Skip to content

Category: Uncategorized

It’s the end of the world as we know it…

Published October 27, 2003

Wild fires are raging throughout Southern California.

Last night, I was reading J. G. Ballard’s Millenium People (thanks Lean, it’s great!) outside on the balcony, when the Santa Ana winds whipped up suddenly, blowing hot and dry and laden with ash — then the coyotes started howling.

It felt very much like the end of the world… freaky stuff.

Everything is covered in ash; the air smells of wood smoke; the sun is a minute cent-at-arm’s-length red disc; everything is lit in a very odd reddish-orange tint. And the nearest fire is 30 or so miles away. I’d hate to see what they’re like up close…

Somehow I missed all this in Australia… I hear Sydney was like this for a week over Christmas that year.

Some links:

Worst album covers ever

Published October 23, 2003

C sends along a few classic album covers taken from this site. Here’s my favourites:

There’s plenty more…

E-Voting: ACT’s open-source e-voting system

Published October 22, 2003

Voting: I’ve pointed to this before, but I use taint.org partly as a searchable database of annotated bookmarks, so — for reference — here’s the Australian Capital Territory’s EVACS system, an entire, open-source e-voting system:

Tentacle Porn has a long and illustrious history

Published October 22, 2003

The Guardian: Melbourne row over art ‘porn’:

‘Police in Australia have investigated pornography claims against an art gallery which exhibited a painting drawn from a 19th-century woodcut by the Japanese artist Hokusai.

The painting, The Dream of the Fisherman’s Wife, is by an Australian, David Laity, and is valued at £5,400. It is being shown in a Melbourne gallery. Like the 1814 original, it depicts a woman copulating with an octopus.

Katsushika Hokusai was an influential Japanese painter and woodcut designer in the 18th and 19th centuries — more info and pictures here. (There’s a great exhibition of his work on at the Chester Beatty Library in Dublin right now, which is where I caught it.)

He coined the term ‘Manga’ to describe a collection of sketches. Who knew he also came up with the totally bizarre ‘tentacle porn’ subgenre of anime?

On ‘Intellectual Property’

Published October 22, 2003

Patents: One thing that gets pretty confusing when one investigates the whole patents/open-source/copyright protection field, is the nature of the term Intellectual Property.

Control your life support via the Internet!

Published October 20, 2003

Romania Emerges As Nexus of Cybercrime (AP). Contains this glorious nightmare scenario:

BUCHAREST, Romania – It was nearly 70 degrees below zero outside, but the e-mail on a computer at the South Pole Research Center sent a different kind of chill through the scientists inside.

‘I’ve hacked into the server. Pay me off or I’ll sell the station’s data to another country and tell the world how vulnerable you are,’ the message warned.

Proving it was no hoax, the message included scientific data showing the extortionist had roamed freely around the server, which controlled the 50 researchers’ life-support systems.

One question: why was an internet-connected computer controlling the life support systems? eeek.

‘Don’t eat slugs’

Published October 20, 2003

Funny: The Medical Journal of Australia has issued a warning: Australians, don’t eat slugs. ‘The warning came after a Sydney student contracted a potentially deadly form of meningitis after eating a slug for a $20 bet.’

Secsed-up

Published October 20, 2003

Humour: Data::Secs2 — canoncial string for nested data. A format for representing nested data structures in accordance with SEMI E5-94, Semiconductor Equipment Communications Standard 2 (SECS-II), apparently pronounced “‘sex two’ with gusto and a perverted smile.”

Using a Web of Trust to stop spam

Published October 20, 2003

Been thinking about a distributed ‘web of trust’ approach to fighting spam.

Combine those with another key point — that we do not need PKI, crypto, or any other changes to identify senders in current SMTP — and it could be done today, I think.

Why we don’t need crypto to identify an SMTP sender

Every email message delivered via SMTP across the internet will contain these headers:

  • the From line
  • one or more Received headers

Traditionally, whitelisting uses just the From line, which is vulnerable to spoofing. SpamAssassin used this up to version 2.3x. Spammers started spoofing mails where ‘From’ was the same as ‘To’, and since most people had themselves in the whitelist, that worked. boo.

In 2.3x or 2.4x, we added code to extract the IP addresses from the Received headers, and use a combined token — ( from_address, ip_address ) — as the sender’s address.

(In fact, we use just the top 24 bits of each IP to deal with situations like DHCP or dialup pools, where a relay may get a different IP every now and again. That’s close enough, at least.)

This is much harder to forge without doing a full-scale TCP spoofing attack; which is why the SpamAssassin auto-whitelist generally works well.

So basically, to identify someone strongly enough to provide a spam fix in plain old vanilla current SMTP, gen up a string containing their ‘From’ address, along with all the /24 masks of the IP addresses found in the ‘Received’ headers.

Remove your relays’ IP addresses, and you have an unspoofable ID for that person’s SMTP traffic. Any spammer who wants to spoof that, will have to compromise their mail server (or a server in the same /24). That’s not cost-effective for spamming.

Note that whitelisting based on that is effectively what the SpamAssassin auto-whitelist does. But for that to be more useful than the AWL, it has to extend over the internet to those people your friends haven’t corresponded with yet; ie. it’s got to be distributed.

(If you would like to comment on this scheme, I’d prefer if you could post comments at this QuickTopic forum.)

MS on Choice

Published October 18, 2003

Music: This is great. Microsoft’s general manager for the Windows Digital Media division, Dave Fester, on iTunes for Windows:

AdvogatoDay

Published October 17, 2003

Tech: So, I just looked at NTK; it has a brief bit about Bram Cohen ‘having solved content distribution, (announcing) he was now tackling other simple problems: reputation systems, version control and perhaps after lunch the NP-complete set.’

