Well, yesterday i decided to try my hand at some very simple code to restrict spamming, a spur of the moment thing.It’s now the following day and I keep thinking about the whole problem and the approaches taken by various people/projects.

I’m left thinking - us techies are making it all too hard! I feel you really don’t need to deploy the worlds best solution based on the most advanced comp-sci theory, nor should you apply the approaches taken to email spam filtering as it is a fundamentally different problem.

A computer program it is written to match certain expectations. With spamming, it expects the comment form to look and behave a certain way, it isn’t expecting akismet, capatcha, or a math questions, it is just looking for the three fields and a form submission.

To break their app - you just need to do something unexpected.

You see a spammer is playing a numbers game, he wants the maximum impact for little effort. If he is going to spend an hour finding a way of cracking your side when there are another 1000 he could be off spamming, he’s probably going to give it a miss.

(This theory doesn’t apply for bored post grad students grandstanding about their AI projects, but then thats like the CIA proving they can beat my home security system - it doesn’t invalidate the system, it just makes it inappropriate to keep out the CIA) Of course, if your counter measure becomes popular, and now 300 of those 1000 sites are using it, he’ll probably start to look for a way of beating it.

So the key isn’t the counter measure - its about the diversity of counter measures, put another way (in terms mentioned elsewhere), we want to avoid a monoculture of counter measures.