How the other half lives - a very seriously funny article.

Part one of our very seriously funny article will be a quote from the logs to keep up with tradition, tradition!

ben_vulpes anyways the notion that anyone on facebook is anything other than a non-player character is hysterical on the face

mircea_popescu the evolution of paul graham's internet : first, ashley madison made a site where scripted "women" interacted with loser men ; then, a bunch of kids made a bunch of sites where scripted "users" interact with scripted "users" : facebook, reddit, instagram, twitter, you name it. ALL of them, simply put.

Part two of our very seriously funny article will be a serious discussion of part one, which you mistakenly think is some sort of joke.

It isn't some sort of joke. Leaving aside the obvious, allow me to fish through the currently running ask.fm botⁱ.

Now then : other than the obvious observations that Trilema = Eulora = Bitcoin = BSDM as far as "mindshare" goesⁱⁱ and that the communication of the human herd consists of 50% &#xFUCK by mass, what can you tell from this data ?

Can you, for instance, identify the bots ?ⁱⁱⁱ

And finally in part three of our very seriously funny article we shall attempt to offer some tech support to the very people hurt by the seriously funny questions we raised in part two. Here goes^iv :

How To Stop Spam Bot Registration??
Cary Silverman Member www.deadflyzone.com Posts: 17 4 months ago

I recently noticed that bots are registering as customers at my store at an alarming rate. ^v The first and last name they use is a long series of letters and numbers and is accompanyed by a fake email address. I did find an old thread here that gave instructions on how to add a simple math equation to the registration screen to stop bots from registering. I added the code to the customers/register.liquid page and the math question showed up on the registration page, but it didn't stop the bots. In fact, while the equation does show up, you can still register on my site without putting in the answer.^vi
Ideally, I would just like to remove the text on the sign-in page that says " New Customer? Sign up → ". I don't have a need for my customers to register on my store unless they are placing an order.^vii If there is another way to stop the bots from registering, I would be open to that solution as well. Thanks for any help.

Coel May Member Posts: 15 4 months ago
This has become a seriously annoy occurrence with our shop.
The post ecommerce.shopify.com/c/shopify-discussion/t/account-creation-spam-how-can-i-stop-it-299920 addresses this same issue, however falls short of a solid solution.
The best hope is that Shopify come up with a built-in solution to stop this behaviour.

Cary Silverman Member www.deadflyzone.com Posts: 17 4 months ago
Thanks Cole. I saw that thread a few days ago and it offered no help at all. I love how the Shopify Guru offered two solutions and then admitted he didn't know how to implement either of them. WTF? And he didn't even research it for the store owner. Basically just said figure it out if you can.
Sure would be nice if someone from Shopify chimed in here. From reading the forums, this has been a problem with people's stores for a very long time and Shopify is basically ignoring our pleas. I did send Sandbox (folks who designed the template I use) a message as well asking how to remove the ability to sign up for an account outside of checkout. They have not bothered to answer me either.
Great support from two companies I have given my $$ to^viii.

Cary Silverman Member www.deadflyzone.com Posts: 17 3 months ago
Finally heard back from Out of The Sandbox. These are the folks that designed my template. A real nice guy over there asked me to create a staff account for him on my site so he could make some changes to my language code.
He took the option off the SIGN IN page that said "New Customer? Create an Account". I didn't need visitors to my store to create an account unless they become customers. They still have the option to create an account after the check-out process. Removing the "New Customer? Create an Account" option on the SIGN IN page will eliminate spam bots from registering accounts on my site. Problem solved.^ix

Cary Silverman Member www.deadflyzone.com Posts: 17 Last edited 3 months ago
Well, scratch my last update. Problem still exists. Removing the "New Customer? Create an Account" button on my sign in page did not work. The web designer at Out of The Sandox didn't think it would. This is what he told me:

"Spam bots are annoying and the goal is to access information that they do not have access to. Unfortunately, removing links will not stop spam as spam bots automatically send a post request to the form, meaning they do not need to see the form or fill out anything to submit it, they can bypass this and submit the form. Unfortunately, Shopify does not provide the best protection against spam, however, I would consider having a look on Shopify's app store for an app that may help you deter spam bots."^x
At least he responded. Shopify has excelled at ignoring me and this post.

