Here's the situation. D3r stepped down as an admin at one point because of a personal fall out with m7. Without him Saidit didn't have an admin competent enough to handle the attacks, m7 doesn't know enough about it and relied on him. There's no-one else he trusts enough to have full access to the servers either so instead he's letting the place rot. Vulptex at one point made an important commit to the Saidit code but m7 is paranoid about breaking things when pushing it, so it never went to production. We've offered help to m7 many times and he basically refuses. On top of that the canary's dead and that leaves one to wonder whether or not he's letting it die intentionally because of some gag order, so we aren't even sure if it's good to revive it.

I heard that the current level of clownflare is actually meant to stop DDOSes, but m7 abuses this to prevent spam because he doesn't know how to implement something that filters spam specifically. He could fix the website very easily. But yeah it seems futile at this point.

I know way too much about this. Cloudflare is fine if you don't use the captcha. I use it. It reduces the number of people who know and therefore attack the IP address. Even if there is nothing vulnerable I don't need every bot on the internet port scanning me, giving me useless traffic and dirtying my attack attempt logs. It makes sense as a proxy.

Fighting spam is all about ratios. Here are the ratios. Value/effort. Spammer effort/user effort. Spammer effort/developer effort. Developer energy/spammer energy.

What increase value for the spammer is having links that stick around for days. I'm pretty sure search engines don't even value links that aren't a few days old. If I was developing a search engine and wanted to filter out spam links that's the first thing I would filter the data on. Because even the good new posts will eventually get older and contribute to the authority graph.

So what they are trying to do is get one past the goal post. Also human sense of time is skewed. The proportional difference between 5 minutes and 3 months is bigger than you think. They live for the post that stays on for a long time because it has so much more value.

In terms of spammer effort vs user effort, the captcha doesn't make sense at all. The spammer can manually beat the captchas and then transfer the cookies to a headless browser or run a userscript and post 30 posts per captcha solve. But if you are Saddit and run a recheck every two minutes, if someone is reading between any action then they are doing a captcha solve per action.

Now spammer effort vs developer effort is where things get really fun. It the most fun game in the world. There are a lot of puzzles that exist where making the puzzle is easier than solving it. You have to leverage that by making a parameterized spam block that you shift the values of. A new puzzle every week, black box solving the accept/deny surface of some program, while the developer can just change some things.

Now here is where things get really fun. Making this black box problem harder. Any time I've dealt with spam at a level that's more than I can handle I've done this. Have multiple post/spam accep/deny surfaces. If from one IP I see they do something that is blatant spam I don't fully block their IP. But I now make that IP work a different problem than the real one. I also increase the website's filter level. Now the filter level is so high on their IP that it seems to go past what any site would do. WTF, this site really doesn't accept any links in text posts besides a few white listed domains? And if they change IP addresses they are now burning IP addresses to solve this problem and still have a false problem. They don't know when an IP address is still good or burned and if they want to solve the problem they will need to burn an IP address per attempt.

Now it gets even more fun. Add a little bit of probability to the mix. It's better to accept one spam post you can remove but make the black box problem impossible. You can also add more probability the the hard mode of an soft banned IP address that will never impact real users. WTF the words sex, republican, and health are all banned?

Now if somehow they crack it. All you have to do is change some parameters, word blocks on different filter modes. Takes two minutes. They now have a new black box problem so hard that if they could solve it they could go get a real job.

The last ratio is energy. Spam is more of a psychological game than a programming game. They know fighting spam is tiresome and the site owner doesn't make any money from doing it. The question is who breaks first. They want to break you. Because they know if they can get you to give up on removing spam they get an infinite spam garden. They can post a 100 a day and have them last for years. This is the real goal. At the same time you can break them. You can give them a problem to solve in hopes that they have a script that will make them money forever. They could spend a week of their time on it. Then you can change the script instantly and break them. Maybe they have more energy than others. They spend another week on to resolve it. Then you change it in five minutes. That's how you break somebody. It's your job to break them before they can break you.

As far as saidit goes and programmatic spam removal goes just filter foreign language symbols. That would be level 1. They'd adapt. But the fact that he isn't bothering to make a filter something that is pretty much the easiest function to write that would get a perfect score confusion matrix means these people see a spam garden awaiting them. They just need to outlast the few users that remove spam and they'll get what they really want.

Saidit also needs to apply any filter they develop on old posts to cut any hopes of long term spam links.

I told Magnora I would do this for him and he's not interested. I don't get how its users don't get this. The site is abandoned. That's Magnora's right. He can work on whatever he wants. They try to demand he solves these problems like he has some obligation. He doesn't. Just migrate to somewhere interested in active development. That's what the 2 minute captcha really means. It means spammers and users not welcome. That's why if people tell him "but it will chase users away." His response if he would voice it would be "yeah, that's the point."

What he doesn't realize is that if he chases too many users away in his goal to hibernate the site the spam garden will happen. And that will be worse that a hard close and hard open. But he doesn't understand spam so he doesn't get that. If he just spend five minutes writing the most basic spam filtering function he could expand the catpcha to something longer and he'd keep enough users to remove spam that he could hibernate. That and give the top 30 users global spam removal capacity.

That's the other reason why spam will never work here. I haven't done it on any other site before but I am fully prepared to deputize almost everyone to remove spam. It's what badges are for. I can deputize large numbers of people with fine grained permissions for anything.

What I got from conversations with magnora7 is that he became unnecessarily paranoid - for example, he brought a couple of times how he once switched this extreme Cloudflare mode (which no other forum uses constantly, according to d3 it's called "under attack" mode) off, and immediately forum was filled with spam. But I remember that case - it was Edward having a manic episode, so he manually posted dozens of ChatGPT generated comments/posts, and I can't see how that can be used to justify "under attack" mode for a year+.