spam

I think I’m going to take a couple of days off again…

Dave Farquhar General , , ,

There’s an old Oasis lyric that I’ve hated for most of the past four years, mostly because of the memories it conjurs up, and now it really bugs me that it seems appropriate: “‘Cos I need more time just to make things right.”
The other fragments of the song that have survived my efforts to blot them out also seem fitting. “Don’t go away… Say that you’ll stay… Forever and a day…”

So, to ward off those perpetual rumors/fears/whatever that I’m hanging things up, I’ll just say this. I’ve “hung it up for good” before. The longest it ever lasted was 6 months, and that time was due to serious injury. Right around that time, someone insinuated that I should hang it up. We haven’t spoken since that time, and I’m better for it and I don’t give a rip about how he feels.

I fully expect this break to last through Saturday, then run out of gas sometime late Sunday afternoon.

I’ve overextended myself the past month or so. I’m tired. My Web server is running fabulously (it never hiccups, so long as Union Electric keeps the power flowing) but I haven’t come up with an effective way to upload content to it or add new features. I can live with that.

Meanwhile, my mail server’s a royal piece of… Nah. That doesn’t go far enough. My mail server is a Backstreet Boys Fan. It runs like a 16 MHz 386, and I can’t tell if it’s a configuration problem or if it’s just overwhelmed with spam. No matter. I’m overwhelmed with spam. On a good day I get 7. On a bad day I get 60+. I got 38 copies of the same spam message from some stupid online casino Tuesday. I absolutely have to get some spam filters in place, and some priority filters in place.

So the mail needs to be archived, a bare-essentials mail server built (Linux 2.4.8 kernel, sendmail, IMAP, fetchmail, procmail, and whatever else those five things force me to install so they can run, all built from the newest sources of course, using the most aggressive compiler settings known to man), then the archives restored, then spam filters put in place and run. Then I will have regained my ability to communicate and will be able to do something about my guilt over having week-old e-mail sitting around unanswered because it’s buried in worthless spam.

I need to tend to my servers. I need to rebuild a couple of workstations. I really ought to try to salvage the Baseball Mogul season that’s sitting on the corrupted hard drive in one of those workstations… (Though I hesitate to call anything that runs Microsoft Wintendo 2000 a “workstation…”)

Meanwhile, a couple of other projects need to get done, and I just realized today that I haven’t talked to Gatermann in more than a week and for all that group of friends knows, I’ve run off to the ends of the Earth only to find an Internet cafe, so I continued posting. I need to do something about that too.

I’ll be back. I have the same love/hate relationship with writing that most writers have. It’s like breathing after running a couple of miles on a brisk day in early March. I always hated breathing after that, because it hurt so badly. But no matter how much it hurt, I couldn’t stop.

Spammers must die… And it’s possible their enterprises will. With your help.

Dave Farquhar Spam , ,

Hi. My name is Dave Rhodes.
Sorry, that’s not funny. Remember the good old days, when the closest thing we got to spam was the occasional Dave Rhodes chain letter? (I found a joke about him that I found amusing.)

But something great happened today. Besides finding that joke, I mean. I came up with a foolproof way to make buckets and buckets of money through UNSOCLICITED COMMERCIAL E-MAIL. Now, remember, UCE isn’t spam. Spam’s bad.

Here’s how it works. You don’t have to buy anything from me. I’m not going to sell you a CD-ROM full of three-year-old e-mail addresses harvested by some scriptkiddie’s code. You don’t need it. Making money from UCE doesn’t even require you to send out a single piece of e-mail! Not a one!

Believe it or not, your customers will come to you! About the only thing you have to do to build up your list of victims, I mean clients, is to get an e-mail address, then sit back and wait!

Best of all, this method is safe and completely legal! It hasn’t been approved by the Postmaster General. It does, however, have the blessings of the Federal Trade Commission and the legislatures of 17 U.S. states! (Dave Rhodes ain’t got nothin’ on me!)

Did you know that 17 states have laws regarding unsolicited commercial e-mail? Yes, those 17 states have very strict regulations and requirements. Certain types of spam are illegal in those states. So why don’t spam laws work? Because nobody uses them! And in the end, the loser is you!

You see, when a spammer violates those regulations, you can sue them! One attorney in Washington state sues spammers in small claims court and so far has collected more than $13,000! One Missouri resident, bombarded by unsolicited e-mail from a free webhosting service after he cancelled his account with them, sued in small claims court and received $2,525! That’s $500 per unsolicited message that didn’t meet with Missouri law, plus the spammer even had to pay his court costs of $25!

Just think… That unsolicited e-mail that annoys you could be worth thousands! But in order to cash in, you have to be, you know, in the know (wink wink), if you know what I mean. What’s that information worth to you? A hundred bucks? Two-fifty?

Who cares! Go to www.suespammers.org and check to see what your state’s laws on spam are. It’s free. You don’t even have to tell ’em I sent you. It won’t do any good to tell ’em I sent you anyway, because they don’t know me from Adam.

