Myths About CAPTCHA's

For those that don't know what a CAPTCHA is, it's something that typically a human can answer but automated software can't figure out. An example of this is on the comments page of this blog which has a box with the squiggly letters you have to type in before you can submit a comment.

Some people are declaring that it's the end of the CAPTCHA era either with human powered sites that trick visitors into providing the answer to the CAPTCHA, or automated image recognition software that just needs time and a little computing horsepower to decode the text in the image.

Myth #1 - CAPTCHA's aren't accessible to the visually impaired.

Accessibility issues are a legitimate complaint for some sites that don't implement a robust accessible CAPTCHA solution. For instance, the visually impaired can use the alternative audio CAPTCHA used on this very blog that solves this simple problem. Other types of CAPTCHAs that are math or word problems which are easier to read are also accessible.

Myth #2 - All CAPTCHA's are those squiggly text things seen on blogs.

Most of the comments about CAPTCHA's are based on the one type of CAPTCHA that uses extremely bent and distorted text called Gimpy. However, Gimpy is just scratching the surface when it comes to CAPTCHAs as they come in many forms.

Some of the other CAPTCHAs variants include identifying what's contained in a picture, simple math questions like "1 + 4 = ?", a text question like "What color is the sky?", or typing in the letters or numbers played via audio.

If you don't think people can spell "BLUE" or answer the math question properly you can always give them a nice drop list of possible answers and only give one chance to answer per question to stop bots from hacking at the answer.

Myth #3 - Bots can easily "BLOW THROUGH" CAPTCHAs.

When humans are being used to provide CAPTCHA answers that can be the case, but only when you implement sloppy CAPTCHA code in the first place. You can use a series of security measures to make sure there's a human sitting at the keyboard and it's not being passed through by a bot.

1. Require Javascript to validate the CAPTCHA since the majority of bots don't run Javascript in the first place.
2. Obfuscate your CAPTCHA in randomized encoded Javascript so that it's difficult, if not impossible, for a bot to even detect the presence of a CAPTCHA on the page in the first place.
3. Use Javascript input sensory techniques such as MT Keystrokes to detect whether a human has actually typed into the field on the web page.
4. Randomize the type of CAPTCHA being used so that there isn't a single specific type of CAPTCHA to target with an automated tool.
   

Summary

The real vulnerability of most forums, blogs and wikis face isn't even the risk of CAPTCHA failure, it's the identical footprint of all the Open Source software which makes locating the comments pages so easy.

Changing the name of the anchor text and page name on a blog from "comments" and "comments.php" to "Post an Opinion" and "youropinion.php" is another form of CAPTCHA because the human will immediately know where to click but the bot might get confused.

Better yet, since most bots don't read javascript, simply obfuscate the actual HTML of your "Leave a Comment" section in Javascript. When bots can't even find the link to "leave a comment" or the form fields where you enter a comment in HTML it may eliminate the need for the more complex text bending CAPTCHA's in the first place. Sure, the spammers could code the bot to decode a single instance of obfuscated Javascript for a single blog, but the code itself could be randomly obfuscated so that it would be quite a difficult task.

Don't let the naysayers dissuade you from increasing the strength of your spam blocking as stronger CAPTCHA's combined with Javascript tricks appear to be bulletproof until the bots get a lot more complex and smarter.

P.S. Note that the guy claiming CAPTCHA's are dead doesn't have one on his blog and if you scroll down past the actual comments you'll see he has a shitload of porn spam at the bottom. Obviously someone knee deep in spam is NOT the person you should be listening to about whether or not to use a CAPTCHA.

Gigablast Data Trail

While following where my data goes on the internet I found a couple of sites that appear to be using data from Gigablast which include eWoss and searchEstate.

The upside is fewer crawlers as they're leveraging existing data crawls in multiple locations.

The downside is that you have no control where your information shows up so the only way to control that relationship is block the source.

Update: Also found Gigablast content in Webled as well.

Ezilon Also Has Some LookSmart Content

This time my content tracking bugs led me to Ezilon which has content that originated from LookSmart. Don't know if Ezilon is a LookSmart partner or what the deal is, perhaps they scraped LookSmart, but the link to one of my sites in their listings was definitely crawled by LookSmart.

Just goes to show that blocking bad bots from your site doesn't always stop your content from being misappropriated anyway.

Update: Also found LookSmart data in xogger.com.

5 Reasons Why I Blog - Tagged By a Boy Named Sue

Looks like old anti-spam Connie tagged me because I'm a second-rate blogger that's about as popular as a fart in an elevator, but I'll accept that tag and play the game.

