But, that was not going to float when I started getting 20-30 comment spams a day. So I turned to a filtering solution: akismet. Akismet’s pretty decent, it does a good job catching about 99% of the spam that gets tossed at stuff, and leaving the moderation rules in place caught 90% of what made it past akismet (leaving only about 1 in 1000 that got through unmoderated). That was all well and good, right … it worked, it was sane, it had a good performance rate and a very low false-positive rate (I’ve seen maybe 3 false positives between here and gotwoot, which is set up exactly the same as this blog).

But, spammers have been winning the fight. Lately, they’ve been designing more and more messages that make it through akismet, and akismet’s false positives are getting worse because to catch all the spam means to catch broader patterns, which include legitimate comment patterns.

Well, I wasn’t happy about that. I don’t get a whole lot of traffic over here, but I do get a fair lot on gotwoot, and losing 2% or so of the legitimate comment traffic to false positives on spam filtering meant having to pay too much attention to the filters too often.

So, I decided it was time to move away from that model. Akismet’s a post-comment filtering system. The moderation queue is another post-comment filter. They treat the symptoms, but not the disease. So I moved the whole mess forward a step.

Captcha! is a more direct approach. Rather than guessing whether a comment is legit or not, why not just block out the generally irritating spambots before they can comment at all?

Captcha’s author suggests that it’s better for now to use other tools … like checking to make sure the user’s browser understands javascript, and that eventually captcha will be OCR-breakable (which is quite true). However, any technique can be automated given sufficient computing power. Breaking a captcha with OCR requires the comment-spammer to have the computer resources to OCR the image at all. While that’s not terribly hard, it’s a hell of a lot harder than just churning away using POST requests (since it means establishing a session, getting, parsing, ocr’ing, and then posting). It’s not a huge problem to do on a single page, but automating it will certainly slow down the spammer a bit, hurting his efficiency and making it cost slightly more than the nothing that it currently costs him.

They say “a stitch in time saves nine” and all that. The way I see it, captcha is the stitch before the tear gets worse, akismet’s the ten late ones to fix it up.

That said, I use them both now. If someone does break captcha with OCR, they’re also going to have to get past akismet :p.

Incidentally, since installing captcha on gotwoot and here, I went from ~50 spams a day being caught by akismet to none at all being either akismetted or moderated, and none getting through to the front page. So, so far it’s been 100% effective, which makes me happy. And I’ve aimed for a generally readable captcha, which nobody’s complained about yet… so I guess everything’s cool!

For those that don’t, it means the term “blog” is probably sort of inaccurate for what I actually do here, so … you know, I figured I’d change it to be a bit more semantically accurate.

’cause you know me and semantics.

All I can say is, great work, akismet. That’s a lot of spam that I didn’t have to wade through.

Akismet … seriously kicks ass. I got 58 comment-spams today, and precisely zero of them ended up making it past akismet.

For some numbers: I’ve had one false positive and three false negatives with akismet, out of drawing near 700 spams since getting complich8.net.

Pretty amazing, that…

I’ll make a couple real posts later this week (or this weekend? dunno when exactly) … but for now I’m too busy dealing with broken gotwoot and broken seaslab security model and broken sleep schedule to put together enough coherent thoughts to post anything else… so there ya go :-p.

So I did what I’ve done in the past: I smacked down a mysqldump of the important tables, dropped all the tables and did a clean install.

But then I had an idea!

MySQL has pluggable storage engines, right? And the default is MyISAM, right? Well, MyISAM sorta blows (doesn’t support transactions, is generally unsafe, uses ISAM indexing). So what if I were to take the table dump, and turn all those MyISAM tables into InnoDB tables….

See, I have already narrowed the problem down as far as “something wrong with one of the wordpress config tables” (as in, not something wrong with the php, and not something wrong with the post or comment tables on the mysql side). So … what could it be? Well, what if it’s that the options db is getting corrupted because of some glitch or another? And, further, what if said glitch is because MyISAM is a sloppy bastard that is moderately unreliable (which is generally true, it’s very much not an ACID compliant engine).

So I did that. Now my entire wordpress install is working off of InnoDB. Of course, I won’t know if that actually fixed the problem until the problem shows up again. But we’ll see, right?