—
Man. I ought to be in infomercials. I sure know how to use italics and exclamation points. Though most of these creeps think quotation marks are for emphasis. That’s one of my biggest pet peeves.

Someone else e-mailed me at work and sent me a link to a link to a link that led me to this Brian Livingston column, which eventually led me to www.suespammers.org, where I learned that 17 states have anti-spam laws on the books. I looked into the laws, which are printed on the site. Surprisingly, Missouri is one of the more enlightened states. If a spammer sends e-mail to Missouri and fails to include an opt-out e-mail address or 800 number, you can sue the spammer for 500 smackers.

Most spammers include an opt-out Web page. That complies with the spirit of Missouri law, but not the letter of it. Maybe someone pointed out to lawmakers that it’s harder to implement an e-mail opt-out than a Web page opt-out. Who knows. The law is a stroke of genius, whether by design or accident. I don’t know if that’ll hold up in court, because that really is a technicality. But a lot of spam doesn’t provide any opt-out at all, which means they have no defense whatsoever.

This got me thinking. I get tons of spam. I might have $3,000 worth of spam in my inbox just from this week. I probably ought to check. I could make a decent living suing spammers until the laws change.

And this got me thinking some more. Who cares if 55 people buy stuff when they send out 100,000 messages? Fancy this possibility: What if every time a spammer sent out 100,000 messages, 55 of the recipients sued? The number of sales is irrelevant when you’re faced with that many lawsuits. And let’s face it. Most spammers are idiots trying to get rich quick working out of a spare bedroom. They don’t have a lot of resources. I know the type of individual who tries this crap because I’m related to one. (Fortunately for the world, there’s probably not enough left in his head for him to be able to operate a computer these days. But I’m pretty sure if he had my phone number he’d be calling me, asking me to hook him up. Don’t worry. If he ever gets my phone number, I’m changing it the next day.) This type of person is not well-equipped to handle a few dozen separate lawsuits, especially a few dozen lawsuits outside his home state. And he’s dead meat if multiple suits in different states happen to end up landing on the same court date, since generally if you’re not present you lose by default.

It makes no sense to fight a Missouri lawsuit. Unless you live in the same county as the plaintiff, you’ll probably spend more than $500 to defend yourself, and judges aren’t very sympathetic to the plight of a spammer because so many of them are con artists anyway. It’s much cheaper to just settle. The nature of the spammer is to just ignore it, which of course becomes even more costly. Getting on the wrong side of a judge is a lot more dangerous than getting on the wrong side of an ISP.

So, here’s what you and I need to start doing to really make a difference. Spam filters mostly work, yes, but why should we bother with that when we can sue the lowlives out of business and pick up a little extra cash? And no, my libertarian tendencies are against a federal anti-spam law, because it’s much harder to comply with 17 states’ varying laws than it is with one Federal law, which would probably be watered down anyway. And if more of the remaining 33 put laws on the books, it’ll be even tougher to comply. That would be a very good thing. Wouldn’t it be absolutely fantabulous if some state required a toll-free opt-out number? That would significantly raise the cost of doing business…

The Missouri law is good in that someone can make a lot of money by suing people who don’t comply, but the people who do comply can simply disregard the opt-out stuff. I’ve seen spammers use 800 opt-out numbers. I’ve even called. It’s funny how they never pick up the phone. Missouri laws will drive the less-crafty spammers out of business if enough people use them, but it’s the Washington laws that’ll really hurt. They’re stricter still. In Washington, the state holds the opt-out list, and if you spam an account on that opt-out list, you’re lawsuit bait. Period. And apparently, a printout of the e-mail is sufficient evidence. Sounds like some influential guy in Washington really doesn’t like spam.

The difficult part is tracking down the spammer so you can sue them. There’s a nice primer on decoding mail headers here and some more information here.

I know. It’s my journalistic responsibility to go nail one of these creeps and step you through the process. (And get 500 bucks to boot.) Maybe this weekend I’ll start walking down that road. Tracking down a physical address from a mail header so I can slap a guy with a lawsuit in St. Louis County ought to be interesting. But we journalists have ways of tracking down people who don’t want to be tracked down.

And then there’s this. Go here to read about a guy who set up a Paypal account, sent threatening notes to 15 spammers, and netted 300 bucks in 10 minutes. And his page makes it sound like you can go to a state with tougher spam laws and sue them there if you wish. Strange. You can sue somewhere other than in your hometown? Looks like I need the services of an attorney.

There’s a certain poetic justice to the idea that you can make more money off a spammer’s mass e-mailing than the spammer makes, isn’t there? I think we can fight and win this war.

