It's probably the reason (not having server services run reliably), but that is/really/ not a technical one. Note that your connection can stay completely idle for those 24 hours, or pump a full 16mbit/s through it for 24 hours -- you can also reconnect immediately after the forced disconnect; it doesn't really do anything to prevent idle connections or "unecessary" (that term should be defined by the paying customer, not by the telco) traffic.
(the above was written by man, and genetic memory was not even a far-fetched thought back then. I love it when people try to cite that (admittedly in some stretches quite entertaining) book as a way to instill fear and prophecize whatever it is that is currently worth prophecizing to the citer:)
Quite correct, but said directive has not been transformed into national law in Germany, yet, so what T-Online is doing is, put simply, illegal; whether or not it will be legal 3 months from now is a different matter.
"logging IP addresses" means logging which IP address your connection had at a particular point in time within the last 80 days. (so a lookup of 1.2.2.4 in their database would yield "mxs", or whatever my customer number is)
hrrm... wouldn't UDF work as a replacement for fossilfs ?
This problem could be handled differently. You could tear down a PPPoE connection if no data has flown through it in 24 hours, for instance, or automatically reset the connection if new LCP packets arrive indicating the customer wants to set up a new PPPoE connection; also contrary to popular belief, you can set up multiple PPPoE sessions on the same wire; they need to have the Host-Uniq flag set, or use different MACs -- but it is possible; for instance, you can open connections to T-Online and Titan Networks over the same link easily (I actually use this for native IPv6 connectivity from Titan). Also, if this WERE the reason for this idiotic behavior, you would not be able to get business service on the exact same line from the exact same access concentrator using the exact same infrastructure that did not have this limitation. Of course, the price is not exactly the same in that case.
Did you miss that AOL and TW merged ? Many ISPs are part of larger conglomerates, or in bed with parts of the media industry. That should be enough incentive. Traffic usage logs are interesting as well; one broadband ISP (1&1) in Germany regularily offers some of their customers $150 if they leave for another provider, since these customers actually used the bandwidth being advertized and generated generous amounts of traffic. You can't do that without retaining information on traffic usage. Other ISPs might use this to segment their userbase a bit so that the bandwidth-hogs get lower traffic priority than the "good" customers. This is rather common (or used to be so) in Switzerland. Some ISPs take it as a metric to decide whether certain ports should be blocked for a certain customer (a notable one, also in Germany, blocked port 1214 and some other notorious filesharing ports; if you asked them about it, they'd lift the block -- but only if you signed a contract that you are not breaking the law... Fat lot of good that does, but hey, it seems to intimidate enough). Another ISP (I think it was T-Online, way back) sent letters to their bandwith-hogs reminding them not to do illegal stuff with their connection -- the ONLY metric used in that case was bandwidth used, not any indication of any wrongdoing. So if you were merrily sharing Warcraft patches or Firefox releases using BitTorrent you would get such a letter.
Maybe the network admins per se can't do much with that data, but the accountants & salesforce sure can.
The ISP in question stores your assigned IP, duration of the session, start-time of the session, bytecounters up/down, username, and probably access concentrator (i.e. which physical land line was used). No logs of website accesses or acribic list of all packets sent and received are made.
A lot of data is accumulated, but really, what does a terabyte of online storage cost these days... Peanuts. Amazon stores your entire clickstream history, everything you ever did on their website, for an indefinite amount of time. Walmart has some of the largest databases in the world holding all manner of customer and sales records. I'd be surprised if Google ever deleted search logs. archive.org tries to store the entire web many times over. Storage, per se, is cheap:)
Radius, actually. That particular ISP does not use DHCP; all (A|V)DSL(2\+?)? connections are handled with PPPoE, so you get your IP from the PPP session set-up. Connections are reset every 24 hours automatically, and you do not usually get the same IP again after 24 hours (they claim this is done for technical reasons, which is, simply put, BS:)
Not/exactly/ true. The sample letter speaks of a complaint, but T-Online has every choice not to comply. The linked webpage then recommends sueing T-Online in that case. If/Once you win that lawsuit, T-Online has no choice but to comply. This is a tad different from what the blurb here would have you believe.
