Forums General Discussion Practical ways to stop spam on IRC

Who here knows what a turing test is?
Its any test which can tell the difference between a human and a computer.
You've seen these a lot; any web page that makes you read a number from an image when doing a form input. It works because you can read it but a program can't translate from image to text easily.

So how can we apply this to IRC?
The idea is simple.
You get a bot, you get your channel, and you get scripting.
Firstly; rename you channel, ie if you owned #pants change the name to #dsghjkdfgo;dbjdjfghdf;gdf
Make the channel +s Secret and +i Invite only

Secondly; start up your old #pants channel. Put in a bot. This bot is a modified trivia bot. When someone joins they are asked a simple question.

Q: If con is the opposite of pro, what is the opposite of progress?
A: Congress

When they get the right answer they get an /invite to the secret channel thus preventing unwanted users from getting in.
a) This discriminates against people who are dull-witted
b) This discriminates against bots

Other possible turing tests could include something like the following and asking to translate to the correct english:
Aoccdrnig to a rscheearch at Cmabrigde Uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoetnt tihng is taht the frist and lsat ltteer be at the rghit pclae. The rset can be a total mses and you can sitll raed it wouthit porbelm. is bcuseae the huamn mnid deos not raed ervey lteter by istlef, but the wrod as a wlohe. Amzanig huh?

Simple maths problems could also be used.
Or trivia everyone knows ("The best thing since sliced... ")

Ideas; thoughts; comments?
I got a little way through scripting a lazy bot to do it.

;Aliases
alias -l _waitingRoom {
;/_waitingRoom $nick #channel
.msg $1 Welcome. I have a riddle for thee. Of attempts only you have three.
set $+(%,_q.,$1) $read(riddles.txt,$rand(1,$lines(riddles.txt)))
.msg $1 $gettok($eval(% $+ _q. $+ $1,2),1,94)
}
alias -l _answer {
;/_answer $nick #channel <answer>
if ($3- == $gettok($eval(% $+ _q. $+ $1,2),2-,94)) {
.msg $1 CORRECT ANSWER $gettok($eval(% $+ _q. $+ $1,2),2-,94)
.invite $1 $eval($+(%,$2,.chan),2)
.unset % $+ _q. $+ $1 $+ *
}
else {
.msg $1 INCORRECT ANSWER
inc % $+ _q. $+ $1 $+ .i
if ($eval(% $+ _q. $+ $1 $+ .i,2) >= 3) {
ban $2 $1
kick $2 $1 Bye bye bot bot [either that or your not the sharpest tack in the box]
}
}
}

alias -l _help {
var %f $input(Welcome. This is a simple proof of concept script; designed to target spam bots. It will stop 90% of all bot; such as trojans and the like. Unfortunately it will not stop bots who work by having a human agent sitting in the channel relaying information. This however becomes a much more labor intensive task.)
}

;Events
on *:join:%waiting.room:{
_waitingRoom $nick #
}
on *:text:*:?:{
_answer $nick # $1-
}
on *:load:{
if (!$isfile(riddles.txt)) { write riddles.txt Cat is to Mouse as Predator is to^Prey }
}

If this was to be done; we couldn't have the bots distributed with a pre-compiled list of tests. Otherwise; spam bots could easily use this lists to bypass this method.
Also; this wouldn't stop a human agent joining the channel and working on behalf of the spam bot; collecting nicknames

Nice idea

Already have that idea, Is very nice.. On the channel of my country i put the +m flag and voice all users with the ip of my country and other with strange ip's must response to a question.. Only ppl from my contry know the response.. Like that the users know what the voiced users are not bots.. Usualy the ppl what join to spam have foreign ip or have a masked ip(i live on undernet and there exist the +x flag what hide the real ip with somthink like some.users.undernet.org).. And like the spam decrease for a few times.. And the lame spam-chat-bots don't have voice.. And the users don't msg it..

