17 November 2013, 17:34

Hi Aaron,

The Captcha should be a setting that a site admin can turn off instead of having it like we used to have in the past as a must because lots of people hate Captchas and they may not really add to the security of a site. In contrast to Mahara.org (and probably free hosting sites), most sites will have some sort of registration requirement turned on to allow only those users in who should have access, and Captcha should not hinder the account creation there.

I created a wishlist item to make public page creation more flexible, e.g. according to your role or by being a trusted person: https://bugs.launchpad.net/mahara/+bug/1251955

Cheers

Kristina

17 November 2013, 18:52

Well, we got a few more spam posts today. I'll take a look at them in the database to get some more info about them.

Following up on the name-drop of phpBB, I found this list of other anti-spam measures from phpBB, so I'll take a look into whether any of these are doable: http://www.michel-kraemer.com/5-anti-spam-measures-for-phpbb3

I think the idea of putting a user on "probation" and preventing them from posting links & images until they've made a certain number of posts that have been responded to by users who are not on "probation" is a sound idea. There are some sticky design issues, as to whether it should be sitewide, and whether this limit should be on all forums or if the forum administrator should be able to decide...

Cheers,

Aaron

17 November 2013, 18:57

Oh, it would also be great to automatically delete/hide all posts and pages by a user when the user is suspended.

17 November 2013, 22:51

Hi Aaron

I'm not sure that deleting all posts and pages is a good suggestion if a user is suspended. There are different cases I see for now:

1. A user is  a spamer. Deleting pages, forum post, notification and feedback is really ok.
2. A user is suspended temporary by any internal reason like leaving the institution. Forum posts are relevant content and shouldn't be deleted. Same for shared templates.
3. A user who should be suspended started groups. What should happen with groups and group connected content when this user  created started the group?

I think there are other cases also we should think about.before implementing such a feature.

I thought a little bit about spamming at moodle.org and in Moodle systems. I remember several waves over last ten years.

• Spam in  moodle.org forums. They are deleted consequent and spam user accounts are deleted.
• Moodle offers blocking of domains for self registration. This reduced  spam account creation. I don't know if moodle.org uses this feature. On national sites its ok to do it and it works well.
• Registration for  courses required to post . This additonal step reduces the spam post also.
• Spam in personal description. Moodle blocks access to personal description for people who are not logged in. That makes such content ineffective.
• Spam in personal description (2). Admins can check these field for inappropriate content and delete the accounts.
• Spam in personal messages. This is actual a strategy. I got 1-2 such spam message/month in moodle.org.   The accounts can be blocked by users. They are deleted immidiately if reported to admins.

Ralf

18 November 2013, 10:28

Hello Ralf,

I agree with you that pages / posts should not be deleted automatically when a user is suspended for the reasons you pointed out. Spammers are the exception in this case. There could be an additional setting if an admin is really sure as in the case of a spammer.

I think it would be good to implement a differentiation of who can create public pages for which I made a wishlist item. And then having a moderation queue for forum posts could be sufficient as all non-approved users would need to go through that.

Cheers

Kristina

18 November 2013, 12:22

As promised, I've implemented a new user probation system. Now, newly self-registered users will not be able to post links or images until they have made a certain number of forum posts that get replied to by existing users.

Here's the tracker bug for it: https://bugs.launchpad.net/mahara/+bug/1252101

This may pose some inconvenience to our legitimate users, many of whom come here for their first post to ask for help on a Mahara problem, or post a link to a plugin they have developed. On the other hand, the idea of not being able to post links when you're a new user, is something they're likely to have encountered on other websites as well, so hopefully they won't be too taken aback by it and will simply ask for help with it if need be.

Cheers,

Aaron

18 November 2013, 13:12

Test'Screenshot'

18 November 2013, 15:50

Only users who newly register after I deployed the new code this morning, will be prohibited from posting links and images, Pete.

21 November 2013, 11:35

After taking a look at the activity of the users who have registered since I implemented this, I added a couple more anti-spam measures yesterday.

1. Probationary users can't post links in feedback, wall posts, or private messages.

2. Probationary users can't create public pages.