(All this is based on rather strict privacy laws that require a provider not to collect any data not relevant to accounting; since IP addresses and data volume is not needed for accounting on plans with a flat fee per month, T-Online has no right to do so; they, however, save that data for 80 days.)
This service is only available within the US. The client seems to determine whether it is in the US by sending a GeoIP lookup request via SOAP. I won't tell you the address, you can do the legwork yourself.
Interestingly, that soap-request contains the amazon username and password to do further SOAP GeoIP lookups. If you were really devious, you'd either proxy that stuff or manipulate the SOAP response. Nobody here is devious, right ?
You could also set up your own personal resolver locally or on a server you have access to (http://cr.yp.to/djbdns.html http://www.powerdns.com/en/products.aspx -- the powerdns resolver, for instance). It's not really that hard. You loose the benefit of prepopulated DNS caches, though. I'm sure something equivalent exists for Windows. Bind (*blech*), for instance.
Not in the realm that/any/ human would notice, but heck, you're talking to people who can "feel" the difference between 80 and 120 fps, who have the l33t sk1llz required to react to something they see within less than 0.5ms, and generally will believe anything a cool rendered babe tells them about the latest r4d graphics card.
"The faster your ISP service is, the lower your latency will be. The lower your latency is, the less Lag youll experience."
Certainly. Get a satellite uplink. It's faster.
"If there are applications or background tasks running, its a sure bet that your machine is going to devote some CPU to it. Dont let it happen!!!!"
Correct. Please kill explorer.exe, all svchost.exe, winlogon.exe, and anything that does not look like cstrike.exe. Your gaming experience will be much improved !
"Nothing can slow down a machine like a good dose of Spyware. Dont let those murderous bastards who write Spyware ruin your game."
Like the ones you got when you disabled your AntiVirus and Firewall. (For many people, they are one and the same)
"When you decide between playing on a server with a ping of 36, or a server with a ping of 150... choose the 36!!! Seriously, if you connect to the server with a high ping you will not only expose yourself to potential Lag, but you will expose everybody else as well. Everybody loses when somebody with a terrible Ping signs onto the server."
Pure and utter bullcrap on the last part.
I love sites like that. I love it even more when a l33t pr0-g4m3r w/sk1llz tries to educate me based on that stuff. It's fun, every time.
-Translate text on the fly into languages with non-arabic characters
Such as, y'know, Latin ones ? And Arabic numerals ?
Though let me add something else to the list :
- Collect a lot of data. After a while, send it back to them... The user goes to ebay.com and the first thing he sees is "Hey ebaymemberxxx, the password to your mailaccount is XXX, you have visited pornsite YYY recently, your bank is ZZZ, and you really should be more courteous to your wife in your mails." Don't do this consistently, just every now and then automatically insert it in webpages for them.
No lengthy and buggy "WGA" product check neccessary. No advanced computer knowledge neccessary. Browser restart is required, operating system restart is not.
This POS is neither new nor newsworthy nor useful, at least not for the reasons they try to sell it to you for.
An alternative-root DNS system will never work (since Critical Mass is impossible to attain).
Myspace will not get faster. Whoever made you believe that is selling snake oil, too.
In fact, your DNS will actually slow down by a good bit; at least if you belong to the majority of the world (unlike root DNS servers, which actually deliver geographical and network dispersion). The big cache they are so proud of will create lots of problems if they actually do it differently from regular DNS resolver caches that you have at every major (and minor) ISP -- and those will be a lot closer to you than OpenDNS ever will.
Fixing typos is a double-edged blade. Sure it's nice if slashdo.torg works. How about whitehouse.gom, though ? And who decides that microsaft.com is really typo-squatter ? (They might just make nice juices !)
