Hacker News Reader

Comment by chime | Hacker News Reader

I have been using pseudo-timestamps and honeypot fields for a while now and it has worked pretty well for me. I get a bit of spam every now and then but it is usually someone manually copy-pasting. I could safely block those too but it is infrequent enough that I don't need to bother.

Here's my algorithm:

    /form-show

      fieldhash = hash(ymd(today))
      valuehash = hash(remoteip + ymd(today))

      <input type=hidden name=fieldhash value=valuehash>
      <input type=text name=email value="" style=display:none>

    /form-validate

      field0 = hash(ymd(yesterday))
      value0 = hash(remoteip + ymd(yesterday))
      field1 = hash(ymd(today))
      value1 = hash(reomteip + ymd(today))

      if(post[email] != "")
        // reject form

      if(post[field0] == value0 || post[field1] == value1)
        // accept form

View on HN

Wait until your site gets popular. It'll get fun sooner or later.

The latest thing I'm seeing on my site is a robot that automates real web browsers, jumps between ip addresses, scrapes real user content off the site, then posts it back using some form of Markov generator to make the content look unique. It'll do that on new accounts for weeks before trying to insert any links.

It's amazing the lengths spammers will go to to get their content onto your site. In this case, the crawler is clearly written specifically for my site, even though it's only PR4 and nofollows all its links. It's no wonder 99% of the content on big sites like Blogger is spam.

That's getting dangerously close to xkcd's gold standard of spambots that actually make well-written, useful contributions to the discussion.

Link: http://xkcd.com/632/

Actually he was referring to http://xkcd.com/810/

Interesting analysis. I knew that people put effort in spamming, but never new they go so far.

Most modern bots know to jump over fields that are type=hidden or display:none/visibility:hidden - your site just isn't big enough of a target yet.

Even hiding the CSS externally doesn't help, many bots now use inline browsers to decode javascript and stylesheets.

There's no single way to block spam. I just showed two of the most basic methods I used. There are lots more that can be setup if spam starts to become a problem without resorting to captchas.

what i've done recently is give a text field a worthless class, then use javascript to change it's class to a display:none. Sure bots may execute the javascript however it causes them to run much slower so I'd think the majority of them aren't.

You just gave me an interesting (but somewhat unrelated) idea.

You can "sign" a timestamp by appending a hash of that timestamp with some sercre value. This way, whenever the user submits your form, you can reliably determine when it was requested without storing anything on the server.

Reply on news.ycombinator.com