Comments and track-backs disabled after spam flood

Yesterday was the Random Oracle blog’s turn to become targetted in a track-back spam attack. Each post ended up with a handful of track-backs to articles on the same bogus blog, which appears to be nothing more than an undigested collection of random paragraphs from different WordPress blogs.

Requiring a CAPTCHA solution with each comment/track-back would have solved this problem. Windows Live Spaces (formerly MSN Spaces) has this option. It is far more effective than the alternatives of allowing public commenting or requiring authentication. The latter is not a barrier since the underlying identity system is disconnected from the real world and has no reputation attached. Spammers can register one account, use this to spam hundreds of blogs and move on to start from clean slate when the ID is black-listed. WordPress controls on commenting are primitive by comparison. Ping-backs and track-backs can be disabled, comments can be disabled or held in the queue for moderation. Finally comments can bet limited to users who had a previously approved comment, which creates a boot-strapping problem. Proof-of-work by solving CAPTCHAs is much better suited to this problem: users serious enough to comment on an article will not mind taking a few extra seconds to solve the puzzle. Spammers will give up and move on to the next blog.

cemp

HD-DVD processing key and Internet censorship

More observations:

  • Attempting to suppress information after it has been leaked on the Internet is highly counter-productive. The heavy-handed tactics required to force the hand of web-site owners and publishes across the world only serve to draw more attention to the problem. This is a lesson that DVD Copy Control Association learned the had way with DeCSS.  But it should have been an obvious point to extrapolate from individual experiences. For example Outlook/Exchange have a feature to recall messages– but the “recall” works by sending another message which the recipient must first open, before Outlook will process it to remove the original one. Emails are often sent by mistake; to err is human. But sending a recall only draws attention to the original blunder and virtually guarantees more people will read it. This is because most errors involve sending a message to the wrong audience: not recognizing the subject line or sender, most  busy people may be tempted to ignore the message or file it away for later review. Send a recall message though, and suddenly everyone dropals their work and dig up the original. (Bonus points for sending an additional message on top of the recall: in 2004 an HR person sent email containing salary information to an entire building at MSFT campus. She followed up with a high-priority message admonishing people not to open the original, even kindly explaining the contents of the confidential attachment. )
  • User generated content cuts both ways. It can fuel a website, but it can also bring untold dangers in the way of legal risk. Digg is far from alone here– witness the Viacom litigation over copyrighted content posted to YouTube. This is the trade off associated with riding an economic externality in the form of getting your audience to build your business: the result is a t the whim of users. Trying to shape the externality by weeding out the negatives can back fire. It is difficult to build a sense of ownership unless users feel they can post their choice of content, as opposed to content approved by the omniscient moderators.
  • Commercial ventures have a lot more to lose than individual bloggers. Deeper pockets equals greater incentives to be litigated for perceived wrongs. Digg has decided to take a stand and ignore the C&D letters. Depending on your perspective, this is either a principled stand to be applauded, or unabashed grab for cheap publicity via corporate martyrdom. Developments over the next few days will be interesting. Already there is speculation on whether Digg has any legal ground to stand on. But either way, the decision to stop censoring the content would have been difficult to justify for any reason to an established company.

cemp