New tactic against Trackback spam
Hmm. I’ve confirmed that all of the really bad spam we’ve been getting over the past couple of days is Trackback spam. I have no idea why we’ve been getting hit so hard, but whatever. Currently, there aren’t any solutions for WordPress which address Trackback spams effectively (that I know of), which is unfortunate.
But hey, what’s the use of a programming degree if you never get to use it, right? So I went ahead and disabled the display of all trackbacks. My “fix”, such as it is, is to add the following bit to the query on or near line 87 of wp-comments.php:
and not match(b2comments.comment_content) against ('<trackback />')
Okay, so that’s not much of a fix; all I’m doing is supressing the display of any comments which have “<trackback />” in them (that’s the magic foofy tag the WordPress guys use to tell that a comment is really a trackback. Why they didn’t just use a flag in the database, Lord only knows.) Also it sucks because I still have to go in and delete all of the bad trackbacks from the comments database; once there are more trackbacks than real comments this fix will stop working.
I’ll enable trackbacks when spam karma gets effective at blocking trackback spams. Until then, no way. Oh, and if you link to me, you can still do the trackback, it just won’t show up until I reenable them. It’s not like I did anything useful, like, block new trackbacks entirely or anything like that.
January 7th, 2005 at 2:31 pm
John:
They were doing that because theyre 1) following the TrackBk specification and 2) treating TBs as they do other comments.
January 7th, 2005 at 2:49 pm
Hmm, I had to edit your comment, I guess you can’t say Tr*ckB*ck at all. Mysql must be ignoring punctuation.
January 7th, 2005 at 3:26 pm
Did you encode the < and > with their ASCII equivalent? You might need to escape the slashing as well.
January 7th, 2005 at 3:31 pm
And anyway, John … go to Options –> Discussion and change your setting to disallow TB and PB pings, and then run an UPDATE wp_posts SET ping_status = enum(’closed’) WHERE ID >0; to kill pings on each entry.
January 7th, 2005 at 4:20 pm
Heh, no, then I would have to turn them back on again. My hack only changed the code in a couple places which are easy to remember. Im holding out until SK gets good enough to trap all tr*ckb*ck spams (SK is catching over half of them.)
January 7th, 2005 at 5:54 pm
You might grab Spam Words, which seems to be helping me catch a goodly chunk of the TB spam attempts.