ADMIN: PMs disabled

[bob3160]

What still disturbs me is the fact that someone who isn't part of management was able to get  to the members email addresses.

Well, what does it mean "to get to the members e-mail"? They didn't learn these e-mails, of course. But if your settings say that the forum should send you the notifications about received PMs, you'll get the message, yes.

In that case, nothing was compromised. I don't open garbage mail or PM's the only place I saw the XXX picture was in the forum itself and that was
because a member posted it in a thread on the forum. Not the spammer.
That was annoying to me. The PM's are easily deleted and to me, this isn't a reason to stop the PM function.
PM's are a selected function so unless you elect to receive them, they should be blocked.

[justin1278]

In my opinion disabling PM's is not needed to stop the spam, make rules when sending PM's such as each user can only send 1 PM every 90 seconds.

We're open to any (realistic) suggestions. But they must be realistic - meaning that the forum software (SMF) has to support them. Are you sure something like this is supported?

Hi VLK,

The Comodo Forums use SMF 1.1 RC3 and the Admins made a rule (due to spammers) that each member can send 1 PM every 90 seconds, I am only a moderator there so I couldn't tell you the steps to enable this option. Also since you are using an older version of SMF (not RC3 of the latest) this feature may not be available yet. However you may wish to check into it. And in all honesty I don't really think that any real member here would need to send more then 1 PM every 90 seconds. Also it doesn't have to be 90 seconds it can be as long or short as you wish, although I think that 90 seconds is a good time. Like I said I am not sure how to set it on the SMF forums because I am only a Mod at the comodo forums, but that feature is available in the latest 1.1 RC3 if it is not available in the version that the avast! forums use.

[Vlk]

We have been waiting for SMF 1.1 for a very long time. The problem is, RC2 was released on December 2005, and now there's only RC3. I mean, how long is it going to take to get to the final version?

For obvious reasons, we don't want to use pre-release (beta or RC) version of the forum in "production" environment.

[MikeBCda]

I'm a mod at two Yahoo groups which are medical-support (one for head-injury survivors like myself, the other for psoriasis) in nature.  Medical-related groups in particular are prime targets for spammers because of the opportunity to offer "cures".

Obviously the mechanics of a mailing-list group are different from the boards here.  But we've come up with what seem to be workable solutions for us.

The psoriasis group was often the victim of new "members" who obviously joined for the sole purpose of spamming.  The list-owner finally decided that ALL new members go onto moderated status (i.e., postings must be approved by him or a mod) until they've done some legit posts, which is essentially what's being proposed for the PM's here.

We play it even tougher in the head injury group.  Membership is restricted (not just hit the "Join" button), and we want a brief intro letter describing the nature of the applicant's injury and problems and work-arounds before we'll approve membership.

[bob3160]

I think that a simple warning to the member who decides to accept PM's that doing so could result in possible SPAM, should be sufficient.
As long as the spam is kept out of the actual forum. Acceptance of PM's or NO PM's  should be left up to the individual members. IMHO

[mouniernetwork]

One of the options to stop the spaming of PM's would be to have kind of am image that disaplays random characters and then the user has to write them manualy that way it will block the spammers from creating bots that work with with system. This verification should be used when opening an account as well as when writting personal messages.

Hope you consider this

Al968

P.S: I don't know if thats available with the forum software.

[mouniernetwork]

One of the options to stop the spaming of PM's would be to have kind of am image that disaplays random characters and then the user has to write them manualy that way it will block the spammers from creating bots that work with with system. This verification should be used when opening an account as well as when writting personal messages.

Hope you consider this

Al968

P.S: I don't know if thats available with the forum software.

Here are some links related to the topic:

http://www.phpbb-security.com/
http://www.simplemachines.org/community/index.php?topic=102714.0

[justin1278]

We have been waiting for SMF 1.1 for a very long time. The problem is, RC2 was released on December 2005, and now there's only RC3. I mean, how long is it going to take to get to the final version?

For obvious reasons, we don't want to use pre-release (beta or RC) version of the forum in "production" environment.

Hi,

In that case what is the latest stable version you are using? The current stable version is 1.08 is that the version that avast! is using?

[szc]

Even though forum admin and I had some issues in the past, I think that this step taken by Alwil is necessary and overall it is a great decision. Thinking that limiting to 20 posts in forum before you can send PM to someone will stop these SPAMMING idiots is plain waste of time. As Vlk already mentione, they can make hundreds if not thousands posts literally in no minutes if they want... just take a look at what they did in this forum through PM system. Something must be changed from the scratch if we want to stop them. If that requires changing the forum engine to some more secure one, then why not going that way ? Of course if there is one that's more secure at the moment, with maybe some better security features...

