Ninety-seven ghosts and one human

Tue, 15 Sep 2026 12:15:00 -0600

I have metrics to keep an eye on engagement on PopsicleBoat.

I work hard to keep the comment system clean from spam and bots, a big part of the core ethos of what I’m trying to do there.

Last week I read a number in the metrics that looked bad, or false, or something felt off.

I have a system where posts have a “parked” state. There’s an automated system for moving those parked posts to actual publication, with a few strategies to prevent automated systems. A human has to be involved. Without the friction you usually see, identifying which images have bikes or whatever.

Ok, so I’m checking the numbers over the last week or so. 97 parked posts, only 1 made it to publication.

I guess it’s kind of cool bots have found the site and that my detection system is working.

Still, for the numbers, that’s just noise. Not signal.

In a way, the shape of those numbers was the tell. These weren’t from humans, these were from bots. The parked posts came in at a steady, almost predictable, rate.

Bots crawl the web POSTing into any form they find. PopsicleBoat is many things, one of the main things it is (a comment form) attracts scrapers, bots, etc., so those bots were happily just stuffing it.

I don’t check the metrics every day, but my interest was piqued by seeing 97 parked comments. So I looked more into it.

Because I refuse to add captchas and instead I’m designing the solution to the problem that one (sort of) solves, I added a honeypot. Bots think they’re submitting a form because it shows up to them, but not to human users. Easy peasy. When a submission fills out a field I know is invisible to human readers, I know it’s a bot. Classic honeypot.

The field only a bot can see and think is real.

I have other strategies in place as well, no need to elaborate. Security by obscurity is the weakest, but also a valid first layer strategy position. (What I’m saying is I won’t be documenting my secrets.)

So bots type their garbage, it gets parked, they think they succeeded but I’ve got them flagged. I also have them garbage collected every day.

It thinks it posted! Haha. Sucker.

This results in (so far) 0 junk accounts and 0 garbage comments on anyone’s page. The parked junk is cleared out daily.

The only reason I realized what was happening was because I had metrics set up, know a thing or two about the modern internet, and connected the dots.

I will illuminate a little bit, though. For an unsigned in PopsicleBoat user, it looks like this: A reply on its way in passes through three stages:

Parked (anyone and anything can do this) ->
Continued (a signed-in person carrying their parked reply) ->
Posted (published on the thread, and from there it syndicates back to the blog it belongs to).

For already signed in users, it basically skips the Parked and Continued stages. You’re already verified as a meat popsicle, and not as a silicon popsicle. (see what I did there?)

This keeps junk out and things clean without being a huge PITA for users. No captchas, no tracking, all free.

I don’t know about you, but the internet has felt to me a bit much for a long time because of reasons like ^. I think this is a better solution without taxing the user beyond a bit of setup for your site.

Thoughts welcome below (or any of the ways I’m reachable)

Bots on jvalol

Ninety-seven ghosts and one human