Spam Rapidly Increasing In Weblog Comments

dsurber writes "BBC News has a nice article discussing 'flyblogging', the phenomenon of spammers leaving advertising-related posts on personal weblogs. The writer comments: 'None of the other blogs I contribute to or run has been affected yet, but I can only assume it is a matter of time before the spammers move in, as they did first with UseNet and then with e-mail. It depresses me to think that any open medium can be so easily undermined by people with no scruples, no sense of responsibility and no idea of the damage they are doing.'" It seems a little surreal that people are having to develop anti-spam weblog tools.

Comments

Wikis too?

[Thinkit3]

They would seem vulnerable to spamming. I was on a lojban wiki for awhile which was under the radar enough to avoid it, but don't know about now.

Re:Wikis too?

[lacrymology.com]

How dare you post this here to give all of the spammers an idea you insensitive clod! Haven't you ever heard of security through obscurity? You just as bad as that box-cutter college kid and those dangerous white hats! -m

Here's My Solution

[notsewmit]

Since most blog spammers will search for "Remember personal info?" in various search engines to quickly find personal blogs, I edited my MovableType templates. Now, instead of saying "Remember personal info?" on the comments page, I have something else that spammers don't normally search for.

Re:Here's My Solution

[jparp]

Interesting idea!

How about, a "spam" button beneath every comment, accessible to rigestered users. The message then gets put in the spam pile, to be deleted after a certain amnount of time.

Also, if the editor notices a registered user labels non-spam as spam, he could ravoke that users use of the spam button.

If it still gets out of hand, it would have at least been an interesting experement.

Re:Here's My Solution

[JWSmythe]

I wrote something like that into a messaging system that I wrote once..

If you go to voyeurweb.com (warning, porn site), and select any set of pictures, at the bottom there's a link where users can post their comments.

Anyone can write there, and frequently enough they write really rude comments. The people contributing the pictures don't like it, the people posting nice comments don't like it, so I added in a button, that simply keeps a record of how many people have clicked the alert button. The text of it is:

"Alert! Click Here to let the VW Ops know if this is a rude message."

The idea is simple enough, it remembers (SQL DB, of course) how many unique complaints were made about a particular message, and the message monitors get that list, sorted by the number of complaints. The users are pretty good about complaining, and are more than happy to click the button.

It's fairly free of abuse, because messages that have more complaints from more users are the bad ones. Of course, there are people who complain about perfectly normal messages, but that's why we have people actually reviewing the messages before they're removed.

There's a whole lot more to it than just the alert button,

To me, it's very wierd, it's an adult site, and you'd think that most people are just there to look at the pictures, but there are a significant number of people posting messages there, and they are just about as fanatical about it as /. posters are about /. . :)

The system as a whole works very well. We have 3,363,465 messages in the system (I purge old messages every few months), 5 alerts that haven't been read, and 43 IP's or networks that have been blocked. They have the power to prevent any size network from posting in the future, if the abuses have been bad enough. Most of the abuse and filtering features have grown with the messaging system over the years. When I originally wrote it, it didn't have or need any of it. It's fairly complete now, I haven't done any significant changes in years.

This is why...

[Sanity]

...you need Locutus! Its absolutely FREE and works with Outlook, Outlook Express, and Eudora!

So why not try the best anti-spam tool on the market and wave goodbye to those pesky spams?!

Re:This is why...

[Mysticalfruit]

I guess I just saw a blog as a different thing from what other people are using.

I login to my blog page and add to the running log. No place for people to spam.

Though as a side note, I love getting spam about anti-spam software!

Re:This is why...

[brianosaurus]

Some people like to get comments about their blog entries. My mom actually asked if I could set up mine so she could leave comments. I'm still, uh, working on it.

With the massive adoption of programs like Moveable Type, the spammer's jobe becomes easier, since they only have to locate a new MT site and point their bots at it. Its pretty pathetic that they're even doing this, but not more than I'd expect from a bunch of bottom-feeders.

Mod

[CGP314]

Perhaps these 'web logs' could come up with a kind of 'moderation system' to let users filter out the crap.

Re:Mod

[Anonymous Coward]

Oh please, it doesn't even work on Slashdot half the time. Intelligent posts get modded down all the time because they're not the majority opinion.

Re:Mod

[orthogonal]

Oh please, it doesn't even work on Slashdot half the time. Intelligent posts get modded down all the time because they're not the majority opinion.

Mod heretical parent down!!

Baa! Baa!

