Slashdot Mirror


User: Zocalo

Zocalo's activity in the archive.

Stories
0
Comments
2,447
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,447

  1. Re:Use spam assassin with more that one RBL on SORBS - Is There a Better Spam Blacklist? · · Score: 1

    From memory (I've not double checked that the syntax is valid either) the basic structure of the rule is as follows:

    # Assign a score of 1.0 to a "shadow" of each DNSBL rule the message hit
    # (not included in the total message spam score):
    meta __AMB_DNSBL1_HIT ( DNSBL_RULE_NAME1 > 0 )
    meta __AMB_DNSBL2_HIT ( DNSBL_RULE_NAME2 > 0 )
    ...
    score __AMB_DNSBL1_HIT 1.0
    score __AMB_DNSBL2_HIT 1.0
    ...

    # Count the number of hits on the "shadow" rules:
    meta __AMB_DNSBL_TOTAL ( __AMB_DNSBL1_HIT + __AMB_DNSBL2_HIT + ... )

    # Now bitch slap the message score accordingly:
    meta AMB_DNSBL_MULTI2 ( __AMB_DNSBL_TOTAL =~ 2)
    meta AMB_DNSBL_MULTI3 ( __AMB_DNSBL_TOTAL =~ 3)
    meta AMB_DNSBL_MULTI4 ( __AMB_DNSBL_TOTAL > 4)
    score AMB_DNSBL_MULTI2 2.0
    score AMB_DNSBL_MULTI3 5.0
    score AMB_DNSBL_MULTI4 50.0

    You'll need to replace the "DNSBL_RULE_NAME?" entries with the actual names of each DNSBL rule that you are doing, including the system defaults, or just those that you trust enough to use in this manner if you prefer. As an additional twist I have my own local DNSBL list which counts for three regular hits via the following META rule:

    meta __AMB_MYDNSBL_HIT ( AMB_DNSBL > 0 )
    score __AMB_MYDNSBL_HIT 3.0

    Note that newer versions of SpamAssassin may make this easier - I wrote this sometime ago and haven't looked at the documentation on rule creation to see what's new for quite a while.

  2. Re:Dangerous on Toyota Creating In-Vehicle Alcohol Detection System · · Score: 2, Interesting

    If you get rear-ended because your engine has been cutoff because the car decided that you were DUI and you are drifting to a halt that's not your fault; it's that of the person who rear-ended you. You'll probably still get prosecuted for DUI, but the driver that hit you also could be prosecuted for driving without due care and attention as well. If you are swerving all over the road, don't have any lights on at night, or get into a "he-said, she-said" situation with no witnesses to back you up then you're likely going to be saddled with all the blame though.

  3. Re:Use spam assassin with more that one RBL on SORBS - Is There a Better Spam Blacklist? · · Score: 4, Informative

    To extend on that I also have a META rule set up to handle DNSBLs in SpamAssassin that adds some additional points based on how many RBLs each IP address has hit. A server on one DNSBL may be a false positive or an over aggressive listing, but if it's on three or four then it's almost certainly spam and gets an extra couple of points towards being classed as spam. If it matches five or more, then it gets an instant +50 file in the mailbox "/dev/null" score.

  4. Re:The RAF has a base in the falklands... on Penguins Disappearing From Southern Hemisphere · · Score: 5, Informative

    That's highly unlikely as the RAF operates very strict flight regulations concerning the areas around the Falklands that are used by nesting penguins. Especially so during the breeding season when the noise of an overflying jet may startle a potential parent into letting the egg balanced on its feet to keep it warm come into contact with the frozen ground, almost certainly killing the chick within. More than one RAF pilot has had their flying status revoked and found themselves on the next transport plane home after being caught too close to the penguin colonies.

    For those of you old enough to remember the TV advert, the RAF most certainly does not "P-P-P-Pickle a Penguin".

  5. Re:A Modest Proposal on Shortage of Electricity Drives Data Center Talks · · Score: 1

    Jokes aside, this seems like a brilliant way for a gym to offset at least some of its operating electrical bill, but I can't recall ever reading about a single instance of this being put into practice. When I was a kid I bought a rig to power the lights on my bike via a simple friction mechanism off one of the wheels for about £10, so I doubt cost is an issue. Is anyone aware of this being done on a larger scale, or has the idea really just not occurred to anyone?

