Blog - Ultimate trackback spam protection? Not.

Ultimate trackback spam protection? Not.

Update (2005/2/19 11:30): Turns out this wasn't such a good idea, as some hosted services have the admin on a different domain than the blog (e.g. livedoor.jp uses livedoor.com), and that may be more than I initially thought. Too bad. :( See comments for more thoughts.

Hasn't this been thought of before? If a trackback's URL's host name is different from the client's (ping sender) IP, chances are it's spam. Or am I missing something?

The only disadvantages I see is that it may add a small delay for the trackback URL's host lookup, and also it could give false positives if someone tries to do legit trackback pings from an IP different than their blog's host name's IP, which I believe is probably rare (though I don't know about the hosted services like TypePad, LiveJournal, Blogger, etc.).
Tell me if I'm wrong.

I'd sure like to get some pings (even unrelated) to this entry to see if anyone can ping me without trouble.
Trackback URL: http://www.chipple.net/cgi-bin/mt/mt-tbz.cgi/388

My MovableType patch follows (tested with MT2.64). It may not be optimal, so any correction is welcome.

/lib/MT/App/Trackback.pm (or /extlib/jayallen/MTBlPing.pm if you use MT-Blacklist)

At the top, after the other use's.

use Socket;
use Net::hostent;

In sub ping, just after the "Check if this user has been banned from sending TrackBack pings." block.
(In the case of MT-Blacklist, put it in sub ping_post_hdlr after Jay's first "### INSERTED CODE ENDS HERE ###".)

    my $host_url = $url;
    $host_url =~ s!^(https?://)([^/]+)(.*)$!$2!;
    my $host = gethostbyname($host_url);
    my $host_ip = inet_ntoa($host->addr);
    if ($host_ip ne $user_ip) {
      return $app->_response(Error =>
        $app->translate(
          "Only trackbacks from the linked Web server's own IP are accepted. ".
          "If you were trying to send a legit trackback, please contact me.")) 
    }

That's all.

Posted on February 19, 2005 at 01:36 | Tweet |

---

Trackback

---

Comments RSS

---

© 2003-2024, chi­pple­.n­et