I also have a suggestion for the ircd and the mIRC.. On connect to a irc-server is showen a image.. Only a human can read what there is writed.. Thats is many times used to prevent the bot web registration..

Well to be more specific, the Turing Test is designed to test a computer for the presence of artificial intelligence. That it can be used to tell the difference between a human and a bot merely exploits our current lack of true artificial intelligence. Something which is steadily changing.

The examples wouldn't work for many channels.
- The mixed-up letters would most likely defeat people who aren't particularly familiar with the language the test is made in. Because many IRC channel's userbases include multiple countries that's not very practical.
- The same goes to the one using a common saying.
- To some extent the same goes for the word-link one too.

A 'simple maths' test could probably be beaten by a bot.

In all it would be a hell of a lot simpler to just use a network which isn't plagued by spam. There are plenty about.

I can see your point, could help cut down on a lot, but that wouldnt stop infected users or those that use scripts that spam.

*grumble* spammers are worse than telemarketers and you cant even let the answering machine deal with them.

Technically:



... How exactly will that work?

Morally:

It seems as if you'd be using this to filter *new* people entering your channel. "This discriminates against bots", no, it discriminates against users by having a BOT give them the third degree, so you can prevent BOTS joining your channel, ironic? "This discriminates against people who are dull-witted" and "thus preventing unwanted users from getting in": seems to me you think this is an advantage - I doubt you have much need for this kind of system.

Perhaps the easiest test would be to have people message you so you can invite them? You can make assumptions on peoples intelligence there too.

Many self-advertising drones infect the users mIRC and install a script to have a socket connection (and often the main connection itself) spam the nicks the main mIRC connection sees, so as you said this wouldn't stop all bots (you used the term 'human agent' as if the victim were a willing spammer, which isn't always the case).

Nice idea, ClockWerx, but the devil's advocate in me says...

• It makes auto-joining your channel impossible
• It won't stop "innocent" spammers, i.e. those infected with spam "viruses" (particularly those afflicted by JS exception viruses)
• It won't stop "script illiterate" spammers, i.e. those whose spam is caused by not understanding how their script works (they don't know how to switch off onjoin messages, or don't know that their script generates onjoin messages)
• It won't stop "feeders", i.e. real clients/bncs which send info on users joining to a bot outside channel, which then sends the spam (I have seen viruses which set up this kind of system, too).
• You'd have to be careful about the server you put the waiting room bot on - what happens if the server it uses splits? (especially if that is the ONLY server to split?)

It IS an interesting way of keeping the 'classic' spambots and zombie clients off a channel, though

PastMaster
IRCnet @#beginner @#travelersinn

Spammers have, alas, rapidly become adept at getting round this... I'm not a programmer, but I would guess that decoding this kind of image is not much different than dealing with scanned text...

PastMaster
IRCnet @#beginner, @#travelersinn

I think it would be a better idea if we just started using Bayesian Filtering though. Of course the filters would have to be trained for a bit, work on individual sentences, and be fast. But it does wonders for my e-mail. I almost never get false positives or negatives, and I can get from 100 to about 336 spam every day. If you're on a net with a lot of spam, I guess a filtering system based on that could really help you.

Bayesian Filtering is a good solution for email - but its just not too handy to try on anything but a server level.
Sure you could train /ignore commands with a client side script, but still it takes a toll on teh server's throughput.

The failing of the +v method for spamming is that it still lets bots get nicknames and send privmsg spam; but at least we know that the basic method works. :P

Decoding an image and OCRing it is leaning towards specialisation too much for most HTTP web bots, whiule it could be done; the resouces needed to do it are... extensive to say the least.

I don't think that forcing users to view an image on connect to pass a turing test is effective for a client like mirc. *sigh*

Lets see have I missed any posts?

"Because many IRC channel's userbases include multiple countries that's not very practical."
I've found that this isn't the case actually in my experience; and it would be easy to have them type a trigger for alternate quesitons... ie !Duetsch would trigger "ich habe eine Katze im ..." or the german equivalents.

