Comments on: How Bad Behavior handles false positives

By: Michael Hampton

Michael Hampton — Tue, 17 Mar 2009 19:29:12 +0000

If people get a completely blank page, then there was probably a PHP error somewhere, which will be logged in the server’s error log. You might look for it there.

By: tigtog

tigtog — Tue, 17 Mar 2009 19:15:20 +0000

The IPs of these people didn’t show up in the PHP-MyAdmin logs either, and there’s now two more reports. Comment counts for the day are right down, so I’m going to have to disable BB until I can find a resolution.

I’m still on an older version of WordPress because I can still use the Greasemonkey extension Akismet Auntie Spam with it. It hasn’t been updated for WP 2.7+ and I refuse to wade through spam without it, so unless BB can work to block the spam and still allow commenters I guess I’m stuck without upgrading that blog.

By: tigtog

tigtog — Tue, 17 Mar 2009 05:44:06 +0000

Hi, just installed BB today. The spam blocking appears impressive, but the only two people to contact me to say that they can’t see the site are just getting a blank page, no error message or self-help links.

Their IPs are not showing up in the list of blocked IPs in the WordPress management page.

For now I’ve just whitelisted them, until I figure my way around the php-MyAdmin logs. But why aren’t they getting any diagnostic message? I’m using WP SuperCache, and I added the code there as instructed, and other people are commenting OK (although not as many as usual).

Any ideas?

By: joe

joe — Mon, 23 Feb 2009 12:53:06 +0000

Just added two robots to the whitelist, which may be interesting to have there by default.

1. Simile (a MIT research project on Semantic Web subjects)
Fixed IP address: “18.51.2.218″, // Simile.MIT.EDU

2. Sincice (a semantic web search engine with their own index robot).
Allowing their UA seems not to work: “SindiceFetcher/0.1 (+http://sindice.com/developers/bot)”,

I noticed the sindice people about the problem, see:

http://forum.sindice.com/showthread.php?p=330#post330

By: Sebastian

Sebastian — Mon, 16 Feb 2009 13:53:13 +0000

Hi there,

I just wanted to say thanks! I love BB and it saved me tons of time and resources. It works really well (at least I didn’t get any bad feedback at all so far.

What I hate are ignorant users or even worse ignorant users that don’t care at all – those who cause the web to drown in SPAM, Botnets and Phishing.

Again, thanks for BB!

By: Tamara Burks

Tamara Burks — Tue, 27 Jan 2009 05:59:31 +0000

I tried posting on one site and it gave me a error saying it wouldn’t post because of your software. then went back and reloaded the page and saw it had gone through. I’m more than a bit confused. I was thinking that maybe that instance of fakealert virus that I had had about a week ago (and had originally thought I was just continually running across a very annoying autoscan) was cleared up. I have a antivirus, winpatrol and I use Glarysoft utilities to repeatedly clean out the temp files so if anything is hiding in there gets cleaned out.

By: Andre

Andre — Tue, 13 Jan 2009 12:23:31 +0000

Sorry, i get a little paranoid. a spamer tray recently to spam the wiki with many IPs, and science den among others i don’t publish my email anymore. And sorry for the double Post. (You can delete my posts if you want.)

By: Michael Hampton

Michael Hampton — Mon, 12 Jan 2009 23:20:20 +0000

Andre, since you were able to post here, which also uses Bad Behavior, I suspect something is going on with your web server. But since you filled out fake information I can’t go any further.

By: Andre

Andre — Mon, 12 Jan 2009 23:07:35 +0000

Thanks for your comment, Michael Hampton

Hmmm… Ok…

i use opera, firewale, and the system is regularly virus checked.
the error occurs to if i don’t post any text but abbort the edit.
(i have no idea where this EXPECT is coming from, maybe from the firewall? but so mach i know, EXPECT is ok with HTTP/1.1, true?)

in the code common_tests.inc.php is written:
// Is it claiming to be HTTP/1.0? Then it shouldn’t do HTTP/1.1 things
…

if the HTTP_EXPECT header is ok in HTTP/1.1, but then the code don’t check this:
if (array_key_exists(‘Expect’, $package['headers_mixed']) && stripos($package['headers_mixed']['Expect'], “100-continue”) !== FALSE) {
…

in the next check the HTTP/1.1 is checked:
if ($settings['strict'] && !strcmp($package['server_protocol'], “HTTP/1.1″)) {
if (array_key_exists(‘Pragma’, $package['headers_mixed']) && strpos($package['headers_mixed']['Pragma'], “no-cache”) !== FALSE && !array_key_exists(‘Cache-Control’, $package['headers_mixed'])) {
…

if it is my software, i have no idea what could cause this problem, there is nothing unusual. where i should search the cause?
(i don’t want abuse this commend place as forum, if everything is ok with the code in your opinion, i will fix it for the wiki with a patch, thanks.)

By: Andre

Andre — Mon, 12 Jan 2009 23:03:34 +0000

Thanks for your comment, Michael Hampton

Hmmm… Ok…

i use opera, firewale, and the system is regularly virus checked.
the error occurs too if i don’t post any text but abbort the edit.
(i have no idea where this EXPECT is coming from, maybe from the firewall? but so mach i know, EXPECT is ok with HTTP/1.1, true?)

in the code common_tests.inc.php is written:
// Is it claiming to be HTTP/1.0? Then it shouldn’t do HTTP/1.1 things
…