Happy Thanksgiving to all my readers! I hope you are amongst friends and family and that it’s a day of rest and peace for you all. We’re spending a quiet day with my Mom, cooking turkey and just relaxing. We’re not the kind to spend the entire day in the kitchen — it’s happened in the past but that’s not the vibe we wanted today — so it should be nice. It’s our first Thanksgiving since my father died but I think we’re all in a relatively good place.

I survived a reduction in force at work yesterday — though several of my favorite people didn’t — so I can use a bit of peace and quiet (he says as his daughter watches Cars in the other room).

An update on the plugin

I’ve gotten some good feedback on the proposed Spam Karma 2 mod_security plugin. The best feedback was from SK2’s creator, DrDave, who gave me some insight into his architecture and suggested some improvements and direction. Many thanks, DrDave! I’ve since modified the plugin to do the following:

• Block outright any IP address in the IP blacklist with a score greater than 90. Any request from them will get a 412 precondition failed.
• Block any domain in the domain blacklist with a score greater than 90 from appearing in a POST request. In other words, if someone tries to post a comment to the blog with one of the domains, they’ll get a 412 as well.

With these in place, my daily comment spam take has dropped from an average of 400 per day to an average of 3… two whole orders of magnitude. I like that. There are still a few things to do with it before it’s ready for external testing.

• Provide adjustable strength like the rest of the SK2 plugins for people not quite as nasty as me. Strength will affect both the minimum score a blacklisted item must have before it’s blocked as well as possibly changing whether domains are blocked at all. For instance, on “weak” strength we’d only block IPs with a score of 99 or higher and not domains. On “fearsome” we’d block what I currently block.
• Add in aging of blocked entries, reducing the score of items that are currently blocked so they can eventually be discarded from the blocked list. SK2’s scoring can’t account for this as it’s dependant on still getting the requests or spams… if I block them it can’t do it’s scoring adjustments. I just need to give it some help with that.

I’m really pleased so far. I’m going to be doing some access log mining to get some better statistics.

This entry was posted 1 year, 10 months ago and is filed under Blogging, Development, My Life. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.