Banning Codes

Out of curiousity started to take a tour to see if there is any new ways to deal with banned members or ways to control bans...

thought this was interesting...a way to ban members from posting in specific forums...

Quote:

---

Global Header

<div id="forum">

Global Footer

</div>
<script type="text/javascript">
<!--
function ban(user, board)
{
if(location.href.match('board='+board) && document.cookie.match(new RegExp('user='+user)))
{
document.getElementById('forum').style.display = 'none';
}
}

ban('username','boardID');

//-->
</script>


Edit and repeat the line in purple for more users/boards :)

---

http://support.proboards.com/index.c...7333924&page=1
ProBoards® Support - Banning Member in ONE Forum Code


Another thing I came across was ' invisible mode '...software that effectively makes the offender invisible to other members...as if he was on everyone's ignore list...effectively the person could post but he'd be talking to himself...no one would see him or even know he's there.

Eg ;)

While I'm all for the first, they could have a heyday creating/posting useless and wastefull space on the forums. Go for the first!

While I'm all for the second, they could have a heyday creating/posting useless and wastefull space on the forums. Go for the first!

Hi Egaladeist

What you have suggested is a very good idea but I also have another idea of how to stop banned members from coming back although it may sound a bit crap. When I signed up with AOL I had to give them my full name, address, post code and bank details in order to set up a direct debit. As soon as I did that they got me online. Now what if members were only allowed to sign up with their ISP email address? That way, if they get banned and try to sign up again, a code could be implemented which recognises their email, can see that they are banned and therefore stop them from returning and creating yet more havoc?

It's just a thought.

Don't think it would work, paws...

First of all, some people might have dozens of email addresses or even more. I myself have my own domain name and can create a near-unlimited amount of email addresses for that domain, with a near-unlimited amount of aliases for them too. That would allow me to sign in an infinity number of times, although the mods could decide to just ban a whole domain instead of a single user.
I also have a GMail account which I prefer to use anyways. It has a good spamfilter and is pretty large and thus I prefer it. I also have an email account from my ISP but I barely ever use it anyways.

Requiring people to fill in name, address, postcode just requires you to rely on people to be honest about this information. People are not...

Requiring bank information will make people suspicious, though. Many will refuse out of fear that the information will be used to plunder their bank account. That is, if they even have a creditcard or bank account that this site would be able to validate.

And whatever other way you use to ban people will also be broken by those who just want to break the rules. All that additional security would do is make AO less attractive and less easy to use for the regular members.

The best way is just having users report any suspicious post, with moderators and administrators keeping track of IP numbers from those who abuse AO. If some ass seems to use the same IP number to hack AO, then his IP number could be banned for, say, three months or so. (If he uses the same IP number all the time.)

A fun way would be to use a cookie and set a flag in it. Won't work when they clean their cookies but as long as that cookie is set then the user will not be able to access AO. All you need are users who are required to accept cookies from AO. But again, this trick is easily bypassed. It's fun though since it's so simple... A user logs in and the AO site detects that he's banned. His cookie is set to 'banned' and the user won't be able to do anything. Even if the user logs out, AO would still know he's banned until he cleans the cookie. And then just hope he doesn't think about cleaning his cookies...
Of course, the server should also continue to remember which users are banned but it just helps a bit more to block them and doesn't have much impact for the normal users.

Well, there is also the fact that the above example code appears to be client side script which is trivial to defeat. Most anything you stick client side is going to be trivial to defeat.

Cookies will never work to solve the problem either. All you have to do is install a different browser and you get an entirely new cookie cache on the hd. Also it's incredibly simple to whip up a client side web proxy in languages like vb or perl in just a short amount of time that will allow you to edit your http requests/responses as you like.

Or you just run a bootable cd, use vmware, etc.

Doing it by ip address doesn't really work if you are trying to keep your services available to everyone. Some ISP's run everyone through a proxy/gateway, most companies do as well. You'd be allowing one knucklehead to do a denial of service for your website on an entire group of people.

The only way you're going to weed out the idiots is with a better authentication system that has decent fraud checking. It would probably cost more to implement something like that for this site than it's worth.

Not one... not two... but three search bars at the bottom of this page, big banners at the top, thread AP, other features that have sat to rot back when JP was in charge, and for some reason JupM added blue to all this yellow and purple.

