Those thieves BLATANTLY STOLE THE TERM, and probably didn't pay the originators of it for the use of their linguistic properties. It's plagiarism at the very least - why next thing you know, people will be appropriating the narratives of Brothers Grimm and claiming their fairy tales are now "intellectual property".
No, you don't "know what to do", because they're going to make up new rules any time they feel like it, and they only thing you know to do is unquestioning obedience to our new Homeland Security overlords. That kind of thing made my ancestors start throwing tea in the harbor, ranting in taverns, and writing Bills of Rights that were supposed to prevent _their_ government from abusing the population that hired it.
If there's an actual written law, you can know what the rules are, obey them if you think they're acceptable in a free society, and you can challenge them in court if you think they're not, and you don't have to do anything that's not mandated by law. If there's a secret law, the Rent-A-Feds at the airport gates can order you to do anything they feel like and you aren't allowed to challenge them without being harassed, because you're not allowed to know what really is or is not the law.
Remember that woman they ordered to drink her own breast milk on the pretense that the bottle of it she was carrying for her baby might have been some dangerous substance?
Ever notice how people who look sufficiently ethnic always get the third degree from the Airport Inquisitors, but of course they're just Enforcing Regulations, and you're not allowed to see those regulations , and they'll threaten to separate you from your family and haul you off to limbo of you complain?
Remember when the right to travel without providing identity papers was part of civilized society, and only Commies and non-white South Africans had to put up with internal pass laws? Now the government maintains secret lists of who's not allowed to travel, or not allowed to travel without being harassed, and you're not allowed to know if you're on the list, and the government also has databases of who's been travelling where and when.
It used to be that long-haired hippie freaks like me would get attention from various cops in airports who might suspect that I might be carrying dope, but I had a Fourth Amendment right to refuse searches by anybody except occasionally Customs. Not any more, though usually they're having more fun harassing the ethnics.
Ever notice that whatever bogus requirement they're pushing this time has either "always been the rule", even though it wasn't the rule on the flight you just took in the opposite direction, and wasn't the rule over the last 10 years you've been flying?
Does the law require you to take your shoes off and have them X-rayed rather than walk through the metal detector and hope you don't beep? No, but the last time I was flying, I wore my rubber and cloth sandals to avoid that hassle, and the guards insisted when I walked up to the metal detector that I should have put my shoes through the X-ray like a good sheep. "Is it a rule?" I asked, "Where's it posted?" They snarled at me and dragged me off to the post-metal-detector third degree, even though it hadn't beeped.
Gilmore's doing an abolutely necessary thing here.
Getting a patent requires convincing the patent office that your idea is sufficiently novel that it's not "obvious to a skilled practitioner" in the field. Business method patents, unfortunately, have been widely abused, because the patent office is relatively clueless about prior art and relatively unskilled in any useful field and therefore unable to determine what's obvious to a skilled practitioner, and anything can be turned into a business method by saying "1) Do _X_ on the Internet... 3) Profit!". "Doing _X_ in a P2P network" when the concept of "Doing _X_ in a server-based file transfer application" or "Doing _X_ in a distributed file system" are already known isn't, IMHO, particularly novel or non-obvious, but that doesn't mean the Patent Office isn't clueless. So let's look at _X_ itself.
"Using the hash of a file as a filename for the file" is really a much different concept than "calculating a hash of a file and using it to verify file integrity." It's also relatively orthogonal to the details of any particular hash function, except that some applications need a cryptographically strong hash (like MD5 or SHA1) for which it's difficult to generate collisions, while other applications can work fine with any reasonably well-distributed hash (like basic CRC checksums.) The question is whether the idea is sufficiently novel that it's not obvious to a skilled practitioner in the field, and whether there was prior art that was ignored. The primary patent, 5,978,791 , was filed in 1997, and seems to be a continuation of a patent filing begun in 1995, which implies it was based on work done by around 1993-1994. (Remember that something might seem obvious now, when everybody's been doing it for 10 years, but might not have been obvious back then.) My assumption is that the idea should have been obvious, because I know _I_ thought of it and several variations on it for stuff the cypherpunks community was discussing in the mid 90s, (and if I've thought of it, then it ought to be obvious to skilled professionals also), but I don't have specific documentation around that says exactly when or whether it was published on dead trees anywhere. (Professor Dave Farber of the EFF, who's not the same Dave Farber on the patent (:-), says that yes, this stuff was obvious well before then.)
