Re: Spam on the wiki

On Wed, Dec 16, 2015 at 6:27 PM, Joshua D. Drake <jd@commandprompt.com> wrote:

On 12/16/2015 09:22 AM, Andres Freund wrote:

On 2015-12-16 18:21:47 +0100, Magnus Hagander wrote:

Either they've found a way to script-generate gmail addresses, or they have
found a way to break the django hashes.

Or they just hired somebody to do that kind of thing manually. There's
sites for that...

In the interim, let's just disable edits.

New account signups have been temporarily disabled at least. But yes, they still have all those accounts against the wiki as well. 

Magnus Hagander <magnus@hagander.net> writes:
> New account signups have been re-enabled, now requiring a captcha.
> Hopefully that will be enough to stop the new spam signups. We'll keep an
> eye on it and disable them again if it seems to happen again.

You probably already noticed, but ... they're at it again.

Magnus Hagander <magnus@hagander.net> writes:
> So they break the captcha in seconds. I'm more and more thinking andres'
> idea that it's actually farmed out to people and not just bots...

Yeah, it's sounding a lot like manual creation of the accounts and then
bots doing the actual spamming.

> My suggestion is we make all edits on the wiki moderated, if that's at all
> possible. It's AFAIK the only service where we allow people to post things
> with no moderation on the content today, and clearly that's not working.

Sigh.  That's pretty ugly, though maybe it will work if you can set it up
so that known members of the community can bypass the moderation.  The
bulk of the legitimate edits probably come from a fairly small number of
people.

On 12/16/2015 09:22 AM, Andres Freund wrote:

On 2015-12-16 18:21:47 +0100, Magnus Hagander wrote:

Either they've found a way to script-generate gmail addresses, or they have
found a way to break the django hashes.

Or they just hired somebody to do that kind of thing manually. There's
sites for that...

In the interim, let's just disable edits.

On Thu, Dec 17, 2015 at 3:30 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:

Magnus Hagander <magnus@hagander.net> writes:
> New account signups have been re-enabled, now requiring a captcha.
> Hopefully that will be enough to stop the new spam signups. We'll keep an
> eye on it and disable them again if it seems to happen again.

You probably already noticed, but ... they're at it again.

ARGH!

I was looking at a cached copy of the page :S

On Wed, Dec 16, 2015 at 11:16 AM, Dave Page <dpage@pgadmin.org> wrote:

> I've blocked those two users, and it looks like Alvarro has done
> a few more.

There seem to be a lot of user IDs involved.  Do we know whether
there are new user registrations happening, or were all these set
up before the attack?

On 17-12-2015 12:13, Magnus Hagander wrote:
> Yeah. I have no idea how mediawiki actually works with those things, but
> I'm not sure what else we can do. It's been suggested to have a
> cooling-off period for new accounts, but how long should that be... I
> guess we could have a 2-4 week cooling off period and then some way to
> bypass it by contacting someone manually, but who's going to deal with
> those approvals?
>
Why don't we create a group of known community members? This group can
edit without restriction but new accounts will be moderated.

On Wed, Dec 16, 2015 at 05:32:19PM +0100, Guillaume Lelarge wrote:
> Hi,
>
> There's something wrong over here: https://wiki.postgresql.org/wiki/
> Talk:What's_new_in_PostgreSQL_9.1/fr
>
> And to many more pages. See: https://wiki.postgresql.org/index.php?title=
> Special%3ALog&type=&user=Singhuma893
>
> Not sure what's the best way to deal with this, but wanted you guys to know
> about it.

Yes, I am trying to fix it but the spam users are creating new pages
faster than I can fix it.  I am concerned we are going to need to revert
the entire wiki to an earlier state.

I see problem users Johnthe and Sanjaypatel but the fixes are geting
re-spammed so quickly I am afraid it is some automated attack that will
be difficult to clean up.  The other problem is that they are _moving_
pages, meaning we have to move them back as well as undo the edits.

I am going to give up trying to undo this until we can get a better
handle on a process of cleanup.

On Wed, Dec 16, 2015 at 11:09 AM, Kevin Grittner <kgrittn@gmail.com> wrote:
> Looking at the Wiki's change log, it appears to be logging about 10
> changes per second.

Sorry, 10 changes per minute.

Still...