Coel May Member Posts: 15 3 months ago
The people that build bots are clever.^xi Of course they are going to look at what will potentially hamper their efforts to post data, and naturally s form, with captcha etc. is going to be the first thing on that list. So if they can post data without the form, they will.
The whole not situation (among other considerations) was why the self-hosted option was ruled out and Shopify was chosen.
WordPress flags spam messages and does not publish them, just as I understand Shopify does. Maybe they could do the same with account creation too, and not have the email confirmation sent out until it is approved. Then one's inbox will not fill up with needless "undeliverable mail" notifications.
Or maybe there is a better solution.
Or maybe there is no solution.^xii

Cary Silverman Member www.deadflyzone.com Posts: 17 3 months ago
I guess for now I will have to just keep deleting the spam accounts that get created at my store every day. I usually delete about 30-40 a day right now.^xiii I am still a bit disappointed that not one single Shopify "Guru"^xiv has bothered to chime in here.

Coel May Member Posts: 15 3 months ago
Ok, 30-40 a day! Man, only dealing with a handful each week.
It's annoying that it happens period, but to happen on the level you are seeing, I cannot fathom to understand the time you are spending on it, and how @&$%#%#$&@&$ you are.

vire Member www.audiopcba.com Posts: 3 3 months ago
YOU CAN STOP THEM REGISTER.
Vire is a china brand specialize in customize bluetooth audio module/pcba/decoder board for 10 years,this mp3 pcb module support FM/USB/TF/MP3/Video/AUX. email: sales33@vire.net.cn^xv

Cary Silverman Member www.deadflyzone.com Posts: 17 3 months ago
Vire, why don't you share with us how you can stop the bots from registering. I think many people that are following this thread would be interested in how since the Shopify "Gurus" clearly don't have a clue.

Coel May Member Posts: 15 3 months ago
Have obtained a php data post script which I then ran on our store. Sure enough, there was the customer.
However, after going to Settings -> Checkout -> Accounts are disabled, running the script again did not result in an account being created (because they are disabled).
If you do not want accounts, I would suggest doing that.
We, however, wish to allow customers the option of creating an account, so this solution is not for us.

HunkyBill Shopify Expert experts.shopify.com/resistor-software Posts: 3590 Last edited 3 months ago
Since a customer registration is just a form POST to Shopify, it is pretty simple to just disable this POST action. A Spam Bot will thus be unable to submit the form.
When a real customer fills in the form, you can tell they are a real customer by asking them to do a simple test. For example, if they are really human, ask them a question like what is 5+8 in a text box. If they answer 13, you pretty much know it is not a Bot.^xvi Or use a Captcha. Whatever. If they pass the human smell test, submit the form to Shopify.
Problem solved. Why the angst? This type of form process has been around pretty much as long as Bots... nothing new here.^xvii
Custom Shopify Apps built just for you! hunkybill@gmail.com

Coel May Member Posts:15 Last edited 3 months ago
For those more curious, the script I used can be found at stackoverflow.com/questions/1217824/post-to-another-page-within-a-php-script
All one needs to do is set the url [e.g. http:///account], and set the $fields array so it contains the values from the sign-up page:

"form_type" => "create_customer",
"utf8" => "✓"^xviii,
"customer[first_name]" => "Secret",
"customer[last_name]" => "Squirrel",
"customer[email]" => "dodgyemailaccounthere@live.com",
"customer[password]" => "dodgyemailaccounthere"

Then run the script and hey presto! A new customer account has just been created on your store.
There is apparently no referrer checking^xix done anywhere in the account creation, and as far as I can tell, this is something only Shopify can do something about as it is not part of a :"theme".
DISCLALIMER: I post this information for education/awareness purposes only.^xx

Cary Silverman Member www.deadflyzone.com Posts: 17 3 months ago
Bill, the math problem script does not work. I added it to my store and you were still able to register an account without answering the question. I read instructions on how to add this on an old post in this forum. If there is a new way to get this added that will actually work, PLEASE share instructions.
Cole, I absolutely want customers to be able to create an account, so disabling that feature is not an option. I just want them to create the account after the checkout process. What was the script you posted in your last reply? What does it do?

Coel May Member Posts: 15 3 months ago
Cary,
The script demonstrates how the bots are able to create accounts without the use of the account creation page on your (any other) Shopify site by sending data straight to the post URL. That's why putting captcha, maths problems, etc. on the account signup page is never going to work: the bots bypass it.