Odds and ends to start the week

Dave Farquhar General , , , ,

Let’s talk about this site. So far, the forums are pretty much a flop. There’s a little activity over there, but not much, and the forums didn’t cut down on the amount of mail I receive by much. I’m not going to take them down because I like them, and a few other people like them, but since they’re not solving the problem they were designed to solve, I have to look at other methods.
So I’m going to put mail on a separate page. I’m using MHonArc to generate the pages. Mail messages end up on their own pages, which is a disadvantage to the traditional Daynotes method of handling mail, but they’re threaded, which is a big advantage. Discussions can continue indefinitely, you can follow them easily, and if the subject matter isn’t something that interests you, if you don’t click the link it won’t bother you. And I don’t spend long amounts of time reformatting mail–sometimes it takes longer to reformat mail than it does to write the day’s content–which is a huge advantage that I think outweighs not having all the mail on a single page. I used to solve that problem by forwarding all my mail to my sister for her to format and post, but she has less free time than I have these days.

I haven’t figured out how I’ll handle archiving just yet, but I know that’s a problem many have faced and many have conquered. (MHonArc’s been around since 1994.) I’m just happy to have it live and looking good.

One option in MHonArc totally mangles the e-mail addresses in headers, but not in message replies. I wised up to this and started nuking the addresses there manually. Some people want the privacy; nobody wants spam, so I figure this is the best way to handle it. I know spambots are harvesting addresses from this site so I don’t want to give them another bonanza.

Please continue using the discussion facilities here though. If you’re posting a response to a day’s entry, it makes a whole lot more sense to have them here than over in Mail.

My Royals make a smart move… And a dumb one! Smart move: My Royals re-acquired the catcher they never should have traded away. Brent Mayne was never going to be the next Johnny Bench; he looked more like he’d be the next John Wathan. But seeing as the Royals haven’t had a better catcher than John Wathan for the past, oh, six years since they gave Mayne away to the Mets… Mayne’s .251 average in 1995 didn’t tear up the league, but he handled pitchers decently, didn’t ground into a lot of double plays, in an emergency he could play a couple of different positions, and he could even steal a base. And he played cheap. That’s hard to find in a catcher. And in the years since the Royals dealt him away, he learned how to hit better.

He was batting .331 in hitter-friendly Coors Park when the Royals re-acquired him. I doubt he hits better than .270 in Royals Stadium, but when your catching platoon is the legendary A.J. Hinch, who’s batting about a hundred points below that, and future Hall of Famer Hector Ortiz, who’s batting about 50 points below that, Mayne looks awfully good.

Dumb move: To get Mayne, the Royals traded away Mac Suzuki. Last year, Suzuki was the Royals’ best pitcher. This year he’s struggled, but when you have no job security and no niche, it’s hard to do your best. It seems Tony Muser will banish his starters to the bullpen if he doesn’t like the way they tied their shoes that morning. Sometimes young pitchers have problems with that.

And not only that, Suzuki was a revenue pot. Suzuki was born in Japan. All of Suzuki’s starts were televised in Japan, because the Japanese are crazy about Japanese players playing in the States. (It was small-time compared to Mariners mania, who sport outfielder Ichiro Suzuki and closer Kachiro Sasaki, both bona-fide superstars, but when you’re the small-budget Kansas City Royals, you take what you can get.) With Suzuki on the mound, the Royals got television royalties in Japan. In all likelihood, more people watched those games in Japan than in Kansas City. Suzuki in all likelihood brought in more money than the Royals had to pay him, due to television and merchandising revenue, and the Royals are constantly moaning about how they have no money.

The Japanese couldn’t care less about Brent Mayne. Or any other player on the Royals’ roster, for that matter.

So now my Royals have a decent catcher, but at the expense of a pitcher who’s about 9 years younger and has a tremendous upside. But no one ever said Royals management had any common sense.

E-scape from the Hotel California…

Dave Farquhar General , , , ,

Escaping Microsoft’s Hotel California. For lack of any other available alternative, I started using Outlook Express for mail about 18 months ago. It’s a decent mail client, does most of what I want–I don’t want much–and doesn’t do too terribly many things I don’t want it to. But it’s Microsoft. It runs on Windows. Its file formats are proprietary. It forces me to read my mail with the same workstation all the time. Migration makes me leave the mail behind. Most of it I want to leave behind, but do I want to sort it? NO! OK then. What to do?
Make an IMAP-enabled mail server out of a deprecated old PC and move all that mail over to it, that’s what. I tried to do this with TurboLinux but none of my mail clients wanted to talk to it. Since all of the books I have talk about Red Hat, I went with it, and it worked.

Here’s what I did. Install basic Red Hat. Include sendmail, procmail, fetchmail, imap. I pulled out all the XFree86 stuff. GUIs are for workstations. Command lines are for servers (and for workstations where you expect to get any work done quickly). Actually, I also pulled out just about everything else it would allow. A secure installation is a minimalist installation. After installation, edit /etc/inetd.conf. Uncomment imap line, save and exit. (I like pico, but you can do it with vi if that’s all you’ve got–find the line, delete the comment character, then save by hitting ZZ.) Bounce inetd with /etc/rc.d/rc3.d/inet stop ; /etc/rc.d/rc3.d/inet start. Create a user account with adduser [name] ; passwd [password].

