Flashes of Panic

I’ve mentioned this in passing once before, but it bears repeating and calling attention to. A few months ago I changed the name of my Movable Type comment script to foil comment spammers. Some of them have bots which can figure out the new script name, but it appears that many of those bots have a bug: they can’t distinguish mixed-case URLs. Since my new script name has both capitals and lowercase letters (my personal shorthand for this site is F.o.P.,) and URLs are case-sensitive, I am seeing a lot of not-found errors in my log where spammers try to access the comment script using an all-lower-case URL.

So, if you’re changing the name of the mt-comments.cgi and mt-tb.cgi, try using mixed-case names. It’s not utterly foolproof, but it turns out the comment spammers are only run-of-the-mill fools.