Hacker News Reader

Comment by asar | Hacker News Reader

I really like the idea and the implementation looks nice! But not having any type of spam protection is a deal breaker for me. Even if links are set to nofollow, it's still a big opportunity for bots and spammers to abuse this system and spread their links, similar to what is happening to misconfigured wordpress sites.

View on HN

Thanks for the feedback. I'll add Akismet integration to the backlog for people with the same objection. Allowing people to pass an API key to their Namespace shouldn't be too difficult but I'll need to build out a UI for separating ham versus spam which might take more work.

In the Namespace settings you can force all comments into moderation before displaying to the page. This would be the best option for you in the mean time.

One quick win that might catch most of the bots is using CSS to hide an dummy form input.

No human will see it if their browser properly renders, but bots using CSS selectors might fill it in. If you see that field is filled in then you have a high probability of it being a bot and can drop it.

yup. This really works for dumb bots.

Regarding the hidden form input, make sure you aren't blocking screen reader users/the visually disabled accidently. Make sure you can't end up in that input with the tab key.

I've found that comments submitted in less than 7 seconds from page load are spam. On a few low traffic sites I just discard anything faster than that.

A few bots seem to load a page, wait a while, then come back to it. But by and large they seem to try to submit the comment immediately after page load.

Mind you, this was on low-traffic sites. High traffic sites I'm sure see more varied techniques.

I like this. I'll add something like this to the backlog.

`aria-hidden` and `display: none` should effectively hide it from screen readers and you shouldn’t hit it with tab.

Do you need both, or is `display: none` enough?

display: none should be enough.

If you notice issues while testing, aria-hidden is a good thing to have in your back pocket

This is trivial for most bots to bypass nowadays with headless browsers and such.

Something that may be useful here: https://stopforumspam.com/

I love the project but consider integrating oopspam (https://oopspam.com) instead of Akismet. Akismet is basically adding a tracking. People from the EU cannot use it with Akismet.

Reply on news.ycombinator.com