Musings

I was going to leave a comment, at least a “me, too” (though I think both of us could probably drop our numbers somewhat from Sam’s), but I’ve gotten so bored sitting around watching tail -f access.log all day with only a couple of non-flooding nibbles, and reloading terrato.org to see if it’s still down (or just not accepting connections from me ;)) that I’ve sunk to reading Jeff K., and I fear that I’ll shortly descend to Jeff K.-speak, and declare myself king of teh Intarweb!!1!

So I better not comment.

So, do there exist public domain versions of those things the ticket sales sites use? They basically have a graphic that is recognizable as a series of symbols to a human, but not to a computer. You have to type in the code in order to do what needs to be done.

Would not such a thing solve all these problems? (excluding DOS attacks, of course)

That certainly took forever for you people to implement.

Quite frankly I was considering offering my services to the MT coders for a symbolic amount of money, but I figured it’d look too much like blackmail.

YHL HAND.

YHBT

YHL

Jacques–
The link to the patch is bad–take out “archives/” (and it’s more messed up in your feed)

Sorry to see you’ve become a focus for these vandals.

To prevent automatic spam on my blog, I implemented a Turing Test. The turing Test consists of a word in an image that would only be readable by humans. The commenter has to type the word into a text box in order to proceed. PayPal, Yahoo, and other places use a Turing Test to verify that it’s not a script that’s trying to insert a comment into my blog. I don’t use Moveable Type, so it would take more effort to customize a script to insert comments into my proprietary blog framework, and I don’t think anyone will bother. It was fun to figure out how to create the Turing Test though. Check it out here: http://www.donnyspi.com/blog

– Don

There’s even a MovableType [captcha] plugin, I believe (though that one is insecurely written and easily defeated, as the authors of the afore-linked crapflooding program discovered).

Here’s an evil idea… write more broken plugins and submit them to the usual, proper, places. Write a madlibs code generator to write hundreds of such broken plugins.

Someone looking to install and use a working plugin would, one would hope, use google to figure out what the community thinks is a good plugin, and then use that one. Recommendations work.

Meanwhile, script kiddies need to inspect each of those plugins and work out the security flaw to each of them, and then write code to work around those flaws, just in case they want to crapflood a blog which happens to have it installed.

There’s a flaw in this thinking, I know it.

FWIW, MT-Blacklist v1.63 beta (release candidate 1) is out and fixes the incompatibility with MT 2.661.

It also adds some nifty features which help clean up crapfloods…

Hey Jacques, for maintainability and compatibility my intention has always been to use the exact code that MT uses, EXCEPT for the changes necessary for my plugin.

If people wish to customize it, than that’s cool, but I am not going to presume that I know best and rewrite all the MT code. Some people, for one reason of another, may not want to use your fine methods. By sticking very close to the MT code, I give everyone the opportunity to do what they want. People who would patch with you code will still do it.

I agree that IP banning and IP throttling are lame and useless against a round-robin of sufficiently numbered proxies, but that’s not MT-Blacklist’s job.

Forgive me for being clueless, but how do I use this “patch”? Do I copy and paste it into Comments.pm and where, at the end? There are no instructions :) Also, do you know if this works with Blacklist 1.65? I’m using MT 2.661 and I’m desperate for a throttling solution.