Another popular patent abuse method is to patent a business method something like "Claim 1 - A system with _these_ parts. Claim 2 - The system described in Claim 1 with _this_ reasonably obvious thing done. Claims 3-10: The System described in Claims 1 and 2 with 7 different minor obfuscated variations. Claims 11: Providing the systems described in Claims 3-10 _on_the_Internet_ and _charging_money_for_it!" and then suing people for violating Claim 2 even though there's nothing novel or non-obvious until you get to claim 8 or 9 or even 11, and Claim 2 might even have lots of well-known prior art (as technology, though maybe not as a business method.)
It's a really strange concept, because the environments they talk about sending it into (toxics, high heat, radiation) sound like they'd kill off the flies they want this thing to use for power, unless they're evil mutant ninja robot-eating flies, in which case they're also unlikely to be a stable food source.
Either they were really desperate for a grant application, or there's something else going on here, like a very specialized military application (e.g. can't use a solar power collector because they're putting it somewhere dark or because that would be too visible to enemy soldiers.)
...and the annoying spammers had a machine call me on the phone and say that I might have accidentally mistaken their ad for junk mail. (It might have been different spammers, and no, I correctly identified their ad as junk mail:-)
Several replies to the parent article have disagreed and said that SPEWS does block people. But it doesn't, and the parent article is correct that that's a spammer lie (as well as a common misperception by some non-spammers who don't RTFM.)
What SPEWS and similar services do is blacklist people, and users of the blacklists can decide whether to use the blacklist to block incoming messages, or whether to use it as weighting in systems like SpamAssassin. I fairly commonly see SpamAssassin ratings that say "X points because it's in blacklist1, Y points because it's in Blacklist2, Z points because it's matches the Nigerian_3 pattern, N points because it's ALL YELLING", etc.
SPEWS does have a reputation for being overzealous, and blacklists that are way overzealous get ignored by users, or given a low SpamAssassin weighting or whatever, as opposed to more conservative and responsible blacklists. But that's a choice you can make.
If she can see colors better than you, then when she sees red, it's because what she's looking at really is RED, in spite of your typical doggish male attempts to get out of trouble by saying that it's just orange or pink. What this means for you is that not only is it still your fault, but it's going to keep on being your fault...
The other thing it means to you is that she can tell scarlet from fuschia from red from cerise from red with that little pattern on it, so when she tells you to fetch the red dress from the closet (Which one? The _red_ one I got at Macy's before that party with those people) then you simply don't stand a chance.
I'm currently running Mozilla 1.7, because Firefox was too flaky around 0.8. Is there any reason I should switch back? (Of course it's worth switching from IE to Moz or FF whenever possible - I'm trying to ask the harder question here.)
Firefox was a bit faster, but not really that much, and it would occasionally crash, losing all my tabs and windows, which very seldom happens on Mozilla. It was nice to have extensions (most of the Firefox extensions don't work on Mozilla), but very few of them were that important compared to not crashing.
I gave up on Firefox around 0.8 because it was crashing too often the same week Mozilla 1.7 came out. Moz's been pretty reliable, though of course Slashdot and a few other web sites often render incorrectly because somebody's playing games with vertical spacing, but a redraw usually fixes that.
Different spammers have different techniques. Using nonexistent domain names is really easy to detect, and anybody who's checking SPF is probably also checking this one. (You just look them up in DNS, and if DNS says they don't exist, reject them - one of the many big problems with Verisign's Sitefinder hijack was that it broke this spam rejection technique.) At the very least, anybody who's not even checking if domain names exist is almost certainly not checking if the domain name has SPF records attached to it.
The article said that Canadian bills were harder to do than US bills, though US bills are harder than they used to be. But the reason this guy was counterfeiting Canadian bills was because he lived in Canada! And the reason for the increase in Canadian counterfeiting was largely that he was pretty good at counterfeiting, though not quite good enough for it to be undetected, and greedy enough to want to make a lot of money, and the Canadian market is enough smaller than the US market that he could make a measurable dent in it. If he'd been enough better at it to make really undetectable counterfeits, like Fred Smith is, it wouldn't be a crime statistic...
