Fighting spam in phpBB3
I think purely by virtue of my time zone, I was doing the lion’s share of moderating on the Mumble forums up until work absolutely blew up a couple of weeks ago. I re-attached to IRC to find Stefan Hacker lamenting that the moderation queue was rather large. It turned out it wasn’t just my inattention, we’ve been discovered by spam bots and are under some sort of widespread attack now.
So what to do about it? My first thought was “Akismet worked pretty good back when I ran Wordpress”, but the results for phpBB3 aren’t exactly comforting. Jan Klass administrates Mumble’s Wordpress blog, and had pretty good luck with “Bad Behaviour” so off to find a MOD for that. I installed it and… nothing. It appeared completely ineffective - perhaps the MOD is outdated?
I’ve been following Project Honeypot for a while now, and decided to go hunting for a module that implemented that. I ended up finding one (sidenote: there’s another that’s substantially less work to install that only implements PH itself) that also includes various other blacklists. Unfortunately it took the better part of an hour to install, and once it was done a couple of the blacklists are no longer functioning and return positive for everything (whoops!). With some adjustments to the black lists, and it appears to be doing it’s job: the mod queue is empty most times when I check it, though we do occasionally have spammers who were already signed up coming back to post (it only checks on registration to save server load), which I can deal with.
Unfortunately though, modifying phpBB3 is seriously flimsy. I reckon if I had more time, building a sort of “meta mod” for phpBB3 would be a really interesting project (despite the fact I don’t really care for PHP any more)… that is to say, a modification that implements plugin hooks, that other plugins could be written on top of, meaning less lines of code to potentially conflict when you go to upgrade the software.
Then Stefan had the nerve to interrupt my tirade about phpBB3’s lack of a plugin infrastructure by pointing out that Mumble doesn’t really have one either…