Anti-spam measures (updated 14/6/10)

[nedsram]

You will have noticed that, from time to time, these forums were being hit by spam. Whenever this happened, I deleted the offending "user" and all his posts, and banned his IP address. However, it appears that most if not all of these accounts were being created by "spam bots" that use OCR software to decipher the "captcha" - the picture of random numbers and letters they have to enter in order to register. They also use random IP addresses from a large pool, and generate large numbers of random usernames and email addresses that will only be used once to register on a particular forum, so blocking them by username, IP or email address is a blunt instrument that doesn't work.

As a result we have changed things so that new users have to be authenticated by an administrator - which in practice means me. We'd have preferred not to do this as it is time consuming and causes delays for new users. However from my point of view it's far less time consuming than trawling through user lists, deleting posts, fielding PMs about spam posts, and so on.

UPDATE (8/1/10). As we have had complaints that some people are unable to register as they can't decipher the "captcha", this has been disabled. Spam bots sadly find these easier to decipher than humans, which defeats the object of having them. However all registrations are thoroughly vetted before being approved, and 90% of registration attempts are being rejected as these are generated by bots or known spammers.

UPDATE (23/2/10). Ringmaster has now put in place an add-on which requires new users to answer a simple question that all local people would know the answer to, but spam bots wouldn't. Since he did that I haven't had a single registration request from a spam bot - whereas before I was having to deal with up to 50 a day. We'll review the situation, and if we don't have any rogue registration requests for an extended period, we may consider allowing automatic account activation again.

UPDATE (26/3/10). Please allow up to two days from registering before receiving an activation email. Normally it will take much less time than this, depending on what access I have to my email. (I can't access it at work, or I may be on holiday with no Internet access, for example.) Multiple registration attempts won't speed things up!

UPDATE (14/6/10). As there have been no fake registrations by spam bots since the additional question was added, and because of the delays some people faced while I was on holiday recently, for a trial period we have decided to allow users to activate their own accounts. This will be reviewed at regular intervals.