Silly me. I thought that by writing my own blog software, those nasty comment spammers wouldn't be able to penetrate my fortress of php spaghetti code. But since I have added an atom feed, I have been getting a couple of automatically generated comment spams per week.

I have been looking for comment spam software to study how it works, but it's impossible to find. People hate this software, so it's taboo to link to it. It's taboo to describe how to make it,or how it works. This is a benefit to the blog spammers, because then nobody knows how to defeat them either.

The blog spammer on my site probably started with the atom feed, which I have submitted to several manual pinging services. So the spammer has a list of blogs, and picks an entry in each one in which to post a comment.

I have a non-standard interface to my blog, since I wrote the thing myself. The spammer would have to actually download the web page in order to post the link. The comment form on my site consists of three fields: displayname, email, and comment, which I assume is different from WordPress's format.

In the spam I received, all of of the form field contained valid values. In addition, my blog sets a cookie in the browser, and this was correctly echoed back in the comment. The POST request was indistinguishable from a real comment, except that it contained a lot of urls.

Possible tactics

• Blog spams are generally a list of urls. If I ban comments containing "http:" then it will probably block all spam.
• Generate the form in javascript. Spammers will probably be too lazy to implement a Javascript interpreter.
• Include extra text fields that the user is requested not to fill in. I read somewhere that this is effective, since the spam software will probably fill in these fields. Or use Javascript to hide this extra text item. I would use css, except that a real programmer could write a css parser in about an hour to detect whether form elements are hidden.

I'm going to try out the last option.

Update

Aha! Today, I captured another piece of comment spam. The "Leave this blank" field actually has the name "address". The comment spammer's script obligingly filled this in with "USA, NewYork". Users who can read will leave it blank. So my strategy is working!

Update #2

It worked for only 1 day. Now, all kinds of comment spam is getting through. I will filter out all messages containing "http:".

• Test Driven Development without Tears
• Coding tips they don't teach you in school
• It's a dirty job... (comic)
• When a reporter mangles your elevator pitch
• The PenIsland Problem: Text-to-speech for domain names

Want more programming tech talk?
Add to Circles on Google Plus
Subscribe to posts