Keep your weblog clean!
It appears that comment spam is here to stay, and attacking the source produces little to no results. Best we can do is get rid of the pesky trash they throw our way and move on with our lives.
The more we delete - the less reason they have to continue, so with all this diligence why is the spam still around? Because not everyone appears to care. Those who don't are the ones providing the spammers a reason to continue flooding our personal web space with their greasy messages full of slimy urls. I see no reason why anyone should put up with spam in their weblog unless it's pure, old laziness. Enough is enough, there are plenty of ways you can deal with it.
- Just delete them as they arrive, this is easy if you only get a few and becomes tedious and bothersome quickly.
- If you use MT, Jay Allen's mt-blacklist is your friend. Install it, use it, learn to love it.
- Close off older entries to comments. This will cut down on your spam considerably as the weasels usually arrive via google searches. Jeremy has a tip on that.
- Require registration to comment - I hate this one, but if it's the only way for you, whatever, just do it.
Sounds like bothersome, tedious work? That's because it is, but when you open your site to the public and allow them to leave a mark on your pages you have to take the responsibility to make sure your site is not hurting the community -- otherwise you're just a selfish amoeba and need an attitude readjustment. If you don't want to do this, don't enable comments, simple as that. Just like running a mail server brings forth the responsibility of making sure spammers cannot use you, so does running a weblog, a guestbook or a forum site. Make sure spammers have no reason to target us.
One may ask, is this reallly such a big problem? You bet your sweet linux box, here's a sampling of weblog authors who appear to not give a hoot:
A few thousand words on India or a few dozen casino links?
Addicted to DSLReports or just spam?
Happy New Year and happy spam!
Good advice can I have some viagra with that?
Apparently Safari MT bookmarklet solution is playing blackjack.
Typepad isn't bug free but this entry is sure full of spam!
You also missed a hell of a lot of spam.
I don't know what this says but I know spam when I see it.
Live Journal users are not immune.
The spam post.
This just in a quick google search, I could probably dig up a few hundred more if I was so motivated. Maybe if I do a set of links like this once a week some will get embarrassed enough to clean up their act. If they notice.. not like they noticed all the spam they're hosting.
Note: If you're an owner of one of the above weblogs and came here from a trackback ping I left you, hiya, I'm glad I got your attention, now clean up please, you're helping spammers.
Comments
"Kasia Trapszo cleans community. Community in shock."
You damn right they're all in shock. You go girl.
Nut squeezing by proxy almost. Steve would be proud.
Posted by: david | February 27, 2004 09:43 PM
Steve is :-)
Posted by: Steve Friedl | February 27, 2004 09:45 PM
Hi!
Thanks for the slap across the face :)
I used to delete them as they came, but they just came faster adn faster, and I found myself spending more time deleting spam than blogging. One day, there was a bot that spammed every single post in my archives (about 250 of them) at one shot. That was the point where I gave up. I think I've had it with MT. I'm trying to be regular in my Live Journal (link above) which is clean and sweet. Do visit :)
Posted by: Mahesh Shantaram | February 28, 2004 12:48 AM
There's better ways of stopping spam in MT than mt-blacklist. mt-blacklist is just simple keyword-based filtering, meaning that it's rather easy for it to get false positives while also getting false negatives.
From what I've seen, the hidden-key mechanism (where you put a key in the form which isn't a standard part of the MT comment form, preferrably one unique for each page and, even better, comprised of a hash of the user's User-Agent and a per-page pseudo-random number) works exceedingly well.
Also, if you have a phpBB forum already, you might want to look into some work I did for integrating phpBB with MT: http://trikuare.cx/mt/archives/000425.php
phpBB's anti-spam measures are much more robust than MT's (granted, MT is catching up in most regards in 3.0, but it'll take a while), and it has the added benefit of requiring user registration if they're going to link back to a URL as their 'personal site' or whatever. Also, phpBB's moderation interface is WAY better than MT's (which was the main reason I switched to begin with).
Posted by: fluffy | February 28, 2004 02:57 AM
I used to have tons of comment spam on my blog (MT), but none anyomre. No need for blacklists or keyword-based filtering either.
The bots that spam you just pretend that it hit the "Post" button. You will agree that this is a stupid hack, but it should be enough to fool the bots. Simply change the "value" parameter in the "Post" HTML button in the comments template to something other than "post" and hack the appropriate MT perl module so that it accepts that value.
The module you want to edit is MT::App::Comments, look around for $q->param('post') and change it to whatever you want.
Works perfectly for me.
Posted by: asdf | February 28, 2004 02:47 PM
Oops, I think I meant to say that you should change the "name" parameter in the button, not the "value" parameter..
Posted by: asdf | February 28, 2004 11:59 PM
I cleaned up my act last year. I met a very unsavoury person from the nether regions of the internet. It was then that I spent a week making sure that all content was verified before being posted.
Posted by: Arden Wiebe | March 1, 2004 11:13 PM
Comment spam hit b2++ last year and on my site we offered weblogs to other users. If those users didn't maintain their blogs the comments would persist and be indexed by Google. Now it's fixed. How? Comment moderation. All comments have to be verified by the blog owner before they're displayed. Attempts at spamming have practically stopped now :)
Posted by: Donncha | March 2, 2004 08:15 AM
"Require registration to comment - I hate this one, but if it's the only way for you, whatever, just do it."
I hate it, too, but there may be a way to lock out the spambots without having to require registration for users who want to post. It won't help prevent stuff that was cut and pasted by humans, though.
I'm not a MT user, but I know that PHP-Nuke (I know there's a difference between PHP and Perl :)) has a feature where you can't even log in without typing in a randomly generated "secret" number that is in a graphic that cannot be OCR'd. In other words, when you log in, you also need to type in a 6 digit number that appears next to the log in information. This is to prevent brute force attacks.
Could not the same thing be done in MT, even with anonymous comments? Simply require entry of the random nubmer token to verify it's a human, not a machine that can't read the graphic information, and the bots should be locked out.
At least, I think it would work.
Posted by: mospaw | March 3, 2004 07:52 AM