Slashdot Mirror
jQuery Dev Bemoans Overwhelming Spam On Google Groups
angryrice tips a blog post by John Resig, lead developer for jQuery, about the failure of Google Groups to manage spam, declaring attempts to use it as a public discussion system "completely futile." Quoting:
"The final straw was placed upon my patience with the Google Groups system a few weeks ago. Spammers are now spoofing the email addresses of existing group participants to sneak their messages through. Previously you would've seen a delightful 'FREE MOVIE DOWNLOADS' spam from 'freemovies123@gmail.com' — but now you'll see it coming from existing group users — or even the group moderators themselves. This cheat completely bypasses the moderation system since the spammers are pretending to be pre-moderated users. The Google Groups system is completely fooled. The spam message comes in claiming to be from an existing group participant — and according to the Google Groups interface there is no difference. If you click the user's name you'll be taken to a full listing of that user's posts (with the spam messages delightfully interspersed)."
You get what you pay for.
Maybe if we created a mail header with the pgp signature of the message in it we could train our spam filters to filter on that. Google could silently inject the header into its mail clients... no one would need training. Email would look the same. Clients unaware what to do with the header could ignore it. Inside systems like Groups you could see "verified" or not on the email.
[signature]
I used to be an avid newsgroup participant way back in the day. The flamewars were legendary, and the amount of technical information exchanged on some of those groups was beyond description.
If there were a way to use spammers for fuel, I'd have no qualms solving our energy woes that way ...
If libertarians are so opposed to effective government, why don't they all move to Somalia?
Yahoo chat as well seems to be overtaken by this spamfest. They have tried to address it with captchas, but the spammers simply go ahead and entire the captcha code and keep spamming. They could require credit card verification to make it harder to open massive numbers of accounts, i suppose. Maybe they could have some sort of scanner that would look for sequences that could identify common patterns in spam messages and flag these messages for moderation. Even moderation itself is ripe for abuse with moderators who abuse that power that they have. Perhaps another solution is a voting system on particular messages like that on slashdot, in this case, simply as to whether the message is spam or not, the messages which are voted to be spam are basically collapsed but could be opened with a click, or can be shown with a show "spam marked messages" feature. Could be useful both on chat and also on message boards.
Google's really dropped the ball on spam blocking with Blogger too. I host a couple of random blogs on there, and they've all been hit with a ridiculous amount of spam in the last year. Blogger doesn't even give you something like Akismet... :(
If this is a Usenet group that Google Groups is just providing an interface to, I guess it's time to bring back the cancelbots. UDP against Google. It's come close before.
If this is one of the Google Groups that's a web forum, then they need to require that you actually log in before posting.
Why the hell haven't they put the same spam filters that they use for Gmail on the discussion lists?
Is there anything better than clicking through Microsoft ads on Slashdot?
Time to move away from the antiquated system of mailing lists. Web based forums are much easier to control and a far, far better way of sharing information with users. I hate coming across an otherwise useful site and then having to go to a mailing list to see what other users are talking about.
Google has some of the weakest around. And whats more is becaue Google uses domain keys it is a desired domain because that stuff gets through the spam filters better.
I wish Google had an automated honey pot system where you could drop a google address, and any google account would instantly get shut off for sending mail to it. The idea is you plant the email address in a place where automated spambots will harvest it and poof! no more spammer.
Of course it could be used for abuse and if passed off as a legit account, so there needs to be some registration and tying of spam honey pot accounts to their owners for accountability.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
Google Mail has a feature in Labs whereby they identify social groups within your email contact so that if you exchange a lot of emails between a certain group of people and suddenly add a new recipient it will flag a possible problem. Surely it would be possible to apply a similar methodology to Google Groups only with the IP addresses messages originate from - send from a new IP assignment and the message gets moderated, no matter how many successful posts you've made from elsewhere.
UNIX? They're not even circumcised! Savages!
And then have to deal with spam from Gmail accounts.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I see a lot of Google's products needing the oh so familiar Beta label again.
Seriously, Google's offering is not without it's serious drawbacks, and I suspect that the good stuff is to be had from actual paid services. However, this kind of letting crap slip where people can spoof the name of a valid member is a serious Alpha quality flaw. What's the point of identifying anyone, if everyone can pretend to be everyone else? I mean that is the actually concept of identity, to uniquely label something as different as other things.