How about focusing on running this site in the right direction. In doing this, all of these senior members would have less justifucation to come back and poke fun at the moderators and administration.

Hi Katja,

I agree with most of what you say. However, with AOL if people abuse the message boards and generally annoy and harass others, or impersonate them, they will have a COS (Conditions of Service) warning sent to their account. Now I think if you recieve up to three of these warnings AOL will close your account. So when you sign back up with them they will see from your personal details that that person was banned from AOL, thus stopping that person(s) from coming back online.

I know there is no way from stopping someone who is so determined to cause trouble from accessing the internet, it just seems a shame that there are those out there who want to spoil it for others. The internet is meant to be fun.......

Just require new account applications to be digitally signed. This is a security board after all... we should have have our digital certificates right?

Users lacking certs will only be granted access to the newbies forum.

cheers,

catch

Quote:

---

Originally posted here by catch
Just require new account applications to be digitally signed. This is a security board after all... we should have have our digital certificates right?

Users lacking certs will only be granted access to the newbies forum.

cheers,

catch

---

LMAO, thanks catch, I needed the chuckle. Ah, but were it only so simple...

What each of you has failed to acknowledge is that AO is a FREE site. The only real driving factor JupM has to keep the site running is REVENUE from advertisers. Yes, I am certain they have some philanthropic and neighborly attitudes and factors that make this a good site for them to own/run, but that don't pay the bandwidth bills. If this site in and of itself isn't necessarily profitable, then you can be certain they gain some intrinsic value to their line up of websites, by having AO on the list. Otherwise, this community would not continue for very long under their sponsorship. That's simply a fact of business.

ANY solution that has a reasonable chance for false positives would not be acceptable to them, I'm certain, nor would anything that seriously impacts the page load times or server load, unless it significantly offset increased costs with a direct increase in 'hits per day', which is their proverbial bottom-line.

I think that, like many problems, diligence, common sense, and fixing the holes that exist are going to be the most acceptable solutions. We can dream up all sorts of magic spells to "end" the "problem", but in reality, unless you have to fork out cash to get a login and even VIEW content (let alone POST), the people that create or exploit these issues will NOT go away, until they tire of this place.

I bet we see some changes in how you authenticate to make changes to your account, for sure. I would not hold your breathe for lots of code changes...this site is has enough complex code as it is, without adding per-page-load authorization queries being handled.

Quote:

---

LMAO, thanks catch, I needed the chuckle. Ah, but were it only so simple...

---

It is that simple, such a system doesn't need to be particularly secure, just a casual check to ensure that they are new... however I agree that there is no point in doing this because annoying users have no impact on revenue.

cheers,

catch

Quote:

---

Not one... not two... but three search bars at the bottom of this page, big banners at the top, thread AP, other features that have sat to rot back when JP was in charge, and for some reason JupM added blue to all this yellow and purple.

How about focusing on running this site in the right direction. In doing this, all of these senior members would have less justifucation to come back and poke fun at the moderators and administration.

---

And just think...

All this started pretty much after I was banned and blocked for saying that no one has leverage over me.

He's no where near the first person to do this ****. One upon a time someone named "Memory" and "Nemory" had a running splurge on AO and really got annoying. They were banned a lot, and just as sudden as it started, he stopped and now is a decent member of AO.

I can understand the first couple bans, he was bumping threads left and right. That problem is gone. Not sure why he got banned the last time for one post, I mean **** Katja started more **** in one day than he has the entire time he's been here. The only difference is he doesn't put everyone on ignore and doesn't have ****. He's a Lesbian too, don't you geeks just get hard as Assembler over that? ;)

Yup Gore, I remember the whole passwords issue in IRC and I always thought - once he/she :D became Nemory, things had lightened up a bit.

People let us not forget the "Community" that is a BBS. Some of the older members remember 300 - 1200k modems and BBS'.

There was always a character - Always One that was excepted. Perhaps c.r. is the accepted, pardoned one and spec is screwed.

Anyway, live and let live. I think that the pronounced AO dike is without original thought and void of any knowledge whatsoever; however, I just gave her +ap's for digging up memories.

