How I shut down comment spam on jeffcroft.com:
jeffcroft.com/blog/2012/jan/…
Jeff Croft
@jcroft Dude, the whole reason that system works is because no one knows about it. Why would you publish that???
Mike Davidson
@mikeindustries Information wants to be free.
Jeff Croft
Mike Davidson
@mikeindustries You posted it on Twitter. What's the difference?
Jeff Croft
@jcroft Because tweets essentially disappear a week or two after you post them.
Mike Davidson
@mikeindustries What do you want to bet I don't start getting comment spam anytime soon?
Jeff Croft
@jcroft You're totally missing the point of it. Security by obscurity. As soon as someone writes a WP plug-in for it, it's done.
Mike Davidson
@mikeindustries Nah. Not the way my version works. Just change the secret string if/when someone catches on.
Jeff Croft
@mikeindustries Mine works a good bit differently than yours...you just pointed me down the right path.
Jeff Croft
@jcroft No, when a WP plug-in is written, the spambots will get rejiggered to manually set off the timer.
Mike Davidson
@mikeindustries Mine is two-pronged, though. The timer alone isn't good enough.
Jeff Croft
(@mikeindustries's circle of trust) @jcroft
Shaun Inman
@shauninman Yep. @jcroft got just array_pop'ped.
Mike Davidson
@jcroft Sure it is. Yours works essentially the same. Bots aren't going to store your key.
Mike Davidson
@mikeindustries Don't forget that the single biggest reason this is effective is that it requires JS, and bots don't have JS.
Jeff Croft
@jcroft Some do. The more popular a JS-based technique gets, the more bots will use JS.
Mike Davidson