4 ms·

I run a popular blog and confirm that spam is a massive issue. I am trying to keep the independent web alive with an old-school commenting system because it hel

I run a popular blog and confirm that spam is a massive issue. I am trying to keep the independent web alive with an old-school commenting system because it helps readers and myself improve outdated posts. My domain is over 20+ years old and attracts all sorts of threats, including monthly DDoS and daily spam. Using Cloudflare solved all of these problems. Next, you need to add firewall rules inside Cloudflare WAF to trigger a captcha for /path/to/blog/wp-comments-post.php. That will not get rid of human spam tho. For that, you need to use another filtering service called Akismet.

toastal 4y ago
Putting everything 'behind Cloudflare' isn't a panacea. By merely living outside the West, I'm getting Geo blocked from 'normal' news sites and constantly having to solve hCAPTCHAs to solve riddles for some AI algo without compensation. It's such a burden and I find myself giving up pretty often. GeoIP blocking is what prevented me from getting my voter information out of my last domicile. Running everything through Cloudflare or similar also contributes to the concept of letting the internet be centralized around a few choke points that can hurt free speech (both the good and bad kind) and when they go out (which did recently) a large swath of the internet comes with it.
- jks 4y ago
  Does Cloudflare's "Privacy Pass" browser plugin help at all? It's advertised as reducing the number of hCaptchas you need to solve by a factor of 30, but I rarely see hCaptchas anywhere on my connection so I can't really evaluate myself.
- nixcraft 4y ago
  I agree with you. But, what solution do you propose for independent solo developers or people who wish to run a blog instead of using FB, Twitter and co to create content? Cloudflare may not be perfect, but it prevented me from shutting down my solo operation without putting a massive cost burden on me. When the first time DDoS hit, I had to beg one of those large cloud companies to reduce bandwidth costs. It took them forever to forgive that abuse and price, which was not my fault, and I was given a strong warning not to repeat such an issue again. There is no easy solution to this problem. At least with Cloudflare, people like me can stay online, but it does cause a problem for a bad IP reputation. TL;DR: I won't expose any of my projects or API directly these days due to spam, ddos and other abuse.
  - account42 4y ago
    For commenting or forums the best solution IME is to require moderation review for all new users before showing the posts anywhere. You can also add a super simple "CAPTCHA" that is just a text field with a question easily answerable to any human looking at your site (e.g. name of $thing that your site is about without mentioning $thing in the question itself) to reduce load from non-targeted automated spam.
baisq 4y ago
People here like to say that BigCo has ruined the independent web and that everything is now siloed and blablabla but the truth is that running an independent website fucking sucks in many regards
- jimmywetnips 4y ago
  Exactly, sorry the current solutions don't live up to ideals, but if there's no better then we're already doing the ideal thing
nicbou 4y ago
Same job, same problem. I simply don't allow comments anymore. This is unfortunate, because they're amazing feedback if you write about bureaucracy. People won't take the time to write to you about their experience, but they'll leave a comment.
- coldpie 4y ago
  I came to the same solution, just disabling comments. There's a prompt to email me in the footer, but no one ever has. Shame, but that's the world we live in.
  - account42 4y ago
    Just like with banners, nobody reads footers so that is not surprising. Your footer also makes no indication if you will publish replies via email in a way similar to comments so there will be people that won't bother if it is only you that will see their thoughts. Have you considered an info box where the comments would be to push anyone interested to mail? Or allow comments but make them work more like mail with comments not being publicly visible until you approve them? If you just want to cut down on non-targeted spam then it might be enough to have your comments work even slightly differently from the standard word-press solution, e.g. by adding a simple text field with a question that real human visitors of your site should be able to answer. This alone has worked for all of my sites that allow user contributions so far - won't stop anyone trying to spam your site specifically ofc but you can always take further measures WHEN that becomes a problem. PS: Is your site supposed to have a default WordPress favicon?
    - coldpie 4y ago
      > Have you considered an info box where the comments would be to push anyone interested to mail? Not a bad idea, thanks. Maybe I'll try that. I suspect the "problem" is I just have approx. zero readers :) > If you just want to cut down on non-targeted spam then it might be enough to have your comments work even slightly differently from the standard word-press solution, e.g. by adding a simple text field with a question that real human visitors of your site should be able to answer. Yeah, I'd like to do that, but I don't have the time/interest in figuring out how to make Wordpress do that. I tried googling for plugins or whatever a while back, but never found anything pre-made. > Is your site supposed to have a default WordPress favicon? Never thought of changing it!
fariszr 4y ago
Hmmm, maybe offload your comments to something else ? Im thinking of using GitHub issues/discussions as a comment system. The website and everything will function normally without CloudFlare, but the comments are based on GitHub, which will deal with spam and hosting for me. And i personally think using it is better from centralizing the internet view, as you don't increase the absolutely crazy 20% that CF controls of the web. But that obviously doesn't solve the DDOS problem, which should be solved with big cloud providers which have included DDOS protection. Another workaround is using IPFS, but for a normal user, he/she will need a gateway, and guess who operates on of the biggest IPFS gateways ?, Yes CF. That without considering the tradeoffs is using IPFS. I think a static site + external comment provider like Github, might help with the attacks and spam without using Cloudflare, but I don't have any website close to your blogs size, so its all just a predication.
- Zak 4y ago
  I've integrated a static site and a Wordpress site with Mastodon for comments. I rarely get any comments, but I never get any spam. I do generally think federated social networking (ActivityPub) is a good way to handle commenting. Comments are associated with identities separate from your site and there's plenty of opportunity to layer a reputation system on top of that, though I don't know if it's been done yet.
seydor 4y ago
Unfortunately, well-known platforms with known URIs are targetted way more than any custom website. I think if wordpress just allowed rewriting all the URLs would reduce spam attacks by a lot