I guess that makes me a hypocrite

The code @ ProBoards just makes that paticular forum not display for the "banned" member. The workhorse of the whole thing is:

Code:

---

javascript:document.getElementById('forum').style.display = 'none';

---

Just fix the display style (or do a quick change to your cookie string) through the address bar, and that member can see the forum again.


It should be mentioned that in a larger community preventing a single person from posting in a paticular forum open to the public is somewhat pointless (so the functionality isn't there, but you could do so through groups). But whatever floats their boat I guess. It does nothing to prevent them from actually posting there...just makes the uneducated poster not see a forum to post in...




In the end no amount of features will prevent it from happening. You just have to report it & let the mods sort it out...

Quote:

---

Originally posted here by catch
It is that simple, such a system doesn't need to be particularly secure, just a casual check to ensure that they are new... however I agree that there is no point in doing this because annoying users have no impact on revenue.

---

Trouble is any idiot can get a digital cert for a few $ saying they are just about anyone they like.

To get identity confirmed digital certs costs loads more and would preclude lots of members of this site.

Steve

Quote:

---

Originally posted here by catch
It is that simple, such a system doesn't need to be particularly secure, just a casual check to ensure that they are new... however I agree that there is no point in doing this because annoying users have no impact on revenue.

cheers,

catch

---

I agree the process of utilizing Digital IDs for registration is simple. It's the primary and preferred method of authentication inside my employers network for web resources, and it's simple and slick.

I'm commenting on the backend processes of having proper, approved, supported Digital IDs in use by everyone. What CA (or CA's) are trusted for this purpose. What type of certificates are allowed? Who supports certificate issues. What if a legitimate security pro comes from a company that uses an alternate method? Et cetera ad naseum.

Aesop's Fable Belling the Cat comes to mind.

Hi gore,

Quote:

---

He's no where near the first person to do this ****. One upon a time someone named "Memory" and "Nemory" had a running splurge on AO and really got annoying. They were banned a lot, and just as sudden as it started, he stopped and now is a decent member of AO.

I can understand the first couple bans, he was bumping threads left and right. That problem is gone. Not sure why he got banned the last time for one post, I mean **** Katja started more **** in one day than he has the entire time he's been here. The only difference is he doesn't put everyone on ignore and doesn't have ****. He's a Lesbian too, don't you geeks just get hard as Assembler over that?

---

As you well know the reason I supported getting rid of katja was because she was being more disruptive than the Spec ( in regards to her ability to get on people's nerves )...and I stood behind that stand right up till the end ( my poll which decided in her favor, only two senior members supported her staying of which one was you...which really surprised me...the rest of her support came from non-seniors )...I respected my own poll and dropped it...after the result proved there was no majority that wanted her out.

The Spec is another case entirely...he's a fixture here...he has caused more disruption than katja but it just doesn't seem like it because, like I said, he's a fixture...we accept that he's going to act like an a@@ and do stupid things like bumping threads or pretending to be someone he's not ( eg. katja's other profile )...
so...when he does do something it's not surprising...it's expected.

Eg ;)

Momma always said, stupid is as stupid does.

Quote:

---

Trouble is any idiot can get a digital cert for a few $ saying they are just about anyone they like.
To get identity confirmed digital certs costs loads more and would preclude lots of members of this site.

---

Reread what I said... the dig cert would just be used to allow registration beyond a few newbie forums. And if some user wants to throw money away so that they can be annoing and get themselves banned... well, at leas they have to pay for it.

Quote:

---

I agree the process of utilizing Digital IDs for registration is simple. It's the primary and preferred method of authentication inside my employers network for web resources, and it's simple and slick.
I'm commenting on the backend processes of having proper, approved, supported Digital IDs in use by everyone. What CA (or CA's) are trusted for this purpose. What type of certificates are allowed? Who supports certificate issues. What if a legitimate security pro comes from a company that uses an alternate method? Et cetera ad naseum.

---

You're over thinking the issue, it doesn't need to be secure... it merely needs to increase the effort required for someone to make multiple, non-matchable accounts.

It doesn't need to be a proper dig cert processing system... it could even accept personal/expired certs... but doing so would dramatically up the amount of effort required for someone just looking to troll.

Again though this isn't justified by the ROSI.

cheers,

catch