No rush. You're not obliged to bid on my auction  .

I'm not particularly desperate about getting a sig ad as soon as possible so forcing myself to make a specific number of posts is not exactly something I intend to do. I'll have to think about lowering the minimum bid since that does seems like an OKish idea.

And if their reports don't have any merit, they will be marked as bad.

I've only commented on your posts being deleted. I did not claim that your reports are "ok to be ignored" nor did I label your complaints as unreasonable. As hilarious mentioned, none of the moderators are forced to handle every report they see. Consequently, reports of possible offenses where it's more difficult to assess whether a forum rule was broken (either due to the sheer amount of context required or the post being borderline) are going to hang around the queue for longer than ones where an offense can be easily detected at a glance. Whether it's this or one (or more) moderator(s) being biased against you is where your guess is as good as mine since I can only speak for myself. Glancing over your reports in the queue, it seems like it's the former though I could be wrong.

When I handle reports (or moderate in general), I try to keep my biases in check and provide as close to an objective decision as I can. If I feel like I would be incapable of making an objective enough judgment due to close involvement with one of the parties related to a report, I stay out of the situation and let someone else from the staff team handle it. Not sure how other staff do it, but I assume (or at least hope) it's similar.

No guarantees in terms of number posts. I've stopped keeping track of the average number recently so I don't feel comfortable throwing out a random number.

IIRC while I did find your first post borderline, I wasn't the one who acted on it so whoever did may be able to comment on it better. I did, however, delete the second (?) one which included you complaining about moderation, which definitely was off-topic. Nevertheless, here's what my opinion on the first one:

Had you posted that in a thread that had maintained active discussion up until recently, you could argue that. Since the thread you posted in was inactive for the past 4 years, your post had to have contributed to the old discussion directly (answering the question "Should I report posts that hijack a thread?") and substantially (if you necro a super old thread you better have a good reason and enough useful content to warrant it) rather than branching it off to a related discussion ("Why are my reports on hijacking not getting handled?"). Had you been the OP of the aformentioned thread, I could see how complaining about it would've been directly contributing to the discussion.

As for any posts that break the rules, report them. If your report gets denied and you're vehemently sure that it's against the forum's rules, message theymos.

Since self-modded topics aren't allowed in Meta, IMO local rules don't apply here. If you want to reach out to one or more moderators, send a multi-recipient PM. As for how to find them, see https://bitcointalk.org/index.php?topic=703657.0:


As for your posts getting deleted, if you necro a super old thread, you better make sure your contribution is directly on-topic and substantial enough to warrant bumping it to the top. Yours was neither. If you want to complain about moderation, you're free to do it by starting a thread in Meta or posting in an at least semi-recent thread where it's directly on-topic.

A few questions / observations:

1. Has it withstood numerous attempts to fully automate the captcha solving process (via ultra low cost, high volume means)?
2. You say it "does not keep tracking like Google" yet FunCaptcha's front page mentions that it uses "<...> past reputation of a request <...>") to detect fraudulent actions. So, any source for that claim?
3. I don't see a pricing page on the site so I assume it's an "enterprise-focused" (a.k.a. "costs a fuck ton") service. I really doubt theymos wants to dedicate a substantial amount of the forum's budget to CAPTCHA protection when the current CAPTCHA does the job fine.

This is trivial to bypass for an attacker who has a botnet under his control and provides a huge decrease in usability for the average user.

Considering that the system essentially wiped the incentive to use thread pumping services / pump a thread with alts  or run on-forum altcoin giveaways (both of which generate insurmountable amounts of spam and clutter), it's definitely a positive change IMO. As for tweaks: maybe try and communicate the system to new users better. When I saw the "bump" button the first time, I had to go check Meta for a thread explaining the change. I really doubt that's the first thing newbies would do.

No idea. Seems like I've removed them from my queue while cleaning up reports a while ago so this could be one of those "not sure if reports are good or bad" situations.

Propose it to theymos via PM - he's the one who decides whether a new board should be created. Do note that there has to be enough recent scam accusations to fill at least a few pages:


Might have to link the aforementioned topics as well.

More often than not, if a case is super clear cut (e.g. "+1 / good project" spam, speculation threads posted in the "Bitcoin Discussion" board), a report on it will get handled pretty quickly. It's when all of the moderators checking the report aren't sure whether they should act on it (e.g. the post is borderline, not sure if it breaks the spirit of a rule, complex situations where one has to have a nearly full context of the thread's discussion) is when it hangs as unhandled for a while till someone decides to do something.

Had the "Connection Problems" error page just now. No clue as to why the forum's acting up.

---

I assume failing. IIRC most static assets should be cached and served by Cloudflare, especially for the non-changing SMF forum UI elements. I assume that after the cache expired and Cloudflare failed to load the assets, it just dropped errors for those requests. You should be able to check the network tab on your browser (on Firefox: right mouse button, letter Q, select "Network", refresh page) to see if any of those requests are returning error codes.

