As I've undoubtedly mentioned here before, one of the less obvious chores a security blogger has to find time for is to approve and - where appropriate - respond to comments. Though I use the term chore, it's by no means an unpleasant task: for every ill-mannered snottogram that gets submitted as a comment, there are many comments that are thoughtful and thought-provoking, useful additions or corrections to the original post, and many of them are complimentary. Still, it is an additional job and we can't always find time to approve or respond to comments as quickly as we'd like, so I apologise to anyone who has posted something relevant and useful but has had to wait for days (or longer!) to see it approved.
Unfortunately, some posts aren't really relevant: for instance, we simply aren't resourced to answer support queries here, though we'll usually respond to explain where you're likely to get a more helpful response. (Again, if we sometimes fail to do so, I apologise.) Sometimes, we'll even use them as a starting point for a different blog, but that depends on our having the time to do so: even a short, straightforward post like this takes time to put together.
Then there are the comment spammers, who aren't going to get an apology. Of course, a lot of comment spam is clearly automated, so the comments have nothing to do with the topic or even the site, or are so generic as to be useless. While we like to think that we're pretty good at the blogging game, we're rarely fooled by comments like "Great article!" that are obviously intended to flatter us into including an email address or link that constitutes some sort of advertisement.
However, one interesting trend in blog comment spam that I’ve noticed in recent months is that a number of posts are obviously intended to push a product or site, but contain content that is actually relevant. While there might be some automation involved here - Black Hat Search Engine Optimization (BHSEO) frequently makes use of content scraped from various sources and based on relevant keywords - some of the comments I’ve seen actually sound as if the spammer had read the article.
Well, we see our role as bloggers as being at least in part educational. Perhaps even spammers can learn something from us. ;-)
However, we're still not going to publish links to anything that looks spammy or malicious...
David Harley CITP FBCS CISSP
ESET Senior Research Fellow
