It’s ASCII art in 2pt font. What a way to avoid the spam filters.

UDP (46 bytes) from 76.187.107.238:26546 to 76.178.xxx.yyy:33273 on eth0
UDP (46 bytes) from 76.173.19.250:53379 to 76.178.xxx.yyy:33273 on eth0
UDP (46 bytes) from 75.31.97.247:28101 to 76.178.xxx.yyy:33273 on eth0
UDP (46 bytes) from 76.170.130.124:32888 to 76.178.xxx.yyy:33273 on eth0
UDP (46 bytes) from 70.105.249.4:49884 to 76.178.xxx.yyy:33273 on eth0
UDP (46 bytes) from 69.31.210.146:23186 to 76.178.xxx.yyy:33273 on eth0

/boggle. Hundreds of packets per minute.

I thought the culprit was the mail system, the available resources spread too thin to spam check and bounce so many messages every minute. After some experimentation, I found that killing mysqld dropped my load average to normal levels. That dropped the blame squarely on the shoulders of the web server, as the only process that uses the database regularly.

A quick check of the last thousand lines of access_log covers 18 minutes of requests. A cool 925 of these requests were POSTs to wp-comments-post.php. Amazing that so many people could directly comment on my blog without first reading the post itself.

Commenting on my blog now requires users answer a simple question. The answer will determine if the comment is posted, or if the comment dies before ever accessing the database or spawning another file read.

May future battles be more meaningful.

From: Mohinder Short <shokinmohin@india.ensim.com>
Date: Tue, 4 Oct 2005 01:16:28 -0500
To: Allegria Harrow <sales@removed>
Subject: Re: Hi hedgehopping
X-Mailer: Microsoft Outlook Express 6.00.2800.1106

Hi, nice to meet you. Do you want
d less On
dications?
to spen
your Med
VLXCAV
iaggevitannaiallmmbialli
ra $3traxis $1enum $3
33 .21 .75
And many other Get dettailed infoormation
Best regards

Well, it looks like those meds are working out pretty well for you. Where do I sign?

When my blog gets spammed, I’m responsible for those outgoing links. I authorized the anonymous comments, I let the link show up, and, while I have every intention of deleting the spam, it’s still going to sit there for hours or days, possibly in view of an indexer. I’m not cool with that. Nofollow would fix my problem, but it’s not in my release of WordPress. I plan on upgrading in the near future, but it will be a task, and I’m not ready for it yet. Instead, I’m leveraging my “blessed” attribute to decide which comments can and cannot use HTML.

New functionality is as such: by default, all comments are not blessed. The poster’s name will not link to his website even if he provided a URL, and all HTML will be stripped from his comment. Hours pass. I find the comment and bless it. WordPress shields it from future comment cleansing, and enables the poster URL and tags. Simple. There is a period of time where the legitimate comments are somewhat crippled, but at least the content is present. Seems like a decent compromise to me.

Have you ever seen compliment spam on this site? There are no links, just some message to the tune of “I loved your site!,” obviously automated. I can only assume they exist to muck up filters and make comment moderation hard, if not impossible.

For a long, long time I’ve been quarentining spam. I’ve added a comments_removed table to my WordPress database, and I’ve modified the stardard “Delete” mechanisms to instead move comments into this holding pen. I can use this table for tracking, statistics, as a corpus for eventual bayesian filtering, etc. As a bonus, if I accidentally “delete” a comment, the result is non-destructive. Recently, I’ve taken things a step further.

Every so often, I visit my blog’s admin section and backtrack through the spam a page at a time. WordPress helps me out. I can search for keywords (“poker,” “holdem,” “levitra”), then click “Invert Checkbox Selection” and “Delete”. Eventually, I hit a wall of good comments and I have to tread more carefully. Even worse is when a comment is posted in the midst of all the spam. I have to work around it for the rest of the session until it’s back with the rest of the good comments. This is not ideal. I can mark a comment as spam, so why can’t I mark it as “ham”? (The anti-spam, as it were.)

As of last week, my comment tables include a new column: comment_blessed. Set the value to “1″, and the comment will be ignored in the admin panel comment list. The initial version has removed the spam/ham wall, since all the known-good comments are hidden during the deletion process. Future additions will include a “Bless” action so that I can bless without accessing the database directly.

It’s not ideal (I’m still getting spam, after all), but it’s progress. Spammers beware.

I’ve heard others express concern over the sudden devaluation of our biggest currency, the link. (To steal a phrase from Weez’s student.) Linking has built the Google-centric web as we know it. To stricken a large part of the links from the record books changes Google (et al), and will affect our searching in the future. This is true, I will not contest it.

That being said, my blog is my house. I put effort into the posts that go here, and I link to sites that have some value to me. Other sites link to me in turn, for the same reason. I have a decent page rank, and I’d like to think I have earned it. I create the content, I take the time, I foot the bill. If links are currency, links in comments are spent using my checkbook. PageRank represents the linking practices of the Internet community, but this idea goes down the toilet when any fool with a browser can link to his own site from the highest-linked-to (and therefore, highest-ranked) of websites. Nofollow makes linking truly representative.

Tweaking Nofollow

While this is one important aspect, that doesn’t mean blog comments have no value to me. Entries can spark very good discussions with very pertinent links, and there is little reason to blanket an entire history of comments with nofollow.

Why do I hate spam comments? They have no value to me. They are completely off-topic, and leech off my bandwidth, my server space, my PageRank, and my free time. I will delete a spam comment, whether nofollow is around or not. What nofollow does is remove the spammer’s incentive to comment on my site. Yes, people might still click on the links directly, but I imagine the improved search engine ratings are the driving forces behind spam commenting.

So, comments with links are good, involuntary linking to sites about online perscription drugs is bad. What to do?

Why not allow comments to be marked as “approved?” I can delete the spam for the day, and mark the entire back archive (or select posts) as “clean.” The nofollow filter passes over these clean posts, only touching potentially harmful comments. It’s a possibility, one among many, I’m sure.

Fin

This attribute is not armageddon, just a more fine-tuned version of something we’ve had for a long time. It’s also very young, and still needs to spread and settle before the real impact will be realized.

In forty years we can all look back and tell our grandkids about rel=”nofollow” and how we though it was such a big deal.

The commenters leave no name, but do list an e-mail address. There are no URLs in the comment at all. What’s the point? To deluge me with too many comments to moderate effectively, in the hopes that true spam will slip through the cracks? That’s the only thing I’ve come up with.

How wretched.

I added a second graph for “Spam by Blog” right before posting this. Abra and Isaac are currently in the lead, but this could be anyone’s race.

In other news, I’ve added spam protection to my wiki, though I’ve yet to be targeted by a spammer on that site. It could happen, I guess.