  6. Re:Middle Eastern nations ? on Nuclear Tech Race Is On In Middle East · · Score: 3, Informative

    Actually, classing them as Arabic isn't much better either since the bulk of Morocco's population is Berber with only about 10% being "pure" Arabs, Algeria's genetic makeup is not too much different than that of Morocco and Libya is even named after a Berber tribe. A much more accurate term would be Islamic, but that's not especially a word people like hearing in close relation with the word nuclear these days, despite almost all of the listed governments having generally cordial political relations with the EU and US at present. Morocco is talking about membership of the EU and openly supported the Coalition in "Iraqi Freedom", and Libya seems to be trying very hard to make amends for past activities at present.

  7. Usually six or seven, but lots and lots of tabs... on How Many Windows? · · Score: 1
    Dual screen, with lots of overlapping windows:
    • Web browser - six to ten tabs
    • SSH/SFTP client - six to ten tabs again, unless patching, in which case *lots*!
    • VMWare console - probably four or five active VMs
    • Email client with three pane view
    • A couple of "Office" apps, possibly with multiple documents open
    • Maybe four or five other tools, but usually minimised when not in use
  8. Text books of course on Wikipedia's $100 Million Dream · · Score: 5, Insightful

    If you are going to make a $100m philanthropic gesture, which I assume this is, then surely you would want to see the largest possible impact for your effort. Remove the copyrights from the books necessary to give the impoverised of the world free access to the materials required for a decent education and I'm sure that those with the necessary skills to translate those works into as many languages as required and teach it to those willing to listen will step forwards as well.

  9. Re:I say let the spam come on Email Servers Will Choke, Says Spamhaus · · Score: 1

    Losing Spamhaus isn't likely to have as much of an impact as they would have you believe, even if their two figures of 90% of email is spam and 75% of ISPs use Spamhaus are accurate. Why? Because most ISPs that use DNSBLs like Spamhaus use multiple lists, so if Spamhaus goes away then there is a fair chance that one of the alternate lists they are using will pick up the IP address anyway. If it doesn't, then the email may well fall through to a more thorough second level anti-spam system that actually scans messages which should hopefully flag the junk. Worst case scenario is that *some* of the other DNSBLs or *some* ISPs message scanning servers get more traffic than they can handle and slow to a crawl/collapse under the load.

    The spammers know this of course, so chances are they are all set for the event, should it happen. I think that if Spamhaus does get its .org domain pulled without an alternative solution in place a DDoS against other major DNSBLs in conjunction with a spate of spam and trojans with 0day exploits will follow shortly after. Assuming that is that Spamhaus doesn't start providing its services on a domain outside the reach of the US legal system before then - "spamhaus.org.cn" anyone?

  10. Re:Aluminum foil over the RFID detector? Burn a co on RFID To Track Play of DVDs And CDs? · · Score: 2, Interesting

    And the destruction of the RFID tag is going to occur without damage to the probably even thinner layer of metal that holds the actual media content because?

  11. Big grey area if you ask me... on Can Banks Shift Phishing Losses to Customers? · · Score: 1

    If you send all your bank account details to some Nigerian "widow" based on the contents of an email written all in block capitals, then that's hardly the bank's problem, is it? At the other end of the scale if you visit your bank's actual website only to have your account details obtained by some cracker that managed to compromise the webserver then that is very much the bank's problem. In practice though, the vast majority of fraud is going to fall somewhere in between those two extremes, so really this kind of thing should be handled on a case by case basis based on a predefined framework set out when you sign up to the account. I suspect that means we are going to start seeing a T&Cs for bank/credit accounts that resemble insurance policies though; "We will refund your money in the event of A, B and C, but not P, Q and R, although we'll cover you for those too for a monthly fee. Under no circumstances will we be liable for X, Y and Z."

  12. Re:If you use an encryption product, use open sour on Suggestions for Company Wide Password Vault? · · Score: 1
    Yes, open source would be better, but since so few people *really* understand encryption to the point that they could take a look at the source code and say "yes, that's secure" most people would still be relying on someone with the necessary skills monitoring the code. You can't just assume that because the code is available that all the specific code versions in your compliation has been checked and found to be backdoor free by someone capable of doing so. If you need the open source comfort blanket though then clearly this is not the product for you, but that's just another one of the decisions that individuals need to make for themselves when choosing a product.

    If the DB becomes corrupted I'd restore from a known good backup, which we have. As the web page states "there are no backdoors" which, true or not, is what I would expect from *anything* involving encryption. Even if there was a magic back door safety net, I still wouldn't be sending my password data off for recovery, regardless of who the company was or where they were based.

