Live data from Hacker News

How to beat comment spam

dendory.net

1–10 of 107 posts

Re: How to beat comment spam

#2
Idea is good for massive/popular spam bots. But... well... I've been there and I know, that spam bots evolve if only there is someone, who can tune bot a little. So changing bot from looking for submit button into just submiting form is quite easy. Also - technology goes forward and there's no big problem today to write bot, that understand JavaScript. And as I have mentioned this - the best solution, I've found to fight spam bots is to create hidden (or visible, what the hell) field with initial value, that's later changed by JavaScript. Checking for value, you expect it to be set by bot works like a charm. But - as long as you say, that this solution works, it's worth mentioning and remembering.

Re: How to beat comment spam

#3
Another technique I find to be working really well is the "honeypot" technique. I create a CSS-hidden input field with a delicious, attractive name "url" and then validate it to be empty.

Re: How to beat comment spam

#4
this is amazingly simple and brilliant. thanks for sharing. it is going to be too difficult for the bots to learn to get around that for quite some time, so now it's the time to enjoy this defense mechanism. once it becomes the ordinary thing, the bots will evolve too for sure but we're not quite there yet.

Re: How to beat comment spam

#6
This is a cat and mouse game. If enough websites out there use this technique then there will be bots that can circumvent this, although some non-trivial amount of work is needed to parse the javascript.

Re: How to beat comment spam

#7

I don't think Javascript tricks work very well against motivated spammers. It is trivial to use headless WebKit client to execute Javascript and ajax requests.

Thats for bots customized to run on your site. There are generic spider-like bots that look for forms they can submit into, without knowing anything about the sites architecture.

Re: How to beat comment spam

#9
post #6

This is a cat and mouse game. If enough websites out there use this technique then there will be bots that can circumvent this, although some non-trivial amount of work is needed to parse the javascript.

Not really hard at all, you can automate a browser using phantomjs and it's really fast too.

Re: How to beat comment spam

#10
post #8

Why don't bots just fill in the form then trigger a click on the anchor?

i suppose because the bot is not a browser but a service that gets the page, parse input fields and possible tokens and send request to the page that the form would post to.
Post reply on HN