Share via

Blog Spam, Part 2

  • Article

Three months ago, I ranted in this blog entry about blog comment spam. Well, it appears that the arms race of allowing anonymous blog comments (which I deem highly important) has been steadily escalating, and the latest crop of blog comment spam are pretty clever to the point that I think that anonymous blog comments cannot be allowed to be made unfettered and freely.

For example, the latest algorithms:

  • One takes snippets of existing blog comments from the same blog entry, injects its URL into the username field, and repost that as blog comment
  • One takes snippets of text from novels, emails, etc from other sources, injects its URL into the comment text and/or username field, and reposts that as blog comment
  • One uses short congratulatory phrases like "good to know", "I like your site a lot", "keep up the good work", etc, injects its URL into the username field, and reposts that as blog comment

The only common thing amongst all of them is that the spam URL is in the username field, but unfortunately, that is also used for Trackback and by legitimate users linking to your blog... so disallowing those links diminish the linkage of the blogosphere.

Now, some have proposed requiring HIP-CAPTCHA and other Turing Tests for Humans before allowing comments to be made... and while I resisted such user restraint earlier because I value my user liberties, a little validation every once in a while can't hurt... or can it?

Anonymous Spam is the very abuse of personal privacy, but chipping away at one's civil liberties in the name of security is just as dangerous and slippery slop towards tyranny. Is there a better choice? Perhaps we can attack/remove the economic incentive to spam, or make it prohibitively expensive to spam than not.

//David

Comments

  • Anonymous
    June 14, 2006
    Once Infocards (or Windows Cardspace) is ready, you could use that. Just require a claim like "this is a user and he has demonstrated to be one by using our mega captcha system once last month" from any identity provider. You could accept such a claim from any identity provider (like Windows ID and others). You would not need to collect any personal data, no user id, no nothing. All you would do is ask your users to provide you a ticket/claim from any of the big identity providers that proves that they are real. At least that is how I understand the system ;)
  • Anonymous
    June 15, 2006
    Hey at least your MSDN Blog doesn't support trackbacks! On MSN Spaces, not only do we get SPAM Comments -- we also get SPAM trackbacks! (Shall we call them "porkbacks"?)
  • Anonymous
    June 15, 2006
    The comment has been removed
  • Anonymous
    June 15, 2006
    There's an online blocklist of spamvertised URLs:

    http://www.surbl.org/

    It's been very effective for me (and others) in email.  I don't see why it wouldn't work just as well for blog spam.

    TinyURL.com uses it, among others.
  • Anonymous
    June 15, 2006
    The comment has been removed
  • Anonymous
    June 16, 2006
    Spam would be over in a month if people just quit buying the spamvertised products.  I don't know how that translates to the terrorism analogy.
  • Anonymous
    June 16, 2006
    Maurits - your analogy would be if people just got a clue and stop joining Terrorism cells. But nah, that would be too easy, wouldn't it? ;-)

    //David