Slashdot Mirror


User: mjh

mjh's activity in the archive.

Stories
0
Comments
936
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 936

  1. Re:Proposed email subject lines. on Slashback: Spamnation, Long-Distance, Libel · · Score: 1

    There are a number of things that you can do with mailing lists. But unfortunately, since there are so many different types of mailing lists with so many different configuration options, there typically isn't one single, easy to set up solution.

    For what it's worth the TMDA documentation on the web site is pretty good. As for me, I tend to use TMDA sender addresses to subscribe to mailing lists. More details here. And, of course for anything more complicated than the docs can handle, there are the TMDA mailing lists, which can be accessed without subscribing through GMANE

    Once you've gotten a little bit comfortable with TMDA, this is a pretty good reference for using it with mailing lists.

    Good luck.

  2. Re:Proposed email subject lines. on Slashback: Spamnation, Long-Distance, Libel · · Score: 3, Insightful
    The main problem with laws such as these is that they just will not work.

    Of course they won't work. But that's not the point. SPAM is not a technological problem. It's a social problem. Technology alone can't solve it. And, unsurprisingly, the law alone can't solve it. But combined, there's hope.

    The reason that I want a law against spam is to continue to keep spammers using fake email addresses. To keep them from going to actual email addresses. If spam is illegal, then there's a disincentive to be easily tracked by using a real working email address. Why do I want spammers from using real email addresses? Because the most effective way I've seen to block spam is TMDA. And it's spam blocking ability depends on spammers not having working email addresses.

    TMDA requires users to authenticate themselves by verifying that they can be tracked to a working email address. If they can, then they can send me email. Spammers don't do this. So they don't get into my mailbox.

    But if everyone started using TMDA, then there would be an incentive for spammers to start using real mailboxes in order to get around the fact that everyone is blocking them. But a law which disincents getting tracked makes TMDA stronger.

    The fact that a law, alone, won't fix spam doesn't mean that it won't help. And, frankly, I think the technology needs help, because this is a much harder problem than technology is accustomed to solving alone.

    $.02

  3. Re:Ignant on 98% of DNS Queries at the Root Level are Unnecessary · · Score: 1
    Ummm, no. "inverse" does not in any way shape or forme identify a request for the hostname associated with an IP address.

    Yeah, most of the time so-called "reverse lookups" are done by doing a normal query of a PTR RR. But there is also, an obscure DNS query called an iquery, where the answer is prefilled in with the IP address and any name. If the query type is IQUERY, then the server (if it supports it) is supposed to lookup the name that corresponds with the IP address.

    More details here. See section 6.4.2.

    So, basically, the previous poster is right. But as far as I know they're hardly ever used. They are, however, part of a security vulnerability of DNS. So I wonder if the 98% of packets sent to the root namesevers indicate that 98% of the time, those nameservers are really under attack.

  4. Re:hopeless on Plan for Spam, Version 2 · · Score: 1
    Until we have quantum computers, we're stuck with black lists, which work pretty well anyway.

    ... or software managed whitelists. This software assumes that everyone is blacklisted until they can prove otherwise. This system will work until spammers start using real, working return mailboxes. At which point, 99% of the battle will have been won.

  5. Re:Ok... I'll do the math on 11 Digit Dialing Comes Home to New York · · Score: 1

    Yes, of course, you're right. I "cut & pasted" the wrong number.

  6. Ok... I'll do the math on 11 Digit Dialing Comes Home to New York · · Score: 1

    Old
    [2-9][0,1][1-9] => 8 * 2 * 9 = 144 area codes
    [2-9][2-9][0-9] => 8 * 8 * 10 = 640 exchanges
    144 * 640 * 10000 = 921,600,000 total numbers

    10 digit
    [2-9][0-9][0-9] => 8 * 10 * 10 = 800 area codes
    [0-9][0-9][0-9] => 10 * 10 * 10 = 1000 exchanges
    800 * 1000 * 10000 = 8,000,000,000 total numbers
    7,078,400,000 more than old way

    11 digit
    [0-9][0-9][0-9] => 10 * 10 * 10 = 1000 area codes
    [0-9][0-9][0-9] => 10 * 10 * 10 = 1000 exchanges
    1000 * 1000 * 10000 = 10,000,000,000 total numbers
    2,921,600,000 more than 10 digit
    9,078,400,000 more than old way

  7. Re:An argument FOR egress blocking port 25 on MIT Spam Conference Conclusions · · Score: 1

    I'm sorry that you've suffered these attacks. Truly I am. But I want to run my own mailserver on my cable modem. It is part of the terms of service for the ISP that I use. I specifically looked for a cable modem ISP that would allow this.

