Unfortunately, while most bots still don’t, some do, meaning some spam still gets through. Those that hook a javascript engine to post spam are going pretty far to do it, so having to compute a half a second or so worth of javascript isn’t a big hit to them. They’ve got a couple thousand bots in a botnet to do it anyway…

Since making that change, 4 spam messages have made it past hashcash. Hashcash plus akismet has caught all of them, but mopsi’s message got flagged as spam as well, which is somewhat unacceptable too. However, I’ll still keep this combination, because it results in an acceptable level of spam hitting akismet, to the point that I can actually do some vetting from time to time without having to dig through hundreds of spams per month to do it. Akismet alone was churning through in the neighborhood of 50 to 100 spams per day when I switched to the captcha, and with hashcash and akismet, it’s down to like 4 per day. So that’s pretty tolerable …

the problem is that this method is no 100% proof (captchas aren’t as well but with those hard to read images it came near…) since it doesn’t prevent a robot to post but it just slows them down.

It works by requiring the user’s machine to do some computation which takes 0.5 seconds per comment or so. This slight delay means nothing to someone posting one comment. But it slows down the spammer robot that wants to post thousand of comments.

But if the spammer doesn’t care for the slow-down he still can do automated spamming.

I still prefer this method because as long as there are enough unsecured blogs the spammers will go for those while the legit user gets rid of the need to enter the captcha.

jerk >_<

Apparently there are some spambots that actually implement javascript… I’ve already had to spam-flag a comment or two.

otoh, I don’t want to go back to captchas again, ’cause people hate them and they’re buggy.

I originally went to captcha because akismet was giving false positives, so that’s not really a great answer to go back to either. And since I don’t want to babysit the place forever, a moderation queue is probably not so great either.

hmm….