The CAPTCHA Continues As A Challenge

This month, we are again seeing evidence of recent security changes by Microsoft. We see signs of continued frustration, in the process of publishing comments - and publishing posts, as part of the Import process.

In the process of diagnosing an apparent comment publishing problem, I ventured into the comment publishing experience, yet again.

I temporarily tweaked commenting permissions for this blog, to allow anonymous comments and to require the CAPTCHA.

With CAPTCHA required, I published a test comment to my earlier post in this blog.

I did my best - which was not good enough.



CAPTCHA solving continues, as a challenge.

I entered a test comment, and made appropriate selections.

I got a challenge.

"Select all the food."

I did my best.

Apparently, my best was not enough.

"Select all images with a store front."

I tried again. Not all images here were completely obvious, either.

My second try was successful.



Hmm.

Select all the food.

Zoom in on the fourth image, above - and tell me which pictures, that I did not select, are food? To whom? Will zooming always improve chances of success?

CAPTCHA solving, as spam interdiction, will always lead to frustration.

There will be cultural issues - and resolution problems - with CAPTCHAs. This version of the CAPTCHA beats the one from several years ago - but still will cause frustration.

And need I again point out - will require proper filter tuning, on each computer used. Note that ongoing changes by Microsoft are currently affecting publishing comments - and publishing posts during the Import process.

And our experience may very, depending upon many different details, varying by blog, by computer, and by person. My sympathies to all who must deal with spam - and with spam interdiction.

---

The CAPTCHA continues to be an unavoidable element in comment publishing and other episodes of #Blogger life. And like life, some episodes are more pleasant than others.

Read More

Blogger Magic - Comment Moderation Settings

If you publish a blog, and want your readers to comment, you need to decide whether to moderate comments.

Comment moderation, applied properly, help you to keep abusive and spam comments off your blog. If you want to publish a blog, and have real people commenting, you need to keep spam comments off the blog. People won't comment, if they have to compete with spam.

If you want to publish a blog, and allow Blogger Hosted comments, you really should moderate. If you don't moderate, prepare to remove spam comments after they are published. Remember that Google+ Hosted comments are moderated by the community.

You setup moderation, for Blogger Hosted comments, from the dashboard Settings - "Posts, comments and sharing" page.

Under "Comments", you have "Comment Moderation", with 3 settings.

• Always.
• Sometimes.
• Never.

Moderation settings are in the Settings - Posts, comments and sharing page.



Moderate Always.

Every comment, published by somebody who is not an administrator or author, will be moderated.

With "Always" or "Sometimes" selected, moderated comments will be sent to each email address listed in "Email moderation requests to".

Select "Always", "Sometimes", or "Never".



You - or whoever is addressed under "Email moderation requests to" - will have the ability to moderate from the email message received. You, or any blog administrator, can moderate from the dashboard Comments - "Awaiting moderation" page.

Moderate Sometimes.

You can selectively moderate comments for older posts, with newer posts not subject to moderation.

If you select "Sometimes", you provide a moderation threshold.

Here, we are set to moderate all posts older than 14 days.



Every post subject to moderation will receive the treatment, selected for "Always". Every newer post, not subject to moderation, will permit any comment to be published immediately.

Moderate Never.

Any comment, submitted to be published, will publish immediately.

Dashboard moderation offers three options.

With every comment listed in the dashboard Comments - "Awaiting moderation" page, you have 3 options.

• Publish.
• Delete.
• Spam.

Once one of these options is chosen, for any comment being moderated, you'll have similar - but not symmetrical - options.

EMail moderation offers similar options.

With each comment moderated by email, you'll have 3 similar options.

• Publish.
• Delete.
• Mark as spam.

Select "Publish", "Delete", or "Mark as spam".



Besides moderation, you can select CAPTCHA verification.

Besides moderation, you can reduce spam, using CAPTCHA verification. If selected, all non administrators and authors will be subject to CAPTCHA verification.

If not selected, anybody commenting anonymously - and not signed in with a Google account - will still be subject to CAPTCHA verification. The "Show word verification" setting applies to comments posted with the publisher properly authenticated.

Right now, the CAPTCHA used is a word puzzle - and has received mixed reviews.

The bottom line.