Re:Mod

[sharkey]

Trouble is, the advertizers will just rebrand themselves as "editors", and forge ahead anyway.

Google?

[The Tyro]

How much truth is there to the statement that increased links equal increased google rank?

This article implies that all these postings are an effort to stack the google rankings, in order to place spam sites near the top. I'm not a google wizard... is this actually a usable loophole in google's ranking system?

Re:Google?

[realdpk]

Yes. That's partly why Google's search results are nearly useless any more - especially while looking for information about specific brand-named products. This whole blog-spam thing has been known about for a very long time, and I have yet to see it addressed - I'm surprised that it's finally picked up by the media though. Maybe that'll force Google to update their ranking code before their IPO.

Re:Google?

[devphil]

How much truth is there to the statement that 2 + 2 = 4? A lot. Why? Because that's how it's defined to work.

How much truth is there to the statement that increased links equal increased google rank?

Uh, that's how Google documents it. That's how all of Google's employees define it. That's how everybody's experience pans out. Maybe they're all just making shit up with nobody ever calling them on it, but I'd argue for "that's actually how it works" myself. Try going to Google and clicking "About".

is this actually a usable loophole in google's ranking system?

Only if the log owners let the spam sit there long enough to be googled. If they do that, then my guess would be quite possibly yes.

Maybe compile a list of such spammers, then a list of the advertised sites. I'd like a checkbox on my google searches that says, "Ignore results on sites whose page rank is mostly due to asshole tactics."

Re:Google?

[Lagged2Death]

My hobbyist project was picked up by Google after a while, but it wasn't until I retroactively changed my comment signature here on Slashdot and on Kuro5hin (thereby creating many links to my project page) that it went to the top of the search results. It wasn't my intent to subvert Google in any way - I was quite surprised by the dramatic result.

There have been some less-than-scrupulous advertising companies in the business of that publishing dummy machine-generated web pages to exploit this trick. The dummy pages were typically filled with repitions of some nonsense paragraph, with self-links (to other dummy pages) and client-sponsored links interspersed here and there. The idea was that the self-linking would make the site look like a large, legit site to Google, which would mark it as relatively well-trusted and influential. Then Google would dutifully note the client-sponsored links and rank them highly. I believe Google has worked on ways to stop this; I don't know how successful they've been, or if the dummy-site makers are still around.

Re:Google?

[Blimey85]

Nearly useless? I thought it was just me but for the past couple of months I've been hating Google more and more. It used to be so easy to find what I wanted but I try a simple search for a name brand item and the manufacturer is the last page listing to come up it seems. What really irks me is how many listings show up for other search engines... or search services as they call themselves. It's a shame that Google has not done anything to solve this problem. Surely they could change things a bit to completely drop these so-called search services since they offer no real information and are just basically advertisements.

Arms race in the making

[jmerelo]

The arms race has just started: spambots becoming increasingly more sophisticated, and bloggers having to go to greater lengths to avoid spam.
The root of the problem might be in the impact a weblog link has on google ranking. Spammers have taken note, and they're acting on it.

I've Noticed

[Starquake]

I read LiveJournal and I have noticed this. Anonymous comments with a link to some page I guess they are hoping you will click on out of curiousity. LiveJournal allows you to easily delete such comments but like e-mail spam it is still a hassle. The solution is simple: stop buying what spammers are offering and they will go under soon after.

Re:I've Noticed

[mcrbids]

The solution is simple: stop buying what spammers are offering and they will go under soon after.

This is one of those simple-sounding, and utterly worthless "solutions".

You see, you can stop buying what the spammers are offering, but will everybody else? You see, this world is chock-full of people who just don't get it when it comes to spam. They don't realize the mechanical nature of SPAM, many think the message was sent by somebody to them personally.

Scams were common in the 20th, 19th, 18th, 15th, and 11th century, why would they stop now?

So, really, what you in fact just said was " The solution is simple: change human nature for every person on the earth to a very cynical nature and then spend billions of dollars in education so that people know what SPAM is and how best to treat it, and they will go under soon after." .

Utopia doesn't exist, and won't as long as there are people to pollute it. In the meantime, we have to deal with the fact that this world has both unscrupulous people and suckers.

The solution is to change the protocol of Email to introduce enough resistance to communication to thwart SPAM. Until that happens, SPAM will be a problem.

Re:I've Noticed

[brianosaurus]

I think the ads in the blogs are going for better Google PageRank scores, rather than for direct exposure. Most blogs don't get a whole lot of traffic, mostly just family and friends, if even that much. Only a very small percentage of that audience will click, and they surely won't fall for it more than once.

