Filtering of any sort does not solve the problem, it just treats the sysmtoms.
Spam wastes bandwidth, and costs money. If I wait until it's delivered and run an automated filter, I still pay to receive it, I just didn't have to spend time deleting it. Whoopee! I want my bandwith back! That means not accepting the spam in the first place.
So far, the only workable technology I've found is DNSRBL. I whish I had a better idea, I could probably make a HUGE profit on it and still save people money. But I don't. Filtering is nice for spam that gets through and it works well. But it's like having a 1gpm sump pump and a 10gpm hole in the boat. It's gonna sink eventually.
I just looked at blackholes.us. Based on what I saw in their text lists, I believe it would be easy to parse out the data into larger blocks (where appropriate) and write a set of iptables rules to block all or some (your choice) of the traffic originating from those IP addresses. If you used this as a choke firewall in front of your web servers performance should be pretty good. For a single fast server, you may be able to do it on the box.
Of course, for the fastest performance you would need an Apache module to deny based on DNS query. Ideally it would do different things based on the result (127.0.0.1 vs. 127.0.0.2) so you could have some granularity in your response, like giving better customers their own server, or blocking based on rough geographic region. Unfortunately, I know of no such animal at this time.
This just goes to show you how far technical skills have
atrophied over the years. I always assumed that this trick was obvious, and that any self respecting geek could do it. Especially since I repaired my first drive (MFM 13 Meg) at 14 years old. I've done it and seen it done numerous times over the years.
I can understand the average geek not knowing how to do board level repairs, though again, my friends and I taught ourselves to do that too at a young age.
Simple subsystem replacement should be something that anyone of average intelligence can do. I am concerned that as I see more of this sort of attitude, "Wow. He swapped a board out on his HDD. That's really cleaver.", it signals the decline of curiosity and experiment. And the rise of Asimov's "calculator people." (They can't do simple mathmatics without a caculating device of some sort.)
The mind, like the body, can be developed and improved, with enough work. But also, like the body, it will atrophy if not exercised.
It just makes no sense from a legal perspective, it is false advertising.
And your point is...?
We're talking about the eletronics industry. A lawyer sitting on the CEOs lap is in the business plan. Of course, the purpose of that lawyer is to retreive the soul after they get away with this sort of thing. Which they will.
doesn't the constitution garauntee against exactly this sort of thing?
You are correct on both counts, except that the US Constitution garauntees nothing. It is a blueprint for the restraint of, and operation of, a government. The problem is that government will not restrain itself. It is up to the people to do that. The founding documents of the U.S. even tell us that we (American Citizens) have the God given right and responsibility to overthrow our government if it becomes tyranical.
Of course there are many other safegards for correcting infringments on liberty short of overthrow. I think that it was, and is, hoped that it will never come to that.
The people, however, must have the will to live free. The Constitution, therefore, does not garauntee freedom. It simply reminds us (U.S. Citizen or not) that we all have a right to take what belongs to us; by force if necessary.
Sic Semper Tyrannis - but only if we take the risk
Most people miss the point completly. No operating system, save a few special purpose systems with things like mandatory access controls and classification tags, is very secure without a great deal of work.
Unix (Linux/BSD/Solaris/etc...) is recognized throughout the industry to be more secureable than any version of windows. This requires an experienced knowledgeable professional initially, as well as, ongoing administration performed by an experienced knowledgeable human being. No system can be made secure, or kept secure for long, without these things at a minimum.
The reason for this is that Unix, in the keeping of a competent Unix admin, allows greater flexability and control than Windows in the hands of an equally competent Windows admin. This is not conjecture, it is the experience of the industry.
The diference in aproach is profound and fundamental. I don't claim that one OS is better or worse for any given aplication, rather that the aproach of Unix to solving the business problem of securing data is fundamentally more sound than that of Windows.
This has nothing to do with how secure or insecure the various apps are. No one can reasonably claim that Linux is more secure than Windows. It does, however, have greater potental to be so, given the self imposed limitations of the Windows approach.
Can we stop arguing about this now? I think that if you look at the various perspectives from which everyone makes their arguments, you will quickly see where the truth lies.