As a blog owner, you should choose a comment moderation policy - if you allow Blogger Hosted comments.

---

If you allow #Blogger Hosted comments on your blog, you need to choose a moderation policy. Moderation is essential, to reduce spam, and encourage comments by actual blog readers.

Read More

Export / Import, And Page / Post Publishing Limits

Not all blog owners understand the connection between page / post import, and spam limitation.

We see the occasional question, in Blogger Help Forum: Get Help with an Issue, about page / post import, and daily publishing limits.

Why I can not import content, to my blogs?

Note that "Automatically publish" is selected, in the blog discussed here.

I've suggested a few times that use of "Automatically publish all imported posts and pages" is a bad idea, when importing many blogs - because it abuses the computer and home Internet connection.

Here, we see another reason for not using "Automatically publish".

Import, with "Automatically publish", will exceed the daily publishing volume.

Blogger limits daily posting volume. Any blog with more than 40 - 50 pages / posts, when it is exported then imported, will be a problem - if "Automatically publish" is selected during "Import".

"Sorry, you have exceeded the maximum number of entries."



If you import, and publish as you import, you will exceed the daily publishing limit. Your import will fail - because you are publishing more than the daily limit.

Without a daily limit, spammers could flood post their blogs.

If this limit was not in place, spammers could flood their blogs with pages and posts, by simply creating multiple blogs with multiple pages / posts, export from each blog, then import to other blogs - and publish while importing.

If Blogger is to control spam, they have to limit page / post publishing. With the daily limit of 50 pages and posts / 24 hours, that is slightly more than 1 page or post every 1/2 hour - allowing for no sleep, or other non blogging activity.

People have to be encouraged to do something, besides publish - or how do you get material, for the blog? If people are going to publish a blog - and do other things besides publish a blog - there has to be a daily limit.

Genuine blog owners have to not spend all their time publishing their blogs.

Blog owners need to be encouraged to publish blogs with informative, interesting, and original content - so people will read the blogs, and search engines will index the blogs. Automated blog content, a favourite way of "bulking up" a blog with spam, has to be discouraged, to give genuine blog owners a chance.

Without a daily limit, people who publish blogs with personal content would be at a disadvantage to spammers who publish pages and posts with automated content. Using Import, with no limits, would be an excellent way to publish spam in a never ending daily activity.

Use "Import & back up" in 3 steps, to avoid the limit block.

1. Export pages and posts, from one blog.
2. Import pages and posts, to a second blog.
3. Publish imported pages and posts, at a limited rate, selectively.

That is the best way for genuine blog owners, to use the Export / Import ("Import & back up") option.

---

#Blogger has a daily page / post publishing limit, to encourage blog owners to publish blogs with informative, interesting, and original content. Automated page / post publishing is allowed - but subject to a daily limit.

Without a daily limit, spammers would abuse the Blogger infrastructure, with mass produced and scraped content - and Blogger would become one more spam haven.

Read More

Empty Or New Blogs Can Be Classified As Spam Hosts

We're seeing a few recent reports, in Blogger Help Forum: Something Is Broken, from owners of empty and / or new blogs, about spurious spam classification.

Very few owners of empty or new Blogger blogs understand why their blogs should be classified as possible spam hosts, by the Blogger anti-spam processes. Most blog owners seem to think that only blog content is considered, in spam classification.

Spam classification considers many characteristics of a Blogger blog, in classifying any blog as a possible spam host.

Blog post content is an obvious - but not the only - factor in spam classification. Given previously observed behaviour of spammers, many characteristics of blogs, besides simply the extracted and analysed content, are used in classifying possible spam blogs. Using fuzzy spam classification techniques, one might also consider

• Accessories and decorations, on the blog.
• Addresses used, in setting up multiple blogs.
• Overall behaviour in Google, by the owner.
• Past posting habits of the owner.
• Previous classification of similar blogs.

Some spammers obscure their activity, with gratuitous Google activity.

Some spammers are active in multiple Google activities and features. It's possible that some spammers even try to make their spam in Blogger harder to detect, by spreading their activity across other Google services - even when non abusive in other Google services.

Some spammers may not realise that activity in other Google areas can be tracked, and included by Blogger spam classifications processes.

