These people really did go to far too much work...

[jducoeur]

Digging through the Rolls logs, I find that the spammers went to some real effort. They bothered to put real data into many of the fields -- they hooked the name fields up to name generators, location fields up to location generators, the whole nine yards. They even generated fake email addresses for the email fields. Clearly, they thought that there were automated mechanisms here doing data validation on the fields. And all completely to no avail: I still think the entire exercise was pointless, and the spam entries just look different from real ones, so it doesn't actually slow me down in deleting them.

(Although I'm not quite sure what they were thinking when they kept putting "square coffee table" into the Interests field...)

Comments

[fairdice.livejournal.com]

Could this also be explained by them doing too little effort? If they were already set up to do bulk wikispamming, they doubtless have existing random name/location/email generatots just sitting around. And a script that retrieves pages, asks to edit them, and fills in those randomly-generated values into fields with likely names (or maybe a human looks at the edit form once and tells the script which generator to query for each field's value).

By this logic, of course, you should protect the Rolls by using whatever captcha your research shows is the least popular: your goal is to pick one such that it hasn't been worthwhile for the scripties to write a decoder.

[jducoeur]

Possible, and you're right that a more obscure captcha is theoretically better. Actually, though, at this point I think the principal line of defence probably has to be a degree of moderation. If the data goes through an approval round, that pretty much stops the spam cold -- workflow defenses are usually more effective than technological ones.

It's possible that they could still inconvenience us by foolishly trying to hook their machinery up, even if it's going to fail, thus overwhelming the moderation process. But it's almost trivial for me to tweak the locations of the scripts if they do so, significantly less effort than it takes them to hook it up. So I believe I can make it entirely not worth their while to bother...

[alexx-kay.livejournal.com]

a more obscure captcha is theoretically better.

Only along some axes. The well-known ones now at least *attempt* to incorporate accessible alternatives for the visually-impaired. Mind you, they don't actually *work*, but it's at least a start...

[jducoeur]

Hmm. Good point -- the better-known ones are likely to be more mature in ways like that. Of course, I've begun to rethink the captcha idea in general, on accessibility grounds. I'm currently hoping that moderation plus some other tweaks will suffice...