Moderation Queue adjustments

[DavidIQ]

The moderation queue is a good tool for preventing spam from being posted publicly. There might be a little hitch with this though and would like some opinions on the matter before I write up an RFC for it.

Here's the scenario: "Super Spam Bot" has decided to hit your forum and make several posts perhaps even hundreds of posts. Because you have Moderation Queue enabled none of the posts are seen because they are pending approval so mission accomplished...SPAM spreading is prevented. But the cleanup is going to be kind of painful. The moderator that sees this SPAM attack now has to go through several pages of posts pending approval and unapprove them. This can take quite a while. It could be that this "Super Spam Bot" also registered multiple accounts during that time.

So a couple of questions come up in this scenario:

1. Does a new user that is on the moderation queue really need to be able to post as many times as they want before any of their posts are approved?
2. Should a user registration be allowed when coming from the same IP within a certain time span of the previous from that IP, say 30 minutes?

My opinion on both is that these should not be allowed but would like to hear other opinions.

[EXreaction]

I think a limit to the number of posts by a single user on the moderation queue may be a good feature, though I do not too often run into it where bots post a bunch from a single account.

[Pony99CA]

Here's the scenario: "Super Spam Bot" has decided to hit your forum and make several posts perhaps even hundreds of posts. Because you have Moderation Queue enabled none of the posts are seen because they are pending approval so mission accomplished...SPAM spreading is prevented. But the cleanup is going to be kind of painful. The moderator that sees this SPAM attack now has to go through several pages of posts pending approval and unapprove them.

Won't deleting the user and checking the option to delete posts clear everything up without having to unapprove posts?

It could be that this "Super Spam Bot" also registered multiple accounts during that time.

[...]

Should a user registration be allowed when coming from the same IP within a certain time span of the previous from that IP, say 30 minutes?

That's a tougher question, but will the spam bot actually use the same IP address? If so, maybe there should be a flood option for registrations from the same IP address. The admin could set the time limit (probably in minutes), with zero meaning no flood control. If a "flood" was detected, a message would be displayed saying something like "A user account was registered from your IP address within the last <n> minutes. If this was not your account, please try registering again in <flood - n> minutes."

Steve

[DavidIQ]

Won't deleting the user and checking the option to delete posts clear everything up without having to unapprove posts?

You're assuming the moderator has the ability to delete accounts.

[Pony99CA]

Won't deleting the user and checking the option to delete posts clear everything up without having to unapprove posts?

You're assuming the moderator has the ability to delete accounts.

I was actually assuming that the moderator would get an admin to do that. As nobody can see the posts except moderators, there's no real hurry to delete the posts. The moderator can ban the user to stop new posts, of course.

However, maybe there could be a "Delete all unapproved posts posts from this user" capability added to the MCP. Of course, neither this suggestion nor your moderation queue flood control option help boards that don't use the queue. In that case, the moderator has to delete posts one at a time (unless he can get an admin to handle this as above).

Steve

[brunoais]

Won't deleting the user and checking the option to delete posts clear everything up without having to unapprove posts?

You're assuming the moderator has the ability to delete accounts.

I was actually assuming that the moderator would get an admin to do that.
(...)
However, maybe there could be a "Delete all unapproved posts posts from this user" capability added to the MCP.

+1
More on that. The admin probably wants to ban the user and not delete. If the user is deleted then the bot may come back with the same username. After you get thousands of banned usernames, you get get somewhere... probably....

[drathbun]

The admin probably wants to ban the user and not delete. If the user is deleted then the bot may come back with the same username. After you get thousands of banned usernames, you get get somewhere... probably....

Bots don't - at least in my experience - tend to reuse names. I have never bothered to ban users, we just delete 'em and move on. Whether moderators have the permissions to do this is up to the board owner, of course. That's a logistical issue not a coding one, as has already been mentioned there is an option to clean up all posts by a user when they're being deleted.

[Pony99CA]

The admin probably wants to ban the user and not delete. If the user is deleted then the bot may come back with the same username. After you get thousands of banned usernames, you get get somewhere... probably....

Bots don't - at least in my experience - tend to reuse names. I have never bothered to ban users, we just delete 'em and move on.

I don't ban, either. I've had some bots (I presume) return with the same user name, in which case I disallow that user name (or, if the user name is obviously spammy, like "OnlineViagra", I wildcard ban it, like *Viagra*). If the spammer's domain is spammy, like warez.com, I ban all of the E-mail addresses (*@warez.com). If I notice multiple hits from an IP address or small range of IP addresses, I do a WHOIS and ban that range if they're not a major ISP.

IMHO, banning is for good members gone bad. A temporary ban is for somebody who goes off the rails for a bit; a permanent ban is for people who have gotten multiple temporary bans. Users who start being jerks (or spammers) just get deleted.

Steve

[callumacrae]

Imo, banning a user (thus revoking their posting permissions) should disapprove all of their posts.

[imkingdavid]

Imo, banning a user (thus revoking their posting permissions) should disapprove all of their posts.

I disagree. If you have a member that gets unruly but has made constructive posts up to that point, it wouldn't make sense for all of their constructive posts to suddenly disappear from view just because they've been banned for whatever they did. Anyway, if their posts were disapproved upon being banned, would they be re-approved when their ban was revoked?