Slashdot Mirror


User: jqh1

jqh1's activity in the archive.

Stories
0
Comments
108
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 108

  1. AddressScramber on How Do You Fool Spam Bots? · · Score: 1

    for yet another javascript address mangler/demangler, check out
    AddressScrambler

    Don't listen to people who say these don't work -- if a spammer can spend $x and a get buzillion unmasked addresses, but has to spend a great deal more to get a few hundred masked ones, what do you think he or she will do? And to the people who say -- yeah, but what about when everyone starts doing this? Everyone is not about to start doing this. Relax.

  2. Re:Politicians for Ya on Senate Passes Anti-Spam Bill · · Score: 1

    true, but only to the extent that the WA state law "prohibits falsity or deception in any portion of a commercial electronic mail message or information attached thereto" -- any portion of the WA state law that relates to spam in another way will be superseded by the federal law (and therefore no longer applicable) by virtue of 108(b)(1) and the supremacy clause of the US Constitution. It's hard to argue that spam doesn't affect "interstate commerce", so 108(b)(1) would probably easily survive any 10th amendment (or similar) challenge.

  3. Re:Politicians for Ya on Senate Passes Anti-Spam Bill · · Score: 1

    from the Bill:

    SEC. 108. EFFECT ON OTHER LAWS.
    [snip]
    (b) STATE LAW-

    (1) IN GENERAL- This title supersedes any statute, regulation, or rule of a State or political subdivision of a State that expressly regulates the use of electronic mail to send commercial messages, except to the extent that any such statute, regulation, or rule prohibits falsity or deception in any portion of a commercial electronic mail message or information attached thereto.

    That's politicians for ya -- hope you like the proposed federal law better than any state law you may be rooting for...

  4. probably good on Verisign Gets Out of the Registrar Biz, Keeps .com Registry · · Score: 2, Interesting

    Did you ever deal with NSI or Verisign customer service? I did on several occassions and couldn't help getting the "I'd like to help you, but don't piss me off or I'll turn off the Internet" kind of feeling from the reps.

    The business Verisign kept is, of course, absolutely critical, and people operating under the brand and direction of Verisign have irritated me beyond reason in the past. So, reasonably or otherwise, I don't like the thought of that company continuing to run the backbone. Still, it works most of the time, and now I won't ever have to call them to find out why my DNS designations haven't been updated yet.

    So I *do* like the idea of separating the retail front from the back room folks. It's always smacked of government sponsored monopoly to have the two together -- maybe the new NSI will actually be a pleasure to work with (and I'll win the lottery and the Cubs will take the series).

  5. Re:So how do I....? on Handspring Treo 600 Finally Available · · Score: 1

    On my T180, I've been using TopGun ssh (and I think mocha telnet works for ssh, too).

    VNC? You're not going to connect to windows boxes are you? CLI Forever!!! Seriously, I don't know anything about VNC for palm.

    For email, I have the following setup - SnapperMail hitting a ssl Pop3 server (every hour or so), and a perl script on the server that "digests" messages and sends them to the SMS gateway provided by the cell phone provider if a) the message makes it past spamassassin and b) the message is marked as "important" -- voila!

  6. Re:Am I missing something here on Spammers Using Hacked Machines as Decoys · · Score: 3, Informative

    My site/service got mentioned in a spam "newsletter" once without my knowledge or consent. I was promptly strung up on spamcop as a business that had advertised in spam -- and my site/service is a spam *fighting* service to begin with!

    The point here is there's so much spam with so many variations on the base set of presumed facts, that hair-trigger lawsuits will cause many friendly-fire victims. I doubt the spammer I mentioned above meant to cause me any harm by mentioning me in his "newsletter", but I doubt it would be too hard to find a situation where it's done on purpose -- i *have* been "joe jobbed" several times (used as the reply address on spam) and that gets pretty nasty, too, and presents a similar situation where spammers falsely implicate others. Add in swift and sure legal consequences, and it would be much worse. Even assuming the courts have the ability to determine a false positive defendant when they see one, just think of the expense of doing that.

