After extensive testing, and some excellent help from Iain and Kate, I think we've licked the problems under Windows servers. The problem has to do with the way that Movable Type handles the path when processing plugins. MT-Moderate and some other plugins use a new technique known as a plugin envelope to make using the plugin a bit easier. Everything is installed in one location - typically a subdirectory of the plugins directory.
The other day I had a server that no one could access. It wasn't actually being used or anything, but the company has been talking about using a server for a while, so it seemed to make sense to see if the one they had could actually be used. Maybe I'm the only one who thinks that way.
So I needed to get into it, but I had no way to do so. Back in the day, I would have used L0phtCrack, but since L0pht was purchased by At Stake, and then by Symantec, the costs have gone up a bit. A minimum of $450 for this? I don't think so. The idea was to save money. So it's off to the Internet.
I was browsing through my stats just now - something that I really don't do all that often - when I realized just why I don't get much spam. Sure, you can argue that it doesn't stay up long, and it doesn't. But I doubt seriously that that is the culprit. It's been established before that the cost of spam is virtually nil, much less that of spamming any individual blog. You'd think I'd still get some. Yet I don't.
Mostly I think that it's because I move my blogs a decent bit. Not the pages, mind you, but the script parts. For instance, when I started, Movable Type was located in /mt/. This month alone, I show 294 hits on the comment script that was, at one point, located in that folder.
I have another handful of hits on the script at prior location /mt3/ and then again at /mt3.14159/. The first was around for a while - a few months, while the second was only available for a very short period of time. Perhaps that's why the first has 50% more hits on nit. Trackbacks are very similar - I have more than 300 hits on prior locations of the trackback script.
Why do I move MT so much? I don't know. Whenever I install an upgrade, I simply install the upgrade - then I apply all the changes and plugins. Doing so in a different directory makes things so much easier for me. The biggest difficulty right now is that I have to rebuild so much when I change the locations of the scripts, that it takes a while. Perhaps I should come up with an include solution, so I only need to rebuild the included file, containing the script location, each time I move. That would be so much easier.
So if you want to cut way back on spam, get your stuff out of the limelight. If you don't get much now, try changing your script names. That will make it tougher for people to find you in the first place. If it's not in Google, they'll have to stumble across your site. And let's face it - it's so much easier to scrape names out of a Google search than it is to browse manually, you're likely to remain clean just by performing this step.
Naturally, if you're already a target, then you can't do just this step. You need to relocate first. It doesn't have to be much. I just create a new folder for each release - at the time of this writing, my MT install resides in /mt/3.15/. When the next version comes out, be it 3.16 or 3.2 or even version 4, I'll simply create a new directory and move there. At the same time, I'll probably change the script names too.
I don't get much spam to start with, but it never hurts to be on your guard. And MT-Approval and MT-Moderate don't hurt either. If something gets through, at least it very, very rarely displays on the blog. I consider that a victory.