So here goes with my 5 reasons why I blog:

1. Because I'd probably get kicked off most, if not all forums, for saying some of the shit I say. Therefore, the best way to truly express my opinions and not get a boot to the head was to take it elsewhere, and the blog was born.

2. If I didn't blow off some steam every now and then when things are really pissing me off, my fucking head would explode, therefore blogging is also done for medicinal purposes.

3. My wife is probably sick and tired of hearing me rant and rave about things that get under my skin so I blog them out, then she can read it once, or I might read it to her, and it's over with. The blog may actually be saving my marriage until I blog about her one too many times, or about the wrong topic, and then the shit will hit the fan for sure.

4. I actually have some useful information to pass on from time to time and the blog is as good as any place to post it.

5. Blogging about exposing, blocking and whacking scrapers and spammers pisses them off so the blog gives us a nice virtual parking lot to duke it out.

There, I've done the deed, 5 fandamntastic reasons why I blog.

Looks like I should tag 5 other people just because misery loves company:

John Andrews - because I know John dislikes following the herd
MartiniBuster - just so I can imagine him rolling his eyes at me
SpamHuntress - so she'll get off MySpace and start blogging again
John Scott - he's been so intermittently blogging someone needs to kickstart his ass
WillMac - bots make him as crazy as they do me, so he needs to share

That's all for this time and may whoever comes up with the next game of blog tag get a big swift kick in the nuts from all of us that feel dragged into this shit whether we want to play or not.

Don Imus Joins Ranks of Unemployed

I've always hated Imus and just the sound of his voice and his idiotic bullshit made me want to smash radios.

Then those idiots over at MSNBC decided to put that stupid fucker on TV so the country could see that walking corpse spew bullshit in living color. That was the last day I ever watched MSNBC simply because it wasn't worth the risk of accidentally seeing that past-the-expiration-date walking organ donor still polluting the tube.

Now, thank the gods, he has aimed his prejudiced venom at the wrong bunch of women and not only has MSNBC gained a potential viewer when they canceled his dawn-of-the-dead carcass but CBS then followed suit and booted his old dusty ass to the curb.

Bye bye Imus, I won't miss you one fucking bit.

TIP FOR IMUS: Don't call the lady processing your unemployment claim a "nappy-headed ho" or she'll slap your ass into next week.

Webaroo's Content Stealing PulseBot Flatlined

If you've never seen Webaroo before, the concept of copyright obviously has been completely glossed over.

Here's what it says on their website:

Webaroo servers crawl the web, analyze web pages and automatically select the subset of pages with the greatest diversity and quality in the least storage size. These pages are then packaged into topic-specific "Web Packs" that can be downloaded by users onto their devices. Once downloaded, users can search and browse that content on the go.

Here's an English to English translation:

Webaroo takes whatever copyrighted content of yours we want and repackage it for our customers without permission. Of course we do it without permission because nobody knows about Webaroo in the first place so they won't stop us or the many bot names. Isn't it cool how we're going to steal your shit and pack it up so others can download it and now they don't even need to bother visiting your website? Wicked!

Look at the total number of bot names coming from their crawler's IP address.

64.124.122.228 "WebarooBot (Webaroo Bot; http://64.124.122.252/feedback.html)"

64.124.122.228 "PiyushBot (Piyush Web Miner; http://piyush.com/feedback.html)"

64.124.122.228 "RufusBot (Rufus Web Miner; http://www.webaroo.com/rooSiteOwners.html)"

64.124.122.228 "RufusBot (Rufus Web Miner; http://64.124.122.252/feedback.html)"

64.124.122.228 "SumeetBot (Sumeet Bot; http://64.124.122.252/feedback.html)"

64.124.122.228 "PsBot (PsBot; http://64.124.122.252/feedback.html)"

64.124.122.228 "pulseBot (pulse Web Miner)"

Hell, if you were trying to stop them using robots.txt it's a lost cause as the bot names seem to get changed faster than a baby's diaper.

I would just block their range of IP's, it's more convenient.

Webaroo MFN-B843-64-124-122-224-27 (NET-64-124-122-224-1)
64.124.122.224 - 64.124.122.255

That's how you stop name changing bots, the firewall way.

Package THAT into a topic-specific "Web Pack" and download it.

Prius Damages Planet Worse Than SUVs

I'm sure a few of you have read the report that the actual environmental damage caused by a Prius is worse than a Hummer, but in case you haven't, go read this article. I'm not saying that the concept of a Prius is bad, nor is trying to save some gas bad, but when you stack up the total environmental damage caused by the Prius manufacturing process vs. the meager savings to the end user, it's damn near criminal.

