• Announcements

  • Disposable email domains are blocked for new forum registrations

Legitimate users occasionally use disposable email domains for throwaway accounts. Unfortunately, we've been forced to block using these domains due to an extreme level of abuse. People are manually creating hundreds of accounts to raid the forum. We'll keep this around as something we can quickly enable even after the raids stop so that we're more protected against it going forward.

We're using the Friends of Flarum Disposable Emails extension which had a list of 40033 disposable email domains which we've updated to the newer upstream list with 56360 domains. We're gradually extending it to cover large groups of domains for additional disposable email providers being used to raid the forum. We're currently up to 60718 domains. This will continue to be extended to cover more of these domains making cycling through email accounts too quick.

We're going to be adding additional defenses against raids and spam to the forum. Flarum v2 is currently in a release candidate stage and should have a stable release soon which has massive improvements to both Flarum and many of the extensions for it including several anti-spam / anti-abuse ones we use.

    other8026 it's so google of you to ignore my core question and hide it. "What's the rough cost of trial for local solution (not necessary a LLM) to detect spam/enshittification for 3 months? $100, $1K, ...?" I've asked you twice and twice you have hidden the message. It's so google...

        mosatroiriffe60 What's the rough cost of trial for local solution (not necessary a LLM) to detect spam/enshittification for 3 months? $100, $1K, ...?

        There is no magic wand which automagically removes spam.

        LLMs are a terrible approach due to the very large likelihood of false-positives due to biases, etc.

        mosatroiriffe60 It's so google...

        You clearly ignore the moderator's request to be productive; this kind of snarky statements make you come across as trolling.

            Please keep simplelogin premium domains out of that list!

            It is unfortunate time has to be spend on this cause, but it is what it is i guess. The recent spam streaks (allthough originating from 1 person i think) have indeed been quite disruptive.

            You are right to manage your forum as you wish Devs
            But
            I am fortunate to have been able to register with a disposable email because it matters to me.
            I have taken in consideration that it is temporary but it can refrain ppl to register and participate imho

            mosatroiriffe60 to ignore my core question and hide it. "What's the rough cost of trial for local solution (not necessary a LLM) to detect spam/enshittification for 3 months? $100, $1K, ...?" I've asked you twice and twice you have hidden the message. It's so google...

            Moderators are not here to do your homework or produce cost estimates for unrelated projects/ideas. This discussion forum exists to discuss GrapheneOS. Since your (border line entitled attitude) question / idea is outside that scope, it's off-topic. Reposting it and accusing a moderator of ignoring / hiding it doesn't make it relevant.

                Well.. That's me banned. I get it, I really do but if you think hour getting my real email.. Not a chance. 👋🏻

                  akc3n oh, it's so sweet. So, instead of an ask to a community on how to deal with a spam crisis for a particular forum engine, you decide to just block the whole area for privacy-conscious users. I know you're security-first, but haven't expected for privacy-last.
                  Your enforcement for a LLm ( that I have mentioned as not necessary efficient for a sentiment estimation), is, of course productive
                  . Ignorance on par with rejecting an ask for "how much do you need to trial a proper way to fight spam instead of blocking legitimate users?"

                    r134a Yes but for privacy reasons I cycle my account every 6 months (or so). Something I've done for years on here. So when I close this account (I've just requested this now) I won't be able to make a new account.
                    Also this is happening more and more with other sites and accounts, this is (IMO) pushing away from a privacy POV and also hurting the likes of smaller project like addy etc

                        Aero I won't be able to make a new account

                        Again, it's not a permanent change. The disposable email blocking feature will be disabled as soon as we can disable it.

                          I advocate for this mitigation: moderators approving the first post of an account.

                          Currently, the spam gets removed manually and quickly, therefore the first posts would get approved at a similar rate. It's privacy focused and will stop anything but extremely focused human engineered spam.

                          It's like avoiding badness enumeration in a sense. It's impossible to list all bad actors, so why not only allow good actors. Of course it can be combined with any other methods that are desirable, though.

                          I can't speak to whether the burden of manually approving every forum user would be an unreasonable ask of the moderation team, but my idea is only the first post of a new account, which is not many and could be quickly eyeballed in a unified interface. It seems to me that it would be easier than hunting for specific first-posts that are rule-breaking.

                          Many forums like Privacy guides.net, monero.forum use this technique.

                          I don't know if it's possible on Flarum so that could easily disqualify this approach.

                          Curious to hear the admins, moderators or anyone's thoughts on this proposal.

                            Appreciate the transparency with email blocklists, many sites have opaque anti-spam measures which can make it a pain to sign up privately. This demonstrates how much the maintainers of the project care about their user experience.

                            Strange that a new account joins to advocate against my idea with nonsensical arguments.

                            Hi all from a throwaway account. It's just to demonstrate stupidity of the decision