It's a shame to kill such a useful feature as comments just because of spamming idiots.  I don't know about pyblosxom, but other blog softwares have anti-spam features that can help reduce the problem.  For my blog, since comments are very rare (almost none, in fact, since I just switched to WordPress and Advogato is down so nobody knows about it yet) I have moderation on, so I get a mail whenever someone tries to post a comment and I can delete/reject the spam items.  (I've had to do so 3 times so far.)

More intelligent plugins exist that can scan the comment body/information and reject them based on various criteria.

Why not switch to trackbacks, moderated if you want? At least you can hunt their publishers a bit easier IME.

Which reminds me: I must add a trackback receiver to my blog. I can send already.

Hi Jody,

I'm having similar (but lower) problem on my blog (also running pyblosxom) where somebody was sending SMTP command to try to lure pybloxsom comment mailing feature so they could use pyblosxom as an open relay. Hopefuly, the problem (which could only be used to send mail on the local system) was quickly fixed by pyblosxom hackers but the stupid spammer still send those comments.. I think I'll probably add a image containing a random string to protect comment submission (not very a11y friendly, unfortunately :(

Quite a few less honest sites are doing this. Their robots look for blogs, open web statistics and wiki pages.

If they find blogs they try and add links to their site all over them, then ask google to index it all. If they find wiki they do the same thing. The smarter robots seem to create wiki pages with apparently harmless names and uninteresting links and then google index that.

If they find an open web statistics page they parse it and slam the site with sufficient requests to get into the top referrers and then google index that.

Nice people aren't they 8)

Hi Jordi,

this is quite common, I usually get a 5 entries like this every week. I use Movable Type and an anti blogging module for it which basically works as a black list. If a url is in the black list I can just press a button to despam my blog (all entries). Otherwise I can just add it to the black list and press the button.

With the current amount of spam this works fine.

There are two other things that you can do (the latter being a more long term solution).

* Rename the cgi script that lets you post. In some cases the spambots know where the cgi is installed on a default installation and just tries to post using that URL.

* Use the technique used by for example Orkut when you register. That is you post an image with a string in it that the user has to type in to make the post valid.

Yeah, I've had that too on my LiveJournal account. The spam people seem to stop nowhere to push their damn junk down your throat. Luckily, you can have it semi-moderated at LiveJournal; if you have an account, posts appear immediately, while if you post anonymously, you need to wait for moderation first.




That works awfully well. In my case, they tried anonymously at first, but I blocked it; then, they registered a new account. All I needed to do was to send a mail to the LiveJournal admins; and less than an hour later, all those spams were gone :-)

It would be pretty cool to have comments queued up and piped through spam assassin or similar, by upgrading them into mails temporarily/locally... disabling HTML may also reduce interest.

With my Movable Type installation, simply renaming the CGI script and all the references to it eliminated 90+ percent of the comment spam, suggesting it was bot-based. Now, interestingly enough, the few spammers I do get always seem to add their cargo to the blog entry I wrote about the changes I was making to eliminate blog comment spam.

You haven't encountered blog spam until now? Surprising!

Anyway my suggestion is that you remove the URL field in the form and disable HTML in the comment box.

Wow!

Thanks for all the input. I'll have a look at the currently available solutions for pyblosxom.

Yeah, from what you guys say, it's quite surprising I only noticed this spamming now. I hope I can get rid of it soonish.

Jordi, Have a look at this:
http://notreally.org/blog/devel/Python/pybloxsomnospam
and http://notreally.org/blog/devel/Python/pybloxsomnospam2