Options for banning users


InstantForum Suggestion
I know you have the BAN IP and delete member options, however, those don't work in the modern world. IPs change and are shared. If I ban IPs, I'll be locking out an unknown number of members from different parts of the world that share an IP. This doesn't make sense, and it's too heavy handed.

Likewise deleting a member means they can re-register wiith that email. Equally problematic in the age of scripts. We have spammers that register and then post 30-100 messages inside of 30 minutes. By the time the SPAM tool catches up, users have been notified of many issues.

It also seems that we ought to perhaps have some delay in notifications that allow a member to be marked as banned or posts as SPAM before they are sent.

What I'd like is an "IsBanned" flag on the member, which does a few things.
a) can't post new items
b) existing posts are marked as hidden
c) notifications from this user are not sent to others. (post, PMs)



Steve Jones

www.sqlservercentral.com
InstantForum Suggestion

way0utwest - Tuesday, May 22, 2018 4:38 PM
I know you have the BAN IP and delete member options, however, those don't work in the modern world. IPs change and are shared. If I ban IPs, I'll be locking out an unknown number of members from different parts of the world that share an IP. This doesn't make sense, and it's too heavy handed.

Likewise deleting a member means they can re-register wiith that email. Equally problematic in the age of scripts. We have spammers that register and then post 30-100 messages inside of 30 minutes. By the time the SPAM tool catches up, users have been notified of many issues.

It also seems that we ought to perhaps have some delay in notifications that allow a member to be marked as banned or posts as SPAM before they are sent.

What I'd like is an "IsBanned" flag on the member, which does a few things.
a) can't post new items
b) existing posts are marked as hidden
c) notifications from this user are not sent to others. (post, PMs)


Hi Steve,

Thank you so much for your suggestions and post. I hope your well. 

I think we already have what you are looking for however this works in a slightly different way.

We have a "Banned Members" member group which is created when you install a fresh installation of InstantForum. If you edit the "Banned Members" member group via the Admin CP > Members > Member Groups page you should see a "Show Member Group" option. If you disable this option (so hide the member group) and then place users into this member group (as their primary member group by editing the user via the Admin CP > Manage Members page) those users will no longer appear (within member list, whos on) and posts from those users will no longer appear within any forum or topic. 

In addition I would suggest editing the "Banned Members" permission set (which is by default linked to the Banned Members member group) and disabling all posting options within the Banned Members permission set. This will ensure once you place a user into the Banned Members member group they can no longer post new topics, replies, private messages etc. 

I completely agree that banning a specific IP address can be a bit heavy handed. We do offer an alternative approach if you are able to enable our built-in StopForumSpam.com integration offered within InstantForum. SFS.com offer a central database of known spammers. Like InstantForum other popular forum platforms contribute to the SFS.com database so often spammers can be detected as they attempt to create an InstantForum account. 

With the SFS.com integration enabled you can set thresholds for the users IP address, email address or username and InstantForum will obey these thresholds when checking user details against the SFS.com database. This can be helpful to prevent false positives as you can ensure that the user will only be flagged as SPAM if there IP address appears more than say 10 times within the SFS.com database. Of course this can also cause false positives - for example if you set a username threshold of say 1 and a new user creates an account within InstantForum with the username "Bob" it's likely a spammer has used this username before and it appears more than 1 time within the SFS.com database. 

With the SFS.com integration enabled when users post new topics or replies InstantForum will check the users email address, IP address and username against the SFS.com database. If the IP, email or username appear more times than the set thresholds the post will be automatically queued (will require approval) and an additional email notification will be sent to any assigned forum moderators informing them of a detected SPAM post. 

Enabling the SFS.com integration is also very helpful to prevent spammers from creating new accounts within your forum. With the SFS.com integration enabled again when a user registers InstantForum will check the email, username and IP used for registration against the SFS.com database. Again if any of these appear more than the specified thresholds set within InstantForum these accounts can be handled differently depending on the "Spam Registration Action" setting upon the InstantForum Admin CP > Settings > Forum Settings page. 

If you choose to enable SFS.com integration to prevent false positives for existing trusted users you can also choose to skip all SFS.com checks when users post new topics or replies if the user meets an existing reputation level within InstantForum. You can set this reputation level within the StopForumSpam.com settings on the Admin CP > Settings > Forum Settings page. 

Also Steve please take a look at the "Reputation Threshold" settings again on the Settings > Forum Settings page. Using reputation thresholds you can disable features like private messaging until the user reaches a certain trusted reputation level within your community. You can also set if a user can follow other users or if they are able to vote and a few other things. Preventing users from voting or liking topics until they reach a certain reputation level can to helpful to prevent users from trying to artificially inflate there reputation early on. 

We appreicate the pain spammers can cause Steve. We've added several features over the last few releasers to help prevent spam. We appreicate spammers are constantly evolving and of course we will continue to innovate and introduce new ways to ensure your InstantForum community remains a positive place to moderate and participate. 

I've gone ahead and added your suggestions into our GitHub issues and we'll certainly review these during our next sprint. Thank you again Steve. I sincerely appreciate others helping us make InstantForum better. Please don't hesitate to post any further suggestions or questions.

http://www.instantasp.co.uk/images/line.gif
Kindest Regards,

Ryan Healey



ryan@instantasp.co.uk
www.instantasp.co.uk
Blog | Community | Docs

http://www.instantasp.co.uk/core/assets/images/email/facebook.png http://www.instantasp.co.uk/core/assets/images/email/twitter.png http://www.instantasp.co.uk/core/assets/images/email/google.png http://www.instantasp.co.uk/core/assets/images/email/linkedin.png

Thanks, Ryan.

We do use SPAM integration, and I appreciate the Banned Members features. What I'd say is that at any scale, the "move to banned members" doesn't help. We often see spammers posting 3-4 posts a minute, which means they acquire reputation and can't easily/quickly be flagged by the spam integration. The larger issue is that the notification process kicks off then and essentially lets the spammer reach many people.

We can code around this, but then we can't take ugprades of your code. That's another whole problem.

Hence why I suggested you build a few features in the system that account for not users posting, but scripts and bots that post in a pattern and scale that humans can't match.



Steve Jones

www.sqlservercentral.com

Hi Steve, 

Thank you so much.

I realized you had enabled the StopForumSpam.com integration after reading your other topic - apologies for that.  I've posted a few ideas within your other topic

I look forward to hearing from you :)

http://www.instantasp.co.uk/images/line.gif
Kindest Regards,

Ryan Healey



ryan@instantasp.co.uk
www.instantasp.co.uk
Blog | Community | Docs

http://www.instantasp.co.uk/core/assets/images/email/facebook.png http://www.instantasp.co.uk/core/assets/images/email/twitter.png http://www.instantasp.co.uk/core/assets/images/email/google.png http://www.instantasp.co.uk/core/assets/images/email/linkedin.png

Thanks, I do think that there could be work that bans members in a more subtle way. Perhaps a way that allows them to post, but auto hides all new/edited posts. This isn't just a SPAM issue, but also sometimes a disruptive member that re-registers with a new name/email and continues to berate or inappropriately post. One forum I used years ago did this. We could certainly deactivate a member, but we also could mark them as "banned", though "disruptive" or "silence" might be better verbiage. This allowed the user to continue to post and vent, but hid their posts. We could still reveal valid ones, but this helped to dampen and limit arguments gone south.




Steve Jones

www.sqlservercentral.com
GO

Login
Existing Account
Email Address:


Password:


Social Logins

Select a Forum....







InstantASP Forums


Search