441262 - spam comments in Labs blog posts

Status: RESOLVED FIXED

(Websites :: mozillalabs.com, defect)

Description

[Gen Kanai [:gen]]

Please clean out spam comments in Labs blog posts

A sample can be found here:

http://labs.mozilla.com/2008/03/extend-firefox-3-is-here/

http://labs.mozilla.com/2008/03/mix-your-passions-ignite-the-web-with-music/

http://labs.mozilla.com/2008/03/major-update-to-prism-first-prototype-of-browser-integration/

Comment 1

[Gen Kanai [:gen]]

http://labs.mozilla.com/2008/06/firefox-mobile-concept-video/

Comment 2

[Gen Kanai [:gen]]

http://labs.mozilla.com/2008/04/mozilla-labs-higher-education-and-new-opportunities/

Comment 3

[Dan Mills [:thunder]]

I spent a while today cleaning up the comments.  We really need a better solution for this.

Comment 4

[Gen Kanai [:gen]]

dm, still a bunch of spam comments in the posts.

What needs to happen is a number of things:

1) turn on comment moderation; no comments allowed without human moderation

2) spam comment plugin for the CMS installed

3) clean out current spam completely

I'm happy to help where I can.

Comment 5

[Dan Mills [:thunder]]

Cc'ing Chris.  Gen's points seem like a good approach.

Comment 6

[Gen Kanai [:gen]]

Re-opening bug as spam comments are still available.

Comment 7

[Myk Melez [:myk] [@mykmelez]]

The lab blog remains overrun with spam.  I just told Akismet to check existing comments for spam, and it identified 10 messages as spam, a miniscule proportion of the more than 5000 comments on the site, most of which seem to be spam.

Spam Karma 2 might do a better job, but its interface is so inscrutable as to be unusable.

Per Gen's suggestions in comment 4, I'm going to do this:

* check the "an administrator must always approve the comment" checkbox on the Discussion Settings page <http://labs.mozilla.com/wp-admin/options-discussion.php> and periodically approve comments awaiting approval on the Manage Comments Awaiting Moderation page <http://labs.mozilla.com/wp-admin/edit-comments.php?comment_status=moderated>;

* not install a spam comment plugin, as two are already installed (Akismet, which is the default plugin, and Spam Karma 2);

* encourage all administrators of the site who are labs folks to help clean out existing comment spam over time by periodically loading the Manage Comments page <http://labs.mozilla.com/wp-admin/edit-comments.php> and removing some spam.

cc:ing administrators who are labs people and aren't already cc:ed on this bug.  Anant, Jono, Rhian, Aza, Chris, and Dan: help clear out comment spam by loading http://labs.mozilla.com/wp-admin/edit-comments.php and removing some!

Also, periodically check the Manage Comments Awaiting Moderation page <http://labs.mozilla.com/wp-admin/edit-comments.php?comment_status=moderated> and approve non-spam comments there.

And let's give administrator privileges to more trusted labs folks who can help out via the Manage Users page <http://labs.mozilla.com/wp-admin/users.php>.

Comment 8

[Myk Melez [:myk] [@mykmelez]]

(In reply to comment #7)
> Per Gen's suggestions in comment 4, I'm going to do this:
> 
> * check the "an administrator must always approve the comment" checkbox on the
> Discussion Settings page
> <http://labs.mozilla.com/wp-admin/options-discussion.php> and periodically
> approve comments awaiting approval on the Manage Comments Awaiting Moderation
> page
> <http://labs.mozilla.com/wp-admin/edit-comments.php?comment_status=moderated>;

I have done this.

Comment 9

[Myk Melez [:myk] [@mykmelez]]

(In reply to comment #8)
> (In reply to comment #7)
> > Per Gen's suggestions in comment 4, I'm going to do this:
> > 
> > * check the "an administrator must always approve the comment" checkbox on the
> > Discussion Settings page
> > <http://labs.mozilla.com/wp-admin/options-discussion.php> and periodically
> > approve comments awaiting approval on the Manage Comments Awaiting Moderation
> > page
> > <http://labs.mozilla.com/wp-admin/edit-comments.php?comment_status=moderated>;
> 
> I have done this.