But google reads a lots of blogs. If a spammer gets their link onto a whole lot of blogs, Google PageRank would see hundreds or thousands of links to their site and bump up its rank. They exploit everyone's blog in order to improve their score on searches.

That's the theory anyway. Whether or not it works is another story.

Re:I've Noticed

[Stephen Williams]

At least with LiveJournal, you can disable anonymous comments. It means that people without LJ accounts can't comment, but I find that preferable to having my journal spammed or trolled.

-Stephen

Re:I've Noticed

[CaptBubba]

Those numbers strike me as BS. That's over the hit rate for some direct mailings.

The numbers I allways hear for spam are around 1 hit (purchase, mortgage lead, etc) per 100,000 emails sent. I've even heard 1 per 1,000,000.

Re:I've Noticed

[Saeger]

The solution is simple: change human nature

Well, we are going to have to change human nature eventually, if we want to survive alongside exponentially advancing technology where any random psychopath will be able to "press The Red Button" with exponentially decreasing effort.

I think humans are basically good when resources are abundant and life is good, but when resources are scarce (artificial or not), then the "selfish gene" goes into overdrive and people get desperate. But there's also that rare minority who have their selfish gene stuck in high gear even though they're already living like [spam]kings, because, hey, more power and more money secures *MY* genes even further, right? Screw the commons. I only care about ME and MY family and MY tribe.

--

Re:I've Noticed

[24-bit Voxel]

Do you know of any scams from the centuries you listed? (I am not confronting, I am just curious.) Vox

I have a quick and dirty solution.

[Ignorant Aardvark]

Use the same type of human verification system that Yahoo uses when signing up for an e-mail account. If you can't type in the mangled letters in the image, then your post to the weblog is ignored. This would only be required for anonymous postings - if you're logged in, presumably you've already passed the human verification test upon account creation, so you don't have to go through the hassle each time you want to post.

Re:I have a quick and dirty solution.

[Alan]

There has been some discussion on this that I've seen on various blogs I read, and basically the concensus seems to be that people don't want to make the barrier to entry of submitting a comment harder (ie: accounts), as part of the beauty of blog comments is the spontinaity. Most people I've seen have either done some of the 7 tips for a spam free blog or are using the MT Blacklist plugin.

Once I installed the latter and did some of the former, I've had almost no spam, vs several hundred over a couple of days. Now whether that is testimony to how well the tips work or that the spammers are going in short bursts then taking breaks is still unknown.

Re:I have a quick and dirty solution.

[GeorgeH]

That's called a CAPTCHA, and James Seng wrote a Moveable Type plugin to do this with MT. CAPTCHA stands for Completely Automated Public Turing Test to Tell Computers and Humans Apart, you can read more in this story

Re:I have a quick and dirty solution.

[4of12]

That excludes people who prefer to browse using text, which is what that image recognition filter effectively does. Blind people, low bandwidth folks are automatically eliminated from the community.

Requiring a periodic human response at the other end of a live email address, after a time interval, helps some. It's still possible for spammers to cultivate a temporary reputation of responsibility and spam a site as their last post, but requiring them to periodically exert effort to prove they're authentically human helps to make spamming hard work.

It wouldn't hurt for sites to start keeping a growing list of bad urls and poisoned posters. A spider that visits url's, maybe one or two deep after the posted URL (phenomena of delayed appearance of herbal viagara behind URLs that are opaque looking), checks for spam links, and assigns big negative karma would help some, especially if it runs before the posting appears on the blog.

Re:I have a quick and dirty solution.

[madstork2000]

I have a human verification engine that I use to "protect" web logs, email, and other public, but sensitive pages (like contact pages on my website). My image mangling uses base images that each have three sets of letters Red, Blue and Black, then forms random words out of 5-8 images. So to verify you have to enter either the RED, BLUE or BLACK word. If you entered it correctly you are allowed to post, send mail, look at the page, etc. There are no accounts to create, profiles, etc. I set it up to work as a module in the content management system I worte (which can accept POST NUKE plugins). Anyway, in the limited testing I have done thus far it seems to work, but since none of my sites have had a huge SPAMBOT problem, it is hard to tell. Though I am pretty confident they cannot read and understand the form, because as of now one of my bigger problems is getting people to properly read and recognize what to do. -MS2k

Uh, try disabling comments altogether...

[ccnull]

This is reason #1 why I don't allow comments on my weblog or any other site I run. Have you read the comments most people post on these things, anyway? They're even more asinine than the weblogs themselves...

