A heads up on spam prevention measures

[denise]

Due to recent increases in spam account registration (over and above the already-high baseline levels of spam account registration!) and the amount of our administrative time that dealing with spam is costing us, it's highly likely we will need to start playing around with more aggressive measures to block spammers in the next few weeks. We already use quite a few spam account creation prevention techniques, but there's been a worldwide increase in the amount of abusive/spam traffic over the last six months or so, and we're at the point where we need to start getting much more aggressive about filtering it.

Generally speaking, we try to use the least restrictive measures of spam blocking that we can, because any form of spam blocking can impact legitimate use of the site. If you start getting 403 errors when accessing the site, or you are asked to solve a captcha from our hosting provider (the graphical captcha that shows on a separate page, not the text-based one that shows on the same page) before proceeding to the page you're trying to load, and you are not using a VPN service, please email support@dreamwidth.org with your IP address and let us know. If you don't know your IP address, you can look it up at whatismyip.com.

If you are using a VPN provider and you get these errors, I am incredibly sorry, but we probably won't be able to help. We know that many of our actual-person users use VPNs for privacy and security reasons or to circumvent government restrictions on accessing the site, and we are trying our very best to keep those services able to access Dreamwidth. Unfortunately, VPN services are also a major source of our abusive traffic, especially the free ones, and it's impossible for us to distinguish legitimate traffic from abusive traffic automatically. You are less likely to have problems with paid VPN services, but even those are the source of a lot of spam: our two main VPN sources of abusive traffic are NordVPN and Proton VPN. We're trying very, very hard to not have to block VPN services entirely, but the problem is getting much worse. If you subscribe to either, you may want to contact them and tell them that you've been having problems accessing sites you regularly use because of the amount of abusive traffic that comes from their network.

We will continue to tweak our spam prevention measures as much as we can to avoid interfering with legitimate traffic, and I apologize in advance if we wind up temporarily interfering with your use of the site as we try to stop the garbage we're drowning in.

Comments

[kore]

BOO SPAM. I was followed by at least twenty empty pornbots on Tumblr last week. I've given up playing whack-a-mole with them. I am so glad DW fights spam with a fury!

[innitmarvelous_og]

Aren't the p*rnbots on Tumblr awful? I am soooooooooo sick of them too, especially the ones that are not an empty account!

[kore]

The only thing I am more sick of than the non-empty pornbots are the Only Fans-type "Tumblr Live" accounts which have shown me dick picks more than once! Which you can't turn off!

[innitmarvelous_og]

Yeah those would be the non-empty ones I hate! I've learned to be super cautious when seeing what the accounts are!

[scissorsevered]

The big wave of pornbots is probably the one bad thing about Tumblr allowing NSFW again.

[innitmarvelous_og]

Yeah, things will always be abused in some way. *sighs*

[profiterole_reads]

I usually report them, but when I don't, they usually disappear in a few days from other people reporting them. Fortunately, it's not as bad on DW.

[denise]

It actually is just as bad! We're just still small enough that we can handle them the only truly effective way, which is to say, a real person looks at every newly created account and knocks out the spam ones. Once you get to Tumblr size, that method stops being possible and you have to switch to automated detection, but automated detection is kind of shit. We get just as many spam accounts as Tumblr does, we're just more effective at knocking them out before you notice them because karzilla or I spend four hours a day every day screening every single newly-created account for the ones that our automated systems miss, heh.

Ironically enough, this is one of those things machine learning networks are moderately decent at -- worse than human eyeballs, but sharply better than a lot of other systems. We experimented: when we fed ChatGPT the profiles of a test suite of 100 of our spam accounts, it caught about 60% of them, and it didn't flag any of the test suite of 100 real accounts as spam mistakenly. But implementing that as a screening method would involve sending user profile text to ChatGPT, and, well. *gestures wearily to the entire controversy about generative ML models*

[profiterole_reads]

It's all in your honour that I don't notice it's as bad from my side of things. I hope you'll find a way to save yourselves some time.

[ganimede]

I had no idea you checked every new account, that has got to be going above and beyond! Four hours is a lot of time that could probably be better spent elsewhere on the site. Is there any way some of that workload could be taken off you by a small select group of volunteers?

[denise]

We do to some extent, but there's a lot of logistical problems with it because of how much access to sensitive user data someone needs in order to make a lot of the calls.

[ganimede]

I didn't realise that some of the spam accounts had got so clever as to make that access necessary. Eugh, that does make it harder. And it must be such a pain when you don't have the time to create a system to fight spam accounts because you're so busy fighting spam accounts but also not so busy fighting spam accounts to require the system... I think that just broke my brain.