toastal 4y ago

Putting everything 'behind Cloudflare' isn't a panacea. By merely living outside the West, I'm getting Geo blocked from 'normal' news sites and constantly having to solve hCAPTCHAs to solve riddles for some AI algo without compensation. It's such a burden and I find myself giving up pretty often. GeoIP blocking is what prevented me from getting my voter information out of my last domicile. Running everything through Cloudflare or similar also contributes to the concept of letting the internet be centralized around a few choke points that can hurt free speech (both the good and bad kind) and when they go out (which did recently) a large swath of the internet comes with it.

jks 4y ago
Does Cloudflare's "Privacy Pass" browser plugin help at all? It's advertised as reducing the number of hCaptchas you need to solve by a factor of 30, but I rarely see hCaptchas anywhere on my connection so I can't really evaluate myself.
nixcraft 4y ago
I agree with you. But, what solution do you propose for independent solo developers or people who wish to run a blog instead of using FB, Twitter and co to create content? Cloudflare may not be perfect, but it prevented me from shutting down my solo operation without putting a massive cost burden on me. When the first time DDoS hit, I had to beg one of those large cloud companies to reduce bandwidth costs. It took them forever to forgive that abuse and price, which was not my fault, and I was given a strong warning not to repeat such an issue again. There is no easy solution to this problem. At least with Cloudflare, people like me can stay online, but it does cause a problem for a bad IP reputation. TL;DR: I won't expose any of my projects or API directly these days due to spam, ddos and other abuse.
- account42 4y ago
  For commenting or forums the best solution IME is to require moderation review for all new users before showing the posts anywhere. You can also add a super simple "CAPTCHA" that is just a text field with a question easily answerable to any human looking at your site (e.g. name of $thing that your site is about without mentioning $thing in the question itself) to reduce load from non-targeted automated spam.

baisq 4y ago

People here like to say that BigCo has ruined the independent web and that everything is now siloed and blablabla but the truth is that running an independent website fucking sucks in many regards

jimmywetnips 4y ago
Exactly, sorry the current solutions don't live up to ideals, but if there's no better then we're already doing the ideal thing

nicbou 4y ago

Same job, same problem. I simply don't allow comments anymore. This is unfortunate, because they're amazing feedback if you write about bureaucracy. People won't take the time to write to you about their experience, but they'll leave a comment.

coldpie 4y ago
I came to the same solution, just disabling comments. There's a prompt to email me in the footer, but no one ever has. Shame, but that's the world we live in.
- account42 4y ago
  Just like with banners, nobody reads footers so that is not surprising. Your footer also makes no indication if you will publish replies via email in a way similar to comments so there will be people that won't bother if it is only you that will see their thoughts. Have you considered an info box where the comments would be to push anyone interested to mail? Or allow comments but make them work more like mail with comments not being publicly visible until you approve them? If you just want to cut down on non-targeted spam then it might be enough to have your comments work even slightly differently from the standard word-press solution, e.g. by adding a simple text field with a question that real human visitors of your site should be able to answer. This alone has worked for all of my sites that allow user contributions so far - won't stop anyone trying to spam your site specifically ofc but you can always take further measures WHEN that becomes a problem. PS: Is your site supposed to have a default WordPress favicon?
  - coldpie 4y ago
    > Have you considered an info box where the comments would be to push anyone interested to mail? Not a bad idea, thanks. Maybe I'll try that. I suspect the "problem" is I just have approx. zero readers :) > If you just want to cut down on non-targeted spam then it might be enough to have your comments work even slightly differently from the standard word-press solution, e.g. by adding a simple text field with a question that real human visitors of your site should be able to answer. Yeah, I'd like to do that, but I don't have the time/interest in figuring out how to make Wordpress do that. I tried googling for plugins or whatever a while back, but never found anything pre-made. > Is your site supposed to have a default WordPress favicon? Never thought of changing it!

fariszr 4y ago

Hmmm, maybe offload your comments to something else ? Im thinking of using GitHub issues/discussions as a comment system. The website and everything will function normally without CloudFlare, but the comments are based on GitHub, which will deal with spam and hosting for me. And i personally think using it is better from centralizing the internet view, as you don't increase the absolutely crazy 20% that CF controls of the web. But that obviously doesn't solve the DDOS problem, which should be solved with big cloud providers which have included DDOS protection. Another workaround is using IPFS, but for a normal user, he/she will need a gateway, and guess who operates on of the biggest IPFS gateways ?, Yes CF. That without considering the tradeoffs is using IPFS. I think a static site + external comment provider like Github, might help with the attacks and spam without using Cloudflare, but I don't have any website close to your blogs size, so its all just a predication.

Zak 4y ago
I've integrated a static site and a Wordpress site with Mastodon for comments. I rarely get any comments, but I never get any spam. I do generally think federated social networking (ActivityPub) is a good way to handle commenting. Comments are associated with identities separate from your site and there's plenty of opportunity to layer a reputation system on top of that, though I don't know if it's been done yet.

seydor 4y ago

Unfortunately, well-known platforms with known URIs are targetted way more than any custom website. I think if wordpress just allowed rewriting all the URLs would reduce spam attacks by a lot