Blog publishers, enjoying similar activities, may be spuriously classified.

Blog owners who use one or more techniques involved in setting up and maintaining spam blog farms may be classified as spammers - and their blogs then classified as possible spam hosts.

The term "blog owner" must itself be considered fuzzily, as some spam blog farms contain blogs owned by multiple Blogger accounts and profiles. Some Blogger accounts, similar to known spammer accounts - even with no blogs owned, or with empty blogs published - may then appear as possible spam hosts.

Empty blogs may still provide clues, which suggest spammy purpose.

Empty blogs, that appear similar to blogs in known spam farms, may themselves be classified as possible spam hosts. Various details such as blog name, blog design, and use of various blog accessories and features, can make a blog appear similar to known spam blogs - with no other content.

As long as spammers exist, some Blogger blogs will be spuriously classified.

Given the need for Google to reduce the volume of spam blogs, fuzzy spam classification might use any of the above details, in classifying any empty or new blog as a possible spam blog. This will, unfortunately, lead to spurious spam blog detection.

The possibility of spurious classification cannot prevent classification, in general.

Given the ability of spammers to publish multiple blogs in the Blogger name space, classifying empty and new blogs is necessary, in making it possible for Google to keep up with spammy activity. This technique enables publishers of genuine blogs to have their blogs viewed as righteous Internet content - not as one more blog, in a sea of spam.

Read More

Consider, Carefully, The Decision To Use A Third Party Commenting System In Your Blog

Not all Blogger blog owners appreciate the features provided, in Blogger native commenting.

Some suggest that third party commenting systems, such as Disqus, provide a superior service. It's possible that, to some, third party commenting systems are more feature rich - but only Blogger native commenting provides one essential feature, in comment moderation.

Blogger commenting is one component, in the global Blogger / Google spam classification and mitigation strategy.

Blogger blog classification, Blogger commenting moderation, and various Google services, all contribute globally to spam detection, and to spam removal, in Google Internet space. Each service both provides input into - and accepts input from - other services.

Third party commenting products, while they may have some interesting design features that Blogger won't include, won't necessarily contribute to the Blogger blog spam classification effort, or to the community commenting moderation process. Nor will they accept input from Blogger blog spam classification, or from the community comment moderation process.

If you, as a blog owner, believe that Disqus - or other non Blogger commenting products - provides more useful service to your blog, you're entitled to use any service, that you can make work, in your blog. It is, after all, your blog - and this is one feature in our blogs which Blogger / Google leave to our discretion.

As with all third party accessories and services, however, you will get limited support, for any problems. If you break your blog, you'll have only yourself (or the provider of the third party service) to support your problems. You may even see the blog deleted or locked, because of suspected malware.

When you use a third party commenting system, there are two details to consider.

1. Integration of existing comments.
2. Post template modification.

When you install a third party commenting service, you'll have the service import existing comments into their database. And, you will have to install the necessary code into the post template - and deal with ongoing changes to the post template, in the future.

If, in the future, you want to return to use of Blogger commenting, you'll have both of the above details to consider, in reverse. Third party services, while they may provide importation of Blogger comments into their database, may not provide a reverse service. Nor are they likely to provide easy reversal of post template changes - particularly as the Blogger post template may have been changed after installation of the third party service.

If your blog uses an alternate product like Disqus, right now, you'll probably find it easiest to refresh the post template, to return to Blogger comments. If you have various custom tweaks in the post layout, you may not find this to be a pleasant solution.

If you are contemplating changing your blog, to use Disqus - or another alternate commenting system - you may do well to consider all of these issues, before changing.

>> Top

Read More

How You Should Backup Your Blog Will Depend Upon How You Plan To Restore It

We see signs of naivete, in Blogger Help Forum: How Do I?, from blog owners concerned with malware / spam deletions, and with other unexplained disasters in Blogger.

How do I backup my blog, to protect the contents against unfair spam deletions?

Not many concerned blog owners realise the first principle of backups, known by any experienced network administrator.

• Never plan a backup, without first planning the restore.

How you backup your blog depends upon several details.

• What problem do you expect, to require a backup?
• How do you plan to recover, from a problem?

