From: David Ross <dross@...>
Date: 2004-10-24T15:42:13+09:00
Subject: Re: Garden Spam

trans. (T. Onoma) wrote:

>Speaking of attacks, I jumped over to the Garden Wiki just now and see that 
>the front page is spammed to the hilt and all the RecentChanges are nothing 
>but spam entries. So then I check out the PreventingWikiSpam page (which I 
>started) to see what was new there. There I find this interesting link:
>
>  http://www.rubygarden.org/ruby?action=browse&id=SpamIssue&revision=1
>
>Imagine my surprise at seeing this! I am not sure who wrote it (daz?), but 
>actually I don't really care. Although, it seems I am being insinuated as the 
>potential "Great Graden Wiki Spam Artist". Lol! Sorry to disappoint folks, 
>but it ain't me.
>
>But I can tell you this. I am quite dissappointed that the spamming problem 
>has not been satisfactorily dealt with yet. So much so that I now declaring 
>my intent to FIX IT. The plan is simple: any revision that adds an external 
>link will be denied --or perhaps better, honeypotted. If you want to add 
>external link(s) you'll have to email the administrator or official moderator 
>and ask that the link/links be added to the page. I doubt the email load this 
>will create will be very high especailly if spread out over a handful of 
>moderators. But if it does prove too much we can later add temporary 
>passwords (as in 48hrs) to let anyone do so via a special 
>(yet-to-be-determined) secure interface. Thats it. Problem solved.
>
>So how should I proceed? Should I make a patch for Ruwiki? Or what?
>
>T.
>
>And BTW: I am not BillGuindon either.
>
>
>
>On Sunday 24 October 2004 12:41 am, Richard Kilmer wrote:
>| Some freaking dork at the following IP address(s) was continually
>| downloading ruby182-14_RC8a.exe from here:
>|
>| 200.98.63.142
>|
>| Then from here...
>|
>| 200.98.136.108
>|
>| How is this for an example log:
>|
>| [snip]
>|
>| And I mean continually.  Those IP address are now officially blocked.  If
>| we find the perp who did this, they are going to be NAILED.  We realize
>| that this is probably a DSL line or cable modem.  If someone wants to help
>| track down who is doing this it would be great.  It seems to be coming from
>| Brazil (www.uol.com.br)  RubyForge is a community resource and this screws
>| the whole community.
>|
>| I can only assume this was a denial of service attack.  I will block the
>| entire 200.98 subnet and every other subnet owned by uol.com.br if these
>| things continue (which may negatively effect innocent people...and I don't
>| want to do that).
>|
>| Best,
>|
>| Rich
>| Team RubyForge
>
>  
>
These spam attacks are ridiculous. There needs to be a type of honeypot 
system. I'm still curious how these spammers are working, through manual 
or bot. Logs or explaination would help.

I still think setting a link to trap the spammer in thier own db where 
no public changes are made and they view thier  changes are the better idea.

David Ross
-- 
Hazzle free packages for Ruby?
RPA is available from http://www.rubyarchive.org/