    So, please don't interfere with my relationship with my ISP by suggesting that they restrict my service. I'm sorry that you are suffering because of spammers. But I'm not the one you're after. I'm using a mailserver for my own purposes. I don't spam people. I don't spam you. But if you could, you would have my ISP shut down this service that I pay for.

    Sorry, but I think that's intrusive. You're trying to solve your problem by devaluing my service. I think you're overstepping your bounds. And, for what it's worth, I do understand the problem, and I've spent weeks chasing down abuse like this, slogging through conflicting privacy policies and abuse policies. At no point when I was doing this did I ever suggest that some part of your internet service be shut off. So please, pay me the same kindness.

  8. Re:An argument FOR egress blocking port 25 on MIT Spam Conference Conclusions · · Score: 1
    OK, twice you have accused me of trying to dictate what your ISPs terms with you should be. I'm not doing this. Period.

    My apologies. I was just trying to say how I understood what you were saying. Thanks for correcting me. It wasn't meant to be an accusation.

  9. Re:An argument FOR egress blocking port 25 on MIT Spam Conference Conclusions · · Score: 1
    Now do you think spam is a filtering problem or is it in fact a DoS attack? I think its the latter...

    If someone wants to deny your service, blocking port 25 is the least of your worries. There are 65534 other TCP ports available, including port 80. And worse yet, there are 65535 UDP ports available which are trivial to forge and all are completely untrackable. And as far as tracking goes, the stuff that typically flies over port 25 is incredibly easy to track (follow the yellow brick "Received" header).

    What would you advocate if you started getting DoS'd on port 80?

    if the users couldn't get fast access to AOL's mail servers from another providers line, then this common problem would not exist.

    Oh sure it would. It wouldn't be in the same form, but DoS attacks are simple to implement and there are 131069 other ports on which to do it. Blocking everyone's access to a limited number of outbound ports is a really *bad* way to solve a DoS problem. In fact, there are really no good ways to solve DoS problems. I don't think that spam is a DoS problem. It may accidentally cause a DoS, but that's just a symptom. Not the cause. If you only treat the symptom, it'll turn up somewhere else in a different form.

    So please stop advocating blocking port 25. It doesn't solve your problem and it creates a whole different set of problems for lots of people who want to run their own mailservers.

  10. Re:An argument FOR egress blocking port 25 on MIT Spam Conference Conclusions · · Score: 1
    I'm curious how you handle DNS issues with a dynamic IP. My first instinct here would be a problem propogating changes when your ISP gives you a new IP. Is there a service for people who need domain name to dynamic IP resolution I haven't heard of? Links...

    There are *many* services that do this. Let me list the two that I've used:

    1. The first one is free and doesn't require you to buy your own domain. Simply create your own name in one of a bunch of available names, download one of the automatic update clients, and off you go.
    2. The second one is free if you register your domain with them. You can either register a new domain with them, or transfer your domain to them. Doing so means paying at least some amount of money in order to create/transfer your registration with them for a minimum of (I think) one year. But the cost is no more than the standard registrars are getting... so it's sorta free. In any case, they also provide dynamic dns service.
    I actually use both of these services at the same time. A DNS lookup on mhorn.dyndns.org and hornclan.com *should* show the same IP address. The DNS update software I use is ddclient. It allows me to update both names whenever a change happens, which is surprisingly infrequent.

    Dude, I can't do a damn thing about what your ISP allows on the net. If someone doesn't like it, they won't accept traffic. What I'm saying is that an ISP should be able to let you run your server and block port 25 from everyone who isn't so we can all stop getting spam delivered from personal firewall software.