What country do you live in?
on
Make Money Fast
·
· Score: 1
Your junk faxer.sig story sounds like you live in the US. But here in the US we no longer have bills larger than $100 for general circulation - they were a casualty of the War on Politically Incorrect Drugs (According to TheFreeDictionary. com, Nixon had them stopped in 1969 to annoy the Mafia.) The last US cashier who got a US bill larger than $100 who didn't work for one of the central banks was the sucker who accepted that $200 George Bush bill the other day.
But yes, the risk vs. reward is an important issue, and there's just the increased amount of work in passing lots of $5 bills - if you want a lot of money, you need at least $20s.
So make C$500s, eh?
on
Make Money Fast
·
· Score: 2, Informative
The US no longer uses bills over $100 in general circulation, mainly because the Feds want to harass anybody engaged in cash businesses, like drug dealing and tax evasion, and force them into electronic banking systems where they're easier to detect. So a Canadian $500 bill is worth quite a bit more than a US $100 bill.
We're on Yellow Alert now, so use the yellow money
on
Make Money Fast
·
· Score: 2, Funny
The US Federal Reserve bank started printing yellow notes in time that we could use them for the Yellow Alert. Once we go into Orange Alert, they'll probably have an orange series (or if the Feds ever stop letting the Department of Homeland Security call us chicken, we could go back to using greenbacks...)
Duh, that was too easy. Never mind those earthquakes and fires and mudslides and power failures and RIAA/MPAA lawyers, at least we don't get hurricanes out here. (Or if you don't like living here in civilization, you could move to Phoenix, like lots of banks and other companies that want low-risk locations for their data centers have done over the last decade or so. Eventually the telecom boom of the late 90s built enough fiber out there to actually support them, and unlike the dotcom/software business crash that made cool stuff vanish, when a telecom fiber company goes bankrupt, somebody else buys up its fiber for pennies on the dollar and keeps operating it. You'll need a bit bigger UPS to handle your air conditioning, but it's no big deal.)
Seriously, though, there is a need to develop good backup software, and businesses need to make sure they're prepared for disasters. Here in California we had the 89 and 94 quakes to remind us, though too much of NYC's business didn't get serious about it until after 9/11.
Lots of people rant about how "somebody" ought to redesign SMTP so it's "better", but it's mostly just talk from people who don't have sufficiently clearheaded ideas about how a mail system should be designed to actually do anything useful. Meanwhile, changes like SMTP-over-SSL are getting introduced and fit into SMTP just fine. And SPF seems to be a useful bandaid that fits nicely alongside, because SMTP and DNS were designed by tool-builders rather than monolith-builders like MSMail/Exchange/Outlook.
The biggest things I've seen that "somebody" needs to fix about SMTP and DNS are 8-bit cleanness, and unfortunately Verisigh's trying to add international domain names by radically breaking DNS for web-only use, and Unicode complicates the details of any character set support issues (not that that's a bad thing, it's just exposing the fact that the job is harder than it looks.)
Let's hit these in reverse order, since your most important point was about phishing, where you were pretty close to correct.
It can help a bit with the phishing case, because your bank can SPF-protect the domain example-bank.com and let you know that they'll always send email from that domain. That doesn't stop phishers from sending email from example-bank.biz or examp1e-bank.com (notice the number 1 in the name) unless Example Bank also bought that name, but it helps. And it doesn't stop them from sending mail from disposable-domain-1e3w243e2e.biz or BankFraudStoppers.com with a big GIF that points back to somewhere other than your real bank unless the recipient pays attention to the sender's domain name, but it helps. Digital signatures could also help a lot, if anybody used them.
It won't help much with viruses - if you get mail from your-coworker@your-company.com, SPF will show that it really came from them, even though they sent the REALLY COOL SCREENSAVER by clicking on the attachment rather than typing it in themselves. It may cut down a bit on mail pretending to be from Microsoft Security with an URGENT SECURITY UPDATE - CLICK HERE RIGHT NOW!!! but not so much.
