Dana Epp's ramblings at the Sanctuary: Defending Against Comment Spam


« Blog Funkiness \| Main \| Why Default Passwords Are a Bad Idea » November 24, 2004 Defending Against Comment Spam Well it looks like I may have finally found the solution to fix my comment spam hell in Moveable Type. This is the approach I have taken: Upgraded to MT 3.12 Moved the flat Berkley DB to mysql Installed MT-CloseComments and set it to turn off comments after 7 days Rebuilt the entire contents to reset all old comments. We will see over the next little while if it works. I noticed that as I was doing the update, I got nailed with another 150 comments. None since the older comments have been closed. Lets hope. Posted by SilverStr at November 24, 2004 01:24 AM \| TrackBack Comments I had a similar attack of comment spam. I beat it by deleting identical comments, not allowing more than 1 comment a minute from one IP and implementing captcha's after 30 days and blocklists from sbl-xbl.spamhaus.org and bl.spamcop.net. In addition after 30 days comments are moderated or if they contain more than 7 links, if they contain more than 13 they are rejected. All thanks to my blog software serendipity, which has fairly easy to port php code if yo are interested. Posted by: Dominic at November 24, 2004 04:11 AM You might want to try the wonderful product MT-Blacklist. It keeps a blacklist of disallowed web sites, plus adds some new features to MT 3.x that keep "bad" comments from being automatically posted. Check it out at: http://www.jayallen.org/comment_spam/ Posted by: Jonathan Arnold at November 24, 2004 08:40 AM Hey Jonathan, I WAS using MT-Blacklist. It still gets through. On the flood of 3000 I got on Monday, the blacklist was updates as of last Thursday. The common trait is that they are nailing posts that are over a few months old. Most are popular posts from a year or two ago. By removing the ability to comment on those entries, I seem to have eliminated all the spam. If something gets in to a recent post, Mt-Blacklist will be there to help me quickly remove it post-analysis. However, I can not longer expect it to defend against new unknown comment spam vectors. It just wasn't working good enough. With that said though, I HAVE to say Jay was a god send. Guess what I used to clean up the 3000 comments in less than 2 hours :) Posted by: SilverStr at November 24, 2004 08:49 AM Really good work. I found a lot of profound information which can help me to go on. Thanks for all this input. Posted by: Brenda Marie at December 1, 2004 01:14 AM		My 5 Favorite Books Writing Secure Code Secure Programming Cookbook Security Engineering Secure Coding Principles & Practice Inside the Security Mind My 5 Favorite Papers Smashing the Stack Penetration Studies Covert Channel Analysis of Trusted Systems DoD Trusted Computer System Evaluation Criteria NSA Security Recommendation Guides Archives December 2005 November 2005 October 2005 September 2005 August 2005 July 2005 June 2005 May 2005 April 2005 March 2005 February 2005 January 2005 December 2004 November 2004 October 2004 September 2004 August 2004 July 2004 June 2004 May 2004 April 2004 March 2004 February 2004 January 2004 December 2003 November 2003 October 2003 September 2003 August 2003 July 2003 June 2003 May 2003 April 2003 March 2003 February 2003 January 2003 December 2002 November 2002 October 2002 September 2002 August 2002 July 2002 GeoURL

November 24, 2004

Defending Against Comment Spam