How to beat comment spam • Hacker News Board

Re: How to beat comment spam

#61

Post by Simucal » Fri, Oct 12, 2012, 2:56 PM UTC

eli wrote: post #56

Simucal wrote: post #36

Earlier quoted context omitted.

Maybe the barrier to posting a comment should be low if you don't have a hyperlink but if you include one then you have to jump through some hoops (captcha's, etc).

I implemented that with some success. Much more successful was to simply require Javascript.

Interesting. Why do the bots run with JS turned off?

Re: How to beat comment spam

#62

Post by JimWestergren » Fri, Oct 12, 2012, 2:59 PM UTC

With 5 lines of PHP I was able to block 94,94% of the spam on a WordPress blog. I simply checked how long time it took for reading my article, writing and submitting a comment. Less than 10 seconds = block with a friendly message. Code and more details here: http://www.jimwestergren.com/a-new-approach-to-block-web-spa...

Re: How to beat comment spam

#63

Post by eli » Fri, Oct 12, 2012, 3:08 PM UTC

Simucal wrote: post #61

eli wrote: post #56

Earlier quoted context omitted.

I implemented that with some success. Much more successful was to simply require Javascript.

Interesting. Why do the bots run with JS turned off?

To be clear, we're talking about an automated process that is looking for forms to fill out. It's far easier and faster to simply scrape the HTML of a page and look for the and tags to figure out what to submit than to actually fire up something that resembles a real browser.

Re: How to beat comment spam

#64

Post by fooyc » Fri, Oct 12, 2012, 3:14 PM UTC

Kudos wrote: post #21

You accept comment submission via GET requests? I may not have reverse engineered it fully, but something like this will allow me to post images around the internet that actually create comments on your site by the IP of the visitor. http://dendory.net/blog.php?id=5078058e&cn=Kudos&cp=... />

You can do that with POST too if the site doesn't have CSRF protection ;)

Re: How to beat comment spam

#65

Post by pkulak » Fri, Oct 12, 2012, 3:20 PM UTC

Yup. You just have to make your system a bit unlike everyone else's. I just hid my normal comment field with css, and made a new, visible one with a different name. Any comment that came in with the old parameter name was chucked. Done and done.

Re: How to beat comment spam

#66

Post by Kudos » Fri, Oct 12, 2012, 3:49 PM UTC

fooyc wrote: post #64

Kudos wrote: post #21

You accept comment submission via GET requests? I may not have reverse engineered it fully, but something like this will allow me to post images around the internet that actually create comments on your site by the IP of the visitor. http://dendory.net/blog.php?id=5078058e&cn=Kudos&cp=... />

You can do that with POST too if the site doesn't have CSRF protection ;)

You cannot do it in drive-by format like you can with a GET. It's passive and can be posted almost anywhere, message boards, email, Facebook.

Re: How to beat comment spam

#67

Post by 1qaz2wsx3edc » Fri, Oct 12, 2012, 4:03 PM UTC

Kudos wrote: post #66

fooyc wrote: post #64

Earlier quoted context omitted.

You can do that with POST too if the site doesn't have CSRF protection ;)

You cannot do it in drive-by format like you can with a GET. It's passive and can be posted almost anywhere, message boards, email, Facebook.

Drive-by format, that might have to go in my hacker news dictionary of awesome.

Re: How to beat comment spam

#68

Post by mratzloff » Fri, Oct 12, 2012, 4:14 PM UTC

Kudos wrote: post #21

You accept comment submission via GET requests? I may not have reverse engineered it fully, but something like this will allow me to post images around the internet that actually create comments on your site by the IP of the visitor. http://dendory.net/blog.php?id=5078058e&cn=Kudos&cp=... />

Step 1: Link to a dynamically generated comment from my website

Step 2: Google, Bing, and others index my site

Step 3: Every bot that crawls my site is now a spambot

Re: How to beat comment spam

#69

Post by driverdan » Fri, Oct 12, 2012, 4:21 PM UTC

Kudos wrote: post #66

fooyc wrote: post #64

Earlier quoted context omitted.

You can do that with POST too if the site doesn't have CSRF protection ;)

You cannot do it in drive-by format like you can with a GET. It's passive and can be posted almost anywhere, message boards, email, Facebook.

You can with simple JS posting a hidden iframe. This obviously won't work on 3rd party sites but works just fine from sites you control.

Re: How to beat comment spam

#70

Post by driverdan » Fri, Oct 12, 2012, 4:24 PM UTC

obituary_latte wrote: post #18

I recently set up a WP site and forum for a product my brothers are trying to sell. We're not allowing commenting on WP, but obviously have to allow people to post on the forum. The forum software offered a couple of (unofficial) anti-spam plugins, but they were not effective at all. Decided to try re-captcha, but found that to be equally ineffective (hadn't read about just how broken re-captcha is until this inciden…

That seems clever but is actually a bad idea. I often browse the web with vimium and no mouse movement. I wouldn't be able to comment on your blog. There are better ways of using JS to prevent spam.