Not every single web site needs to be a two-way communication system. That's what email and discussion groups are for.

Re:Uh, try disabling comments altogether...

[aliens]

Have you read the comments most people post on these things, anyway? They're even more asinine than the weblogs themselves...

Yeah I mean who reads these comments anyway? Can you imagine a site full of these asinine people writting about stuff they don't even know the first thing about?

What a stupid stupid idea ::)

Solution to the problem

[Anonymous Coward]

1) Only allow people with verified accounts to post.
2) With every post, display the advertising policy (buying an ad on the site is $5000)
3) Make sure they confirm that if their message is an ad, they agree to pay the $5000
4) Host their ad for them, and collect your money. Small claims is helpful here.

Awkward Alternative.

[CGP314]

Although the term flyblog has been used already to mean either blogging about flying, or blogging while flying, I would like to claim it for the practice of posting spam comments to people's blogs like this: I have just been comprehensively flyblogged

I like I have been splamogged much better. Just rolls off the tongue.

I have already seen this with my blog

[chrisgeleven]

It is a huge pain in the butt, especially considering that I have not found an easy way to mass delete comments with Movable Type yet...so I have to go to each comment individually and delete them.

This past week alone I cleaned out about 20 spam comments.

Re:I have already seen this with my blog

[Alan]

Just go into the database (assuming you're running off of mysql) and run something like "delete from mt-comments where author = 'spammer@whatever'" or "where website = 'http://blahpornspam.com'". Run a rebuild afterwards and all spam will be gone. Make sure you run a select on the author = or url = to make sure you know what you're deleting. Note: the actual fields aren't correct I'm sure, run 'desc ' to get them first.

I've seen the requests for a mass delete of comments in the support forums for MT as well, you're not the only one.

This was happening to my guestbook too

[Phoenix-kun]

I had the same problem with the guestbook on my website. I was used to the occasional, manually entered, advertisement that I would then promptly remove. However, suddenly my guestbook was being hit with dozens of spam advertisements at a time, all at the same time. This was taking place every couple of days. It was always the same ads with bogus compliments, but the source IP addresses would vary widely from attack to attack. A review of my access log showed spybots looking for the presence of certain common guestbook scripts, one of which I was using. Then later, the spambot would hit my site executing the scripts directly. I got around it by changing the file name of the script. Normal users to my site would follow the link and get to the guestbook with no problem. But since the spambots depended on the script being a certain name, they would fail with a 404 error.

Re:This was happening to my guestbook too

[Another AC]

We run DreamBook, a free guestbook service with about a million members, and recently the guestbook spam started getting to the point we had no choice but to do something about it. We think the way they get the list of our user's URLs is just through a google search (which has the added benefit of returning the most trafficed books where their spam will potentially be the most widely viewed).

Originally the spam was just huge lists of porn sites, from a few specific spammers. To fight that, we kludgingly added some specific urls we wouldn't allow in any post.

They figured that out, and we started getting more from all sorts of different people. So we started adding various heuristics that were kind of lame to block posts (no domains with a - in them for example).

They figured that out, and started to post all sorts of random spam, unrelated to porn, usually with just links to some other dreambook url. We were kind of puzzled about those, because when you went to their dreambook, it was blank. Viewing the source though, they'd added hidden links to their sites at that book. So it seemed they were spamming to get higher google results. Super.

So then we added system-wide a check for the same IP posting to multiple books a lot within a certain amount of time. That worked really well for a few months, but recently they've started using I guess a whole slew of proxies! So finally we now look for any URLs in their posts instead of IPs (they vary the messages they post so there's nothing else you can really look for) and filter on that.

So far it's working okay (but now with some false positives) but it's only a matter of time until they work around that as well.

Bastards!

Why let users comment on your blog at all?

[crazyphilman]

You're blogging to publish your thoughts to the world, right? Weeelllll, if your users want to say something, let them get their own blog. There's no law that says you have to start your own mini-slashdot. Make your blog read-only and the spam problem goes away.

Doesn't it?

I think the whole "open forum" thing is overrated... Look at all the junk that gets published here, on Slashdot, one of the more serious of the open forums (yeah, I know how crazy THAT comment is, but it's true).

Re:Why let users comment on your blog at all?

[poot_rootbeer]

Make your blog read-only and the spam problem goes away.

Doesn't it?

Yes, but in many cases so also will the blog's audience go away.

