Dear Vanessa --

I woke up this morning to find hundreds and hundreds of new spam-comments deposited on this blog. It took more than half an hour to cleanse them away. When it gets to this stage, spam-comments become more than a mere annoyance; they start threatening to make blogging not worth a blogger's time. In recent months, I've had to spend hours and hours of my life on spam-comment maintenance to keep this blog in running order. I've got nearly 500 IP addresses on our "banned" list so far. 500! -- that's 'way too much banning, and 'way too much time spent on banning.

But the worst was yet to come, because this morning I also discovered a scary and unwelcome new spam-comment twist, a new generation (I think) of spam-comments: spam-comments that appear on the public version of the blog -- a websurfer looking at a posting would see them -- but that don't show up from inside the guts of the blog. In other words, the spam-comments have been deposited on the blog in such a way that visitors can see them, yet I can't delete them. When I go behind the scenes to do my usual spam-comment maintenance, these new spam-comments are invisible, so I can't get at them to zap them.

I'm not sure I'm being clear, so forgive me for trying again. The affected posting when viewed by a visitor is dotted with spam comments. But the same posting when viewed from within Movable Type -- which usually shows the posting's contents as well as all the attached comments -- doesn't show that any spam-comments are on the posting at all.

Some examples of postings that from the public's p-o-v have tons of spam-comments on them but which from inside Movable Type don't: this posting here, this one here, this one here, this one here, this one here, and this one here. From within Movable Type, I can see none of the spam-comments visitors can see. So I can't remove them, and I'm having nightmares about watching the blog drown in tidal waves of spam-comments that I'm helpless to do anything about.

Has anyone run across these newfangled spam-comments? Is there a sensible way to contend with them?

Also: is now a good time to upgrade to Movable Type 3.0? I confess to feeling baffled when I look at Movable Type's webpage (here). I can't tell whether we're being told that geeks and only geeks should now make an early move, or whether the time has come for everyone to upgrade.

Many thanks for advice and tips.

Best,

Michael

Cripes, I hope I didn't catch anything by checking out the "here" links in this post. But no, I haven't quite seen this yet. Go to the Movable Type Forum and see if anyone else has--something like this is usually posted right away as it often affects those on the same service.

Posted by: susan on July 21, 2004 12:59 PM

There's still a D in the name of the Movable Type distros, so it's still for developers only I should say.

Isn't there such a thing as MT-Blacklist?

[I use Wordpress for an cms, so I do not that much about Movable Type. If you look at the Wordpress website, it seems that many former MT-afficianados have changed their cms to Wordpress and are glad to have done that]

Posted by: ijsbrand on July 21, 2004 1:37 PM

First off, install MT-Blacklist. Along with reducing the amount of comments spam, it also makes removing spam incredibly easy. Instead of spending an hour, you'll spend maybe 5 minutes at it. Secondly, I really don't see how there can be spam that you can't find to delete. Maybe you're looking at a cached page or something? Either way, Movable Type stores all comments as individual rows in the database, so there's really no way they can be unaccessible that I know of. Another anti-spam technique is to rename your "comments" link to something else. The spambots look for that text, so changing it reduces the chances of them finding it. Also, after a thread gets spammed, if it's old enough, you might consider closing the comments for it. Usually older posts don't get any new comments anyways, so you're not really losing out on anything there.

Posted by: mallarme on July 21, 2004 2:36 PM

Is the now-you-see-it-now-you-don't spam still there when you rebuild the page?

Posted by: Jim Kalb on July 21, 2004 2:46 PM

I also recommend using MT-Blacklist. But speaking of new tactics in comment spam, I received a spam comment the other day that included a link to my own domain among the Cialis adds and such. This tricked me into Blacklisting myself! Fortunately I caught it before running a scan and delete of my archives, but it's something to beware of if you use MT-Blacklist.

Posted by: Jacob Grier on July 21, 2004 3:24 PM

D'oh! Of course! Without rebuilding, even if you've deleted the comments from the database, they'll still show up on the site since MT creates static HTML pages for every entry to speed load times. That's another think MT-Blacklist is faster at-rebuilding entries.

Posted by: mallarme on July 21, 2004 3:43 PM

D'oh indeed -- I had no idea you had to rebuild the entire database for the spam comments to vanish on the public site. I rebuilt and now they're gone, praise the lord. Phew: nothing like being a tech-idiot. And many thanks to all. Next step: getting my webguy to install MT Blacklist.

Posted by: Michael Blowhard on July 21, 2004 3:49 PM

For future reference, you don't actually have to rebuild the entire site, just the individual entries affected, but it's usually easier to do it that way if you don't use MT-Blacklist.

Posted by: mallarme on July 21, 2004 4:19 PM

Get your webguy to install the MT-CloseComments plugin, too. It automatically closes comments on posts older than "x" days. You lose very little, except for the comments from randomoids that drop in from Planet Google on the ancient entries.

Posted by: Scott Chaffin on July 21, 2004 5:35 PM

I don't know anything about the nuts-and-bolts, but I've also seen a kind of "authentication" thing in use, where in addition to the name, e-mail and URL fields, there's a fourth field that contains a number on a grayish background that a commenter has to replicate in order to post. (Presumably, the spam-bots can't do it.) I know it's in use over at Pandagon.net, so either of those guys can probably tell you how to do it.

Posted by: Jaquandor on July 21, 2004 6:52 PM

MT-Blacklist and CloseComments are now installed.

Posted by: dnekm on July 22, 2004 1:22 AM

In Movable Type 3.0D, you no longer have to rebuild your static pages after deleting comments; it does it automatically.

Posted by: Will Duquette on July 22, 2004 12:28 PM






Post a comment

Name:


Email Address:


URL:


Comments:


Remember your info?