Connect to your new IMAP server. For now, just use your ISP’s existing mail server for outgoing mail; use your IMAP server for incoming. Your username and password are the name/password you just created. After a brief delay, you should see your empty inbox, and you can start dragging stuff to it.

It went great for me. I created a new IMAP folder, opened one of OE’s folders, dragged all the contents over to the IMAP folder, and bingo! They moved. Read status and date were preserved too. (I’ve seen IMAP servers that wouldn’t do that.) I switched to another PC that had OE loaded and connected to my new mail server via IMAP and read some messages. Fantabulous.

Theoretically, I can go to my DSL router and forward port 143 to my mail server and read my mail from the outside.

Now, if you want to actually use your mail server to send mail, that gets trickier–you’ve gotta configure sendmail for that. The out-of-box setup is too secure to just use. Open /etc/mail/access and add your LAN to it, like so:

172.16.5 RELAY

Of greater interest is the fetchmail/procmail combo. You can use fetchmail to automatically go grab mail from the 47 mail accounts you have, then use procmail to sort it and filter out some spam.

To configure fetchmail, create the file /root/.fetchmailrc and chmod it to 0600. Here’s a very basic configuration:

#.fetchmailrc
poll mailserver.myisp.com
with protocol pop3
username myname password mypassword is my_name_on_my_linux_box

And finally, what’s the point of running your own mail server if you don’t spam filter it? There are lots of ways to go about it. I’m experimenting with this method. It uses procmail, which is called by sendmail, which is called by fetchmail. See how all this works?

If you want to get really smooth, you can even block mail before you download it with a program called Mailfilter. You probably don’t want to get as fancy with Mailfilter as people do with procmail, but you can use Mailfilter to search for certain key words or phrases like (checking my spam folder) viagra, mortgage, “fire your boss,” “lose weight” and delete them before you waste time and bandwidth downloading them. I’ve read estimates that spam traffic costs ISPs an average of $3 per month per user. Mailfilter won’t save your ISP very much, since the mail’s already been routed through its network and is just on its very last leg of the trip, but it’ll save them a little, and it’ll save you some bandwidth and time, so it’s probably worth it.

So if you’re looking to leave Outlook and/or Outlook Express all behind, or at least give yourself the option to use a different client, here’s the way out. It’s not too terribly difficult. And you gain an awful lot in the process: mail in a standardized, open format; redundancy; ease and versatility of backup (just schedule a cron job that tars it up and does stuff with it); the ability to very, very quickly search all of your mail with the Unix grep command (just log in, type grep -r [search string] * | more, and find what you’re looking for instantly) and far, far better mail filtering options.

And it’s infinitely cheaper (and more secure) than Exchange.

One way to defeat spammers

Dave Farquhar General , , , , ,

Ever since Brightmail closed up their free filtering service, I’ve been thinking a lot more about spam because I’ve been getting a lot more. I know where these losers are getting my e-mail address. It’s right here on my Web page. But I need to post that so people can contact me. Fortunately, I found a trick. Look at this:
dfarq@swbell.net

That’s just an e-mail link, right? It works just like any other, right? Well, here’s the HTML code for that:

mailto:dfarq@swbell.net

See what I did? I obscured the @ sign with an ASCII code (64), along with the dot (46) and a couple of other characters like the colon. Most automated e-mail address harvesters don’t decode the HTML, so their search routines, which look for things like @ signs and dot-somethings will blow right past that.

So if you run a site, obscure your e-mail address. If you don’t remember your ASCII codes, hopefully you’ve still got QBasic on one of your machines. In QBasic, the command PRINT ASC(“A”) will give you the ASCII code for the letter A. Substitute any letter you like. Or you can remember that A is 65 and lowercase a is 97. A is 65, B is 66, and so on.

When a Web site asks you for an e-mail address, you can see if it’ll let you obscure parts of it. Unfortunately, my forums flag illegal characters, but I may be able to modify that. Some Web sites aren’t that smart.

Obviously this trick won’t work in e-mail, unless you always send your mail in HTML format, which I (along with about half the world) really wish you wouldn’t–it’s annoying. And even if you obscure the mail you send, if I copy and paste your mail to my site, it’ll go up there unobscured. So this advice is mostly for webmasters.

Anyway… On to other things.

We’ve moved, if you haven’t noticed. These pages should be at least a little bit faster. The forums will be several times faster. And the forums are goofy. I haven’t figured out exactly why, but posts are missing and user files are acting up. If you’re having problems (Steve DeLassus just told me he can’t post because it tells him his .dat file can’t be accessed), go ahead and re-register. If you want your post count raised to its previous level, just let me know. I can change that. (Hmm, I wonder if Gatermann would notice if I set his post count to a negative number…?) I’d have preferred to move everything intact, of course.

Anyway. Go play in the forums. See what breaks. If I don’t know it’s broke, I sure can’t fix it. (I may not be able to if I do know, but hey, I can give it my best shot.)

