4 ms·

> Maybe they should change the button to say, "I am a robot"? Long time ago I saw a post where someone running a blog was having trouble keeping spam out of th

by Izkata 1y ago

> Maybe they should change the button to say, "I am a robot"? Long time ago I saw a post where someone running a blog was having trouble keeping spam out of their comments, and eventually had this same idea. The spambots just filled out every form field they could, so he added a checkbox, hid the checkbox with CSS, and rejected any submission that included it. At least at the time it worked far better than anything else they'd tried.

starshadowx2 1y ago
Something like this is used in some Discord servers. You can make a honeypot channel that bans anyone who posts in it, so if you do happen to get a spam bot that posts in every channel it effectively bans itself.
- 3036e4 1y ago
  Most web forums I used the visit had something like that back in the day. Worked against primitive pre-LLM bots and presumably also against non-English-reading human spammers.
- mudkipdev 1y ago
  There is a new method with the 'server onboarding' where if you select a role when joining it auto bans you.
bo1024 1y ago
Yeah, this is a classic honeypot trick and very easy to do with pure HTML/CSS. I used a hidden "Name" text field which I figured would be appealing to bots.
ChrisMarshallNY 1y ago
I did something almost identical. I think I added a bogus "BCC:" field (many moons ago). It worked almost 100% of the time. No need for a CAPTCHA.
throwaway290 1y ago
I know people who did this decades ago and it worked
JangoSteve 1y ago
This was a common approach called a "honeypot". As I recall, bots eventually overcame this approach by evaluating visibility of elements and only filling out visible elements. We then started ensuring the element was technically visible (i.e. not `display: none` or `visibility: hidden`) and instead absolutely positioning elements to be off screen. Then the bots started evaluating for that as well. They also got better at reading the text for each input.
- iwwr 1y ago
  Each step in that chain is harder to do and more computationally expensive.
mmsc 1y ago
That's more or less how Project Honey Pot [0] worked for forums, blogs, and elsewhere. Cloudflare spawned from this project, as I remember, and Matthew Prince was the founder. [0]: https://en.wikipedia.org/wiki/Project_Honey_Pot https://en.wikipedia.org/wiki/Project_Honey_Pot
Legend2440 1y ago
Would not work in this case, because it is actually rendering the page in a browser.

by Izkata 1y ago

starshadowx2 1y ago

Something like this is used in some Discord servers. You can make a honeypot channel that bans anyone who posts in it, so if you do happen to get a spam bot that posts in every channel it effectively bans itself.

3036e4 1y ago
Most web forums I used the visit had something like that back in the day. Worked against primitive pre-LLM bots and presumably also against non-English-reading human spammers.
mudkipdev 1y ago
There is a new method with the 'server onboarding' where if you select a role when joining it auto bans you.

bo1024 1y ago

Yeah, this is a classic honeypot trick and very easy to do with pure HTML/CSS. I used a hidden "Name" text field which I figured would be appealing to bots.

ChrisMarshallNY 1y ago

I did something almost identical. I think I added a bogus "BCC:" field (many moons ago). It worked almost 100% of the time. No need for a CAPTCHA.

throwaway290 1y ago

I know people who did this decades ago and it worked

JangoSteve 1y ago

This was a common approach called a "honeypot". As I recall, bots eventually overcame this approach by evaluating visibility of elements and only filling out visible elements. We then started ensuring the element was technically visible (i.e. not `display: none` or `visibility: hidden`) and instead absolutely positioning elements to be off screen. Then the bots started evaluating for that as well. They also got better at reading the text for each input.

iwwr 1y ago
Each step in that chain is harder to do and more computationally expensive.

mmsc 1y ago

That's more or less how Project Honey Pot [0] worked for forums, blogs, and elsewhere. Cloudflare spawned from this project, as I remember, and Matthew Prince was the founder. [0]: https://en.wikipedia.org/wiki/Project_Honey_Pot https://en.wikipedia.org/wiki/Project_Honey_Pot

Legend2440 1y ago

Would not work in this case, because it is actually rendering the page in a browser.