Spamcop and ‘Al-Quada’, sitting in a tree

Published October 17, 2003

The null device reports a spam entitled, ‘julian haight funds terrorists b alqoswmw l lgng’.

Julian haight spamcops CEO is rumoured to have conections with Al-Quada, one of the most disruptive terrorist orginisations on earth. hes specialty is cyber terrorism. which disperses highly needed homeland security funds by rendering multi million dollar industrys unprofitable.

haights main motive is the perversion of American free enterprise.

Oh, the poor spammers! One comment quotes Samuel Johnson: ‘patriotism is the last refuge of a scoundrel’.

Also present is some lovely pictures of Carlton, with trams, greenery, grey skies, and that distinctive turn-of-the-century Aussie architectural style. A couple of years ago, I lived just around the corner in North Melbourne; looking at those photos, it seems like I could just pop out the front door and walk through it all on the way down to the Vic market. They thoroughly evoke day-to-day just-outside-the-CBD Melbourne.

The Bin Tax

Published October 15, 2003

Over the past few months, Dublin has seen increasing resistance to newly-introduced rubbish-removal charges, or as they’re being called, ‘the bin tax’.

Snippets

Published October 15, 2003

Bits: BarbieOS, a cutdown version of Debian from Mattel. Really. ‘BarbieOS 1.0 is the result of almost a year’s worth of marketing research into what pre-adolescent girls want in a mobile Linux solution aimed at being a desktop replacement.’ (via Ben)

The Funniest Thing I’ve Read

Published October 15, 2003

Guardian Talk: The Barefoot Doctor, live online. This is the funniest thing I’ve read in months — thanks Tom!

(Background: ‘The Barefoot Doctor’ is the ‘healer’ who writes for The Observer Magazine on ‘wellbeing, alternative therapies and medicines and ways to cope with modern life’. Everything can apparently be healed through kidney massage and a few essential oils.)

Q: A case study, Mr Barefoot: my bus has crashed – I’ve got a compound fracture in my right leg, the bone is sticking out from under the skin and is wedged into the ‘Used Tickets’ receptacle, my skull has had a good old thump against the seat in front and is impersonating a boiled egg after the first thump with the teaspoon, and my ribs have been broken into bits like a packet of smokey bacon crisps someone has stood on.

What herbs and aromatic oils would you recommend?

Doc: you may jest – however, aromatic oils or potions can be extremely effective in speeding the healing process eg – manuka honey,lavender, marigold etc – thanks for bringing it up

Q: oooh good answer. yes i’m going out to buy some manuka honey right away. what do you do with it, is it nice on toast?

lavender, marigolds? is he opening a kitchen department?

Q: My unfortunate friend received a quite severe beating in the street a few days ago and has since been passing blood in his urine, in copius amounts.

Can recomend any effective massage oils for my friend? Its quite urgent because he’s beginning to talk incoherently about bright lights, can’t move and fainting.

Thank you, 3000

(… snip several hundred similar hilariously bitchy ‘questions’… Barefoot Doctor disappears for a while…)

Q: Where is he? Maybe the Barefoot Cab Driver who learnt to drive by karmic chanting has driven into a tree — or can’t find first gear?

(BTW the real ‘barefoot doctors’ were a different kettle of fish entirely; ‘part-peasant, part-doctor’ commune-level health workers in revolutionary China.)

For Reference: Why Greylisting Sucks

Published October 14, 2003

I’ve been meaning to collate a page about why I don’t like greylisting. My previous posting is relatively useful, but it needs an update, so here it is:

First off, every single message is delayed until a database match is found for the combination of sending IP, envelope-from and envelope-to. As Alan Leghart pointed out, ‘So…we punish everyone in the world, and hope that a delay of one or more hours is considered ‘acceptable’? Maybe some people already expect a mail to take several hours to reach a recipient. In that case, you need to fix your mail server.’

Secondly, large mailing lists that use VERP (generating keyed From addresses for each mail for good bounce-handling) will require manual whitelisting for each list, or each host.

Yahoo! Groups, for example,
uses VERP for all its lists, and also will not retry delivery if the first attempt fails.

There’s even buggy SMTP servers that do not support retrying, believe it or not.

(Once again, as for many spamfilter designs, the unusual SMTP clients are the ‘edge cases’ that cause the most trouble.)

Manual whitelisting == work == what spam filtering is trying to reduce == bad.

Thirdly, and most seriously, it assumes spammers would never introduce retries into their spam-tools if it took off. Tempfailing, what this is based on, is effective right now because spamtools don’t retry. But every proposed spam solution has to consider what would happen if every server admin in the world implements it, and spammers then want to subvert it.

For a spamtool to retry, it just needs to track 4xx responses, and if it encounters one, save these items of data:

  • From, To addrs and HELO string used
  • proxy IP used (btw proxies are almost never shut down successfully, so the spammer can generally assume this can be reused next time)
  • random seed used to generate random hashbuster tokens etc., so the body text matches

That’s really not a lot of data — 64 bytes per address that requires a retry. Then, an hour or more later, do the retry.

So, IMO, ‘greylisting‘ will work fine in the short term, until it becomes reasonably common — then the spamtool developers will start adding retry code.

Then we’re back to square one — except some legit mail takes much longer to get delivered, and the bandwidth wasted by spam has doubled, due to all those retrying spams. That’s not really progress.