SPF can prevent you from accepting mail from hijacked machines that fraudulently claims to be from an interesting domain, such as Example-Bank.com or Microsoft.com, or from a freemail system like Yahoo.com. It won't prevent you from accepting mail from hijacked machines that correctly claims to be from a non-interesting domain, like herbal-fake-viagra-2343243214.biz or M1cr0s0ft.com. It also won't prevent you from receiving mail that claims to be from the hijacked system's owner's domain, like spam from one of your coworkers or spam from "(Microsoft Security Update) port-132342134.cable-modem-company.net".
Meng is one of the proprietors of pobox.com, a mail service that lets you have an email address that forwards to whatever your current email address is (whether that's a dial ISP, or cable, or work, or school, or freenet, or freebie email, or whatever.) The business started a decade or so ago in a dorm room, and it's let me keep the same email address in spite of changing ISPs a few times. They also offer POP/IMAP mailboxes now, and they do a lot of spam filtering.
If you have a pobox.com account, and want to send mail as username@pobox.com, you can connect to their SMTP server using SASL or other secure login mechanism, and it'll go out from there. I don't think they're currently using SPF to _prevent_ you from sending pobox.com mail from other IP addresses (or if they are, nobody's checking it, or nobody's sending me bouncegrams.) I have my current version of Eudora configured to be able to send mail out through pobox.com, but I also sometimes send it from my work email servers if I'm VPNed into work, or sometimes through another ISP I use for another email address.
It's possible to configure Eudora, and maybe other email clients, to use a different SMTP server based on which username you send mail from, so if I'm sending mail from joe.example@pobox.com, it'll use pobox's server, and if I'm sending mail from joe.example@my-dsl-provider.net , it'll send mail from my DSL provider's SMTP server (though I almost never use that email address except for mail to the DSL provider themselves, or for test messages.)
SPF never pretended that it would make spammers identify themselves, much less include their True Name, Driver's License Number, Cell Phone, Credit History, or up-to-date ICBM address. You've apparently missed the point, and haven't RTFFAQs.
What SPF does is let real people identify themselves in a way that makes it harder for the spammer to impersonate them. You can make sure that anybody who gets mail claiming to be from Otto@Ottosdomain.com can tell that it really came from you, not from some spammer impersonating you, which reduces the amount of complaints you'd get about the million-email spam run that went out with your name on it and reduces the number of people who received that message because you're in their whitelist.
If SPF or some Son-of-SPF becomes sufficiently widespread that lots of people start rejecting mail from non-SPF-advertising domains, then lots of spammers will start using it - but lots of spammers already get domain names, and just because mail appears to have legitimately originated from herbal-fake-viagra-21343214.biz doesn't make it any easier to track down, unless the spammer is stupider than usual.
The main way it makes it easier to track down spammers is that spammers who use free email services like yahoo and hotmail or cheap dial services like AOL will have to start using those services' mail-sending capabilities, which makes it easier for the services to throttle the amount of spam that goes out with their name on it, and easier to shut down abusers of free accounts quickly. But there are plenty of cheap email providers in China who aren't bothered if foreigners get annoyed as long as the spammers pay in advance, and lots of people with virus-infected PCs who could find the spam going out with _their_ names on it and their SPF verifying that it really came from their IP address.
Some spam comes from little spammers who buy spamware kits thinking they'll M4K3 M0N3Y F4$$T! and it doesn't matter if they make a profit or not - the extra $6 setup cost isn't going to deter most of them, though maybe a few, and if the $6 lower profit discourages one of them, well there's another sucker born every minute. Most spam comes from big spammers who are making higher profit margins. Either way, it's much less than the sales price of one bottle of Herbal Fake Vi@gra.
Somebody else pointed out that spammers are already buying lots of domain names - this just means that the services that are serving the domain herbalfakeviagra1324234.com need to add another couple of records to the DNS record, which is zero effort for the big spammers.
Joe jobs are one problem SPF helps with, but it's not just to prevent spammers from impersonating people they want to annoy. One of the biggest markets for it is big free and cheap mail services like aol and yahoo mail wanting to block forged mail from pretending to be from their site, so they can reduce complaints and reduce the extent to which people discard mail from their real customers.