Cary Silverman Member www.deadflyzone.com Posts: 17 3 months ago
Thanks Cole. When I added a math problem to the sign up page, you could still create an account without even answering it, so that didn't work either. I understand what you're saying however. Even if the math problem worked, it still wouldn't stop the bot.^xxi
Still waiting for Bill's reply. He seems to have something that will work. Perhaps?

Nitsa Member mythaicurry.com Posts: 16 3 months ago
My store has started getting hit through the create account page, about 70 a day so far and building. I don't see how deleting the accounts is going to be a sustainable solution and I certainly don't want to turn off the the ability to create an account after checkout. We have heaps of returning customers who appreciate not having to re-enter the details each time they shop with us.
Talking shopify support at the moment, let's see what comes of it.
Customer account spam thumb

HunkyBill Shopify Expert experts.shopify.com/resistor-software Posts: 3590 3 months ago
Cole makes a valid point. Anyone can quickly determine where to POST accounts simply through discovering the shop URL. At that point, all bets are off.
So you can turn off customer accounts from that URL. Replace the customer sign-up with one that POSTS to an App instead^xxii, allowing/forcing any new account to first flow through the App. The App can then create the customer using the API.
A wee bit of luxury would be a moderation queue built on top of this, allowing the merchant to add customers with a click after checking their account details out.
Custom Shopify Apps built just for you! hunkybill@gmail.com

Coel May Member Posts: 15 3 months ago
So every Shopify store should use an app (one which may or may not exist) to circumvent the dodgy customer registration system Shopify currently uses should they HunkyBill?^xxiii
A platform maker is responsible for keeping that platform fit for purpose (which means secure, useable, non-hackable, etc) whether that platform be a desktop operating system, mobile phone operating system, satellite navigation, or eCommerce system (e.g. Shopify, Magento).
Shopify make this platform. They should fix it.^xxiv
How about this: Shopify change the dodgy customer registration system to at least have some sort of url validation in the least (so a POST cannot come from just anywhere), implement a two-step system (where the before POSTing the data another page is shown which contains a captcha that a bot will not be able to solve), or some other non-App system for the benefit of all customers both current and future.

HunkyBill Shopify Expert experts.shopify.com/resistor-software Posts: 3590 3 months ago
@Cole. I simply provided a solution for aggressive^xxv merchants to deal with the problem. I don't speak for Shopify, nor do I care what they should or should not do for merchants.
Please don't confuse my free advice that gets you from A->B regardless of what you think the real solution is, with me wishing anything on anybody.
I am sure if the obvious solution is easy to do, they would do it, and make my approach overkill/dumb.
So chill out man, relax, and don't try and drag me through this mud, as I have nothing to do with it.^xxvi
I just offer solutions... for free, and lately with the crap I am taking from some people I feel like just walking away from doing this, leaving crickets chirping for all to listen to.^xxvii

Custom Shopify Apps built just for you! hunkybill@gmail.com

Coel May Member Posts: 15 3 months ago
I understand you are just a third-party developer, offering "solutions" to merchants.
Thank you for your time, and "free advice".

Nitsa Member mythaicurry.com Posts: 16 3 months ago
Coel,
You have just nailed it.
"A platform maker is responsible for keeping that platform fit for purpose (which means secure, useable, non-hackable, etc) whether that platform be a desktop operating system, mobile phone operating system, satellite navigation, or eCommerce system (e.g. Shopify, Magento)."
My latest exchange with shopify is pointing towards apps, the irony being that they don't exist to solve this problem.^xxviii For the contact form, yes, that is not where my problem lies.
This will be solved. It will be solved simply because this problem will increase because the spambots have found the weakness in the system and will exploit it at an ever-increasing rate, as I am witnessing tonight. Who's going to want to take their business, or keep it with a platform that can't protect against this very basic threat and shows little interest in doing so until it harms their business model.
I've had it for today. So many more important things I could have been doing with my time and here I am dealing with something that is the responsibility of the platform maker, not down to an app developer to create a solution to a problem that shouldn't exist.

