From: "David G. Andersen" <dga@...>
Date: 2004-10-26T02:49:52+09:00
Subject: Re: Garden Spam

On Tue, Oct 26, 2004 at 12:54:57AM +0900, trans.  (T. Onoma) scribed:
> On Monday 25 October 2004 11:35 am, Jamis Buck wrote:
> |
> | ASCII art will still suffer from accessibility issues, since a screen
> | reader will not be able to read the ASCII art in any intelligible way to
> | the user. :( However, it is an ingenious approach...I'm tempted to look
> | into that, JFTHOI.
> 
> There is no way to do otherwise for a captcha system. How would a blind person 
> every be able to use a captcha system?
> 
> And a poor man's captcha is hardly a defense at all.

If it's effective, it's a great defense.  You're falling prey
to "the perfect is the enemy of the good" -- while you're sitting
around worrying about an attacker one-upping a simple captcha
system, the RubyGarden webpages are being turned into an utterly
useless cesspool of spam.  This discussion has been going on
for literally months, during which the majority of the updates
to RubyGarden look like:

(diff) JavaWorld 12:47 pm (8 changes) [restore from spam] . . . . . ChrisHulan 
(diff) JEdit 12:46 pm (3 changes) [restore from spam] . . . . . ChrisHulan 
(diff) JEditExtensions 12:45 pm (3 changes) [restore from spam] . . . . . ChrisHulan 
(diff) OldHomePage 12:44 pm (3 changes) [restore from spam] . . . . . ChrisHulan 
(diff) ZeusForWindows 12:44 pm (3 changes) [restore from spam] . . . . . ChrisHulan

       http://www.rubygarden.org/ruby?RecentChanges

Throw in a simple captcha.  If it works, great.  If it doesn't,
then go with something stronger.  This is not rocket science, it's
a bloody car alarm -- make the other guy's website an easier
target and they'll go away rather than waste the time to try to 
figure out how to automatically work around the RubyGarden captcha.
Most wiki spam is crawler-based and automated;  they're not going
to adapt to one annoying website that wants a captcha.  Jamis's
captcha fills this space admirably.  Easy to implement.  The
only thing I might change with it is using a keyed MD5 digest
(or a poor-man's keyed MD5 digest -- prepend a local key to
the string you feed into md5) instead of a plain MD5:

  mylocalkey = "MyLocalKey,Yo"
  string = chars.join
  md5hash = MD5.hexdigest( mylocalkey + string )

...

  sum = MD5.hexdigest ( mylocalkey + captcha.gsub(/\s/, "") )

On the presumption that others will reuse this code and change it
slightly;  can't hurt to remove one easily scripted hack. :)

  -Dave

-- 
work: dga@lcs.mit.edu                          me:  dga@pobox.com
      MIT Laboratory for Computer Science           http://www.angio.net/