Forum cleanup

[tomreyn]

Code: [Select]

<tomreyn> i just deleted all forum accounts where users (1) have registered before 2013-08-01 && have never posted, (2) were last online >= 5 years ago.
<tomreyn> posts and the names of who posted are retained
<tomreyn> so we're down to 899 forum accounts now (was ~3600)

On a first glance, deleting those many old user accounts has made things noticeably faster. I did so manually using the forum web interface, which took me quite a while but is the only easy way to do this safely.

That's not all we wanted to clean up, yet, though. We need yet to decide what to do about those old forum users which were last online before ~ 2013-08-01 when we announced the need for password change.

Luckily those old users are unable to login (unless they reset their passwords) which means there's no danger that these accounts will be hijacked by spammers (I came across some examples where this happened before we changed those passwords, resulting in those members' old posts getting edited to add blackhat SEO links to those users' old legitimate posts).

[Omega]

I ran a quick query on the table, and it looks like we have 688 members who haven't reset their password.

[tomreyn]

This seems like a realistic number to me. Should we delete those, too? We could limit it to those who have not posted more than once or twice.

[Omega]

Yeah. I mentioned before in IRC that we'd have to delete all references to the user IDs (of the accounts we delete) from the logs, though, otherwise SMF chokes.

I also mentioned the SQL code that would be needed to do this. It'd be trivial to add a condition that only deletes accounts with, say, zero posts.

[tomreyn]

Yes I remember we talked about it (though I dn't usually take notes from IRC, and neither did in this case), and that we wanted to work on this once you have more time. I think the approach I used had the same effect, did it not?

[tomreyn]

So it does seem like the forum purge succeeded. We've had zero negative feedback since (people could still write in by e-mail when their accounts were dropped).

I've also since added several bans which only trigger upon registration of new users and thus do not slow the forum down further in normal operation. Those are some rather broad blocks on new registrations - I've blocked entire network ranges for those ISPs our regular spammers came from. Apparently they don't actually use proxies, since all of these spammers connected from IP addresses in India, Pakistan, Philippines and Vietnam.

When someone from these IP addresses tries to register now they will get to see a message telling them that their ISP is blocked and that they should send us e-mail providing their registration details, so we can register them manually. Sadly this message is just in English, but then this forum is entirely in English, too, so I guess that's at least not making things worse.

And these bans work really well, we have not had new spammy registrations (or any I could detect to be such) for a week now (while we used to have a couple every one or two days before). So I think this trade-off is quite acceptable for now.