3 ms·
Before adding captchas to my stupid personal blog, Akismet was catching ~300 attempted spams a day, and I was manually flagging ~2 a day. Then I installed reCa
by jfager 16y ago
Before adding captchas to my stupid personal blog, Akismet was catching ~300 attempted spams a day, and I was manually flagging ~2 a day.
Then I installed reCaptcha, and now Akismet catches ~10 a month, and I've had to manually flag zero.
I'll take that illusion, thanks.
- il 16y agoThat's one datapoint. The counterpoint is the thousands of forum owners who mistakenly relied on captcha to prevent spam at the expense of other antispam measures, like GeoIP.
- jfager 16y agoI'm not saying captchas are a magic one-step solution to end all spam (hence the mention of Akismet). I'm just disputing the idea that they are "nothing more" than illusory security. Sure, they can be turked, and sure, if someone relies only on captchas they'll probably eventually get screwed. But they do provide some benefit as part of a complete approach against spam, in that they raise the cost of a spam attempt up from zero. Unless you have meaningful levels of traffic, the vast majority of spammers aren't going to bother with you if it costs anything at all to hit you.
- there 16y agook, but how many comments are you losing because people don't want to fill out a captcha? i've used defensio.com for filtering comments on my site with no captcha and rarely ever get a false positive or negative. false negatives are easy to spot, and users can manually override false positives by supplying an email address to get a confirmation link (which gets fed back to defensio as a false positive once clicked).
- jfager 16y agoIt's a tradeoff, sure. In my case, I'm perfectly happy to trade a few comments from people who don't want to deal with a captcha for never having to manually deal with spam. YMMV.
- mike-cardwell 16y agoThere are better ways of reducing comment spam to near zero without resorting to captchas. Here's how I did it: https://secure.grepular.com/Blocking_Comment_Spam_Using_ModSecurity_and_Hidden_Fields https://secure.grepular.com/Blocking_Comment_Spam_Using_ModS... It's still working now.
- mseebach 16y agoThat's great, pretty much any home-rolled CAPTCHA will perform great, simply because it's not worthwhile for spammers to design an attack. If that, however, was the default anti-spam mechanism on, say, wordpress installs, it'd be automated against in minutes.
- mike-cardwell 16y agoDefinitely. If more people rolled their own, the spammers would be screwed.