alogblog's MTy plugins

Requirement

MT 3.2
RDB like mySQL if you are using Dynamic Publishing. (This plugin provides PHP version)

Installation

Download this plugin and untar it under mt home.

ex) $ cd mt_home; $ tar xvfz CTCode-3.2.03.tar.gz

Then all files will be located in proper sub-folders as below.

• (mt home)/default_templates/obfuscator.js


• (mt home)/php/plugins/alogblogObfuscator.php


• (mt home)/php/plugins/init.alogblog-CCode.php


• (mt home)/php/plugins/init.alogblog-TCode.php


• (mt home)/plugins/BigPAPI.pl


• (mt home)/plugins/alogblog/CCode.pl


• (mt home)/plugins/alogblog/TCode.pl


• (mt home)/plugins/alogblog/lib/alogblogObfuscator.pm

In your blog's Index Template menu page, open "Site JavaScript" template, and then add the content of obfuscator.js into the bottom of that template. And Save and Rebuild it. That's all.
This method is easy but If you created a new blog, then you would have to do this process again.

Second method is more recommanded. Open (mt_home)/default_templates/site_javascript.tmpl and add the content of obfuscator.js into the bottom of it. Then in Index Template menu page, check Site JavaScript template and do "Refresh Template(s)" action. Then the content of obfuscator.js will be automatically added. With this method, you don't have to add it manually to each newly created blogs, because we modified default template of Site JavaScript.

Tag Usages

1. CCode

Insert <$MTEntryCCode$> tag within the comment <form> tag of Individual Entry Archive template and Comment Preview template. Proper inserting position may be as below.

<input type="hidden" name="entry_id" value="<$MTEntryID$>" /> <$MTEntryCCode$>

And then rebuild individual entry archives. ( You can see above tag's results by openning this page's source. )

* Also, these tags can be added to the default templates for Individual Archive (individual_entry_archive.tmpl) and Comment Preview (comment_preview_template.tmpl) much like the second method described under Installation of site_javascript.tmpl. This provides the same advantage of using refresh instead of manually updating each blog's template set. ( Updated with help of Jeb )

2. TCode

MT's default template tags, <MTEntryTrackbackID>, <MTEntryTrackbackLink>, <MTEntryTrackbackData>, are used. So you don't have to edit templates. Just rebuild individual entry archive if you are not using Dynamic Publishing. ( You can also see this entry's tb URL example and RDF tb data in its source. )

* Added attributes of MTEntryTrackbackID / MTEntryTrackbackLink in 3.2.02

• <MTEntryTrackbackLink nocode="1"$> : If you want to embed trackback link to some XML feeds, then you need to use this attribute. ex) ".../mt-tb.cgi/24.your ping is to be moderated, so please dont't send repeatedly"
• <MTEntryTrackbackLink nocode="2"$> : ex) ".../mt-tb.cgi/24"
• <MTEntryTrackbackLink hidden="1"$> :The "hidden" makes ID/Link invisible, and then those values are assigned to __MTTBID__, __MTTBLINK__ javascript variables. You can use trackback ID/Link in Javascript. For example, if you want to implement copy-to-clipboard feature, then you need to use that variable like copytoclipboard(__MTTBLINK__);

Description

1. CCode

CCode adds an additional input field to the defalut comment form. This value(=CCode) is calculated from entry's own data, and that value is obfuscated by Javascript routines. I used the obfuscator probided by http://www.jottings.com/obfuscator/

So as to send comment spams, spam-bot must parse a page and calculate it reversely. This reverse solution is not impossible theoritically. But although spammer finds a solution routine for CCode, the problem is still there. They have to visit a page, parse it, solve it, and finally send spam to only "that" page. If they want to send spams to 100 different entries, they have to always loop above full process for each 100 entries.

CCode is similiar to SCode in that it adds one more input field. But CCode doesn't require commenter's interaction. And it doesn't store any additional CCode-related data to DB or file.

2. TCode

Trackback spambots visit meta blog sites and download recent updated entries, and then collect trackback URLs using RDF tb data which was embeded into page for blogger's easy use of Bookmarklet or QuickPost or Auto Trackback Discovery featues or so. I think the main customer of embeded RDF tb data is ironically trackback-spambot. (If I were tb spam-bot programmer, I would thank the inventor of RDF tb data)

Spambots need just one sampling tb URL for each blog. If they know one tb URL, then they will make other entry's tb URL by simply iterating as like example below.

loop ( i = from 500 to 1 ) {

   result = send_ping(tb base URL + i );   # i is tb ID

   if(result is OK) {

     bombing to that URL with many pings

   }

}

TCode comes out from the idea that longer tb ID(by adding TCode into origianl tb ID) is, more difficult or time-consuming for guessing tb ID. Moreover, obfuscating it will frustrate spambots for re-calculating it.

Additonal notes for TCode:

1. RDF's trackback::ping
TCode treats entry's RDF trackback URL differently from the original one. In this entry's source, you can find RDF tb data. See trackback:ping field.(If you installed QuickPost, you can see tb URL in QuickPost window)That tb URL is as like "http://www.example.com/mt-tb.cgi/777.your ping is to be moderated, so please dont't send repeatedly" Yes, it is also this entry's tb URL. This URL is for automatic trackback sending tools like QuickPost, Bookmarklet or TB Auto-Discovery and MAINLY for spambots.

It is because an obfuscated TCode by javascript can't be applied in RDF tb data. In MT 3.17, I removed MTEntryTrackbackData. But in 3.2, all pings sent to above URL(ie. by automatic tool) will always(even if you turn off comment moderation) have PENDING state.

2. Category incoming trackback
Category Trackback URL also works as like an entry. If you turn on incoming category trackback, tb URL applied with TCode will be used.(Of course, passphrase can be used with no problem.)

Credits

Thanks, Tim Williams and Andrew Moulden for obfuscator. It initiated me in making CCode/TCCode plugins.

Thanks, Kevin Shay. With his BigPAPI, TCode of category trackback could be dramatically easily programmed.

License

Relased under the Creative Commons License.

Version History

• 3.2.03 : Missing <$MTCategoryTrackbackLink$> tag added. Thanks id.tiiop for notifying me
• 3.2.02 : nocode="1", "2" attributes are added in ID/Link. Thanks dusl for this option.
• 3.2.01 : for MT 3.2, PHP plugin added.
• 1.0 : for MT3.17