BuddyPress.org

@r-a-y i have a tough time understanding it myself! just crazy tinkering I guess, there is probably a simple solution….

I think you’re right about super admin.

I’m talking more about other members, who have posted on other network blogs. If you look at my profile sidebar, you’ll see “my videos” and “my posts” links. Each should take you to the author template page for those members on the corresponding blogs.

My Videos ==> site.com/author/ray
My Posts ==> site2.com/author/ray

get_blogs_of_user method works to display only the sites members have posted on sitewide – it will however show primary site of a member regardless of posts.

get_blog_details method forces all member profiles to display the links regardless of having posts or not. It will just link to the author page with “no posts for this author’ message as part of the author.php template.

the issue i’m having with get_blogs_of user, I have users who make one time posts by way of a frontend form. They own that post but they don’t have a role on the blog. I think that is the reason why on some users, the links don’t display even if they do have posts.

both methods are useful depending on how you want to use them.

i’d like to be able to use the get_blog_details method because it lets me define what links to display. and the issue i have with that is that the links are always present, I’d like for them to only show up if the user has posts.

make less sense now! hehe, anyway it is a very specific feature, some people may like to do something like this.

PART 2 – DEFEATING SPAMMERS

In the last post I covered why and how spammers attack BP installations. This post will cover how I propose to counter them.

Fast Attacks -vs- Slow Attacks

There are two basic kinds of spam attacks that get run on social networks: “fast” or “flood” attacks, and “slow” attacks.

In a fast attack, the spammer signs up for an account on the site, then sends thousands of messages as quickly as possible.

Obviously, the site admin will be deluged with complaints about the spam user and quickly delete their account …but in the hours (or days) it takes the admin to respond, hundreds and hundreds of people will read the spam messages. Then the spammer signs up for another account, and repeats the process.

In a “slow” attack, the spammer signs up for *hundreds* of accounts on the system, often over a period of many months, and only sends out spam messages one at a time …often days, weeks, or months apart.

“Slow” attacks are very difficult to counter using automation …at least without annoying legitimate users.

The best way people have come up with so far is just a “report spam” button which, when clicked, reports the member to an admin so they can investigate it and if necessary delete the account. This will be implemented as part of @francescolaffi ‘s BP content moderation plugin in a couple of months.

Unfortunately, a “report spam” button doesn’t work well against “fast” attacks.

This is because:

a) There is a delay while the admin responds to manually submitted spam reports, or,
b) When a consensus scheme is used (if X users report a member their account gets suspended), there is a delay while enough votes are accumulated to flag the member as a spammer.

During that time, people are reading the spam messages and the spammer is winning.

Goals of Proposed BP Core Anti-Spam Mods

The goal of the proposed core modifications is to counter “fast” attacks by the following means:

1) To make it difficult for a spammer to create large numbers of member accounts using automated means.

2) To make it difficult for a spammer that already has a member account to use automated means to:
a) send large volumes of PM’s
b) send large numbers of friend requests
c) create large numbers of groups
d) create large numbers of group posts
e) post large numbers of comments
f) post large numbers of status updates

3) To accomplish 1) and 2) without being annoying to legitimate users.

4) To make the system configurable, so it can be adapted to the needs of the site …for example: visually impaired users, or display on mobile phones.

5) To make the system “on by default” and “secure by default”

How We Can Accomplish This

1) New User Sign-up

a) Add a captcha on the new account sign-up screen.
b) If the “user” gets the captcha wrong on the first try, require *TWO* captchas to be solved before they can proceed. (If the odds of a bot solving ONE captcha with OCR are 1 in 100, the odds of the bot solving TWO captchas with OCR are 1 in 10,000. This is a technique Gmail uses.)

…set X to be a random number on each installation between 3 and 7…

c) If the user gets X captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours). (This is what Craigslist does)
d) If the user fails X captchas *again* after being blocked, permanently ban their IP and post it to akismet.
e) If a locally banned IP tries to sign-up, don’t throw an “error page”. Completely ignore the request and don’t send anything.
f) If an akismet banned IP tries to sign up, require *TWO* captchas to be solved on the first try, and if they get X captchas wrong in a row, permanently ban their IP and repost it to akismet.
g) Add an option field to the admin menu that limits the number of accounts that can be created per IP address. By default, set it at 2.

2) Existing User Sign-In

a) Use a “normal” password box on first sign-in attempt.
b) If the member gets their password wrong on the first try, require them to solve a captcha on the second try. Offer password recovery option.
c) If the member gets their password wrong on the second try, require *TWO* captchas to be solved before they can proceed. Offer password recovery option.

…set X to be a random number on each installation between 3 and 7…

d) If the user gets X logins / captchas wrong in a row, block the visitor’s IP for a random amount of time (15 minutes to 2 hours).