  7. Re:Can we really enforce this? on California Tries Spam Ban · · Score: 4, Interesting
    from the act findings:
    (i) Many spammers have become so adept at masking their tracks that they are rarely found, and are so technologically sophisticated that they can adjust their systems to counter special filters and other barriers against spam and can even electronically commandeer unprotected computers, turning them into spam-launching weapons of mass production.
    Follow this with one of my favorite (unattributable?) quotes:
    "I'll be damned if I'll trust my fate to 12 people who aren't even smart enought to get out of jury duty..."
    At spamgourmet.com, which is a disposable email service (i.e., spam *fighting* service), I've receieved angry law-suit-threatening phone calls, emails, etc. from spam recipients when spammers used disposable addresses as "reply-to" or "removal" addresses (in violation of the TOS, btw). The servers are in California, but I'm here in in TX, and I'm so not ready to go to court in CA...

  8. Re:Is the default config file safe? on New Vulnerabilities in Portable OpenSSH · · Score: 1

    OK - caution 1, blood pressure 0 (actually much, much higher)
    [wince]...

    Thanks

    p.s. - works fine with
    UsePAM no
    [whew]

  9. Re:Is the default config file safe? on New Vulnerabilities in Portable OpenSSH · · Score: 1
    The advisory does appear to mention this default, explicitly anyway...

    *Ahem*, I meant, of course:
    The advisory doesn't appear to mention this default, explicitly anyway...

  10. Is the default config file safe? on New Vulnerabilities in Portable OpenSSH · · Score: 1

    I'm using pretty much the default config file, and I've never intentionally enabled PAM. Here's what the PAM part looks like:

    # Set this to 'yes' to enable PAM authentication (via challenge-response)
    # and session processing. Depending on your PAM configuration, this may
    # bypass the setting of 'PasswordAuthentication'
    #UsePAM yes

    If you have to uncomment out that line to enable PAM authentication, then *not* uncommenting it is equivalent to setting it to "no" (like the advisory says to do) yes? The advisory does appear to mention this default, explicitly anyway...

    [sorry to ask what may be the obvious, but weeks fall off my probable lifespan whenever I'm messing with sshd on a remote server, and I'd sure like to avoid it if I can]

  11. hope it's not a bumpy start on UK Makes Spamming a Fineable Offense · · Score: 2, Interesting

    Anti spam laws are great, and I hope they keep coming. I get a little jolt, though, when I think of most of the law enforcement professionals and judges I know determining who was responsible for spamming.

    I run a free anti-spam service (disposable email) and, probably intentionally, spammers have used disposable addresses from my service as the reply-to or "list removal" address on more than a few spam messages (note: they don't use my server to send the spam -- it's usually some open relay). They generally don't receive any email through these addresses because they get invalidated right away -- either by me or automatically. It really really looks like a simple smear campaign, and certainly has that effect.

    The result is that I get angry emails, and even phone calls threatening to sue from the people who receive the spam. They assume that I'm somehow responsible for sending the spam. They almost all chill out as soon as I explain the situation, but after a big spam frenzy from one these ##*$!!#@, I find myself doing a lot of explaining.

    I also live in America (*you insensitive clod!*) and I'm definitely not prepared to appear in a British court to explain something like this. Enough about me, though, the "Joe Job" is a fairly frequent occurrence these days (whether it is the intentional use of someone else's address in spam -- the true Joe Job, or the mere incidental use of someone's address that was picked at random). I'm sure the legal system will get smart over time, and hopefully will start out that way -- I can't help thinking there's be bumps, though.

  12. Re:Get it in Writing on Building Up a Small Computer Business? · · Score: 1

    Most *standard* disclaimers don't won't save you if it's your fault -- you could theoretically write one that would, though, but then you'd have to get them to understand it and to agree to it...