It's also to prevent them from impersonating well-known senders who might be whitelisted (e.g. Dave Farber's list, Declan McCullagh, Dogbert's New Ruling Class, other popular email newsletters), and to make it hard for phishers to send scam mail pretending to be your bank, etc. Whitelisting is a fairly necessary component of any spam filtering system, and if spammers can forge popularly whitelisted addresses, they'll get more mail through to potential suckers.
Google's advertising technology is good, because it lets them make money by including ads without annoying the users, but that's fundamentally only useful because Google was a sufficiently better search engine than Altavista or Yahoo to attract eyeballs. Visual cleanness is pleasant, and it helps the speed because your browser doesn't waste much time drawing garish graphics like Hotbot did, but again, it's relevance that really helps.
Pagerank was good enough in its original form to do a really good job of putting the most relevant of the 30000 web pages that match your query on page one, and as they keep tweaking it it keeps getting better (though much of the tweaking is simply to prevent advertisers from exploiting Pagerank to grant artificially high status to pages that are inherently uninteresting.) So the amount of my time it takes to find something is much less, because it's almost always the top half of the first page, and I don't have to wade around through uninteresting stuff to find what I want (even though I don't ever bother with the "I Feel Lucky" button.)
The only thing close to Google's quality that I've seen was Northern Lights, which tried to do some value-added categorization that grouped semantically similar results together, but it was a bit slower, didn't have as many pages indexed, and didn't make it financially (I think it eventually sold itself to businesses and the CIA or something.)
Slashdot Mirror
Those thieves BLATANTLY STOLE THE TERM, and probably didn't pay the originators of it for the use of their linguistic properties. It's plagiarism at the very least - why next thing you know, people will be appropriating the narratives of Brothers Grimm and claiming their fairy tales are now "intellectual property".
till somebody loses an eye... From Don Freed's "Live ARR"
If there's an actual written law, you can know what the rules are, obey them if you think they're acceptable in a free society, and you can challenge them in court if you think they're not, and you don't have to do anything that's not mandated by law. If there's a secret law, the Rent-A-Feds at the airport gates can order you to do anything they feel like and you aren't allowed to challenge them without being harassed, because you're not allowed to know what really is or is not the law.
Gilmore's doing an abolutely necessary thing here.
"Using the hash of a file as a filename for the file" is really a much different concept than "calculating a hash of a file and using it to verify file integrity." It's also relatively orthogonal to the details of any particular hash function, except that some applications need a cryptographically strong hash (like MD5 or SHA1) for which it's difficult to generate collisions, while other applications can work fine with any reasonably well-distributed hash (like basic CRC checksums.) The question is whether the idea is sufficiently novel that it's not obvious to a skilled practitioner in the field, and whether there was prior art that was ignored. The primary patent, 5,978,791 , was filed in 1997, and seems to be a continuation of a patent filing begun in 1995, which implies it was based on work done by around 1993-1994. (Remember that something might seem obvious now, when everybody's been doing it for 10 years, but might not have been obvious back then.) My assumption is that the idea should have been obvious, because I know _I_ thought of it and several variations on it for stuff the cypherpunks community was discussing in the mid 90s, (and if I've thought of it, then it ought to be obvious to skilled professionals also), but I don't have specific documentation around that says exactly when or whether it was published on dead trees anywhere. (Professor Dave Farber of the EFF, who's not the same Dave Farber on the patent (:-), says that yes, this stuff was obvious well before then.)
Another popular patent abuse method is to patent a business method something like "Claim 1 - A system with _these_ parts. Claim 2 - The system described in Claim 1 with _this_ reasonably obvious thing done. Claims 3-10: The System described in Claims 1 and 2 with 7 different minor obfuscated variations. Claims 11: Providing the systems described in Claims 3-10 _on_the_Internet_ and _charging_money_for_it!" and then suing people for violating Claim 2 even though there's nothing novel or non-obvious until you get to claim 8 or 9 or even 11, and Claim 2 might even have lots of well-known prior art (as technology, though maybe not as a business method.)
Either they were really desperate for a grant application, or there's something else going on here, like a very specialized military application (e.g. can't use a solar power collector because they're putting it somewhere dark or because that would be too visible to enemy soldiers.)
Toasted for now. Hope it's back later...
