Note: Not a duplicate of Please don't use a spam filter based on IP address. That proposes that we stop blocking IPs; this one suggests implementing an additional feature while keeping the existing IP blocking system.

Over at Charcoal, we've detected at least a few persistent spammers and trolls that have the time/motivation to keep spamming or trolling. Some of these tend to hop IPs in order to get around the existing built-in spam prevention system SpamRam, which is currently solely based on IP addresses.

The folks over at Wikipedia recently implemented a new cookie blocking system into their existing autoblocking system, which attempts to prevent users blocked for many reasons, including spam or vandalism, from coming back, and before that feature was implemented, was solely based on IP addresses (and X-Forwarded-For headers in certain cases). The way it works is that whenever a user is blocked and autoblocking is enabled, a cookie is set on the blocked user's device. Then, if they try to hop IPs, the system will detect the cookie on their device and prevent them from editing.

I'd like to propose that this cookie-blocking system be adopted into SpamRam, to prevent spammers and trolls from simply hopping IPs to keep at it. Basically, when it decides to block an IP, it should also set a cookie on the user's device set to expire at the same time the IP block expires, and then that cookie should prevent the user from posting.

One way to track the effectiveness of this before implementing this would be to keep the current status quo with regards to how blocks are made, but also set a cookie whenever someone's posting results in an IP block. Then, keep statistics to check and see if many users who post here have the cookie set on their system, and if those posts are also deleted as spam or abuse.

According to the Wikipedia page on cookie blocking:

The feature is intended to provide a small extra level of protection against blocks being circumvented.

I believe that any hurdle, big or small, is useful, per Byte Commander's comment.

When I edited as the anonymous editor, and my IP would be blocked (which was common since anonymous edits are subject to a content filter and a single edit that trips it will insta-ban the IP), bypassing the block was as simple as enabling my VPN. Based on what I've heard about SpamRam in Charcoal, I imagine that that system would be that easy to evade as well in the same manner.

Also, I believe that this would be compliant with GDPR, as we do display cookie warnings to all users, and we could list this as a use of cookies in our cookie policy (which Wikipedia also does).

  • 4
    I've occasionally wanted something like this for detecting vote fraud - a persistent cookie that unobservant account-hoppers would hopefully not notice. I think it's a good idea, but easily defeated with an incognito window by the more dedicated trolls.
    – Undo
    Commented Apr 4, 2018 at 0:06
  • 1
    Sure, but every stone in their path is a good thing, so why make their life easy? This should be fairly easy to implement too, so I'd agree with the proposal. Commented Apr 4, 2018 at 0:08
  • Send me a list of these persistent spammers, I'll tell you if this would've helped at all.
    – Shog9
    Commented Apr 4, 2018 at 0:23
  • @Shog9 stackoverflow.com/c/charcoal/questions/2 (Charcoal team members only) Commented Apr 4, 2018 at 0:24
  • Do note that those are only a small subset of them. Commented Apr 4, 2018 at 0:37
  • 1
    Of that small subset, the only two who would've been even slightly inconvenienced by the system described here are the ones who repeatedly revive the same accounts and are instantly suspended by the system. That's not... promising.
    – Shog9
    Commented Apr 4, 2018 at 1:45
  • 2
    @Shog9 That subset only includes trolls, not spammers. For spammers, you should check Metasmoke. Commented Apr 4, 2018 at 1:46
  • Nice idea, but seems pretty easy to defeat.
    – anonymous2
    Commented Apr 4, 2018 at 2:03
  • @anonymous2 If we make it less obvious that we're using cookies...much of Wikipedia's unblock help pages still advise people on the basis of IP address autoblocks Commented Apr 4, 2018 at 2:04
  • 2
    @Sonic Yeah, sure, and like I said, it's a nice idea (+1): seems every step in the right direction is great, but I have doubts it will impede a significant portion of the serious offenders.
    – anonymous2
    Commented Apr 4, 2018 at 2:08
  • Note that the "cookie block" on Wikipedia is experimental. Its effects are not fully clear yet, which is one reason it's not yet been done on all Wikimedia wikis. meta.wikimedia.org/wiki/Community_health_initiative/…
    – Nemo
    Commented May 15, 2018 at 14:13
  • @Nemo That page is outdated. Wikipedia thinks it's working, so they recently rolled it out to direct IP blocks placed by administrators, not just autoblocks. Commented May 15, 2018 at 23:31
  • @SonictheInclusiveHedgehog You probably mean "English Wikipedia", not Wikipedia. I'm not sure what part you think it's outdated. I meant the 7th link: phabricator.wikimedia.org/T152462 . See blockers.
    – Nemo
    Commented May 16, 2018 at 5:57


You must log in to answer this question.

Browse other questions tagged .