I've come to the conclusion that the best way to slow down bogus account sign-ups is disable the standard account creation. Instead, have users fill out a form telling us about themselves and have that go to an approval queue. Admins then review the application and approve or reject it. Unsurprisingly, I've found a mediawiki extension to do just this.
My main concern with this tactic is that it might make us seem insular. I think though, that some carefully written copy could help diminish this perception.
Besides me, I haven't seen any other new and legit users editing in the past few weeks. Our options are either to Make the Regulars Spend More Time Doing Busy Work Instead of Adding Canon, or Keep It Easy For Potentially Non-Existent New Users to Sign Up. Phrased like that, I think the choice is relatively clear.
I think this is overdue. For some reason the number has escalated to very high levels recently. I don't think we'd be seen as insular - I have had to make a little case to join other gaming groups to avoid spammers and it hasn't concerned me. We need to explain why we need to do this and make the invitation super friendly. Furthermore, I'd say a stream of bogus sign ups might also act as a disincentive to join of itself.
And... done! Users now how to apply for an account. Admins will see a small message in the upper-right of every page when there are account requests awaiting review. We could probably edit some of the text on the signup page, but for now this should stem the flood.
Thanks! I'm gonna test it now. Out of curiosity, where would we edit the signup page's text at? Is that a MediaWiki namespace page?
That works really elegantly. We should probably put together some terms and conditions, I guess. I'm leaving my request up for other admins to see, but I encourage each of you to try making a new account (you need to be signed out of an existing account to do so) to see what's on that page. We'll need to brainstorm ways to make the process as informative, simple, and welcoming as possible.
Re: "Out of curiosity, where would we edit the signup page's text at? Is that a MediaWiki namespace page?" Huh, I don't know off the top of my head. I'll poke around. If I go silent on this, ask me again.
Found it! They can be changed in Special:AllMessages
. All of the strings associated with the extension have the prefix "requestaccount".
I just created a bogus user and I really like the new sign up process - well done Andrew - and we have had far fewer users on the Recent Changes as a result. I think I need to be made a bureaucrat, though, as the user request has not flagged up a message on my screen - this is probably also why I can't make users trusted, etc. A search for it actually brings up no hits as well.
The email I got to confirm my email address does not say I need to wait for an administrator to vet my application either which it probably should.
The flag shows up for me, so it must be a bureaucrat-only feature. I don't have a problem with admins also being bureaucrats unless someone can think of a reason that's not a good idea.
So if I'm not mistaken, at the moment, only registered users may edit any page, correct? And the only way to become a registered user is to go through this process asking for phone number, CV, etc? I fear we're not going to see anyone new contributing to the project. While this is a great step in the right direction, I do feel a bit like we're fighting a weed with a gallon of napalm to the detriment of the rest of the lawn.
For us, I don't see a huge difference between a bureaucrat and an admin. I say we grant bureaucrat permission when someone becomes an admin. If we see abuse in the future, we can deal with it then.
Right now, only registered users may edit pages. Also, only "trusted" users can add external links to a page. As for the whole "phone number, CV, etc" thing, I don't see that on the sign-up page. I do see that you've edited the strings though, so I assume you've removed the offending language. There are actually WAY more fileds on that form by default (including one to upload your CV), many of which I removed... it seems I didn't read the accompanying text too closely though. With the string updates that you've made, I think it's pretty reasonable.
We need to change our Getting Started documentation and Help pages to reflect this restriction on editing and the need to request an account rather than just signing up. If we can lessen the number of fields in the request process to just one or two that would be ideal, as ultimately the info we need is the stuff I put in the revised strings: involvement in past wikis, relationship to the Pathfinder setting and game, and if folks want to, their paizo.com screenname.
I've removed the bit on the signup page about "Terms of Service". I've also removed the last couple of "tell us more about yourself" fields, which I felt were a little redundant. We can add these back in if we want, but I figured that while we're in the running for an ENnie nomination we should clean this page up as much as we can and remove as many barrier for legitimate users as possible.
Just want to say that I've been very happy with the lack of bogus accounts created here lately. As far as I know, nobody with a legitimate right to post here has been hindered greatly by our new policy. Jolly good, I say!
I notice that when a new user is accepted, we generate some text on their talk page that includes "We hope you will contribute much and well. You will probably want to read the help pages. Again, welcome and have fun!" Where is this text hosted, as I'd like to make some edits to it (particularly the awkward "much and well").
Yikes, that is pretty clumsy. It looks like you can edit it here
Clumsy text for new users is back - what changed?
As of this time (see date stamp), I have quickly gone through over 500 requests for application to the wiki - Ennie success clearly has its advantages. Unfortunately only one of the 500+ seemed to know about Pathfinder: welcome Devlingreye. The rest are offering a myriad of goods and services some only seen elsewhere in the Nightstalls. Is there a way we can purge the queue as doing it one by one manually will take a fair amount of effort?
Has something changed this week that allows more in, or are we just unlucky now after a lull?
Finally, when I create a user I still get the old 'clumsy' text auto-generated but I notice others get the improved text. Do I need to change something for my account to get the new welcome text?
Engine room here - she's not gonna hold...
Over 1,000 now and growing rapidly. I checked again and all spam as far as I can see though worth as second look as my eyes have glazed over.
Can we just do a single deletion of the whole spamming lot?
Andrew looks like this is being blasted now thanks. I just looked and all that's left is stuff from before the time I last checked when I had gone through all the requests to check for valid ones and found a sole contender (see above): so I'd say what was left is spam.
I also have gone through a random sampling of the bogus requests and have blocked all of their IP addresses. They seemed to have come from a fairly limited number of locations (which you can see HERE
). Unless they're using IP Address Spoofing
that should hold off those particular spammers for a while (I hope).
Resurrecting this thread to note that the automatic new user talk page text is located at MediaWiki:Confirmaccount-welc. Fleanetha saw the default text because he switched his language on his Preferences from English (en) to British English (en-GB), which applied the default welcome text because it is treated as a different language with its own (default) messages. I've overridden this behavior by transcluding the generic English welcome message onto MediaWiki:Confirmaccount-welc/en-gb and MediaWiki:Confirmaccount-welc/en-ca.
Thanks Oznogon for finding and then sorting this - I hope it wasn't too painful to find. I'll double check next time I initiate an account but I reckon that is sorted.