Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to beat comment spam

dendory.net

Post reply on HN
Print view View original

71–80 of 107 posts

Re: How to beat comment spam

#71

Post by flomo »

jackalope wrote: post #31
obituary_latte wrote: post #18

I recently set up a WP site and forum for a product my brothers are trying to sell. We're not allowing commenting on WP, but obviously have to allow people to post on the forum. The forum software offered a couple of (unofficial) anti-spam plugins, but they were not effective at all. Decided to try re-captcha, but found that to be equally ineffective (hadn't read about just how broken re-captcha is until this inciden…

I use browser plugins that allow me to avoid using the mouse (Vimperator for Firefox, for example). It's not unusual for me to run a search query and view several sites using only the keyboard. I'm replying to your post now without ever touching the mouse. I think your approach is clever and the advantages may outweigh the disadvantages, but it may need some refinement to avoid false positives.

Yes, I'm not sure if this approach would pass the Accessibility test. (Think text-to-speech browsers, customized control setups, and so on. Some people really cannot use a mouse.)

Re: How to beat comment spam

#72

Post by nollidge »

krapp wrote: post #27
obituary_latte wrote: post #18

I recently set up a WP site and forum for a product my brothers are trying to sell. We're not allowing commenting on WP, but obviously have to allow people to post on the forum. The forum software offered a couple of (unofficial) anti-spam plugins, but they were not effective at all. Decided to try re-captcha, but found that to be equally ineffective (hadn't read about just how broken re-captcha is until this inciden…

Apart from captcha farming what are the issues with recaptcha?

They tend to be either too easy for AI to guess, or too hard for even a human to read.

Re: How to beat comment spam

#73

Post by zalew »

eli wrote: post #55
ryanwanger wrote: post #51

Earlier quoted context omitted.

Blocking any spam that contains a link is helpful, for sure, but doesn't get everything. Every few months I see waves of comments like: "Really graet article. We need more people like you in the world." Each comment has exactly one pair of transposed letters. There is no product being pitched, and no url (we don't display or link to email address either). It's baffling.

Some blog platforms whitelist comments from people who have had previous comments approved. I'm pretty sure these meaningless (but positive) comments are an attempt to get on that list.

yes. also some platforms (mostly forums, less of blogs) allow editing of posts, so forum spammers sometimes post meaningless crap only to replace it later with spam.

Re: How to beat comment spam

#74

Post by stcredzero »

eli wrote: post #55
ryanwanger wrote: post #51

Earlier quoted context omitted.

Blocking any spam that contains a link is helpful, for sure, but doesn't get everything. Every few months I see waves of comments like: "Really graet article. We need more people like you in the world." Each comment has exactly one pair of transposed letters. There is no product being pitched, and no url (we don't display or link to email address either). It's baffling.

Some blog platforms whitelist comments from people who have had previous comments approved. I'm pretty sure these meaningless (but positive) comments are an attempt to get on that list.

We should be able to detect that by looking for large numbers of posts with small edit distances. That will contain false positives, but looking for very large numbers should mitigate that.

Re: How to beat comment spam

#75

Post by jiggy2011 »

From my experience running popular open source applications seems to pretty much guarantee spam.

For example, We built a website with a forum some years back and used phpBB. Within days massive amounts of explicit porn had been posted all over it and we had a client threatening to sue.

We tried everything we could to get rid of it, stopping images/hyperlinks from being posted, adding captchas , anti-spam plugins and doing stuff like adding sneaky hidden form fields.

At one point we even deleted the signup form and required administrators to create accounts by hand on request for users, yet the bots still somehow managed to create their own accounts on the forum.

None of it worked for over a month at a time.

In the end I just built a super simple php forum by hand in a few hours with very rudimentary anti-spam since it was a small forum and we weren't using many phpBB features anyway.

Took over a year for the bots to come back and at that point switching the HTML around and changing the form field names seems to have kept them away thus far.

Re: How to beat comment spam

#76

Post by gambler »

threedaymonk wrote: post #34
obsession wrote: post #5

I don't think Javascript tricks work very well against motivated spammers. It is trivial to use headless WebKit client to execute Javascript and ajax requests.

I'm reading this thread whilst running a full-stack test suite against my app - using a headless WebKit client. I expect spammers will do the same if and when the JavaScript-unaware methods stop yielding an acceptable return, but given their low costs that threshold may be a long way off. I use something similar in my own site: a field in which the commenter is asked to fill a specific value. If they're running JavaS…

Progressive enhancement for bot detection... I like your idea. This is much, much better than simply stopping anyone without JS enabled from using the form.

Re: How to beat comment spam

#77

Post by shrub »

tomwalsham wrote: post #53

My personal favourite quick-fix (which doesn't stand up to targeted attacks, but is a very effective band-aid), is to put the following : Then disallow any form submissions server-side which contain a value for 'website'. Automated bots can't resist filling out that field.

This happened to me recently with a WP blog. It happened quite by accident, however, since the client just didn't want the website field. When comments still came in with a URL, the client was concerned that I had screwed up - but it clicked right away for me that these must be bots. It might have been a little disheartening for the client, since a number of these spam messages were along the lines of "I have never read such a great article. I have bookmarked your blog and will come back every day to read more of your insightful posts." What unaware blog owner wouldn't want that on their comments? Crafty spammers.

Re: How to beat comment spam

#78

Post by krapp »

eli wrote: post #59
obsession wrote: post #5

I don't think Javascript tricks work very well against motivated spammers. It is trivial to use headless WebKit client to execute Javascript and ajax requests.

Nothing works against motivated spammers. For high value sites, they pay real humans to operate real browsers to post spam comments on your site.

Clearly the answer then is to kill all the humans.

Re: How to beat comment spam

#79

Post by whyhellothere »

vidarh wrote: post #39
whyhellothere wrote: post #17

Unfortunately (at least in the UK) this technique cannot be used on consumer facing sites as it breaks the accessibility of the form for some disabled users. For personal sites it really comes down to your preferences. Personally I would prefer that everyone was able to comment, however if it stops you having to wade through thousands of spam messages every day I can see the point of using it.

Why would this be an accessibility problem? I don't see why screen readers would have a problem dealing with it - for them the form in the users browser will appear just the same as it otherwise would.

You are right to question this. There does seem to be a bit of a long standing myth that ALL javascript is bad for accessibility: http://www.brucelawson.co.uk/2011/javascript-and-screenreade...

In this case though, from an accessibility point of view there are a few issues with the use of a link tag rather than the standard form 'input submit' or 'button'.

Problems include:

- It goes against user expectations of how the form functions

- User would not be able to submit the form while focus is on one of the inputs (although this could be remedied with more js)

- User would have to realise that this form does not have a standard submit button and realise that the link tag is the submit button (difficult for screen readers because there are no alt tags).

There is also an issue with usability for the few who don't have js enabled, as they will not be able to submit this form.

Post reply on HN