Disable editing of posts for new users

[lassoan (Andras Lasso)]

It has become a common pattern that spam bots post some seemingly valid message that they edit to add malicious links a few days later (when people who monitor all new posts don’t read them anymore).

See for example these topics (spam posts are marked deleted and will disappear at some point):

• Initial presentation
• Migrating GitHub issue to discourse

There are two options to discourage these spam bots:

• Option A: Change minimum trust level for post editing from “0: new user” to “1: basic user” (see settings). Since trust level 1 can be earned by just browsing the site, it might not be very effective if spam bots are programmed to spend some time on the site.
• Option B: Reduce time limit for editing a post form the default 60 days to something like 1 hour (or maybe even 15 minutes). We would probably spot malicious links added soon after a new post is created. Spammers currently wait a few days.

Option B would be probably more effective, but it would impact all users. However, it may not be that bad to limit post editing to quick modifications right after posting anyway. So, I slightly prefer option B.

What do you think @jcfr @pieper @ihnorton @fedorov

[pieper (Steve Pieper (Isomics, Inc.))]

Yes, I prefer option B. If people make a big mistake like posting possible PHI or something and don’t realize right away then they should be able to contact an admin to get the post edited.

[fedorov (Andrey Fedorov)]

Amazing. I am glad you caught this Andras.

Why don’t we implement both A and B?

[lassoan (Andras Lasso)]

@fedorov

Why don’t we implement both A and B?

It is better do the minimum necessary restrictions to not frustrate users. We can first try if applying one of the restrictions is enough.

[jamesobutler (James Butler)]

OptionB sounds like a good option Andras.

I was suspicious of those comments in the topics that you marked as examples above. I specifically checked the specific user a day later to see if they modified the posts with links and sure enough they did. I then marked as spam at that time.

[lassoan (Andras Lasso)]

Thanks for all the feedbacks. I’ve set post editing time limit to 60 minutes. Hopefully it is long enough for legitim users and short enough for spammers.

[fedorov (Andrey Fedorov)]

@lassoan

It is better do the minimum necessary restrictions to not frustrate users. We can first try if applying one of the restrictions is enough.

Makes sense. I thought most will meet A anyway, but I can understand your concern. No objections!