I think Google is trying to take on more than it can handle and it is beginning to really show now that they've removed the excuse of "Beta".
Maybe it's because they want to encourage you to use Gmail, which they control and can extract some income from, instead of Usenet, which they have only a passing acquaintance with and can't squeeze a penny out of.
Google Groups was a good idea with a bad implementation. Last time I checked, there was no fast way to report a spammer, you have to click 3 or 4 times and be redirected to different pages before having just one message successfully reported.
I created and admin a Google group for my son's high school team. We have coaches about 120 parents in the group.
Even though it's a pain in the ass, I chose to moderate messages for new members. Still, spam gets through. As the group's admin, it's embarrassing to see graphic messages and know that all the parent's on my kid's team are seeing it. Also, moderation means that some messages may not get through in a timely manner.
I'm looking to migrate the group to an alternative now.
The problem is that the trail of money ends at a Western Union or Moneygram branch.
Back in the day of 2 kbit/s modems, yes it was a pain because it would take a full minute to download a single message, but in today's 1000+ kbit/s world, these messages just ziiiiip right past.
I use Vodafone UK, you insensitive clod!
I manage a moderated google group and I have received spam "from the group" from someone who is not a member. This makes me think that they sent it directly to me and just spoofed the headers to make it appear to come from google to get past my local spam filter. I wonder if this is what is really happening?
"Computer Scientists can count to 1024 on their fingers" (non-mutant, non-mutilatated, human computer scientists)
1. Spam is theft of service.
2. Spam is theft of service.
3. The spam in Google Groups absolutely ruins many groups because the boards are inundated with spam to the point that a real message is like a needle in a haystack. The stock discussion boards have gone to hell in the last few months.
Bill Clinton: Pimp we can believe in. - The Shirt!!!
Google Groups serves as a face to Usenet, yes, but it also advertises itself as a place to create new groups which are hosted by Google, as an alternative to setting up your own mailing list. I suspect the jQuery folks are using a Google hosted group. The spam situation is indeed ridiculous, and Google could indeed do something about it. They even have "report spam" buttons on all the messages, but so far as I can tell clicking on those buttons has no effect. At the very least it should hide the messages from me that I mark as spam. But no, it doesn't even remember which messages I've marked as spam from login to login. They've just dropped the ball for some reason.
We were having some problems with this on the wimax hacking google group.
About a month ago I set all posting options to members only (read is still public, the group is listed in the directory, and there is no moderation). I then set it so people need to request an invite to join. The signup page says "Sorry, about the inconvenience, but spam was starting to ramp up, so now users have to request membership manually. Anyone who is human is welcome, and encouraged to join."
There has been zero spam since the change.
It would be nice if there was an option to just let people solve a captcha to join the group, but until then this solution is working fine.
Maybe the answer is to block posts to USENET that come in via Google. That seems to be the source of the trouble.
Looking at the newsgroup "comp.lang.python", all the spam seems to be coming in via "posting.google.com" with GMail return addresses. Bulk-created phony gmail accounts are such a source of spam that they should be blocked until Google gets their act together. At this point, we have to view GMail like Hotmail, another free email account system made useless by spammers.
Hotmail is widely blocked. Next, Gmail?
The problem is that the trail of money ends at a Western Union or Moneygram branch.
That's not a problem! We can safely assume that said spammer lives in a 10 KM range of said branch office. A small tactical nuke should take care of it. Sure, it'll cause some collateral damage, but we're talking about spammers here.
8 of 13 people found this answer helpful. Did you?
The reason, at least to me, seems abundantly clear: Google has the attention span of a three year old. They fixate heavily on something for a while... then their attention drifts and they are off to the next shiny thing. They've got a lot of products, but no clear vision or effective management.
When you have 10x more spam than relevant material in a topic, it's easy to miss the relevant material.
That, and some spam subjects are just painfully horrible, and nobody should be subjected to the horror of even glancing at them.
Then again, when I saw one suggesting I could own my own Bionic Turtle (I kid you not), spam did rise *a little bit* in my opinion. I still deleted it, but I loved that title.
Self proclaimed typo king, and inventor of the bear destroying coffee table (patent not pending).