Their business model is funny, too. They sell advertisement for search pages in case they can't figure out where you want to go. This is hilarious, really. The selling point is that it can send you to the right page when you make a typo, but not figuring out what a typo was supposed to mean makes them more money. Hrrm. The better they become at their game, the less money they get ! Brilliant ! (Not to mention that this is precisely what got Verizon into hot water with their SiteFinder crap).
How on earth will OpenDNS stem the tides of spam ? Even IF it had a chance doing that purely with DNS, if it was relevant at all Spammers would find a way to make it inconsequential.
Last, but not least, their company is small. There is no oversight. I don't know whether I want to trust a group of 20 people to decide who is an abuser and who is not. I'd rather have hundreds of parties involved in the process, providing a stable balance to one another. (Fun scenario : OpenDNS gets bought out by DirectRevenue.com, starts redirecting EVERY DNS request to their own servers, encasing every website with a nice adbar. Oops. (points for doing it after attaining critical mass).
True enough. However, if it accomplishes the feat by scrambling the serial number and then deleting itself (after properly spreading itself, of course), blame will fall on Microsoft in most of the cases.
All it takes for M$ to have the PR-blunder of a lifetime is to have one single worm out there whose perpetrators figured out how to change the Windows XP serial number. Right now it would already be pretty annoying if such code were introduced into the fast-spreading worms (WGA notifications for everybody !), if they do it the day after WGA goes into kill-mode there'd be hell to pay.
(kill mode, incidentally, is the right word. Somebody somewhere is bound to have made a mistake on critical equipment; while far-fetched, just imagine some emergency service's system going down due to this during a catastropic event)
That is, of course, if this has not already happened.
There are not many guns TO take off the street, as it's not ridiculously easy to get one in Germany. You can't buy bullets at the next Wal-mart, either.
That having been said, there are problems worth their time, at least more than this crap.
You seem to fail to recognize cynicism and sarcasm when presented with it. You quite obviously also lack a solid founding in geek pop culture, or you'd know what movie that quote is from. Taken in context, the OP does not laugh at the matter in any but the most cynical way.
Does anybody here remember BrainBench when they offered their tests for free and with free paper certs sent to you if you passed, or passed at master-level ?
I was fresh out of highschool and got around 40 of those certs, 20 of which at master level, one of which, in their ranking system, in the top 10 of all takers (Internet Security Specialist, I like that one:) It was a fun way to pass a few hours. Getting a perfect score was near impossible (the test adapted; get an answer right, and you get a harder question next time), but passing was doable. I now have a stack of those certs printed on nice paper, a few with the golden master star in a folder somewhere.
My point is that, while some of them correctly assessed my proficiency in some sectors (Perl, TCP/IP, Unix, etc., at least that's what I thought), others I had absolutely no prior experience in (Telecommunication Industry Analyst, Microsoft Office Worker, some obscure programming language) incorrectly passed me as well, sometimes at master level. This is with no prior work, just using common sense, and at times, Google (which was explicitly allowed).
Some time later, I took the LPI Level 1 test (heck, company paid for it), and had a look at some of the MSCE prep material and practice test (for the heck of it). The questions were not all that different, and considering you can't use Google on most of them, en par (i.e. easier).
Since then they have started charging for the tests, so I stopped having fun trying to pass new ones on first try. But one thing that stuck was that such certifications, barring very few exceptions, are completely worthless. All they test is whether or not you can soak up information on a topic for a test, or barring that, use Google and your own resources to figure out answers to questions. They don't test whether you can actually apply that knowledge, or whether it will last any amount of time. An one-hour interview can tell you much more about a candidate than the alphabet soup ever will. If that candidate is like me he had some fun doing those tests. Hopefully.
While your thoughts may be in the right direction, they are still wrong, at least from anecdotal evidence (that's worth nothing, but neither are theories without any support from facts or statistics; and even those are of questionable value).
Case in point : About a year ago, I had the lovely distinction of being on the receiving end of a joe-job (i.e. a LOT of spam apparently originating from my own eMail address -- fraudulently, of course). As such I had the privilege of seeing how exactly that spam run unfolded.
