dw_maintenance | (no subject)

We've just done a quick code push to get some fixes live (other changes in this push are here!), so if you spot anything awry, give us a holler. This push also should get Google indexing back (for those who have chosen to make their journals indexable) after the next crawl! 🤞 (We had to block an incredibly large range of hosted IPs in order to tackle our persistent and ongoing spam and flooding problem and there was a little too much splash damage.)

If you are not using a VPN and you regularly get the captcha from our hosting provider (the graphical one instead of the DW-native text one), please email support@dreamwidth.org with your IP address and we can see if we can add you to the bypass list after you've run a network and virus scan to make sure the reason our hosting provider is blocking you isn't because your network has a compromised machine on it. I am incredibly sorry that we won't be able to add any VPN IP addresses that are on the "suspicious activity and so receive a captcha" list to the exceptions list: we are very well aware of the security and privacy reasons to use a VPN service for internet browsing, and we really wish we didn't have to put those barriers in the way of some of the VPN services people use to access the site, but the overwhelming majority of our abusive traffic comes from free VPN services. It's been getting sharply worse lately, and we've needed to take some radical steps to curtail it. I apologize profusely to those of you who are using those services legitimately for the inconvenience you've been experiencing.

Threaded | Top-Level Comments Only

Thanks for putting in this work!

When people put up Dreamwidth links on Mastodon, the preview looks like a captcha request. It would be nice if there was some way to prevent that from happening. I realize it may be difficult.

Thank you!

+1 (also realizing it may not be possible)

Any replacement for VPN you will recommend?

Kudoses for the care you always show!

Unfortunately, there's no way to fix that, as we haven't been able to find any way to assemble a list of Mastodon servers and there are a lot of them!

I can't recommend a specific one that will never have problems, because any one might be the source of garbage traffic at any moment, unfortunately.

I appreciate the work you do.

I suspect you'll support U2F before my bank does.

As somebody who tends to poke around for old information on DW, thank you so much for working to restore google indexing. I hope that not many legitimate users get slammed by these changes.

Thank you for the work you do!

Thanks for the hard work!

I don't know if I'm the only one getting this issue, but I was trying to make a new account today for roleplaying purposes and the site was giving me an error saying that I wasn't 13+ in spite of me inputting an appropriate year, so that might be something to look at.

You all are the best!

Mark has the skeleton for it written, we just ran into the problem that there are eighteen billion legacy ways to log in while doing another thing (posting, commenting, etc) that are all slightly different and we need to solve the UI problem of how to handle each one of them individually!

Got it! Thank you and it should be addressed somehow, because I saw lot of failures with VPN's technology not just for private users, but for enterprise users as well.

In order to comply with COPPA, we make a reasonable effort to block people who have entered a date of birth that makes them under 13 (such as if you typo 2018 instead of 2008 or whatever) so someone who's under 13 can't just go back and change the DOB when they see that they're blocked for it. It is a cover-our-asses legal maneuver that will help us defend against any future charges of not taking COPPA seriously and preventing signups from people under 13 (since any more stringent ways of preventing people under 13 from signing up for the service without parental permission are all privacy nightmares for adults). The least-restrictive means we settled on for that blocking is setting an "underage" browser cookie that lasts for a little while (I think it's 24 hours) if someone enters a DOB that would make them under 13, and if that cookie is present in the browser that the user is using, giving an error message at signup no matter what the actual DOB entered on the second attempt is. It's not a perfect solution because there are definitely ways to work around it (which I would of course never provide instructions for!) but it's a way to show that we're complying with a perfectly reasonable and not at all ridiculously easy to circumvent law!

Yes, it's a problem, and we've been trying very hard to come up with better ways to separate legitimate VPN traffic from abusive VPN traffic! The problem is anywhere between 60-70% of our account creation on any given day is spam and a very large portion of our network traffic is malicious, and we're barely keeping up. I hate that we have to inconvenience the people who are using VPNs or accessing the site from hosted servers, because we know how many of you are doing it for privacy or safety reasons. We're trying as hard as we can to minimize the collateral damage, but the volume of garbage we get is killing us :/

I see…

You are appreciated!!!

Follow up response because I think there's a misunderstanding here and I'd like to clear things up: me and a few others that I spoke to have been having the issue of being able to create an account in spite of inputting a DOB that is over 13 without having any typos prior; is this issue the same problem in spite of that or something else entirely?

Ugh, that's awful! Thank you for all the work you do to keep the spammers off the site.

The only way to get that error is to either input a DOB that's under 13 or be using a browser that has the underage cookie set! If you're getting it when you're positive you haven't recently (within the last 24 hours) made a typo on the DOB, check your browser auto form fill settings: you probably have something set that's "helpfully" correcting what you input. It's also possible it's a browser extension: some of the quick account switch extensions can do truly heinous things to cookies and it's possible one of them is keeping an "underage" cookie alive for longer than it's supposed to be.

I encountered the captcha when using a VPN. I have a concern, not on behalf of myself, but on behalf of other users: my impression was that the kind of captcha used is going to pose a more serious barrier for anyone with greater visibility issues. I believe there are now captchas available that are better options for users with accessibility requirements? (I may be wrong about all of this.)

We unfortunately don't have any level of control at all over that captcha (it's not ours, it's our hosting provider's) and what type or style it is. Again, we are very aware that the situation isn't optimal! However, the level of abusive traffic we get from VPN services dwarfs the legitimate VPN traffic to an extent where it's either enable the captcha or disable VPN access at all, and we are trying very very hard to not have to disable VPN access at all.

Page 1 of 3