Comment spam killing MT weblogs?
Slashdot has an article on how comment spammers are killing Movable Type blogs by introducing high load on servers. The report turns out to be talking about a bug in MT 3.x, whereby the server gets put under high load even if the comment is rejected by MT 3.x's anti-spam measures.
What about MT 2.x users, though? Movable Type deliberately left MT 2.x users in the cold in this regard as gentle encouragement to upgrade to MT 3.x. For me and many others, this is more hassle than it's worth, although we definitely don't want to have to continue to fend off the torrential spam that is coming through these days. These fuckers will do anything to get their links crawled in an effort to increase their PageRank.
Below, you'll find a simple patch to MT 2.661, the last of the 2.6 releases. Once this is applied and someone tries to post a comment, MT will read a couple of files, bad_words and bad_urls, and reject the comment if either the author name contains any of the bad words or the comment field contains any of the bad URLs. In fact, it doesn't just reject the comment; it also auto-bans the IP address of the prospective poster.
The bad_words and bad_urls files can actually contain regular expressions, one per line. These files should be installed in the same location as Comment.pm. In the code below, the path is hard-coded as /var/www/cgi-bin/lib/MT/App.
It takes a very short while to build up the bad_words and bad_urls files. If you're hit with spam anything like as often as I am, you'll find this patch starts to save you a lot of arduous work very quickly.
By posting this here, I run the risk that spammers read the code and work around my current measures, but I think the benefit of posting the code outweighs the inconvenience of potentially tipping off the spammers.
One tip: when composing your bad_words file, include &#\d+; as one of your regular expressions, as this will stop spammers from using HTML entities to get around your traps for individual words.