One thing that I don't understand... how come that admins or moderators can't see who is sending these messages by origin IP address ? Isn't there any way of tracing them whoever they are... I mean, there must be some way to find out who is doing this... for God's sake, this is a security related forum.

In my humble opinion, this is an act of some competitor AV product fanboy. They knew exactly what they are doing and how to do it. People, just take a look how those posts they posted later in forum look like... "...oh this is shitty forum, that means this AV is nothing but garbage..." All similar posts were posted by some person who just signed in forums under many different names, posted one or maybe 2 or 3 posts and then started to s**t about this forum and this antivirus... It is obvious that someone did that just to badmouth thisproduct and to make it look ugly in people's eyes.

There must be something to find out who did it... let's show them that this is a serious product and people behind it are some serious people who know their business better than anyone else.

Regards

[mauserme]

The idea that this problem must be solved today or this week, in a 100% infallable way would be great if it was a realistic goal. But its not realistic and shutting off the PMs because this can't be attained doesn't make sense to me.

Take the interim steps suggested by DavidR along with the "possible spam" warning suggested by Bob, but continue to work on a better, more secure solution.

The all-or-nothing approach can only work against a strong, thriving forum.  Let the solution evolve.

[roro]

I know a lot of people were upset with the PM messages contents.  I didn't see it as I didn't open the mail and don't open any mail that I don't recognize.  If you get a PM that looks fishy even if it is from this forum, you should go to the forum to check it out before opening.

Is it possible to have a vote on the number of members who wish PM's to be disabled for good?

As for me, I make my choices.  If I don't want to take the chance, I can disable the send notification of PMs feature.  It would be a shame to disable a feature for all, that many of the forum members use to good advantage.

I still miss the Off Topic forum myself and wish it would be reinstated.

Ro Ro 

[Tarq57]

I'm quite new here, too, but tend to agree with the majority of the other posters. Nobody has to receive pm's, nobody has to open them. I did, and can definitely see why a lot of people were offended.But to bleat stridently to the admins about it? I respect the decision taken, but think that to disable pm's is a bit overkill. Like banning live coverage of the superbowl because of a "wardrobe malfunction".
Long term, I hope a technical solution such as mentioned by al968 5 posts back could be used. Also would like to see the spammers prosecuted or otherwise somehow penalised, if such a thing is legally and technically realistic.
We live in the age of junkmail. It's unpleasant, and annoying,and sometimes offensive, but...get over it. Site security wasn't compromised, and that's the main thing.

[markofkane]

It's funny. The porn spam in my email is what brought me back here. My Avast has been working fine, but sometimes get the "AAVM - initialization error: AavmStart: avworkInitialize failed, 0000A438"  and that is fixed by repairing Avast.

I was p'd off when I found out the email was a PM from a spammer, the first time, it was AnnT, I think, and reported it to a admin, because it was a spammer posing as an admin.
Then the ones you guys mentioned. So I got really p'd off.

Then I found a way to block PM's. I tried to send a pm to myself, and the * filter worked. (This was before pm's were disabled globally)

[Marmot]

One of the options to stop the spaming of PM's would be to have kind of am image that disaplays random characters and then the user has to write them manualy that way it will block the spammers from creating bots that work with with system. This verification should be used when opening an account as well as when writting personal messages.

This seems to be quite popular anti-spam function since I see every single service with account has this process except these fora.

Also, although I cannot remember the name, I found a forum which I signed in had an opt-out email notification option for PMs except from administrators, which is opt-in.  There was an opt-out option of totally disabling PM function itself, too.

As some people have already mentioned, it is nice to give users choice rather than restricting.  Here, I am not criticizing the temporary decision but talking of possible flexibility, which can make the whole experience constructive.

[Dwarden]

realistic options to keep PM on forums ?

simple:

- limit PM to users older than month (exception are PMs to admin/moderators)
- limit PM to users with more than 25-50 posts (exception are PMs to admin/moderators)
- add Captcha to new user registration dialog http://en.wikipedia.org/wiki/Captcha
- add Captcha for PM dialog http://en.wikipedia.org/wiki/Captcha
- disable "e-mail" notifications for PM and replies by default (force user to OPT-in manually)