Anti spam system
The 2007-02-14 at 20:21 by Loïc d'Anterroches filed under Plume CMS.
If you have a blog, I recommend you to read Stopping spambots with hashes and honeypots by Ned Batchelder. I have implemented some of the technics he describes and some of the ones presented in the comments to control the comment spam on this website. In the past 3 days, I got 80 spams and 3 real comments with no false positives and no false negatives.
I am waiting another week or so and will commit the code into the default spam filtering system of Plume CMS. Note that this sytem will never prevent someone to manually come and write some spam in my comments, this system is tuned against robot.
Sites I like
Mon entreprise
Logiciel libre
Sur ce site
Comments from readers
Pierre said:
I read this article and found out a couple of not-so-good ideas, especially about accessibility or your website.
For instance, in the chapter "Making honeypots invisible", the author recommands to use one of the methods, such as making the honeypot invisible in CSS, or too small, or using Javascript, etc.
But if you deactivate CSS, or if you're using a program like JAWS to read the content of your webpage, then the content may appear as a normal one, and you won't be able to post any comment because it will be treated as a Spam.
Fortunately, the latest method ("Leave the honeypots displayed like the other fields, but tell people not to enter anything into them.") is a good one ; you can also use a system like Jimmac (http://jimmac.musichall.cz/weblog.php) does on his website, with a field asking "Are you an annoying spammer?", and the default value is "yes", then you just have to write "no", and the comment will be accepted automatically!
Well, just to say: beware of the accessibility of the webpages you're creating!
Loïc said:
Hi Pierre. Very good remarks. In fact if you deactivate the CSS you will see that I have not included any of the non accessible technics. Accessibility is something I will never trade against possibly more security against spammers.
For the moment I am doing the following:
- Special field based on the server time to have a comment valid only 5 sec after the preview and up to 15 minutes (you need to go through the preview process and spend at least 5 sec to figure out what to do).
- Control of the numbers of URL in the comment field.
- Control of the length of the comment.
- Control of the ip (black listed or not).
Thank you and I am happy to read that accessibility is part of the concerns of my readers!