Good idea. Not sure whether that's something I want to do right now but I'll think about it.

Don't exactly enjoy repeating myself but I'm going to re-quote (with minor modifications) what I've already quoted in a topic not far back since the same applies here:

I only cleaned up the duplicate reports. IIRC I haven't actually marked any of your (edit: non-duplicate) reports as handled or bad. So I can't really comment as to why some reports were marked as such.


If a report is unhandled, it's either that a mod hadn't had the time to look into it (meaning someone will get to it sooner or later) or what theymos describes as a "soft bad" report where none of the moderators that looked at the report could decide whether they should act on it or mark it as bad, choosing instead to leave it for someone else to decide.

IIRC I marked a lot of your reports as bad since they were duplicates. If the the double reported posts haven't been deleted and there are still unhandled reports, that probably means the non-duplicate reports corresponding to the duplicate ones simply haven't been handled yet.

It does but that's only useful if you don't want to use Cloudflare's SSL certificate for some other reason aside from encryption (e.g. you have one of those fancy SSL certificates with your company name). You uploading the certificate == you giving your SSL private keys to Cloudflare (if I'm not mistaken; I haven't used the service, just did some casual research in the past). For a fully-featured DDOS mitigation service to work, said service has to be able to look at the unencrypted request (both to check it against certain basic rules as well as to detect anomalies using various machine learning methods). The uploaded certificate merely changes the web request pipeline from:

(you)----encrypted connection <CF cert>--->(CF servers)---encrypted connection <your own cert>---->(Bitcointalk servers)

to:

(you)----encrypted connection <your uploaded cert>--->(CF servers)---encrypted connection <your own cert>---->(Bitcointalk servers)

I've bolded the parts where the data being transferred (which in this case is the request to Bitcointalk's servers) is unencrypted^[1].

In a perfect (not-so-far-from-our-current-situation) world, everyone would have a DDOS-mitigation-in-a-box type of open-source application (which would be widely used and supported) as well as enough money to afford the hardware required to run it. In reality, AFAIK there is no free and open-source DDOS-mitigation-in-a-box application that'd be able to stand up to all the attacks that Cloudflare mitigates right out the box (alongside with it being constantly supported and updated to address new threats). And if you tack on the massive server costs on top of that, you can start to understand how despite the compromise in privacy, Cloudflare (and similar DDoS mitigation services) provide an amazing value proposition (especially for services less concerned with user privacy). It's either sink a ton of money and / or work and hope for the best (Bitcointalk tried this one and it worked.... till it didn't; DDoS mitigation is very much a perpetual arms race that few can keep up with once they reach a certain size), get DDoSed to hell and back (hey, you get the privacy benefits... by not being able to transmit any sort of data to the website) or use one of these services.


I tend to follow the methodology of never ruling something (important) out until you're 99.9% sure that isn't the case - especially when a wrongful assumption can lead to catastrophic consequences. Hacking is (usually) messy and complicated. You usually don't just sit down and "hack something" - for highly secured systems it might take months of pushing and prodding till you figure out where and how the system is vulnerable. Some of that poking and prodding might leave traces. While I'm not saying that I'm fairly certain Bitcointalk was hacked again, I prefer to cover all my bases when talking about possible causes for an issue I have very little information about.

[1] - Do note that this is the most secure configuration as encrypting the <your own cert> part of the pipeline is optional for your browser to consider the connection as "secure". It sort of is (as in it's much more likely and dangerous letting randoms intercept your request (and response) data while you beam it over your coffee shop's WiFi) but if you don't or don't want to trust the people / companies managing the infrastructure between Cloudflare and your hosting company, the high-level configuration shown in the makeshift graph is what you should use (and what I assume Bitcointalk uses).

I don't really get into intense discussions nowadays so most of my messaging is usually moderation related. However, unless it's a personal matter (direct requests, notifications of a discussions related to my actions, etc.), I prefer to keep the discussion public and in the thread. It always felt weird when I commented on someone else's thread (either positively or negatively) and they directly messaged me about it instead of just replying in the topic.

Wait a sec... Weren't those the exact same (or at least really similar in max volume at least) terms (alongside the lack of a manager) that got them temporarily blacklisted the first time?

Looking at the Cloudflare blog, in the past few days 2 new features have been added to their "website protection suite" or however you want to define the collection of services they provide (they released some other stuff, but from what I've gathered it isn't related to their core product) - Browser Insights and Bot Fight Mode. While neither of those should be enabled by default (at least according to both blog posts), maybe it's automatically enabled for a certain groups of customers? If that's the case, either (or both) of these features might be injecting JS into the page (the announcement of the Browser Insights feature even shows a dashboard screen of insights per geographic region).

Do note that I'm speculating but it's either that, you accidentally visiting a phishing website, your PC being infected with malware / adware or Bitcointalk getting compromised again. Hopefully it's the first one.