Comments on: comment spam resistance

By: blog @ davegurnell.com

blog @ davegurnell.com — Sun, 03 Apr 2005 22:53:31 +0000

[...] der Web, Geek.
Leave a comment |
Trackback URL |
Comments RSS

Following the simple anti comment spam measures suggested by Simon, I am trying a little experiment of by own. I have removed the C [...]

By: DaveG

DaveG — Thu, 31 Mar 2005 11:27:26 +0000

Another point to note (quite obvious, this one):

CAPTCHAs don’t affect trackback or pingback spam. In fact, in WordPress 1.2 (which I’m still using for DJBA and SquirrelWeb) I don’t think disabling the admin option for “Allow link notifications from other Weblogs (pingbacks and trackbacks.)” actually does anything.

A quick remedy is to add a PHP die() to the beginning of the relevant files (wp-trackback.php and xmlrpc.php). However, this rather avoids the fact that trackbacks and pingbacks are cool. It’s a shame to disable them.

Perhaps a way around this would be to add a “blog URL” field to the trackback request, which can be whitelisted or blacklisted accordingly. I wonder if WordPress 1.5 does this (I remember something about whitelisting)?

By: DaveG

DaveG — Thu, 31 Mar 2005 11:12:15 +0000

I think I’ll try it anyway… DJBA is getting spam at the moment so I’ll update it and we’ll see what happens.

Whoops! Almost forgot to tick the box! What kind of goody goody human am I?!

By: si

si — Wed, 30 Mar 2005 16:57:30 +0000

I expect that would probably stop most current spam-bots. The danger is that if many blogs have the same structure then the form elements might still be reliably inferred. Even if they aren’t, spam-bots will probably just try random combinations because, hey, they don’t care! From their point of view it’s better to leave some kind of trace than none.

By: DaveG

DaveG — Tue, 29 Mar 2005 18:23:03 +0000

How about just renaming the form elements to be something else? For example (substitute square brackets for echelons):

[input name="melon"/] Name (required)[br/]
[input name="bison"/] Mail (will not be published) (required)[br/]
[input name="happy"/] Website
[textarea name="airvent"][/textarea]

I don’t think spam bots will be able to interpret that, and it doesn’t require ANY authentication.