Older blog entries for robogato (starting at number 2)

Advogato Status Report

A new rev of mod_virgule code went live on Advogato today. There were only minor changes and bugfixes. See the changelog for details.

Most of the code changes this week were aimed at getting a clean compile on gcc 4, Apache 2.2, and the newest version of the Apache APR libs. Here and there mod_virgule still relies on some of the deprecated Apache 1.3 compatibility code that's being dropped from the newest Apache libs. There's still more work to do here but it's getting close.

The rate of Advogato spammer account deletion has slowed to a trickle. Most of the easy to spot spammers are gone. I did run across a few today, however: Pramod, nulledphpscritps, Phat, JohnH, bekka, Zorro and a few more if you follow the inbound certs on those.

The removal of all those accounts has had two side effects. One is that thousands of certifications issued by the spammer acounts have also been removed. That seems to have contributed to shorter run times for trust metric computations. The other side effect is that search engine robots are hitting a lot of account pages that no longer exist. Mod_virgule didn't handle this quite the way it should. It displayed an error page saying the account wasn't there but it returned a result code of 200. So the search engines continue indexing the bad URL and continue hitting it every couple of days looking for updates. I've tweaked this so mod_virgule now returns a 404 when displaying the person not found error page. This should cause the search engine robots to eventually stop trying to hit all those dead accounts.

View This Profile Here

Advogato Status Report

It's been a little over a week since Advogato transitioned to new hardware and a new codebase. Overall the transition went pretty well considering the differences in the code. Minor bugfixes are ongoing. Please excuse the mess during the transition period!

In case you haven't noticed, the much requested password reminder feature is working and has already been used several times. Maybe that means we'll be seeing some long lost friends posting again?

Bandwidth and DoS issues seem to be coming under control. One strange problem now solved was a Microsoft proxy server that was hitting a single Advogato diary 5 times per second. Most likely just a misconfigured RSS program of some kind. Once the source of the problem was identified, an email to their NOC took care of it. The new, paged person index also seems to have reduced bandwidth usage somewhat.

Spam, spam, spam. It's still with us but there's light at the end of the tunnel.

To reduce the attraction of Advogato to spammers, blog entries posted by untrusted users now have nofollow attributes included in all links. Further, links posted by untrusted users in their account profile pages are supressed altogether. A note has been added to the new accounts page so potential spammers know their links are going to be worthless in search engines.

Two active groups of spammers have been identified so far. One was an SEO firm in New Delhi, India. They were using their own IP addresses to connect, so adding a few addresses to iptables has taken care of them (at least for the moment). The second group connects from random IPs in China and Korea. It will take a group effort to discourage them - how, you may ask?

By using Advogato's new spam rating system. It's based on a suggestion by lkcl and also on the system used over at craigslist. If you see a post in the recent log that looks like spam, click to that user's profile page. If you're certified as apprentice or higher, you'll see two new things at the top of the page: a spam score and a "flag this account as spam" link. Click the link and you'll add to the account's spam score. If you're an apprentice, you'll add one point to their spam score. A Journeyer adds two points. A master adds three points. When an account's spam score reaches a preset threshold (currently set at 10 points), the account is automatically deleted. This system only applies to untrusted, observer accounts, of course. If a user is certified by a trusted user, it's assumed they aren't spammers. There are several spammers currently listed in the recentlog, so let's give it a try.