I went to the site advertized in the mail and poked around a bit. Low and behold, the directory indexes were turned on, and there was no index.html... Also, there was a cute little file called "database.db". When I first looked at it, it was virtually empty (there was a test string in there). I reported the site to the webhoster it used and the various upstreams listed in whois. Nothing was done, unfortunately. Spam-bounces kept rolling in, procmail had quite a bit to do to weed out the automatic responses. I also got lots of threats. Heck, one of those idiots even called me.
Either way, a few days later I rechecked the site. It was still up, the directory was still readable. Only this time, the database.db was substantially bigger. The site sold some herbs or pills or whatever it was they sold and solicited email, address, and credit card details. All those were present, in plaintext, in the database.db file. Thing is, in just three days, that site seems to have accumulated several hundred orders of $50+ each, as witnessed by the personal details and credit card numbers present in that file.
I sent that file to mastercard and visa; Never heard back from them. (If I can find that file, so can countless others) The site was gone the week after (i.e. the next time I checked), but my guess would be that this particular spamrun was rather successful. $10000+ is a lot of dough.
So... Unless things have drastically changed (and I won't assert they haven't), spam does make money. And it won't really stop either -- there are new users on the internet every single day, and lots of them. They have not yet been burned, they have not yet been educated, heck they may not yet have much spam in their inbox. Combine that with insecurity about the size of their and the "anonymity" of the internet, and you have a goldmill. That is, if you beat out all the competition in the spam-market, which, I would assume, is a cut-throat business.
Slashdot Mirror
It's probably the reason (not having server services run reliably), but that is /really/ not a technical one.
Note that your connection can stay completely idle for those 24 hours, or pump a full 16mbit/s through it for 24 hours -- you can also reconnect immediately after the forced disconnect; it doesn't really do anything to prevent idle connections or "unecessary" (that term should be defined by the paying customer, not by the telco) traffic.
Thanks for this, I needed some comic relief :)
:)
(the above was written by man, and genetic memory was not even a far-fetched thought back then. I love it when people try to cite that (admittedly in some stretches quite entertaining) book as a way to instill fear and prophecize whatever it is that is currently worth prophecizing to the citer
Quite correct, but said directive has not been transformed into national law in Germany, yet, so what T-Online is doing is, put simply, illegal; whether or not it will be legal 3 months from now is a different matter.
"logging IP addresses" means logging which IP address your connection had at a particular point in time within the last 80 days. (so a lookup of 1.2.2.4 in their database would yield "mxs", or whatever my customer number is)
... wouldn't UDF work as a replacement for fossilfs ?
hrrm
This problem could be handled differently. You could tear down a PPPoE connection if no data has flown through it in 24 hours, for instance, or automatically reset the connection if new LCP packets arrive indicating the customer wants to set up a new PPPoE connection; also contrary to popular belief, you can set up multiple PPPoE sessions on the same wire; they need to have the Host-Uniq flag set, or use different MACs -- but it is possible; for instance, you can open connections to T-Online and Titan Networks over the same link easily (I actually use this for native IPv6 connectivity from Titan).
Also, if this WERE the reason for this idiotic behavior, you would not be able to get business service on the exact same line from the exact same access concentrator using the exact same infrastructure that did not have this limitation. Of course, the price is not exactly the same in that case.
Did you miss that AOL and TW merged ? Many ISPs are part of larger conglomerates, or in bed with parts of the media industry. That should be enough incentive. ... Fat lot of good that does, but hey, it seems to intimidate enough). Another ISP (I think it was T-Online, way back) sent letters to their bandwith-hogs reminding them not to do illegal stuff with their connection -- the ONLY metric used in that case was bandwidth used, not any indication of any wrongdoing. So if you were merrily sharing Warcraft patches or Firefox releases using BitTorrent you would get such a letter.