Comments were still getting posted without moderation, so I dug in to Wordpress documentation and support forums and discovered that Spam Karma 2 silently disables Wordpress's built-in comment moderation features <http://wordpress.org/support/topic/154347?replies=2>.

Since Spam Karma 2 also isn't catching the spam being posted to the blog, I've disabled it.  Now comment moderation is working, although note that users are not notified that their comments will be moderated.  We should add a notice to the comment form to dissuade spammers from even trying.

Also, I have made Gen a blog administrator so he can help us fight spam.

Comment 10

[Gen Kanai [:gen]]

The Labs blog has 'nofollow' for all external urls, but the blog spammers don't know that (or are too stupid to check) so there's no SEO benefit in spamming the blog.  

One thought is to take away the url from the comment submission form.  That way the user can only submit an email address and comment.  Or add language to the url form that says "all urls are marked 'nofollow' and will not benefit any search engine rankings".

Comment 11

[Gen Kanai [:gen]]

And I vote that we disable trackbacks if that hasn't been done already.

Comment 12

[Myk Melez [:myk] [@mykmelez]]

> Now comment moderation is working, although note that users are
> not notified that their comments will be moderated.  We should add a notice to
> the comment form to dissuade spammers from even trying.

I've done so and checked in the change, although I haven't pushed it to production yet because I think the site repository is currently in an unstable state, as Chris is making some changes that he hasn't finished yet.

Nevertheless, thinking about it more, I suspect that spammers aren't actually filling in the forms but rather using automated tools to spam multiple blogs, so the note isn't going to help with spam.  Nevertheless, it may still be useful in reducing confusion from real commenters wondering why their comments don't show up immediately.


> One thought is to take away the url from the comment submission form.  That way
> the user can only submit an email address and comment.  Or add language to the
> url form that says "all urls are marked 'nofollow' and will not benefit any
> search engine rankings".

I'd be sorry to see the URL field go, since real commenters use it for legitimate purposes of identification, but perhaps it's necessary.  After all, a lot of spam these days takes the form of reasonable-sounding comments with a spam URL in that field.  And those are a pain to moderate.

I suspect that a note about nofollow wouldn't work for the same reason the note I added about moderation won't work.


(In reply to comment #11)
> And I vote that we disable trackbacks if that hasn't been done already.

I think that was done six months ago during the last round of spam fighting.  The "Allow link notifications from other blogs (pingbacks and trackbacks.)" checkbox is unchecked in Settings > Discussion.  But there may still be some trackbacks left that we didn't remove.

Comment 13

[Myk Melez [:myk] [@mykmelez]]

> > One thought is to take away the url from the comment submission form.  That way
> > the user can only submit an email address and comment.  Or add language to the
> > url form that says "all urls are marked 'nofollow' and will not benefit any
> > search engine rankings".
> 
> I'd be sorry to see the URL field go, since real commenters use it for
> legitimate purposes of identification, but perhaps it's necessary.  After all,
> a lot of spam these days takes the form of reasonable-sounding comments with a
> spam URL in that field.  And those are a pain to moderate.

I looked into this a bit, but I can't find a simple configuration option for turning off the URL field.  It looks like it's a more considerable change (i.e. editing the templates themselves to remove the field from both entry and display).  But perhaps I'm missing something, as my Wordpress fu is light.

Comment 14

[Myk Melez [:myk] [@mykmelez]]

Pingbacks/tracebacks were still getting through.  It turns out that the global setting for disabling them only applies to new posts; existing posts retain their post-specific settings.  So I've disabled them for every existing post.

Also, I'm seeing spam that looks like someone took a legitimate comment someone else wrote and is repeating it.  Something to watch out for...

Comment 15

[Gen Kanai [:gen]]

(In reply to comment #14)
> Pingbacks/tracebacks were still getting through.  It turns out that the global
> setting for disabling them only applies to new posts; existing posts retain
> their post-specific settings.  So I've disabled them for every existing post.

Great.  Can we delete old trackback pings if they link to spammy domains?