Bet you Prius users feel good about saving some gas in your wallet while driving an overpriced vehicle that has already caused more harm to the environment than the average car had you driven it instead.

Now that you've read it and are more educated about the situation, if you actually own a Prius, you should take it back to your Toyota dealer and demand a refund purely on the ethics of this so-called environmentally friendly car. If they refuse to give you your money back, I'm wondering what a Judge in a court of law would say if someone sued to get a refund about being mislead about the environmental impact of the Prius.

Hey, it's just a matter of time and we all know Americans love to sue.

Besides, the environmentally hopped up fanatics won't admit they made any mistake in the first place or they'll tell you they're all too busy getting people to sign a petition to ban the chemical H2O which is getting into all the water supplies.

Fucking tree hugging naive planet killers, don't you just love 'em?

Swooglebot Thnks My Site Is Anti-Semantic

Here comes the little toy bot from UMBC that's trying to figure out the semantic web and sure enough, my anti-semantic site booted the little fucker.

Here's the 411:

130.85.34.29 [eb2.cs.UMBC.EDU.] "Swooglebot/2.0. (+http://swoogle.umbc.edu/swooglebot.html)"

Since my site is anti-semantic, does that make me an anti-semantite?

Hmmm...

Nutch Goes to the Opera

OK, everyone knows I'm a big Nutch fan.

Everyone should also know the above statement is sarcasm laid on thick like peanut butter.

Anyway, back to the topic...

I saw this supposedly Nutch user agent in my logs today which is pretty slimy claiming to be MSIE, Opera, and Nutch all in the same UA.

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.01/Nutch-0.9 (http://lucene.apache.org/nutch/about.html; http://lucene.apache.org/nutch/bot.html; mail@dev.null)

Whoever thought that was clever enough to slide under my radar was wrong as that word Nutch set off alarms and tossed your crawl into the online equivalent of the pit of despair.

Sorry, better luck next time.

Craigslooters Even Take Kitchen Sink.

If you missed this news item it bears repeating just because it's a cautionary tale about how some people are real lowlife scumbags.

Someone posted an ad on Craigslist for a location in Tacoma telling everyone to "Please help yourself to anything on the property." and they took it, literally took everything including the front door and the kitchen sink.

Who in the hell takes anything posted on Craigslist that seriously?

Obviously common sense flew out the window when the first person on the scene encountered a locked building and had to remedy that situation before they could start helping themselves to everything else, so I assume the door was the first to go.

Wonder what could happen if someone posted something like this for a local WalMart for the "2am giveaway, everything you can carry in 1 trip you can have!". Would people be that stupid to think WalMart was endorsing looting their own stores?

After what happened with the LA riots, anything is possible.

It's just another reason to weep for the future.

Porn spammers at it again

Don't know what porn spammers hope to gain from this, but they're adding a parameter to an actual URL on my site and cloaking this information to Google.

You may see requests like this in your log file:

http://www.domain.com/mypage.html?ref=spammerdomain.com

Don't know what they're trying to game in Google, don't even give a shit, I'm just bouncing any request with "?ref=" in the URL to stop this nonsense cold.

WorldWebWide Scrapes LookDumb

Today my content tracking bugs led me to something in the worldwebwide.net which originated from LookSmart.

The IP address where the data was originally crawled from:

60.88.242.64 -> sv-crawlfw4.looksmart.com

This is nothing new as LookSmart seems to be a scraping target as I've already reported same thing happening with GoodBidWords.com containing scraped LookSmart listings.

Livebot vs. Googlebot - Microsoft trying to catch up?

Was looking over my log stats today for my site (not this blog) it was surprising to see Microsoft's Livebot crawling very aggressively, possibly taking more pages and returning faster then Googlebot this month. I'll give Livebot this much, the volume of crawling is pretty impressive compared to what it used to be so it looks like Microsoft is in this horse race to win and not just play 3rd fiddle.

Then of course we have our pals over at Ask slowly poking around my site. If Yahoo's Slurp is taking a nap this month, Ask must be in a coma or something. Slow as a snail and information seems to take forever to show up on their site. Maybe they cater to the dial-up crowd.

Then good old Gigabot seems to be crawling from a new bank of IPs and I don't even care.

Anyway, it will be interesting to see how quickly some of my new site changes show up in Live because crawling that fast and not updating as quickly would be silly!

Site Upgrade Finally Started

Finally got around to upgrading to the new Blogger layout today and even managed to organize some of the posts with labels just to see how that works. The archive section is much easier to navigate and I think people will find this a whole bunch easier to use once I'm finished with upgrading.

Now to find a nice stretch template I like that fills my full 1680 x 1050 display and doesn't look like shit on the laptop's 1024 display!

