Figured it was time to start a new topic, since it’s getting worse and worse.
Helicopterbrah was today’s guest. Romo took out 8 or 9 hits, I got 5.
Edit: Known Alts - Please Add
thomas7669
ThomasReturns
tommy7669
Helicopterbrah
tdawg1989
thirdtierlawls
Tdawg7669
Gavin
Ilikebigbutts
ColumbianFever
JoeDona
Is there a reason not to keep registrations closed for a bit?
I see no reason not to do so.
I’d even volunteer to go through pending registrations by hand for the next couple of days, if it would help.
(Although actually, I don’t think I have the power to approve new posters. Ugh.)
Oh, also: I mentioned this in the f7 outing thread and there seemed to be widespread consensus. Can we start a list of disallowed (or maybe allowed would be easier) email servers? If we can eliminate yahoo and a bunch of temporary junk email sites I think that would go a long way toward tamping down on alts. Hell even just allowing only .edu and gmail names would do it (since I think gmail sets a limit… someone correct me if I’m wrong).
Going to reiterate my proposal for placing a limit on the number of images posters/IP addresses can post in a given length of time (5 posts with an image in it, with a maximum of 20 images total, per hour). No idea if this is possible, but it’d be nice if implemented.
Are the recent alts from throwaway email addresses? The power to view email addresses is a power that I would really like to be given to the regular mods. I suspect it’s separable since I had it a long time ago, then lost it at some point.
All of the above. Would love to get rid of the burner email servers, would love to be able to see that info.
(Also reiterating what Chem & I have noted in the past: non-trads won’t have .edu addys; just something to keep in mind as we move forward. 
)
Also, fatduck brought up a good point in the backseat thread:
We absolutely need a limit on failed login attempts. I don’t know that bruss or whoever has thought of this yet, but if someone uses some brute force program to crack an admin or moderator’s password, we are absolutely fucked.
I had to look up what scat was, and I still can’t believe it. I think leaving registrations closed is a good idea util I can try and implement a solution on the server. I plan to try and implement a quick, temporary solution tonight. Any information you can provide would be helpful such as some guilty usernames so I can examine the IPs and emails of their accounts.
thomas7669
ThomasReturns
tommy7669
Helicopterbrah
It’s possible that this guy is a banned poster called Bruss, but it’s also possible it’s someone else entirely.
I’m about to go through the E-mail regs for those accounts and see what I can discern.
Either this guy is really trying to frame someone named Thomas, or he’s one of the stupidest attackers I’ve ever seen.
He’s used E-mails from Gmail and a *.edu E-mail from his college. ( 
) All of them contain variations of the same real name.
If we wanted to go nuclear, we have options. However, we obviously would need an admin-level consensus before taking this to Real Life.
Also, he has another account (Tdawg7669, I’m sensing a theme here) which was banned in 2011 for trolling. Same MO.
Some of the other accounts (Gavin, Ilikebigbutts) are using other E-mail addresses, though.
The IP range he’s using appears legit, but unfortunately it’s dynamic (you can be assigned random IPs by your ISP) and such a wide range that nuking it would have huge negative effects. We’d effectively be nuking an entire ISP, one which a number of users (including Ken, Corsair, and Grant) have used.
UVA lets you spoof email addresses with whatever name you want, so it doesn’t necessarily have to be some guy called Thomas, but this is good to hear.
Next time we get a scat attack, we should move some of it here, if possible. If we have to go there, it’d be good to have some sort of evidence.
Another note: It looks like he first started with his legit Thomas E-mail addresses, used another one with a different first name (Linda? Maybe borrowing his mom’s or sister’s account?), and then from there went to using random @yahoo.com addresses.
The last 3 users to register with @yahoo.com addresses were Thomas accounts. I propose temporarily nuking Yahoo.
Yes, but into its own thread. I want to be able to use this one without vomiting.
I actually did move a thread in here yesterday (Gavin had started one JUST for the purpose…) but it was deleted.
Just trying to get a complete list of all his accounts so far in one place. These were previously banned, but I’m going to edit the first post and start putting in all the known usernames. If you know one you don’t see, please add it.
ETA:
I did identify a large range of IPs assigned to a hosting company apparently known for hosting proxy/attack/spam accounts. (Details of it here if you care.) Taking out that whole range looks like it’ll only affect two active posters, and I suspect they’re proxying anyway.
Scatface used this IP range to register at least one account, so I just nuked the ranges. Ranges nuked:
184.82..
64.191..
I looked into things and it seems pretty clear this is a person and not a bot and it is difficult to stop a determined person without impacting legitimate users. For example, if you ban yahoo emails they go to gmail. I have a quick solution to try tomorrow which prevents new users from posting images. I am thinking the criteria would be if registered less than 7 days or having made less then 25 posts then users can not post images. I plan to implement it tomorrow morning so I can monitor things. For tonight I put up a more informative message about registrations being temporarily disabled.
I’m also working on a system where any mod can enable and disable registrations so no mod ever has to be a sitting helpless when something really disruptive is taking place. I anticipate that being done tomorrow some time.
I am also brainstorming on a one-click link that mods can see next to every post of every fairly new user that can trigger some real aggressive things without impacting users who have a decent amount of history. For example, clicking the special link next to a post could trigger a number of things such as:
I’m thinking it may also be helpful to build a special page for the mods that shows the most recent posts by relatively new users since the majority of trouble is from new registrations. That combined with the one-click tool could be pretty helpful.
I looked into failed login attempts and there doesn’t appear to be any automated attempts (i.e. 15 failed attempts was the max and that was probably just a frustrated person). I believe there is some captcha thing that comes up after a certain number of failed attempts, but I don’t think there is a hard limit if someone could automate the captcha. I’ll plan to code a hard limit on failed login attempts just to be safe.
In summary, I’ve got something quick to try tomorrow with the images and also plan to have enable/disable registrations available to all mods tomorrow too. I’m also working on some solutions for the future.
Thanks for taking a look Grant. I like all those ideas as helpful solutions since having more than one tool is definitely what we need.
How about something like a button that temporarily breaks image embedding until it’s shut off? My thought would be like having a word filter that filters {IMG}{/IMG} temporarily until we turn it off (without having to dig all the way into the ACP to do it). Or maybe simply just stops IMG from even working at all. Not sure if something like that is possible.