Bad Behavior 2 Roadmap
October 25th, 2005 by Michael Hampton
Update: Bad Behavior 2 development is on hold indefinitely. Find out why and how you can help.
Yesterday I said I was beginning work on Bad Behavior 2.0, the next generation of the Web’s premier link spam killer. And I did. I wrote some ten lines of code.
Before I go into the roadmap, I have to diverge a bit and explain something a lot of people may not be aware of.
Bad Behavior is open source software, released under the GNU General Public License, which you can find copies of all over the Internet, or included with the program. You don’t have to pay a cent to download or use it. However, developing it still costs me time and money, which is why it can go so long between minor releases. Unless (until) some cash comes in, it doesn’t get updated except in cases of dire emergency. Which only happens if I ship code with a typo in it, or Microsoft changes their search engine, or something like that.
I have hundreds of comments and trackback pings from users all over who have virtually eliminated their spam problems with Bad Behavior. And every so often, someone does click the nice PayPal button, to send a few bucks my way. Both are very much appreciated.
Killing blog spam has been mostly a labor of love, however, rather than cash, and as such, has to take a back seat to other more pressing concerns, like anything that generates revenue.
So what I’m going to do here is outline my roadmap for Bad Behavior 2.0, invite you to comment on it, and if you want to see it come about sooner rather than later, to vote with your dollars, pounds, euros, or whatever you have. The amount is blank, so fill in whatever you feel is appropriate.
And if you see any problems with it, or think it could be improved, you can comment on it as well.
First off, Bad Behavior needs to be even more modular than it is currently. Version 1 proved fairly easy to integrate into diverse PHP software packages with differing requirements for their plugins or modules, but it seems like each package requires something different. For version 2 I will have a structure put together to allow Bad Behavior to drop in much more easily into packages such as DotClear and Geeklog, where the plugin architecture is quite different than everything else. This will also have the side effect of opening Bad Behavior to porting to even more software packages. This will be the largest design change in version 2.
Second, Bad Behavior needs to deal with the database more intelligently. In version 1, I kept a log of requests which had been denied, expanded it to optionally include all requests, and expanded it again to include the reasons for denial. Then I started using the information in the log to make decisions. Version 2 will feature a complete redesign of the database table, and expansion into two tables, one strictly for logging (for you to stare at), one strictly for making decisions. I expect to gain significant performance improvements thereby, as well as being able to make more intelligent decisions on which requests should be allowed and which should not be.
Third, Bad Behavior’s API needs improvement. It started as a simple generic interface, and has already outgrown that interface. Version 2 will feature a completely redesigned API for integration into the host PHP program, offering more flexibility, and hopefully the ability for the host program to provide services to Bad Behavior, such as statistics and log viewing.
Fourth, that error page needs to be reworked. Most legitimate users unfortunate enough to see the page, have no idea what to do, even though the page does provide suggestions. It needs to be shortened, clarified and contain links to expanded information sources so that users can solve the problem on their own whenever possible. It should also customize the message based on the specific reasons for denial. Though the ideal is that Bad Behavior should never present the page to a legitimate user — only to spammers.
Along those lines, the 412 error code will be changed. Bad Behavior 2 will attempt to deliver the most appropriate error code to the denial circumstance. In some circumstances, version 2 will return a 403 error. In others, perhaps a 412. In one case, a 417 is appropriate.
Fifth, Bad Behavior needs to provide better tools for site administrators to search for and eliminate any false positives that may arise. While version 1 contains whitelisting capability, it’s not easy for a site owner to determine why a particular request was blocked, due to being unable to find it in the logs. Version 2 will provide a unique key to each denied request which the site owner can use to immediately find the problem, if any, and take any necessary corrective action.
Finally, Bad Behavior must continue to keep up with spammers as they attempt to adapt and find new ways to post their automated garbage. To date, this has been at most a minor issue, as there is only so much the spammers can do, while maintaining their high rates of spamming (10,000 or more posts in a single run is not unusual). Bad Behavior attempts to drive up the cost of link spamming, by blocking as many of those spammy requests as possible, forcing the spammers to resort to MUCH slower manual methods, or ideally, give up and find more honest work.