One of the simplest solutions for a backup, which some Blogger experts will suggest, is to use the Export / Import wizard, in Settings - Other.

• Before disaster strikes, Export your posts and comments.
• After disaster strikes, simply Import your posts and comments, from a convenient backup.

Besides backing up comments and posts, backup the template.

Similarly, some experts may suggest backing up the template.

• Before disaster strikes, use the dashboard Template "Backup / Restore" wizard, to backup the template.
• After disaster strikes, use the wizard to restore the template.

But consider other components, too.

There are many components of a Blogger blog - not just the comments, posts, and template.

• Accessories.
• Comments.
• Decorations.
• Gadgets.
• Posts.
• Layout.
• URL.

Before you plan how to backup your blog, you need to decide which of these features is most important to you, and what problem from which you wish to recover.

Backing up accessories right now is not so easily done.

The accessories (decorations, gadgets) is one component of the blog which is most frequently missed, after a deleted blog is recreated / restored using a "comments / posts / template backup" restore strategy. Both graphic decorations, and XML based gadgets, may not be easily backed up, and may present a challenge when the blog is restored, or recreated.

XML gadgets, such as bloglists and linklists, may contain a lot of detail, which is installed into the blog one entry at a time - and there is no known way to automate a backup or restore of these gadgets.

The URL cannot be recovered, by creating or restoring.

Recovering the URL is one of the most subtle details, that may not always be considered by many blog owners. The URL is relevant in two ways. Most blogs which are important enough, for the owner to want to backup, have acquired reputation - both with people (readers, subscribers, and viewers), and with search engines.

Some blogs will link the various posts to each other - as I do with this blog. In either case, the recovered blog is not as useful, unless the URL is also recovered.

If the blog is deleted, the URL may not be recoverable.

If the blog is deleted by Blogger - or by the owner - the URL may not be available, for blog recovery. When Blogger deletes a blog as a suspected abusive content host, the URL is locked to the blog. The only way to recover the URL is to have the blog reviewed, and restored to availability.

When a blog is deleted by the owner, the blog must be restored by the owner - within 90 days after deletion. In either case, a backup is useless.

If you have a personal blog, containing just posts (and maybe comments from known family or friends), backing up the comments and posts makes sense. For a publicly known blog, containing various accessories, and having a known URL, you'll want to plan your backup / restore strategy using a bit more effort.

Read More

Blogger Cannot Provide Advance Warning Of Deletion

One of the more intriguing tales, in the never ending saga of malware and spam interdiction, would have to be the confusion about the proper procedure for deleting or locking blogs, when suspected of hosting malware or spam. We periodically see, as part of a "Please unlock my blog!" request in Blogger Help Forum: Something Is Broken, the naive suggestion.

It would be better if Blogger Support had immediately alerted me of this problem, before deleting my blog!

The irony here is that, from a purely "customer service" viewpoint, I have to concur with the principle here.

It would be better, if Blogger Support could do this. Like many "it would be better" observations, this is probably never going to happen.

What would happen, if Blogger were to provide advance notification of any malware / spam classification? Many spammers would certainly appreciate this option - to remove the dodgy content, before the blog is deleted or locked. The typical spammer would have several options.

1. Remove the dodgy content, immediately.
2. Copy the entire blog to a second blog in the spam blog farm, and wait until receiving advance notification for that blog. Lather, rinse, repeat.
3. Possibly, do nothing. Later, claim indignantly

   I never got the notification!

   and hope that the kind souls at Blogger Support would give him another chance, since he had not been properly warned.

Option #1, used wisely, could even be used to "map" out the current spam mitigation strategy, and let spammers publish hundreds of spam blogs, staying below the radar. Essentially, we would see self whitelisting of spammy blogs. What spammer would not go for that, in a second?

Besides the spammers benefiting hugely from advance notification, not all genuine blog owners would benefit. Not every blog owner uses a properly registered Blogger account, or will read email from Blogger Support.

So, we have two downsides to the option of advance notice.

• Spammers would love it.
• Not every non spammer would appreciate it.

I, for one, don't see an upside - or certainly not any upside with benefit to counter the downsides.

In Utopia, there would be no spammers, and no need for any of this. Unfortunately, the Internet will never be part of Utopia.