1. How can you steal a service that's provided to you for free?
My internet service is not provided to me for free. I pay for it. I reserve the right to accept or reject advertising as I see fit. People who not only force advertising on me, but do it in a deceitful manner, deserve nothing more than forcible, unlubed sodomy during the half time show of the Super Bowl. Spammers are roaches and should be treated as such.
People who not only force advertising on me, but do it in a deceitful manner, deserve nothing more than forcible, unlubed sodomy during the half time show of the Super Bowl.
So if your local library's cork board has individual citizens pinning up advertising deceitfully, will you unleash your gay sexual fantasies on the library staff since you pay for the library with your tax dollars?
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Your post advocates a ( ) technical ( ) legislative ( ) market-based (x) vigilante approach to fighting spam. Your idea will not work... ...aah never mind.
This is more to do with Yahoo Groups than Google Groups but they seem similar. Recently I've joined several Yahoo Groups about specialized ham radio topics. Nearly all of them keep their archives private. I have apply to join (basically push a button and say who I am) and then wait for approval from the admin. Once approved I can read the archives and also post. Posting from members is usually unmoderated. It's painless enough but still very frustrating when I'm just searching around for information and a quick look at the archives is probably all I want.
I don't mind having to join if I want to post but do they achieve anything by keeping the archives private? Yahoo obscure the email addresses so spammers' 'bots are not going to get much from them. I've asked several admins "why do you keep the archives private?" and have not received a convincing answer. It usually goes something like "I understand your frustration but we have a lot of trouble with spam" and sometimes goes on to imply what a silly question I asked. Well ... I still don't see how keeping the archives private helps to reduce spam. I haven't been a group admin so maybe I'm missing something.
I can understand keeping archives private or non-existent for a group on a personal or private subject but that doesn't apply to these groups.
My guess is that this is Yahoo's default setting when a group is created and few admins really think about it. Of course Yahoo want as many people as possible to join.
I say we take off and nuke the entire site from orbit. It's the only way to be sure.
Bingo. They need a moratorium on new products for 3 years while they chain the engineers to big, burly product managers and get all of their offerings on the same page.
Of course, that's (more or less) what happened at Yahoo!, and Google took the opportunity to fly right past them.
Why don't you just sign your messages and verify based on signature, rather than something completely meaningless like email-address?
And once again: Why the hell does google not sign all messages which pass through gmail as "really did come from this address"?
(x) technical ( ) legislative ( ) market-based ( ) vigilante
(x) Requires immediate total cooperation from everybody at once
(x) Lack of centrally controlling authority for email
(x) Why should we have to trust you and your servers? (I'm using the short-form.)
What I mean to say is, you don't have to have a Gmail account to be a member of a Google Group. Your approach might keep people from spoofing Gmail addresses and be completely painless for Gmail users, but non-Gmail users would have to manually configure their mail clients to digitally sign their messages and some (web-based) e-mail clients might not even support this.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Ooh Ooh is spam theft the same way illegal copying of copyrighted materials is theft? I can't wait to see the argument on this one!
Why bother
Ha ha ha ha ha ha ha
You really truly honestly believe the spammers are paying for their own bandwidth? They're riding on bot-nets and open relays costing someone else their bandwidth. Most of the spam I see on the filters at work comes from residential networks.
Trying to become famous by taking photos. Visit my homepage please.
Back in the day when Dejanews was a "cool web 2.0" like thing for Usenet and Usenet was still popular, they could manage the actual, pro spammer attacks with handful of people. Those were the days when CNET had "help.com" which allowed complete newbies to post questions to Usenet.
Now Google, with impossible to imagine computing resources lets the core Usenet _and_ their own private groups gets polluted by trivial spam. Yes, trivial since even my stupid mail filters can sort that kind of spam without even touching bayesian etc. filters.
It is almost like pyramid scheme. Spammer uses Google groups infrasacture to post pirate software download forums which are solely gathering income from Google adwords. That happens on a big5 one, not some alt.conspiracy low traffic thing.
In first days, I thought Google didn't care on purpose of promoting their own, closed, moderated fake groups but it was a total tinfoil hat theory. They simply didn't/doesn't have competency to carry that kind of job which 2-3 experienced admins did while Usenet was 10x-20x more popular.
I can answer this one, time. The more time developers spend administering yet another system, the less they get actually working on their open source project.
MidnightBSD: The BSD for Everyone