My interest was piqued enough by this post to go clicking around the IndieWeb site for more information on Webmentions, and I was amused to see, on the page whe

My interest was piqued enough by this post to go clicking around the IndieWeb site for more information on Webmentions, and I was amused to see, on the page where they discuss an earlier spec that attempted to do the same thing, TrackBack (https://indieweb.org/Trackback https://indieweb.org/Trackback), a link to an essay I wrote 14 years ago critiquing the thing that ended up killing TrackBack -- its complete lack of spam-proofing. (This one: http://anthillcommunities.com/archives/001653.html http://anthillcommunities.com/archives/001653.html) I guess somebody actually read it! Huh. In unrelated news, now I feel old :-D I was curious to see how Webmentions sets out to avoid the same problems, since they should be more obvious today than they were when TrackBack was created in 2002. The answer appears to be one of your classic "good news/bad news" situations. The good news is, it appears some thought has been actually been put into spam-proofing this time around. The Webmentions spec lays out a verification process that incoming Webmentions MUST pass in order to be accepted as valid (see https://www.w3.org/TR/2017/REC-webmention-20170112/#webmention-verification https://www.w3.org/TR/2017/REC-webmention-20170112/#webmenti...), which is good. The bad news is, assuming I'm reading the spec correctly, that verification process boils down to "do an HTTP GET of the page that supposedly linked to you and parse its HTML to make sure there actually is a link to you in there," which doesn't seem like much of an anti-spam speed bump. All your spammer has to do is send all their Webmentions from the same URL, and then publish an automatically-updated list of links to all the URLs they've spammed over the last six hours at that URL, and boom, they're valid, right? Or is there something I'm missing here that makes this more spam-resistant than it first appears?