title: What is the best way to filter spam with JavaScript?
body: <p>I have recently been inspired to write spam filters in JavaScript, Greasemonkey-style, for several websites I use that are prone to spam (especially in comments). When considering my options about how to go about this, I realize I have several options, each with pros/cons. <strong>My goal for this question is to expand on this list I have created, and hopefully determine the best way of client-side spam filtering with JavaScript.</strong> </p>
  
  <p>As for what makes a spam filter the "best", I would say these are the criteria:</p>
  
  <ul>
  <li>Most accurate</li>
  <li>Least vulnerable to attacks</li>
  <li>Fastest</li>
  <li>Most transparent</li>
  </ul>
  
  <p><strong>Also, please note that I am trying to filter content that already exists on websites that aren't mine, using Greasemonkey Userscripts. In other words, I can't prevent spam; I can only filter it.</strong></p>
  
  <p>Here is my attempt, so far, to compile a list of the various methods along with their shortcomings and benefits:</p>
  
  <hr>
  
  <p><strong>Rule-based filters:</strong> </p>
  
  <p><em>What it does:</em> "Grades" a message by assigning a point value to different criteria (i.e. all uppercase, all non-alphanumeric, etc.) Depending on the score, the message is discarded or kept.</p>
  
  <p><em>Benefits:</em> </p>
  
  <ul>
  <li>Easy to implement</li>
  <li>Mostly transparent</li>
  </ul>
  
  <p><em>Shortcomings:</em> </p>
  
  <ul>
  <li>Transparent- it's usually easy to reverse engineer the code to discover the rules, and thereby craft messages which won't be picked up</li>
  <li>Hard to balance point values (false positives)</li>
  <li>Can be slow; multiple rules have to be executed on each message, a lot of times using regular expressions</li>
  <li>In a client-side environment, server interaction or user interaction is required to update the rules</li>
  </ul>
  
  <p><strong>Bayesian filtering:</strong></p>
  
  <p><em>What it does:</em> Analyzes word frequency (or trigram frequency) and compares it against the data it has been <em>trained</em> with.</p>
  
  <p><em>Benefits</em>: </p>
  
  <ul>
  <li>No need to craft rules</li>
  <li>Fast (relatively)</li>
  <li>Tougher to reverse engineer</li>
  </ul>
  
  <p><em>Shortcomings:</em></p>
  
  <ul>
  <li>Requires training to be effective</li>
  <li>Trained data must still be accessible to JavaScript; usually in the form of human-readable JSON, XML, or flat file</li>
  <li>Data set can get pretty large</li>
  <li>Poorly designed filters are easy to confuse with a good helping of common words to lower the <em>spamacity</em> rating</li>
  <li>Words that haven't been seen before can't be accurately classified; sometimes resulting in incorrect classification of entire message</li>
  <li>In a client-side environment, server interaction or user interaction is required to update the rules</li>
  </ul>
  
  <p><strong>Bayesian filtering- server-side:</strong> </p>
  
  <p><em>What it does:</em> Applies Bayesian filtering server side by submitting each message to a remote server for analysis.</p>
  
  <p><em>Benefits:</em></p>
  
  <ul>
  <li>All the benefits of regular Bayesian filtering</li>
  <li>Training data is not revealed to users/reverse engineers</li>
  </ul>
  
  <p><em>Shortcomings:</em></p>
  
  <ul>
  <li>Heavy traffic</li>
  <li>Still vulnerable to uncommon words</li>
  <li>Still vulnerable to adding common words to decrease spamacity</li>
  <li>The service itself may be abused</li>
  <li>To train the classifier, it may be desirable to allow users to submit spam samples for training. Attackers may abuse this service</li>
  </ul>
  
  <p><strong>Blacklisting:</strong></p>
  
  <p><em>What it does:</em> Applies a set of criteria to a message or some attribute of it. If one or more (or a specific number of) criteria match, the message is rejected. A lot like <strong>rule-based filtering</strong>, so see its description for details.</p>
  
  <p><strong>CAPTCHAs, and the like:</strong></p>
  
  <p>Not feasible for this type of application. I am trying to apply these methods to sites that already exist. Greasemonkey will be used to do this; I can't start requiring CAPTCHAs in places that they weren't before someone installed my script.</p>
  
  <hr>
  
  <p>Can anyone help me fill in the blanks? Thank you,</p>