This is my vision for Bad Behavior 2. All things being as they are right now, the timeline for all this is anywhere from one to six months. How quickly it gets done depends on you.
Without any further contributions to Bad Behavior development, I’ll work on it in my limited free time, and it’ll take somewhere around six months. If I were to receive, for instance, $500 in contributions, I could devote a significant amount of time to it, and complete it within the next month. Hey, don’t laugh, that’s only a few cents per user.
If you think this roadmap looks good, and want to accelerate the development of Bad Behavior, contribute financially and I’ll be able to devote more time to it, meaning version 2 comes closer to reality sooner. And by all means, if you think I left something out that should be in version 2, please let me know. And yes, I know a lot of you are flat broke, so even if you are unable to contribute financially, leave a comment. Say hi, or suggest changes, or something, just so that I know you’re there and you think I should continue this project.
VxJasonxV Says
Place more links to donate why don’t you!
Oct 25th, 2005 at 12:49 am
Michael Hampton Says
Oct 25th, 2005 at 12:54 am
Jonathan Says
Well, you wanted comments…so here ya go =)
Oct 25th, 2005 at 1:33 am
Lorelle VanFossen Says
Excellent outline and road map. I wish more serious plugin and add on developers would be so clear about what needs doing and what it will “take” to get it done. Great work.
While it is unfortunately we live in a world that makes a program like Bad Behavior necessary, Bad Behavior is revolutionizing the way bloggers work, eliminating most of the evil comment spam.
Thanks for all the amazing hard work you do to make the blogging world safer for everyone. You are amazing.
Oct 25th, 2005 at 1:38 am
Mark Jaquith Says
Ahh! It’s a minefield! I panicked and tried to close the window, but ended up stepping on a link and donating $10!
Oct 25th, 2005 at 1:39 am
Ed "What the" Heckman Says
I just found out about Bad Behavior a few days ago. I would love to use it, but I don’t have enough skill (yet!) with PHP or the time to make it work with Expression Engine.
It would help me (and other EE users) a lot if you could take some of the comments in this thread into account during your rewrite.
I hope you get all the contributions you need! It’s unfortunate that Bad Behavior is needed, but it is and I’m thrilled that you’re serious about making it good.
Oct 25th, 2005 at 2:37 am
Ozh Says
Good news.
As for the error page, I would like it to include some “I’m a human damn it, let me access the page” link so that false positive cases can be dealt with nicely. And to me, 403 is just enough. I guess a spammer having an eye over his logs (if such a thing happens) just doesn’t know what a 412 is.
Oct 25th, 2005 at 9:51 am
Michael Hampton Says
I love you guys. WordPress definitely has the most amazing community, and I’m glad to be a part of it.
Ed, I’m aware of the interest for ExpressionEngine, and it’s one of the things motivating the version 2 redesign. I may well do the EE port myself, just to prove that my new design works.
Ozh, I’d originally chosen 403, but way back in the beginning, people complained because they couldn’t tell apart the spambots blocked by Bad Behavior, and those blocked by other measures, in their Apache server logs. So I changed it to 412 at almost the last minute, which had the side effect of confusing a couple of spambots enough to crash them. It also upset a couple of RFC purists who rightly pointed out that 412 is almost never the “right” error to return. Hopefully with better logging (and log viewing) capabilities, this won’t be an issue in the future, though I’ll miss 412.
Oct 25th, 2005 at 12:22 pm
Geof F. Morris Says
Michael: Consider yourself 5% closer to the goal.
Oct 25th, 2005 at 7:43 pm
Michael Hampton Says
Well, I must say I’m both honored and amused. It seems several people took my “for instance, $500″ offhand comment as a fundraising goal and contributed a specific percentage toward it. Thanks, guys.
So after one day, the returns are more than I’d expected, less than I’d hoped.
