Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development is taking place in the 2.1 development tree.

Who should upgrade?

WordPress users should upgrade to prevent internal data from leaking to the web browser when the database encounters an error. Users of other platforms are not affected.

What’s new?

New in this release (since 2.1.0 and 2.0.35):

• Due to recent changes in the WordPress database code, any database errors that may occur because of WordPress, other plugins, or server trouble may be inappropriately displayed in the web browser. This could result in the leakage of information useful to attackers. This issue has been fixed. Thanks to Andrew Zhang for reporting this issue.

Download

The 2.1 development releases will not be offered through the WordPress automatic upgrade facility.

Download the 2.0.36 stable or 2.1.1 development release of Bad Behavior now!

Support

This release would not have been possible without the support of people like you who find Bad Behavior valuable enough to make a financial contribution to ensure its further development.

Your contributions ensure that I can continue to devote time to bringing you the features you want, as well as continuing work on making spammers’ lives hell.

If you haven’t already done so, consider setting up a recurring contribution for as little as $5 per year, or make your most generous one-time contribution for any amount.

Thank you again for supporting Bad Behavior development!

Who should upgrade?

Users who use Bad Behavior’s whitelisting features, or who customize Bad Behavior’s settings on a platform other than WordPress or LifeType, should upgrade to take advantage of new features offered in this release.

What’s new?

Development of Bad Behavior 2.1 generally follows the roadmap outlined earlier. In this initial release, the following features have been implemented:

• Bad Behavior now reads whitelists from a separate file which is preserved through updates. See below for preliminary instructions on using this feature.
• On platforms where Bad Behavior cannot store settings in the host platform’s database, Bad Behavior now reads settings from a separate file which is preserved through updates. See below for preliminary instructions on using this feature.
• Bad Behavior’s core has been reworked to facilitate testing its core logic. While the actual logic tests have not yet been written, a test mode is available for developers to experiment with. See below for preliminary instructions on using this feature.

Whitelists

Bad Behavior now reads its whitelists from a separate file named whitelist.ini. This file is not distributed with Bad Behavior, so that future upgrades do not disturb the whitelist. This means that anyone who wants to use the whitelist must download the whitelist.ini, customize it, then upload it to their server. Place the whitelist.ini in Bad Behavior’s top level directory (the same directory that contains bad-behavior-wordpress.php, README.txt, etc.).

Note for IPv6 users: At this time, single IPv6 addresses can be whitelisted, but IPv6 networks cannot be. This will be fixed in a future release.

Settings

On some platforms, such as WordPress and LifeType, Bad Behavior stores its settings in the host platform’s database and provides an interface through the host platform for changing the settings. On other platforms, Bad Behavior is not capable of storing its settings in the host platform’s database, either because there is no database, or because the database cannot be used in that way.

On these platforms, Bad Behavior can now read settings customizations from a settings.ini file. This file is not distributed with Bad Behavior, so that future upgrades do not disturb your settings. This means that on those platforms, anyone who wants to customize their settings must download the settings.ini, customize it, then upload it to their server. Place the settings.ini in Bad Behavior’s top level directory (the same directory that contains bad-behavior-wordpress.php, README.txt, etc.). This feature has been implemented for the MediaWiki and generic ports; other platforms will need to implement the feature in their platform connectors before it is available to you.

Testing

Bad Behavior’s core logic now supports “black box” testing. This won’t be of much interest to most people, except that testing will help improve the quality of the product. A test suite is still planned and will be released later.

In addition, Bad Behavior now supports a live “test mode” in which it will not actually block any requests, but will report on whether they would have been blocked. This is fully implemented in the WordPress port; to use it on other ports, the platform connector must provide a method for the platform to report the results. To enable test mode, define a PHP constant BB2_TEST.

Download

The 2.1 development releases will not be offered through the WordPress automatic upgrade facility.

Download this development release of Bad Behavior now! You can install Bad Behavior using the usual installation instructions; there are no special requirements for this release.

Remember to subscribe to the Bad Behavior RSS feed to receive notice when Bad Behavior development updates are available.

Support

This release would not have been possible without the support of people like you who find Bad Behavior valuable enough to make a financial contribution to ensure its further development.

Your contributions ensure that I can continue to devote time to bringing you the features you want, as well as continuing work on making spammers’ lives hell.

