Re: [Phpwiki-talk] Wiki spam and the future of phpwiki

[Dan F. <dfr...@cs...>]

Philip J. Hollenback wrote:

>I've been running phpwiki for several years on my site
>http://www.hollenback.net.  I started with the 1.2 phpwiki and have
>upgraded several times.  Currently I'm running a cvs version from some
>time after the 1.3.10 release.
>
>I've always been a big supporter of phpwiki and have always appreciated
>the work everyone has put in to it.  But now, I'm at a crossroads: I'm
>pretty seriously considering migrating my whole site (600+ pages) to
>PmWiki.  Here's why:
>
>1. The phpwiki development model is broken.  Particularly over the last
>year, I have seen a tremendous amount of new, potentially cool features
>added to phpwiki.  However, many of these features are broken in various
>ways, and some just don't work at all.  Based on my use of phpwiki, the
>buginess of the code base has increased significantly.  To phpwiki's
>credit, I've never really seen a data corruption bug.  Instead, most of
>the problems I see are things like plugins that don't work with certain
>themes, random odd error messages on pages, etc.
>
>I think new features are fantastic.  However, the lack of a stable
>phpwiki release is really, really hurting phpwiki.  I know that a 1.3.11
>release is very close and that is a good step in the right direction. 
>However, the problem of all these new, not very well tested features
>will remain.
>  
>

I agree with all of this.

Stability, fully functional, easy to use, well-documented features are 
very important, more important than most new features. It is a lot of 
work to take a feature from "a good first shot" to easy to use and 
obviously great.

Releasing more often is probably also important.

Finally, I believe this goal would be aided if there were much less code 
to maintain. For example, support only one backend. I see so much work 
going into different database ports, needlessly. I vote for MySQL, since 
that is what I am using. However, I might even go with a CVS backend 
(*shudder*) if that were the community's will, as long as it supported 
query-able relationships between 2 things (exactly like backlinks, or 
we've expanded also to ratings, categories, and in the future perhaps 
list items), and multiple instances from the same code base (currently 
with multiple MySQL DBs).

>2. Wiki spam is a major problem.  I finally had to turn off editing of
>my site last week.  The reason: large amounts of wiki spam.  For the
>last year, I've been getting perhaps one or two spam attacks a week on
>my site.  I managed that by removing or reverting pages manually, not a
>big deal.
>
>However, last week someone created 500 spam pages on my site.  I was
>able to remove them via the admin interface, but it was a very slow
>process.  Clearly manually removing pages is not an effective answer for
>that level of wiki spam.
>
>I realize that the spam problem is not unique to phpwiki.  However, I'm
>not seeing anything being done to address it.  For example, ip address
>blocking is not implemented in the phpwiki version I am running. 
>Obviously that's not a particularly effective way to deal with spam, but
>it is a start.  What about blacklists such as the ones from chongqed.org
>or Movable Type?  Captchas?  Typekey?  I'm guessing that if I'm having
>these problems, lots of other people are too.  What is being done in
>phpwiki to deal with the spam problem?
>  
>

To be fair, Reini put in two things, and I believe they are in RC1 
(aiming at 1.3.11 if all goes well):

1. Don't allow saving a page that has more than 20 external ("http://") 
links. In our code, I modified "20" to be a configurable parameter 
SPAM_MAX_EXTERNAL_LINKS. We've been completely spammed as well, and I 
believe this will help us a lot. We have a wiki where each legitimate 
page only contains a few external links, but spam pages contain tons 
(>50 for sure) external links.

2. Hook up with babyspam, which is a hookup to Spam Assassin. In other 
words, an evolving tool for detecting spam.

Might not be a bad idea to also have IP filtering, but this can also be 
done at the .htaccess file in your dir .. IF your Apache allows overrides.

>I'm not writing this to bash on phpwiki.
>

I think you do a service to state the things you really need.

Dan