OK, after cleaning up a ton of this profile spamming nonsense by hand to get a feel for it, I am not sure we should even offer the flag to disable profiles for TL0 users. Here’s why.
FIRST! Remember that
- robots.txt excludes
/users/out of box - no hyperlinks are ever generated on a user profile page for TL0 users
- we don’t even have any user index page, so good luck finding a user who has never posted
So it’s not that dangerous to have profile spammers, it’s just noisy and kind of annoying.
My worry is that this class of spammer only expose themselves as a spammer when they enter spammy profile info. So ask yourself this: which of these outcomes is worse?
-
a bunch of new mysterious users sign up from India but don’t ever post or fill out their user profile info, because they can’t.
-
a bunch of new users sign up from India and don’t ever post, but they enter spammy profile info (that is safe for the reasons listed above) that definitively exposes them as spammers.
Knowing what I know about people wanting to “grow” their sites, they’d be perfectly happy to keep these mysterious non-posting, non-profile-updating spammy accounts around as evidence that “hey my site is working look at all these user account signups!” when they’ve let some evil people in their house, and simply don’t realize it yet.
So I posit that there is value in letting these spammers reveal themselves as profile page spammers. And there is significant danger in suppressing the profile edits for TL0 because it will prevent eager (or busy, inattentive, etc) Discourse operators from discovering that their influx of new users is actually just a bunch of super low value spammers who weren’t able to post anything… yet.