If you haven’t already done so, consider setting up a recurring contribution for as little as $5 per year, or make your most generous one-time contribution for any amount.

Thank you again for supporting Bad Behavior development!

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development will be to the 2.1 development tree.

MediaWiki and WordPress users who have not updated in the last year or so should take note of special upgrade instructions below.

Who should upgrade?

Users whose sites are on shared web hosting services should upgrade to prevent “MySQL server has gone away” database errors. Users whose sites are on dedicated servers or virtual dedicated servers should review the information below before upgrading.

What’s new?

New in this release (since 2.0.34):

• In very rare circumstances, Bad Behavior users may see MySQL database errors stating “MySQL server has gone away.” This issue does not occur in Bad Behavior’s default configuration. It primarily affects shared web hosting providers using cPanel/WHM, though it may affect other shared web hosting providers or, even more rarely, people who run their own virtual dedicated servers or dedicated servers. A workaround has been placed in Bad Behavior to mitigate this issue.

In order for this issue to occur, three things must happen:

• Bad Behavior must be configured to use the http:BL DNS-based list (which is disabled by default);
• A DNS query sent to http:BL must take an unusually long time (several seconds or more); and
• The time the DNS query takes must exceed the MySQL server’s configured wait_timeout value.

In this scenario, because MySQL has not seen a database query for a long time, the server drops the database connection. Shared web hosting providers set the wait_timeout value relatively low in order to preserve resources on their typically very active databases; each open connection uses scarce memory that could be serving another user. There is nothing wrong with this, in theory, though a few hosting providers set wait_timeout so low as to be frequently unusable. For instance, cPanel/WHM based web hosts may have wait_timeout set to 10 seconds, which I feel is completely unreasonable.

The “MySQL server has gone away” error appears when the host platform under which Bad Behavior runs (e.g. WordPress, Drupal, etc.) fails to trap the error and reopen the database connection. There is nothing Bad Behavior can presently do to cause the host platform to reconnect to the database. If your host platform does this, its database code needs to be reworked so that it reconnects and resends the query when it gets the “MySQL server has gone away” error.

Another issue here is that DNS lookups typically take less than a second. When http:BL is active, Bad Behavior screens the IP address for all POST requests against it. The Internet not being 100% reliable, it’s expected that occasionally DNS queries will be slow. If DNS lookups consistently take significantly longer, (e.g. they’re slow for more than a day) this may indicate trouble with the DNS servers being used by the web server. There isn’t much that Bad Behavior can do about this.

In the meantime, the workaround released today will ask the MySQL server to temporarily raise the timeout to 90 seconds, for that connection only, whenever it does a DNS lookup. (The timeout for most requests is left alone.) This should be more than sufficient; with my own server set at 60 seconds I have never seen this error.

If you continue to see “MySQL server has gone away” messages and/or slow loading times when you log in or navigate your administrative pages, disable http:BL. If that still doesn’t help, you may have other trouble; contact me and we’ll figure it out.

Finally I want to thank Jen Lepp at DrakNet Web Hosting for providing the information which finally allowed me to track down this rare but annoying issue.

Support

Thank you to everyone who has chosen to make a financial contribution toward further development of Bad Behavior. Your contributions ensure that I can prioritize Bad Behavior development and make more frequent and timely releases, like this one.

Download

Download Bad Behavior now!

Special Upgrade Instructions

Users of MediaWiki and WordPress upgrading from version 2.0.20 or earlier should follow these special directions (from 2.0.21 or later, upgrade normally):

For MediaWiki: Before installing this version of Bad Behavior, manually remove (e.g. using FTP or ssh) any old versions you may have, including the lines added to LocalSettings.php. Then install the new version fresh, following the installation instructions for MediaWiki.

For WordPress: If updating to this version through the automatic updater fails, manually remove (e.g. using FTP or ssh) any old versions you may have installed. Then upload and install the new version fresh, following the installation instructions for WordPress. After doing so, future automatic updates should proceed normally.

For other platforms: No changes to your upgrade procedures should be necessary.

Cahoots is described on its SourceForge wiki page as “a PHP-based knowledge-exchange community application.” From viewing their demonstration site and feature list it looks like an interesting and useful way to do project collaboration.

If you’re a Cahoots user, welcome to the Bad Behavior community!

This behavior occurs because of a misfeature in IIS 7.0 where it serves custom error pages by default, overriding the error page generated by your web application. This is, of course, utterly broken behavior, and just one of many reasons you shouldn’t use IIS on Windows to serve your web site.