One of the key atttractions of small-to-middle-sized weblogs is the interactivity. If the blog author says something incorrect, you can let him know. If you have additional information pertaining to something a blogger wrote about, you can share it with her.

Without comments, blogs are just another one-way communications medium. Not to say that's an undesirable thing, but we already have plenty of those.

I've seen far worse from spammers.

[Rahga]

I've got a website.

Last year, I closed my hotmail account and two spammed-to-heck e-mail accounts. To keep old friends and family from getting shafted, I had an autoreply attatched to those addresses, announcing that those addressess were closed and that I could be reached through the contact form on my website, prior to sending those e-mails to /dev/null .

To date, through this manual entry, effort-draining contact form, I have had at least 20 offers to increase my manly-ness, 10 offers to find the love of my life, and 5 death threats from annoyed spammers. Only one charitable organization had a problem with my auto-reply, because a spammer was using their e-mail address to send junk to me over and over again.

I have had problems

[Squeebee]

Couple of things for MoveableType users:

1) If you get flooded with spam just go directly into MySQL and issue a DELETE...WHERE query, it's really too much trouble to use the MT frontend to delete multiple comments.

2) Check out MT-Blacklist at http://www.jayallen.org/misc/projects/mt-blacklist /

Legislation

[Schmucky The Cat]

This isn't that new but it's becoming a nuisance because spammers now have automated tools.

It's taken eight years since email spam became an issue for signifigant legislation to pass.

We need an easily amendable federal law that simply says unwanted, unsolicited, uncompensated advertising is simply illegal.

Usenet, fax, email, public chat, blogs, RPC messenger, any forum that allows public input for free has become a spammer magnet. They don't own it, get them out.

We need a law that says this, as a statement that to live under our social contract you can't be an annoying louse.

Re:Legislation

[Atzanteol]

Scary that somebody believes that anything annoying should have a *federal law* against it.

Would you like to be notified when the U.S. becomes a military state, or would you rather be thrown up against the wall when the time comes?

Every day I wish people would stop putting more and more control of their daily lives into the hands of Uncle Sam. Remember, the more control the government has, the less control you have.

I've been seeing this for months

[einer]

I run a phpbb based blog, for my friends and family, and it is definately a problem. So far, the only solution I've found is to block all users who register with an e-mail address from .ru and .tw. This is obviously a sub-optimal solution.

It's frustrating on so many levels. The spammer always sees a hit from your website in their logs if you do a background check on the user (you have to visit the site in order to realize it's spam), so the insentive to spam is reinforced. On the other hand, you run the risk of deleting a user who is truly interested in your site if you don't investigate their profile information.

Unfortunately, it's really easy to use google to find phpbb based sites, and it's just as easy to write a script to register yourself with all of these sites. The signal to noise ratio is making it hard for me to justify the admin time costs of running a public site.

The other (not as easy) solution is to modify your site code in some non-standard way so that their scripts fail.

To hell in a handbasket, i tell you!

[Dwarfgoat]

This is why I had to shut down the guestbooks on several of my sites. It didn't help when I changed the input form, then used a new URL for the posting page, THEN deleted any connection to the CGI script whatsoever. It was only after deleting the script from my webspace that it stopped.

My hosting company was unsympathetic to my pleas for help. Needless to say, I now host elsewhere. I mean, sheesh...my mother reads that that thing. The last thing I want to think about is her and my dad...and viagr^H^H^H

*shudder*

Solutions

[ChuckDivine]

One blog I frequent -- Samizdata (a libertarian site) -- was recently hit with this kind of stuff. They've initiated a technology that forces people to enter a code supplied on the comments page before being allowed to post a comment.

Slashdot's moderation feature may also help with this problem. If the spammer's goal is to be seen, rather than just Googled, moderating down spam as offtopic or some other negative category may help reduce that visibility.

Don't be rediculous

[Sanity]

That would lead to censorship by majority and the inability to say anything that contradicts the weblog's collective "groupthink" without getting moderated down.

*ducks*

Re:Don't be rediculous

[quacking duck]

You got modded up. Conformist!

Re:Don't be rediculous

[CGP314]

Actually, I think a bigger problem would be audience size. You need to reach a certain critical mass before the moderation system would work. Most blogs, my own included, do not have the necessary audience.

Re:Don't be rediculous

[sunwukong]

Perhaps you need to spread the word more -- use mass mailings, tying your website to popular lifestyle products, etc.

No Spam Blogging Here...

[bluethundr]

Get 500 by tomorrow. It's quick, easy and confidential.

