21–30 of 107 posts
I may not have reverse engineered it fully, but something like this will allow me to post images around the internet that actually create comments on your site by the IP of the visitor.
http://dendory.net/blog.php?id=5078058e&cn=Kudos&cp=... />
I was in the business of fighting web spam for over 5 years (Defensio) and while these techniques help, they're not the definitive answer. Spam bots are now extremely sophisticated and have been able to execute Javascript and "read" and understand web pages for many years. They'll also post bogus comments that are somewhat related to your article but sneak in a fishy URL in there. We had many false-positive reports t…
I think the kind of defense you need to use depends on what kind of website you have. Based on my experience if you have a small/medium website you won't find bots that execute javascript, understand a web page or use human spammers. Those are reserved for the big ones, for all the others is mostly general-purpose bots that try every form they can find on the internet. Where speed is most important than accuracy spam…
I recently set up a WP site and forum for a product my brothers are trying to sell. We're not allowing commenting on WP, but obviously have to allow people to post on the forum. The forum software offered a couple of (unofficial) anti-spam plugins, but they were not effective at all. Decided to try re-captcha, but found that to be equally ineffective (hadn't read about just how broken re-captcha is until this inciden…
I recently set up a WP site and forum for a product my brothers are trying to sell. We're not allowing commenting on WP, but obviously have to allow people to post on the forum. The forum software offered a couple of (unofficial) anti-spam plugins, but they were not effective at all. Decided to try re-captcha, but found that to be equally ineffective (hadn't read about just how broken re-captcha is until this inciden…
Nice idea. I tend not to use the mouse a whole lot once the 'reply' link has been clicked, have you had any complaints of legitimate posts being lost?
I'm wondering if adding a check for key down/up events would mitigate this potential issue since a spam bot is not likely to generate those either.
I was in the business of fighting web spam for over 5 years (Defensio) and while these techniques help, they're not the definitive answer. Spam bots are now extremely sophisticated and have been able to execute Javascript and "read" and understand web pages for many years. They'll also post bogus comments that are somewhat related to your article but sneak in a fishy URL in there. We had many false-positive reports t…
I wonder if eventually people will just stop allowing hyperlinks in comments altogether. It would, at a stroke, eliminate the biggest incentive for spam. Yes, it's nice (I guess) when someone's name is a link to their personal website or they can post the URL of a relevant article in the comments, but it's not like commenting ceases to be valuable without those features.
I recently set up a WP site and forum for a product my brothers are trying to sell. We're not allowing commenting on WP, but obviously have to allow people to post on the forum. The forum software offered a couple of (unofficial) anti-spam plugins, but they were not effective at all. Decided to try re-captcha, but found that to be equally ineffective (hadn't read about just how broken re-captcha is until this inciden…
I recently set up a WP site and forum for a product my brothers are trying to sell. We're not allowing commenting on WP, but obviously have to allow people to post on the forum. The forum software offered a couple of (unofficial) anti-spam plugins, but they were not effective at all. Decided to try re-captcha, but found that to be equally ineffective (hadn't read about just how broken re-captcha is until this inciden…
The number 1 effective thing we have found to do is to not allow hyperlinks to be posted if they are not trusted (not enough rep/point/score whatever)
Overnight it basically stopped the spam wave. Your removing the one thing of value for them, a hyperlink. I'm a big fan of accessibility and this works well with it. The only other technique we use is honeypot form fields which do catch a fair few, but nowadays a lot of spam I suspect is paid human spam.
We got hit with a huge wave recently, that sent over 40,000 visits a day to our site and nearly ground it to a halt. The number 1 effective thing we have found to do is to not allow hyperlinks to be posted if they are not trusted (not enough rep/point/score whatever) Overnight it basically stopped the spam wave. Your removing the one thing of value for them, a hyperlink. I'm a big fan of accessibility and this works…