    On the subject of them based in the Ukraine, so what? I think it more likely that if the CIA/NSA/whoever have backdoored any encryption programs it's more likely that they will have done the ones in their own country first, so I guess that's PGP out then. Personally, when it comes to security, I assume everything is as secure as wet tissue paper and factor that into my risk analysis and installation - hence this tip about using Windows' file permissions for an additional (independent) level of security. You could also add another layer by using something like TrueCrypt to scramble the partition that the databases were secured on if you wished.

  13. Password Manager XP on Suggestions for Company Wide Password Vault? · · Score: 2, Informative
    We use Password Manager XP from CP Lab with a set of databases shared by numerous users across multiple sites via remote network shares with DBs for sites, departments and we also allow individuals to create personal databases if they wish to do so with a quite complex access schema. It's Windows based and not free, but the price is fairly reasonable and the feature set is broad to say the least! You can grant readonly access and update access on per database, per branch, or per password levels as required by to either individual or groups of users. Tip: Locate your password DBs in multiple directories and use Windows' own directory permissions for another level of security, although all common encryption algorithms are supported in combination. It's got full logging, plus a complete change history so you can view prior passwords which is very useful if you dig out a box that's been sitting on the shelf for a few years!

    Seems to me it does everything you need and then some.

  14. Re:Not nearly enough. on Microsoft Wins Record Amount from Hotmail Spammer · · Score: 1

    Oh yes, flogging as a punishment. That'll work. I can just picture my inbox overflowing with S&M porn with genuine contact details included to "aid" law enforcement. The irony is that would probably make it CAN-SPAM compliant and there would be nothing anyone could do about it an updated "Think-of-the-Children-SPAM" law got passed.

  15. Re:surprised that I'm sad to see it go on 'Stargate: SG-1' Cancelled · · Score: 1

    That was a definite Firefly reference; The answer to the question was something alone the lines of how well the DVD Sales had been. Another reference that is particularly ironic now was when they were poking full at Michael Shanks' haitus from the show and how the fans had setup a website to bring him back which had got upto 27 hits a day, "which is quite a lot, apparently". Anyone care to bet what kind of SG1 fan sites are going to be springing up over the next week or three...

  16. Lies, damn lies, and PR on Dell, Sony Discussed Battery Problem 10 Months Ago · · Score: 5, Interesting
    That's pure crap. Why else would they have registered the "dellbatteryprogram.com" domain name back on 10th November of last year if they didn't think that a recall was going to be required? You might also notice from the WHOIS information that they are not hosting the domain on their own DNS servers like they do with their other domains. I think it far more likely that they had their discussions with Sony, but decided not to risk a PR disaster by performing a complete recall unless failures made it absolutely necessary to do so.

    My company made the decision to dump Dell just before this latest fiasco broke. Between regular failures of wireless modules in the D600 laptops, having to replace the motherboards of every one of GX270 desktops (OK, not really Dell's fault that one, but it's their badge up front for management to see) and totally abysmal support we've had enough. From their recent earning reports, I guess we're not alone in that.

  17. Re:Eliminate the zombies on Sophos Reveals Latest Spam-Relaying Countries · · Score: 1

    Every time a spammer needs to register a new domain, it'll cost him money

    Yeah. Sure. Like maybe $1.99. Domains are cheap; a spammer can quite easily register a domain, possibly even on the credit card of a random luser that got phished, configure some hosts and SPF records and send several tens of millions of spams in a few hours. All it takes is one valid order with a profit margin greater that $2 from all that and they are in the black, and if they get the timing right then with some registrars they can even cancel the domain and recoup the $1.99.

    The only thing that SPF provides, and all that it was ever intended to do, is to try and prevent domain names from being misused in Joe-Jobs and phishing attempts, primarily through enabling ISPs to reject/discard the emails before a delivery failure message gets generated. It does work quite well, although there are some minor issues with forwarding that need to be taken into consideration, so quite why it has not been adopted by more of the companies likely to be used in phishes than it has I don't know.

  18. Re:Actually on Astronomers Awaiting 1a Supernova · · Score: 5, Informative

    Actually, they do name the star. It's RS Ophiuchi which is 1,950 light-years from Earth according to the linked Wikipedia article. It's worth a look if you are now thinking of doing some amateur astronomy since it also contains some information on some of the star's past failures at going nova and a bunch of related links.