Update: It’s 5:45 in the p.m., and you’re watching… Wait. That’s something else. The forums seem to be working properly now. Lack of uniformity between Linux distributions bites me again… It wasn’t the location of the files YaBB was objecting to, nor was it permissions. It was ownership. Under Mandrake, Apache runs as a user named “apache” and thus files created by CGI scripts like YaBB are owned by “apache.” Under TurboLinux, Apache runs as user “nobody,” and thus files created by CGIs are owned by “nobody.” And when you just tar up your Web site and move it to a new box like I did, those files remain owned by their old owners. Since Linux assumes you know what you’re doing, it happily handed those files over to a non-existant user. So when YaBB came knocking, Unix security kicked in and said, “Hey, nobody, you don’t own these files,” hence those error 103s everyone was getting.

SPAM from Macromedia regarding Flash; Neatgear NICs; Crash course

Dave Farquhar General , , , , , , , , , , , ,

MAILBAG:
From: “bsprowl”
Subject: Spam ?? from Macromedia regarding Flash

I keep getting offers to down load Macromedia’s Flash. These aren’t e-mail type spam; a window pops up and asks if you want to download it.

I have find it very annoying to get these regularly. I have searched on it and find it will cost $399.00 plus tax and shipping for this web authoring tool after the trail period runs out.

Well duh, that’s expensive and I don’t want to write using it; I use Arachnophia (sp?) which is freeware, saving over $400 for the small bit of web development that I do.

There are also some security issues that I don’t want to deal with (although how a glorified text editor can cause security problems seems insane, the FAQs lead me to believe that it can happen.)

But why do I keep getting offers to download it from so many sites. The latest is weather.com, who you would think would not have ads of this type. And the ad pops up several times as I open the radar map and every time I refresh the map it pops up two or three more times.

I have tried to see if this spam is somehow tied to my computer and have used some of Steve Gibson’s tools ( grc.com ) and updated my virus definitions, etc., to eliminate or reduce it if it is hidden or my system. I found nothing.

Any suggestions?

Bob
~~~~~
I know exactly what’s going on. (My site isn’t bugging you about that, is it? If it is, Vinny and Guido will be knocking on a couple of people’s doors because off the top of my head I can’t think of anything I hate more than Flash and my site’s not *supposed* to be using it….) There’s nothing wrong with your computer. You’re getting that question because so many sites use Flash; and most sites, if they detect you don’t have the free Flash plug-in, offer to let you download it. You’d be downloading the free unlimited-use plug-in rather than some trial version of the $399 package.

But Flash animations are annoying (and mostly used by really blinky and obnoxious ads) so I don’t like installing it. I also don’t like the stupid dialog boxes (or sites that install it without asking permission, as some do). When a site offers to install Flash, I add it to the Restricted Sites zone (Tools, Internet Options, Security, then click Restricted Sites, then click Sites, then add, say, www.weather.com to the list). That shuts ’em up, unless they also use ActiveX, in which case IE will pop up a dialog box saying the page may not render properly. But at least they’ll quit bugging you about Flash.
~~~~~~~~~~
From: “Bob”
Subject: Re[2]: Spam ?? from Macromedia regarding Flash

Hello Dave,

Oh. Now I feel stupid for bothering you.

I never noticed Flash or Macromedia before this. I don’t really want to install it but I would like the weather maps to update automatically and also to show the past several hours.

I guess I’ll do a backup to CDW and then install it. I don’t have a lot on my system, the C: drive only has about 590 MB so it will fit on a single CD. Then if it’s a problem I can just go back to the original system.

I really am wasting that drive but then none of mine are full. I don’t download music, that’s why I have my stereo; I don’t even have a speaker plugged into my computer.

I don’t play DVDs; that’s what the VCR is for (although I haven’t used it more than once since I brought it; I don’t even know were the nearest video rental place is located.)

A year or two ago I tried to install the latest release of the Asteroids game which I though might be fun but after downloading half a dozen files from several sites (I need something called Direct X) it won’t run and neither would anything else. I tried it on several of my systems from an old 486 with DOS 6 and Window 3.11 to a system with a PII 450 and Windows 2K. I’ve never gotten a game more complex that Mahjongg to run on anything besides my old Atari, so it must be me.

I spend a lot of time reading and I like paperbacks so I don’t download books either. I do have a database of all of the books I’ve read in the last five plus years. And that is linked to my Palm so I no longer buy a book I have already read.

I find your sight to be most useful concerning computer technology and read it everyday. While most of the other daynoter’s are interesting, they are not nearly as useful. I really don’t care what they ate, etc.