3) Private Messages

a) Add a field to the user table that allows PM limiting to be bypassed or set to a unique value on a user-per-user basis.
b) Add three option fields on the admin menu: allow “X” messages to be sent every 24 hours, averaged over the past “Y” hours with “Z” hysteresis
…when BP is installed, randomly set X, Y, and Z to allow a daily maximum of between 18 and 24 messages, averaged over between 2 and 24 hours, +/- 3 messages.
c) If the maximum is exceeded, require the member to solve a captcha before they can send another PM.
d) If they get the first captcha wrong, require them to solve two captchas before they can send another PM.

…set R to be a random number on each installation between 3 and 7…

e) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours). (This is what Craigslist does)
f) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
g) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

Consider how difficult the algorithm above makes it to send automated messages. A spammer can’t just send “12 messages a day” or “1 message an hour” and avoid triggering the system. Every BP installation will have a unique combination that will cause it to trip. Yet for a “normal” user, the system will hardly ever trip, and if it does, it takes all of 5 seconds to enter a captcha and continue. And the system can be bypassed entirely for edge cases, like paid advertisers or site news.

3) Friend Requests

a) Create a config option in BuddyPress that allows the admin to remove the member’s directory with one click. Disable the member directory by “default” on new installs. In my experience, the only people that use the member’s directory (in its default state, on a socially oriented site) are Spammers, Marketers, and Competitors. There’s a reason Facebook, MySpace, LinkedIn, and Twitter do not have “global” member directories.
b) Implement same scheme as private messages.

4) Group Creation

a) Add a field to the user table that allows Group limiting to be bypassed or set to a unique value on a user-per-user basis.
b) Add an option field on the admin menu that sets a maximum number of groups that can be created by a user. By default, set it at 5.

5) Group Posts

a) Add a field to the user table that allows group post limiting to be bypassed or set to a unique value on a user-per-user basis.
b) Create a “whitelist” field on the admin page that allows “trusted” media sharing URL’s like YouTube, Revver, Flickr, etc to be bypassed in spam protection.
c) Create an option that automatically “scrubs” URL’s and email addresses from group posts if they are not on the whitelist. Not just “nofollow” …complete removal. This will stop 90% of abuse dead in its tracks, because most spammers are just trying to get traffic to a site or replies to an email.
d) If the system detects a URL or email address embedded in a message, and it’s not on the whitelist, require a captcha to be solved before allowing the post.
e) If they get the first captcha wrong, require them to solve two captchas before approving the post.

…set R to be a random number on each installation between 3 and 7…

f) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours).
g) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
h) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

i) For posts that do not contain a URL or email address, run the post through akismet. If it passes, approve the post. If it fails, require a captcha to be solved before allowing the post.
j) If they get the first captcha wrong, require them to solve two captchas before approving the post.
k) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours).
l) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
m) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

6) Comments

a) Create an admin option that only allows users to comment on their *friend’s* items. Activate it by default on new BP installations.

7) Status Updates

a) Add a field to the user table that allows status update limiting to be bypassed or set to a unique value on a user-per-user basis.
b) Create a “whitelist” field on the admin page that allows “trusted” media sharing URL’s like YouTube, Revver, Flickr, etc to be bypassed in spam protection.
c) Create an option that automatically “scrubs” URL’s and email addresses from status updates if they are not on the whitelist. Not just “nofollow” …complete removal. This will stop 90% of abuse dead in its tracks, because most spammers are just trying to get traffic to a site or replies to an email.
d) If the system detects a URL or email address embedded in a message, and it’s not on the whitelist, require a captcha to be solved before allowing the activity stream post.
e) If they get the first captcha wrong, require them to solve two captchas before approving the activity stream post.

…set R to be a random number on each installation between 3 and 7…

f) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours).
g) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
h) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

i) For activity stream posts that do not contain a URL or email address, run the post through akismet. If it passes, approve the post. If it fails, require a captcha to be solved before allowing the post.
j) If they get the first captcha wrong, require them to solve two captchas before approving the post.
k) If the user gets R captchas wrong in a row, block their IP for a random amount of time (15 minutes to 2 hours).
l) If the user fails R captchas *again* after being blocked, permanently ban their IP and post it to akismet.
m) If a locally banned IP tries to visit the site, don’t throw an “error page”. Completely ignore the request and don’t send anything.

8 ) In All Cases

a) When a member account is banned, or repeatedly triggers spam protection measures, send an alert to the site administrator.
b) Allow admin alerts to be disabled if necessary, example: DDOS attack against the site.

9) CONCLUSION

While the list of modifications above may look incredibly complicated, really, it’s not.

I’d say “worst case” it’s about a week of work to research and make these modifications. Then we can push it out into beta testing with all the other new code to give it a proper shakedown.

I’m sure there are plenty of ways the algorithms above could be improved, so please go ahead and post your feedback!

Thanks!

