I've been meaning to write up a rant on this topic for a long, long time now. Pity I never got around to it; saying "I told you so" would have been a small, mean, but nonetheless savorable pleasure.

Anyway, here was what was gonna be the punchline/pullquote:

"Those who do not remember Usenet are doomed to repeat it. Badly."

The only surprise here is that it took as long as it did for the spambots to discover blogs, especially given MT's near-total dominance of the independently-maintained corner of the blogoverse, and the near universal usage of the (completely insecure) Blogger XMLRPC API. We might as well have tattooed "Insert spam here" on our collective asses.

So now we get to watch the MT developers first, and the rest of the blogosphere soon after, quickly repeat the same arms race / learning cycle that us NNTP and then SMTP developers/administrators did. Rotsa ruck, kids. Block by IP address? Block by frequency analysis? RAPING YOU VIA MILLIONS OF OPEN PROXIES. Block by regular expressions? Bayesian filters? SHOVING RANDOM TEXT AND OBFUSCATED URLS BETWEEN YOUR BLEEDING LIPS. Cute challenge-response methods? OWNING YOUR ASS WITH A WAREZED OCR PROGRAM, AND HA HA HA YOU SEEM TO HAVE DRIVEN YOUR ACTUAL CUSTOMERS AWAY...OOPS I GUESS I WANTED THEM AROUND TOO.

As far as I can tell, it's axiomatic that spam expands to fill any available common space that can host it, eventually driving out the users of that commons that the spammers wanted to contact in the first place. And the ratio of otherwise bright engineers who think about the problem for 0.0021 seconds and immediately announce that they've got the perfect solution to the number people who've actually solved the problem is...oh wait, can't divide by zero.

BTW, I'm pretty sure that Yahoo was using the "type the phrase in this fuzzy GIF into this field" method long before Paypal, but I could be wrong. (Despite my snarking above, it's been a reasonably effective holding action, although I don't expect it to last. I suppose we should be grateful that nobody's yet tried to patent it.)

Amusing related note: AT&T has just announced that they're changing all of their mail servers over to a default-reject policy: if they don't have email from a human being, somewhere, claiming to exercise administrative authority over an IP address, they'll no longer accept mail from it. Oh well, SMTP was nice while it lasted.