Read More

Benefits Of The New Dashboard Based Spam Review Request Option

The improved spam review option has been available, on our dashboards, for slightly less than 2 months. For all it's usefulness, it appears that some blog owners see the new option as just another bit of red tape, which prevents them from publishing their blog. We see suggestions in Blogger Help Forum: Something Is Broken, periodically.

Can't you just submit my review request now, without making me wait another 2 days? Is my dashboard review request really necessary?

Unfortunately, the better the dashboard based spam review option works, the more this confusion should be expected.

Long ago, we had a "Deleted Blogs" link on the previous Blogger dashboard. That link, and the hidden list, were obscure - and explaining how to find the "Deleted Blogs" list was not a job for the weak or impatient. When a blog owner would post in the forums

Why was my blog deleted? I am not a spammer!!

we would typically reply, immediately, with the notorious Spam Appeal Guidelines - then later, cooperative blog owners would see

Your appeal is forwarded to Blogger Support ...

In order to speed up recovery of the less spammy blogs - and shorten the restore wait time for all deleted blogs, Blogger Engineering added the dashboard based "Restore" button. The new button serves two functions.

1. For blogs deleted by Blogger, that are marginally spammy, the blog owner can request an expedited review.
2. For blogs deleted by the owner, less than 90 days previously, the owner can easily restore his own blogs, as convenient.

The new button serves several groups of people, in various ways.

1. Owners of less spammy blogs benefit by expedited restore. When successful, they see their blogs possibly restored on that same day, without their spending any time in the forums.
2. Owners of marginally spammy blogs benefit by regular review and restore, from a shortened queue - since some blog owners will use the expedited queue.
3. Blogger Support can spend less time with the marginally spammy queue, and produce quicker turnaround - yet spend more time examining the truly spammy blogs.
4. Only the genuine spammers will not benefit from the new review queue.

This produces a Win - Win - Win - Loss (sorry, Spammie) scenario.

The blog owners who get their blogs back in a few hours probably won't post in the forums, and praise the improvement - they will be busy re publishing their newly recovered blogs. We may see more oblivious spammers, because Blogger Support will able to spend more time examining truly spammy blogs - which should encourage Blogger Engineering to tweak the automated spam classifier, into digging deeper into the Blogger Blogosphere. So we should expect to see more posts in the forums, for a while.

Why was my blog deleted? I am not a spammer!!

And, it's possible that not all deleted blogs will be listed by the "Deleted Blogs" wizard.

>> Top

Read More

Use Of Google+ For Networking, And Keeping Your Blogger Account And Blogs Safe

One constant activity in Blogger Help Forum: Something Is Broken involves blog owners whose blogs were deleted - either righteously or spuriously - as part of the ongoing battle against spam, in Blogger blogs. Generally, the problem comes directly from the blog content.

Sometimes, the problem is more subtle.

When I tried to login to Blogger, I got a screen that said my account needed to be verified, due to "unusual activity on my account". Having verified my account, I see that my blogs have been deleted.

This is part of one of the more intriguing episodes, in the never ending fight against hacking and spam, in Blogger.

Some Blogger blog owners participate in comment based discussions, and provide their email addresses there. Some state their email addresses openly, in the body of the comments, for the world to see when viewing the comments. Others post comments using their Blogger accounts, knowing that the blog owners can see their email address in the comment moderation / notification email messages - and can contact them using email.

Spammers use comment based networking, to their advantage. They subscribe to any comment thread, using the "Notify me" option - then wait while blog readers comment using their Blogger accounts. As the email comes in, from blog readers commenting, they scrape the email addresses from the email content. Since most people commenting either openly state their blog URLs in the comment bodies - or link to a list of their blogs - the spammer now has two essential ingredients, to be used for hacking someone's Blogger account, and gaining control of the blogs owned by the account.

Google now provides Google+, where we can network with a designated audience, and avoid spam in our email. Using Google+, our email addresses are not revealed, and spammers have less incentive to use Google+ for email address harvesting. This protects our Blogger accounts and blogs against hacking, and relieves us from email based spam.

For people who update their Blogger accounts to use Google+ based profiles, but continue to network using Blogger comments, Blogger now protects us by using anonymous email addresses in all comment generated email. This leaves people who continue to comment, using Blogger accounts with native Blogger profiles, vulnerable to ongoing email address harvesting, and account hacking.

Blogger account hacking, using email addresses harvested from Blogger blog comments, will typically involve brute force password guessing. Blogger, detecting brute force attempts against a vulnerable Blogger account, will lock the account and the blogs. Once we verify ownership of our Blogger account - and hopefully change the Blogger account password to something less vulnerable to guessing - the blogs owned by a possibly compromised account remain locked, until they can be examined for signs of tampering, by Google security / spam analysts.

We also must consider the possibility that not all brute force password guessing attacks are being detected by Google - and some Blogger accounts are being deviously, and temporarily, hijacked.

People who setup Blogger accounts based on bogus email addresses - or who have accounts based on old email addresses which they can't use - continue to present a challenge here. These people will never receive essential email advising them of a problem in either verifying their Blogger account - or their blogs. This will continue to make our initial spam lock advice relevant.

Can you login to Blogger? Do you have a dashboard link "Deleted blogs"? That's where you start.

You wait 24 to 48 hours after submitting a Restore request - then you post back here, and we take the next step.

>> Top

Read More

Redirecting The Traffic From Your Blogger Blog

Some Blogger blog owners are confused about their ability to redirect traffic to, or from, their blogs.

Sometimes this leads to problems, as in the need to report a problem with spam classification, in Blogger Help Forum: Something Is Broken

Why was my blog just deleted, for "Malicious JavaScript"?

Other people will want to know why, after renaming their blog, all the search engine references now point to a dead URL. Still others may want to rename specific posts, and yet have the post URLs match the new titles.

Blog URLs, and Post URLs, are complex details, for Blogger blogs. By default, both are managed for you. Not everybody understands how to manage blog and post URLs, when necessary.

Not every blog owner understands that ones readers are not possessions, to be manipulated at will.

Spammers would appreciate the ability to use Blogger blogs as starting points.

Many spammers would love to use various Blogger blogs as gateways, redirecting their readers either to other Blogger blogs, or to non Google controlled websites. In order to discourage spamming activity, neither type of redirect is permitted, by the Blogger spam classifier.

Even if automated redirection was permitted, many redirection techniques may not work for everybody. Modern browsers, designed to prevent abusive activity like hacking and spamming, may have filters which explicitly block DNS settings, and scripts, designed to redirect traffic from one website to another.

If you migrate a blog, then redirect, you may not see consistent results.

If you design your URL migration strategy to require automated redirection - and even if Blogger / Google does not delete the blog for abusive technique - you may still not see a consistent transfer of existing traffic, to your new URL.

You can redirect a Blogger blog, to a non BlogSpot URL, using properly setup custom domain publishing - "CNAME" referral. That is the only valid way to redirect a BlogSpot URL, to a non BlogSpot URL. Any other method will eventually leave you posting, in Blogger Help Forum: Something Is Broken

Why was my blog just deleted, by Blogger?

If you migrate to a new BlogSpot URL, use a Welcome post in a stub blog.

If you rename your blog - and publish to a new BlogSpot URL, your only recourse is to publish a "stub" (empty) blog to the old URL, and visually redirect your readers.

This blog is now published as "blogger-status-for-real.blogspot.com". Please update your bookmarks.

Blogger does not offer ".htaccess" features, such as redirection.

One disappointment, experienced by non Blogger webmasters, is the lack of ".htaccess" based redirection. You do not have access to the "blogspot.com" root folder - and you cannot use ".htaccess" based redirection.

You can redirect the feed - after you setup a new feed.

You can, if you wish, redirect the blog feed, after renaming the blog - but this should be done only when necessary.

There are several specific cases where the blog feed should not be redirected.

Custom redirects does not provide BlogSpot to BlogSpot redirection.

Blogger recently provided us the option to redirect traffic from one blog post to another - but the syntax used by the custom redirects wizard explicitly prevents redirection outside the base blog URL. That said, we have seen some imaginative redirections, between different URLs in the same blog.

Use of the custom redirect feature can generate interesting problems, not all of which can be prevented, easily. You can redirect some URLs - but you need to understand what you can, and cannot do - and why you cannot do everything that you would like.

Read More