CLICK HERE TO LEARN HOW!!!


Use the money anyway you like:

• Pay off your bills
• Help you and your family through an emergency
• Repair your car
• Go shopping
• Enlarge your penis!

...sigh. Okay, I keed I keed and I know I'm going to get modded down for posting some actual spam I found in my inbox. But I have actually heard of this problem before. I wish it would just go away along with the majority of our obsessivly consumerist culture. But thank god, though I have seen some folks accuse Slashdot of being in bed with some of the product manufacturers it features in its stories (an accusation I don't actually subscribe to), I have NEVER seen blatant spam (that wasn't a blatant troll) mixed in with the blogging on this site. Could it be that the lameness filters are admirably effective in blocking this sort of content? Or have, I wonder, the spammers not figured out how to interface with Slashdot as of yet? Repeat: yet?

Personal Guestbooks have been targeted also...

[Diplo]

This relatively new phenomena isn't just confined to blogs - it's been happening to personal guestbooks for a while. I discussed this recently on the Mozzaline forums and it's apparent I'm not the only one to suffer from this automated spam. A brief summary of what I said :

Recently I've had 3 enteries in my guestbook that are blatant adverts for rather-dodgy commercial websites. I've deleted them, but wondered if anyone has had similair problems? One was an advert for 'bingo cards' and another for one of those dodgy 'casino' types. Now, what's interesting is that I log the user_agent that was used for all enteries, and all of these adverts stated the user_agent as Snoopy 0.95. If you follow the link you'll see that Snoopy is, infact, a PHP class that emulates a web browser.

Obviously someone has been using it to automate the task of spidering the web and looking for guestbooks and then filling them in with this blatant spam. What suprises me, though, is that I custom wrote my own guestbook, so I'm a little suprised that what appears to be an automated process can work out how to fill in all the fields correctly. I guess my field names are fairly common, but it still managed to work out which was the 'sign' page and fill in the form, including checking radio boxes etc.

I have feeling that the reasoning behind this spam is that it automatically creates a link from my website to the spammer's website (since I have a field for guests to fill in their own website). My guess is that this is a way to generate lots of links back to the spammers' site and increase their Google page ranking. It just amazes me the lengths these people will go!

The article misses the point

[HealYourChurchWebSit]

The BBC article misses the point, as does a similar article in Wired. Seems the editors are more focused on name-dropping and doomsdaying than on focusing on some recent solutions. For example:

• Jay Allen's MT-Blacklist" plug-in;
• Simon Willison's Blacklisting Comment Spam;
• Scripty-goddess' Anti-Comment Spam Tactics;
• BurningBird's Comment Spam Quick Fix;
• Kalsey Consulting's ideas on dealing with Comment spam; or
• even my own observations and suggestions on the topic

Point is ... perhaps we'd all be better service if said articles spent less time on the hype and a bit more investigation on some of the solutions ... whether they succeed or fail ... as both are educational.

Just so long as no one attempts to use a rather evil solution I discovered here on /... ... that would be wrong ...

porn spam thoughts

[AssFace]

I'm pretty sure that someone is spamming my brain with thoughts and dreams of porn like material. That said, I'm not too bothered by it.

Tell me something new...

[Manuzhai]

Jeremy Zawodny on this:

SMTP Sender Authentication, Blog Spam, and PageRank
Cheap Viagra, Vicodin, Xanax, Prescription Drugs, and Penis Enlargement Pills!!!
Gureilla Tactics Against Blog Comment Spammers

Russell Beattie on this:
Googler Comments

Simon Willison on this:
Battling Comment Spam
Banning Google Comments

Michael Fagan on this:
Seven Ideas for a Spam Free Blog

Scott Johnson on this:
A Possible Blog Comment Spam Solution

SPAM will kill the open nature of the internet

[jhendow]

Or at least it'll be forced to evolve into something more restrictive. When only adventuresome geeks were using the net, it was like we were the earliest settlers in a vast ancient forest. I remember getting maybe two or three messages a month and being elated at each. It was like meeting a fellow pioneer and being mutually pleased at having anyone else to talk to. Eventually the web was born and even my mom got an email account (ZOINKS!). And then the first annoying ads starting showing up in my inbox. And now... well, we already know what happened.
Seems like there won't be any real solution to filtering spam and the internet will have to go from being a wide-open crosslinked universe to a collection of private nodes/networks. Commercial interests supported the explosive growth of the internet/web, and a lot of us got neato jobs in the process. But now that same commercialism (and human greed/stupidity) have clearcut that beautiful old forest and built up sleazy strip malls.

