Slashdot Mirror
How To Keep a Web Site Local?
Cornwallis writes "The universal accessibility of the Internet is one of its attractions. But what do you do when you don't want your board to be Slashdotted? Back in the day it was great to run a local BBS where friends and neighbors could dial in using their 9600-baud modems to pick up mail or share games or stories. Now, my Web-based board gets slammed by people from all over the world who have no reason to access it, can't possibly take advantage of the locally focused services it offers, and generally take up my time because I have to block their accounts or explain to them why they can't have access. This despite the fact that the board explains quite clearly that it is for local use only and couldn't possibly be of interest to them. Other than putting thousands of entries in my hosts file to block IP ranges, what options do I have to restrict access to locals only? Or isn't that feasible?"
order allow,deny
.
deny from all
allow from iprange
allow from iprange
allow from iprange
etc. etc.
There are websites all over the internet that allow you to do country-by-IP-range lookups.
You could also do;
ErrorDocument 403 "Sorry, this website is only available to people living in
(Yes, no final quotation mark).
Or don't worry, what does it hurt if people who aren't benefiting from a website visit it?
...I doubt Slashdot can make a good assessment without taking a look at the site. Mind posting the URL?
Get some paper, pin it up around the neighbourhood with a private key. Ensure that people can't create an account or access the boards without the private key.
Am I missing something? Why use an overly technical solution when some paper and pens will fix the whole thing?
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
Give us a link to the board, we need to have a look at it before we can properly assess the best way to 'keep it local'.
If you use PHP, consider getting Maxmind and filter on its city / country databases.
You have no idea what is of use to other people. Maybe they're thinking of visiting your local area. Maybe they have friends that live there. Maybe they're thinking of setting up a similar board for their own area and want to know how yours is going. Put down your ego for a minute.
How we know is more important than what we know.
I'd put good money on this being 4chan
Implement something similar to a captcha: Ask questions only people from your neighborhood can answer. Make sure the answers are not too easily found by using google.
A couple of years ago we started to get a lot of people signing up from China, India, Russia etc and then posting spam. So now, to register with the forum you have to answer a question that requires you have some local knowledge. That gets rid of most automatic signups. And secondly, the accounts are not activated automatically but have to be approved by an administrator. So we delete those with spammy URLs in their signatures ("Buy WOW gold" seems to be a common variety). In a small community, the number of real local people siging up is a few per week. Maybe a couple of spammers get past that in a month, and then their posts and accounts are quickly deleted.
Really only two choices: GeoID and Registered Only, with a valid matching pair of city/zipcode (city/zip databases are widely available).
If you want news from today, you have to come back tomorrow.
Best to only apply this restriction to account creation. Requiring them to be local when they make the account is entirely understandable, but blocking them from logging in while traveling is not.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
While it does involve having thousands of addresses, this kind of thing is pretty easy to automate, given what your goals are. For example, I use this tool to determine which country my visitors are in and display the relevant contact information (show the French address to people in France, the Belgian one to people in Belgium, etc). I have a cron job set up to update the database once a week; it is fully automatic and very reliable.
If you need to be more specific, this guy has a php class that can supposedly give you information as specific as city, or you can write your own using the db you can download here, although I can't personally vouch for either. You could also parse the hostnames in your server and only allow service providers in your area.
Also, google code has a really good tutorial for a client side application if your server is limited in its capabilities.
Either way, it sounds from the summary like you have access to a database of ip address ranges you want to allow. Just set up a cron job to download it and parse it.
weirdest thing I ever saw: scientology advertising on slashdot.
Have a credibility check page - like checking if someone knows about a local detail that's known by the locals.
"What was the color of the church at Elm Street before 2004?"
And you may want to be careful with IP address filtering since that can result in unexpected disadvantages when a local is out traveling.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
One previously common method of authentication was call-back. You give the site your phone number, then then site calls you (and you press a digit, or answer with your modem).
Nowadays the equivilent is SMS. When they sign up, have them put in their cell number to receive an SMS, then require them to enter that code to continue. You can send SMSes via email for most carriers, so no equipment on your end. Only allow SMSes to your area code and local carriers. For people without cell phones, have them enter their landline phone number and then have a human call them.
Yes, exactly: "... you may want to be careful with IP address filtering since that can result in unexpected disadvantages when a local is out traveling."
Don't expect that your users stay in one place.
