Spam prevention

xasharma

luceos ->allowLinksFromDomain('luceos.com')

luceos checkForUserUpToHoursSinceSignUp(5)

Does it will give warning to user also ?... like "Only links from luceos.com are allowed to post", "You have to wait minimum 5 hours to start a thread or discussion"

luceos

xasharma no, zero warnings, because that would give these bad actors an indication on how to tune their scripts. In fact that has kept me from posting the package publicly for a while as well.. If you want something like that you'd need to find/build/commission another extension because this is about changing/modifying user behavior, not preventing blatant spam.

CyberGene

composer remove luceos/flarum-simple-spam-tools
composer require blomstra/spam-prevention

Then update extend.php notice the use declaration at the top, I believe the rest is identical.
Make sure to call enable() though, @jakemckown correctly pointed out that nothing is enabled without some additional extenders which I combined into one additional method enable() starting from 0.1.3.

CyberGene

Nice initiative, thank you!

What's the proper way to migrate from the flarum-simple-spam-tools to this one? I guess I should just remove the other one and start over anew with this one?

One thing I noticed (and probably important) is for this extension you require in extend.php:

use Flarum\Extend;
use Blomstra\Spam;

Any other consideration besides the changed package/class names?

CyberGene

I installed the new one, configured it the way I liked it and all works as expected (like with the old one), however there's some discrepancy I just found. So, I have allowed the following domain:

->allowLinksFromDomain('pianoclack.s3.us-east-1.amazonaws.com')

Now, I have a user that matches the criteria for filtering and I posted two images from the above server:

https://pianoclack.s3.us-east-1.amazonaws.com/2022-05-16/1652706371-369258-6931c6ee-525b-4025-b1c1-db1fb2d0d7b6.jpg

https://pianoclack.s3.us-east-1.amazonaws.com/2022-09-01/1662053787-63955-how-effective-are-mask.jpg

The first one is not allowed (but it's from an allowed domain), while the second one is allowed. And they are both from the same allowed domain. So, maybe the URL matching regexp has some issues?

luceos

CyberGene one thing I noticed sometimes is that it considered links as text and thus a language that wasn't allowed. Let me add your example to a test and see what happens 🙂

Does your community have the English language enabled? ~~Piano is an English word, I guess it needs to ignore links for these analysis.~~ It already does that 🤔

CyberGene

luceos Does your community have the English language enabled?

Yes, only English is enabled (and used on the forum).

luceos

CyberGene can you confirm that the post that was flagged contained only that url to that image and no other text?

CyberGene

luceos yes, exactly that URL, no tags or any additional formatting applied. No additional text/content. Could it be an extension? I have the Rich Embeds that handles raw image URL-s.

luceos

I'm closing in on v1 which will become an extension, but without settings for now. Once enabled it will use the defaults, you will be able to use your local extender to modify the default behavior.

CyberGene

In any case, I’m OK with false positives, rather than false negatives, so you may not bother finding it.

Here’s a suggestion. How about scrutinizing users both for min age and min number of posts? Currently if min age is reached OR min number of posts are made, the filtering is bypassed. However I prefer more conservative (pessimistic) approach. The user can create enough posts in his first day to overcome filtering and then start spamming. Or, he can wait for a day without posting and start spamming.

So, I prefer that the user is filtered both in his first day but also until he makes enough posts even if they are made at a later time:
boolean userIsFresh = registeredRecently || lessPostsThanRequired

luceos

CyberGene So, I prefer that the user is filtered both in his first day but also until he makes enough posts if if they are made later.

That is actually the case:

    public function isFreshUser(User $user): bool
    {
        $age = Filter::$userAge;
        $postsRequired = Filter::$userPostCount;

        if ($age && ($user->isGuest() || $user->joined_at->diffInHours() <= $age)) {
            return true;
        }

        if ($postsRequired && $user->posts->count() <= $postsRequired) {
            return true;
        }

        return false;
    }

this reads as:

The user is a fresh user if

an age is required, the user is a guest or they joined within that time
or if a minimum number of posts is required and the user doesn't have enough posts
otherwise the user isn't fresh

CyberGene

luceos ohh, you’re right, I got confused, so all is great 👍🏻

luceos

v1.0

This is now an actual extension, configuration is still only done through the extender but that will change soon. Spam prevent already works perfectly without any modifications to your local extend.php. But you can still customize using the extender if you want.

For those using the extender, drop the enable() call at the end, see the updated OP for more information.

CyberGene

I just pasted the following text (copy/paste from Wikipedia) and it got allowed on an English only forum:

帝室御賞典」は1937年（昭和12年）に行われているが、JRAが前身としている「The Emperor's Cup（エンペラーズカップ）」は1905年（明治38年）に起源をもち、日本で施行される競馬

Is it because there’s some English text in it?

luceos

CyberGene which version is this? Perhaps v1.0 is broken, although I tested it a bug might have crept in.

CyberGene

luceos it’s 1.0, however if I remove everything after and including “The Emperor…”, then it works. Probably something related to the way languages detection works.

masihdindar

How to enter some languages on whitelist?
I just prefer English, Persian, Arabic and France languages to be whitelisted and block other languages.

luceos

masihdindar languages that have their respective language packs installed will be on the allow list. It makes sense to allow customization of this.

privacytoolsIO

luceos perfect timing to release that. great work

linc

There's currently no license info on the GitHub repository.

luceos

linc oh whoops. It's mit. A PR would be appreciated.