Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to beat comment spam

dendory.net

Post reply on HN
Print view View original

51–60 of 107 posts

Re: How to beat comment spam

#51

Post by ryanwanger »

TomGullen wrote: post #29

We got hit with a huge wave recently, that sent over 40,000 visits a day to our site and nearly ground it to a halt. The number 1 effective thing we have found to do is to not allow hyperlinks to be posted if they are not trusted (not enough rep/point/score whatever) Overnight it basically stopped the spam wave. Your removing the one thing of value for them, a hyperlink. I'm a big fan of accessibility and this works…

Blocking any spam that contains a link is helpful, for sure, but doesn't get everything. Every few months I see waves of comments like: "Really graet article. We need more people like you in the world."

Each comment has exactly one pair of transposed letters. There is no product being pitched, and no url (we don't display or link to email address either). It's baffling.

Re: How to beat comment spam

#52

Post by obituary_latte »

fuzzix wrote: post #24
obituary_latte wrote: post #18

I recently set up a WP site and forum for a product my brothers are trying to sell. We're not allowing commenting on WP, but obviously have to allow people to post on the forum. The forum software offered a couple of (unofficial) anti-spam plugins, but they were not effective at all. Decided to try re-captcha, but found that to be equally ineffective (hadn't read about just how broken re-captcha is until this inciden…

"So I spent 10 minutes writing a little script that checks for mouse movement and clears a pre-populated field. If the field isn't empty, bot it is" Nice idea. I tend not to use the mouse a whole lot once the 'reply' link has been clicked, have you had any complaints of legitimate posts being lost? I'm wondering if adding a check for key down/up events would mitigate this potential issue since a spam bot is not likel…

Well, I'm not checking when people are trying to post but when they try to register--sorry if I wasn't clear.

The forum requires registration (and verification) before posting, so once they're registered there aren't any restrictions. And one of the benefits of this check is that there aren't any "human verifications" visible to the user. In fact, I could probably do away with the email validation too.

Re: How to beat comment spam

#53

Post by tomwalsham »

My personal favourite quick-fix (which doesn't stand up to targeted attacks, but is a very effective band-aid), is to put the following :

Then disallow any form submissions server-side which contain a value for 'website'. Automated bots can't resist filling out that field.

Re: How to beat comment spam

#54

Post by obituary_latte »

artursapek wrote: post #45
fuzzix wrote: post #24

Earlier quoted context omitted.

"So I spent 10 minutes writing a little script that checks for mouse movement and clears a pre-populated field. If the field isn't empty, bot it is" Nice idea. I tend not to use the mouse a whole lot once the 'reply' link has been clicked, have you had any complaints of legitimate posts being lost? I'm wondering if adding a check for key down/up events would mitigate this potential issue since a spam bot is not likel…

I think he probably starts checking for the mouse movement as soon as the page loads.

Exactly right, and there is a threshold set. Though it's not used when people try to post but rather when they try to register, I'd imagine it'd work similarly well on an "open" comment page. For a while at least.

Re: How to beat comment spam

#55

Post by eli »

ryanwanger wrote: post #51
TomGullen wrote: post #29

We got hit with a huge wave recently, that sent over 40,000 visits a day to our site and nearly ground it to a halt. The number 1 effective thing we have found to do is to not allow hyperlinks to be posted if they are not trusted (not enough rep/point/score whatever) Overnight it basically stopped the spam wave. Your removing the one thing of value for them, a hyperlink. I'm a big fan of accessibility and this works…

Blocking any spam that contains a link is helpful, for sure, but doesn't get everything. Every few months I see waves of comments like: "Really graet article. We need more people like you in the world." Each comment has exactly one pair of transposed letters. There is no product being pitched, and no url (we don't display or link to email address either). It's baffling.

Some blog platforms whitelist comments from people who have had previous comments approved. I'm pretty sure these meaningless (but positive) comments are an attempt to get on that list.

Re: How to beat comment spam

#56

Post by eli »

Simucal wrote: post #36
huskyr wrote: post #35

Earlier quoted context omitted.

Seems pretty effective indeed. If i look at the caught spam on my blog all of them have hyperlinks in either the 'website' field or the comment text itself. Pity it also targets normal users that simply want to post a hyperlink :(

Maybe the barrier to posting a comment should be low if you don't have a hyperlink but if you include one then you have to jump through some hoops (captcha's, etc).

I implemented that with some success. Much more successful was to simply require Javascript.

Re: How to beat comment spam

#57

Post by eli »

gabemart wrote: post #19
cmer wrote: post #13

I was in the business of fighting web spam for over 5 years (Defensio) and while these techniques help, they're not the definitive answer. Spam bots are now extremely sophisticated and have been able to execute Javascript and "read" and understand web pages for many years. They'll also post bogus comments that are somewhat related to your article but sneak in a fishy URL in there. We had many false-positive reports t…

I wonder if eventually people will just stop allowing hyperlinks in comments altogether. It would, at a stroke, eliminate the biggest incentive for spam. Yes, it's nice (I guess) when someone's name is a link to their personal website or they can post the URL of a relevant article in the comments, but it's not like commenting ceases to be valuable without those features.

I thought that would happen as more people added rel=nofollow to links in comments... hasn't happened yet though.

Re: How to beat comment spam

#58

Post by eli »

Kesty wrote: post #16
cmer wrote: post #13

I was in the business of fighting web spam for over 5 years (Defensio) and while these techniques help, they're not the definitive answer. Spam bots are now extremely sophisticated and have been able to execute Javascript and "read" and understand web pages for many years. They'll also post bogus comments that are somewhat related to your article but sneak in a fishy URL in there. We had many false-positive reports t…

I think the kind of defense you need to use depends on what kind of website you have. Based on my experience if you have a small/medium website you won't find bots that execute javascript, understand a web page or use human spammers. Those are reserved for the big ones, for all the others is mostly general-purpose bots that try every form they can find on the internet. Where speed is most important than accuracy spam…

It depends. I can tell you from experience that even a medium-sized website that ranks well on (legitimate) pharmaceutical terms is a huge target for spammers.

Re: How to beat comment spam

#59

Post by eli »

obsession wrote: post #5

I don't think Javascript tricks work very well against motivated spammers. It is trivial to use headless WebKit client to execute Javascript and ajax requests.

Nothing works against motivated spammers. For high value sites, they pay real humans to operate real browsers to post spam comments on your site.

Re: How to beat comment spam

#60

Post by jarofgreen »

I tried to comment on the original blog post in both FireFox and Chrome and it just said "Comment not sent!".

Anyone else?

Might this code be shutting out legitimate users? (Apart from the fact that if you have JS turned off you can't comment, that is.)

Post reply on HN