I know I'm at risk of sounding like one of those "I was here before it sucked" types. Lamenting the loss of the good old days won't bring 'em back.

So, what do we do? The idea of charging a token fee for email delivery, which could be rejected by the recepient (thus resulting in a charge for spam, but not for mail we really want) is a good idea. But it might already be too late for that kind of solution. Make spam illegal? Sounds like yet another unwinnable "war-on-a-concept".
Many usenet groups already require approval for membership, and even that doesn't guarantee that new accounts won't become a source of spam.

I predict that more and more organizations and individuals will simply build fences around their cyber-outposts, only allowing recognized friends past the gate. At my house we NEVER answer the phone unless the caller ID displays a name we recognize. Ditto for email. Ditto for newgroups as well. I guess my mom was right... I don't talk to strangers any more.

Not as insurmountable a problem as with usenet

[Junior J. Junior III]

Just disable anonymous comments in your blog, and you're pretty much OK.

My solution

[NeoSkandranon]

I don't reallly have a blog, as such, but my domain does have a PHP site that has galleries of my photographs which viewers are able to comment on. Lately i've been getting spam from people who apparently randomly find my site and decide they have to leave their mark (much like dogs leave their marks on bushes)

my solution? Have MySQL log IP addresses along with the comment submission. My intended audience is so small I know the majority of the viewers personally, and thus have no issue walling off an entire ISP ( after reporting that IP address to said ISP's abuse dept)

something similer happened on my BBS

[night_flyer]

but it was a little different, the messages that were already there were replied to, but they had "empty" response, unless you looked reallu close one "character" in the reply to message now had a link attached to it.

I dont remember where it was linking to but I think it was a seach index or something similer.

were they trying to boost the ranking on search engines by having these so called links in place?

The real issue is trust management.

[androse]

Just like spam on other media (email, usenet, web forums, etc), you can apply quick and dirty fixes :

• IP # based black lists
• URL based black lists
• CAPTCHA (images and/or audio) authentication
• keyword filtering
• bayesian/statistical filtering
• etc...

But the real issue is always the same : trust management. You want to be able to grant as much trust as possible to trustworthy (non-spamming) strangers, while revoking all trust to others.

So why do we always want to build trust management systems on top of other systems, and not design a stand-alone one, that can be used by a wide range of media (email, usenet, blogs, etc) ?

Note: identifying "personas" does not mean identifying "real people", so there are no privacy issues in such a system.

Re:An interesting double standard re: spammers

[NetDanzr]

When you're not paying for things directly, you're paying for the 'net indirectly via adverts. Think it through the next time you start ranting against people exercising their rights to free speech to promote their fledgling business.

Enlighten me, please, how does buying Viagra support the Internet?

I think you are confusing two issues here. On one side, you have the Web sites I want to visit and products I want to buy. I am fully aware that nothing is for free, and because of that I don't complain about banners or fees, if the Web sites contain information I want to access. In fact, when the site is really helpful to me, I click on banners even though I have not the slightest interest in the products advertised, only to increase the site's revenues.

On the other side, you have Web sites and products that I don't want to buy. I don't visit those sites, and I don't buy such products. As such, I don't own them anything, and thus I do my best to fight against their aggressive marketing campaign. If anything, they put additional burned on the Internet infrastructure without paying their share to "support the 'net" (if there is such a concept in the first place).

this is just a taste of our doom

[theCat]

Exploiting a commons to utter exhaustion is a well-understood human trait. We have never failed to do so as soon as the opportunity presents itself. This is because we have a well developed sense of personal gain, but a poorly developed sense of societal good, even to the point of our eventual individual destruction. If you are in a bright mood today and would like to read something to bring you down, try this lovely bit of rational thought: The Tragedy of the Commons by Garrett Hardin (1968)

I'll save you a bit of surfing by extracting a tasty morsel, but do glance over the rest as it is quite a classic:

[snip]

The tragedy of the commons develops in this way. Picture a pasture open to all. It is to be expected that each herdsman will try to keep as many cattle as possible on the commons. Such an arrangement may work reasonably satisfactorily for centuries because tribal wars, poaching, and disease keep the numbers of both man and beast well below the carrying capacity of the land. Finally, however, comes the day of reckoning, that is, the day when the long-desired goal of social stability becomes a reality. At this point, the inherent logic of the commons remorselessly generates tragedy.

