4 ms·

I really like the idea and the implementation looks nice! But not having any type of spam protection is a deal breaker for me. Even if links are set to nofollow

by asar 6y ago

I really like the idea and the implementation looks nice! But not having any type of spam protection is a deal breaker for me. Even if links are set to nofollow, it's still a big opportunity for bots and spammers to abuse this system and spread their links, similar to what is happening to misconfigured wordpress sites.

foxhop 6y ago
Thanks for the feedback. I'll add Akismet integration to the backlog for people with the same objection. Allowing people to pass an API key to their Namespace shouldn't be too difficult but I'll need to build out a UI for separating ham versus spam which might take more work. In the Namespace settings you can force all comments into moderation before displaying to the page. This would be the best option for you in the mean time.
- simplecto 6y ago
  One quick win that might catch most of the bots is using CSS to hide an dummy form input. No human will see it if their browser properly renders, but bots using CSS selectors might fill it in. If you see that field is filled in then you have a high probability of it being a bot and can drop it.
  - foxhop 6y ago
    yup. This really works for dumb bots.
  - ficklepickle 6y ago
    Regarding the hidden form input, make sure you aren't blocking screen reader users/the visually disabled accidently. Make sure you can't end up in that input with the tab key. I've found that comments submitted in less than 7 seconds from page load are spam. On a few low traffic sites I just discard anything faster than that. A few bots seem to load a page, wait a while, then come back to it. But by and large they seem to try to submit the comment immediately after page load. Mind you, this was on low-traffic sites. High traffic sites I'm sure see more varied techniques.
    - foxhop 6y ago
      I like this. I'll add something like this to the backlog.
    - rovr138 6y ago
      `aria-hidden` and `display: none` should effectively hide it from screen readers and you shouldn’t hit it with tab.
      - esperent 6y ago
        Do you need both, or is `display: none` enough?
        rovr138 6y ago
        display: none should be enough. If you notice issues while testing, aria-hidden is a good thing to have in your back pocket
  - deanclatworthy 6y ago
    This is trivial for most bots to bypass nowadays with headless browsers and such.
- corobo 6y ago
  Something that may be useful here: https://stopforumspam.com/ https://stopforumspam.com/
- onara 6y ago
  I love the project but consider integrating oopspam (https://oopspam.com https://oopspam.com) instead of Akismet. Akismet is basically adding a tracking. People from the EU cannot use it with Akismet.

by asar 6y ago

foxhop 6y ago

Thanks for the feedback. I'll add Akismet integration to the backlog for people with the same objection. Allowing people to pass an API key to their Namespace shouldn't be too difficult but I'll need to build out a UI for separating ham versus spam which might take more work. In the Namespace settings you can force all comments into moderation before displaying to the page. This would be the best option for you in the mean time.

simplecto 6y ago
One quick win that might catch most of the bots is using CSS to hide an dummy form input. No human will see it if their browser properly renders, but bots using CSS selectors might fill it in. If you see that field is filled in then you have a high probability of it being a bot and can drop it.
- foxhop 6y ago
  yup. This really works for dumb bots.
- ficklepickle 6y ago
  Regarding the hidden form input, make sure you aren't blocking screen reader users/the visually disabled accidently. Make sure you can't end up in that input with the tab key. I've found that comments submitted in less than 7 seconds from page load are spam. On a few low traffic sites I just discard anything faster than that. A few bots seem to load a page, wait a while, then come back to it. But by and large they seem to try to submit the comment immediately after page load. Mind you, this was on low-traffic sites. High traffic sites I'm sure see more varied techniques.
  - foxhop 6y ago
    I like this. I'll add something like this to the backlog.
  - rovr138 6y ago
    `aria-hidden` and `display: none` should effectively hide it from screen readers and you shouldn’t hit it with tab.
    - esperent 6y ago
      Do you need both, or is `display: none` enough?
      - rovr138 6y ago
        display: none should be enough. If you notice issues while testing, aria-hidden is a good thing to have in your back pocket
- deanclatworthy 6y ago
  This is trivial for most bots to bypass nowadays with headless browsers and such.
corobo 6y ago
Something that may be useful here: https://stopforumspam.com/ https://stopforumspam.com/
onara 6y ago
I love the project but consider integrating oopspam (https://oopspam.com https://oopspam.com) instead of Akismet. Akismet is basically adding a tracking. People from the EU cannot use it with Akismet.