Simon Willison's Weblog: spam

Quoting Kyle Kingsbury

2025-07-07T19:27:51+00:00

I strongly suspect that Market Research Future, or a subcontractor, is conducting an automated spam campaign which uses a Large Language Model to evaluate a Mastodon instance, submit a plausible application for an account, and to post slop which links to Market Research Future reports. [...]

I don’t know how to run a community forum in this future. I do not have the time or emotional energy to screen out regular attacks by Large Language Models, with the knowledge that making the wrong decision costs a real human being their connection to a niche community.

— Kyle Kingsbury, The Future of Forums is Lies, I Guess

Tags: community, moderation, spam, ai, generative-ai, mastodon, llms, slop, ai-ethics, ai-misuse, kyle-kingsbury

Quoting @deepfates

2024-05-07T15:59:47+00:00

Watching in real time as "slop" becomes a term of art. the way that "spam" became the term for unwanted emails, "slop" is going in the dictionary as the term for unwanted AI generated content

— @deepfates

Tags: definitions, ethics, spam, ai, generative-ai, llms, slop, ai-ethics, ai-misuse

Quoting dang

2024-02-19T15:57:50+00:00

Spam, and its cousins like content marketing, could kill HN if it became orders of magnitude greater—but from my perspective, it isn't the hardest problem on HN. [...]

By far the harder problem, from my perspective, is low-quality comments, and I don't mean by bad actors—the community is pretty good about flagging and reporting those; I mean lame and/or mean comments by otherwise good users who don't intend to and don't realize they're doing that.

— dang

Tags: hacker-news, moderation, social-software, spam

Quoting Del Harvey

2023-11-22T04:59:47+00:00

I remember that they [Ev and Biz at Twitter in 2008] very firmly believed spam was a concern, but, “we don’t think it's ever going to be a real problem because you can choose who you follow.” And this was one of my first moments thinking, “Oh, you sweet summer child.” Because once you have a big enough user base, once you have enough people on a platform, once the likelihood of profit becomes high enough, you’re going to have spammers.

— Del Harvey

Tags: moderation, spam, twitter

Tell-a-Friend: Leverage Word of Mouth Marketing

2008-09-20T12:00:31+00:00

Tell-a-Friend: Leverage Word of Mouth Marketing

I’d love to know how they intend to stop this free widget from becoming the world’s most popular spam proxy. And of course, they abuse the password anti-pattern despite the existence of safe API alternatives to address book scraping.

Tags: spam, tellafriend

Using Akismet with Django's new comments framework

2008-08-28T10:12:25+00:00

Using Akismet with Django's new comments framework

A nice example that demonstrates two features that were recently rolled in to the Django 1.0 betas: the new signals library and the new comments framework.

Tags: akismet, comments, django, python, signals, spam

The law behind "tell a friend" services

2008-07-28T10:49:22+00:00

The law behind "tell a friend" services

Useful guide based on UK law, updated in July 2008.

Tags: law, marketing, spam, tellafriend, uklaw, viralmarketing

Quoting ator_fighting_eagle

2008-06-20T18:55:38+00:00

This is the new blog-spam. [...] 'web design company' takes the highest ranking comment from reddit, and posts it on the site that the original comment is based on. [...] Neat eh? They get to have links on a site that won't get blog-spam filtered, because the comment is 'relevant', since the comment originates from a comment thread about the site.

— ator_fighting_eagle

Tags: commentspam, reddit, spam

Quoting John Nagle

2008-05-26T08:40:05+00:00

Craigslist is fighting back. Its latest gimmick is phone verification. Posting in some categories now requires a callback phone call, with a password sent to the user either by voice or as an SMS message. [...] Spammers tried using their own free ringtone sites to get many users to accept the Craigslist verification call, then type in the password from the voice message. Craigslist hasn't countered that trick yet.

— John Nagle

Tags: callback, craigslist, phonecall, sms, spam

OpenID and Spam

2008-04-02T19:33:25+00:00

OpenID and Spam

Matt Mullenweg: “OpenID has a ton of promise for the web—let’s not hurt it by setting people up for disappointment by telling them it’s a spam blocker when it’s not.” True for the case of general registration, but I still believe whitelisting known OpenIDs could be a powerful tool for fighting spam on personal sites.

Tags: matt-mullenweg, openid, social-whitelisting, spam, whitelisting

Sorry PR people: you're blocked

2007-10-31T17:22:29+00:00

Sorry PR people: you're blocked

I was added to some PR mailing lists a few months ago and they appear to be spreading my address around like a nasty disease. I’m tempted to contribute some addresses to Chris Anderson’s block list.

Tags: chris-anderson, email, pr, spam

Quechup: Another Social Network Enemy!

2007-09-21T23:36:15+00:00

Quechup: Another Social Network Enemy!

This is why we need to stop teaching users that it’s OK to give their e-mail username and password to any site that asks for it.

