Otherwise Occupied - spam

Blog comment spam

gregh — Thu, 14 Jun 2007 13:12:59 -0500

On February 14, I noted that after 3 months, Akismet, which I use to filter spam from comments here, had blocked 100 comment spam. The rate was roughly 33 per month.

Today, 4 months later, that rate is over 100 per month. The ironic part about this is that the comment spam has increased even as my blogging output has decreased. I had assumed that they would key off changing content, as that would seem to indicate more of a userbase. While they do seem to key off of particular content (anecdotally, this is the page most commonly spammed), they don't seem to care about new content or rate of change at all.

I'd suggest that slower turnover is better, because it could potentially indicate a site administrator who's not overly in touch with the blog. However, states from Scoble and Arrington seem to suggest that their substantially more popular and changing blogs are spammed at a much greater frequency, not counted in hundreds per month, but in hundreds per hour or more.

Based on the content, I assume it is still largely out to game the search engines by linking all over creation. Right now, I just let Akismet delete it after 24 hours. Akismet has yet to turn up a false positive -- given my low rate of comments, this is not a huge endorsement, however -- and only misses the occasional spam. If my numbers were bigger, I'm sure I'd be much less thrilled.

Clearly, something needs to be done about this scourge of bots that allows spammers to operate so freely.

"Peptide and Antibody"

gregh — Tue, 10 Apr 2007 11:23:46 -0500

You know your work is infecting your sensibilities when you open a mail with the above subject headings, worried that it might just be about system with those names and not a spam.

Blog comments

gregh — Mon, 12 Mar 2007 15:49:21 -0600

These people start off with such great feedback, yet they follow-up with all sorts of URLs!

"See you...Thanks, its great to receive such positive comments."

"This is a cool site! Thanks and wish you better luck! Brilliant but simple idea."

("Simple idea?" *sniff*)

"Your site was so interesting and informative I had to call a friend to tell her about it. Great work"

(Now, that one I like.)

I'm not willing to follow any of the links they've included.

Fortunately, Akismet continues to do a great job filtering this stuff out for me.

Akismet nabs its 100th spam

gregh — Sun, 28 Jan 2007 05:02:11 -0600

After trying a number of things to combat spam, a little over 3 months ago I installed Akismet, a free-for-non-commercial-use anti-spam service from Automattic, the people behind WordPress.com and WordPress.org. Of course, I don't use WordPress for this site; I use Drupal. No worries. The Automattic folks allow anyone to code to the API, and Markus Petrux of phpMiX.org has written a Drupal Akismet module.

As you can see from the counter in the lower right, in just over 3 months, Akismet has caught 100 spam comments. That seems to be a pretty good indicator that my site is not popular enough to be hit. I do run the Bad Behavior module, as well, which catches lots of comment spam before it gets to Akismet, rejecting it for petty little things like bad headers and stuff. My Akismet numbers might be higher, but I like that Referer spam is blocked by Bad Behavior.

Before Bad Behavior, the spam was much worse. But even with it, it was pretty bad. I used the old Spam module for Drupal, but it had pretty poor results. Then I shifted to captcha, but spammers got by it even when legit people couldn't.

Akismet has been wonderful. Nothing's slipped past, and nothing's been falsely accused of being spam. That's pretty good.

State anti-spam laws

gregh — Mon, 06 Nov 2006 17:43:19 -0600

My fellow USF School of Law blogger notes:

Spam:

This is good to know. Cal. Bus. & Professions Code section 17538.4 requires that spam have an opt-out feature. If you opt out and they continue spamming you, they can be liable for $50 per message up to $25,000 per day.

I wonder if the source of the spam has to be located in California?

The short answer... isn't particularly short.

California Business & Professions Code § 17538.4 was repealed in 2003. It was split up into a number of pieces. The most interesting are Cal. Bus. & Prof. Code §§ 17529.2 and 17529.8.

The former restricts the sending of spam from California or to email addresses in California (along with some restrictions on address harvesting):

Notwithstanding any other provision of law, a person or entity may not do any of the following:
(a) Initiate or advertise in an unsolicited commercial e-mail advertisement from California or advertise in an unsolicited commercial e-mail advertisement sent from California.
(b) Initiate or advertise in an unsolicited commercial e-mail advertisement to a California electronic mail address, or advertise in an unsolicited commercial e-mail advertisement sent to a California electronic mail address.

The latter provides the remedies:

(a)(1) In addition to any other remedies provided by this article or by any other provisions of law, a recipient of an unsolicited commercial e-mail advertisement transmitted in violation of this article, an electronic mail service provider, or the Attorney General may bring an action against an entity that violates any provision of this article to recover either or both of the following:

(A) Actual damages.
(B) Liquidated damages of one thousand dollars ($1,000) for each unsolicited commercial e-mail advertisement transmitted in violation of Section 17529.2, up to one million dollars ($1,000,000) per incident.

(2) The recipient, an electronic mail service provider, or the Attorney General, if the prevailing plaintiff, may also recover reasonable attorney's fees and costs.

The problem is, 15 U.S.C. § 7707(b):

(b) State law

(1) In general

This chapter supersedes any statute, regulation, or rule of a State or political subdivision of a State that expressly regulates the use of electronic mail to send commercial messages, except to the extent that any such statute, regulation, or rule prohibits falsity or deception in any portion of a commercial electronic mail message or information attached thereto.

(2) State law not specific to electronic mail

This chapter shall not be construed to preempt the applicability of--
(A) State laws that are not specific to electronic mail, including State trespass, contract, or tort law; or
(B) other State laws to the extent that those laws relate to acts of fraud or computer crime.

That would seem to leave Californians with only § 17529.5:

(a) It is unlawful for any person or entity to advertise in a commercial e-mail advertisement either sent from California or sent to a California electronic mail address under any of the following circumstances:

(1) The e-mail advertisement contains or is accompanied by a third-party's domain name without the permission of the third party.

(2) The e-mail advertisement contains or is accompanied by falsified, misrepresented, or forged header information. This paragraph does not apply to truthful information used by a third party who has been lawfully authorized by the advertiser to use that information.

(3) The e-mail advertisement has a subject line that a person knows would be likely to mislead a recipient, acting reasonably under the circumstances, about a material fact regarding the contents or subject matter of the message.

In short, we got a wimpy solution from the federal government that expressly preempted the laboratory that was being provided by the states. It allowed a bunch of folks in Congress to declare victory, when all we've really seen is a huge increase in the amount of spam. (At work, spam blocked by our very expensive filters currently knocks out around 50% of inbound email. Just a remaining trickle is actual spam after that.)

Until we can get widespread technical solutions, whether it's Microsoft's newly less-encumbered Sender ID, Yahoo's DomainKeys, the simpler SPF, or something else that's wandering around, things will continue to be ugly. Now that so much spam originates from the bots lingering around the world, trying to take any legal action against spammers is very, very difficult and expensive. The relatively small number of successful cases, given the huge expense of this problem, seems ample evidence of that.