I recently had some serious spam trouble, detailed here:

You might be wondering why my blog was down all day yesterday and part of today. Well, that would be because thousands and thousands of spam comments hit my blog at once, taking down the server at Open Source Host. For several days beforehand, I'd been watching phpMyAdmin and running these commands:

DELETE FROM `comments` WHERE `subject` = 'insert spam subject here'

which would delete ~2000 comments at a time (and I did this more than once a day). Finally it was too much for the server to handle. After much discussion with Charlie about possible options, I agree that the only solution, at least for the time being, is not to allow anonymous comments. This means if you want to comment, you'll have to register here. I've got comments turned off completely now, and I'll wait a few days before turning them back on.

I've been adamant for a long time that it's best not to put up any perceived barriers to communication on my blog. People don't want to register on sites and login, even though I have to point out that logging in isn't any more trouble than leaving one's name, email, and URL every time one leaves a comment. I know that after I make this change, my number of comments will be drastically reduced. People who are just cruising by, who don't plan on commenting here long-term and don't want to make the commitment of registering with the site, won't leave comments anymore. People who comment here regularly but who don't want to register won't leave comments anymore. I worry that my blog will become more broadcast, more one-to-many. I don't want it to be that way, but it seems the alternative is no blog at all, unless I want to use a different software tool, which I don't.

So right now, much as I don't like it, I'm not allowing anonymous comments. It has already affected the number of comments I receive. What I'm wondering, though, is if I could create a multipurpose username and post the username and password for people so they wouldn't have to register, thereby eliminating the steps of registering, having the password emailed to them, going back to the site, changing the password, etc. Sort of a bugmenot for CultureCat.

What happens if, say, ten or twenty people are logged in under the same username at the same time? Would it not work? I don't want to try it until I hear from some Drupal-savvy people.

Oh, and I'm also thinking about the captcha module, but if I understand my situation correctly, it's not that the spam got through, but that the enabling of anonymous comments permitted the spambots to TRY to post comments, and THAT is what brought down the server, all the hammering by scripts. Charlie has more on my situation.

So would a multipurpose username work? It might be a stupid question, but please humor me.

Comments

clancy@culturecat.net’s picture

I'm going to be creating accounts for commenters I don't want to lose and emailing them their usernames and passwords. I'll even create avatars for some of them. A sort of flattery/invitation. Maybe then people won't stop commenting. This is going to be an interesting social experiment, I think.

CultureCat

media girl’s picture

Aside from the DoS issue, which is going to happen no matter what (they could just attack your user registration to overwhelm the server), have you had no success with the spam and trackback modules?

Last I checked, the patches to get trackback to pass through the Bayesian spam filter controls have not been committed, but if you go through the effort of applying them yourself, they do work.

Then again, I've received no more than 100 a day, not 1000 simultaneously.

--
mediagirl.org

oNyx’s picture

[...]if I understand my situation correctly, it's not that the spam got through, but that the enabling of anonymous comments permitted the spambots to TRY to post comments, and THAT is what brought down the server, all the hammering by scripts.

If that's the case and if those bots are rather simple (and build to spam drupal sites), then a possible solution would be to change the urls for the "post comment"-links. In addition trying to load a post comment page with the usual path should be redirected to an empty page (for avoiding the overhead of generating a 404, which is really tiny - but adds up rather quickly under DoS attacks). Doing so will reduce the cpu usage per spam try down to a tiny fraction.

And bots which really crawl the site can be tricked out with captchas.

HTH

cel4145’s picture

this? (look at any of the posts that would normally have the "login or register to post comments" links).