^F^

@r-a-y is similar because it seems that all links take me to the main blog author template which is cool. but I’d like to keep things as is and be selective with what links i send to the author page so instead, from my profile home, add ‘quicklinks’ to the various subblogs i’ve authored on not only the main blog.

I was able to link to the individual blogs users are admin on, by using bp_has_blogs(‘user_id=’ . $bp->displayed_user->id == $bp->loggedin_user->id) but i guess that only works for being an admin of a blog. what if user has contributed to another blog on the system, how to link over to the author posts template for that user, is the thing

r-a-y, i started with that 2 months ago. Honestly, I’m frustrated. It seems like I can’t even throw money at this issue. I have an elance job post and the folks who’ve replied can’t do what I’m asking…I’ve posted that I’m willing to pay for this answer here at BuddyPress.org…and no one has responded…and buddypress.org has the forum categories working here…and to date has not shared the procedure and code that could allow users to do the same.

I’ve been trying to release a basic install of BuddyPress that works like BuddyPress.org for one year. I have 19 years experience as a technical writer (albeit off and on), and I’ve offered to help BuddyPress with documentation in exchange for assistance. I’ve offered to make videos, and yes, I’ve posted in more than one thread. I’m a proficient “hack,” so to speak, and am happy to mess with code, however, I’m not a programmer and I just don’t understand the back end of BuddyPress the way you do…

..can you expain why you haven’t shared the code? Or rather, can you just share the code? I mean, asking me not to bump several posts…after months of my effort in trying to do something most likely so simple that it’s just figuring out a file path and the right file in which to call a particular function…which is really hard for me to figure out…but most likely you and several readers of this post

know how to do and are just not sharing

…is just frustrating…

can you relate?

I mean, I’ve been at this for a year and what I’ve wanted is:

1) a BuddyPress install that works like BuddyPress.org, which means:

1.1) the forum works the way the BuddyPress.org forum works

1.2) the look and feel is consistent for the main and user blogs

So, maybe I’m wrong, maybe this isn’t easy for you…maybe you don’t have access to the code…or there is something else going on…but geeze can you relate at all to how frustrating it is to be sitting here, and, my assumption (which could be wrong) is that all you’d need to do is share a few PHP files and some quick instructions, and I’d be off and running…

…and a few other folks have gotten in touch with me with a) willingness to split the costs of figuring this out b) asking me to get in touch with them when and if I do wind up receiving an answer.

…so those folks might be shy about coming out with their desires, because they don’t want to be treated harshly.

…and frankly, how am I supposed to feel with you posting

“Use the bbPress admin backend to create your forum categories.

/yourdomain.com/your-bbpress-install/bb-admin/”

…yeah…ha ha…like I wasn’t back there 2 months ago…you know…it’s hard not to get sarcastic and just say “thanks for not helping” you know?

…honestly, how do you expect me to take your reply?

I mean, are you guys going to share the code and procedure for creating what could be called “Main themes” “Forum Categories” or “Sub Boards”

and not just creating them in the backend, because that is really easy…

…are you going to share the code and procedure for creating and displaying them or not?

It’s hard for me not to be upset about this issue…because it’s been so incredibly long…and I just feel like the developers, for whom this is likely a super easy issue, are really just “code hogging,” which frankly, I find simply mean. Especially when I’ve sincerely offered to create documentation in exchange for help…and I’m a documentation professional…so I’m not talking about slacker beginner docs.

So really, can you give me a straight up yes or no? Cuz this issue is really tiring, and I don’t feel like beating a dead horse anymore…

…if you won’t reveal the procedure and code, please explain why.

…if you won’t reveal the procedure and code, please help me figure out where i can get the answers to these issues either at a developer forum or in a paid coding community… i mean, is wpmu dev the right place where people would share both code and a procedure so that folks can move forward instead of going round and round in circles?

It would really help if you could clear these issues up, cuz it’s also tiring for me to continue expecting to receive help (in a positive environment), and well, I just might be wrong about my expectations for help and I might be wrong about what this forum offers.

I just figured you’d be willing to share the code and a procedure.

…ok…enough circling around the same issue…it’s clear what I need, what I want to do, what I’ve offered repeatedly to get it…so I’ll look forward to any replies this post receives and any assistance I can get in displaying forum categories.

Hi Andrea,

Thanks for stickin with my questions here

I do understand that single wordpress only has one blog. What I don’t understand is how to display that one blog to users.

on my buddypress (single wordpress) install I have the homepage showing the activity feed rather than the it showing the latest wordpress post. When I have this the blog seems to disappear entirely.

Can you tell me how I would create a tab (called blog) that would show all the blog posts instead of showing just a page I titled blog. I am a little lost on how to get the single blog showing up for users to easily find in the navigation.

I hope I made sense. Thanks Andrea.

BTW – Love your blog on WPMU – you have a lot of great tutorials and info. Great stuff.