But some people still want to do it, so here is a workaround to allow Bad Behavior (not to mention every other web app you have) to display its error pages properly.

You will need to know your way around IIS already; I cannot give you any support for this.

You will need to modify your IIS configuration to set the web server httpErrors element to “passthrough”. An MSDN blog post from the IIS team explains how to set this property for an individual web site or for your entire server.

Not only does this provide a fix for Bad Behavior, it also fixes WordPress 404 pages, as well as numerous problems where a web application expects to generate its own error page. Of course, it’s utterly ridiculous that this requires a workaround and is not the default behavior, as it is with every other web server. But that’s one more reason not to use IIS.

Bad Behavior 2.0.34 has been released. It is a maintenance release and is recommended for specific users of WordPress identified below.

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development will be to the 2.1 development tree.

MediaWiki and WordPress users who have not updated in the last year or so should take note of special upgrade instructions below.

Who should upgrade?

WordPress users who use the W3 Total Cache plugin should upgrade to ensure that users are not blocked inappropriately due to flaws in W3 Total Cache.

What’s new?

New in this release (since 2.0.33):

• On some WordPress installations which use the W3 Total Cache plugin, W3 Total Cache could inappropriately store the error page which Bad Behavior serves to illegitimate requests. When this happens, the cached error page would be served to subsequent legitimate requests. Bad Behavior 2.0.34 contains a workaround which forces W3 Total Cache to not cache these error pages. (To be clear, W3 Total Cache is still broken and needs an update, but this resolves the immediate problem.)

Authors of caching plugins should consider following the “standard” set by WP Super Cache: check for a constant DONOTCACHEPAGE which can be set by other plugins; and checking to ensure that non-cacheable error responses are never cached, regardless of which plugin generates them.

Support

Thank you to everyone who has chosen to make a financial contribution toward further development of Bad Behavior. Your contributions ensure that I can prioritize Bad Behavior development and make more frequent and timely releases, like this one.

Download

Download Bad Behavior now!

Special Upgrade Instructions

Users of MediaWiki and WordPress upgrading from version 2.0.20 or earlier should follow these special directions (from 2.0.21 or later, upgrade normally):

For MediaWiki: Before installing this version of Bad Behavior, manually remove (e.g. using FTP or ssh) any old versions you may have, including the lines added to LocalSettings.php. Then install the new version fresh, following the installation instructions for MediaWiki.

For WordPress: If updating to this version through the automatic updater fails, manually remove (e.g. using FTP or ssh) any old versions you may have installed. Then upload and install the new version fresh, following the installation instructions for WordPress. After doing so, future automatic updates should proceed normally.

For other platforms: No changes to your upgrade procedures should be necessary.

In the last 24 hours I’ve received complaints from Bad Behavior users that legitimate requests are being blocked. These users are using WordPress caching systems. In each case, the caching system was inappropriately caching the blocked page which was served to an illegitimate request. The caching system would then serve the blocked page to subsequent legitimate requests.

To be perfectly clear, this is a problem with the cache, not with Bad Behavior. The HTTP standard, RFC 2616, explicitly prohibits caches from “negative caching,” or storing the types of 4xx error pages which Bad Behavior serves to illegitimate requests. (The only cacheable error is 410, and Bad Behavior does not use this error.)

Currently I know of two WordPress caches which have this problem: Hyper Cache and W3 Total Cache. There is currently no workaround; to resolve the problem, either Bad Behavior or the caching plugin must be disabled.

In the case of Hyper Cache, you can replace it with WP Super Cache, which does not have this problem. There is no comparable replacement for W3 Total Cache; it’s otherwise an excellent product which combines many different techniques to speed up your site.

Other WordPress caches may be affected as well. If you don’t see your favorite caching plugin listed below, leave a comment and I’ll test it for this issue.

Current test results with Bad Behavior 2.0.33 and WordPress 2.8.6:

Batcache 1.0 = OK
Hyper Cache 2.6.3 = Broken
W3 Total Cache 0.8.5 = Broken
WP Super Cache 0.9.8 = OK

With respect to external caches and content distribution networks, normally these do not engage in negative caching. However it is possible to configure them to cache error responses. When this functionality is used, it should be limited to caching 404 and 410 errors.

