Continuing dispatches on the war against spam

[denise]

A few days ago we let you know about spam prevention measures that we were taking to help stem some of the flood of garbage. One of those temporary measures included geoblocking all IPs from several of the countries that are our largest source of spam. This did (as we knew it inevitably would) have some collateral damage for real users, and we're very sorry!

We're continuing to experiment: this time we've slightly expanded the range of countries we're geoblocking to include the ones that we held off on geoblocking because it would affect too much legitimate use, but we've limited the geoblocking only to the account creation page. This should mean that if you were having trouble accessing the site because of geoblocks, you should be able to access 99% of the site without a problem, and the only page you won't be able to access is the account creation page. With luck, this should cut back heavily on our spam account creation without disrupting legitimate use of the site. The current list of countries that are geoblocked from account creation are Bangladesh, Cambodia, Egypt, India, Indonesia, Morocco, Pakistan, Singapore, Turkey, and Vietnam. (If you're an existing user from one of those countries and you'd like to make an additional account, email support@dreamwidth.org with the username you'd like to register and we can register it for you. If the number of requests gets to be enough that it's taking up too much of our time, we may have to pause this until we can build automated exceptions, but we'll start there.)

We will continue to monitor the results of these experiments and adjust as necessary: when we do one of these experiments, we always make sure to define in advance what "too much interference with legitimate use" will look like, and we try very hard to stick to it. I apologize to everyone who's been collateral damage in our efforts to filter out more of the goddamn spammers.

Comments

[dennisgorelik]

Why do you geoblock the whole countries?
Isn't blocking individual abusing IP networks sufficient to mostly eliminate spam?

[denise]

That's been our tactic for quite some time, but it isn't enough anymore. It's not individual netblocks that are the issue: the major spam factories have custom software that rotates their connections through multiple networks (and through multiple browser builds, to avoid browser-based fingerprinting) after every new account in order to evade automated blocking and detection. The big social media properties can afford to have engineers working full time on adapting to the tactics they're using, but we can't; geoblocking is the next tool we have available in the arsenal (for this particular problem; there are about six running concurrently) that has the least interference with legitimate use over the more invasive options.

[thatwasjustadream]

I managed spam posts on a web site for years. In the end, we had to remove commenting because it was impossible to keep up. User blocking was a joke. IP blocking didn't really touch the problem, either. Am sharing that to say I understand how hard it is. I think I'm still a little scarred from all the cr*p I read in the deleted comment files all those years. :\

I hope you can find the right formula, and I'm sure people will (should) understand. This is not an easy problem to manage.

[denise]

It's gotten so, so much worse lately, too. We had the spam percentage down to a good 20-30% for a while but they keep adapting, and now we're back up to 80% on a bad day and hitting 60% regularly. I feel like Sisyphus pushing a rock up a hill most days, sigh.

[shadowbliss]

Thank you for all you do Denise

"They're coming in too fast!"

[tornir]

Been there, done that, got the userpic. :P
Thanks for all your hard work. :)

[dylan_mx]

thanks for the hard work! It's much appreciated!

[pebble_in_a_lake]

Sorry you're continuing to have to deal with the spam problem. It sounds like something I'd never have the patience to handle. We appreciate all your hard work in keeping the site safe and free of spammers. Thank you!

[profiterole_reads]

Thanks for your work!

[bluedreaming]

Thank you for your update!

[sixbeforelunch]

Would bringing back invite codes help? Or does that fall too heavily on the side of restricting legitimate use?

Thanks for the hard work! I’m sorry the spammers are making your job so hard. :(

[denise]

I covered it in comments to the last post: the problem is it's easy enough for spammers to get codes (between people posting lists of invites and the "create an account, age it and wait for it to start generating codes" tactic) that it's not an effective deterrant and it takes about as much administrative time to deal with invite-related problems as it does to deal with spam so it would just be a giant pain in the fucking ass for no net benefit.

[qitian]

Hi Denise, thanks for the update. Just a few questions:

1) Will Dreamwidth periodically review the list of countries subject to signup blocking and update it?

2) What's the anticipated turnaround for the support team to respond to account creation requests? I'm not asking this for the purpose of holding the team to some hard timeline, but if the process is expected to take longer than a day then I'll probably send in my requests for throwaway account creation in batches instead of doing them individually.

