NMS Formmail

*johnfl68* · 02-20-2008, 05:10 PM

I asked this several months ago in another thread, and didn't get a response.

Is there something newer and more robust to take the place of NMS formmail, which has not been updated in years (2004)? Any recommendations from the FQ staff? Is NMS still the best answer?

I have seen an increase lately of robots posting to the forms, and of course would like to do what I can to alleviate this.

Any suggestions?

Thanks!

John

*kitchin* · 02-20-2008, 05:18 PM

Form spam almost always has one string you can search on: "http://"
Count those up and score it, it's really easy. False positives are possible, but how many people are going to put 10 http://'s in the message and one in the "first name" field too?

jmihawkins · 02-20-2008, 06:30 PM

I use NMS's TFMail, mainly for the ability to hide the 'to' address. My form spam volume goes up and down, depending on the spammer, day of week, whatever. The spammers have focused on just 1 of 8 forms, and just load up ALL the form fields with the same web address over and over. I've played the game of renaming all the pieces more than once, with only a coupla days relief. I recently reset my FQ built-in spam filters to exclude all executable content (as well as attachments), and have seen a major reduction in spam, with no impact on legitimate form submissions - could be the filter, could be the boys are on vacation, could be they aren't seeing any response and have moved on - who knows???

I stumbled across a suggestion to place a 'honey-pot' field in the form, using CSS to make it really tiny and hidden. The idea being no customer could see it or fill it in, but the spam-bot would - so you error-page any form with that field filled. Of course, you need to know enuff coding to add that to your form script.

Shelia has a similar script, Gypsy-Mail. I've asked her in the past about the possibility of adding a honey-pot field, but no response. Maybe she has some answers.

*kitchin* · 02-21-2008, 12:23 AM

Yeah, I have a few other techniques, but counting those "http://"s is <edit>very good</edit> I tell you.

*johnfl68* · 02-24-2008, 09:56 AM

Are you doing this (looking for http://'s) in the form, or with a email filter, or how? Any examples?

I also have a reCAPTCHA key for vBulletin 3.7.0 Beta that I guess I could also start using on the forms on the web site.

Thanks.

*kitchin* · 02-24-2008, 11:40 AM

My scripts are custom, so I don't know how helpful I will be. Do you know how to modify NMSFormmail? Or have you seen any good plugins for it?

I scan the content in the form processing script. Form spam is where "http://" seems to be the best test by far. I mean, somebody could be emailing you a bunch of links. But if multiple links are in the name field, or whatever, that is wrong!

I add score, "[spam 6]" or whatever, to the beginning of the subject line, like SpamAssassin does. Then I can filter and sort them in my email client: Eudora, Thunderbird, Outlook, etc. In other words, they go into a spam folder and I check it for false positives every so often.

If you have a point in NMSFormmail you want to modify, post the line number and version here. The scanning code that counts http:// is easy.

*johnfl68* · 02-24-2008, 02:58 PM

No, I do not know how to modify NMS Formmail - It looks like there is a spot for custom code, but have not gotten to trying anything yet.

Anyone ever look into using reCAPTCHA with NMS Formmail?

I am interested in this route - have looked at it briefly, it sounds like many people want to do this, as they are using NMS Formmail, but no one has published a working example yet (at least that I could find).

One posting I saw made it sound like you need reCAPTCHA.pm in the Perl Library, not sure if this is the case on the FutureQuest servers.

John

*johnfl68* · 02-25-2008, 05:41 PM

Ok, so I need the following Pearl Modules, that are not installed on the FQ servers:

CGI::Simple
Captcha::reCAPTCHA

Can I install these in my cgi-bin, or other folder in my account, and do I need to do something in the script to identify these as being somewhere else? Or do they need to be installed for the whole server, which I assume is not likely to happen?

Any help would be appreciated.

Thanks!

John

*johnfl68* · 02-28-2008, 09:23 PM

Bueller?... Bueller?... Bueller?

*sheila* · 02-28-2008, 09:56 PM

Quote:

Originally Posted by jmihawkins

Shelia has a similar script, Gypsy-Mail. I've asked her in the past about the possibility of adding a honey-pot field, but no response. Maybe she has some answers.

I'm sorry...
I don't recall receiving that from you, but maybe I did and it was a long time ago and I've simply forgotten? Truly sorry...

The state of the situation with GypsyMail is that I haven't done any development on it in a very, very long time (a few years). There's certainly stuff that could be done to it to improve it. However, I'm occupied with other things. So, honestly, I don't see that I would be doing any coding on it any time in the foreseeable future.

If someone else wanted to add that functionality to the script and contribute the code, I would be happy to post the update on my site. As it is, the way GypsyMail is currently, I was even thinking of taking it down off my site (due to the lack of recent updates and the fact that it doesn't prevent spam from being sent to the addresses coded into the template...).