I don't see how effective this could be. How long before spammers get smart and set their SMTP program to give up after X seconds?
Exactly! Sendmail, for example, allows a configuration to get around this all together. If the connection takes too long, say 5 seconds or so, then drop back and punt to your fallback server to deliver at a more leisurely pace. Meanwhile deliver another thousand messages to all of the other sites that don't use this tech.
Don't forget that even without optimization any mailer is capable of handling hundreds of simultaneous connections. All this does is tie up resources on your own machine while the spammer delivers to someone else. You will eventually get a delivery if you accept the connection. If you get a lot of spam, all you do is DoS youself while you NAK all of those packets.
As for tying up spammer resources, how many ISP's are planning to use this? Without ISP buyin, spammers will continue to vomit out garbage toward the low-hanging fruit.
I think that a better solution would be to RST the connection as a result of the stats and blacklist the IP for a few hours. When they retry they get a 550 or something akin, and you don't get DoSed. That is, if you're going down that road at all.
There is actually no Constitutional right to privacy
I would have to say no, you're wrong.
Amendment IX
The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people.
Or more correctly, there are no constitutional rights of any sort. The Constitution does not grant any rights. It simply limits government's legal authority to infringe on the rights we all already have by virtue of being alive.
So, if it's not prohibited or disparaged in some way, then it's our right to do it, say it, think it, not have it done, etc...
Now if we could just get the guys with the guns and tear gas to believe all of that and act accordingly...
So why should any of this article be a suprise or even particulary note worthy?
perhaps because when large numbers of people are uneducated about something they use and make daily decisions about, it is shocking to them to learn that their assumptions (probably brought about by marketing) are erroneous.
Other notable, and obvious "surprises" in research:
-Two parents are better than one.
-More concealed carry = less violent crime.
-You are more likely to get sick at a hospital than at home.
-Breast milk is better for babies than formula.
A lot of money and time have been spent researching these topics, only to find what many of us already knew to be true and obvious.
Not everyone is educated and experienced in everything, and it can be painfully difficult to dissuade people of their delusions. Especially when they've been formed out of ignorance.
You don't need to turn off HTML e-mail to protect yourself. Though it is a good idea if you can stand it.
All you need to do is tell your mailer not to automatically download images. This will result in readable text with no images, and no indication that you read the mail. You should also turn off auto return reciept (less widely, but more correctly known as DSN notification,) and javascript in e-mail as those can be used against you as well.
I don't know how to do these things in Outlook, since I use evolution where the default setting is not to download automatically.
I will do what I want with what I have bought and paid for.
In the case of software, you didn't buy anything except the right to use something with a whole lota strings attached.
You entered into a contract with a vendor, to whom you you gave money in exchange for agreeing to contract with you. The fact that you walk out the front door with a distribution media package does not automatically give you any rights regarding its disposition. And depending on the contract you may have elected to give up certain of your privileges with regard to how you will use the distribution medium.
In short, I believe you are the recipient of a service. (insert pun here) And the paper, plastic, and cardboard are window dressing.
Look at it this way. If the researchers have tackled the fundamental problems, and the engineers have nailed the practical problems, then it's up to the hackers and hot rod'ers to solve the usefulness problems.
Hackers make things behave in ways they were never intended to, and preform in ways not foreseen. To me this is axiomatic, I'm a hacker, not an engineer. We do different things.
If it were any other company I might agree. And in fact you may be right. However, repeated experience with MS has taught many of us that like any master chess player, every move is a threat, no matter how innocuous it may appear.
When your opponent in the market simply wants to be number one, that's one thing. Markets often expand to everyones advantage. But, when they want to own the marketplace that's different. That's to no one's advantage but the monopolist.
I choose to mistrust MS in even the most harmless cases only because so many companies have been burned or destroyed by extending even guarded trust for what appeared to be minor exchanges. The exchange of resources requires at least a minimum level of trust or the market can't function. Even criminals have to take certain risks to exchange goods, but if nearly everyone who attempts to trade with a given partner gets killed (figuratively, in business) and their property stolen, then who wants to trade with them? The desperate or the deluded?
