So about an hour ago a spambot replaced the contents of my MIKE TYSON'S JUNGLE BEAT blog post with some garbage text and links. This naturally made me freak out, because I was pretty sure that random users couldn't just go around editing other users' blog posts.

After doing some research, I discovered that the reason that the spambot was able to do that was because I had made my blog post into a wiki page, so that I could link to it nicely, I guess. This is the first time that a spambot has edited our wiki.

We get a fair amount of comment spam right now that is caught by the automated spam filter, but that's happening much too late for my tastes. We must have hundreds of spambots who signed up and haven't posted anything (defeated by my email that doesn't contain a login link, perhaps), and whose accounts remain active.

Here's some stuff I'd like to do in the near future:

1. Set up a captcha for the user registration form.
2. Set up Project Honeypot -- I googled the IP address of this particular spammer and discovered that Project Honeypot already knew about him.
3. Regular database backups! I'm ashamed this isn't already happening.
4. Our wiki does not currently have a proper edit history; I have never managed to make it work. Make that work! If spammers start editing our wiki, I don't want to have to resort to the Google cache to fix it.
5. Investigate how difficult an upgrade to the latest version of Drupal 5 would be, so that I can keep up with the latest security updates. If it had been an SQL injection attack, I'd have been more or less helpless to stop it without simply taking the whole site down.