here? where it would have a reference to the req object.

https://github.com/designcreateplay/NodeBB/blob/master/src/routes/authentication.js#L200

[psychobunny]

I think req.connection.remoteAddress could be passed into user.create, perhaps at some point in the future NodeBB will also store user's IP as well

[bentael]

@psychobunny that won't work if behind proxy, you need req.ip - BUT you also need express.enable('trust proxy'); if behind one

[bentael]

plugin pending this PR: https://github.com/designcreateplay/NodeBB/pull/820 needed that added hook and the req.ip to be plumbed in User.create

[baris]

Hopefully one of the early birds can take a look @julian @psychobunny

[psychobunny]

@julian is the early bird I'm going to bed (mooning)

[julian]

@bentael -- merged it in, but let me know what you think re: my comment, perhaps I am mistaken?

[bentael]

replied. Thanks.

[bentael]

@julian @baris @psychobunny
we may have a little problem, so I'm writing this anti-spam plugin, and I was able to successfully use the StopForumSpam.com api, and I wanted to use the filter:post.create hook to submit to Akismet as well, BUT, Akismet's API is very greedy, it wants all this stuff, i am not too sure we can easily plumb all that through, what do you think?

some we may not have, but still. I can get the req object in, but not too sure if you have something else in mind

blog url (required)
user_ip (required)
user_agent (required)
referrer (note spelling)
permalink
comment_type
comment_author
comment_author_email
comment_author_url
comment_content
comment_date_gmt
comment_post_modified_gmt
blog_lang
blog_charset

Should we also change the Post.create signature, but then we need to do the same for Topic.reply, Topic.post, and plumb all these info through.

thoughts?