Tags: oauth, openid, quechup, social-networks, spam

3rd Annual Nigerian EMail Conference

2007-06-26T01:27:21+00:00

3rd Annual Nigerian EMail Conference

“Registration is via a confidential money transfer.”

Tags: funny, spam

Unsettling

2007-06-05T21:16:58+00:00

Unsettling

Sounds like there might be a massive scripted hack going on against out of date WordPress installs on Dreamhost. Check your site. See also discussion in the comments attached to this post.

Tags: dave-shea, dreamhost, hosting, php, security, spam, wordpress

Introducing http:BL

2007-04-25T23:39:55+00:00

Introducing http:BL

Project Honey Pot announce a new blacklist service for blocking comment spammers and e-mail spiders using information from their network of honey pots.

Via Jacob Kaplan-Moss

Tags: blacklist, commentspam, honeypot, security, spam

Fading Out Nofollows?

2007-04-15T20:27:16+00:00

Fading Out Nofollows?

Philipp Lenssen suggests automatically removing the nofollow from links in comments a few days after they have been posted, to allow administrators time to delete spam without penalising legitimate authors.

Tags: nofollow, philipp-lenssen, spam

Quoting David Sifry

2007-04-05T23:39:58+00:00

Thankfully, because of the accountability that is built into the web itself (the URL structure is fundamentally accountable), I believe that while the vulnerability of the live web to spam is real, it is managable.

— David Sifry

Tags: david-sifry, spam, technorati

i'm Home

2007-03-02T10:43:02+00:00

i'm Home

“Every time you start a conversation using i’m, Microsoft shares a portion of the program’s advertising revenue with some of the world’s most effective organisations dedicated to social causes.” Microsoft are now getting their marketing ideas from spam e-mail forwards.

Tags: funny, im, microsoft, spam

Quoting Rick Skrenta

2007-02-15T11:15:33+00:00

The bright side: web spam is an evolutionary force that pushes relevance innovations such as trustrank forward. Spam created the market opportunity for Google, when Altavista succumbed in 97-98. Search startups should be praying to the spam gods for a second opportunity.

— Rick Skrenta

Tags: google, search-engines, spam, startups

Fake bloggers soon to be "named and shamed"

2007-02-12T09:35:48+00:00

Fake bloggers soon to be "named and shamed"

Apparently due to a new EU directive banning companies from “falsely representing oneself as a consumer”.

Via Slashdot

Tags: astroturfing, spam

Why people hate SEO... (and why SMO is bulls$%t)

2007-02-08T07:47:19+00:00

Why people hate SEO... (and why SMO is bulls$%t)

Jason Calacanis explains SMO, or “Social Media Optimisation”—digg spamming now has its own TLA.

Tags: jason-calacanis, seo, smo, spam, tla

Social whitelisting with OpenID... (plasticbag.org)

2007-01-26T01:00:50+00:00

Social whitelisting with OpenID... (plasticbag.org)

Tom’s write-up of the social whitelisting idea. Lots of sceptics in the comments.

Via plasticbag.org - a weblog by Tom Coates

Tags: openid, social-whitelisting, spam, tom-coates

Stopping spambots with hashes and honeypots

2007-01-23T13:39:15+00:00

Stopping spambots with hashes and honeypots

Ned’s analysis of how spambots work, along with some relatively simple tricks that should fool most of them.

Tags: commentspam, hashing, ned-batchelder, spam, spambots

The Spam Farms of the Social Web

2006-11-22T10:41:23+00:00

The Spam Farms of the Social Web

Really interesting exposé by Niall Kennedy.

Tags: niall-kennedy, spam

Hacked for Spam

2003-12-09T02:56:42+00:00

From the New York Times:

Computer security researchers have been watching the evolution of remote-access rogue programs as they have become more common and have put more machines under the control of hackers. Programs like Sinit infect target machines and surreptitiously open back doors that allow outsiders to control the PC's. The rings of infected computers have been used to send spam, to present online advertisements for pornographic Web sites or to trick people into giving up information like credit card numbers.

In fact, at least a third of all spam circulating on the Internet is now sent from or relayed by personal home computers that have been taken over, said Jesse Dougherty, director of development at Sophos, an antivirus and antispam company.

Emphasis mine. Of course, whether or not you want to believe a director from a company that directly profits from people's fear of security attacks is up to you. That said, I've seen plenty of supporting evidence in the past few months that indicates that spamming is now the number one reason that a cracker would want to take over a PC, not least this Wired article.

Continuing on the same theme, The Rise of the Spammers is a fascinating article by David Barroso Berrueta describing how one of his servers was turned in to a spam relay after being compromised through a vulnerability in a PHP script. The technical details are intriguing; the attacker downloaded and uncompressed a daemon which then communicated with another host using an extended version of the SMTP protocol, receiving spam email bodies along with lists of addresses to send the spam on to.

