Hey @downpw

> @DownPW said: > > You have wrote this plugin ?

Yes and No :sweat_smile: I did not write it, I vibe coded it. I would describe it as: I have thought it up and let AI do its thing.

Yea I have published it after I used it a little. Thought to myself, ehh, may be useful to someone else as well so why not put it on GitHub and npm.

> @julian@activitypub.space said: > > Take a database backup before you let it loose on your codebase then

I fully agree :laughing: Having a backup is always good and even more when playing with vibe code :grimacing: I will also add a disclaimer to the README of the repo, forgot it this time.

But in the spirit of true corperate IT:

• have no backup
• run and deploy only on Fryday at 16:00 o'clock (should be Friday, but why not call it Fryday when you fry your servers on this day)
• turn off all devices
• go home

Well I did build this plugin https://github.com/... / https://www.npmjs.com/... to filter for exactly stuff like that and mass delete them.

Got another idea to improve the spam-be-gone plugin - Check ASN of IP to get another spam indicator

GitHub issue #118

Since we already have the IP, the plugin could also check the IP address if it matches against knows ASNs. So if an IP is from a datacentre it is more likely to be spam. I am aware that this might also mark users as suspected spam if they use VPN/Proxy.

I already did an implementation but would like to discuss this first before creating a PR.

Demo Idea:

This was implemented using https://www.maxmind.com/en/home and https://github.com/X4BNet/lists_vpn There is a promising repo for ASN lookup, tho pretty new: https://github.com/openasn/openasn but good to have on the map for the future.

Noticed some more things being outdated or bricked.

Translations not shown correctly. Report button shows [[spam-be-gone:report-user]] and does apperently nothing because the click handler is only attached on tpl_url === 'admin/manage/registration'

Will create some more issues and PRs :)

> @omega said: > > Even if Ai can be made parse and respond correctly, it may introduce a computational load that is unattractive.

I understand your thoughts but with an edge AI model that runs anywhere and uses little to none resources it simply analysis the HTML within seconds. No datacentre needed.

Not to mention the hurdles already added.

> @julian@activitypub.space said: > > Simplest form of spam prevention is still just a hidden input field, and then disqualify any registrants that fill that input with gibberish.

Is that not what project honeypot in this plugin is doing? :thinking_face: At least I would have expected it to do that.

You two @omega and @julian@activitypub.space just gave me some ideas.

If project honeypot from the spam-be-gone plugin does not add these honeypot input field, we should add them. But, we could add something else hidden. A set of hidden HTML label and input field added by the spam-be-gone plugin which attempts prompt injection. So even if an AI enhanced spambot figures out the registration process including all hurdles already added, maybe a prompt injection can add stop it or provide further details. :D Could work :shrug:

Missed opportunity to do a:

• yes
• no
• maybe
• i don't know
• can you repeat the question

Malcolm in the Middle poll :)

https://youtu.be/ZtKqQNpFJCo

> @DownPW said: > > For example, most of my users only connect via VPN

Since this targets the registration an already existing user using a VPN is of no thought here. :thinking_face: Making it a config option for the plugin would resolve both needs, right? Example config: "Handle registration requests from known ASN as suspected spam" Maybe better wording for that config option? This way the NodeBB admin can configure the behaviour.

> @DownPW said: > > Well, I assume you tested it a bit before releasing it publicly, especially given how sensitive it is.

I actually tested it on prod :sweat_smile: But since we have a solid backup/restore strategy and restoring is just 1-click :shrug:

> @DownPW said: > > Don't hesitate to keep it updated; I think quite a few people will find this plugin useful.

Will do and thanks.

> @DownPW said: > > By the way, I wonder what the best approach is when you need to restore a database backup to a server where the database already exists. > > Delete the existing one and then restore the backup? > > Same thing for the NodeBB folder? > > I've never done this before; I'm just curious how MongoDB handles it.

That is what we do. Throw everything away and rebuild from backup. In my opinion, a working full restore is always better to have comapred to a partial restore.

> @julian@activitypub.space said: > > Lots of them sneak backlinks in their aboutme

That is why we put the aboutme and signature behind min. 5 rep to avoid that.

Check in. Again 10 accounts from gsaserbuilder.xyz got created. I have configured Spam Be Gone with Akismet, Project Honeypot, StopForumSpam and hCaptcha.

I have mixed feelings about enabling the registration queue, but will try it anyway. edit: just set Registration Approval Type to Admin Approval and the link pointing to $FQDN/admin/manage/registration leads to a Not Found. Maybe need to restart the forum? Will try.

> BrutalBirdie said: > > edit: just set Registration Approval Type to Admin Approval and the link pointing to $FQDN/admin/manage/registration leads to a Not Found.

Found the real one, it is /registration-queue and not /admin/manage/registration. So that is a "bug". https://github.com/NodeBB/NodeBB/pull/14825

Hmmm I will have a look at that!

edit: Installed and set it up. Before we already had 20 new accounts from one of the spam mail hosts again. Will report back after some time to see how well it works :)

Another thought. There is the config option Automatic Approval Time. So with spam-be-gone an option like Automatic Deny Time for suspected spam would also be great. If my default action is to deny all suspected spam a setting like that would be good since if I forget to check the registration queue for the time configured for the Automatic Approval Time all the suspected spam account are approved.

(:+1:/:-1:)?

> @omega said: > > In my simple mind I would have thought hCaptcha might provide a decent holdout against bots, am I too understand it had negligible effect even when combined with all the other mitigations?

In our case we still have a decent amount of spam accounts that try to get through. I have a suspicion how tho but I will need to investigate.