    So why have any disclaimer? The "default" rules that come into play when something goes wrong sometimes result in liability that the parties did not anticipate. So instead, you can use contractual terms (a disclaimer, etc.) to override the effect of the default rules and put agreed-upon rules in their place. Of course, it helps if you know what the default rules are, and what effect you'd like for the agreed-upon rules to have.

    Does this sound complicated? It is. If you're serious about starting a business, somehow get enough money up front to hire:

    a) a lawyer, and
    b) an accountant

    for a short consultation - good ones will appreciate what you're doing and will work with you to cover your needs while staying within a budget. Discuss all that up front.

    Most businesses fail pretty much right away on their own terms. But the ones that succeed wind up failing pretty soon afterward anyway if they skipped a) and b).

  13. Re:Who replies to spam? on DoS Assaults Underway Against Spam Blocklists · · Score: 1

    probably about 0.001% of the recipients, which is more than enough. As to whether this is the work of spammers, take a minute and adopt the mind of the spammer...

    [no! take the gun away from your head! this is just pretend!]

    Why would you take on more risk than you already do just to bring down these servers when your work is already so profitable? I really think it's someone/something else.

  14. i feel better... on Symantec Adds Product Activation · · Score: 1

    For many folks, it seems that:

    (probability of getting virus * cost of getting virus) < (cost of running virus software)

    and my personal experience has shown this to be true, as long as the user stays reasonably abreast of prevailing viruses, avoids risky behavior, and doesn't use risky software (like outlook).

    Now, with product activation (which is, alone, worse than most viruses, if you ask me), the right hand side of the equation just went up significantly..

  15. drop off in spam on NZ Spammer Shutdown Makes Big Difference · · Score: 4, Informative

    for what it's worth, the stats at spamgourmet.com confirm a drop off in spam the last couple of days. (if you look at the graphs, note that there was a server move near the beginning of July that accounts for the big drop and spike at that time).

    Are we saying, beyond the featured shutdown, that SoBig, etc. have actually taken the *spammers* out of commission for awhile -- not only by clogging mail servers, but by infecting and disabling their boxes?

  16. Re:bash? on FTC Chief Bashes Anti-Spam Bills · · Score: 1

    forgive the plug, but if the anonymity of the supply side is a problem, mainly because of the lack of anonymity of the demand side (asymmetrical anonymity!) - enhancing the anonymity of the demand side should help, no?

    Use disposable email addresses: spamgourmet (my service), sneakemail, jetable.org.

    The trouble is, Ma and Pa aol user don't "get" these services (especially mine -- even tech rag reviewers have a hard time sometimes :)) -- I think the next step is to make them more accessible. We're working to make spamgourmet more easily deployable, including a proposed PHP Nuke front end to go with your own installation...

    Thinking out loud -- does any of the legislation cover what website operators are allowed to do with the email addresses they collect? Dangerous territory, I know, because anything like that would greatly increase the cost of operating a small website (compliance/legal costs, for one thing), but I believe analogous legislation is underway in California regarding the personal information collected by banks and related entities.

  17. Re:Spam Gourmet - Disposable addresses on National Do Not Call List Opens for Registrations · · Score: 1

    Have no fear -- I'm moving the service over to a beefier host this weekend. The service provider had already required me to move a couple of days ago due to a DOS attack eating up CPU. I reconfigured to ignore the attack, and CPU usage went down. I was telling them everything was going to be OK, and then this morning... boom! :) Anwyay, try again next week...

  18. Re:ouch on Spammers Exploiting Hotmail Vulnerability · · Score: 4, Informative

    go for the bonus round by getting a disposable email account (eg spamgourmet.com) to protect your new address.