Let's talk about the PHP vulnerability in question: yet again, it was the classic problem where an attacker can instruct PHP to download and execute code from their own server by feeding in a query string parameter that is passed un-checked to an include() function call. While there are a number of steps that can be taken to deny this kind of attack, it unveils a fundamental problem with PHP itself - that it will execute code retrieved from a URL in the first place! This feature should be removed from PHP - it has almost no purpose in the real world aside from allowing servers to be cracked in to. The feature exists because PHP has the extremely useful ability to open remote files over HTTP. Unfortunately, this feature extends to the include() and require() functions which will execute any PHP code in the file passed to the functions. The most obvious solution to my mind would be for these functions to refuse to execute PHP in files that were opened via HTTP. I have no doubt that this would involve an ugly hack on behalf of PHP's maintainers, but I believe the number of security problems it would solve would be well worth the trade-off.

Incidentally, I know you can disable opening files over HTTP and I know you shouldnt allow the direct creation of variables from the query string in the first place. The problems here are two-fold: firstly, opening files over HTTP is actually a very useful feature, one that would be all the more useful if it didn't carry the risk of executing arbitrary code. Secondly, the problem is mainly down to third party software which often requires insecure PHP settings (such as register_globals) in order to work.

Tags: security, spam

New anti-comment-spam measure

2003-10-13T08:22:09+00:00

I've added a new anti-comment-spam measure to this site. The majority of comment spam exists for one reason and one reason only to increase the Google PageRank of the site linked from the spam and specifically to increase its ranking for the term used in the link. This is why so many comment spams include links like this: Cheap Viagra.

Cut off the PageRank boost and you cut off the advantage of spamming, simple as that. I've altered my comments system to redirect ALL outgoing links through a simple redirect script, and added that script to my robots.txt file. Links still work fine (even the referral information persists across the redirect) but Google will ignore them completely when calculating PageRank.

Will this reduce the floods of comment spam my site receives? Probably not; I've added a note about the restriction to my 'add comment' form but I doubt many spammers bother to read much about the sites they are targetting. What's really needed is for this technique to become widespread by being integrated in to existing blogging tools - are you listening Moveable Type hackers?

Update: Sencer has pointed out in the comments that PageRank persists over redirects, and Google appears to ignore robots.txt when used to hide a redirecting page. I've updated my redirection script to use javascript to power the redirect (with a link for people with javascript disabled) and an extra meta tag to remind Google not to follow the link. This has the unfortunate side effect that referral information no longer persists across the redirect.

Tags: projects, robots-txt, spam, site-upgrades

Battling comment spam

2003-09-30T13:34:15+00:00

It's a sad state of affairs when you come back to your blog after a week elsewhere and have to add another 56 domains to your blacklist. I'm actually getting more comment spam than legitimate comments now - this is becoming more than just a minor nuisance. I'm considering a number of improvements, including adding a moderation queue to comments on entries posted more than a month ago, disabling the comment form if the referral is a search engine (as per Russell Beattie's suggestion) and adding some kind of wildcard support to the blacklist file.

I'd really rather not do any of this, but the problem looks like it's going to escalate.

Tags: moderation, spam

Fighting Filters and DDoS

2003-09-02T00:55:15+00:00

Paul Graham's essays on fighting spam are generally excellent; it was Paul who sparked the recent flurry of activity surrounding Bayesian statistical filters and inspired the creation of some of the best tools for fighting spam yet. Paul's latest suggestion, Filters that fight back, seems to me to miss the mark in a big way. Paul suggests email servers should "follow" links in any email received. This would turn the tables on spam, as suddenly sending out a million spams would result in a million useless hits to the site being promoted, quickly brining it to its knees. It's a great concept, until some malicious script kiddie realises that they've been handed a tool to run massive distributed denial-of-service attacks on any domain they care to target. Not to mention that such a feature would make many legitimate mass email tools prohibitively expensive to run.

Update: It turns out that this issue has already been discussed in the FAQ attached to the essay. The suggested solution is to use a blacklist, with servers only hitting sites that are linked to from an email and listed on the blacklist.

Tags: denial-of-service, paul-graham, spam

Spam proof email

2002-07-04T15:58:01+00:00

Today saw a useful thread on Webdesign-L about hiding email addresses from spambots. Some of the points raised:

Javascript encryption makes addresses inacessible to anyoen with javascript disabled, not just spambots.
Form based solutions help avoid ever exposing your address to the open web.
An english description (mail cs1spw at bath dot ac dot uk) is a good solution, but may eventually be parsed by spambots as well.
If you go down the javascript encryption route, adding an english description in <noscript> tags can make your address more accessible.
An image showing your email address is spambot proof, but does not solve the problem of how to hide addresses that can be clicked on.
A lot of users with webmail do not benefit from mailto: addresses anyway, and would prefer a form.

I have restructured my contact page to take these in to account.

Tags: spam