Slashdot Mirror

Any method of anti-spam that causes the user to jump through hoops is a bad design. CAPTCHAs are no more effective than a battery of tests against content at preventing spam, period. While an unscrupulous website operator can lift the CAPTCHA and get unwitting users to submit it, they can't fool systems like, say, Spam Karma that test for the characteristics of spam. I've been using it for quite a while and it's been 100% accurate in telling me what is or is not spam while providing zero inconvenience to the end user. About the only way for spammers to sneak it by is to *gasp* leave comments using a real person, a task so expensive that it's not worth it.

Hopefully they mention this in the book, but just in case:

Bad behavior: kills 99% of all spam on contact
Spam Karma: kills the other 1%

I found this post by Dr. Dave, maker of Spam Karma for Word Press, on the State of Spam interesting reading:

http://unknowngenius.com/blog/archives/2006/01/30/ the-state-of-spam-karma/

My interest in CAPTCHA relates directly to comment spam so I may be overly narrowing the problem. I had a couple ideas that I plan to implement at some point for dealing with this outside of CAPTCHA:

1. Require poster to give email address (as with most registration systems). Post comment for a limited period of time (say 15 min), but then have it expire if not verified by clicking link emailed to poster. (Impose a 1-3 comment per session max on posters and periodically purge database of unverified comments.)

2. When posting a comment, run a js script that imposes a 1 second delay of some sort on poster -- to thwart automated attacks. Is there a way to do this effectively? Any implemetations of an idea like this?

Most effective systems I've seen use a layered approach, so these could be layers in a system that also uses CAPTCHA situationally as well.

To my thinking, the problem is not so much coming up with a system that discrimination human problem-solving from computer but rather to come up with one that imposes costs unacceptable to automated spam-bots but acceptable to well-intentioned humans.

Do you think these would be of any use?

Tom

There's nothing wrong with anonymous commenting in WordPress. I allow anonymous comments in my blog, in the sense that you're not required to register in order to leave a comment.

What really hurts are WordPress installations that allow any kind of comment and don't have a working anti-spam system. I personally use Spam Karma 2 and my blog is spam-free.

Wordpress is an excellent open source blogging tool. Couple that with Bad behavior and Spam Karma 2 and you've got yourself a near impenetrable blog to spam in your comments. The new version of Wordpress has tools to migrate from some popular blogging systems, so.. go check it out.

• Referer Karma uses the Referer: header to find spammers
• Bad Behavior checks for specific spambot-like behavior
• WordPress HashCash calculates the answer to a hard problem to "pay" for posting

Wordpress 2.0, Spam Karma, Bad Behavior, PhpBB all completely rock.

Spam Karma 2 is great for controlling comment spam in Blogs. Although it works only in Wordpress.

There are lots of good spam-block plugins for WordPress. I basically receive *ZERO* spam comments or trackbacks that actually get through.

Personally, I use Spam Karma:
http://unknowngenius.com/blog/wordpress/spam-karma /

But there are loads of other good plugins:
http://codex.wordpress.org/Plugins/Spam_Tools

Don't complain about spam comments and trackbacks--get even and get rid of them!

Look into Spam Karma.