  19. Re:Tracking spam on Online Marketers to Stamp out Spam? · · Score: 1

    I track spam at spamgourmet.com for about 27,000 user accounts (disposable email accounts). It's actually down about 13% this week. (no, I don't have a life)

    We see dips around major (US) holidays, such as Thanksgiving and Christmas, and, for instance, a big one right after Sept. 11, 2001, but I'm not sure how to explain this one.

  20. Really: Where is old man murray when you need him? on Ethics and Video Game Reviews · · Score: 1

    Answering that question would likely provide some valuable insight to this discussion. That site overwhelmingly rejected everything we're fussing about here, and now it's gone without much explanation.

    Can anyone post the story of what happened?

    Web hosting is cheap these days -- I bet 90% of the /.ers in this discussion are at least subconciously thinking of starting a review site in the hopes it could be half the quality of OMM. Wouldn't you want to know what happened to OMM first?

  21. 90% of what comes through spamgourmet gets eaten on Forty Percent of All Email is Spam · · Score: 1

    One stat that's held fairly constant during the 2.5 years that spamgourmet has been running is that 90% of email messages to spamgourmet addresses are blocked (actually ignored) as unwanted email.

    A little background is in order -- spamgourmet users invent disposable email addresses at their whims, and by default each is valid for a particular number of messages (they can be "refilled" or made permanent for certain senders if the user takes action). Therefore, it can be said that, understanding the way this works, the users have declared that they actually want 10% of the email that comes to those addresses.

    Granted, the users are engaing in "high risk" behavior because they know they are protected -- that is, disposable addresses fall into the hands of people who are likely to try to abuse them at a higher rate than normal addresses do. Still, for this sort of activity (signing up for things on the web, public postings, etc.) it seems safe to say that 90% of the resulting email is unwanted.

    As a spamgourmet developer, I forward my "eaten" mail to a yahoo account. In the two + years I've been doing this, there have been only two false positive messages -- I can truly say I'm glad I didn't get the rest, because I saw them. My personal ratio is 77%, and this includes a great number of delivered test messages that didn't result in spammage later.

    This may be a more expansive definition of spam than what is popular, but it works for me...

  22. new tower of Babel? on The Space Elevator · · Score: 5, Funny

    One can't help but be reminded of the biblical Tower of Babel (a proposed tower that would reach heaven) -- you'll remember that God put the ax to that project by mixing up the languages spoken by the various participants.

    Now, if NASA is involved, will the mixup be metric versus imperial measurement? :)

  23. those guys! on TurboTax DRM Writes to Your Boot Sector?! · · Score: 3, Interesting

    When I first heard about DRM on turbo tax, I got depressed and sent "whine-mail" on their website. One Joyce, from the Intuit "Executive Response Team" replied, and I responded again. I still haven't heard back:

    Joyce,
    Thanks for the response -- let me tell you a little bit about my April 15,
    2002:

    The time - about 11:00 PM. I've completed my 1040 and related forms using
    TurboTax on my main Windows 2000 computer (I have a home network, with
    several computers connecting to the internet through a common router to a
    cable modem). I go through the steps to file electronically, but
    experience repeated failures, with a couple of different error
    messages. I get on the live chat support and finally get through to an
    attendant. I get some advice, then try again to no avail. Returning to
    support I describe my setup a bit more. When the attendant learns that I
    have a home network, he/she says that I'm more or less on my own. I try
    making many different changes to the configuration of the Win2k computer,
    including dialing up to the internet straight through a modem. No dice,
    and no time to wait for another chat session with support.

    The time is about 11:45 (and my blood pressure is rising
    fast...). I uninstall TurboTax from the Win2k computer and install it on
    my daughter's Win98 computer, transferring the
    tax data file across the network. About 11:55, I try electronic filing
    again, and it works! Without remembering or wishing to burden you with
    the details, let me assure you that it appeared to be a Win2k related
    problem, or at least a problem with the network set-up on the Win2k
    machine. Blood pressure goes down, and I put the whole thing behind me.