Thanks again,

Bob
~~~~~
No problem, I’m sure you aren’t the first to have that question, and I’m sure others are asking, “How do I keep this #&%$ website from telling me to download Flash?” If not today, someday someone will want the answer to that question.

Most recent games do require DirectX, which you can download from here. If the DirectX version is too old, games will complain. The safest way to get a game running, if you’re willing to invest the time, is to build up a system, install Windows clean, then install the current version of DirectX, then install the game. That may be more trouble than you’re willing to go to.

I chuckled as I read the rest of your mail. About two years ago, a box of stuff showed up in my boss’s cube. Nobody knows where it came from. There was some ancient computer stuff, and there was some REALLY ancient computer stuff. One of them was a CompuServe manual, and I could tell from the logo and the hairstyles and tie widths that this thing was from 1984 at the very latest. I flipped through it and chuckled at the words that suggested 1200 baud was something new, and when my boss walked in, I held it up and said, “Now this is a relic from a time when computers were computers, and not washing machines and stereos and VCRs and TVs and fax machines and toasters.”

“You sound bitter.”

“No, just practical.”

I remember my Amiga’s simple elegance. Yes, it invented multimedia, but it knew what it was, and that was a computer, and it did a good job of being one. And I miss that.

And thanks for your compliments of the site. I try to be useful, and entertaining, and compelling. I don’t always succeed, but enough people come back that I guess I succeed often enough. I know Pournelle’s a better writer than I am, and both he and Thompson have a much deeper depth of knowledge than I do (they’ve also had more time to accumulate it). So I do the best I can, and try to make it as easy as possible here for people to find the stuff they do like.

Thanks for writing.
~~~~~~~~~~
From: “Steve DeLassus”
Subject: Neatgear NICs

OK, what’s the difference betwen a Netgear FA310 and an FA311? At the price mwave is hawking them, I am ready to pick up 3…
~~~~~
The FA310 uses the classic DEC Tulip chipset near and dear to all Linux
distros’ hearts. The FA311 uses a NatSemi chipset that only very recent
distros know what to do with. The FA311 should be fine with Windows boxes,
and it’s supposed to be fine with Mandrake 8.
~~~~~~~~~~
From: “Gordon Pullar”
Subject: Re Crash Course

Hi, I have just read your article in this months “Computer shopper” I am having trouble re-formatting my hard drive (which previously had WIN98SE on it and worked well!) I used FDISK( Got from WIN98 then WIN98SE.) to create a Primary DOS partition,using the whole disk,6.4 Gig. After that I reformated it, it now freezes at writing the FAT table,that’s if I get that far,4 times out of 5 using a boot disk,(I have tried several from differnet PC’s) It gets as far as “verifying pool data” and then freezes.I have checked the HDD drive out with Seagates own diagnostic software and all is OK.(Funny it always boots OK with the seagate software “Seatools”) Changed the IDE cable to the hard drive.I have flashed the BIOS with the latest version.

Is there anything else I could be missing??

Giga-byte GA 5AX motherboard
AMD K6 2 500 Mhz CPU
256 Mb pc100 Ram
Seagate 6.4 Gig ST36451A
HDD Generic video card

