NodeBB anti spam

[jmeketa]

Evaluating to possibility of using and contributing to NodeBB for our company dev community. Does NodeBB have any built-in Anti-Spam available (like CAPTCHA or something else) or must we add?

[julian]

Hello @jmeketa!

Glad to hear you're thinking of using NodeBB!

As of right now, we don't have anti-spam plugins, though it is definitely a major concern for the platform. Eventually, an anti-spam plugin or CAPTCHA will be added, and installing it on a NodeBB will be as simple as running something like

npm install nodebb-plugin-recaptcha

Ultimately, I'd like to create a plugin that automatically sends post content through a free API that does text analysis and determines link safety, although I have not found a free API for that yet (something like Askimet)

[jmeketa]

@julian, glad to hear it is a concern and you want to address it. it is definitely an issue with forum technologies that we have struggled with in previous efforts. i will let you know what other questions i have but i like what i see in general otherwise.

[Chris]

Any updates on a recaptcha for sign ups? Had to delete a few users today - they didnt actually post anything but there were a few random signups that were clearly fake.

E-Mail verification on new accounts would be handy as well.

[julian]

Hey @theepiphany -- right now, my focus is on overhauling the email system. After that is done, we can add the ability to lock down posting for unverified accounts.

[trevor]

+1 on email system.

[julian]

Working on it as we speak...

#newyearsproblems

[StuartH]

rather than using rechatcha which most people hate myself included, I use questions relevant to the forum on my xenforo site and so far not one spam bot has got through, would this be easier to implement?.

[julian]

Oh most likely. You'll notice my first reply to this topic was 3 months prior

I hate CAPTCHAs as much as the next guy. If there's a way for me to not have to use one, I'd go for it.

[kamov]

@julian said:

Oh most likely. You'll notice my first reply to this topic was 3 months prior

I hate CAPTCHAs as much as the next guy. If there's a way for me to not have to use one, I'd go for it.

Check this: http://www.stopforumspam.com/

API usage: http://www.stopforumspam.com/usage

the service is free, you have 20k API queries per day.

I hope you can integrate it asap, as the spammer are a big problem for my sites

Thanks!

[datagutt]

If the NodeBB developers choose to implement stopforumspam.com, here is a node module for it: https://github.com/dkleehammer/node-stopforumspam

[julian]

@datagutt :

here is a node module for it: https://github.com/dkleehammer/node-stopforumspam

Now that's what I like to hear...

[bentael]

@datagutt said:

If the NodeBB developers choose to implement stopforumspam.com, here is a node module for it: https://github.com/dkleehammer/node-stopforumspam

taking a shot at that today if no one beats me to it.

Stay tuned.

[bentael]

hmm ....

doesn't really provide post.content analysis, just username, email and IP, is that really what we need?

EDIT: unless you want this check on User creation. @julian can we sneak in a filter:user.create but where do I get the req.connection.remoteAddress from? is the express.req available anywhere at this point?

I was thinking something like that in User.create .. async.parallel call

			function(next) {
				plugins.fireHook('filter:user.create', {username: username, email: email, /* req: req, and probably leave the password out, or not? */}, function(err){
					next(err);
				});
			}

[bentael]

or should that filter live in here? where it would have a reference to the req object.

https://github.com/designcreateplay/NodeBB/blob/master/src/routes/authentication.js#L200

[psychobunny]

I think req.connection.remoteAddress could be passed into user.create, perhaps at some point in the future NodeBB will also store user's IP as well

[bentael]

@psychobunny that won't work if behind proxy, you need req.ip - BUT you also need express.enable('trust proxy'); if behind one

[bentael]

plugin pending this PR: https://github.com/designcreateplay/NodeBB/pull/820 needed that added hook and the req.ip to be plumbed in User.create

[baris]

Hopefully one of the early birds can take a look @julian @psychobunny

[psychobunny]

@julian is the early bird I'm going to bed (mooning)