we evolve

Blocking Spam Comments Using a Honey Pot

hello@we-evolve.co.uk (Stoo Goff) — Sun, 01 Nov 2009 00:00:00 -0000

Everyone who uses the internet is familiar with spam and the problems it causes. Most people's familiarity is through its intrusion on email, and I've already outlined how I use gmail to block email spam. Since running this site I've had to deal with a lot of comment spam. It goes in phases but I receive about 2–3 spam comments per week and sometimes as much as 20. And this is a low traffic site.

My initial strategy was to delete spam comments as they appear. I receive a notification email whenever a comment is posted and while working I'm never too far away from a computer so spam comments wouldn't appear for too long on the site. Of course, having to delete spam comments quickly became tedious!

There are a number of common methods for blocking spam comments — forcing the user to register with the site, hiding comments until approved by a moderator, CAPTCHA images, etc. Whatever method I decided on I knew it had to require as little thought from the end user as possible. I don't want to stop the few legitimate comments I am getting in my effort to stop spam.

That cuts registration from my available options and, I would argue, CAPTCHA. While CAPTCHA is becoming more familiar to internet users and a lot of good work is being done by reCAPTCHA it's still an impediment to the commenter. This leaves comment moderation, but that feels too close to my current system.

After some research I came across honey pots as a security concept and found a lot of information in the article Stopping spambots with hashes and honeypots by Ned Batchelder. Using programming cunning to prevent spam is a bit more like it! I decided to try implementing the ideas outlined in the article one at a time, starting with a honey pot.

The honey pot idea is very simple: provide something enticing for the spambot but hide it from the user. Spambots vary in their sophistication but most operate by trying to fill relevant information into the form e.g. a field named 'email' will be filled with an email address. Hidden fields are left untouched as these often contain information vital to filling in the form. The trick to the honey pot is that spambots will fill in all text fields.

With this in mind I created an additional text field in the comment form with the name of 'lastname'. It's randomly inserted into the form each time it is generated and removed from display by using CSS absolute positioning within the stylesheet. As far as a spambot is aware the field is there on the page — you can see it by viewing the source code — but doesn't appear to the end user. If the field is filled in when the form is submitted the comment is flagged as spam and not displayed on the site. I can then delete or allow the comment as I see fit. My only concern with this method is accessibility: screen readers will probably display the field. Currently the field is labelled 'Input not required' which I hope is enough to stop legitimate users from filling it in.

Over the past 3 months this technique has worked incredibly well: I've had a 100% success rate so far.

Order, Inheritance and Specificity in CSS

hello@we-evolve.co.uk (Stoo Goff) — Sat, 19 Sep 2009 00:00:00 -0000

Some quick notes on an easily misunderstood area of CSS.

One thing to remember with CSS is the order statements appear in the stylesheet is important along with inheritance and specificity. So if you have the following:

div {
	background-color: red;
}

... snip ...

div {
	background-color: green;
}

The green background will be applied. This is also true across multiple stylesheets. Rules from stylesheets linked later in the HTML will take precedence over stylesheets appearing earlier in the HTML.

Inheritance allows some styles to be inherited. Not all styles are, but generally the ones you would want to be inherited are. So borders aren't inherited but font and colour information generally is, so if you do:

body {
	color: blue;
	font: 0.9em bold verdana, sans-serif;
}

p {
	border: 1px solid gray;
}

span {
	color: green;
}

In this case all text on the page would be a medium sized Verdana in blue, except spans which would be a medium sized Verdana in green. All paragraphs would have a grey border, but span tags within paragraphs wouldn't have the border.

Specificity is a little more complicated but assigns a sort of weighting to how rules are applied. Tags have the least 'weight', then classes / attributes, then ids then inline styles (styles set with the style attribute in the HTML). So using the previous example as a base, if we added the following rules:

.orange {
	border: 1px solid orange;
}

#border {
	border: 1px solid red;
}

Any HTML tag, including p's, with a class of orange would display an orange border, despite the previous p rule in the stylesheet. A p with an id of border and a class of orange would display a red border because the id is more specific than the class and the tag selector.

The way you write your selectors is also important for specificity. The more specific your selector is the higher the specificity. That's a very confusing sentence but what it means is if you had div p as your selector it would have more weight than p on its own. Building on our body / p /span example from before, we can add the following rules:

p span {
	color: red;
}

.bordered {
	border: 1px solid gray;
}

p.bordered {
	border: 1px solid blue;
}

In this example all spans would be green, except those within p's, which would be blue. All tags with a class of bordered would have a grey border except for p's with a class of bordered. They'd have a blue border.

Specificity, order and inheritance are important areas to understand in CSS, but specificity in particular can be confusing. If anyone wants any more information and Google doesn't help, contact me directly or post something in the comments.