Do expect that they sometimes travel to other countries.
And it sounds like you've never had to pay for things like bandwidth and server space out of your own pocket. Maybe he wants to keep it small because that's what he can afford. Information may want to be free, but the infrastructure to host it never is.
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
Your local audience may leave the area (either on holiday or to live) but still want to talk to people back home. This means that blanket IP Range blocking is out of the question.
What I suggest is restrict viewing the website to people who are logged in. A default splash page for those not logged in could be shown that's minimal in graphics and text, containing just the log-in form and a 'register here'.
To stop unwanted people registering a new account, you could to a blanket IP ban on the registration page ONLY, meaning that a local person can register at home, and then roam to wherever and still access the site.
someone mentioned earlier this library for blocking a range of IP's by country and this PHP class that can do it too.
Just use them on the registration page and set up a redirect for those who are not logged in (regardless of location) and you should have a nice walled in forum.
It pays to be obvious, especially if you have a reputation for being subtle.
Set-up account registration such that you can only get an account if you were referred by an existing user. You know, since you already have a good sized user base (you do, yes?). It isn't unreasonable as long as you're keeping things local. Most people should know one another, or know someone who knows someone.
But, honestly, why are you even explaining yourself to these people. An email solely with RTFM in it with a link to the page the explains what the site is about is more than enough. Seriously, stop feeding the help vampires.
or so I have been told here on slashdot.
PS. Apple users suck.
Best to only apply this restriction to account evolution.
Fixed that for y... wait, what?
Use an invitation system like Google did for GMail. Each existing user would have a dozen or so invites. They enter the recipient's email address in a form on your site, and it sends a welcome email with an invite code. Those codes could only be used one time each. Locally you could spread invite codes far and wide on your hardcopy flyers, business cards, etc, with another set of codes that allowed multiple use - say 500-1000 uses per code. When that bulk code starts running low, create a new code and post new flyers. Eventually you'll get the local saturation you desire, and those public codes could be reduced so they can only be used 50-100 times before expiring. The idea is if they get into the hands of a spambot there will only be a limited number of accounts they can create.
When a public code runs out, your website can say something like "This code has expired. You will find the latest code posted at the community bulletin board at the local post office."
Basically your advertising will be word of mouth (where the invite codes come in), or via local hardcopy posters, flyers and business cards (bulk codes). I believe the invite system would serve as a form of viral advertising in and of itself (which is probably a major reason why Google went that route).
Anyway, that's how I'd do it.
Better known as 318230.
> who cares about the library shutting an hour earlier on Thursdays and the
> graffiti on the bus shelter, except the people living there?
It might be fun to troll even if you don't live there. If only local access were allowed, then the population of possible trolls would be much smaller.
Like everything else it's a tradeoff between the benefits, and the disadvantages (in this case, probably the main disadvantage is blocking access to some people who should have it).
Remember, locals come from all over the world. Can you think of a time when you need local news more then when you are away from home? Just keeping out visitors because some geolocation outfit made some guess about their IP range is gonna hurt a lot of innocent people. And does IP based geolocation even work with mobile phones? If you considder your forum delicate and in need of easy access for locals then frustrating even some of them some of the time will hurt.
If its a forum you can decide to give *more* access to the kind of locals you want, instead of trying to give less to the visitors you dont like. I would try having online trivia quizzes about local events. Then you can give those who score well and have historically contributed interesting post moderating powers.
You can also demand referrals from current members at signup. Kinda like google did when it started gmail. I like the idea of plastering private keys around the neighborhood. Maybe you could use business cards, each with a different unique number and good for one account. If people know someone in the area a unique number will make their way, but if they dont then they are out of luck. Even back in the BBS days some boards were hard to get in. I remember typing up and "application" for access to a board, and then being voted into the community by a couple of regulars. Voting out people who figured "I hav l0adz of pr0n to tr4de" would get them in was kinda fun.
If its just bandwidth thats the problem then I would really considder just paying for the bandwidth someway. Maybe small local businesses would like to advertise cheaply but think adwords ads are for people with a website rather than brick and mortar store? Maybe you can serve more intrusive ads to those without a local IP? Or... just find a way to pay for the extra bandwidth! Bandwidth can be so insanely cheap these days
Now, my Web-based board gets slammed by people from all over the world
Have you never wondered what "www" stands for?
"Wise men talk because they have something to say; fools, because they have to say something" - Plato