CrystalQuest Water-Filters Member crystalquest.com Posts: 1 3 months ago
Ok, this is the snippet of form code they tell us to add for captcha from that article right?
<div class="clearfix large_form">
<br/><strong>How much is:</strong> <input type="text" disabled="disabled" id="question"/>
<br/><strong>Answer:*</strong> <input type="text" id="answer" />
</div>
I did that and like most of you said, it didn't change anything. And you could register without answering the question. So I did this...
<div class="clearfix large_form">
<br/><strong>How much is:</strong> <input type="text" disabled="disabled" id="question"/>
<br/><strong>Answer:*</strong> <input type="text" id="answer" required />
</div>
By adding "required" to the Answer box input tag solves the captcha requirement issue.^xxix

A couple bots have trickled in, but it seems to have slowed down. I think that's because of the cached pages still out there. But give it a try, it may help you!
Sean

Tonya Joyner Member the-jewelry-lady-store.myshopify.com Posts: 1 2 months ago
Is this working for you? I wanted to wait a few days to see what your results were. Thanks!

It worked in the following manner - some different bot meanwhile swallowed him up, rendering this matter moot.

This, my dear friends, has been your end-of-year excursion in the swamp of "how the other half lives". They will conquer salafi Islam, because they're better than the Arabs who can't do it^xxx ; they will summon the-great-again, because they're better than their parents (who summoned the nevermore) ; they'll...

Perhaps it's time to say goodnight. For all you know -- this is the last Christmas spent in the company of the quaint imperial herbivore.

1. For the historical discussion see that 2014 article [↩]
2. Hey, N > 60 so it's a scientific study worthy of Nature, Science and Social Psychology Today. And I didn't spend 80k in taxpayer money to do it, either. [↩]
3. Yes, there are at least a couple in there. But more interestingly - can you actually identify the humans ? Apparently Turing had it all wrong, the question isn't "identify the robot" in any sense, and the solution doesn't come from making the AI "better". It needn't be very good at all, I can currently with items found around the living room make a piece of furniture which you won't be able to meaningfully distinguish from the "users" of "social media platforms" often enough to matter. They're all pieces of furniture.

   What now ? [↩]

4. Original content from "ecommerce university" at ecommerce.shopify.com -- do me a favour and check out the html source of that page.

   If you're curious, shopify trades as SHOP on NYSE (listed at 17 in 2015, jumped to 28, currently trading 41s) and claims "gross merchandise volume" over $10 bn, whatever those are. It's in Ruby on Rails. You know, for security. And yes they have a proprietary "Payment System". And yes to all the rest of your questions. Of course. Problem ? [↩]

5. Have you noticed the double space post dot convention is a good predictor of a certain kind of stupidity ? [↩]
6. Yep, this kind of idiot, the sort that'd ask Popper whether you can "falsify falsification", or check the color of bits. The kind that imagines his permission is required or even desired, the kind that wants to know if "my intentions are serious" etcetera etcetera. [↩]
7. Bots are shaping the world. You don't want to think about it, and you like to imagine that whether you think about it or not, whether it applies to you personally or not, matters. It doesn't matter, and moreover there's a name for that fallacy. We call it "just want to", after jwz.

   Some idiot somewhere is doing a thing because my bot on whatever "platform" did something else. You had no idea my bot exists, because you personally didn't encounter it, because you personally don't even use that dumbass platform. And you never met the some idiot, either. And yet you can't elect your girl. No matter how much you wanted to, you can't. What now ?

   Don't tell me Putin gave up on not understanding how the world works and moved on to influencing the election within one short year. What is this putin, some sort of pet rock/imaginary friend, you put it wherever you need it to be and it just magically fits ?

   Here's the thing : shopify can't be worth money on the long term because the ecosystem it ultimately depends on to exist is composed of people like Cary Silverman on one end and C l a u d i a❗. on the other, which is to say it won't last for very long. [↩]

8. O hey, speaking of which, anyone recall Groupon, that huge scam / major player in the ecosystem ? What ever happened there, I recall they were "worth" however many billions at IPO, and then ? Anything ? "Any news", as the SFYL altcoin crowd used to say ?

   Don't tell me it's sitting somewhere on a piece of paper as a purely notional asset waiting for "someone" to decide to roll it up into an even larger... purely notional asset ? I recall Microsoft paying 50 bn for Webvan, Facebook buying Skype for 50bn, Google buying Whatsapp for 50bn etc etc. Do they print these "50bn" tokens directly, or do they have to sit around and count benjies like old school frauds ? [↩]

9. He thinks this because he is an idiot, and not merely the sort that puts two spaces after the final dot. He's the sort of idiot who thinks in terms of his own experience, he literally imagines that because he personally knows of no other way of using a link than through clicking the underlined thing on a page somewhere it then follows that no other way exists.