Slashdot Mirror
Filtering of any sort does not solve the problem, it just treats the sysmtoms.
Spam wastes bandwidth, and costs money. If I wait until it's delivered and run an automated filter, I still pay to receive it, I just didn't have to spend time deleting it. Whoopee! I want my bandwith back! That means not accepting the spam in the first place.
So far, the only workable technology I've found is DNSRBL. I whish I had a better idea, I could probably make a HUGE profit on it and still save people money. But I don't. Filtering is nice for spam that gets through and it works well. But it's like having a 1gpm sump pump and a 10gpm hole in the boat. It's gonna sink eventually.
I just looked at blackholes.us. Based on what I saw in their text lists, I believe it would be easy to parse out the data into larger blocks (where appropriate) and write a set of iptables rules to block all or some (your choice) of the traffic originating from those IP addresses. If you used this as a choke firewall in front of your web servers performance should be pretty good. For a single fast server, you may be able to do it on the box.
Of course, for the fastest performance you would need an Apache module to deny based on DNS query. Ideally it would do different things based on the result (127.0.0.1 vs. 127.0.0.2) so you could have some granularity in your response, like giving better customers their own server, or blocking based on rough geographic region. Unfortunately, I know of no such animal at this time.
This just goes to show you how far technical skills have atrophied over the years. I always assumed that this trick was obvious, and that any self respecting geek could do it. Especially since I repaired my first drive (MFM 13 Meg) at 14 years old. I've done it and seen it done numerous times over the years.
I can understand the average geek not knowing how to do board level repairs, though again, my friends and I taught ourselves to do that too at a young age.
Simple subsystem replacement should be something that anyone of average intelligence can do. I am concerned that as I see more of this sort of attitude, "Wow. He swapped a board out on his HDD. That's really cleaver.", it signals the decline of curiosity and experiment. And the rise of Asimov's "calculator people." (They can't do simple mathmatics without a caculating device of some sort.)
The mind, like the body, can be developed and improved, with enough work. But also, like the body, it will atrophy if not exercised.
It just makes no sense from a legal perspective, it is false advertising.
And your point is...?
We're talking about the eletronics industry. A lawyer sitting on the CEOs lap is in the business plan. Of course, the purpose of that lawyer is to retreive the soul after they get away with this sort of thing. Which they will.
doesn't the constitution garauntee against exactly this sort of thing?
You are correct on both counts, except that the US Constitution garauntees nothing. It is a blueprint for the restraint of, and operation of, a government. The problem is that government will not restrain itself. It is up to the people to do that. The founding documents of the U.S. even tell us that we (American Citizens) have the God given right and responsibility to overthrow our government if it becomes tyranical.
Of course there are many other safegards for correcting infringments on liberty short of overthrow. I think that it was, and is, hoped that it will never come to that.
The people, however, must have the will to live free. The Constitution, therefore, does not garauntee freedom. It simply reminds us (U.S. Citizen or not) that we all have a right to take what belongs to us; by force if necessary.
Sic Semper Tyrannis - but only if we take the risk
Most people miss the point completly. No operating system, save a few special purpose systems with things like mandatory access controls and classification tags, is very secure without a great deal of work.
Unix (Linux/BSD/Solaris/etc...) is recognized throughout the industry to be more secureable than any version of windows. This requires an experienced knowledgeable professional initially, as well as, ongoing administration performed by an experienced knowledgeable human being. No system can be made secure, or kept secure for long, without these things at a minimum.
The reason for this is that Unix, in the keeping of a competent Unix admin, allows greater flexability and control than Windows in the hands of an equally competent Windows admin. This is not conjecture, it is the experience of the industry.
The diference in aproach is profound and fundamental. I don't claim that one OS is better or worse for any given aplication, rather that the aproach of Unix to solving the business problem of securing data is fundamentally more sound than that of Windows. This has nothing to do with how secure or insecure the various apps are. No one can reasonably claim that Linux is more secure than Windows. It does, however, have greater potental to be so, given the self imposed limitations of the Windows approach.
Can we stop arguing about this now? I think that if you look at the various perspectives from which everyone makes their arguments, you will quickly see where the truth lies.