Thoughts on dConstruct

hello@we-evolve.co.uk (Stoo Goff) — Thu, 10 Sep 2009 00:00:00 -0000

Last week was dConstruct here in Brighton, which I found to be a mix of interesting, inspiring and frustrating; but, above all, entertaining. The topic for the day was "Designing for the Future" and varied from a very high level dreamer's view of what could be, a look at how sci-fi has influenced interface design and vice-versa, to a very practical look at what can be done now in different media.

The speaking highlights for me were Russell Davies's talk on bringing the digital world to the physical realm and August de los Reyes's comparison of university and corporate life and brief discussion of the design of the windows key.

The real highlights for me were outside the conference room in amongst the bluster of the promotional area and book stores. There I got a chance to have a play with the Microsoft Surface and to talk with Richard about FriiSpray.

The Surface is a multi-user, multi-touch computer table produced by Microsoft. Mutli-touch technology is something I'm interested in, particularly with the open source reactable software available. My first attempts at developing a multi-touch interface used a Wiimote controller and a couple of IR pens built by Robbie. Youtube has a video of the multi-touch gallery I built and I'll post about it properly soon.

Richard's FriiSpray takes a very similar approach, using an IR light within a spray can to add graffiti to any image projected onto a screen. FriiSpray uses a Wiimote controller as a receiver for the IR light and has the added bonus of sending the resulting image to a flickr account for anyone to view.

What was really interesting, and funny to watch, was people's usage of FriiSpray. At a conference about interface development, where augmented reality and "juicy" interfaces were discussed and phrases like "cybernetic synesthesia" were bandied around, outside was a perfect example of a tactile interface which exactly modelled its real world origins. When the IR spray can didn't work, the user shook the can! Exactly as if they were using a real can and graffitiing a wall. And as a bonus, Richard had observed this in the past and added ball bearings to the cans so they even sounded authentic!

All in all an inspiring day at dConstruct, but frustrating as I'm not currently doing anything similar. Thanks to everyone who talked and to Clearleft for organising it.

Installing VMWare Server and Running Windows XP on Ubuntu 8.10 Intrepid

hello@we-evolve.co.uk (Stoo Goff) — Wed, 29 Jul 2009 00:00:00 -0000

Recently I was asked to do some .Net development and, unfortunately, my cranky old Win XP laptop is definitely not up to the challenge. Not wanting to buy a new machine or mess with my Ubuntu install I decided to try a virtual install using VMWare Server 2.0. The following isn't exactly a how to, it's more notes and links on what I had to do, so I have any easy reference for next time.

A very good walk through of installing VMWare Server on Ubuntu Intrepid Ibex can be found here:

How to Install VMware server 2.0 in Ubuntu Intrepid

Once the install is complete, creating a new virtual machine is simple. The thing to remember – and this seems incredibly obvious now – is creating a new virtual machine doesn't install an operating system. Just because you've selected an OS as part of the creation process doesn't mean it's installed on the machine. What you have is a fresh PC configured to best run the OS you've chosen. The next step is installing the OS.

If you need to tweak the BIOS settings to change the boot order you may need to set your key mappings. I found I couldn't use the cursor keys to navigate around the BIOS. I can't find the website which gave me the information but correcting it was as simple as adding the following line to /etc/vmware/config.

xkeymap.nokeycodeMap = "TRUE"

You'll need to sudo or have root access in order to make this change.

In the end I didn't need to adjust the BIOS, but it's still a handy thing to know about.

Installing XP from the CD also caused problems. It didn't have the correcft drivers for the hard drive, but switching it to BusLogic drivers and following the instructions here solved the problem:

VMware: Installing Windows XP on ESX using LSI Logic driver

Once you have the OS installed and the machine up and running it's recommended you install VMWare tools, which come with VMWare Server.

After that I was finished! Aside from the endless procession of windows updates...

Next I want to try installing a few different OS's and after that, cloning my laptop.

32 bit DSN on 64 bit Windows

hello@we-evolve.co.uk (Stoo Goff) — Sat, 18 Jul 2009 00:00:00 -0000

Earlier in the week I came across something which had me stumped for a while. After a lot of training on the Endeca platform I finally had an opportunity to set up an instance for a new site. Unfortunately it was a duplication of an existing site so there wasn't that much to do.

Still, I got the tweaked version running on my dev box with no trouble. When I moved it to the staging server it wouldn't work. It consistently failed to connect to the database via a DSN, though the JDBC connection used elsewhere in the configuration worked fine. I checked and double checked the DSN; it worked, no problems. I renamed it, removed and reset it, set it as a user DSN rather than a system DSN, to no avail.

Then I remembered that it's a 64 bit machine, which has bitten me before with an incorrect TortoiseSVN install. After a lot of reading I discovered this relevant Microsoft Knowledge Base article.

The 32 bit version of ODBC administrator is available on 64 bit machines, you just have to go looking for it. So I set up a 32 bit DSN and Endeca ran without a hitch.