Sherm Pendley said:
Just for grins...
while(<DATA>) {
/">(.)<\/font/ && print $1;
}
It took less than a minute to come up with that, and I'm no genius when it
comes to regexen. I wasn't guessing when I said it would take even the
stupidest script kiddie less than five minutes.
Of course not. On the other hand, proof-of-concept code for the "Make
internet users solve image CAPTCHAs for you in exchange for porn" spam tool
was posted years ago and people still use image CAPTCHAs...
The *only* reason you haven't gotten any spam yet is that no one has bothered
to try yet. You're not secure, you're just lucky.
Don't knock the "no-one has bothered to try" defence too much. One of
the various spam filters I've written onto a phpBB install does
nothing more than add an extra hidden variable to a form and check
it's submitted. It blocks about a third of spam account registration
attempts and about a fifth of spam posting attempts, and that's from
such a poor defence that most of the attackers bypass it without
realising it's there... Naturally it'd be no good on its own and there
are far more effective ones behind it that block the rest, but it's
interesting how many spammers currently get sufficient
return-on-investment with easily defeatable spam tools that they still
use them!
My point is that a defence of this sort is actually really good *if*
you're the only site that uses it and you're not in the top league of
sites where it's worth working around it solely to break your site's
defences. It's yet another reason why standard CAPTCHAs built into
popular applications are silly - there is a massive benefit to a
spammer from breaking the phpBB CAPTCHA, which is why I assume they
have already and don't even bother activating it myself.
If everyone coded their own test vaguely like the advertised one (but
with different markup, patterns, etc.) it would take them about five
minutes to code and the spammer five minutes to analyse and break. The
problem for the spammer is that this multiplies up to 5
minutes*[number of sites they want to spam] = several months which
makes it rapidly uneconomical for them. When there's thousands of
sites using standardised or no protection, breaking the odd ones out
is uneconomical for them too.
Now, charging $10 for said script is at the very best optimistic and
misguided, since its effectiveness decreases in proportion to the
number of people who buy it, and there are plenty of free alternatives
anyway... $10 for a well-written guide that teaches exactly the
*techniques* needed to write your own unique filters and tests in the
web language of your choice, on the other hand, would probably be
worth paying for.