Finally, the development roadmap includes features which will let Bad Behavior communicate to other plugins whether it has approved or blocked a request. If you want to support this feature along with future Bad Behavior development, consider becoming a sustaining contributor.

Another very real threat is criminals who use automated attacks against thousands or even millions of web sites, hoping that a few will let them in so they can take over your site, forcing malicious software on your unsuspecting visitors and posting as many links to their garbage as they want.

On Monday the SANS Internet Storm Center noted one such attack seen in the wild which uses a distributed network of virtual machines that all talk to each other and share data on which passwords they’ve tried against which WordPress blogs.

After obtaining a copy of the attack script and testing it in a virtual lab, I’ve determined that Bad Behavior already blocks this script as it is currently written.

Even so, the script has given me some good ideas on how to improve Bad Behavior further to protect against malicious attacks of this type. I will be rolling out some of these changes in the following days in the 2.0 branch.

The first release in the 2.1 development branch will be coming later this month, as well. If you want to see it sooner, consider becoming a sustaining contributor to Bad Behavior development. Your contributions ensure that I can devote development time to Bad Behavior on an ongoing basis.

Bad Behavior 2.0.33 has been released. It is a maintenance release and is recommended for all users.

Please note: The 2.0 series of Bad Behavior is receiving limited updates, including unblocks, bug fixes and security fixes only. Future development will be to the 2.1 development tree.

MediaWiki and WordPress users who have not updated in the last year or so should take note of special upgrade instructions below.

Who should upgrade?

Users should upgrade to permit use of the Coral Content Distribution Network with their web sites.

What’s new?

New in this release (since 2.0.32):

• The web crawler used by the Coral Content Distribution Network uses an HTTP header most commonly seen from malicious requests; therefore, it was being blocked. Users who used the Coral CDN to access Bad Behavior protected sites were denied, although accessing the site directly works fine. This issue has been fixed.

Support

Thank you to everyone who has chosen to make a financial contribution toward further development of Bad Behavior. Your contributions ensure that I can prioritize Bad Behavior development and make more frequent and timely releases, like this one.

Download

Download Bad Behavior now!

Special Upgrade Instructions

Users of MediaWiki and WordPress upgrading from version 2.0.20 or earlier should follow these special directions (from 2.0.21 or later, upgrade normally):

For MediaWiki: Before installing this version of Bad Behavior, manually remove (e.g. using FTP or ssh) any old versions you may have, including the lines added to LocalSettings.php. Then install the new version fresh, following the installation instructions for MediaWiki.

For WordPress: If updating to this version through the automatic updater fails, manually remove (e.g. using FTP or ssh) any old versions you may have installed. Then upload and install the new version fresh, following the installation instructions for WordPress. After doing so, future automatic updates should proceed normally.

For other platforms: No changes to your upgrade procedures should be necessary.

Now the design needs a few tweaks. This work will eventually become Bad Behavior 2.2. Today I want to update you on some of the changes Bad Behavior needs and what I’m planning for the 2.2 version.

As I noted with today’s 2.0.32 release, development of the 2.0 branch has been limited to bug fixes and security issues so that I can concentrate development on this new version. The development will take place in versions numbered from 2.1. As a development branch, it won’t be appropriate for everyone, but many of you will be interested in following its progress.

Before I get into the details of the roadmap, there’s something I haven’t talked about in a while and should probably do again. Bad Behavior has been a personal project of mine for almost five years now. It was born out of an incident, a couple of months after I started blogging, where I got my first comment spam. Unfortunately, my first comment spam was followed by 700 more over the space of a few hours. As you can imagine, I was thoroughly pissed. I spent some time looking at anti-spam solutions, but at the time there wasn’t much, and what there was didn’t work all that well. I felt I had to roll my own. A couple of months later, Bad Behavior was born.

I still clearly remember cleaning up after that first incident, and killing link spam has become something of a personal crusade for me. But I’ve learned that I can’t possibly do it all alone. Fortunately this field has grown significantly and there are now a whole lot of smart people working on various aspects of the link spam problem. What Bad Behavior brings to the table is to take that 700 spam attack and allow fewer than one percent to reach your blog. Having to clean out 7 spam from the moderation queue is much easier than cleaning out 700. (This is one reason why I advise using more than one anti-spam solution.)