Regards

Gordon Pullar
~~~~~
First thing I’d do would be to try to get it to boot off a floppy, then type FDISK /MBR. Both of the problems you’re describing sound like a corrupted MBR, and I don’t think partitioning the drive will zero that out for you. If that doesn’t work, try zeroing out the entire MBR with the MBRwork utility (www.terabyteunlimited.com).

Failing that, I’d try using SeaTools to either low-level format or zero out the drive. Usually after doing that, a finicky drive will work just fine.

No, this is still the old server.

Dave Farquhar General , ,

The new server works, but I got sidetracked last night. I had to take care of a weird work problem, and I ran out to a bookstore where the girls who work there seem to have this competition to see who can be the nicest, and then I came back home and had a long phone conversation with an old friend I hadn’t talked to in a couple of years. Between all that and trying to make some sense of Steve Gibson’s latest discoveries and trying to figure out what he wants and whether I agree with him, my server just kept chugging along.
I need to make my homebrew spam filter too. I’m thinking I’ll press a 486 into that duty, at least initially. I’m out of good PCs to experiment on. Once I get it working, if it’s slow, I’ll get some parts and build something better to block the onslaught of spam.

Oh, speaking of spam, for those of you who have Web pages… If you obscure certain characters in your e-mail address–sub in the raw ASCII code for the at sign and the period and one or two letters–most spam bots can’t harvest it. I need to do that for my pages. I’ve also found some cool-sounding traps for spam bots, including one that tries to dynamically figure out the spambot’s IP address, then feeds it accounts like abuse@owner.com and postmaster@owner.com. If they work, I’ll most certainly toss them your way.

We can’t give hackers anything else to work with

Dave Farquhar General , , , , , , , , , , , ,

Thanks to David Huff for pointing this link out to me (the good Dr. Keyboard also passed it along). Steve Gibson was hacked last month, and he wasn’t very happy about it. So he set out to learn everything he could about l337 h4x0rs (elite hacker wannabes–script kiddies). What he found out bothers me a lot.
Kids these days. Let me tell you…

In my day, 13-year-old truants (those who had computers and modems) used their modems to dial 800 numbers over and over again long into the night, looking for internal-use-only numbers. Armed with a list, they then dialed every possible keycode combination looking for PINs. Then they’d use that information to call long-distance on the telco’s dime. They’d call BBSs, where they’d swap the previous night’s findings for more codez, cardz (credit card numbers), warez (pirated software), or porn.

I never did those things but I knew a lot of people who did. They’d drop off the face of the earth on a moment’s notice, and rumors would go around about FBI busts, computer equipment being confiscated, kids being hauled off to juvenile detention center… And some of them never came back. Some of them cleaned up. Others, who knows? I heard a rumor about one of them running away to Las Vegas after he got out. And some just got hold of their old contacts and went right back to business. One of my friends cleaned up–the huge phone bill he got was enough of a reality check that he stopped. Whether it was a moral reason or just fear of getting caught again, I don’t know. I knew another who got busted repeatedly, and he’d call me up and brag about how his line was tapped, throwing in the occasional snide remark to whoever else might have been listening. I remember our last conversation. He sent me some code (all of the guys I knew were at least semi-competent 6502 assembly language programmers) and we talked music. I’d been fascinated by that subculture, though I never did anything myself–I just talked to these guys (partly out of fear of getting caught, partly because I did want to have some semblence of a life, partly because I didn’t want to kiss up to a bunch of losers until I’d managed to prove I was elite enough), but at that point I was 16, I’d published once, and I realized as the conversation ended that my fascination with it was ending also. It was 1991. The scene was dying. No, it was dead and pathetic. These “elites” had become the butt of jokes–they were risking arrest so they could call Finland for free and pirate Grover’s Magic Numbers, for Pete’s sake! I guess I was growing up. And I never talked to him again. (I don’t even remember this guy’s real first name anymore–only his handle.)

I guess if I’m going to be totally honest, the only thing that’s really changed are the stakes. I want to say my generation wasn’t that bad… But I don’t know.

Essentially, some guy going by “Wicked” had zombies running on 474 Windows PCs. Some of “Wicked’s” buddies took issue with Gibson talking about script kiddies–they thought he was talking about them–so they told “Wicked” to take him down. And he did. And he bragged about it.


"we will just keep comin at you, u cant stop us 'script kiddies' because we are
better than you, plain and simple."

Now, when someone annoys me, I find out what I can about the guy. At 26, I do it to try to get some understanding. At 13 I didn’t necessarily have that motivation, but I did at least have some basic respect. And anyone claiming to be better than Steve Gibson… Gimme a break! That’s like walking up to Michael Jordan and saying you’re better on the basketball court, or walking up to Mark McGwire and saying you can hit a baseball further, or walking up to Colin Powell and telling him you can beat him in a war. And anyone who’s ever written a line of assembly language code and read any of Steve Gibson’s stuff knows it. And it’s not like the guy’s exactly living in obscurity.

Well, Gibson was diplomatic with this punk. And his reasoning and his respect softened him. He called the attacks off. Then they suddenly started again, and Gibson got this message:


is there another way i can reach you that is secure, (i just ddosed you, i aint stupid, im betting first chance ud tracert me and call fbi) you seem like an interesting person to talk to

Say what? You want to talk to someone, so you blow away every other line of communication and ask if you can talk? Now I can just picture this punk once he gets up the nerve to go talk to a girl. He knocks on the door, and the first words out of his mouth are, “I just tesla coiled your phone line so you couldn’t call the cops, but…” Then he’d toss some Kmart pickup line every girl’s heard a million times her way, and hopefully she’d smack him and run to the neighbors’ and call the cops.

For some reason people get hacked off when you do something malicious to them.

Well, Gibson reverse-engineered some Windows zombies and followed them into a l33t IRC channel where he had another interesting conversation. I won’t spoil the rest of it.