  19. Re:Interesting question... on Fair Use for Presentations? · · Score: 2, Insightful

    I guess it depends on where "fair use" ends and "copyright infringement begins", which is probably quite a large grey area which both sides would like to be black and white, although probably not with the same proportions of "black" and "white". You could probably use the standard disclaimer most DVDs seem to force you to watch as a starting point; if it has words to the effect of "public broadcast of any part of this product are prohibited", then that's pretty clear cut. Failing that, you would really need to either consult a lawyer or, better yet, get something in writing from the producer(s) about what they would consider acceptable. The latter actually isn't all that difficult to get, or at least it wasn't a few years ago when an employer wanted to use some movie clips and stills in a publically available presentation; it the main it was "keep it brief and give us a credit with our copyright stated on it".

  20. Re:Not so hot on UK Music Fans Can Copy Own Tracks · · Score: 2, Informative

    Although this does mean that it's ok for you to burn a copy of your friend's cd

    No, it doesn't. Read the opening paragraph again and you'll see that it says: "UK music fans no longer face the threat of prosecution for copying their own CDs on to PCs or MP3 players, as long as the songs are only for personal use." That makes absolutely no mention of making a quick copy of someone else's CD, which would most definitely still come under the UK legal heading of Copyright Infringement which you could be prosecuted for. Assuming that you get caught of course, which is pretty unlikely.

    What I want to know though, is that now we in the UK can buy one copy of a song (or whatever) and then translate it into any format we like for our own use with the blessing of the BPI, does that mean that the music industry is going to stop wasting their money on useless copy protection? Somehow, I don't think so, but we'll see... there is a government review of this in progress, so maybe this is just the music business trying to make it was their idea all along and not what they are about to be told to do in the wake of the Sony rootkit fiasco.

  21. Re:Polish politeness. on Americans Are Scarce in Top Programming Contest · · Score: 2, Interesting

    It wasn't so long ago that the de-facto reason given for coding excellence in the Eastern Block was down to the fact that they were trying to compete with NATO in a cold war on hardware that was at least a generation behind. Where US programmers would be using C (or more likely Ada on DoD projects) the Russians would be doing the same thing in assembly language because it was the only way they could get close to the same performance on the available hardware. I'm curious as to whether these are "new" programmers that have cut their teeth on hardware comparative to that available to their western contemporaries, or old timers that learnt how to do things lean and mean during the cold war because they had no choice.

  22. Re:New Business Plan... on Bearshare Shut Down by RIAA · · Score: 2, Informative
    Actually, there are a couple of not insignificant flaws with your steps numbered #3 and #4:

    3. Pay $30M to prevent further copyright infringement lawsuits.
    4. Loss.

    Although step 4 could be profit if can you manage to clear more than your settlement in subscription fees, ad revenue and then selling on the personal details of your subscribers once all other operating expenses are taken into account. That probably didn't happen here though, and is unlikely to happen to the next "business" to try using this kind of business model and subsequently attracts the legal wrath of the media industry either.

  23. Re:"Fixes some security issues"? on Firefox Update Kills Bugs, Adds Mac Support · · Score: 2, Insightful
    I suspect that some of these are bugs found by HD Moore of The Metasploit Project in Firefox last month - some details here. We can probably expect a similar slew of updates from Microsoft in a future "cumulative update" for Internet Explorer since there were more than 50 brand new flaws (not all critical) found in IE as well.

    Take a close look at the techniques used, and it's no wonder those "criminal cracker gangs" we keep hearing about have no apparent problem coming up with fresh 0-day exploits to sell if they are applying something like this. The only defence against this is going to be that you ship robust code that you can guarantee will handle any malformed data gracefully from day #1. That's going to take some getting used to in places like Redmond, WA where the "if it compiles, ship it" approach seems to have been the standard for so long.

  24. Re:Good leaning experience for .xxx on The .EU Landrush Fiasco · · Score: 1

    And in a cruel twist of fate, the most valuable (and appropriate) domain name in the .EU TLD, appears to have been registered by precisely the kind of bogus registrar that the article is drawing attention to. Still, at least this one actually has a webpage, even if it is just a single page with an image stuck on it and no text what so ever.

  25. Re:Who cares? on The .EU Landrush Fiasco · · Score: 2, Interesting

    I'm pretty sure that spammers do as it's yet another TLD that is almost guaranteed to be completely absent from most major domain name based blocklists. Businesses will want their .EU domain to protect their brandnames, but never actually use them for anything, a few Europhiles and political entities will want one to fly the EU flag. Once it becomes a free-for-all though, I fully expect the bulk registration of disposable domain names and mass spamming to be begin turning it all to crap, just like happened with the .INFO domain.