The main technique Bad Behavior uses to accomplish this is to block bots which scrape your site to get access to your comment forms, login forms and other such forms on your site. Once a bot has the form, it can pass it around a botnet and send dozens of spams to that page from all over the world. Preventing malicious bots from accessing the forms in the first place stops the majority of spam. The remainder is a variety of techniques used to identify poorly coded bots which imperfectly masquerade as legitimate web traffic.

As new spammers start up and new botnets come online, some find themselves already blocked, while others need to be analyzed and updates made to block them, so Bad Behavior will always require continuous development. Often this development is delayed because I have to pay bills. As you may be aware if you’ve been a very long time user, I lost my job in 2005 and since then I have lived on revenue from blogging and paid web consulting work. Therefore I can only work on Bad Behavior when my finances permit.

Today my finances do not permit me to do any further work on Bad Behavior, mainly due to the economic recession. If you want this work to continue, as I’ll outline in the roadmap below, skip your morning latte tomorrow and send me a financial contribution. The amount is blank, so fill in whatever you feel is appropriate.

And if you see any problems with the roadmap, or feel it could be improved, feel free to comment below.

Core Changes

The most important change won’t be visible right away. A design change to the core is needed to enable Bad Behavior to be tested using more rigorous test methods. The earliest 2.1 releases will contain this change and I will write tests for each of Bad Behavior’s existing checks. Before the 2.2 stable release, and going forward, a test will be written for each feature introduced into Bad Behavior, to help prevent obvious and silly bugs which require almost immediate updates to fix, as happened with 2.0.30 through 2.0.32. The test suite which emerges from this work will ship as a downloadable package, so that you can test Bad Behavior yourself. (Thanks to Tony Bibbs for suggesting this change.)

Bad Behavior’s various whitelists will be moved out of the core and into a separate file template, downloaded separately from Bad Behavior. This will allow you to update Bad Behavior without disturbing your personal whitelists. This is currently an issue for all platforms. On platforms which support an integrated administrative page for changing Bad Behavior’s settings, and can store settings in the host platform’s database, the whitelists will be manageable from within the administrative page.

Platform Connector Changes

On platforms which do not support an integrated administrative page for changing Bad Behavior’s settings, and require settings to be placed in the platform connector’s file, these settings will be placed in a separate file, downloadable separately from the platform connector. This will allow for the incorporation of settings for new features without updating the platform connector, or conversely, updating the platform connector without disturbing your settings. This is currently an issue for the Drupal module, MediaWiki extension, and possibly other platforms.

The integrated administrative page will be introduced for more platforms. I had originally intended to write this myself for MediaWiki, whose platform connector I maintain, but the lack of adequate developer documentation had made it virtually impossible. (The documentation seems to have improved greatly since then, so I’m going to make another attempt at it.) I expect that these are going to be highly specific to the platform and that little code can be shared between them. If you maintain a platform connector and need assistance with implementing this, please contact me.

The integrated administrative page will be enhanced to allow more complex searching through the database records. Currently it is not possible to search the records except by manually crafting a URL. In the future the entire database will be searchable and you will be able to mark records and forward them to me for analysis. Due to privacy concerns, records sent to me are kept on encrypted media at all times, used solely for analysis of how to permit or block similar traffic (as appropriate) and destroyed within 90 days. Personally identifying information, if present, is not used. I have done this since the beginning.

The current list of platform connectors needs to be updated; it’s come to my attention that some are out of date or their maintainers have stopped maintaining them. If you are, or want to be, a maintainer for a platform connector, please contact me.

The code which creates the database in a new Bad Behavior installation is currently in the core; however, it properly belongs in the platform connector, since it can vary by platform. For instance, the Drupal module already uses its own code for this, but the WordPress and MediaWiki connectors share the same code. This code will be moved out of the core and split into separate files to facilitate reuse where possible, give a slight performance gain, and enable other platforms to do their own initialization where needed.

I’ve identified several new situations in which it would be useful for Bad Behavior to call back to the platform connector to have the host platform perform some action or another. As a result, the platform connector API, such as it is, will expand. It will remain backward compatible, however, in case some platform does not or cannot implement the complete API.

The porting documentation needs to be greatly reworked and expanded. It doesn’t say much except to look at the existing code and base your work off of it, which is perhaps fine for some experienced programmers, but not for everyone.

