Thu. Dec 22, 2005
Spammers Kill Kittens and Hate Christmas
I’ve had to turn on comment moderation here, due to an escalation in the Spam Wars. So if you leave a comment here, you’ll get a message that it’s being held for moderation. But I assure you that as long as it isn’t spam, it will be approved.
Hopefully it will be a temporary measure. Textpattern users have been quite fortunate because [1] the software is pretty spam-hardened out-of-the-box, and [2] it has not been targeted for comment spam in the way Movable Type and Wordpress have.
I have evidence that #2 has changed. I think I’ve gotten five or six manually entered spams this entire calendar year. Until today, when I got about 10. In addition, they were pretty standard drug spams, so I don’t know why they weren’t stopped by server level mod_security at my web host, but that’s another issue. I’ve dealt with that manually as well.
However, a not-so-little bird has told me that help is on its way. As is the case in war, an escalation by one side (spammers) is met by an escalation on the other (Textpattern developers). But for now, at least until this current rash subsides, comments will be moderated.
‘Cuz I hate spam.
Later: I guess it’s going around, and they’re likely starting with the Textpattern sites that have the highest Page Rank (i.e., they hit John a day or two before they got around to me)
Even Later: After a temporary fix linked in the comments, I’ve turned moderation off to see the SpamBastard is now blocked.
Published 11:44PM, Thu, Dec 22 2005
Category: PhotoDude Dot Com
Previous: «« The War on Extraordinary Executive Orders ««
Next: »» A Day of Peace, Goodwill, and Spare Parts »»
Peanut Gallery
The “Preview� doesn’t eliminate the possibility of a spambot, it just adds an extra step unlike anything needed to spam-attack MT or Wordpress. But that doesn’t mean you can’t write a ‘bot specifically to target Textpattern sites. And if you did so, you’d start off by hitting those with a Page Rank of 6 or better.
I think it is also critical to remove any spam that slips through, as quickly as possible. Their goal is to get indexed in Google, and that happens here at least once per day, so I get it gone as quick as I can. Secondly, they then use Google to find sites where spam has been left … and did not get deleted, but made its way into Google’s index.
These sites then get an extra dose for being such good sports. It’s the Broken Windows Theory, taken to the web.
However, I am beyond certain that the Txp developers are on the case on this. All I can say is that when version 4.0.3 comes out (Real Soon Now), grab it.
Spambots are the only reason why you have to have one comment approved before you can post away at my site. Since I don’t get much traffic, I’m largely ignored, but I’ve noticed that about every two weeks, I get a passel of spambots in the moderation queue. They all usually come within an hour of each other, and it’s usually only 8-10 spams. Weird.
On the whole, I’ve found my method to be beneficial. It also keeps out the riff-raff, because I can just delete a comment from some drive-by in the moderation queue with no problem. I’ve only had one person ask me why I disapproved their comment and I replied, “I don’t let stray animals come into my house and piss on the furniture.”
I wish Textpattern had that level of moderation, but it’s all or nothing. The one-time approval would be beneficial.
I also wish that full moderation could be used only on older entries. As it is now, you can set the length of time before comments are turned off on an article (mine is set for six weeks). But it would be nice to have an option that said “after six weeks, change comments from open to moderated.”
Most of the spambots seem to hit older articles (just the odds, I’m guessin’), so most people close them up completely. It would be nice to have the half measure of moderation after a certain length of time.
At any rate, the help linked above seems to be working like a champ for now, pending further escalations. So I’m leaving moderation off for now.
Thanks for the plugin link. So far, no spam. And my client decided she didn’t really want the phpBB anymore since the only traffic it was getting was from spammers. so I shut that down free of charge.
PHPBB can be modified with a small enhancement which creates a gif file dynamically with a 5 letter code that must be read with human eyes and typed in to be able to register. That keeps the spam bots out completely, in my experience.
I have a contact page on one of my sites US41.org where I created an extra field and wrote above it: type in the number forty one forty one forty one in numbers in this field to contact me.
It shut down all of the spam I was getting from that site.
Wordpress similarly has a host of anti-spam plugins, not the least of which is a similar “enter the number you see in the picture to post” which keeps out all spam.
You guys don’t give up – the spammers don’t have us completely beat yet.
However, I do hope that those cowards in Washington will eventually come to understand that spammers belong in the stocks in the middle of the town square where they can receive the public urination that they deserve.
It seems that the good guys are currently behind on all fronts of this arms-race. All of my e-mail accounts have been seeing a spam-spike since mid-autumn.
(Don’t know about site traffic. I shut down both comments and trackbacks to failedmc long ago, since nobody but spammers ever used them.)
I forgot to mention that Textpattern 4.0.3 is now out with some new anti-spam measures.



I guess I’m simple, but I didn’t think spambots could get past the textpattern Preview requirement. Damn, looks like I have to make some changes. I had to dump Wordpress over spambots. I recently have been dealing with referrer spam on my other sites. Then I’ve got a client using phpBB who’s getting registered user spam with links to all their happy Russian porn and casino sites. I showed her how to delete them, but she doesn’t, and when I offer to do it for her, she “doesn’t have the money�, but I do it anyway. I’m a hair’s breadth away from shutting down registrations and comments on her site.