Idea for a security site for the retro community

[Harrison]

I've been interested in doing something like this for some time.

Over at Amibay, and on quite a few other retro sites there has been continued trouble with specific members of the Amiga and retro communities scamming people, ripping people off, or just generally causing trouble. Either by not sending goods, not sending goods in the condition described, sending pirated versions of software instead of originals. And also members who just like to troll and cause a lot of trouble, such as trying to provoke cross site flamewars attacking staff or other sites and trying to get members to take their side and discredit the site even more.

At the moment there are some generic blacklists that site admins can download and use. These contain known bad domain names and ip addresses that should be blocked from gaining access and being allowed to register on a site, and known webmail providers that are commonly used by spammers.

However there still isn't a central resource for this information, or a more specific resource for a specific community.

Therefore I've had the idea to create a new site and forum that will offer guides on securing specific forum, portal and cms software, plus blacklists containing details of members who we don't want in the community.

It will obviously be focused on the retro community, and mostly the Amiga one, as we know of specific people how have caused trouble across the whole of the Amiga community on Amibay, EAB, A.org, A1 and many other sites and have been banned from them all. And they don't give up, registering new accounts, spoofing their IP addresses to ghost their access and stay under the radar, or dealing via PM with members to hide their activity.

The idea is to have a series of blacklists that are updated often and will contain information for:

• members
• IP addresses
• domain names
• webmail
• ...

Each of these lists could then be downloaded and used to very quickly add this blacklisted information to sites. For example you could copy and paste the blacklist IP address list directly into a forum's IP blacklist box to instantly block them all from a site. And in a similar way, block certain member names from being registered.

With all of the data in these lists being accessible and update-able by all members.

In addition the database could hold additional information about each blacklisted member such as their location, real name, address, sites they have been banned from and the reasons why... etc. Plus link backs to the posts that got them banned and contact info for the moderators and admins involved in originally banning them.

In addition to the blacklists, a security forum could serve as a central location for admins to converge, share and discuss any current security threats, potential risks etc... Plus helpful up to date information on how to secure each forum software to make it as secure as possible, plus helpful tips on setting up, running, moderating and administrating each.

Such a site would due to its nature be underground and not accessible by the general public. It would be by invitation only at the request of each site admin and their staff. If a member of the public tried to access the site all they would find is a logo and login details. The general site security information might be publicly accessible to aid anyone looking to setup and configure a forum or cms, but not any sensitive data such as real names and addresses of blacklisted internet users.

The main idea being that every site admin/moderator contributes what they know from their own site to combine forces and secure all sites involved at the same time.

I would love to know what everyone on this forum things of this idea? Do you think it is a good idea? And do you think those who run sites would be interested in joining such a group project?

One additional thought it that each site who belongs to such an organisation could display a small banner showing they are a member of the organisation as a little rubber stamp to show they are part of a governing enforcement of community members.

[Tiago]

It could be a good idea. But you must be carefull about adding people to the "black" list, there would be people trying to convince you to put certain member in black list just because person A dont like person B. It would be a very interesting project but you must need identify very well the rules to pu someone in the black list

[woody.cool]

I think it's an excellent idea.
I know of one person who would go on straight away ..... he's been banned from 11 forums in 3 months ..... he causes arguments no matter what forum he posts on.
We put up with him for ages over on Retro Gamer, until we finally banned him.

No names witll be mentioned (@ mods & admins: if you want to know who he is, PM me)

[Harrison]

Yes, that is a good point.

One of the reasons I would want to keep the site locked and only accessible by personally vetted administrators and moderators of sites that belong to it is to try and ensure that wouldn't happen, as you would hope that the staff of a site can take an objective view.

The obvious thing that would happen if a site admin or moderator abused their rights by adding people to the list due purely to personal dislike would be for them to be personally added to the list as well. That should hopefully be a good warning for them to be careful.

Also the reason I mentioned that links to show posts proving why someone was blacklisted to validate their inclusion within the blacklist is another safeguard to try and stop this happening.

There could also be something in place for anyone on the list to be able to submit a request to be removed from the list. Giving detailed reasons and circumstances explaining themselves. It could then be reviewed by the concerned admins and moderators and a decision made.

It would definitely take a bit of time and consideration to construct the rules of how the blacklist should be added to, but I think it could work well if managed correctly.

And in addition to using the blacklist to ban and block people, it could also be used as a point of contact if you have members trying to contact someone due to a sale going bad. If that blacklisted seller is included in the list then their details could be used to contact them in an attempt to arbitrate and fix the situation.