c g isa…

I really do like this place….

John: Personally, I wouldn’t care much about users with js disabled. To start with, I’ll take the bet most of them are in fact bots. And for the very few real users that remain, you can always put a noscript tag in your page to notify them js is required to use the comment form.

Yeah, that is a problem with the plugin, I must admit it… I thought about it, but there are really many things that depend on JavaScript: look at how many sidebars implement it without it… So I decided that I could pay this inconvenience to stop spammers…

Best regards,
diego

Now, this is a good question I was expecting.

There are two main differences:

1. Wp-hashcash doesn’t have any “hidden” value. By hidden I mean a value that is *only* known by the server. This value is essential, and is used in pre- and post-processing. Spammers cannot know this value, and cannot generate correct results unless they execute the JavaScript. In other words, WP-Hashcash gives the spammers all the info they need to produce a fake response.

2. In WP-Morph the JavaScript code *has to* be executed. WP-Hashcash claims that in his case, the JavaScript code that calculates the md5 *must* be executed by the client. But this is false: any spammer with an “md5″ function in his pocket can do the calculus without executing any JavaScript in the page, then generating the fake response form. In fact, reading the comments to the WP-Hashcash blog entry, I see that any stupid pimprick has taken the time to study the code and release this code that fools the plugin. In WP-Morph, the code is generated ad-hoc for the page, it must be executed to obtain the result (because the code changes every time), and the result must be returned.

Hope this clarifies the differences.

Best reards,
diego.