FaceBook [Linkcheck]

[Cholmondely]

FaceBook [Linkcheck]

Just saw this listed on the Board Index page as a registered user which was currently online.

How come this gets membership of our Bulletin Board? How does this add in any way to our community? And why is Facebook spying on us?



And what on earth is the point of hiding everything (lists of Developers, Spam Bot Assassins etc) and then allowing "FaceBook [Linkcheck]" bots in?

[Wildeblood]

FaceBook [Linkcheck]

Just saw this listed on the Board Index page as a registered user which was currently online.

How come this gets membership of our Bulletin Board? How does this add in any way to our community? And why is Facebook spying on us?

It's a frequent visitor. Very frequent. More frequent than Bing, in my estimation. Presumably, it follows links people have posted to Facebook, and censors posts containing broken links. As long as there is one message somewhere on FB linking back here, it will visit periodically. Also presumably, locking out Linkcheck would inconvenience someone who is a member both here and on FB.

We appear to have those bots right where they want us.

[hiran]

How come this gets membership of our Bulletin Board? How does this add in any way to our community? And why is Facebook spying on us?

It's a frequent visitor. Very frequent. More frequent than Bing, in my estimation. Presumably, it follows links people have posted to Facebook, and censors posts containing broken links. As long as there is one message somewhere on FB linking back here, it will visit periodically. Also presumably, locking out Linkcheck would inconvenience someone who is a member both here and on FB.

We appear to have those bots right where they want us.

I believe the reasoning to be correct. But how/why there is a user account for a bot is still a question mark for me.

However someone could have registered an account, then put the credentials into the bot. And to mark it up changed the username in the aftermath.

If we block this user I guess the bot will conclude the links to be invalid and remove them from Facebook. Do we want that?

[Wildeblood]

But how/why there is a user account for a bot is still a question mark for me.

However someone could have registered an account, then put the credentials into the bot. And to mark it up changed the username in the aftermath.

If we block this user I guess the bot will conclude the links to be invalid and remove them from Facebook. Do we want that?

Somewhere deep in the phpBB admin settings, you'd find a setting to allow/disallow known safe bots. The BB shows bots on that list as "registered users", but no registration process ever occurred. (It's been a looong time since I installed a phpBB, so I can add no more detail.)

[hiran]

Likely connected: viewtopic.php?p=262642&hilit=BB+Facebook

[hiran]

But how/why there is a user account for a bot is still a question mark for me.

However someone could have registered an account, then put the credentials into the bot. And to mark it up changed the username in the aftermath.

If we block this user I guess the bot will conclude the links to be invalid and remove them from Facebook. Do we want that?

Somewhere deep in the phpBB admin settings, you'd find a setting to allow/disallow known safe bots. The BB shows bots on that list as "registered users", but no registration process ever occurred. (It's been a looong time since I installed a phpBB, so I can add no more detail.)

Good hint. Here is the relevant part from the documentation:
https://www.phpbb.com/support/docs/en/3 ... m_spiders/

[Cholmondely]

Likely connected: viewtopic.php?p=262642&hilit=BB+Facebook

No activity since 24th February....

And the bot is back again.





Edited to say: almost 2 hours later and this blasted bot is still in our BB spying on us.

[hiran]

And the bot is back again.

Edited to say: almost 2 hours later and this blasted bot is still in our BB spying on us.

The forum is publicly viewable. So anyone can spy on us - a decision we never questioned. But we can change it to only allow registered users.
What I want to point out though is that this bot, although scanning us without specific user account, is detected and treated with 'bot provileges'. And this shows up in logs, online users etc. So nothing harmful is happening.

But we can switch the discussion to: Should the board be visible to anonymous users?

[Cholmondely]

And the bot is back again.

Edited to say: almost 2 hours later and this blasted bot is still in our BB spying on us.

The forum is publicly viewable. So anyone can spy on us - a decision we never questioned. But we can change it to only allow registered users.
What I want to point out though is that this bot, although scanning us without specific user account, is detected and treated with 'bot provileges'. And this shows up in logs, online users etc. So nothing harmful is happening.

But we can switch the discussion to: Should the board be visible to anonymous users?

I've no desire to make the board invisible. Just restricting access to (eg) details about our members to non-members.

What are these "bot-privileges"?

[hiran]

What I want to point out though is that this bot, although scanning us without specific user account, is detected and treated with 'bot provileges'. And this shows up in logs, online users etc. So nothing harmful is happening.

I've no desire to make the board invisible. Just restricting access to (eg) details about our members to non-members.

What are these "bot-privileges"?

So bots can only read data. They are not allowed to write anything, not even registering accounts is forbidden. They are completely anonymous - while still their presence is detected. Why then detect them?

As bots just come to scan and index (to be able to verify links are valid or to guide users to us when keywords match), they do not enjoy some complex styled website. In contrary, it takes the forum effort to add all the formatting while the bot then spends effort to ignore all of it. Therefore phpBB offers to configure a special, minimalist style for bots to ease off that burden. This minimalist style could e.g. omit links to user details or the member list.

So all you are worried about is already there, I just cannot say if it is configured to an optimum. On the other hand this board no longer lists the admins or moderators, and that decision was not taken because of bots but because of privacy reasons. Privacy applies not just for bots but for all users and reduces our attack surface.

[Cholmondely]

So bots can only read data.

That's my concern. If the bot only has the same access as a guest, fine.

But the things are registered. This presumably gives them access to things which are kept secret from unregistered users. (Have you tried seeing what you lose access to without being logged in?) Such as possibly the list of members with the details published there in that database. And our chats on the Riedquat Space Bar: “Whiskey Business”.

I thought that this worry was pretty obvious from my previous posts.

I do not see why we have to allow facebook access to any of that information. I think that Cody might share my concerns, and I'm sure that other members of our community do too...

I really think that you should expel that bot immediately. It has been nosing around all day...

[hiran]

So bots can only read data.

That's my concern. If the bot only has the same access as a guest, fine.

But the things are registered. This presumably gives them access to things which are kept secret from unregistered users. (Have you tried seeing what you lose access to without being logged in?) Such as possibly the list of members with the details published there in that database. And our chats on the Riedquat Space Bar: “Whiskey Business”.

I thought that this worry was pretty obvious from my previous posts.

I do not see why we have to allow facebook access to any of that information. I think that Cody might share my concerns, and I'm sure that other members of our community do too...

I really think that you should expel that bot immediately. It has been nosing around all day...

Again: That bot comes in as unregistered user. It does not attempt to authenticate but it does not hide itself either. That's why the forum software is able to identify it. How would you expel an anonymous user without locking the forum for only registered users?

[Cholmondely]

Again: That bot comes in as unregistered user. It does not attempt to authenticate but it does not hide itself either. That's why the forum software is able to identify it. How would you expel an anonymous user without locking the forum for only registered users?

Sorry. Did not understand what you were saying earlier.

[hiran]

Again: That bot comes in as unregistered user. It does not attempt to authenticate but it does not hide itself either. That's why the forum software is able to identify it. How would you expel an anonymous user without locking the forum for only registered users?

Sorry. Did not understand what you were saying earlier.

Maybe I was too technical.