18 Jul
2005
18 Jul
'05
8:30 a.m.
(turn on minor changes)
http://engineer.openguides.org/?RecentChanges
I've been massively spammed by some Wikispamming bastards. What's a
quick way to delete all these nodes?
I also can't see how all these Categories and Locales were auto-created,
there doesn't seem to be a main node linking to these categories?!?!?
--
Rev Simon Rumble <simon(a)rumble.net>
www.rumble.net
The Tourist Engineer
Geeks need vacations too.
http://engineer.openguides.org/
"Sometimes I doubt your commitment to Sparkle Motion."
- Kitty Farmer, Donnie Darko
18 Jul
18 Jul
2:13 p.m.
So, as a basic way of blocking the spammers, how about just rejecting
anything with "http://" in the Title of a node?
Philip Greenspun had a nice little social engineering tip about abusive
posters to web forums. When they'd locked out a particular IP address
or login, instead of getting a "nyerr nyerr you've been banned"
message, they'd allow the user to read, but when trying to post they'd
get a technical-sounding error like "resource busy" or "database not
available". The abuser would just think the site was shit and give up,
instead of working out they'd been banned and finding ways around it.
Not sure if this will work with Wiki spammers... I'll be dropping the
entire netblock of this wiki spammer at the firewall tonight.
19 Jul
19 Jul
5:43 p.m.
On Mon 18 Jul 2005, Rev Simon Rumble <simon(a)rumble.net> wrote:
(turn on minor changes)
http://engineer.openguides.org/?RecentChanges
I've been massively spammed by some Wikispamming bastards. What's a
quick way to delete all these nodes?
Your recent changes are really really slow. I can't actually see them
at all because I get timed out before the page loads. Have you got
your indexes set up? (Explanation of that is somewhere in the list
archives; I think in a conversation with jimbo.)
If they're the same people who hit the vegan guide to Oxford recently
then try nuking everything with '&#' in the name of the node. That
got everything bar four or five pages for me.
Ah, it's just managed to load. Nuke everything with 'supercasino' in
the node name. In psql this is something like
delete from node where name like '%supercasino%';
delete from content where name like '%supercasino%';
delete from metadata where name like '%supercasino%';
Syntax is probably the same for other databases. Insert the usual
warning to back up the database before you do this in case you typo.
Kake
6:59 p.m.
This one time, at band camp, Kake L Pugh wrote:
Your recent changes are really really slow. I
can't actually see them
at all because I get timed out before the page loads. Have you got
your indexes set up? (Explanation of that is somewhere in the list
archives; I think in a conversation with jimbo.)
I think that's a combination of it being a pretty small-spec virtual
machine and the motherlode of data created by the spammer. I seem to
have index files, so I'm presuming I do have indexing. I'm using
sqlite.
Ah, it's just managed to load. Nuke everything
with 'supercasino' in
the node name. In psql this is something like
delete from node where name like '%supercasino%';
delete from content where name like '%supercasino%';
delete from metadata where name like '%supercasino%';
That's done the job (in sqlite). Thanks!
A couple of improvements that this suggests:
1) Limit the number of categories and locales a node can have.
2) Allow regex matches of text in nodes and reject any edits that
include them (in this case, ^Http.**)
3) I couldn't even see the root node that had auto-created all the
"Http" categories and locales in the Recent Changes. Is there a
limit in the number displayed?
Looking through the logs, here's the culprit. Note the referrer it's
come in on:
81.213.173.173 - - [17/Jul/2005:22:19:57 +0100] "GET / HTTP/1.1" 200 8290
"http://www.google.com.tr/search?q=edit+this+page+wiki&hl=tr&lr=&start=140&sa=N"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
81.213.173.173 - - [17/Jul/2005:22:20:20 +0100] "GET /newpage.cgi HTTP/1.1" 200
4804 "http://engineer.openguides.org/" "Mozilla/4.0 (compatible; MSIE 6.0;
Windows NT 5.1; SV1)"
81.213.173.173 - - [17/Jul/2005:22:20:29 +0100] "POST /newpage.cgi HTTP/1.1" 302
325 "http://engineer.openguides.org/newpage.cgi" "Mozilla/4.0 (compatible;
MSIE 6.0; Windows NT 5.1; SV1)"
81.213.173.173 - - [17/Jul/2005:22:20:31 +0100] "GET /?action=edit;id=Kaleci
HTTP/1.1" 200 6864 "http://engineer.openguides.org/newpage.cgi"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
81.213.173.173 - - [17/Jul/2005:22:26:08 +0100] "POST /?action=edit;id=Kaleci
HTTP/1.1" 200 - "http://engineer.openguides.org/?action=edit;id=Kaleci"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
81.213.173.173 - - [17/Jul/2005:22:31:35 +0100] "POST /?action=edit;id=Kaleci
HTTP/1.1" 200 - "http://engineer.openguides.org/?action=edit;id=Kaleci"
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
--
Rev Simon Rumble <simon(a)rumble.net>
www.rumble.net
The Tourist Engineer
Geeks need vacations too.
http://engineer.openguides.org/
If the designers of X-windows built cars, there would
be no fewer than five steering wheels hidden about the
cockpit, none of which followed the same prinicples --
but you'd be able to shift gears with your car stereo.
Useful feature, that.
-- From the programming notebooks of a heretic, 1990.
7:20 p.m.
On Tue 19 Jul 2005, Rev Simon Rumble <simon(a)rumble.net> wrote:
I seem to have index files, so I'm presuming I do
have indexing.
Not that kind of index - the database kind.
http://openguides.org/mail/openguides-dev/2004-September/000502.html
Kake
6531
days inactive
6532
days old
openguides-dev@lists.openguides.org
4 comments
2 participants
participants (2)
-
Kake L Pugh -
Rev Simon Rumble