> Also, I'm seeing spam that looks like someone took a legitimate comment someone
> else wrote and is repeating it.  Something to watch out for...

Yes.  I've taken the liberty to delete comments when the destination url is a spam domain.  There are lots of "Thanks Mozilla" comments with links to spammy urls among many other tactics.

Comment 16

[Myk Melez [:myk] [@mykmelez]]

(In reply to comment #15)
> Great.  Can we delete old trackback pings if they link to spammy domains?

Yep.  Unfortunately the only interface I know of for doing so is Wordpress's Comments admin page.


> Yes.  I've taken the liberty to delete comments when the destination url is a
> spam domain.  There are lots of "Thanks Mozilla" comments with links to spammy
> urls among many other tactics.

Great, thanks!  Spammers are depressingly creative.

Comment 17

[Gen Kanai [:gen]]

The comment moderation is now working- thanks Myk!  We often receive comments from spammers with "Thanks Mozilla!" or some other pity comment and a link to a spammy url.  I am choosing to put those comments in the spam folder as they do not add to the discussion in any way.

New question: What should we do with legitimate comments with links to porn or spammy urls?  The comments that are pending now are real comments with discussions about potential new features or functionality but with domains that link to porn or other SEO-ish domains.  What's the best course of action here?  This is an issue with a significant portion of the existing comments as well.

Comment 18

[Gen Kanai [:gen]]

(In reply to comment #17)
> some other pity comment

I meant "pithy" here.

Comment 19

[Myk Melez [:myk] [@mykmelez]]

(In reply to comment #17)
> New question: What should we do with legitimate comments with links to porn or
> spammy urls?  The comments that are pending now are real comments with
> discussions about potential new features or functionality but with domains that
> link to porn or other SEO-ish domains.  What's the best course of action here? 
> This is an issue with a significant portion of the existing comments as well.

I'm of the mind that we should be aggressive in rejecting these comments as spam, even though the comments themselves are legitimate.

Actually, I'm not sure they're all legitimate.  I think some of them may just be really good copy-paste jobs.  But even for those that are legitimate, if the primary purpose of the comment is to communicate its message, not to link to a spammy site, then I think users won't be put off too much being made to resubmit it without the link.  And I suspect that's actually a very small portion of those comments, with the vast majority being clever spam attempts.

Comment 20

[Gen Kanai [:gen]]

(In reply to comment #19)
> I'm of the mind that we should be aggressive in rejecting these comments as
> spam, even though the comments themselves are legitimate.

I'm glad we're of the same mindset.  I'll be aggressive.

Comment 21

[Myk Melez [:myk] [@mykmelez]]

(In reply to comment #20)
> (In reply to comment #19)
> > I'm of the mind that we should be aggressive in rejecting these comments as
> > spam, even though the comments themselves are legitimate.
> 
> I'm glad we're of the same mindset.  I'll be aggressive.

Note: I finally figured out a good way to go through existing comments for spam:

1. Go to http://labs.mozilla.com/wp-admin/edit.php and select a post to despam.  This takes you to the "Edit Post" page for that post.

2. Search in page for the "Show more comments" link (which appears at the bottom of the Discussions section) and load it.  Repeat until the link no longer appears in the page.  This results in all comments being loaded into the page, so you can review them all at once.

3. Scroll to the top of the list of comments.  Read through them from top to bottom (oldest to newest), clicking the "Spam" link for the ones that are spam (the link appears in the comment when you mouse over it).

Note: If you have to load the URL associated with a comment to determine whether or not it's spam, load it in a new tab; if you load it in the existing tab and then go back to the Edit Post page, it will refresh itself, undoing the results of the "Show more comments" links you clicked.

By loading all the comments at once and reading through them from oldest to newest, it's possible to spot the spam that tries to appear legitimate by copying an earlier comment.  For posts that have been around for a while, most of the earlier comments are real, while most of the later ones are spam, but if you only read the later ones, you won't have just read the legitimate ones, so you won't notice that you're reading a duplicate.

Comment 22

[Dan Mills [:thunder]]

Should this bug still be open?  What's necessary to close it?

Comment 23

[Gen Kanai [:gen]]

I think we're good to close this now.