Traffic usage logs are interesting as well; one broadband ISP (1&1) in Germany regularily offers some of their customers $150 if they leave for another provider, since these customers actually used the bandwidth being advertized and generated generous amounts of traffic. You can't do that without retaining information on traffic usage.
Other ISPs might use this to segment their userbase a bit so that the bandwidth-hogs get lower traffic priority than the "good" customers. This is rather common (or used to be so) in Switzerland. Some ISPs take it as a metric to decide whether certain ports should be blocked for a certain customer (a notable one, also in Germany, blocked port 1214 and some other notorious filesharing ports; if you asked them about it, they'd lift the block -- but only if you signed a contract that you are not breaking the law
Maybe the network admins per se can't do much with that data, but the accountants & salesforce sure can.
The ISP in question stores your assigned IP, duration of the session, start-time of the session, bytecounters up/down, username, and probably access concentrator (i.e. which physical land line was used).
... Peanuts. :)
No logs of website accesses or acribic list of all packets sent and received are made.
A lot of data is accumulated, but really, what does a terabyte of online storage cost these days
Amazon stores your entire clickstream history, everything you ever did on their website, for an indefinite amount of time. Walmart has some of the largest databases in the world holding all manner of customer and sales records. I'd be surprised if Google ever deleted search logs. archive.org tries to store the entire web many times over.
Storage, per se, is cheap
The laws resulting from that directive will not be in effect before Jan 1, 2007.
Radius, actually. That particular ISP does not use DHCP; all (A|V)DSL(2\+?)? connections are handled with PPPoE, so you get your IP from the PPP session set-up. Connections are reset every 24 hours automatically, and you do not usually get the same IP again after 24 hours (they claim this is done for technical reasons, which is, simply put, BS :)
Yes, there is a use. Law Enforcement LOVES long data retention. Really, they do.
The MPAA/RIAA/IFPI/etc. all LOVE long data retention as well, especially when combined with Law Enforcement.
I'm pretty sure all manner of intelligence services also LOVE long data retention.
I have yet to see a case of a consumer/customer loving long data retention.
Not /exactly/ true. The sample letter speaks of a complaint, but T-Online has every choice not to comply.
The linked webpage then recommends sueing T-Online in that case. If/Once you win that lawsuit, T-Online has no choice but to comply. This is a tad different from what the blurb here would have you believe.
(All this is based on rather strict privacy laws that require a provider not to collect any data not relevant to accounting; since IP addresses and data volume is not needed for accounting on plans with a flat fee per month, T-Online has no right to do so; they, however, save that data for 80 days.)
This service is only available within the US. The client seems to determine whether it is in the US by sending a GeoIP lookup request via SOAP. I won't tell you the address, you can do the legwork yourself.
Interestingly, that soap-request contains the amazon username and password to do further SOAP GeoIP lookups.
If you were really devious, you'd either proxy that stuff or manipulate the SOAP response. Nobody here is devious, right ?
You could also set up your own personal resolver locally or on a server you have access to (http://cr.yp.to/djbdns.html http://www.powerdns.com/en/products.aspx -- the powerdns resolver, for instance). It's not really that hard. You loose the benefit of prepopulated DNS caches, though.
I'm sure something equivalent exists for Windows. Bind (*blech*), for instance.
And they both DO help to reduce "lag".
/any/ human would notice, but heck, you're talking to people who can "feel" the difference between 80 and 120 fps, who have the l33t sk1llz required to react to something they see within less than 0.5ms, and generally will believe anything a cool rendered babe tells them about the latest r4d graphics card.
Not in the realm that
"The faster your ISP service is, the lower your latency will be. The lower your latency is, the less Lag youll experience."
Certainly. Get a satellite uplink. It's faster.
"If there are applications or background tasks running, its a sure bet that your machine is going to devote some CPU to it. Dont let it happen!!!!"
Correct. Please kill explorer.exe, all svchost.exe, winlogon.exe, and anything that does not look like cstrike.exe. Your gaming experience will be much improved !
"Nothing can slow down a machine like a good dose of Spyware. Dont let those murderous bastards who write Spyware ruin your game."
