And Teresa, I am reading "Making Book" for the first time. I am enjoying it tremendously.

<Traveller>
Nuke the state from orbit; it's the only way to be sure.
</Traveller>

On a more serious topic, this post on the Movable Type message boards has a suggestion for dealing with these roaches by setting up a trap that automatically bans them.

I desperately want the MT people to address this with some kind of patch or option that non-stupid, but non-technical, people like me and Teresa can understand. Now. Because if this problem isn't addressed in a hurry, it won't be long before we give up on this hobby.

I hunted down and killed every one of them. It was tedious and time-consuming. I could have been writing.

If you have a weblog or guestbook and have the abililty to block posts, I suggest you add 209.210.176.20 to your gag list RIGHT NOW.

I woke up this morning to find 15 Lolita comments. I was not happy. Deleted every one, wrote to the guy who hosts my blog to see if we can maybe finally implement IP banning.

There are a fair number of technically-skilled people who read these weblogs and who would be perfectly thrilled to help you out with the suggested fix.

It's not my area of expertise, but if push comes to shove, I'd take a shot at doing it for you.

(There! That should shame someone better than me into helping you out.)

Somewhat more understandable, but no less annoying, are the "my-blog-is-awesome-come-read-it" spam comments. Trust me, if you leave this kind of comment, you can rest assured that I will not go read your blog.

I have no objections. In the meantime, though, I want to implement some spam-blocking measures. Lolita's proprietors aren't the only spammers who've been hitting my site. My guess is that the knowledge of how to spam weblog comments sections is spreading in the spammer community. Best batten down the hatches now.

I'm not convinced that this would be effective, since the easiest way to find the cgi for the message boards is to follow the link on the weblog page, and .htaccess only works if your apache server is configured to use it -- something J. Random Weblogger may not have access to change.

Worse, given the email spammer wars, I think you are in for a long, and quite possibly futile, war of attack and countermeasure. I like to think that filtering works -- but I've gotten over 100,000 spam emails hitting my server, despite more and more desperate attempts to stem the tide.

The more complex solution in the link, at first glance, looks more effective. Dropping IP addresses into a gag file may work for a while -- until they start using cracked machines as proxy servers, in which case, they'll dance from machine to machine.

I wish I could offer you a better answer. But, in truth, in the war against spam, we're losing, and badly.

1) From the shell, type

mysql -u username -p

Give it the password. The user and pass should be set in the MT interface somewhere.

Once in, you'll get the MySQL prompt. First, we find them.

SELECT FROM mt_comment WHERE comment_url LIKE '%http://COMMENT_SPAM_URL%' OR comment_text LIKE '%http://COMMENT_SPAM_URL%';

Replace the %http://COMMENT_SPAM_URL% with the actual URL they are using, but you will need the single quotes around the string. This should return a bunch of spam -- and no real posts. If so, you can then blow them away with...

DELETE FROM mt_comment WHERE comment_url LIKE '%http://COMMENT_SPAM_URL%' OR comment_text LIKE '%http://COMMENT_SPAM_URL%';

In most SQL implementations, the capitalization of anything not in single quotes is unimportant, but tradition is you all cap keywords of the language, and lc variables and the like.

If you return, and nothing comes back except for a prompt, you almost certainly forgot the semicolon at the end. SQL statements end with a semicolon, if you don't put on, the SQL interpreter will thing you aren't done, and just ask for more. If you did forget, just put the semicolon on the next line, and it'll work. Most complex SQL statements are entered on multiple lines, so don't fret.

When in doubt, do a SELECT, which just retrieves, rather than a DELETE. If you are paranoid, and your database supports it, start with.

START TRANSACTION;

and do the deletes, if you screw up, run

ROLLBACK;

and it'll come back to the point where you typed START TRANSACTION. If you're happy,

COMMIT;

ends the transaction and makes it permanent. There are certain SQL commands that are implicit COMMITs, but that gets complex -- in general, anything that alters the structure of the database or the tables themselves, rather than the data within them, will automatically COMMIT all transactions before execution.

However, you can SELECT to your heart's content without hurting anything. And, when in doubt, "man mysql" wouldn't hurt

Thank you for the information, which reads as though it ought to be admirably clear once I find out what the nouns mean. I'll start tomorrow with "SQL", and go on from there.

I'm sorry to hear that the bad guys are still winning the spam wars. Would it be so terribly wrong to launch DOS attacks againt outfits that advertise via spam?

As to DOS.

1) They own many, many, many more machines that you do. You can try -- they'll either ignore you, or slap you down. Note the number of anti-spam lists that have gone away under severe and sustained DOS attacks.

2) DOS attacks not only attack the bad guy, they attack anyone between you and them. Saturate a T3 feeding a router, and everyone connected to that router falls down.

3) Spammers may be more desperate that you are.

If you didn't tell it to use MySQL, you're probably using BerkeleyDB (I think--I haven't read up on MT 2.6). And again, let me reiterate--use this form, without the wildcard, to block a range:

209.210.176.

Erik is right that these SOBs can overpower you, but that doesn't mean they will.

As the cheerleaders (hopefully, not pre-teen) say:

Block that range! Block that range! Block that range!

http://yro.slashdot.org/comments.pl?sid=77014&threshold=-1&commentsort=3&tid=111&mode=thread&cid=6855944

Instead, I'll just volunteer to help Jay test his application on an older version of MT.

I didn't follow the link from the poster's name.

I wonder now if that might not have been the first shot in this war.