On Wednesday, January 23, 2019 at 1:22:09 AM UTC-5, Jeffrey Walton wrote: > > > A spammer got around our defenses and hit our wiki. It looks like they > created about 65 accounts (maybe more) and dropped 998 new spam pages > starting on 31 December 2018. New pages 999 and 1000 are ones I created on > 27 December 2018 for Release Signing. > > I put the wiki in Read-Only mode ( > https://www.mediawiki.org/wiki/Manual:Lock_the_database) and lost control > of things. The website and wiki are down, and I got booted off my SSH > connection. I can't reestablish the connection for some reason. > > The website and wiki are down, and I need some time to get things back up. >
Two things here.... First, the IP address happened to change while I was working on the machine. Wei changed DNS record and firt problem solved. Second I had to cleanup the spam by hand. There were no extensions to do what we needed. There were 11,000+ spam accounts setup over the years. 10,000+ happened this month. Each of the January 2019 spam account added 30-100 wiki pages, so we were full of junk... I could not clean the spam one-by-one. It was too big a job. I settled on deleting all users who user_id>5. Then I deleted all pages that no longer had an author. That cleared all of the spam and some real content. (The original five user_id are folks like Wei, me and Soren Dreijer. Account 6 was spam from 2004). Feel free to recreate missing pages or point out missing content. Jeff -- You received this message because you are subscribed to "Crypto++ Users". More information about Crypto++ and this group is available at http://www.cryptopp.com and http://groups.google.com/forum/#!forum/cryptopp-users. --- You received this message because you are subscribed to the Google Groups "Crypto++ Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to cryptopp-users+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
