4 ms·

The principal difference is that Stopforumspam is a blacklisting method, and what I described is a whitelisting one. Theirs is an effective approach, and it wo

The principal difference is that Stopforumspam is a blacklisting method, and what I described is a whitelisting one. Theirs is an effective approach, and it works great for dedicated forum sites. But I think it's an overkill for simpler setups for two reasons. First, it creates an obvious dependency on an external service. Second, if I want to allow unregistered posting, it leaves me only with an IP address as a data point and here I wouldn't bet that their by-IP detection is too accurate. It's a simple, self-contained, virtually maintenance-free way to detect humans trying to post. I don't argue it's a superior to other methods, but it is simple and it helps simplifying the user experience of real visitors.

Jhsto 14y ago
I've been developing this 'invisible-catpcha' thing for a while now, which is basically meant to block bruteforce attacks and spammers alike from posting comments and registering accounts etc. The visual difference to the end-user is - as said - invisible, which obviously should be a good thing. Now that I read your comment I start to wonder would anyone really even use my service, as then their site's spam blocking would be dependent on me? Is there other people ho see it this way?
- latitude 14y ago
  FWIW I'm pretty sure that my views on external dependencies aren't very common or popular. I think you'd have no problem finding users for your service.
  - moepstar 14y ago
    IMO, this depends - i'm sure quite a few factor this into their decision on using or not but in the end it depends on your reputation being stable/online 99.XX% or being flakey...
- krapp 14y ago
  Unless you're google, I would much prefer to have something I can read the source code of and install myself.
deleted 14y ago
[deleted]
buro9 14y ago
But yet, if they are using Google over https, searched the issue there and found your forum... the lack of referrer header on your http site and no other activity for the user would have you falsely identify the user as a spammer. The cost of a false positive is great... you may lose a customer. By adding an email field to your form you'd get to use the blacklist and avoid false positives and the risk of offending an already aggravated customer.
- latitude 14y ago
  Ah, no. Of course, he's not identified as a spammer. Instead, he is identified as someone who needs to go through additional checks when posting. This can be combined with the stopforumspam check, and that would yield 3 categories of visitors - white, gray and blacklisted. It's just that in my own setups I haven't come across for the need to blacklist people. PS. If they searched the issue, they were presumably having it with my software, so it's quite likely they were on the site before and I can recognize them. That's not to say that direct hits into an appropriate threads from https://google https://google aren't possible. But they aren't that common either.

Jhsto 14y ago

I've been developing this 'invisible-catpcha' thing for a while now, which is basically meant to block bruteforce attacks and spammers alike from posting comments and registering accounts etc. The visual difference to the end-user is - as said - invisible, which obviously should be a good thing. Now that I read your comment I start to wonder would anyone really even use my service, as then their site's spam blocking would be dependent on me? Is there other people ho see it this way?

latitude 14y ago
FWIW I'm pretty sure that my views on external dependencies aren't very common or popular. I think you'd have no problem finding users for your service.
- moepstar 14y ago
  IMO, this depends - i'm sure quite a few factor this into their decision on using or not but in the end it depends on your reputation being stable/online 99.XX% or being flakey...
krapp 14y ago
Unless you're google, I would much prefer to have something I can read the source code of and install myself.

deleted 14y ago

[deleted]

buro9 14y ago

But yet, if they are using Google over https, searched the issue there and found your forum... the lack of referrer header on your http site and no other activity for the user would have you falsely identify the user as a spammer. The cost of a false positive is great... you may lose a customer. By adding an email field to your form you'd get to use the blacklist and avoid false positives and the risk of offending an already aggravated customer.

latitude 14y ago
Ah, no. Of course, he's not identified as a spammer. Instead, he is identified as someone who needs to go through additional checks when posting. This can be combined with the stopforumspam check, and that would yield 3 categories of visitors - white, gray and blacklisted. It's just that in my own setups I haven't come across for the need to blacklist people. PS. If they searched the issue, they were presumably having it with my software, so it's quite likely they were on the site before and I can recognize them. That's not to say that direct hits into an appropriate threads from https://google https://google aren't possible. But they aren't that common either.