[pmwiki-users] Honeypots for Spam
Patrick R. Michaud
pmichaud at pobox.com
Wed Oct 18 00:15:18 CDT 2006
On Wed, Oct 11, 2006 at 03:41:58PM +1000, Kathryn Andersen wrote:
> On Wed, Oct 11, 2006 at 12:25:06AM -0500, Patrick R. Michaud wrote:
> > Yes. After looking at the page, I'm wondering if we should provide
> > some sort of indication on the page that the post had already been
> > blocked by the blocklist (due to containing an improper term).
> > Or, perhaps we should only show those posts that reach the honeypot
> > that haven't already been blocked.
> I think it makes more sense to put things in the Honeypot blocklist that
> haven't already been blocked; that would at least give us a better idea
> of how effective it is as an additional measure.
Since the Site.Blocked-Honeypot page was becoming too large to be
displayed without timing out, I've temporarily changed it so that
the urls are placed in the page only if the post isn't already
So, we see every attempt to edit the Honeypot page that contains
an unapproved url (so we can keep track of the bad IP addresses),
but the actual unapproved urls are logged only if the other
blocking mechanisms hadn't already caught the page by the time
the honeypot checks were triggered (so we can add new terms
to the blocklist).
I'm planning to rework some of the blocking facilities to make
it easy to maintain a "blocklist log" that records all blocked
posts and the reasons for each post being blocked.
More information about the pmwiki-users