Slashdot Mirror

I was just writing about Attention Trust on my blog last week, if you're interested.

http://www.whirlycott.com/phil/2006/01/11/playing- with-attention-trust/

phil.

First of all, I don't see much security-related content on that site. Second, the issues that are raised all seem to be issues in non-AJAX web development as well.

For example, in AJAX Considered Harmful, using HTTP GETs to change state is a well-known no-no. (Google Accelerator recently broke some sites that violate this principle, but it's been known since at least HTTP 1.0 times that infrastructure would break sites that were coded incorrectly.) But XMLHttpRequest supports POSTs (and PUT, and probably all the rest). It also supports HTTPS.

As far as stealing content, that can be addressed (well enough for 95% of cases) by checking the Referer field. (I think that should work -- I wasn't able to find any documentation whether the browsers add/override that header when submitting XMLHttpRequests, like they should.) Although the random session token he suggests is a pretty good solution as well.

Another good article on the subject is: "The Spam Problem: Moving Beyond RBLs" by Philip Jacob

MAPS didn't block you. MAPS added you to a blacklist. Some admins have decided to block you based on you being in the MAPS list.

SORBS also like to stress this point. They offer their RBL to be used as anyone sees fit, and they take no responsibility for its contents or how it is used. It is the ultimate disclaimer.

The problem is that some ISPs do use these RBLs, and this causes a great deal of 'collateral damage'. When you are the victim of collateral damage, there is often very little you can do about it.

ISP X won't deliver my email to its customers because my ISP's server is on an RBL. My complaints to ISP X go unheeded because I am not one of their customers. I complain to my own ISP. They can't do anything either. They've cancelled the account used to send the spam, but the RBL administrator isn't being cooperative.

Ultimately it is the innocent users who come out worst.

And in my experience, all the comments about RBL admins being high-handed and arrogant are true. SORBS even demand a $50 'fine' for removal. The money goes to a charity that supports someone's legal case against a spammer and not to SORBS itself, but it is as near to extortion as is still legal.

Just for Karma whoring, here's an interesting link (if slightly old) The Spam Problem: Moving Beyond RBLs.

I don't see why it's Slashdot's job to be free advertising for this guy's personal opinion

Whilst written from a personal perspective, the article raises valid issues. Some anti-spam RBLs just blacklist entire countries like Korea and China. See this here for more about that.

The difference is now it isn't just affecting email, but other parts of the web as well. It doesn't make living in one of these countries any easier, does it. If this article is to be believed, it seems that many admins have been quick to blacklist eg. macedonia perhaps because they are small and "not worth the risk" rather than actually being a source of trouble.

So, we're now excluding minorities on the so-called World-Wide-Web. Sure, it's an opiniated observation, but an observation that I'm glad to have encountered. I'm glad this article ran, I got something out of it. I'm sorry you didn't. At any rate, this article is a hell of a lot more "insightful" than the Linux Users Are Spoiled drivel I had to endure recently.

Not everyone is as much of an RBL cheerleader as you are.

There are many problems with using RBLs to block connections. A very good description can be found here:
I've found SpamAssassin a fairly good, rather than block messages from RBLs it analysis message content, adds points to messages in RBLs and checks known Spam databases such as Razor and Pyzor. Rules matches are given a score, and messages with a total aggregate score are tagged in the message headers, allowing users to filter these if they want to.
A main advantage of this method is that no single rule can flag a message as spam, hence legitimate mail sourcing from the badly configured mail relay has a chance of getting through, and in my mind it's probably a particularly bad idea to block any email unless it's actually addressed to you.

I bought an Audiotron recently and hooked it up via a Linksys wireless bridge to my network. All of my mp3 files reside on my linux server and are accessed via samba. I use iTunes on my Powerbook to rip my CD collection and manage the mp3 files.

I've had it probably for a month and it's been great. The unit is stable and the wireless network is great. I don't notice any performance problems with the wireless, despite what others are saying about it.

Originally, I wanted to hardware the unit thinking that it would be a problem, but running cable is such a hassle in my house and I figured I would just try out the wireless option. Since it works, I'm happy. Music never skips or pauses or whatever.

I've saved a huge amount of space in the living room where all the CDs used to be and have also really reduced the visual clutter.

I also looked at the slimp3 player that someone else mentioned, but decided I wanted something "appliance-like" that wouldn't have me digging through perl server code in the middle of a party when I want to be listening to music. The other reason is that the Audiotron supports streaming Windows Media which I use to listen to a radio station in France and this was a must-have for me.

Fyi, if you go with the Audiotron, you should check out my Whirlycott Audiotron TOC Generator which builds table of contents files for the Audiotron to read. This makes scanning your MP3 collection a task that takes just a few seconds (I have around 5000 files) versus 10 minutes.

An apparently growing archive of Dot Bomb's... http://ebituaries.whirlycott.com/

here is a similar site, but you can rank the screen caps on this one:

http://www.ebituaries.whirlycott.com/