Forum:We need an abuse filter

<<< Back to Illogical Zone • <<< Back to Forum

I don't know where this goes, so I'm putting it here.

We're overrun with spam, and nobody's been around to clean it up for the past few days because the admins are off having lives instead of mucking out the stalls 24/7. There's been talk of an abuse filter, but that hasn't happened. I don't think any of our active editors know how they work. I have good news, though -- I've figured out how you can create the perfect filter. Follow these steps:

• Go to Special:AbuseFilter/new
• Add something appropriate-sounding to the "description" field, like "IP spammers"
• Put this in the "conditions" field:

!"user" in user_groups &
old_size == 0 &
added_lines rlike "<br><br>"

• Check the box next to "Prevent the user from performing the action in question". You can also check "Trigger these actions after giving the user a warning" if you want a custom warning message.
• Click "Save filter".

Voila, you now have a filter that prevents IPs from creating pages with double <br> tags, which is a distinctive mark of the spam we've been getting and probably not something a real person would do (they consistently avoid using newlines to break up paragraphs).

So... anyone up for this? Maybe? Gosh, this post is awfully logical. Needs more moldy bananas or something. ❦ Flyingcat (meow?)fr: 01:12, 2 Jumbly 2018 (UTC)

I'm not the first one to think of this, by the way. Also note that the abuse log is already full of attempted spam -- that just goes to show how much we're getting flooded. ❦ Flyingcat (meow?)fr: 06:50, 2 Jumbly 2018 (UTC)

On another tangent, has anyone looked at the chicken filter? I've just realized it can be tripped by external links. It looks for a full stop or a comma directly before a letter, and domain names always contain full stops beside letters. I don't think that's an intended effect. ❦ Flyingcat (meow?)fr: 07:09, 2 Jumbly 2018 (UTC)

Though I'm not an admin here, I know how to edit the filter (as I have the permission to do so in Usopedia), and I also know that "user" also includes registered users (you should make an exception, at least, for autoconfirmed users). I should also tell you that, in general, the content of the filter should not be disclosed, since it allows spammers/vandals to avoid contents blacklisted in the filter.--The Pioneer (A.K.A. 開かい拓たく者しゃ) 14:49, 2 Jumbly 2018 (UTC)

Not the author here, but I think the clause '!"user" in user_groups' lets all registered users off the hook. Beyond that, I wouldn't worry too much about exposing the guts of the filter in a forum -- I think it's unlikely any of the major spam farm operators is going to notice this conversation. ;-) Snarglefoop (talk) 15:12, 2 Jumbly 2018 (UTC)

Oh yeah, you're right. I just missed the not sign !. Nvm about it. Well, it is unlikely as long as they are bots, but I'm not so sure about human spammers.--The Pioneer (A.K.A. 開かい拓たく者しゃ) 16:47, 2 Jumbly 2018 (UTC)

Yes, that's correct. I also thought of spammers possibly seeing this, but I don't have a choice unless I want to email it to somebody instead. ❦ Flyingcat (meow?)fr: 18:33, 2 Jumbly 2018 (UTC)

I guess we should test it ASAP, and I mean it. Spammers are quite active, while there aren't many useful contributions. Besides, you can create another forum to report errors, until it's ensured that the filter doesn't make mistakes. Being too cautious before implementing it is, I think, not a good idea anymore.--The Pioneer (A.K.A. 開かい拓たく者しゃ) 09:47, 5 Jumbly 2018 (UTC)

I've tested it on one of our private wikis. For obvious reasons I can't test it here. The admins need to get back from their 4th of July celebrations and do something. ❦ Flyingcat (meow?)fr: 16:41, 5 Jumbly 2018 (UTC)

Twoandtwoalwaysmakesafive finally created it. Thanks much. ❦ Flyingcat (meow?)fr: 17:36, 9 Jumbly 2018 (UTC)

I doubt it worked, Flyingcat. A few more pages were created in the same manner after he made the changes to the abuse filter. 19:19, 9 Jumbly 2018 (UTC)

Oh yeah, I just noticed the timestamps. That's weird. I know filters get disabled when they match more than 5% of actions (you can probably set the percentage in LocalSettings.php), but that shouldn't have happened yet, and it doesn't say it did. Maybe people who don't have filter permissions can't see the "Warning: This filter was automatically disabled because blahblah" message. ❦ Flyingcat (meow?)fr: 20:23, 9 Jumbly 2018 (UTC)

Actually scratch that. Special:AbuseLog reveals a lot of attempted spam pages getting stopped by the filter. I bet it got disabled. I'm sorry about this. I should have warned you. This is going to be a serious barrier to effectively using abuse filters against spam because we have so few regular legitimate editors. ❦ Flyingcat (meow?)fr: 20:29, 9 Jumbly 2018 (UTC)

Also you probably shouldn't have put <br> in the filter description -- it turns into an actual line break. ❦ Flyingcat (meow?)fr: 20:33, 9 Jumbly 2018 (UTC)

YES YES YES YES YES

We're drowning in the stuff.

This sounds like it would block the bulk of it, which would be a huge improvement.

I'd also advocate for blocking IPs from creating pages (hey, if Wikipedia does it, it can't be all bad, right?) but that's a question for another day. This change doesn't seem likely to block any "real" user from doing anything they might want to do. (And if you really want to insert <br><br><br><br><br><br><br> on a page, well, you just have to log in first.)

Unfortunately I'm just a peon here so I can't do anything more about this than shout "Huzzah!" Snarglefoop (talk) 02:54, 2 Jumbly 2018 (UTC)