Slashdot Mirror
'Spamalot' Subscribers to Get Spam ... a Lot
CrazyWingman writes "It looks like the list of e-mail addresses subscribed to the lists for the Broadway show 'Spamalot' has been nabbed by spammers. The New York Times is reporting that the list was posted on a page that could be found by looking at the source of other Spamalot webpages. All I have to say is that I hope the creators of the Spamalot website have been sacked."
So I don't have to subscribe to the NY Times for the thousandth time?
Who didn't see THAT one coming?
sup
That does it. I'm going to sign up at www.freemoneyalot.com If it works like www.spamalot.com does, I'll be on the gravy train!
Don't blame Durga. I voted for Centauri.
It's only a model.
Halitosis - (n.) Halle Berry's Camel Toe.
It's a bitch. Is this poetic or ironic justice?
Registration free link
Generated using the New York Times Link Generator.
"Spamalot" fans who signed up for a newsletter on the Broadway musical's official Web site may end up getting, well, spammed a lot. "Movin' Out" devotees may have the same problem. A security glitch - now fixed - exposed the names and postal and e-mail addresses of more than 31,000 people to savvy computer users.
Up until Thursday evening, when a reporter from The New York Times pointed out the problem to the Web sites' developer, visiting a specific address on the shows' sites produced a long page with mailing-list data. The security hole was not obvious to casual Web surfers because the address was buried in the site's code. But it could have been discovered by someone deliberately seeking the list data, or by a kind of program used by spammers to scour the Web for new e-mail addresses to bombard.
Both montypythonsspamalot.com, where 19,000 people had signed up for a newsletter, and movinoutonbroadway.com, where 14,000 had, were built by Mark Stevenson, a designer in Croton-on-Hudson, N.Y.
Mr. Stevenson said he had hired a programmer, whom he would not identify, to add the list sign-up function to the sites. He said that the amount of resources put into security on the sites had seemed adequate, but "in retrospect, this was not enough, and we need to do more." He said that a message would be sent to the list with a warning about fraudulent e-mail messages.
Mark Wilkie, a software engineer who maintains Web sites for Gawker Media, said the ability to view the data must have been built into the sign-up software, but it was not clear why someone would do this. "Security-wise, it's a horrible thing to do," he said.
Aaron Meier, a spokesman for Monty Python's "Spamalot," said yesterday that the show would have no comment.
When told by e-mail message about the breach, several people who had signed up for the "Spamalot" list said they were unsurprised, given the state of Internet security and the aggressiveness of spammers. Several noted that there was something appropriately Pythonesque about the incident. After all, Internet historians say that the use of the word spam to refer to junk e-mail messages has its roots in a 1970 Monty Python sketch, in which all conversation in a cafe is drowned out by a group of Vikings chanting the word over and over. The sketch and its song about Spam, the meat product, were adapted for the new musical.
"Are you sure they didn't do it on purpose?" joked one list subscriber, Matthew J. H. Baya of Ellsworth, Me. "Talk about guerrilla marketing."
"The New York Times is reporting that the list was posted on a page that could be found by looking at the source of other Spamalot webpages. All I have to say is that I hope the creators of the Spamalot website have been sacked.""
But it wasn't for that loophole? Google wouldn't have webcam access to security cameras around the world.
The cREators would like to announce that the previous creato
NO CARRIER
The c re a tors of
NO CARRIER
Please help metamoderate.
...for unfalse advertising.
Mr. Stevenson said he had hired a programmer, whom he would not identify, to add the list sign-up function to the sites.
But why? It's not like we'd want to bludgeon, or bitchslap, or ambush, or lynch the programmer.
The coolest voice ever.
No, relli!
She was Karving her initials on the moose with the sharpened end of an interspace toothbrush given to her by Svenge- her brother-in-law- an Oslo dentist and star of many Norwegian movies: "The Hot Hands of and Oslo Dentist," "Fillings of Passion," and "The Huge Molars of Horst Nordfink"...
Baby got spam.
Warning: Could be fatal if taken seriously
If you RTFA, you'd notice that in fact the mailing list subscribers were not spammed. Whoever noticed the security hole was not a spammer, reported it, and the hole was plugged. So, yes, maybe it's funny, but they really were not spammed, which spoils the story.
::instart Fark.com "Ironic" tag here::
Both montypythonsspamalot.com, where 19,000 people had signed up for a newsletter, and movinoutonbroadway.com, where 14,000 had, were built by Mark Stevenson, a designer in Croton-on-Hudson, N.Y.
Mr. Stevenson said he had hired a programmer, whom he would not identify, to add the list sign-up function to the sites. He said that the amount of resources put into security on the sites had seemed adequate, but "in retrospect, this was not enough, and we need to do more."
Why would they use some obviously "home grown" half assed mailing list code when there are perfictly good and fairly sold apps out there like Mailman or EZmlm? Sounds like the "designer" hired some friend, prob. som kid who just learned about web scripting...
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
... from a site designer who can't even spell "bandwidth"? (Or at least spell it twice...)
T. F. Gumby. Anyone know him?
Like, what else did you expect from a site named SPAMALOT!!
..here in Camelot. We eat ham and jam and spam a lot.
I predict that in the future, Shakespeare and Monty Python will be mentioned together a lot.
Well, it has never been successfully tested.