   This is the core of the "traditionalist" idiocy, the negative presumption, the expectation that his negative space is not merely an artefact of his own making, but outright a fair, complete and universal description of reality. His wife doesn't seem to enjoy a good lashing so therefore she wouldn't if I gave her one nor would any woman etcetera. He's never seen his daughter swallow a snake so he has serious trouble dealing with all these young gents whose experience does not match his. Perhaps putin did it ? [↩]

10. On the surface, this seems a perfect world - you create a shitty product, get listed on NYSE where you trade at 10 times ("industry" average 5.6!) the book which is cooked to high heavens anyway, on the general expectation that someone will pay money to buy your premium solution for a problem that exists because "of course" your product doesn't work.

    In reality, this is an extremely fragile world -- the sort of idiots that'd do this are entirely incapable of defending themselves from the smallest of challenges such as you know, "not sending their retirement savings to Nigeria because the man in the webpage said so". Soon enough the cost of defending your herd of cattle from predators exceeds the benefits you accrue from owning it (because unlike the real bovine, the bovine-emulated-on-humans does not usefully graze) and then you get to say that "Apple could have bought Russia if only that Putin hadn't influenced TMSR". You realise this is where we're headed, do you ? [↩]

11. So then why the fuck are you here ?

    This is perenially the progre syllogism, "Putin is bad" and "Putin influenced the elections". Why the fuck didn't you influence the elections then ?

    All the Hollywood films I ever saw had this property whereby good effortlessly and of its own accord conquers evil. Do you recall this ? Every time the poor bad guy is running up and down collecting bricks, building nails, mixing mortar, then the good guy comes, farts accidentally while talking on the phone with his girlfriend and the whole empire of evil falls over.

    So why aren't you influencing the elections then ? [↩]

12. Or maybe stupid women should stop fucking drunks. [↩]
13. Let us revisit that Turing question. Can you distinguish people from bots ? Not bots from people, nevermind that, the question is misstated. Can you distinguish people from bots ?

    How many of them ? [↩]

14. The "guru" is (I bet) not paid for his services. Not in money, anyway, he gets the notional value of you know... being "a guru".

    But then again, if your pitbull misbehaves, you park it in the door and you forcibly close the door on its dumb head until it falls over. It will be upset - but it will be upset with the door. [↩]

15. The irony is delicious, yes.

    But no - you can't "stop them register". Ask.fm is using Google's latest captcha thing (that thing where you have to click on pizza or whatever, shop awnings), and it isn't helping them. [↩]

16. How many humans (by smell, as he says) would fail this test, in your estimation ?

    Because that's the beauty of it : more bots pass it than humans fail it. [↩]

17. "Why are you angry at the world not working -- it never worked! Progress!!!"

    He has a point, actually. The imperial ecosystem deals with Cary's problems through sulfozinum injections, he'd better watch out. [↩]

18. This cutsy idiocy is being used everywhere. Meh. [↩]
19. "Referrer" checking being their naive guess at what a Republic'd look like. Some way to go to the WoT, and most steps on it they very pointedly do not wish to take. [↩]
20. Because intent matters. He believes this. He actually believes this. [↩]
21. Imagine that, they printed a number on the form. These dorks count for literate, they're citizens, they get to vote, serve on juries, they're preparing your food and educating your children.

    And they try out with some regularity the magical power of amulets. Hey -- Ivy League degree makes your life better and so on, right ? Why shouldn't the string "8+3=?" printed prominently on a form protect one from bots much like the "This Property Secured By SecuProp" protects their house from breaking&entering ? What do you mean it doesn't ?!?! Well sometimes it doesn't but it does when it does, which really means when it doesn't not protect it... [↩]

22. Gota xsell that app! [↩]
23. In a word -- yes. It's great for "the economy", and good enough for you. In fact, it's the only thread "the economy" is hanging on by. Do you want a 401k like your daddy had or don't you ? [↩]
24. Right.

    And if they fixed it, how'd they sell you an app ? [↩]

25. You know ? [↩]
26. As the great Eric the Clown once said, "This is just a gig, it's not my life. I don't know who Bozo is - what!" [↩]
27. I guess I win that bet -- not paid. [↩]
28. But they will! For to progress!

    I bet they'll even support Python 3! [↩]

29. You see ? He added "required" to the answer box! This does something - because unlike the previous 5+3 displayed amulet, this one is the more potent variety, stuck in the very guts of the strange Internet beast.

    And, glory of glories - it seems to have worked. Because it always does. [↩]

30. Taleb explains why. [↩]