So, I was reading through one of Scott Hanselman's latest posts, pointing out that the CommentAPI allows spammers to circumvent CAPTCHAs (as pointed out on Phil Haack's blog).
And... had to drop in a comment/post: ReverseDOS blocks CommentAPI spam - dead. ReverseDOS is an HTTPModule that checks every incoming request, be it POST or GET (or even HEAD (I think)), and if it finds anything matching an existing spam filter, it stops it dead - even if the POSTed or GETed content is text, xml, etc.




Comments