“Clean” pop-up comment permalinks

Popup comments are such transient screens, and as you say they are separate so generating a clean url for such a thing makes little sense – you wouldn’t be able to link to it. Or can you ?

Not sure what you mean by an inability to link to them; in any case, that’s not my concern (I have the individual comment permalinks set as anchors that link to single-page posts, like this).

I guess I’m concerned about leaving myself exposed to the “Spam Comments Appear Immediately” attack. Having the popup ID clearly expressed on the index page seems to leave a vulnerability. Or am I off-base on that?

The popup id has nothing to do with that. Spammers have automatic scripts that run based on the program you’re using. Even without the post ids showing, if they find a wordpress page (i.e. wp-comments-post.php), their little wordpress script will run, and it’ll automatically try to populate your database by accessing the page directly.

Spam Karma and Bad Behavior are good anti-spam tools that, when used together, dramatically reduce the amount of spam (auto or manual) that comes in.

Also, keeping your WP installation up to date helps keep you safer (not totally safe, but better off) from security vulnerabilities.