3) Since the instructions in your post do not require users to provide the passwords they wish to use when creating new accounts via email request, I presume this means that the support team will generate the passwords and email them to the user.

Will the created passwords will be unique to each email request or to each account created? E.g. I send in a batch request to create 5 new accounts. Will each account have a different password or will all accounts in that batch have the same password?

4) Will the blocked signup page be enhanced so that users from geoblocked locations have access to the instructions that they need to email support in order to create an account? Right now it's just a 403 error page.

[denise]

1) We keep a regular eye on the hit rates of every access restriction we place, yes. It is very rarely that we can lift one once we place it, however.

2) It absolutely will not be faster than 24h turnaround; there's no way we can commit to that. The exact speed will depend on the volume and on how much admin time we claw back from spam handling. If that doesn't work for you, you can also use a VPN service to get an IP that geolocates outside of one of the blocked countries just for account creation, although VPN abuse is another one of our big issues right now and we have the "filter traffic from netblocks with bad reputations" filter with our DDoS provider turned up pretty high right now.

3) The account creation admin tool generates a random password that can't be emailed to you (it's impossible to extract an account's password: writing the password to the database is a one-way operation) and you will have to reset it once the account has been created through the normal password reset email workflow to a password of your choice.

4) Not easily technically possible, I'm afraid.

I know it sucks, and I'm sorry. We have been holding off on this step for a very long time, because we know it's disruptive. But we are absolutely drowning -- on a bad day our account creation volume is 80% spam and an average day is running around 60% -- and we need to take drastic steps in order to preserve the service for everyone.

[tessitura]

Thank you for the updates, constant vigilance, dealing with bad faith actors (spammers/several passive-aggressive at best comments on DW update posts/etc) and making DW such a cool place to hang out on in general

[kore]

Absolutely seconded!

[dreamtigress]

Thank you for all of your hard work!

[folk_melody]

I am glad that users from the geoblocked countries can now access the site without a problem and thank you for that :D I hope the new measures work and reduce the spams! Thanks for the update!

[bastun]

Thanks for all your hard work. It is very much appreciated!

[frith]

I think that geoblocking the account creation page is a clever solution! I like it. I wonder if the elimination of tracking-based targeted advertising would starve off Search Engine Optimization spam.

[paserbyp]

Good job! I can see right now that I can’t catch any SPAM anymore to report it. Bravo!

[ex_flameandsong751]

Thank you for your hard work.

[grey_and_furry]

Thank you and dw team for your work

[pangolin20]

Thank you for putting in all this work!

[juni]

thanks for the update!

[rampitec]

Not sure if anyone has suggested it yet: make registration from these IPs paid? I am just following Musk's idea for Twitter.

[denise]

Unfortunately, as Elon is also discovering, spam is so profitable that the registration cost is a drop in the bucket. Metafilter charges $5 to register an account and their spam rates are only slightly lower than ours.

[axiomwitch]

Do you need new antispam volunteers?

[denise]

Unfortunately, the kind of spamfighting we can use volunteers for is no longer the primary type of spam we get -- the kind that 99% of our spam is now needs access to the admin tools that also allow access to nonpublic user data, so we can't hand out access as freely. (The tool that lets volunteers handle reported comment spam doesn't involve nonpublic data, so we can give that one out right and left! Except we don't get much comment spam anymore; everyone's moved on from that.) The majority of the spam we get now is designed to be as invisible as possible to anything but Google, so finding it is the world's worst scavenger hunt. I have the outline of a system in my head that will let us abstract away that user data and recruit volunteers to handle the like 70% of it that's very obviously spam and leave us more time to find the 30% that requires more digging, but we haven't had the time to build it because we've been handling the spam. With luck this will give us some spare cycles to get that built!

[medusahealing]

Wow...Just wow...who knew peeps could be so animated...

thanks for the good work. I do have access to the VPN from Proton but rarely use it. So...there's that. I'll keep this in mind though.

[pronker]

Thanks for all your work to solve this ongoing problem - this may be unrelated, but the a-href isn't working for a fancake link? I don't claim to be computer-literate to a great degree and it's possible I'm messing up somehow ... :/

EAD: NM, I used the embed link. :D

[kore]

Thank you so much for all the hard work you do, ESPECIALLY patiently and clearly explaining at length in these posts and comments, which are really enlightening and a unique resource!