Anyone else experience petition spam?

[SaucyWench]

(For those, Nightborn, you should always be comparing the IP and ID in the "show details" that appears whenever they petition when not logged in.)

As I hit "post" I realised that JT originally said he was not going to release the captcha module. Everything *else* that was unreleased got pushed live though when 1.0.5 came out so I had assumed Captcha was with it - but I don't have it here in 1.0.5. He may not have released it after all, which is where I say, DANG, SORRY! If it can't be found, we can ask him if he did release it.

[Nightborn]

(For those, Nightborn, you should always be comparing the IP and ID in the "show details" that appears whenever they petition when not logged in.)

As I hit "post" I realised that JT originally said he was not going to release the captcha module. Everything *else* that was unreleased got pushed live though when 1.0.5 came out so I had assumed Captcha was with it - but I don't have it here in 1.0.5. He may not have released it after all, which is where I say, DANG, SORRY! If it can't be found, we can ask him if he did release it.

(I know how to compare, yet I don't want those mails ^^ as people ask when I tell them somebody tried to frame them "who framed me" and I say "I don't know" and they ask "Why, you run this page!" and well, what should I do? Forget about them? Well...)

well, it would save me work, since I don't have contact to neither JT nor Eric (Eric never responded, JT only did in this forum) so I will let it be.

[SaucyWench]

* SantaWench sends a petition on Nightborn's server from "Talisman" asking if he wants to make a new game, or if he needs a amdin because im good.

[XChrisX]

The CAPTCHA module has been released and is available against a $15 fee (or $10 ? I'm not sure). JT was only selling this module, not releasing it for free becuase of the enormous work behind this module.

[Ironman]

So, does that mean if someone wanted to create a similar version at no cost, they may do so?  (No, I won't be that person.)

[SaucyWench]

Well, that depends. I can tell you that what I remember of JT's module, it had many fonts installed and many files to generate the images. If you make a half-hearted attempt then bots will defeat it. JT worked damned hard on it and the average admin wasn't competant to install it (me included).

If your module were based on his, there would be a serious problem. As we've established it wasn't released for free, it does not fall under the Creative Commons License, and therefore you cannot, at all, base anything off it without JT's explicit written permission or without him licensing you to do so - and JT did comment at the time that he wrote it that he intended it not to be free simply because he worked so hard to make it.

So, anyone making it has two things to contend with... I very much doubt most coders here can make something that would defeat the bots (so it would be useless) and second, they need to create it completely from scratch.

In my opinion you would be FAR better off to simply limit the number of logged-out petitions from a particular IP to one per day, UNLESS their IP or ID is in your ban list. That means, don't ban the bot IPs, and nobody will be able to petition more than once per say 24 hours unless they're actually affected by a ban.

Taking this further, you could simply disable the Petition link unless they have a valid cookie. Then add another link that leads to a "Why can't I petition for help?" with information that they MUST enable cookies to play the game and browser-specific info on how to enable them (but don't detail why the game uses them). You might have 1 in 10,000 users who then find they still have a problem and can't mail the admin... I would think that is so rare it's not worth bothering with, because it would only happen if they have cookie issues, and you would have no further advice anyway! But just my opinion.

[Nightborn]

The fee is OK, I have enough donations to cover such expenses.

Saucy, where can I contact him (and get a response).

[Gonzo]

The fee is OK, I have enough donations to cover such expenses.

That must be nice, my small group is a bunch of freeloaders (kidding of course!). 

The dummy field, as predicted, did not work... Trying the htaccess idea. 

[Catscradler]

What's the code of the dummy field you put in?  There may be a way to make it look more acceptable to the bots.

[Gonzo]

I used an identical field as the charname, but replaced the field name and what not... I'm not sure I could make it look any more realistic.  :/

[Catscradler]

And the bots went ahead and filled that in, or did they ignore it?

[Gonzo]

I didn't actually add it to the e-mail or petition itself, thus the dummy. 

It seems that the htaccess idea isn't resolving it either, though I may be missing the correct bot.  :/

I'm still trying to think of something that wouldn't involve an elaborate captcha

[Sichae]

When I was having bot trouble with my Guest Book, I made it so that the person would have to cut and paste an MD5 string of a randomly generated number into a box. Then, when sent, it would check to see if the two values match up (hidden field to carry over random number, then MD5 it). If you want, I can send you my changes to the petition.php that should effectively stop bots... although, it may frustrate players if they forget to enter the string.

[Gonzo]

Sure, I'll give that a shot.  Seems like a fairly simple change, and users should be able to adjust quickly.  Thanks. 

[Sichae]

This is the 1.1.0 version of petition.php that has been altered. See attachment.