Attack of the Spiced Incense Warehouse!

So, I run, partially as a hobby, partially as a experimental programming site, a little site called FearlessBlogging. It's an awkard mishmash of technologies: there are identicons in posts, a half-baked prototype way of targeting problematic users by session details without actually having to lock-on with a username / password system, my first foray into LiveValidations and Prototype, etc.

It's been about a year or two since it launched and it's more or lessed fulfilled its role. As it 'matured,' I kept my modifications to it to a minimal. I've started working on other websites to explore more newer technologies. The last major thing I did to FearlessBlogging was an upgrade from Rails 1.2.3 --> Rails 2.2.2. It went very smoothly, only a few depreciated methods in the environment configs. Other than that, everything, including caching, was ready.

Resource-use, overall, has gone down.

For the most part it's been sailing along quietly, averaging about 20k pageviews a month, mostly on hot-button issues like a post about incest, or the dozen or more about infidelity. Just regular people blowing off steam.

Attack of the Spiced Incense Warehouse!

Recently, however, I've had the extreme displeasure of being introduced to something called "Spiced Incense Warehouse." It all started about 14 days ago with a post called, "Spiced Incense Warehouse - rip off!" Catchy, title, right? Apparently some dude had shipping problems or something with some product he bought off the site. Whatever; typical nerd-rage on the Internet.

I figured it was inevitable I would get an angry email from the operator of Spiced Incense Warehouse, chock full of legal threats. No surprise, about a week and a half later, I get one. Now, I don't get a lot of these (the site averages less than 12 a year), and all of them are bogus. Mostly its people who feel offended that someone out there in the big wide world has the hates for them. Some of them are polite and terse, some of them are like enraged alcoholics who demand what they demand and will accept no substitute.

Well, guess which one this guy is?

So I get a series of mostly incomprehensible emails demanding I take the post in particular down or else I'll be in beaucoup ligitation up to my eyeballs. I checked the post again (I'm all polite and shit like that) and, consulting with a lawyer, determine that it's coolio.

Now, as general principal, I don't let any unintentionally public information spill onto the site. So, no email addresses, or street addresses, real names, etc, unless you're one of those people who have a public website and plaster that information all over the Interwebs in general. Websites are fine, obviously.

So, after informing this guy what's up, I don't hear back for him in awhile.

Well, that's because he's busy spamming the site. The post "Spiced Incense Warehouse - rip off" ends up getting filled with pseudo-garbage as the owner of Spiced Incense Warehouse goes on a trip fantastic blaming everything from the postal service to the customer in question.

Now, a long time ago, I implemented identicons on the site. If you don't know what an identicon is, it's a visually pleasant representation of a hash value. There's a wikipedia article about Identicons available. The identicon implementation this site uses is based on a user's IP address and the current post they are commenting in (or the post they've created). So, if you make three comments in the same post, they all have your bright and shiny identicon. If you make another comment in another post, you get a different looking identicon. Neat, huh?

I implemented this feature because I was having a bit of a human-spam problem, and also because conversations were becoming difficult to follow, as in, commentors were saying "well, I meant this guy, not this guy." A visual identifer that was tied to a single person in a single thread but which was still anonymous was interesting, technology-wise, and it would also help solve the problem of who-said-what without collecting personal information. Of course, I remember almost nothing about the implementation now, just that generating these things crossbrowser is no fun and I will definitely be avoiding it until all browsers support the canvas element.

Anyway, back to Spiced Incense Warehouse. The site has a "master" RSS feed people can subscribe to. It gets them all posts and comments on the site -- since the site is very low traffic, this feature isn't a problem at all. In this RSS feed, after about an hour, almost a dozen entries show up, all comments for the Spiced Incense Warehouse post. It's become a total circus.

The owner of the site (and it is VERY clear this is the owner of the site, since all the identicons are the same but he's pretending to be a horde of happy customers leaving A++ would buy again-style feedback.) has posted almost a dozen of wild comments. Now, I didn't really care for a bit, since the identicon made it clear it was the same person spamming the post, and the site visitors can pick that up visually.

It only became a problem when I started seeing personal details pop up on the site, presumably the personal details of the original poster. It had his full name, his street address, phone number and email -- it was like some kind of super stalker in action. Normally what I will try to do is edit out the sensitive details like that and leave the rest of the post intact, but this guy was so intent on destroying the site that I didn't have the time or energy to scrub the posts. Not that they had much content besides this guy's personal information. So I just whang'd them all with the disable button, which took about 30 seconds, and left the rest of his crazy rantings up there.

Except he wasn't done.

A few hours later, the details crop up again. And again. And again.

Because once you're eCrazyStalker, you're a fucking eCrazyStalker through-and-through.

The site has a very basic counter-measure to combat automated spam, but I've never really considered having to kung-fu fight "human" spam. Humanized spam? What do you even call it?

I sat down for a bit and thought about the various non-invasive measures of tracking human-spammers and kibbitzing them. Keep track of their session ID and 'poison' the site, not allowing them to post? Keep a pool of 'bad' IP addresses and ignore any action from them for 24, 48 hours?

As I'm writing this, he's still going on in short, machine-gun style bursts.

I think the worst part of this is, the site has very little traffic -- the individual posts, fewer. Even the most controversial posts see a sharp drop in traffic once they're off the sidebar.

However, the sidebar also keeps track of the most recent comments. By continuously commenting, he's ensuring that curious visitors take a look at the post in question. They're going to see him in it, acting the fool, and increasing exposure.

People are so hard to understand sometimes. Some of them, I just don't understand at all.