...and the annoying spammers had a machine call me on the phone and say that I might have accidentally mistaken their ad for junk mail. (It might have been different spammers, and no, I correctly identified their ad as junk mail :-)
What SPEWS and similar services do is blacklist people, and users of the blacklists can decide whether to use the blacklist to block incoming messages, or whether to use it as weighting in systems like SpamAssassin. I fairly commonly see SpamAssassin ratings that say "X points because it's in blacklist1, Y points because it's in Blacklist2, Z points because it's matches the Nigerian_3 pattern, N points because it's ALL YELLING", etc.
SPEWS does have a reputation for being overzealous, and blacklists that are way overzealous get ignored by users, or given a low SpamAssassin weighting or whatever, as opposed to more conservative and responsible blacklists. But that's a choice you can make.
The other thing it means to you is that she can tell scarlet from fuschia from red from cerise from red with that little pattern on it, so when she tells you to fetch the red dress from the closet (Which one? The _red_ one I got at Macy's before that party with those people) then you simply don't stand a chance.
Firefox was a bit faster, but not really that much, and it would occasionally crash, losing all my tabs and windows, which very seldom happens on Mozilla. It was nice to have extensions (most of the Firefox extensions don't work on Mozilla), but very few of them were that important compared to not crashing.
I gave up on Firefox around 0.8 because it was crashing too often the same week Mozilla 1.7 came out. Moz's been pretty reliable, though of course Slashdot and a few other web sites often render incorrectly because somebody's playing games with vertical spacing, but a redraw usually fixes that.
Different spammers have different techniques. Using nonexistent domain names is really easy to detect, and anybody who's checking SPF is probably also checking this one. (You just look them up in DNS, and if DNS says they don't exist, reject them - one of the many big problems with Verisign's Sitefinder hijack was that it broke this spam rejection technique.) At the very least, anybody who's not even checking if domain names exist is almost certainly not checking if the domain name has SPF records attached to it.
The article said that Canadian bills were harder to do than US bills, though US bills are harder than they used to be. But the reason this guy was counterfeiting Canadian bills was because he lived in Canada! And the reason for the increase in Canadian counterfeiting was largely that he was pretty good at counterfeiting, though not quite good enough for it to be undetected, and greedy enough to want to make a lot of money, and the Canadian market is enough smaller than the US market that he could make a measurable dent in it. If he'd been enough better at it to make really undetectable counterfeits, like Fred Smith is, it wouldn't be a crime statistic...
But yes, the risk vs. reward is an important issue, and there's just the increased amount of work in passing lots of $5 bills - if you want a lot of money, you need at least $20s.
The US no longer uses bills over $100 in general circulation, mainly because the Feds want to harass anybody engaged in cash businesses, like drug dealing and tax evasion, and force them into electronic banking systems where they're easier to detect. So a Canadian $500 bill is worth quite a bit more than a US $100 bill.
The US Federal Reserve bank started printing yellow notes in time that we could use them for the Yellow Alert. Once we go into Orange Alert, they'll probably have an orange series (or if the Feds ever stop letting the Department of Homeland Security call us chicken, we could go back to using greenbacks...)
Seriously, though, there is a need to develop good backup software, and businesses need to make sure they're prepared for disasters. Here in California we had the 89 and 94 quakes to remind us, though too much of NYC's business didn't get serious about it until after 9/11.
The biggest things I've seen that "somebody" needs to fix about SMTP and DNS are 8-bit cleanness, and unfortunately Verisigh's trying to add international domain names by radically breaking DNS for web-only use, and Unicode complicates the details of any character set support issues (not that that's a bad thing, it's just exposing the fact that the job is harder than it looks.)
It can help a bit with the phishing case, because your bank can SPF-protect the domain example-bank.com and let you know that they'll always send email from that domain. That doesn't stop phishers from sending email from example-bank.biz or examp1e-bank.com (notice the number 1 in the name) unless Example Bank also bought that name, but it helps. And it doesn't stop them from sending mail from disposable-domain-1e3w243e2e.biz or BankFraudStoppers.com with a big GIF that points back to somewhere other than your real bank unless the recipient pays attention to the sender's domain name, but it helps. Digital signatures could also help a lot, if anybody used them.