The 'simple maths' would be written in english and be a word puzzle description thingy.
IE
Q: John has four cookies; Joan has two. Tom ate two of Joan's cookies; how many are left?
A: Zero.

If your wondering about other languages and having problems answering em; do you know how to count from one to ten in japanese?
German?
Anyone who went to my school(s) knew how to - because in Australia we have to learn a second language at some point or another.
Anyway; most other cultures have bowed in to the inevitable and do teach some english or french in their schools i'd imagine; so they could surely understand that.

Even if they don't; you could do algebra with symbols that just aren't possible to parse wihtout complex coding ion the behalf of the bot.
Now considering how there is a wide range of solutions to cater for; coding this complexity into a bot becomes a prohibitive amount of effort.
AI isn't going to be the saviour of spam by any means.

just any priv messages are sent to an alias for checking against the answer for the nickname.

its done that way so I can write effective test drivers and not have to rely on being only to receive text events.

your file of q+a is filled with lines like:
How many LEGS does a MONKEY have...^four
^ delimits the question and answer to be tokenized..

As for:
"This discriminates against bots", no, it discriminates against users by having a BOT give them the third degree, so you can prevent BOTS joining your channel, ironic?

The point is it stops malicious spam bots. If it so happens that anyone wants to run a bot; then they ask for some kind of automated password from the channel ops - it goes in the back way; not through the lobby.
There are plenty of loopholes open for LEGITIMATE bots that are about with PERMISSION of the people who run the channel.

"This discriminates against people who are dull-witted"... Have you ever been into any #sex or #teens room in your life?
<someguy> Wuz up I so cool it no funny
<someotherguy> ANY LADIES WANT LOVING? MSG ME!
<someguy> Hahahaha he said 'msg'
... you can just tell that people like this aren't likely to provide interesting or amusing conversation.
These people also seem to (in my experience) be rather dull witted. Go ahead and randomly sample a room if you don't believe me; give them simple word puzzles and offer them some reward.

All too often I get this sort of thing:
<someguy> Hi want to chat?
<me> No.
<someguy> Are you there?
<me> *sigh*. Go away; there is nothing of interest here.
<someguy> Hi asl?
... with the other person seemingly UNABLE to take a damn hint. I don't know about you but if I can keep these people out; i'll do it in an instant.
And if I can do that by using their weaknesses against them; why not?

Anyway, we aren't asking them to calculate the value of PI to ten million places, we are asking them to answer a SIMPLE question.
Oh oH.
I feel a 'nerds made computers for nerds, not the rest of you' rant coming on.
I'll hit the button before I get more ranty.

Hmm didn't think about the 'splitting.
The worst comes to worse; your bot goes offline and you get no traffic to the main channel. In which case you'd be running two or three bots (on a netsplitty network) as backup.

Just have them running on a tiered level type thing; on *:join:#:{
if (FirstBot !ison #) {
;do stuff
}
}

combined with bayesian filtering scripts we might see the death of spam. I'm salivating. brb visting feature suggestions to do stuff.

EFnet has a rather handy tool in the form of usermode +g. This usermode blocks at the server all incoming private msg's, CTCP's, DCC's and notices. Coupled with a +m channel, you have an effective solution

Isn't it the same as /silence +* ?

Personally, I use a network that supports chanmode +R and umode +R, so I don't have spam problems.

Secondly, it's not very wise to asume that everyone has access to a 24/7 bot. It's also not very wise to assume that even the majority of users that join your channel will reply to such a test. It's been my experience that the average user don't even read the topic or on join messages.

Thirdly, I personally would find somewhere else to chat other than your channel because I don't want to be bothered with joining a channel... taking a test just to be invited to another channel (might have something to do with the fact that I ignores all invite anyway )

If all your doing is getting past a +i chanmode .. it' is just as effective to set your channel +k and give your friends the chankey. I would assume that only your friends will be interested in going through that whole mess to startwith.

I dunno. Is it? :tongue: