Tender Spam Woes

A patch that was deployed late Friday afternoon angered the spam gods, and most incoming discussions were marked as spam. You may have noticed your Tender site being suspiciously quiet this weekend. In light of this, we’ve done these 3 things:

1. Added a switch to the site settings to disable spam. This might be a better option if you’re not receiving much spam as it is.
2. Refined the spam rules so that the third party spam service is used as little as possible. Your site’s comments skip the spam checker if they are emailed in, or if the user has posted more than 3 valid comments. Three comments is the point that a user is ‘trusted’ and no longer subjected to spam or captcha checks.
3. Added a site-wide spam log in our admin tools so we can monitor the incoming spam. This will help us track and fix future problems much faster. We’re currently going through the pages of spam and clearing or restoring everything.

What was the original bug? When we receive comments through email, we lose out on 3 key attributes that spam checkers use: user IP, user agent, and HTTP referrer. These are all values sent by the user’s browser, but not through email. As a result, we started using default values for everything. Reports of invalid spam were on the rise, so I took out the defaults thinking that spammy emails might be tainting those default values. Since all emails were using the same fake user IP, 5 bad emails could suggest to the spam checker that everything from that IP is bad. However, removing those 3 value completely must’ve put a big target over every email. This is why we’ve stopped checking spam for emails.

We apologize for the inconvenience. We take spam very seriously. The open nature of the service makes it a challenge to keep all of the laptop auction emails off your site, and all of the new support questions out of your spam queue. I’m hoping that the new tweaks tonight should help considerably. If not, we’ll be watching everyone’s spam and fine tuning as necessary.

Update: There’s a bug related to sites with disabled spam checking that now send all anonymous issues to the Trash queue. We’re deploying a quick hotfix, and then we’re going to restore all the issues for you.