    Running that scenario again with product activation lands me in the
    emergency room. I do appreciate the note, and I'm going to start my 2002
    taxes soon. I'll revisit the product activation issue then.

    Josh

    On Mon, 3 Feb 2003, JoyceC Support - [snip] wrote:

    > Dear Mr. Hamilton,
    >
    > Thank you for your E-mail to Intuit. My name is Joyce with Intuit's
    > Executive Response Team. I would like to respond to your concerns about
    > using our product. By working with our customers, it is our intent to
    > establish clear, identifiable solutions to your questions and concerns.
    > First and foremost, I am sorry for the delay in responding to your comments.
    > Second, I gather you are giving up on TurboTax because of concerns with the
    > product activation this year.
    >
    > Let me share some facts about our product activation:
    >
    > * TurboTax 2002 includes a product activation process that ensures
    > TurboTax is used in accordance with the TurboTax software license and
    > services agreement.
    >
    > * Product activation ties printing and filing from the TurboTax
    > federal product to a single computer, preventing unlicensed use of the
    > product.
    >
    > * Privacy was a key consideration when implementing the Product
    > Activation technology in TurboTax. Product activation is completely
    > anonymous -- no personal information is transmitted to Intuit.
    >
    > * Product activation transfers nothing but a Product Key and Request
    > Code. The Key and Code key are matched together and a confirmation is sent
    > from Intuit that activates TurboTax on your computer.
    >
    > * Product activation does not monitor any activities on your computer
    > nor will it prevent you from using your CD-R or CD-RW drives.
    >
    > * The functionality that manages the TurboTax product activation
    > (Macrovision SafeCast(r)) can be deleted from your computer when you are
    > done using TurboTax. The uninstall utility is available on our support site
    > at
    > http://www.turbotaxsupport.com/default.asp?platfor m=1&DocID=836
    >
    > I hope this information answers your questions. If you would like to get
    > more information about product activation, please see the Product Activation
    > page at http://www.turbotaxsupport.com/default.asp?platfor m=1
    >
    > &docid=815. You are a valued customer and your opinion matters. If I can
    > answer any additional concerns that you may have, please let me know.
    >
    > Joyce
    > Executive Response Team
    > Intuit. Inc.
    > [snip]
    >
    >
    > In response to the following E-mail received:
    >
    > I'm sad to hear about your product activation scheme. I will not buy
    > TurboTax this year (as I have for many years so far) because of it. What's
    > depressing for me is that I think the product is so good, otherwise - that
    > is, without the product activation, I would be 100% certain to buy and use
    > TurboTax, but with it, I'm 100% certain *not* to.

  24. Re:Typos do not create copyright on Democracy in the Dark? · · Score: 1

    But the original work in this case is not copyrighted - it's public domain. The FAQ there relates to changing your own or someone else's copyrighted work to claim a *new* copyright. In the case of Lexis/Westlaw the presentation *is* the original work, no?

  25. it's the rendering that's copyrighted on Democracy in the Dark? · · Score: 5, Insightful

    In the early nineties, I worked on a website: the Legal Information Institute, which is still going strong, I think. Our goal was to provide public legal info for free. We got our opinions straight from the courts, and (at least then) maintained local copies of legislative text (eg, US Code).

    Lexis and Westlaw were going strong back then, too. As tempting as it may have been to just lift their versions of the documents we wanted to publish, we didn't. Their versions were copyrighted, just like a map maker can copyright a map. Following with that analogy, their versions (I believed) even contained intentional, hopefully harmless typographical errors to prove up theft. They also added value by providing analysis and indexing (keyword, etc.) that were totally absent from the public text.

    So the point is -- contribute! There are dis-aggregated (free) sources for most of the public information anyone could want. The trick is bringing them together and providing useful analysis. We've done (IMO) a great job of that at LII, and there are other sites as well. When you start to appreciate the labor involved in providing such a service, you start to see why Lexis and Westlaw charge...