    What I hear you saying is that you want an ISP that you don't have a relationship with to impose some rule on me, one of their paying customers, by filtering outbound port 25. I'm saying that you're external to the realtionship between me and my ISP. You don't, and shouldn't, have any say in that relationship. That should be between me, their paying customer, and them. And all of this talk about filtering port 25 comes down to someone else defining the rules between the ISP and their customers. Someone else imposing their will on something to which they have no relationship.

    I hate spam as much as the next guy. Really I do. But I'm not willing to live in a filtered internet to get rid of it. That just seems too much like censorship to me. And as long as I'm the paying customer, and there's sufficient ISP competition, I'll be the one defining the terms of the relationship.

  11. Re:An argument FOR egress blocking port 25 on MIT Spam Conference Conclusions · · Score: 1
    People, this is residential service you are getting here.

    So?

    If you need to run your own mail server you need to find out about that when you sign up for service.

    I did, and it's allowed. And I don't need to run my own mail server. I want to run my own mail server. And I want to run my own mail server because TMDA is the most effective spam blocker that I've tried. It's a *ton* easier to use with your own domain and mailserver.

    A typical residential user never needs to connect to any SMTP relay except the ones the ISP provides.
    Again, so? Are you saying that since some of these dynamic IPs can be used by spammers, that all should dynamic IP's should be considered bad? I suppose that you also support the RIAA's suggestion of a tax upon all ISP's because of file sharing.

    If you're responsible enough to run a mail server, and you really NEED one, get a real account.

    A *real* account is not defined by the nature of the IP address. My service uses dynamic IP address only because static IPv4 addresses are in too high of demand. They simply require oversubscription. That's life. When (if) we ever move to IPv6, what will your solution be then?

    The terms of service of my cable modem allow for running a mail server. That is a term that is between them and me. Stop trying to interfere with it, please... unless of course, you're willing to fund the difference in monthly costs for the static IP address. Didn't think so.

  12. Re:Active Spam Killer / TMDA not mentioned on MIT Spam Conference Conclusions · · Score: 1
    One presenter made an excellent point, though: you can easily say "I've never had a false positive" if you just don't filter very much.

    False postives and false negatives are only interesting for systems that are *guessing* at whether not something is a legitimate piece of email. TMDA and ASK are not doing that. In fact, they're not actually assessing whether the email you send is SPAM or not. They're assessing whether or not that email was sent from a legitimate and working email address. And in that sense they are 100% effective w/out having to fulfill the presenter's point.

    It seems to me a well known fact that the biggest problem with spam is the unauthenticated nature of it. Lack of authentication is what enables spam. If a spammer could be identified by a working emailbox, then 99% of the battle is won. TMDA and ASK turn the spam problem into an authentication problem: get rid of all email that is not authenticated. This has the secondary effect of getting rid of all spam, since no spammer is currently willing to authenticate. It is also very unlikely that they will ever authenticate as it makes them trackable, which cuts into the profit margin. Suddenly spam doesn't need to be 0.01% effective, it needs to be 10% effective (these are guesses) in order to be profitable.

    So, I'm glad your system hasn't been tagging your good messages as bad; how effective is it at getitng rid of the bad ones, though?

    I've been using TMDA for a year now. I have not received a single piece of spam through that system in that time. I used to receive 100+ per day. So that's a sample size of at least 36,500 spams. How's that for effective?

    I'm really disappointed that the spam conference looked only at the AI aspects of spam detection. There are other ways.

  13. Re:"Open Source" vs. "Free Software" on Microsoft Opens Code Just Slightly More · · Score: 2
    p.s. The above is an example of sarcasm. If you are a regular Slashdot reader, the concept may be unfamiliar to you. I suggest a dictionary.
    Really? I guess it depends on your intent. If you're trying to be funny, it's more like parody. If you're trying to be insulting, then it's more like sarcasm.
  14. Re:"Open Source" vs. "Free Software" on Microsoft Opens Code Just Slightly More · · Score: 2
    p.p.s. Speaking of dictionaries, look up "free" while you're at it.

