16 ms·

I have been using pseudo-timestamps and honeypot fields for a while now and it has worked pretty well for me. I get a bit of spam every now and then but it is u

by chime 16y ago

I have been using pseudo-timestamps and honeypot fields for a while now and it has worked pretty well for me. I get a bit of spam every now and then but it is usually someone manually copy-pasting. I could safely block those too but it is infrequent enough that I don't need to bother. Here's my algorithm: /form-show fieldhash = hash(ymd(today)) valuehash = hash(remoteip + ymd(today)) <input type=hidden name=fieldhash value=valuehash> <input type=text name=email value="" style=display:none> /form-validate field0 = hash(ymd(yesterday)) value0 = hash(remoteip + ymd(yesterday)) field1 = hash(ymd(today)) value1 = hash(reomteip + ymd(today)) if(post[email] != "") // reject form if(post[field0] == value0 || post[field1] == value1) // accept form

jasonkester 16y ago
Wait until your site gets popular. It'll get fun sooner or later. The latest thing I'm seeing on my site is a robot that automates real web browsers, jumps between ip addresses, scrapes real user content off the site, then posts it back using some form of Markov generator to make the content look unique. It'll do that on new accounts for weeks before trying to insert any links. It's amazing the lengths spammers will go to to get their content onto your site. In this case, the crawler is clearly written specifically for my site, even though it's only PR4 and nofollows all its links. It's no wonder 99% of the content on big sites like Blogger is spam.
- khafra 16y ago
  That's getting dangerously close to xkcd's gold standard of spambots that actually make well-written, useful contributions to the discussion.
  - IgorPartola 16y ago
    Link: http://xkcd.com/632/ http://xkcd.com/632/
    - deleted 16y ago
      [deleted]
    - corin_ 16y ago
      Actually he was referring to http://xkcd.com/810/ http://xkcd.com/810/
- gumbo 16y ago
  Interesting analysis. I knew that people put effort in spamming, but never new they go so far.
romaniv 16y ago
You just gave me an interesting (but somewhat unrelated) idea. You can "sign" a timestamp by appending a hash of that timestamp with some sercre value. This way, whenever the user submits your form, you can reliably determine when it was requested without storing anything on the server.
ck2 16y ago
Most modern bots know to jump over fields that are type=hidden or display:none/visibility:hidden - your site just isn't big enough of a target yet. Even hiding the CSS externally doesn't help, many bots now use inline browsers to decode javascript and stylesheets.
- chime 16y ago
  There's no single way to block spam. I just showed two of the most basic methods I used. There are lots more that can be setup if spam starts to become a problem without resorting to captchas.
- saranagati 16y ago
  what i've done recently is give a text field a worthless class, then use javascript to change it's class to a display:none. Sure bots may execute the javascript however it causes them to run much slower so I'd think the majority of them aren't.

by chime 16y ago

jasonkester 16y ago

Wait until your site gets popular. It'll get fun sooner or later. The latest thing I'm seeing on my site is a robot that automates real web browsers, jumps between ip addresses, scrapes real user content off the site, then posts it back using some form of Markov generator to make the content look unique. It'll do that on new accounts for weeks before trying to insert any links. It's amazing the lengths spammers will go to to get their content onto your site. In this case, the crawler is clearly written specifically for my site, even though it's only PR4 and nofollows all its links. It's no wonder 99% of the content on big sites like Blogger is spam.

khafra 16y ago
That's getting dangerously close to xkcd's gold standard of spambots that actually make well-written, useful contributions to the discussion.
- IgorPartola 16y ago
  Link: http://xkcd.com/632/ http://xkcd.com/632/
  - deleted 16y ago
    [deleted]
  - corin_ 16y ago
    Actually he was referring to http://xkcd.com/810/ http://xkcd.com/810/
gumbo 16y ago
Interesting analysis. I knew that people put effort in spamming, but never new they go so far.

romaniv 16y ago

You just gave me an interesting (but somewhat unrelated) idea. You can "sign" a timestamp by appending a hash of that timestamp with some sercre value. This way, whenever the user submits your form, you can reliably determine when it was requested without storing anything on the server.

ck2 16y ago

Most modern bots know to jump over fields that are type=hidden or display:none/visibility:hidden - your site just isn't big enough of a target yet. Even hiding the CSS externally doesn't help, many bots now use inline browsers to decode javascript and stylesheets.

chime 16y ago
There's no single way to block spam. I just showed two of the most basic methods I used. There are lots more that can be setup if spam starts to become a problem without resorting to captchas.
saranagati 16y ago
what i've done recently is give a text field a worthless class, then use javascript to change it's class to a display:none. Sure bots may execute the javascript however it causes them to run much slower so I'd think the majority of them aren't.