I don't see how effective this could be. How long before spammers get smart and set their SMTP program to give up after X seconds?
Exactly! Sendmail, for example, allows a configuration to get around this all together. If the connection takes too long, say 5 seconds or so, then drop back and punt to your fallback server to deliver at a more leisurely pace. Meanwhile deliver another thousand messages to all of the other sites that don't use this tech.
Don't forget that even without optimization any mailer is capable of handling hundreds of simultaneous connections. All this does is tie up resources on your own machine while the spammer delivers to someone else. You will eventually get a delivery if you accept the connection. If you get a lot of spam, all you do is DoS youself while you NAK all of those packets.
As for tying up spammer resources, how many ISP's are planning to use this? Without ISP buyin, spammers will continue to vomit out garbage toward the low-hanging fruit.
I think that a better solution would be to RST the connection as a result of the stats and blacklist the IP for a few hours. When they retry they get a 550 or something akin, and you don't get DoSed. That is, if you're going down that road at all.
There is actually no Constitutional right to privacy
I would have to say no, you're wrong.
Amendment IX
The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people.
Or more correctly, there are no constitutional rights of any sort. The Constitution does not grant any rights. It simply limits government's legal authority to infringe on the rights we all already have by virtue of being alive.
So, if it's not prohibited or disparaged in some way, then it's our right to do it, say it, think it, not have it done, etc...
Now if we could just get the guys with the guns and tear gas to believe all of that and act accordingly...
So why should any of this article be a suprise or even particulary note worthy?
perhaps because when large numbers of people are uneducated about something they use and make daily decisions about, it is shocking to them to learn that their assumptions (probably brought about by marketing) are erroneous.
Other notable, and obvious "surprises" in research:
-Two parents are better than one.
-More concealed carry = less violent crime.
-You are more likely to get sick at a hospital than at home.
-Breast milk is better for babies than formula.
A lot of money and time have been spent researching these topics, only to find what many of us already knew to be true and obvious.
Not everyone is educated and experienced in everything, and it can be painfully difficult to dissuade people of their delusions. Especially when they've been formed out of ignorance.
Can I turn off HTML email in Outlook?
You don't need to turn off HTML e-mail to protect yourself. Though it is a good idea if you can stand it.
All you need to do is tell your mailer not to automatically download images. This will result in readable text with no images, and no indication that you read the mail. You should also turn off auto return reciept (less widely, but more correctly known as DSN notification,) and javascript in e-mail as those can be used against you as well.
I don't know how to do these things in Outlook, since I use evolution where the default setting is not to download automatically.
I will do what I want with what I have bought and paid for.
In the case of software, you didn't buy anything except the right to use something with a whole lota strings attached.
You entered into a contract with a vendor, to whom you you gave money in exchange for agreeing to contract with you. The fact that you walk out the front door with a distribution media package does not automatically give you any rights regarding its disposition. And depending on the contract you may have elected to give up certain of your privileges with regard to how you will use the distribution medium.
In short, I believe you are the recipient of a service. (insert pun here) And the paper, plastic, and cardboard are window dressing.
I see a hacker not a crackpot.
Look at it this way. If the researchers have tackled the fundamental problems, and the engineers have nailed the practical problems, then it's up to the hackers and hot rod'ers to solve the usefulness problems.
Hackers make things behave in ways they were never intended to, and preform in ways not foreseen. To me this is axiomatic, I'm a hacker, not an engineer. We do different things.
If it were any other company I might agree. And in fact you may be right. However, repeated experience with MS has taught many of us that like any master chess player, every move is a threat, no matter how innocuous it may appear.
When your opponent in the market simply wants to be number one, that's one thing. Markets often expand to everyones advantage. But, when they want to own the marketplace that's different. That's to no one's advantage but the monopolist.
I choose to mistrust MS in even the most harmless cases only because so many companies have been burned or destroyed by extending even guarded trust for what appeared to be minor exchanges. The exchange of resources requires at least a minimum level of trust or the market can't function. Even criminals have to take certain risks to exchange goods, but if nearly everyone who attempts to trade with a given partner gets killed (figuratively, in business) and their property stolen, then who wants to trade with them? The desperate or the deluded?