All your spam is belong to us
http://www.carapacearts.com/mark_stevenson.htm
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
SPAM SPAM
SPAM SPAM
SPAM SPAM
SPAM SPAM
SPAM SPAM
We aplogize for the spam, the creators of this website have been sacked
SPAM SPAM
SPAM SPAM
SPAM SPAM
SPAM SPAM
SPAM SPAM
We aplogize for the continued spam, the persons responsible for the sacking of the persons just sacked would like to announce that they have been sacked.
Recently I noticed on a certain college website, every employee's email address was listed on a type of 'contact' page.
Every employee.
It actually was a three column table, on the left side it had the employee's name, next column was for e-mail, and the last for their phone number.
I was sitting with the Administrator that handles the email servers, when I heard recently there has been an ever more increasing spam flow to all the college email addresses.
Proceed with Format (Y/N)? Y
What if the web designer/programmer was actually someone sleeping in bed with the spammers ? .....
...
<programmer> ok, I am going to create the website for Acme Inc. For 3 grand, I can leave a backdoor for you to get all the email addresses
<spammer> make it 2 grand and 3% cut of all referral fees
<programmer> deal
<spammer> deal
This would get pretty interesting pretty fast
" And the funny thing is, that it is incidents like this that cause people like me to not want to register with sites like the Times, precisely to prevent accidental disclosure of any information"
Withdrawing completely from society will have the same effect.
"And yes, I know that you can lie on the forms, but my attitude is, why encourage sites to use registration by lying?"
Why encourage sites to put their information on the web by reading it?
From my experience, though, often a web developer's clients push towards unsecure functionality because of cost/time considerations. I've been hired to add functionality to sites' existing shopping carts, for example, and when I've found and reported massive holes (a list of customers, orders, credit cards all accessable from a web page, for one), I've been met with heavy skepicism about the need to fix these holes now.
"How would anyone find that page?"
"Maybe we'll get to that once we add the international shipping feature."
etc. It gets tiring. After a while, you feel unappreciated. I'm not saying that something like this happened here, but at this point, I don't know that it DIDN'T happen...
My 2 cent American.
Mind you, moose bites can be pretty nasty!
Slashdot is to the internet, what yelling fire is to a crowded theater.
That's nice dear, would you like a cup of tea?
Lets see.
"...I've been met with heavy skepicism about the need to fix these holes now."
And yet the media (of all kinds) is filled with examples of "failed security".
So what's the problem? Have nothing to point to?
he probablly wanted something quick and simple that he could easilly and seamlessly fit into his existing site.
it can be hard to do this with existing code especilly if it hapepns to be in the wrong programming language
"And for other websites, use BugMeNot, the firefox extension. Quite helpful."
The irony of a group that boasts about it's ability to not RTFA, complaining about a site you have to register for to read the articles is enormous beyound belief.
I may be wrong, but if this is an attempt at securing a pretext for a reviewer who's got something better to do that evening, I applaud them.
Those responsible for the sacking of the web developers, shall also be sacked.
...bloody vikings!
insecurity asks the wrong question irritation gives the wrong answer
Crap, wrong movie.
Is it me or does anyone else have issues with this being called a glitch? Seems like either sloppy work or deliberate. Either way the page that spat out emails and addresses worked as expected it was simply not locked down.
http://www.montypythonsspamalot.com/cgi-bin/spamal ot.cgi?email=
This html is full of artifacts. I would be surprised if they actually hired a web developer and didn't just screw up and use some free script they didn't fully understand.
3 Matches Found (displaying 1 to 3)
Perhaps we could construct a large wooden badger...
I just saw it last friday (one week ago) and I thought it was great. It's well worth going. But, beware, people are trying to mark up the tickets like crazy.
:)
:)
I also recommend, if you like Indian food, to go to Utsav in the theater district. It was friggin awesome. Get the Murg Vindaloo and order the Sterling Cabernet with it. It's a great combo, if you don't mind your food making you sweat
Anyway, great show for Holy Grail fans
T
---- It puts the lotion on its skin or else it gets the hose again. It does this whenever it's told.
Is it just me, or are Slashdot headlines getting more and more incoherent? And then we find out, by RTFA, that they didn't actually get spammed! Psccht.
Mr. Stevenson said he had hired a programmer, whom he would not identify, to add the list sign-up function to the sites. He said that the amount of resources put into security on the sites had seemed adequate, but "in retrospect, this was not enough, and we need to do more."
He had hired a programmer.... *nod*
And my mother's still a virgin....
After birthing me yesterday.
A community-oriented lyrics site
Large møøse on the left
half side of the screen
in the third scene from
the end, given a thorough
grounding in Latin,
French and "O" Level
Geography by BO BENN
Suggestives poses for the
møøse suggested by VIC ROTTER
Antler-care by LIV THATCHER
John
http://shit.slashdot.org/article.pl?sid=05/03/12/1 735211
Mr. Milton, the sole proprietor is an honest man, so I'm told...
...and those responsible for those who have been sacked have been sacked...
Why is I that we always hear about attacks on 'this server', 'that server', yet nobody's ever thought of planning a DDoS (Distributed Denial Of Service, read here for more info) Attack on Spammers? Why not? We could potentially get rid of them, make their machines crash... I just don't get why we have to wait for the law to take matters into their incapable hands.
Not that I'm trying to incite you or anything.
Sébastien Ferland couzin2000@gmail.com freedom | liberté | libertad | freiheit | libertà libertade |