    Ok. I did that. Note that the first definition is:

    1: able to act at will; not hampered; not under compulsion or restraint; "free enterprise"; "a free port"; "a free country"; "I have an hour free"; "free will"; "free of racism"; "feel free to stay as long as you wish"; "a free choice"

    This is much more in line with RMS' usage when he talks about "free software". You have get to the 3rd definition before it starts talking about no-cost. That you would whittle the word "free" down to the single meaning which pertains to money is fine, I suppose. If I were going to choose one definition, it'd be one that carried a lot more impact than just "I don't have to pay".

    $.02

  15. Re:section 7 doesn't fly on SCO Threatens to Press IP Claims on Linux -$99/cpu · · Score: 2
    IANAL, so please help me understand what you're saying.

    But the GPL requires not only the freedom to redistribute, but to distribute arbitrary derived works. So really, the above should read "... would not permit royalty-free distribution of arbitrary derived works".

    The GPL does not require the ability to redistributed "arbitrarily" derived works. That would imply that any derived work can be redistributed. But it can't. Specifically, if the derived work includes patent incumberences, then it can't be distributed.

    That's the point of this clause.

    But this is clearly nonsense: If I added one-click shopping to GNU ls, I would not have a license to distribute the result. So by section 7, nobody can distribute GNU ls under the GPL.

    I don't see how you're not being able to distribute "one-click GNU ls" means that no one can distribute GNU ls under the GPL.

    The license permits you (and anyone for that matter) to distribute unmodified GNU ls. It also permits you to distribute modified GNU ls if those modifications are also covered by the GPL. Those modifications may be covered by the GPL if they do not include patent incumberences.

    IANAL, but this seems pretty simple to me. Am I misunderstanding what you're saying?

  16. Re:But you can get NFL Sunday Ticket a la carte! on More Details About HDTV Pact · · Score: 2

    You are my hero!

    (I'm a Packer fan in N. Carolina)

  17. Re:Anyone know contract law? on Windows Refund Day II · · Score: 4, Interesting

    IANAL, but in the case of the refund, the EULA requires that you get your refund from the OEM. If the OEM refuses to provide the refund, Microsoft is not in violation of the EULA. Since Microsoft is not breaching the agreement, you are probably still bound to it.

    But remember IANAL. This could be totally wrong. Any lawyers?

  18. Re:What's the fuss? on MS Asking Makers of 'Windows' Software To Rename · · Score: 2
    In other words, to refute your first sentence, absolutely nobody I know would think that "Windows Backup", presented in an appropriate manner, was produced or sanctioned by M$

    Well, that's the rub, isn't it? Of course if it's presented in an appropriate manner, it's not going to be confusing. But the only presentation that matters for this is the name (i.e. "Windows Backup"). Without any additional context, it's not too difficult to imagine someone getting confused as to who produced it or sanctioned it.

  19. Re:Quantum observers on Relativity Finally Meets Quantum Theory? · · Score: 1
    And as what we're talking about here is a physical theory, which you'll note was created by humans, and is essentially a human construct, it will also follow human logic

    How do you know that it's a human construct? I frequently direct my children in such a way that they think that they came up with the idea to clean their room, I even give them the credit for coming up with the idea, but it was clearly directed by me. Usually it goes something like this:

    me: wow, this is sure a messy room!
    5yo son: hrmph.
    me: what do you think you'd like to do about that?
    son: I dunno
    me: want to hear some ideas?
    son: sure.
    me: well you could leave it like this and if it bothers me too much, I'll pick it up. Whatever I pick up becomes mine, and I'll do with it what I want. What do you think of that idea?
    son: Uhmmm I don't like that idea, you'll take all my toys.
    me: ok, well, maybe we could do it together. You pick up the stuff that you want to keep, and I'll pick up the rest and keep it. How about that?
    son: but I want to keep all of my toys.
    me: well, what do you think you ought to do then?
    son: hey! I'll pick up my room by myself so I can keep my toys.
    me: ok. At what time do you want me to come up here and start picking up what you haven't finished? You think you can finish in 30 minutes or 45?
    son: probably 45.
    me: ok

    How do you know that understanding of physical theory isn't a revelation by God? Can you be sure that everything we know isn't actually just revelation?
    </devilsadvocate>

  20. Re:My God...the consequences on Linux Spurs MS Price Cuts · · Score: 2

    It's interesting though. Although competition has increased, it's still no where near a level playing field. That would only come if all document formats, and all network protocols were fully published and any changes well documented.

