Slashdot Mirror
How To Keep a Web Site Local?
Cornwallis writes "The universal accessibility of the Internet is one of its attractions. But what do you do when you don't want your board to be Slashdotted? Back in the day it was great to run a local BBS where friends and neighbors could dial in using their 9600-baud modems to pick up mail or share games or stories. Now, my Web-based board gets slammed by people from all over the world who have no reason to access it, can't possibly take advantage of the locally focused services it offers, and generally take up my time because I have to block their accounts or explain to them why they can't have access. This despite the fact that the board explains quite clearly that it is for local use only and couldn't possibly be of interest to them. Other than putting thousands of entries in my hosts file to block IP ranges, what options do I have to restrict access to locals only? Or isn't that feasible?"
order allow,deny
.
deny from all
allow from iprange
allow from iprange
allow from iprange
etc. etc.
There are websites all over the internet that allow you to do country-by-IP-range lookups.
You could also do;
ErrorDocument 403 "Sorry, this website is only available to people living in
(Yes, no final quotation mark).
Or don't worry, what does it hurt if people who aren't benefiting from a website visit it?
...I doubt Slashdot can make a good assessment without taking a look at the site. Mind posting the URL?
Get some paper, pin it up around the neighbourhood with a private key. Ensure that people can't create an account or access the boards without the private key.
Am I missing something? Why use an overly technical solution when some paper and pens will fix the whole thing?
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
Give us a link to the board, we need to have a look at it before we can properly assess the best way to 'keep it local'.
You have no idea what is of use to other people. Maybe they're thinking of visiting your local area. Maybe they have friends that live there. Maybe they're thinking of setting up a similar board for their own area and want to know how yours is going. Put down your ego for a minute.
How we know is more important than what we know.
A couple of years ago we started to get a lot of people signing up from China, India, Russia etc and then posting spam. So now, to register with the forum you have to answer a question that requires you have some local knowledge. That gets rid of most automatic signups. And secondly, the accounts are not activated automatically but have to be approved by an administrator. So we delete those with spammy URLs in their signatures ("Buy WOW gold" seems to be a common variety). In a small community, the number of real local people siging up is a few per week. Maybe a couple of spammers get past that in a month, and then their posts and accounts are quickly deleted.
Best to only apply this restriction to account creation. Requiring them to be local when they make the account is entirely understandable, but blocking them from logging in while traveling is not.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
While it does involve having thousands of addresses, this kind of thing is pretty easy to automate, given what your goals are. For example, I use this tool to determine which country my visitors are in and display the relevant contact information (show the French address to people in France, the Belgian one to people in Belgium, etc). I have a cron job set up to update the database once a week; it is fully automatic and very reliable.
If you need to be more specific, this guy has a php class that can supposedly give you information as specific as city, or you can write your own using the db you can download here, although I can't personally vouch for either. You could also parse the hostnames in your server and only allow service providers in your area.
Also, google code has a really good tutorial for a client side application if your server is limited in its capabilities.
Either way, it sounds from the summary like you have access to a database of ip address ranges you want to allow. Just set up a cron job to download it and parse it.
weirdest thing I ever saw: scientology advertising on slashdot.
Have a credibility check page - like checking if someone knows about a local detail that's known by the locals.
"What was the color of the church at Elm Street before 2004?"
And you may want to be careful with IP address filtering since that can result in unexpected disadvantages when a local is out traveling.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
One previously common method of authentication was call-back. You give the site your phone number, then then site calls you (and you press a digit, or answer with your modem).
Nowadays the equivilent is SMS. When they sign up, have them put in their cell number to receive an SMS, then require them to enter that code to continue. You can send SMSes via email for most carriers, so no equipment on your end. Only allow SMSes to your area code and local carriers. For people without cell phones, have them enter their landline phone number and then have a human call them.
Yes, exactly: "... you may want to be careful with IP address filtering since that can result in unexpected disadvantages when a local is out traveling."
Don't expect that your users stay in one place.
Do expect that they sometimes travel to other countries.
And it sounds like you've never had to pay for things like bandwidth and server space out of your own pocket. Maybe he wants to keep it small because that's what he can afford. Information may want to be free, but the infrastructure to host it never is.
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
Your local audience may leave the area (either on holiday or to live) but still want to talk to people back home. This means that blanket IP Range blocking is out of the question.
What I suggest is restrict viewing the website to people who are logged in. A default splash page for those not logged in could be shown that's minimal in graphics and text, containing just the log-in form and a 'register here'.
To stop unwanted people registering a new account, you could to a blanket IP ban on the registration page ONLY, meaning that a local person can register at home, and then roam to wherever and still access the site.
someone mentioned earlier this library for blocking a range of IP's by country and this PHP class that can do it too.
Just use them on the registration page and set up a redirect for those who are not logged in (regardless of location) and you should have a nice walled in forum.
It pays to be obvious, especially if you have a reputation for being subtle.
or so I have been told here on slashdot.
PS. Apple users suck.
Best to only apply this restriction to account evolution.
Fixed that for y... wait, what?
The easy solution would be to only apply the limitation on account creation. Just have to prove once that you live in the area!