Re: projecthoneypot

On Thu, Mar 12, 2009 at 7:35 PM, Martin Jansen <martin@divbyzero.net> wrote: >> That is possible yeah - You may go ahead and implement something better. > > You sound a bit offended.  If you are, please be assured that this > wasn't my intention. I am in fact not - I had some headaches already because of the honeypot project but I viewed it more as the code had to improved on our side, which was done since I believe it is a bit silly ditching a system after the first iteration :) >> We were getting quite the amount of spam accounts getting through to >> our system, only reason why you don't see it now is that the account >> listing now only show pear.dev people :-) > > So essentially the spammers were circumventing the CAPTCHA mechanism? Yes and also we required people to receive an email and click a link for their spam to get through and account to get confirmed, which they were managing to do - This is the reason why we decided another approach (and people hating CAPTCHA :P) >> Tho I must say - the honeypot project isn't all that bad + we are only >> stopping off people that have been listed as a spammer and with >> activity during the last 30 days, maybe that is still too high, dunno. > > My position with regard to Honey Pot stems from the fact that Boris' > complaint wasn't the first on the various PEAR lists in the recent > weeks.  Most of the time they came from people who wanted to submit bug > reports -- loosing bug reports because people were wrongly blocked by > black lists sounds like a major drawback to me. Agreed which is why I made the bug report page more relaxed in checks compared to the account pages - I can relax it even more. At the moment we catch IPs that have been marked suspicious (e.g. not been classified but been reported), classified as comment spammer, classified as harvester and classified as a search engine - We check against all of those and it they have to had reported activity within the last 30 days. I can drop the suspicious part which should fix a fair amount of complaints, hopefully, at least I think going back to the old system would give us no benefits and having nothing would be horrible - thus requiring a better implementation (e.g. my earlier comment) or dropping of the suspicious part. I'm open to ideas but new implementations are not within my schedule for now, so someone else would have to do it. - Helgi