Where have all the blog posts gone?

Sometimes I just have to take a little time out to make some freak'n money people. I'm not ignoring you, I'm still here, but there are days when I get so focused on doing actual work that the rants go unpublished. Besides, not all of us have the stamina to read such long winded minutia, let alone the time to write it.

Additionally, I'm getting prepared to go out and rub elbows with people that have venture cash tonight and see if there's any interest in my little project to take back control of the web. If I don't come back with a bunch of biz cards from tonight's little party just shoot me.

A few topics on my mind:

1. It was nice to see common sense prevail when a Judge kicked KinderStart in the ass.
2. Microsoft seems to be taking aim at Made for AdSense aka SPAM sites.
3. Someone sued the Internet Archive for stealing her site.

Fun fun fun.

Local Searches and Associated Ads Miss The Boat

Local search solutions and the contextual ads that appear with those searches have some wrong thinking about how they geotarget ads to the customer.

For instance, I don't live in Alabama but I'm trying to help someone I know locate a service in Alabama, such as a plumber. Go to Google and search for an "alabama plumber" and you get the proper results and appropriate ads displayed.

Now let's trying clicking on one of those ads in Google that takes you to some specialized local service which claims it's taking me to "alabama.whatever.com" on their site.

Do I get listings for Alabama related sites?

Hell No!

The local site picks up on the keyword plumber but shows me a page geotargeted to MY IP, not what I was actually searching.

Let's assume for a second that Alabama wasn't enough information, so I changed the query in Google to "Birmingham, Alabama plumber" and clicked through and got the same stupid results from the local site pointing me back to my local area.

What's worse is that Google AdSense will show you local advertisements when you're clearly on a page researching another location. In all likelihood you would NOT click ads for your local area when it's painfully obvious, even to dense people, that it's not what you're interested in finding. Google can't claim they don't know you were interested, or it's too complicated to geotarget in that way, because Google was the search engine that found that page in the first place and passed the query information to the page you clicked which contains AdSense that reads the referrer!

Yet, here you are looking for Alabama things, on a page all about Alabama, with a referrer and query passed by Google about an Alabama search, and there's AdSense showing ads about Nevada, California and the SF Bay Area.

HELLO?

Anyone can plainly see that THOSE ADS AREN'T RELEVANT to the topic!

Obviously the local search services have a way to go and Google is just losing money with inappropriate ads on those sites.

They better get it together on local sites before someone smarter steps in and fills the gaps.

Take Your AdSense Sites to the Next Level

Don't know how many people out there that read this blog are running sites with AdSense, but I posted a thread on WebmasterWorld that may be of interest.

Go read Unlock the limits of your AdSense earnings potential and you can see that I shared quite a few things you might find useful.

Stop Cloning Around

Here's a random thought of the day to ponder.

Assuming you were cloned, if you have sex with your clone is it incest or merely masturbation?

MSN and Yahoo cleaner than Google?

I've been watching my scraped content in all the search engines and just recently most of the junk sites vaporized from Yahoo and MSN yet Google is still knee deep in scraper results for my sites. Obviously this is nothing scientific yet as this is just a casual observation, but Google is getting a little butt kicking in the cleanliness of content department from where I'm sitting.

Additionally, Google is still crawling proxy sites that cloak lists of links to them like a kid in a candy store, they just love those cloaked links, so nobody seems to be interested in fixing that problem.

Deep Blue Funky Time

Ever have a week or two when you just say "fuck it" to everything?

So the blog goes unpublished for days, emails piling up unopened, voice mail flashing non-stop...

Took a mental health day and went to play some no-limit Texas Hold'em and came away with some winnings, so that was a bright spot. Had a few lunches out with a friend and pounded a few pints as well which is always good for what ails you.

Then an old friend popped into town the other day to interview for Google of all things. Ah yes, there's 2 nights of dragging my ass out to dinner. Oh the horror of it all, having to pull myself off the sofa and get dressed and engage in small talk 2 nights in a row.

What could happen to put the funk back on after snapping out of it?

You guessed it, the kid calls and she's blown her engine and of course needs Daddy to pay to get her a new engine or a new car.

Also, what should've been a bright spot was the new decked out Vista laptop which of course doesn't run all of our software and we're thinking about shoving it up Costco's ass for a refund.

Fuck.

Well, despite my best efforts to lay on the sofa all day again today basking in the glow of the plasma TV I managed to clean off my desk, do some web work and even post a blog entry.

Perhaps it's issues with big oppressive corporations trying to tell people how to run their businesses that makes it harder and harder to get off the sofa, who knows.

Current Mood: the world can kiss my ass