Like the ones you got when you disabled your AntiVirus and Firewall.
(For many people, they are one and the same)
"When you decide between playing on a server with a ping of 36, or a server with a ping of 150... choose the 36!!! Seriously, if you connect to the server with a high ping you will not only expose yourself to potential Lag, but you will expose everybody else as well. Everybody loses when somebody with a terrible Ping signs onto the server."
Pure and utter bullcrap on the last part.
I love sites like that. I love it even more when a l33t pr0-g4m3r w/sk1llz tries to educate me based on that stuff. It's fun, every time.
Such as, y'know, Latin ones ? And Arabic numerals ?
Though let me add something else to the list :
- Collect a lot of data. After a while, send it back to them
No lengthy and buggy "WGA" product check neccessary.
a 2006-45.html to a fix deployed : 1 day.
No advanced computer knowledge neccessary.
Browser restart is required, operating system restart is not.
(this is in the case of a Windows user).
Turnaround time from the reporting of http://www.mozilla.org/security/announce/2006/mfs
I'll leave the comparisons up to others.
The "will support" part is outdated. I have been running debian on amd64 for months. Even sarge has amd64 support.
http://www.debian.org/ports/amd64/
The only difference is, really, that amd64 is on the official main mirrors for etch (and by that, I mean it has been for months).
It runs great.
Forgive me, I did of course mean Verisign. Not that Verizon doesn't have skeletons in their closet, as well :->
This POS is neither new nor newsworthy nor useful, at least not for the reasons they try to sell it to you for.
An alternative-root DNS system will never work (since Critical Mass is impossible to attain).
Myspace will not get faster. Whoever made you believe that is selling snake oil, too.
In fact, your DNS will actually slow down by a good bit; at least if you belong to the majority of the world (unlike root DNS servers, which actually deliver geographical and network dispersion). The big cache they are so proud of will create lots of problems if they actually do it differently from regular DNS resolver caches that you have at every major (and minor) ISP -- and those will be a lot closer to you than OpenDNS ever will.
Fixing typos is a double-edged blade. Sure it's nice if slashdo.torg works. How about whitehouse.gom, though ? And who decides that microsaft.com is really typo-squatter ? (They might just make nice juices !)
Their business model is funny, too. They sell advertisement for search pages in case they can't figure out where you want to go. This is hilarious, really. The selling point is that it can send you to the right page when you make a typo, but not figuring out what a typo was supposed to mean makes them more money. Hrrm. The better they become at their game, the less money they get ! Brilliant !
(Not to mention that this is precisely what got Verizon into hot water with their SiteFinder crap).
How on earth will OpenDNS stem the tides of spam ? Even IF it had a chance doing that purely with DNS, if it was relevant at all Spammers would find a way to make it inconsequential.
Last, but not least, their company is small. There is no oversight. I don't know whether I want to trust a group of 20 people to decide who is an abuser and who is not. I'd rather have hundreds of parties involved in the process, providing a stable balance to one another. (Fun scenario : OpenDNS gets bought out by DirectRevenue.com, starts redirecting EVERY DNS request to their own servers, encasing every website with a nice adbar. Oops. (points for doing it after attaining critical mass).
True enough. However, if it accomplishes the feat by scrambling the serial number and then deleting itself (after properly spreading itself, of course), blame will fall on Microsoft in most of the cases.
All it takes for M$ to have the PR-blunder of a lifetime is to have one single worm out there whose perpetrators figured out how to change the Windows XP serial number. Right now it would already be pretty annoying if such code were introduced into the fast-spreading worms (WGA notifications for everybody !), if they do it the day after WGA goes into kill-mode there'd be hell to pay.
(kill mode, incidentally, is the right word. Somebody somewhere is bound to have made a mistake on critical equipment; while far-fetched, just imagine some emergency service's system going down due to this during a catastropic event)
That is, of course, if this has not already happened.