Now, I admit when I was 13, I was a mess. I was insecure, and I had trouble adjusting. My voice was cracking, my skin was oily, and I was clumsy and gawky. And I didn’t like anyone I knew when I was 13, because I was the class punching bag. Part of it was probably because I was an outsider. This was a small town, and I wasn’t born there, which was a strike against me. If you got all your schooling there you were still OK. I came in the third grade, so strike two. And I didn’t want to be a hick, so strike three. I liked computers, and in 1987 that was anything but cool, especially in a small town. And everyone thought I was gay, because I didn’t hit on girls and I didn’t have a huge porn collection–and there aren’t many worse things to be in southern Missouri, because it’s still a really bigoted place (and since girls made me stammer, it’s not like I could have proven I was straight anyway). And I had goals in life besides getting the two or three prettiest girls in the class in bed. (Yes, this was 7th grade.) So I guess I was oh-for-two with two big strikeouts. And since I was five feet tall and about 90 pounds, if that (I’m 5’9″, 140 now, and I was scrawnier then than I am now) I couldn’t exactly defend myself either. So I was an easy target with nothing to like about me.

I guess “Wicked” sees Steve Gibson as a five-foot, 90-pound outsider with a really big mouth, so he’s gonna go pick on him. Then he’s gonna go hit on the 13-year-old girl who looks 18, and he thinks taking down grc.com is going to make her swoon and tell him to take her to bed and lose her forever. But since she has a life, she doesn’t give a rat’s ass about whether grc.com is up or down, so hopefully she’ll smack him but I doubt it.

Yeah, I want to say the solution is to make things like they were in 1987 but bullies are bullies, whether it’s 2001 or 1987 or 1967. AD or BC, for that matter.

I want to say that accountability to a higher being will solve everything and make kids behave, but I know it won’t. That grade-school experience I just described to you, with 13-year-olds making South Park look tame and trying to get in girls’ pants? You know where that happened? A Lutheran grade school. Introducing the kids to God won’t fix it. Establishing a theocracy won’t fix it. In college I wrote a half-serious editorial, after a pair of 6-year-olds in Chicago murdered a four-year-old by dropping him out of a 20th-story window after he refused to steal candy for them, where I advocated the death penalty for all ages–maybe then parents would keep an eye on their kids, I reasoned. But I know that won’t fix anything either.

Steve Gibson doesn’t offer any answers. He’s not a social engineer. He’s a programmer–probably the best and most socially responsible programmer alive right now. And what Gibson wants is for Microsoft to cripple the TCP/IP code in Windows XP, so the zombies these script kiddies use don’t gain the ability to spoof come October.

Frankly, I wish such a castrated TCP/IP stack, with raw sockets capability removed, were available for Linux. My Linux boxes are a minimal threat, being behind a firewall and only having a single port exposed, but I’d cripple them just to limit their usefulness to a script kiddie just in case.

Why? Screw standards compliance. The standard for mail servers used to be to allow them to be wide open so anyone could use one, just in case their mail server was down. It was all about being a good neighbor. Then spammers trampled that good faith, so open relays are now the exception, not the rule.

Maybe there’s some legitimate use for raw sockets. I don’t know. But I know nothing I use needs them. So why can’t I run a stripped-down TCP/IP on all my boxes, so that in the event that I do get compromised, my PCs’ usefulness is limited?

If software companies want to provide a full, standards-compliant, exploitable TCP/IP stack for esotetic purposes that need them, fine. Do it. But don’t install it by default. Make it a conscious decision on the part of the systems administrator.

Let’s just get one myth out of the way. The Internet isn’t going to change the world. So when the world does stupid things, the Internet’s just going to have to change instead.

Short takes

Dave Farquhar General , , ,

AMD. According to the latest rumors on Ace’s Hardware and The Register, the Palomino core, when released, will be known as the Athlon 4. This is a marketing move; the Palomino is a less radical change to the core and the architecture than Thunderbird was. I think it’s a good marketing move, but it won’t do anything to make people less confused.
Tech support story of the day. A user one of my colleagues supports received an LS-120 superdisk in the mail. This user had no LS-120 drive, only a floppy drive. So my colleague went up to look at the disk and locate an LS-120 drive to read the disk. When he hunted down an LS-120 drive, he stuck in the disk, looked at it, and found a single file on it–a Word document. The file size? 32.5K!

But I guess it could have been worse. At least it wasn’t a 4K file…

Discussion groups. I’m not the least bit happy with how they look, and the performance isn’t so grand (an upgrade next week should help that), but I’ll go ahead and open up my forums. They’re at https://dfarq.homeip.net/cgi-bin/yabb/YaBB.cgi. At the moment they’re totally open. I’ll bolt them down if spam, flame wars, or other things become a problem. I tend to be very open until that openness is abused, then I become a dictator.

I believe you can register without giving a true e-mail address, so you can use a spam filter if you’re afraid of that. Cookies are just used for automatic login and for timeouts–they’re good cookies.

The board is powered by YaBB, a free bulletin board written in Perl. Some things about it I like better than UBB, which is what most forums out there seem to use. I don’t like its color handling, but I’ll sacrifice that to gain other features.

Go ahead, take a look around, start posting stuff, and offer suggestions.

Why the forums when we’ve got comments? Well, I assume people want to talk about more than just what I talk about on a given day. This is preferable to e-mail because I have more options for reading it and it’s already online. Plus there’s always the chance someone else could pipe in with an answer.

More like this:AMD YaBB

R.I.P.: Free Brightmail

Dave Farquhar General

Brightmail, we hardly knew ye. I got notice last week that Brightmail’s free service is finito, as of the end of this month. Another effort to sell product by giving it away for private use goes away. That’s kind of a shame, because Brightmail did a decent job of filtering spam. I got one of my last Brightmail reports this afternoon, and it blocked 14 pieces of spam. Thanks guys. I’ll miss you.
So… I’ve got about three weeks to get something else going. The combo of Fetchmail, Procmail, and a nice anti-spam Procmail recipe on my Linux server ought to do the trick. I’ve done some reading up on it. Of course I’ll be letting you know how that goes. Configuring that stuff isn’t necessarily for the timid, but the price is right and many people report blocking about 95% of spam with their setups. Brightmail, by contrast, blocks about 70%.

Of course I’ll let you know how it goes.