Slashdot Mirror
Comment Spams Straining Servers Running MT
dJ phuturecybersonique writes "Netcraft reports that 'Comment spam attacks on Movable Type weblogs are straining servers at web hosting companies, leading some providers to disable comments on the popular blogging tool. The issues are caused by bugs in MT, forcing publisher Six Apart to recommend configuration changes while it prepares fixes.' More..."
It's a good thing Slashdot doesn't have this problem.
But DoS attacks as well. Running several political blogs I often get "freeped"
:)
The best solution for me:
1. User email address verification
2. server generated images to verify real user for registration
3. Regular cookie expiration after x amount of time
4. host filtering (referr filtering usually gets ride of "freepers" unless they open a new window
However - nothing beats good moderators, quality users and sticking to your nich. Don't go pissing people off tossing your blog around the world yourself and not expect to get anything in return.
It's a jungle out there
This has been going on for quite awhile now, and still no official fixes from SixApart?
Shame on them.
First and foremost, it's free (speech and beer) and distributed under the GPL.
Second, the actual developers of the software actually participate in the support forums, so if you do have a question, it's likely to be answered very fast by someone intimately familiar with the software.
Third, it's a lot less susceptible to comment spam, especially after applying a few plugins and hacks. I've never received a single one, and that's not for lack of spammers trying.
Fourth, it's very easy to customize the look and feel of the site without knowing any PHP. HTML and CSS is about all you need to know. Knowing PHP helps a lot if you want to really customize it, but it isn't a requirement.
Finally, they've already included a Movable Type import utility, so those of you who are sick of MT for this and many other reasons can move over with little hassle.
Signed,
A very happy WordPress user and occasional contributor.
How am I supposed to fit a pithy, relevant quote into 120 characters?
If your case is like mine, where mt is stored in a directory just off of your public web site, do this: use a .htaccess to put a password on your whole MT directory. They can't access comments.cgi (assuming it's just a bot doing the spamming), they can't post comments. I don't really like the idea of people touching my CGIs anyway. Make sure your robots.txt excludes the MT directory as well.
That is, assuming you don't give a damn about people's comments.
We had a similar problem on our ziffdavis.com blogs (like my security blog) and we think we have solved it with with one of those graphic field challenges to the user (enter the value in the nearby graphic).
No this doesn't sound workable, since a person operating at 99.5% accuracy would not make any money.
For example, they check 2,000 e-mails to earn a dollar, so they check 200 to earn 10 cents. If they make one mistake in that 200, then their entire payment for the 200 goes away.
Besides, you are throwing a human resource at a technology problem and when the technology is fixed, *poof* your business is gone.
In the case of MT the problem isn't the amount of spam, its the way in which static pages are rebuilt when they don't need to be, and mostly manifests itself in shared user environments (per the article). Your service wouldn't help this, because the problem isn't in the spam being displayed its the generation of the pages with the spam on it, which would have to be completed before your spam auditors could ever even see the copy.
Not to mention all the problems around fulfillment. So they see spam, what do they do? Send an e-mail? Do you think people would give your little spam army access to delete comments on the spot? Or do you plan on using some sort of live filtering to further slow down a bottle necked process?
Some things, like voting, should have human intervention and control. Others like this aren't as suited to the task.
it would be neat if search engines like Google could be trained to ignore negative score Slashdot comments
Given that the static page is written at a Score:1 threshold, and that Google obeys Slashdot's suggestion in robots.txt not to index the dynamic pages, this is already the case.
I myself run an MT blog and have been contemplating moving to wordpress to dodge the spam bullet, however temporarily.
It occured to me thought that what would really fix this is to push the load onto the spammers by building a Reusable Proofs of Work (RPOW) system.
For those who are unfamiliar, RPOW is a proposal to stop mail spam by asking the sender to do a little "work" that would make sending a lot emails computationally too expensive.
As I'm in the last throws of my PhD I'll have to delay on this one, but maybe the lazy web can help out on this one, so the same thing doesn't happen to wordpress or whatever blogging monocultures exist.
A few problems, as a Wordpress user and as someone who's run into problems w/ other people's MT blogs:
- spam bots attack WP and MT through various means, one of the most common being to simply POST to the mt-comments.cgi or wp-comments-post.php URLs on peoples sites
- the bots mainly post huge amounts of links to stupid websites, like viagra or poker strategy. the goal is to get a higher google ranking by having links from many different sites
- the biggest problem for WP users is that you get flooded with literally hundreds of comments per day. if you have good filtering you'll at worst just have to sit around and delete some manually
- the biggest problem for MT users(or that MT users cause) is that because of the poor design of MT, the comments script takes up a huge amount of CPU time. apparently it actually goes through the process of rebuilding the static post pages even when comments are moderated or auto-deleted. now imagine you have 500 posts and they all get hit at the same time - it's something close to a forkbomb on the server
The best solution to all of this is to find a way to prevent the stuff from ever getting posted. Once it's submitted you're going to have to analyze it in some way and decide if its SPAM or its good. There are some simple solutions like renaming the comment post scripts, and some more complicated ones like using a verification number or requiring users to register. In any case, it's a very major problem for almost anyone with a blog.
feh. stuff.