As a rational being, each herdsman seeks to maximize his gain. Explicitly or implicitly, more or less consciously, he asks, "What is the utility to me of adding one more animal to my herd?" [snip technical stuff] [T]he rational herdsman concludes that the only sensible course for him to pursue is to add another animal to his herd. And another.... But this is the conclusion reached by each and every rational herdsman sharing a commons. Therein is the tragedy. Each man is locked into a system that compels him to increase his herd without limit -- in a world that is limited. Ruin is the destination toward which all men rush, each pursuing his own best interest in a society that believes in the freedom of the commons. Freedom in a commons brings ruin to all.

Some would say that this is a platitude. Would that it were! In a sense, it was learned thousands of years ago, but natural selection favors the forces of psychological denial. The individual benefits as an individual from his ability to deny the truth even though society as a whole, of which he is a part, suffers. Education can counteract the natural tendency to do the wrong thing, but the inexorable succession of generations requires that the basis for this knowledge be constantly refreshed.

[endsnip]

The key insight here is that freedom in a commons brings ruin to all. So in other words, we kid ourselves into thinking that our tiny individual impact does not make a difference, that societal good is not impaired, thus we have the freedom to pursue our impulses to better our share, and working individually this way we ruin everything that does not have a high barrier to entry. The way this applies to email/weblogs/Usenet/etc is that in the beginning the technical hurdles are too high for there to be very many users with thier little impacts, so the Commons is safe for a while. But then comes the GUI and push-button bots and the Commons is swamped. The normal "natural" balance is broken apart and the Commons collapses from the death of a thousand cuts. It has ever been thus, and unless I am mistaken it always will be unless you defend your Commons from newcomers. Which has been tried.

Easy fix for spam.

[Psiren]

It's easy enough to stop spam. Just shoot anyone that needs a mortgage, has a small dick or erection problem, or wants to increase their web traffic. No more buyers, no more problem. Unfortunately one of those applies to me, but I'm not saying which... ;-)

Re:You, on the other hand, are the regular type.

[Dr. Smeegee]

Actually the turing test would be a computer trying to convince a man that it is a woman.

So what? Blogs are write only

[arrowman]

Why would this be a problem? Nobody even reads a blog, do they?

privacy, openness, spamfree

[epine]

Wake up and smell the bacon, people. The techno-utopianism of Wired when it was boosting the dotcom era into orbit has proven itself a poor match with human nature on all fronts.

The benificient fathers of the internet made two horrendous design decisions concerning the final destination of a global internetwork: excessively strong anonimity and a near zero cost for dumping pollution into public media.

Privacy, openness, spam-free: pick any two.

For anyone who looked into ECC yesterday, you might have noticed that RSA has ideal properties for preventing some of this mess: expensive to sign a certificate, cheap to verify, and the ratio becomes worse as you scale up.

If every spam artifact was signed with an anonymous RSA cert (anyone could make as many of these as they wish), as soon as one spam is confirmed, every other post signed by the known-spam cert could be instantly revoked.

This would force the spammers to create a new anonymous cert for every spam instance. Yet with RSA certs, the computational cost to generate a cert is vastly greater than the cost to verify the cert.

As an added step, the cert could require the IP address of both endpoints to be embedded inside (the server would reflect back the IP source address it sees, and then ask for an anonymous cert to be generated at a desired RSA key size).

We won't have to damage anonymity very much to vastly increase the cost of dumping pollution.

In this respect, weblogs would be a good place to start. This is a relatively new technology that could be retrofitted at one percent of the cost of a global e-mail infrastructure upgrade. It really doesn't matter if you inconvience a few bloggers working out the kinks, these people have not much useful to do in any case.

Most Blog Spammers Use Crawlers

[robathome]

I was only hit twice by comment-spammers before I took action.

Using image-text to verify humanity on the other end of the connection wasn't an option, as it excluded sight-impared users. User registration was a no-go: I don't want to have to spend time validating user accounts. I did enough of that in my BBS Sysop days. Even MT-Blacklist is a bit of a pain, as you've got to deal with each spam comment individually once posted.

However, one thing I found in common between my spammers and the attacks I've seen on other sites was that prior to the spamming run, the site was crawled. So, I excluded the locations of the comment scripts in my robots.txt and set a trap to auto-ban any crawler that doesn't obey the excludes.

Well-behaved spiders/'bots can index the site. Ill-behaved or malicious crawlers that download the whole file tree regardless of excludes trigger a tripwire that locks them out. You can eyeball the details in this entry on my site: Setting a Spider Trap