At the moment, the tally stands at $90, or 18%, of the $500 “goal.” Again, thank you.
Most people don’t know that I used to work for MCI, and that they closed down the center where I had been working. Since that time, my primary sources of income (save unemployment, which is a rant for another blog, but suffice it to say I hate government assistance) have been WordPress consulting and Google ads. The ads right now supply less than 1/3 of the income I need to live, and it’s the occasional consulting work, and the even rarer PayPal donation, that fill in the large gap.
So the $90 means a lot. The other $410 would mean a lot more.
It would mean I could spend more time actually coding things you want, as shown above, and less time looking for someone who wants something done to their blog, who seem to be in fairly short supply lately.
If you can contribute, please do. If you can’t, and you know someone who wants some work done to their blog, send them my way. If you don’t know any such person, leave a comment with your opinion of my roadmap.
Oct 26th, 2005 at 12:48 am
Geof F. Morris Says
You should’ve told me that, Michael.
Oct 26th, 2005 at 5:00 am
VxJasonxV Says
I finally read through the post and will post my comments!
Ok, so, it all looks good, I’m all for more modulability, and all that jazz. Above and beyond all, I’m looking forward to each new release.
One point that I wanted to touch on, is that you mentioned proxied/networked (i.e. corporate) environments.
Do have you any plans to expand this, and attempt to work with properly configured proxies? (Do you already?)
I’m sure you’re not going to play nice with bad proxies/programming
.
Oct 26th, 2005 at 10:12 am
Michael Hampton Says
Geof, which that? Like I said, I’m honored, but it’s still funny.
Jason, any proxy in common use in an enterprise setting should pass through just fine, as long as it’s configured properly. That’s true even now. It’s the misconfigured ones, and the malicious ones, that are going to run into problems.
Ideally for version 2 I’d like to be able to detect the specific proxy server software in use, when possible, and provide directions on how to fix the configuration. Humans hit by the block will see it and be able to take action, while spambots are only going to record the 4xx error and move on.
Come to think of it, why don’t I just make the error code 404 instead of 412. (Before you HTTP purists complain, I invite you to read RFC 2616, sections 10.4.4 and 10.4.5.)
Oct 26th, 2005 at 12:21 pm
VxJasonxV Says
100 * $10 would be two times what you asked for.
Oct 27th, 2005 at 8:19 pm
Michael Hampton Says
Heh. Nobody said you had to stop at $500.
After 72 hours, $320, or 64% of $500, has come in. It looks like we just might make it!
Oh, and here’s an update. I registered for a developer copy of ExpressionEngine, so as to see about porting Bad Behavior to it, but after three days, I haven’t heard back from pMachine. If any of you know anyone there, whack them over the head for me.
Oct 28th, 2005 at 1:13 am
Michael Hampton Says
Hm, since Jason asked… as of about 15 minutes ago, the tally is up to $490! That’s 95% of the “$500 goal”! Anybody got a $10 out there?
The ExpressionEngine folks got back to me, and make an excellent case that I should wait for the next release, version 1.4, and port to that, as they are going to introduce a new architecture called Extensions into that release, which will permit things like Bad Behavior to integrate much more easily into their code. I can’t wait to see it.
Oct 31st, 2005 at 10:12 pm
jan Says
Hi Michael, I plan some fund raising end November when my blog members meet. I hope they’ll scrap together some Euro for WordPress, BB and other projects we use.
I wanted to point out that I posted a small stats graph on BB’ error 412 here:
http://www.nazioneindiana.com/wp-content/badbehavior-sett-ott.jpg
Quite effective, right? The whole post is in italian and deals with our monthly website stats:
http://www.nazioneindiana.com/2005/11/02/statistiche-di-ottobre/
Nov 2nd, 2005 at 6:53 pm
eduardo Says
Hi,
I don’t use Bad Behavior (i get very little spam), but i thought i might say that i admire your work anyway, and also your honesty about the cash.
Keep up!
Nov 6th, 2005 at 7:13 pm