Okay, welcome to 2007.

Let me tell you a story: Our trusty friend-wiki Cheat was getting a lot of spam. Kinda. See, someone suggested I just reject any edits which contained ”<a href”. That worked pretty well, but for some reason the spam-bots kept making empty edits. As in there’d suddenly be 100+ versions of a cheat sheet and they were all identical. The cheat cheat sheet is an example: it has 175 edits of which, like, 4 actually changed anything.

So: the spam bots were having a fun time trying to break through my defenses. Like the raptors in Jurassic Park. Time for drastic measures.

Enter: the Captchator. I have no idea how to pronounce that, really. Sometimes I think I’ve got it but then only a few hours later I lose it again. Anyway, this thing is pretty neat: it’s a captcha web service. You don’t need to install ImageMagick or FreeImage, you just make an image tag with a special captchator.com url and then ask captchator.com if what the user entered in your text box matches what the captcha image actually says.

Like this:

<img src="http://captchator.com/captcha/image/8283"/>

That’ll fetch me a captcha image captchator.com generates. See the 8283? That’s your session id. All I need to do now, on submit, is hit a url like this:

http://captchator.com/captcha/check_answer/8283/peanut

“Peanut” is what the user (read: you) entered into the text box for the captcha check. That url will give me a 1 or a 0 depending on whether ‘peanut’ was really what the captcha generated for session 8283.

Pretty simple. All the spam and empty revisions on Cheat have vanished.

In Ruby?

The Captchator website has all the details, but here’s how I hooked this bad boy up to my lil’ Camping app.

First, the form. The real version is in Markaby, but here it is in rhtml:

<% unless cookies[:passed] %>
  <% session_id = rand(10_000) %>
  <img src="http://captchator.com/captcha/image/<%= session_id -%>" />
  <input name="chunky" type="hidden" value="<%= session_id -%>" />
  <input name="bacon" type="text" size="10" />
<% end %>

(Hey, that’d make a nice little helper method.)

When you answer the Cheat captcha correctly, you get the :passed cookie set. That way you don’t have to keep jumping through hoops. If the cookie’s not set, I grab a random number less than 10,000 and use it for your session id (8283 in the previous example).

The form fields: one, chunky, is your session id. It’s hidden. That way I can check on submit if you’re legit or not. The other, bacon, is what you actually enter as a captcha answer.

Pretty damn simple. In the controller, too:

if captcha_pass? params[:chunky], params[:bacon]
  cookies[:passed] = true
else
  @error = true
end

(That’s a lie. Real code is here, but you get the idea.)

Finally I define my captcha_passed? method, in the controller:

def captcha_pass?(session, answer)
  session = session.to_i
  answer  = answer.gsub(/\W/, '')
  open("http://captchator.com/captcha/check_answer/#{session}/#{answer}").read.to_i.nonzero? rescue false
end

This will give me back a 1 or a 0 after cleaning our dirty, dirty user input.

And just like that, you’re spam free. Sure, it can be circumvented. But that’s fine. I just want to keep the bots out of my damn campground. We’ve got enough cheaters here, we don’t need no spammers neither.

Alternatives

If you don’t want to use a hosted service, Rob Sanheim has a logic captcha plugin which I’ve played with and enjoy. This Google search pretty much sums up the ballgame, complete with a 100% roll-your-own solution on the Rails wiki.

The Captchator is great for a small site like Cheat because it’s way easy to setup and the images (I think) are pretty easy to read. Andreas (the creator) says he uses it on his Mikrocontroller site so, with any luck, the service will be around for a time to come.

Of course, I’m using Akismet on this here blog and it’s been working wonders. But that’s another story entirely. Ta.