It won't help much with viruses - if you get mail from your-coworker@your-company.com, SPF will show that it really came from them, even though they sent the REALLY COOL SCREENSAVER by clicking on the attachment rather than typing it in themselves. It may cut down a bit on mail pretending to be from Microsoft Security with an URGENT SECURITY UPDATE - CLICK HERE RIGHT NOW!!! but not so much.
SPF can prevent you from accepting mail from hijacked machines that fraudulently claims to be from an interesting domain, such as Example-Bank.com or Microsoft.com, or from a freemail system like Yahoo.com. It won't prevent you from accepting mail from hijacked machines that correctly claims to be from a non-interesting domain, like herbal-fake-viagra-2343243214.biz or M1cr0s0ft.com. It also won't prevent you from receiving mail that claims to be from the hijacked system's owner's domain, like spam from one of your coworkers or spam from "(Microsoft Security Update) port-132342134.cable-modem-company.net".
If you have a pobox.com account, and want to send mail as username@pobox.com, you can connect to their SMTP server using SASL or other secure login mechanism, and it'll go out from there. I don't think they're currently using SPF to _prevent_ you from sending pobox.com mail from other IP addresses (or if they are, nobody's checking it, or nobody's sending me bouncegrams.) I have my current version of Eudora configured to be able to send mail out through pobox.com, but I also sometimes send it from my work email servers if I'm VPNed into work, or sometimes through another ISP I use for another email address.
It's possible to configure Eudora, and maybe other email clients, to use a different SMTP server based on which username you send mail from, so if I'm sending mail from joe.example@pobox.com, it'll use pobox's server, and if I'm sending mail from joe.example@my-dsl-provider.net , it'll send mail from my DSL provider's SMTP server (though I almost never use that email address except for mail to the DSL provider themselves, or for test messages.)
What SPF does is let real people identify themselves in a way that makes it harder for the spammer to impersonate them. You can make sure that anybody who gets mail claiming to be from Otto@Ottosdomain.com can tell that it really came from you, not from some spammer impersonating you, which reduces the amount of complaints you'd get about the million-email spam run that went out with your name on it and reduces the number of people who received that message because you're in their whitelist.
If SPF or some Son-of-SPF becomes sufficiently widespread that lots of people start rejecting mail from non-SPF-advertising domains, then lots of spammers will start using it - but lots of spammers already get domain names, and just because mail appears to have legitimately originated from herbal-fake-viagra-21343214.biz doesn't make it any easier to track down, unless the spammer is stupider than usual.
The main way it makes it easier to track down spammers is that spammers who use free email services like yahoo and hotmail or cheap dial services like AOL will have to start using those services' mail-sending capabilities, which makes it easier for the services to throttle the amount of spam that goes out with their name on it, and easier to shut down abusers of free accounts quickly. But there are plenty of cheap email providers in China who aren't bothered if foreigners get annoyed as long as the spammers pay in advance, and lots of people with virus-infected PCs who could find the spam going out with _their_ names on it and their SPF verifying that it really came from their IP address.
Somebody else pointed out that spammers are already buying lots of domain names - this just means that the services that are serving the domain herbalfakeviagra1324234.com need to add another couple of records to the DNS record, which is zero effort for the big spammers.
It's also to prevent them from impersonating well-known senders who might be whitelisted (e.g. Dave Farber's list, Declan McCullagh, Dogbert's New Ruling Class, other popular email newsletters), and to make it hard for phishers to send scam mail pretending to be your bank, etc. Whitelisting is a fairly necessary component of any spam filtering system, and if spammers can forge popularly whitelisted addresses, they'll get more mail through to potential suckers.
Pagerank was good enough in its original form to do a really good job of putting the most relevant of the 30000 web pages that match your query on page one, and as they keep tweaking it it keeps getting better (though much of the tweaking is simply to prevent advertisers from exploiting Pagerank to grant artificially high status to pages that are inherently uninteresting.) So the amount of my time it takes to find something is much less, because it's almost always the top half of the first page, and I don't have to wade around through uninteresting stuff to find what I want (even though I don't ever bother with the "I Feel Lucky" button.)
The only thing close to Google's quality that I've seen was Northern Lights, which tried to do some value-added categorization that grouped semantically similar results together, but it was a bit slower, didn't have as many pages indexed, and didn't make it financially (I think it eventually sold itself to businesses and the CIA or something.)