Mailing-List: contact jspwiki-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: jspwiki-dev@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of harry.metske@gmail.com
 designates 209.85.146.177 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references;
        b=PS0K07S5iNrpfKZshUF6p3/REclyibfgXcRZk0llke6uJUcmbYYCtNwQ33aueI3lCqJR+PR1nyRa58vyVzb2Gb/ItzjqOkIl5eakf/9IJko0TfQ4Umli6T388hy9z22uXtwOc2ijYiKDkkCLv3FMwF9fm9FwVkNqFgcSKZRGjpQ=
Message-ID: <3a6c97f00712260231y3ff29f41nc3b3f70c77396e1@mail.gmail.com>
Date: Wed, 26 Dec 2007 11:31:22 +0100
From: "Harry Metske" <harry.metske@gmail.com>
To: jspwiki-dev@incubator.apache.org
Subject: Re: The guy's back...
In-Reply-To: <58A1E27A-897A-4FC4-A2E6-821FBB2D8CE2@ecyrd.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_12445_156538.1198665082384"
References: <7C1E56D8-C09D-4709-8BBD-2D82848B34E0@ecyrd.com>
	 <3a6c97f00712251306n2d98cc77ybd0cd88c8e2f8fbf@mail.gmail.com>
	 <2DA32C36-E574-4C43-ADB8-9AC1333A8996@ecyrd.com>
	 <20071226024045.GJ12092@samad.com.au>
	 <58A1E27A-897A-4FC4-A2E6-821FBB2D8CE2@ecyrd.com>

------=_Part_12445_156538.1198665082384
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

I also think it is too dangerous to offer spammers a dummy jspwiki.org,
chances are that goodwilling editors are loosing their edits in the dummy
wiki.
Another more rigorous approach would be to only allow authenticated users to
edit and comment (so anonymous or asserted users can no longer
edit/comment), and expand the user registration process with an email
confirmation step.

But looking at the amount of spam-edits done so far, this might give a
little bit too much collateral damage.

(I also had a quick look at the registered users, and it seems to me that
there are quite a few with invalid email adressess, I think those should be
removed, what might also be a good idea is an extra attribute that holds the
last access date of the user, this allows for removing users that haven't
been used for a long time).

regards,
Harry

2007/12/26, Janne Jalkanen <Janne.Jalkanen@ecyrd.com>:
>
> > not sure if it possible, but why not let him have hi userid and
> > when he logs in
> > with it, send him to a clone of jspwiki.org, or code up a 200
> > response jst for
> > him but throw away his edits ?
> >
> >
> > I know this is outside normal wiki framework, but might allow the
> > wiki to
> > continue ?
>
> May be possible, but that would need a sure-fire way of recognizing
> the userid.  And, if we can do that, we could probably stop the edits
> right away.
>
> I've been toying with the idea of collecting the IP addresses he
> comes from, and building a "permanent blocklist".  Also, it might be
> cool to have a four-layer option set for edit management:
>
> 1) approve
> 2) send suspect edit to a captcha routine
> 3) send suspect edit to a human to approve
> 4) reject outright
>
> Currently our system is not that fine-grained.
>
> /Janne
>


-- 
met vriendelijke groet,
Harry Metske
Telnr. +31-548-512395
Mobile +31-6-51898081

------=_Part_12445_156538.1198665082384--