The problem of trackback and comment spam in Drupal, and one way to address it

... could still work. I used time as an example because it's a good way to get a sufficiently unique string without randomness. It could have the added benefit of naturally sorting in order by date.

As for pathauto, I realized right as i was walking up to dinner after I posted that it wouldn't prevent the problem I'm facing. Actually, nothing really would; what I'm suggesting actually requires some deep changes and I'm aware of that. I just wish people would be aware of this.

I think the design transparency of Drupal clean URLs is a beautiful thing. Unfortunately, it's too nice to live -- it's like the trusting child who always gets taken advantage of. I'm not suggesting we make the child less beautiful -- just a little less easy to manipulate.

What methods *do* they use?

What methods do the spammers use to decide what pages to attack, if they don't automatically formulate URLs based on the target CMS?

And the point isn't that I need a better spam module; the point is that there is a design defect in Drupal that makes it a more attractive target for spammers. To counter this, you'll need to demonstrate to me that the spammers aren't exploiting that defect.

You seem to be changing your argument, BTW. First you say, "they don't use something as simple as" URL extrapolation based on the target CMS. (BTW, I've yet to see a 404 for mt-comment.cgi, which tells me that they know it's a Drupal site and suggests that they're targeting accordingly. But I digress.)

Now you say, 'it doesn't matter what algorithms they use, because they'll keep attacking no matter what and there's nothing you can do about it.' And then you point me to a spam control module. Ignoring the fact that when the spam module worked for me, spam attacks still resulted in my site being taken down. Not making all the database hits needed to load a page is great, but it still misses the root point: It would be easy to make Drupal a lot less attractive to spammers by changing how node IDs are assigned.

That "it's all about volume" was more or less precisely my point: They have close to zero cost, as I thought I established in my initial post. So they can afford to use dirt-dumb algorithms. I knew that. that was my point. But even if your cost is close to zero, there's a difference between tossing, say, three-digit node IDs, and 13-digit node IDs. The probability of hitting with a node IDs that's on the order of size and complexity of, say, a timestamp, is a factor of maybe ten thousand lower than with a three-digit node ID.

I think a decreased probability of success on the order of a factor of ten-thousand would make a difference even to spammers. Remember: They don't have real costs, but they do have opportunity costs -- after all, those zombies could be off doing something productive with their bandwidth rather than jousting at some Drupal-powered windmill all afternoon.