There are not many guns TO take off the street, as it's not ridiculously easy to get one in Germany. You can't buy bullets at the next Wal-mart, either.
That having been said, there are problems worth their time, at least more than this crap.
You seem to fail to recognize cynicism and sarcasm when presented with it. You quite obviously also lack a solid founding in geek pop culture, or you'd know what movie that quote is from. Taken in context, the OP does not laugh at the matter in any but the most cynical way.
And that, sir, is the only reprieve left, sadly.
Does anybody here remember BrainBench when they offered their tests for free and with free paper certs sent to you if you passed, or passed at master-level ?
:)
I was fresh out of highschool and got around 40 of those certs, 20 of which at master level, one of which, in their ranking system, in the top 10 of all takers (Internet Security Specialist, I like that one
It was a fun way to pass a few hours. Getting a perfect score was near impossible (the test adapted; get an answer right, and you get a harder question next time), but passing was doable. I now have a stack of those certs printed on nice paper, a few with the golden master star in a folder somewhere.
My point is that, while some of them correctly assessed my proficiency in some sectors (Perl, TCP/IP, Unix, etc., at least that's what I thought), others I had absolutely no prior experience in (Telecommunication Industry Analyst, Microsoft Office Worker, some obscure programming language) incorrectly passed me as well, sometimes at master level. This is with no prior work, just using common sense, and at times, Google (which was explicitly allowed).
Some time later, I took the LPI Level 1 test (heck, company paid for it), and had a look at some of the MSCE prep material and practice test (for the heck of it). The questions were not all that different, and considering you can't use Google on most of them, en par (i.e. easier).
Since then they have started charging for the tests, so I stopped having fun trying to pass new ones on first try. But one thing that stuck was that such certifications, barring very few exceptions, are completely worthless. All they test is whether or not you can soak up information on a topic for a test, or barring that, use Google and your own resources to figure out answers to questions. They don't test whether you can actually apply that knowledge, or whether it will last any amount of time.
An one-hour interview can tell you much more about a candidate than the alphabet soup ever will. If that candidate is like me he had some fun doing those tests. Hopefully.
While your thoughts may be in the right direction, they are still wrong, at least from anecdotal evidence (that's worth nothing, but neither are theories without any support from facts or statistics; and even those are of questionable value).
... Also, there was a cute little file called "database.db". When I first looked at it, it was virtually empty (there was a test string in there).
... Unless things have drastically changed (and I won't assert they haven't), spam does make money. And it won't really stop either -- there are new users on the internet every single day, and lots of them. They have not yet been burned, they have not yet been educated, heck they may not yet have much spam in their inbox. Combine that with insecurity about the size of their and the "anonymity" of the internet, and you have a goldmill. That is, if you beat out all the competition in the spam-market, which, I would assume, is a cut-throat business.
Case in point : About a year ago, I had the lovely distinction of being on the receiving end of a joe-job (i.e. a LOT of spam apparently originating from my own eMail address -- fraudulently, of course). As such I had the privilege of seeing how exactly that spam run unfolded.
I went to the site advertized in the mail and poked around a bit. Low and behold, the directory indexes were turned on, and there was no index.html
I reported the site to the webhoster it used and the various upstreams listed in whois. Nothing was done, unfortunately. Spam-bounces kept rolling in, procmail had quite a bit to do to weed out the automatic responses. I also got lots of threats. Heck, one of those idiots even called me.
Either way, a few days later I rechecked the site. It was still up, the directory was still readable. Only this time, the database.db was substantially bigger. The site sold some herbs or pills or whatever it was they sold and solicited email, address, and credit card details. All those were present, in plaintext, in the database.db file. Thing is, in just three days, that site seems to have accumulated several hundred orders of $50+ each, as witnessed by the personal details and credit card numbers present in that file.
I sent that file to mastercard and visa; Never heard back from them. (If I can find that file, so can countless others) The site was gone the week after (i.e. the next time I checked), but my guess would be that this particular spamrun was rather successful. $10000+ is a lot of dough.
So