Comments on: Movable Type Spam Killer

By: gielda samochodowa

gielda samochodowa — Mon, 22 Aug 2005 03:41:15 +0000

Hi, I had also SPAM problem and I installed mt-blacklist! It's a great comment-spam-filter? I use it for weeks and am perfectly happy with it.

By: Rey Bango

Rey Bango — Sat, 30 Jul 2005 19:01:43 +0000

Yep, you called it Jester. :P

By: Barney

Barney — Sat, 30 Jul 2005 19:00:53 +0000

Jester, that was a single comment, and from the access logs, it certainly appears to have been manually submitted. Hardly a spam attack with hundreds of comments at once as seems to be the standard MO.

By: JesterXL

JesterXL — Sat, 30 Jul 2005 18:38:17 +0000

Hehe, told ya!

By: Barney

Barney — Wed, 27 Jul 2005 15:39:40 +0000

Jester,

That's absolutely not true. I haven't used mt-comments.cgi in many, many months. I usually changed it (using random strings) about every other week, and still got a TON of spam. So while not everyone is parsing the HTML, there are a significant number of spammers who are.

By: JesterXL

JesterXL — Wed, 27 Jul 2005 15:34:32 +0000

Most spammers go straight for the mt-comments.cgi, not your HTML page; at least, that's what the bots do.

By: Barney

Barney — Wed, 27 Jul 2005 15:29:32 +0000

Rey,

Ah, I see. Yeah, I totally missed what you meant. I'm more confident that forcing a lookup through the JS event system will prevent automated tools than some in-place hiding will. I'm actually already using string splitting as well. If the spammers ever get ahold of the action template again, though, I'll think about the XOR method (or something equivalent).

By: Rey Bango

Rey Bango — Wed, 27 Jul 2005 15:19:47 +0000

Barney, I don't think you understood what I meant. I was describing mangling your form action URL in the same way that some people mangle their email addresses to avoid spammers picking them up.

By: Barney

Barney — Wed, 27 Jul 2005 14:43:53 +0000

Rey,

The spam isn't about the email addresses, but about automated comment submissions. The email addresses are already mangled a bit to avoid harvesting.

While it was annoying, I didn't mind maintaining my MT-BlackList database a whole lot. The problem is that comments which made it through went to anyone who had subscribed to the threads as well, and that's not very nice on my part. But now that I'm not getting any automated submissions, the subscribers shouldn't get any more spam comment notifications.

By: Barney

Barney — Wed, 27 Jul 2005 14:41:04 +0000

Jester,

I didn't change the template name; that only works for a matter of hours. I removed the ability to figure out the template name without having a full-on HTML/JS parser, rather than some simple text parsing routines (that'll work for 99.9% of sites).