Bad Behavior needs to be localized, that is, translated into languages other than English. This is still an open design issue, since each platform handles localization in a completely different manner and requires files containing localized translations to be installed in different places. The most likely solution at this point will involve “language packs” which you will be able to download separately from the core. In addition, people will be needed to help translate Bad Behavior. I will make a separate post when I’m ready to accept translations.

Spam Prevention

The core design change mentioned above, which will allow for improved testing, will also enable some new features which haven’t been implementable before, such as improved whitelisting of search engines. As you may know, Bad Behavior has been using the http:BL service from Project Honey Pot to detect spammers for some time now (if you enabled the feature). The http:BL service also identifies many different search engines and can be used to whitelist them, preventing such issues as the recent blocking of msnbot when it began using a suspicious user-agent string. This feature will be available for testing early in the 2.1 release cycle. The original methods of identifying major search engines will remain in place and be maintained for those who cannot use http:BL.

Speaking of Project Honey Pot, Bad Behavior will allow you to serve spammers honey pots or QuickLinks provided by the service, so that it can catch even more spammers.

A screener which uses JavaScript and cookies to identify legitimate users has been in Bad Behavior since the initial 2.0 release, but proved difficult to implement, as it required calls into the host platform which weren’t always available or didn’t work as expected. This feature has been disabled for years. I will finally revisit this technique, as I think there’s still some value in this approach.

And of course I will continue to kill spammers as they come across my radar screen.

Other

Bad Behavior’s documentation has always been less thorough than I would like. It will have to be revamped. In addition I will have to keep on top of it by writing documentation for new features as the new features are written, rather than afterward. Documentation will also need to be translated, and I will need your help for that. I will make a separate posting when I am ready to accept translations.

On many platforms, users currently have to download the Bad Behavior core, then the platform connector, and then upload them together on their web site. If not done perfectly, this can result in errors, or a completely broken site. Where possible, I plan to have a build system which, upon each release of the core, combines it with the platform connector for each platform, an optional language pack, as well as files such as the whitelist and settings templates mentioned above, creating a single download. This should make installing and updating the software more convenient and less error-prone for users of affected platforms.

Finally, I made a proposal long ago for Bad Behavior to automatically update itself. This is not appropriate for everyone, of course, but it may be useful for people on platforms which don’t provide update facilities for their plugins/extensions. This is still a post-2.2 change, though I want to do some preliminary work to see if it can be done reliably and what might be necessary to accomplish it.

I’ve also probably forgotten a few things. They’ll be announced when I remember them.

Status

Bad Behavior must continue to keep up with spammers as they attempt to adapt and find new ways to post their automated garbage. Historically, keeping up with the spammers has not been that difficult, as there is only so much the spammers can do while maintaining their high rates of spamming. Today, 100,000 or more spams in a single run is not unusual, and one spammer I’ve blocked can send 1,000,000 in a day. Bad Behavior attempts to drive up the cost of link spamming by blocking as many automated spammy requests as possible, forcing the spammers to resort to MUCH slower manual methods, or ideally, give up and find more honest work.

I believe the proposed changes outlined above will make Bad Behavior a much stronger tool for preventing link spam while at the same time making it more accessible to a wider variety of users and web site platforms.

Only one thing remains, and that is to do the work. As I noted before, Bad Behavior is a user-supported project. If you think this roadmap looks good, and want to accelerate Bad Behavior development, your financial contribution will help ensure that I can devote more time to its development and bring it to fruition much faster. Otherwise, I have to spend my time first on consulting and other work which brings in revenue, and that means it will be much longer before you see these features.

I would estimate that all of the above would take me about six months to complete if it isn’t funded. At the same time I think contributions totaling $500 or more would allow me time to complete the majority of the above within a month. I know that a lot of you are having financial trouble due to the economy; so am I. Even if you are unable to send a contribution, please leave your comments so that I know you support Bad Behavior and wish it to continue.

This is also the time to send in feature requests. If Bad Behavior doesn’t do something you would like it to do, please leave a comment. (And remember that feature requests accompanied by a contribution are more likely to be implemented sooner.) Due to a hard drive crash I’ve lost all email that was sent to me before August of this year, and possibly some more recent email as well. If you have emailed me with a feature request recently, and don’t see it included above, please also leave a comment.

Thank you again for your support, and here’s to a future without spam.

P.S. If anyone knows how to deliver electric shocks over the Internet, please contact me. This could be the ultimate spam-prevention feature.