On comment spam

This would lighten a lot of the burden on the moderators, and also allow for faster response to legitimate comments (they would not have to wait for a moderator to become available; there should be a lot more legitimate users in good standing than moderators). The fast approval in particular should lessen a lot of the friction of "your comment has been held for moderation, and will be posted whenever someone on a different time zone feels like looking through the backlog instead of watching a movie".

To avoid discussions going into a black hole, posting a reply should also automatically approve the parent comment.

This idea only helps with the legitimate comments "caught in the net"; but I feel causing the least amount of friction to legitimate comments is more important for the health of the LWN community. I will braindump ideas on what to do to non-legitimate comments on another comment.

Another option would be to allow subscribers with old enough accounts (something like members of the site for X years who posted at least Y comments) to directly hide spam comments (again they would go in a queue for a moderator to review). A related option would be to allow for these subscribers to vote for hiding the comment; after a number of votes it is hidden (the number of votes would have to be hidden for non-moderators to prevent abuse).

You could go even crazier and do a bit of "meta-moderation" (a bit like on slashdot): allow people to see the queue of comments flagged as spam, and allow people to mark whether the flagging was correct or not. You could also allow people to mark comments as not spam (but this could be abused by the spammers themselves).

And you could even go the full crazy, and start computing trust metrics on each poster, IP address, and network, based on past history (even things like "user X has been often flagged as non-spam by user Y, which has a high trust metric, so we also increase the trust metric for user X"). You could adapt naive Bayesian filters from email anti-spam solutions (not to block comments, but just to flag them for moderation). You could combine both and use trust metrics as a feedback to the Bayesian filter. You could show the "score" from the filter as a border color for the comments, updating them based on subscriber feedback. And so on and on.

The common thread of all these ideas is to use the community itself to help with the filtering, and do so in an unobtrusive way (if I am reading a thread and see a spam comment, it is natural to reach for the "kill it with fire" button, especially if there is one nearby). It might use only a few seconds for each subscriber, and in a natural way since we are already reading the comment thread (and not having to go out of our way to use a separate system only to fight spam). A "recent comments" feature (if there isn't one already) can help even more (and be a useful feature on its own).

As proposed by others, a community-based spam elimination (like what wiki do) seems good also, altough this opens the door to other abuses.

I know that bugs.debian.org also has a mechanism in place, but I don't know the details or whether it'd work in this context.

I can count the number of spams that have gotten through my sites in the last year with the fingers on a single hand. I don't even require a log in at all for things like my bug reporting tool (asking people to spend 10 minutes creating an account and waiting for emails just to report a single bug is the absolute stupidest thing you can do, IMO) and I allow anonymous posting on every news article, blog posting, and most of my forums. Akismet catches pretty much all of it.

The spammer is a volume guy and is cheap. He wants to spew as many copies of his ad as possible at the lowest possible cost.

So first off, any post by a subscriber can be assumed good. After all, if the spammer is willing to pay to put his ad here he could just write sales@lwn.net and if he isn't pitching something totally bogus/illegal he could just buy a real ad. This means that while in theory a spammer could post spam with paid accounts or use paid accounts to approve posts in a moderation scenario, etc. in reality it isn't likely to happen unless the spam scene drastically changes in the future.

While they really like automated tools some do pay third world labor to manually post because humans can still get past filters better than current bots. They can grind out accounts and posts and a captcha just slows them down a little bit. So what are their weaknesses? How about leverage the fact this site caters to a very specific demo? Instead of a typical captcha use a small set of multiple choice questions that anyone who should be posting here could answer but spammers would have to go google. Or display five distro mascots/logos and require matching them to their names. That would waste a lot more of their time than a typical captcha, thus encouraging them to go somewhere they can get more bang for their buck.

And again, after one or two successful ontopic posts it can be assumed that the user is legit. Again, this is a specialty site and a lowest possible labor rate third worlder (who can't graduate to outsourced call center work or something more legit) probably isn't likely to be able to make a couple of cogent posts in a place like this just to get to spew comment spam for a few hours until the account gets closed and every post they made gets rubbed out. The return on the labor is bad.

Don't try to stop the spammers. Realize you can't. What you can do is make it too expensive for most to bother. You will always get a few who try it as they figure this out.

Now know thyself (and the users). You are short on labor but have a highly technical and generally spam hostile readership. Only new accounts need to be suspected so put a spam mallet icon beside those user's posts and let the readers bang on it. Three strikes and it is out. Two posts go out and the account goes dead and after a quick moderation double check by a staffer all posts from that account go away with a single click. Add one final feature to limit how many posts a new account can make in a day and the spam problem should be under control.

Only one problem remains... the spammers who creep in and post in old threads might survive the probationary period. So just don't allow a newly created account to post in a thread over an age threshold, perhaps a month?

Maybe I am opening a can of worms, but I am tempted to suggest you too to explore also the other side: "Know your allies".
Currently, opening an account on LWN is pretty anonymous. This is nice too and some level of anonymity between readers is certainly desirable. However, maybe a stronger and better identification of the owner of an account could be set up. Honestly, I would not mind giving you more personal information about myself if it can help you spot abuses and build a more trusted environment [1].
Technically, note that I have always been admirative of PGP-like decentralized webs of trust (via cross peer to peer key signing/certification) and, well, reluctant to X.509-like hierarchical certification organizations (which probably only work for organizations which can afford the administrative burden and the associated workforce, like a public service).

Both from the technical point of view and from the users side, it comes to me now that I may just be suggesting to extend LWN in the direction of a *secure* social networking site. For blocking spam comments.
I wonder if it may be interesting on its own too ;-) or if I am simply dreaming too much...

Anyway, just my 0.02

Rodolphe

[1] As a side note, this is absolutely the first time I tell that to a web-based business. And maybe this is due to the fact that, historically, this site is also the first web-based business I trusted enough to pay for online (well, not exacly true: first payment was more like clearing an old debt). And probably also because it is certainly the only one that *never* asked me to provide personal information even if I used it regularly for more than a decade.

one thing to watch out for is spam on very old posts. i often come across old blog posts that have lots of comment spam, i guess because nobody is keeping an eye on them.

one good thing about LWN is that often developers of software in an article will reply to comments and questions. it would be a shame to loose that by forcing money from them.

Two filters I'd definitely recommend are POPfile and Nilsimsa. Both use fuzzy matching to assign a probability that two documents were not independently created, and they both work very well at catching this type of crap.

I've had the same mail address for around a decade so I'm on every spam list on the planet, but POPfile keeps that down to around one or two per day out of 150-200 messages. Site: http://getpopfile.org/

The main Nilsimsa site seems to be down from a disk failure, but there's a Perl module on CPAN.

a) provide another benefit to subscribers
b) bring plenty of eyeballs to the spam problem
c) bring eyeballs to the reporters
d) not require hours of Jon's time, which is better spent on Grumpy Editor articles.

To flag a comment as spam should take more than one report (low percentage of subscriber views, perhaps?) and revocation of privleges should be based on bad reports over a specific timeframe.

The rules for using the button would be simple: Use to report comment advertising. Use of the button to flag comments for other reasons will result in loss of privleges.

We tried almost any known solution to stop spam in our forum; each one provided some "resting time", until spammers found a workaround and began spamming us again. At the end, the only solution that has worked for us is as simple as limiting the number of links that can be included in each post. It is a little nuisance for users, but most of them do not need to include ten links on each post; however, spammers soon lost all interest in our forum, once it became useless to them.