    Until that happens there is a huge barrier to entry with switching to Linux (or other free software). Stuff that used to work no longer does. Documents that used to look "correct" now look different. Think about it. If we couldn't convert the gamers, the ones who *ARE* techie, what chance do we have to convert the masses?

    Sure some data centers will switch to linux. It doesn't cost them anything to do it. But as soon as M$ introduces a new incompatibility, they'll be forced to switch back. Becuase even though a few data centers may be switching, NO ONE is switching to linux on the desktop. Which is all that M$ needs to maintain perpetual incompatibility.

    Call me a skeptic, but I don't think that it's a competitive market yet.

  21. What about Tivo? on Will Open Source Ever Become Mainstream? · · Score: 3, Insightful

    Doesn't the Tivo interface indicate that open source in general and Linux in particular is not just ready for the mainstream, but already in use by the mainstream?

    Or are you talking about GUI's? The Tivo gui is proprietary, as is the Apple GUI (another example of an opensource project out in the mainstream).

  22. Re:If you think a little ahead on When Profiling Goes Wrong · · Score: 2

    While I think that your concerns are merited, I am comforted by the fact that polygraph tests are not admissible evidence in a court. Why aren't they admissible? Because defense attorneys, advocating for their clients, have done a good job of convincing the world that their results are not reliable. Hence a court will not rely on those results to make important decisions.

    It's worth speculating about how bad these things could get. And it's worth drawing everyone's attention to how bad decisions could be made from bad data. However, I think that we're a long way away from actually making bad decisions. And there's precedent that suggests that common sense will prevail.

    Of course, for common sense to prevail, it has to be commonly known that these types of decisions methods are ridiculous. A humorous article in WSJ is a pretty good way to get a large group of people aware of the pitfalls of allowing non-sentient things make unimportant decisions for you. It helps people to draw the conclusion as to how valuable it would be to allow the same thing to happen for important decisions.

    $.02

  23. Can you spy on me now? on Verizon Sues to Stop Privacy Rules; Wants to Sell Call Data · · Score: 2

    Good.

    Verizon wireless. We never stop spying on you.

  24. Re:Ultimate Anti-SPAM plan on The Measured Effectiveness of Blocking Asian Spam · · Score: 2
    The next consideration then, is to use a word-filter (and who knows, maybe TMDA does this too), to see if legit mails can be detected by their content. Maybe this could be done using a bayesian (sp?) filter, as recently discussed here, or perhaps SpamAssassin. Emails detected as legit would be delivered directly, and the sender would be auto-whitelisted. Ambiguous emails would go through the usual whitelist-confirmation procedure. This way, the word-filter never actually throws email away. It gives the sender a second chance, by sending it through the whitelist system.

    That's an interesting concept. Personally, I use spamassassin in addition to TMDA. Anything that gets through spamassissin gets processed by TMDA. For what it's worth, spamassassin will autowhitelist addresses. After it's seen what it thinks are 3 legit emails from an address, it'll autowhitelist that address. I had to turn this feature off because way too many spams were getting autowhitelisted. And suddenly email that had previously been caught by spamassassin, was getting through because it was in the whitelist.

    With TMDA, I also have the problem of the occasional legit email getting stuck in pending. But mostly from folks who don't send me that much email. And I've taken the stance that spam is too much of a hassle that if someone doesn't want to confirm my email, then what they had to say to me must not have been that important.

    I try to soften this stance somewhat by the wording that I use in my custom confirmation requests. But ultimately, going from 200+ spams per day to zero is worth the occasional person thinking that I'm not paying attention.

    $.02

  25. Re:Same with (Free)BSD port system on Trojan Found in libpcap and tcpdump · · Score: 2

    Considering that gentoo's portage system is based off of the BSD ports system that's not surprising.