full-disclosure - Comment Spam: new trends, failing counter-measures and why it's a big deal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon Feb 13 04:54:23 2006
From: very at unprivate.com (php0t)
Subject: Comment Spam: new trends,
	failing counter-measures and why it's a big deal

php0t wrote:

> >   A big part of the problem you mention can be solved by requiring a

> > Turing test for the actions that you don't want a bot to be able to 
> > do.

> I guess you missed all the historic discussion of how cheap it is, in 
> "Western" terms, to employ what passes as skilled labour in much of
the 
> third-world to solve "captcha-like" challenges???

  Actually I didn't, this is exactly why I wrote 'big part of the
problem' (that maybe you missed). I thought a very big percentage was
related to only bots doing the spamming, and just a smaller percentage
hiring real life people to spam for them or just solve the captcha-like
challenges (in which case the Turing test isn't a solution).

> Now, while I'm sure that approach would not be economically viable for

> most large-scale blog-spamming, depending on the blog and the spam, it

> may well be worthwhile for some especially targetted blog-spam, so 
> shouldn't be expected to be a singularly successful solution.

  Yep.. I repeat. 'Big part of the problem'. Which is nowhere near
'singularly successful solution'.

Let's suppose 20% of that spam you see is posted by people doing this
all day, getting paid for it. It's probably much less, but this is all a
guess, nothing more. Would it not be a solution for the other 80% ?
  Of course, if you have some statistics that tell me I terribly
underestimated that overestimation of 20%, or just introduce new
elements that I did not consider, do not hesitate to show it to me, I'm
happy with accepting facts.

php0t