Comments on: Die Spammers Die

By: belle waring

belle waring — Wed, 02 Feb 2005 06:14:38 +0000

silly old past self. what do you have in common with him anyway?

By: Yusuf Smith

Yusuf Smith — Wed, 02 Feb 2005 00:13:25 +0000

Jacques Distler said: In particular, that’s why the name of your trackback CGI script is not particularly relevant to these spammers. I’ve changed mine from the default “mt-tb.cgi”, but it’s only a little more work for the trackback spammer to find the new name using TB-Autodiscovery. Well, on my host a CGI script has to have a .cgi extension. So renaming it *.pl makes it inaccessible for spammers, or indeed anyone. By the way, CAPTCHAs (used against comment spam, not TB spam) are inaccessible for blind people’s screen readers as well as spam-bots. It’s why I didn’t use this when I had a big comment spam problem, as one of my regulars is blind.

By: ha

ha — Tue, 01 Feb 2005 23:39:23 +0000

The Spammers the

By: Jacques Distler

Jacques Distler — Tue, 01 Feb 2005 23:28:58 +0000

To be more precise, the method you’re looking for is called a CAPTCHA…

CAPTCHAs have nothing to do with (stopping) trackback spam. Trackbacks are automated computer-to-computer communication. No human intervention is involved. This post is about trackback spam. Why are people talking about CAPTCHAs?

By: Jacques Distler

Jacques Distler — Tue, 01 Feb 2005 23:27:36 +0000

To be more precise, the method you’re looking for is called a CAPTCHA…

By: Michael

Michael — Tue, 01 Feb 2005 23:05:01 +0000

To be more precise, the method you’re looking for is called a CAPTCHA ( completely automated public Turing test to tell computers and humans apart ). Most CAPTCHA’s consist of either a picture of some numbers or letters with some warping or other distortion, to fool automated software.

By: Jacques Distler

Jacques Distler — Tue, 01 Feb 2005 22:46:52 +0000

By the way, how does anyone know your TB addresses anyway? I’ve never been able to find them on any of your blog entries.

It’s right there when you “view source” on this entry: http://www.crookedtimber.org/mt-tb.cgi/3128 in a little commented-out snippet of RDF. This is used for Trackback Autodiscovery. In particular, that’s why the name of your trackback CGI script is not particularly relevant to these spammers. I’ve changed mine from the default “mt-tb.cgi”, but it’s only a little more work for the trackback spammer to find the new name using TB-Autodiscovery.

By: John Quiggin

John Quiggin — Tue, 01 Feb 2005 22:40:35 +0000

What’s the legal status of someone who hijacks open proxies like the spammer in the link above. Isn’t this a criminal offence? Not that this immediately resolves the problem, but it raises the stakes for all concerned. I note that the spammer claims that this is legal.

By: Yusuf Smith

Yusuf Smith — Tue, 01 Feb 2005 21:29:42 +0000

My normal method of dealing with TB spam is to log into my web host account and rename the tb.cgi file to something else, usually tb.pl. I have a banner at the top of my blog which says whether comments and TB are on or off. Generally TB spam floods happen in one go, and are over after a few hours. By the way, how does anyone know your TB addresses anyway? I’ve never been able to find them on any of your blog entries.

By: Matt Weiner

Matt Weiner — Tue, 01 Feb 2005 20:30:02 +0000

Darren, Would the Turing number help with Trackback spamming? Most of the Trackbacking I do from my blog is done automatically in some way—I don’t have to interact with the site I’m pinging. (Most of the Trackbacking I do seems not to work anyway, but that’s another story, I think.)

By: Jacques Distler

Jacques Distler — Tue, 01 Feb 2005 19:40:03 +0000

Ah, yes, many hundreds of attempted trackbacks on my site last night and this morning. None successful, since they all came via open proxies on the blitzed.org open proxy list. I 'spose I should write up a post on dealing with the critters, but until I get around to it, you might want to modify the mt-dsbl plugin to work with opm.blitzed.org instead of list.dsbl.org (which is mostly useless for current purposes).

By: Darren

Darren — Tue, 01 Feb 2005 17:57:04 +0000

Would a Turing number help prevent some of the attacks? “What is a Turing number? A Turing number is a randomly generated image that displays a series of digits. A user attempting to login to his or her account must be able to read back the digits and correctly echo them back to the e-gold website. The purpose of the Turing number is to prevent automated access to accounts. For the visually impaired, an audible turing number is available which provides the same benefits of the turing number, except that it is presented audibly rather than visually.”

By: john b

john b — Tue, 01 Feb 2005 17:42:23 +0000

“It’s German for ‘The Spammers The’”…

By: Kieran Healy

Kieran Healy — Tue, 01 Feb 2005 17:23:51 +0000

Might I suggest getting a copy of MT-Close and start closing all the old comments and trackbacks. We already have a little script that does that for comments more than a week old, and as of 5 minutes ago we now do it for trackbacks, too.

By: Backword Dave

Backword Dave — Tue, 01 Feb 2005 17:21:36 +0000

Steve, I think they do that already—after a post leaves the home page.