After discussing it with Stef and Esteban and of course Ben . we reached the conclusion to have only a few days keeping the invite link private. After that it will become public again to make it easy for people to join without any hassle. If the problem reappears we can discuss whether further action is needed, in the meantime I will try to ban members generated by the bot. I wont be deleting it without consulting you first. Admins please refrain from creating additional invite links, one should be enough and will make everyone life a lot easier. The new link has no expiration date. Making the invite link public means that the links to the link , like the one on the website , will have to be updated to the new one. I do not have access to those places so people that do will have to update it. I will make the link public in this thread in a few days. in case the people that are responsible for sharing the link are not admins in Discord and they cannot access it. Again I apologize for the inconvenience but it was a necessary action to minimize the problem. I am at your disposal for any further clarification and assistance. On Sat, Jan 5, 2019 at 10:00 PM Dimitris Chloupis via Pharo-users < pharo-users@lists.pharo.org> wrote:

I leave the handling of the invite link up to the admins. I made several of you admins as experienced members of this community so that you can handle situations like this. As always my policy has been to make the first step and let others do the rest.

The incident is not one, I had to ban 3 members , obviously dummy accounts for the spammer, to have to delete the invites. When it was first recommended I refused to do it but as they say, third is the charm.

If you use several invites there will be no way to know which invite was used by the spammer.

I do not think disabling the embeding of links is a good idea, cause we heavily rely on them , especially for helping newcomers. It will also make little diffirence to the spamming because the bots wont care and continue spamming. Those members are clearly bots because the same exact message is post each time and I doubt that someone goes to this trouble to do this manually.

In any case, I leave it up to the community, if you want the old method and endure the spamming that's up to you. I do not have the time or desire to do heavy moderation anyway, so its unlikely any method will be future proof.Any direction you decide to follow, you have my blessing.

In any case spamming is far from Discord exclusive problem and it has happened even in this mailing list. So there is no ideal solution.

On Sat, Jan 5, 2019 at 8:58 PM Ben Coman <btc@openinworld.com> wrote:

...

On Sun, 6 Jan 2019 at 00:00, Dimitris Chloupis via Pharo-users < pharo-users@lists.pharo.org> wrote:

...

Hello people , as you may or may not be aware we have a spammer that posts links to sexual content sites. This is of course an unacceptable situation so I had to delete all existing invite links.

This means that from now on I will not allow members to create their own invite links and I will also not allow more than one link to be active at a time so I know which link is compromised.

This would be good to manage better. Its unfortunate that there seems no way to detect which link a spammer joined through.

...

The invite link will no longer be public but shared privately only by Admins to people who are already active here and it will be shared only through personal emails and messages.

I don't see how that arrangement will be workable for newcomers that need help. One of the benefits of instant messaging is that it lowers the barrier of entry for people learning Pharo to receive help.

...

I have also raised the level of automatic moderation , from now on new members wont be able to post in our server unless they have a verified email with Discord. Also all messages are automatically scanned by Discord from now on for improper behavior.

This is good. Live and learn.

...

I am sorry for this inconvenience but its all part of having a very active community, it was just a matter of time till we attracted the attention of spammers.

This does not affect our almost 1000 existing members on Discord server so if you already a member you have nothing to worry about. This affects only new people who like to join.

If you are new and you like to join I will send you an invite link ONLY if you are active in this mailing list and after you are ask for one. You can use this thread by providing your Discord ID (you get this when you register with discord) and I will send you a personal message in Discord with an invite link. By active I mean that you have substantial participation in this mailing list which means at least 3 posts.

This policy seems like an overkill for a first incident. It introduces a chicken-and-egg problem in attracting new users. Someone trying out Pharo who is a potential new user and co-developer. They don't yet care enough or know enough about Pharo to substantially participate in the mail list, but they a quick chat right now would sort out something souring their view of Pharo . But if they need to wait to make three posts plus then someone being available on their timezone to email them an invite, they may just drop it.

...

If you are a member or admin and post the link publicly , its not a problem, but please be aware that if the link is compromised then I will delete it and create new making new members unable to join with the old one. So use the link wisely.

New invites are required for the web page and Pharo's built-in help page. Probably better to have separate invites for each since the former is more likely to be scraped by spammers.

As an alternative action to wiping all links, disabling new members from embedding links might effectively deter spammer from posting links and pictures.

cheers -ben