Wishlist: Prevent new users from taking spammy actions

[Aaron Wells]

As mentioned in https://bugs.launchpad.net/mahara/+bug/1250641 , to combat spam on mahara.org, this is a feature request to add a new user probationary period, during which the user can't take actions that are potentially spammy.

In the prototype implementation it's limited to the forums:

1. New (self-registered) users start with a number of probationary points.
2. When they take actions other non-probationary users approve of, their probationary points are reduced. When they hit 0, the user is no longer probationary.
3. A probationary user can't post links or images in forum posts
4. If a non-probationary user posts a direct reply to one of their forum posts or topics, their probationary points are reduced by 1.
5. The number of probation points they start with is configured in config.php

Additional features it would be good to add:

1. Make the probation points configurable via the admin UI
2. Make the actions that are prohibited, configurable via the admin UI?
3. Additional actions to prevent -- links in direct messages & feedback, creation of public-accessible pages
4. Admins can clear (or increase) a user's probation points via the account settings
5. Report page to show probationary users.
6. Notifications to admins when a probationary user attempts a forbidden action, with quick-link to suspend the user
7. Report page to show which non-probationary users approved of the probationary user (so you can check for spammer-approvers)
8. "Report objectionably content" link for forum posts
9. Display of user's overall post count on forum posts
10. Potentially some way of limiting all this to only certain forums (although I can't think of a good conceptual model for that)

[Aaron Wells (u-aaronw)]

I implemented the following additional features:

1. Probationary users can't create public pages or public profiles.
2. Probationary users can't post links in wall posts, feedback, or private messages.

Some of the existing spam pages and wall posts are just messages with obfuscated links, or an email address or domain name, and the only way to catch those is with a Bayesian filter. However, I'm hoping that by restricting the ability to create public-facing spam content with direct links in it, it will lower the site's value enough to prevent them from spamming it. This was only deployed a couple of days ago, and our spam tends to come and go in waves, so we'll have to wait and see whether it works.

[Kristina Hoeppner (kris-hoeppner)]

Seems like it's working. Haven't seen any spammers over the last few days (except one who didn't post links). :-)

[Aaron Wells (u-aaronw)]

Since deploying this to Mahara.org on Nov 18, we've seen only one spam forum post (which as Kristina mentioned, didn't include any links).

And since deploying the expansion on Nov 21, I've seen only one spam Page. It was shared with Logged-In users, but not with Public, because the user was still probationary. I suspect that it's a spammer who created the page and then realized only afterwards that they couldn't make it visible to the outside world.

At some point we should set someone looking through all the user accounts to delete the spam ones, though. I went and looked through all the wall posts created in November 2013 and found that there were 42 accounts created during that month whose sole content consisted of a spam wall post on their own profile page's wall. This was all before Nov 21 when I blocked external links in wall posts, so that's about 2 accounts per day.

Overall in November 2013 there were 970 user accounts created, of which we suspended 94 for being spammers (nearly all of them before Nov 21).

[Kristina Hoeppner (kris-hoeppner)]

The new measures you put into place are great, Aaron, and we should put them into core with a view for the admin to configure the settings.

[Aaron Wells (u-aaronw)]

Yes, we should try to upstream this stuff for 1.9. It still needs some cleanup. For now I've pushed it into the "newuserprobation" branch in my gitorious repo: https://gitorious.org/mahara/agwells-mahara/source/d73b9ccd528739fcf37eebb376e1733cf9efa9f4:

[Robert Lyon (robertl-9)]

If you need to remove a user from probation you currently will need to go and manually update the db, eg:

UPDATE usr SET newuserpoints = 0 WHERE username = 'newly_joined';

It would be a useful feature to have if one could remove probation via the admin interface.
- Possibly on the bulk actions page one could have a button 'Remove probation' and so could update a bunch of users at once.
- possibly as a select box on the admin user edit page where an admin can select probation = 0

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/3065

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/3068

[Mahara Bot (dev-mahara)]

Patch for "master" branch: https://reviews.mahara.org/3069

[Aaron Wells (u-aaronw)]

I've pushed a couple of additional patches to let admins see and edit user probation points, individually or in bulk.

[Mahara Bot (dev-mahara)]

Reviewed: https://reviews.mahara.org/3069
Committed: http://gitorious.org/mahara/mahara/commit/4bc3364abf595dfffe02016c70cd6d66f141cb3c
Submitter: Aaron Wells (<email address hidden>)
Branch: master

commit 4bc3364abf595dfffe02016c70cd6d66f141cb3c
Author: Aaron Wells <email address hidden>
Date: Wed Mar 5 17:44:57 2014 +1300

Let admins bulk-edit users' spam probation status

Bug 1252101

Change-Id: Id576efdb352156a5e70a03c319e47f23cfdbc558