In the never ending battle... BlogX rev 24... Now you can turn off links of any kind (other than the mail link) in comments, and I've also removed the web service interface for adding comments.

Source and Binaries.

Justin takes issue with my methodology for spam protection...

I spent about 90 minutes implementing the spam protection and a few other minor tweaks to blogx (like the ability to disable comments completely from the site.config file).

First, let me explain the goals of my spam protection. My goal was fairly simple, remove the maximum number of spam comments in my blog. I had two approaches in mind, 1) remove commenting from the site, 2) provide some security.

When I went down the security route, I actually figured that even plain text security (just making someone/thing read the text and parse out a word). I doubt anyone is really using a OCR system to post spam comments on my site. Without anything it is just too easy to post. If people start hacking on the site again, i'll just remove comments - no money is at risk here, i'm not going to spend sleepless nights trying to prevent spammers.

As for the process I use, it is a simple uniform gradient behind the text. Any artifacts are from the jpeg compression. The words are stored in a plain text file on the server, and I use System.Security.Cryptography.RandomNumberGenerator to pick the word. The only thing sent to the client is the offset of the word.

Simple threat modeling excercise... Of course, since I have a small dictionary on the server, it would be easy to visit the site often enough and form a complete duplicate of the words from the server. Since the offset is round triped to the client, both in the URL of the image and in the ViewState, these are both susceptible to attack. In addition, the image pattern is simple, as you point out, so OCR against it would be relatively straight forward.

With all of these threats, and basically no mitigations, it is pretty clear that someone can hack around my "security". The intent isn't to provide robust security that I would expect from a bank or anything else (I'm not even running HTTPs, I don't authorize commentors, etc.)... the goal is just to make my site less attractive to spammers.

I've made the text (hopefully) more readable and replaced the random number generation algorthim that I used... should be much better now.

Source and Binaries.

I added some basic comment spam protection (using a "security word" obuscated in an image)... I also added the ability to turn comments off with a simple site.config file change. Hopefully this will stop the spammers...

BlogX 22 Source and Binaries.

Craig asked me in mail, and on his blog, about the move from GDN to a .Text based solution...

When I first started working on BlogX I was just trying to understand blogging. After I made some progress I felt like sharing the source with everyone, and I really wanted to participate in a community development effort. Unfortunately a combination of my interest and a spike of work (uhm, yeah, the PDC took some time <G>) caused me to not make any more progress on BlogX.

I looked around for someone to take over for BlogX and Dare offered to take over. Dare surveyed the land and quickly realized that there were many blogging efforts going around - .Text and dasBlog being two of the major .NET based blogging solutions. Dare's decision, which I supported, was to instead of continuing yet another .NET blogging solution, to "close the doors" so to speak on BlogX.

The source is still freely available, and if anyone wanted to pick it up, they are more than welcome. However, right now I'm recommending people participate in either .Text or dasBlog if they want to contribute.

With massive appologies to the huge number of people that have joined the BlogX workspace, I have made a minor update to BlogX. Specifically, I had to make a patch to my RSS logic to start honoring the if-modified-since header... I was consuming massive bandwidth from Brian and I needed to fix this.

As always, source and binaries are available.

The BlogX GDN workspace now has the most members of any workspace... Paul's post talked about anybody can get a bunch of open source people engaged in a project at least temporarily, but it takes good design to keep them there...

I have always maintained that BlogX was never designed - I hacked it together over a week or so to solve my blog problem... I don't believe that BlogX is elegant or well implemented... I think it is simple? I hope that Dare is able to make sense of the code and do something interesting with the huge number of people that have showed so much interest in the project...

I have been doing a tremendously bad job of managing BlogX since I released rev 20. Given my responsibilities at work leading up to the PDC, and the new house, I don't think I will be a very good steward of the code for the rest of the year.

Happily Dare has agreed to take over. I'll still be somewhat involved, but I'm hoping that Dare can make some progress where I have failed to. We have over 250 people in the GDN workspace, so I'm really hoping that we can make some great progress.

The good news is that I'll have that much more time to make Longhorn great for the PDC!! :)

Simon Jefford is adding support for several standard blogging apis... KeithBa got a server and client setup program added...

Myself, I've been slacking off and not gotten anything done... should be back in a couple weeks and actually start making progress...

I finally gave up on ever understanding the hell of SourceForge... the GDN Workspaces stuff isn't the fastest, but it took less that 20 minutes to setup the project, upload my files, enlist, and build...

BlogX Workspace

The source code is there for the world - enlist, fix, enhance, extend...

As promissed, rev 20 - now with xhtml:body!

Also, I added support for "description" as a different field than "content" through the system. Since we are now going to have a real place to put content and description, then I don't need to keep stuffing the content into the description field in RSS.

So, if you favorite aggregator isn't showing the full text of my blog, send them a mail and get them to support <xhtml:body>!

Features:

• xhtml:body
• description
• "kill application" button on the wait dialog

Binaries and Source

<xhtml:body> support in RSS... thanks to Don and Sam for the proding...

Expect a public rev 20 of BlogX with this feature tomorrow...

There are a ton of features that I need to get to, however I have been working hard to try and get a new HTML viewing and editing codebase up and running... thankfully, that is now done!

Thanks to Nikhil Kothari and Andrew Lin for the great new editing and viewing code. It is a low level wrapper on MSHTML (from Nikhil) - totally awesome code, with XHTML support (from Andrew). Wahoo!

The HTML viewing and editing code is adapted from the ASP.NETWebMatrix codebase.

• WinBlogXControls & WinBlogX changes only (except for version number)
• New HTML Viewing control
• New HTML Editing control

Just for reference, the internal server that I'm hosting blogx is up to over 80 users!

Binaries and Source