Smalltalk Tidbits, Industry Rants http://www.cincomsmalltalk.com/blog/blogView Cincom Product Manager jrobertson@cincom.com Wed, 16 Apr 2008 09:08:14 EDT http://www.cincomsmalltalk.com/images/cst_small.jpg Smalltalk Tidbits, Industry Rants http://www.cincomsmalltalk.com/blog/blogView 50 81 en-us James A. Robertson Copyright 2007 Cincom Systems, Inc. 2008-04-16T09:08:14-04:00 39.214103 -76.878807 Wiki Spam gone Wild http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Wiki_Spam_gone_Wild&entry=3385537396 spam Sun, 13 Apr 2008 11:03:16 EDT

If I didn't have spam filtering turned on for our Wiki, I definitely would not be able to keep it running - here's a bit of the logging, which illustrates the problem:


<< April 13, 2008 10:49:48.216 >>
<< Spam from: (IP Omitted) >>
<< Spam Intended For: Cincom Smalltalk >>

<< April 13, 2008 10:49:48.781 >>
<< Spam from: (IP Omitted) >>
<< Spam Intended For: Wiki Syntax >>

<< April 13, 2008 10:49:59.142 >>
<< Spam from: (IP Omitted) >>
<< Spam Intended For: Add an action button to a canvas >>

<< April 13, 2008 10:51:29.850 >>
<< Spam from: (IP Omitted) >>
<< Spam Intended For: Wiki Syntax >>

<< April 13, 2008 10:54:22.129 >>
<< Spam from: (IP Omitted) >>
<< Spam Intended For: VW NameSpace Reservations >>

It's like that 24x7.

]]> 3385537396 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3385537396 http://www.cincomsmalltalk.com/blog/blogView?guid=3385537396 blogView?showComments=true&printTitle=Wiki_Spam_gone_Wild&entry=3385537396 blogView?showComments=true&printTitle=Wiki_Spam_gone_Wild&entry=3385537396 Steven Kelly 2008-04-16T09:08:14-04:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Comment by Steven Kelly</p> <p> <p>I've not seen any comment spam on my blog since I added reCAPTCHA. If you're having to spend time manually deleting spam or tweaking your keyword spam filters, you might want to add it too. It's a piece of cake: see my blog entry: <a href="http://www.metacase.com/blogs/stevek/blogView?showComments=true&amp;entry=3382910219">Added CAPTCHA to prevent spam comments</a>. When I receive the VW 7.6 CD and update our server, I'll check with you about adding reCAPTCHA in to the <a href="http://www.cincomsmalltalk.com/CincomSmalltalkWiki/Silt">Silt</a> core.</p> </p> </div> Time to add reCAPTCHA for comments? http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3385537396 Twitter-spam http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Twitter-spam&entry=3385310105 spam Thu, 10 Apr 2008 19:55:05 EDT

Charles Miller isn't happy with the rash of Twitter-spam out there. I'll note that this isn't new; Immediately after I joined Twitter (awhile ago) - I recall that one of the first "follow me" requests came from "Girls Gone Wild". I kind of figured that they weren't interested in "Smalltalk Daily" :)

Technorati Tags:

]]> 3385310105 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3385310105 http://www.cincomsmalltalk.com/blog/blogView?guid=3385310105 blogView?showComments=true&printTitle=Twitter-spam&entry=3385310105 blogView?showComments=true&printTitle=Twitter-spam&entry=3385310105 Tom Sattler 2008-04-11T08:19:26-04:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>No, I think the "Girls Gone Wild" crowd are mostly Python programmers. </p></div> http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3385310105 Waiting for the Spam to Drop http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Waiting_for_the_Spam_to_Drop&entry=3379646960 spam Tue, 05 Feb 2008 06:49:20 EST

As I've said before, spam seems to come in waves - there are times when the attempts to spam the Wiki and the blogs here are just tremendous, and then there are periods like the last few weeks - unusually quiet. After a few quiet weeks, I find I'm waiting for the other shoe to drop...

]]> 3379646960 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3379646960 http://www.cincomsmalltalk.com/blog/blogView?guid=3379646960 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3379646960 Differential Spam http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Differential_Spam&entry=3376123036 spam Wed, 26 Dec 2007 11:57:16 EST

I'm noticing something about Spam this Christmas season. I posted on blog/wiki spam dropping off the other day - apparently, that's done on something resembling a 9-5 work schedule. Email spam though? That's just relentlessly bot driven. Cincom mostly shuts down over the holiday, so it's more obvious: real mail disappears, so all I see is the spam. And boy of boy, is there ever spam :)

It's an interesting difference. I guess email is still easier to automate; after all, to target my blog server, someone has to either manually go at it, or take the time to create a bot that specifically targets it (the servlets and web forms ar all things I created myself).

Hmm - there's a test I could run. I could try changing all the form field names and see what happens...

]]> 3376123036 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3376123036 http://www.cincomsmalltalk.com/blog/blogView?guid=3376123036 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3376123036 Do Blog Spammers take vacation? http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Do_Blog_Spammers_take_vacation&entry=3375975407 spam Mon, 24 Dec 2007 18:56:47 EST

I'm curious about this - I was getting another wave of spam on the blog server(it seems to go through peaks and troughs) when it just stopped completely before the weekend. Which makes me wonder: are the spammers directing their bots on a work-day type schedule, and taking weekends and holidays like the rest of us?

]]> 3375975407 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3375975407 http://www.cincomsmalltalk.com/blog/blogView?guid=3375975407 blogView?showComments=true&printTitle=Do_Blog_Spammers_take_vacation&entry=3375975407 blogView?showComments=true&printTitle=Do_Blog_Spammers_take_vacation&entry=3375975407 Byron 2007-12-24T23:48:45-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Depends on the toolkit, but, generally, yes. </p> </div> blogView?showComments=true&printTitle=Do_Blog_Spammers_take_vacation&entry=3375975407 blogView?showComments=true&printTitle=Do_Blog_Spammers_take_vacation&entry=3375975407 mjl 2007-12-25T06:08:13-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Or the spam sending botnet clients have been turned off by their unsuspecting owners for the holidays. </p> </div> http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3375975407 Spam Overload http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=Spam_Overload&entry=3373174668 spam Thu, 22 Nov 2007 08:57:48 EST

Like Doc Searls, I'm noticing a huge uptick in spam. The blogs here are mostly ok - between the simple spam blocker and the "off brand" nature of the server, we don't get hammered too hard. The wiki is in ok shape; better than the UIUC server, which seems to have been knocked off the air. Email though? My corporate inbox is overflowing with Russian spam. How hard would a rule be such as "if it's not in (insert your language here), assume it's spam?"

Apparently pretty hard :)

]]> 3373174668 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3373174668 http://www.cincomsmalltalk.com/blog/blogView?guid=3373174668 blogView?showComments=true&printTitle=Spam_Overload&entry=3373174668 blogView?showComments=true&printTitle=Spam_Overload&entry=3373174668 John M McIntosh 2007-11-22T14:41:22-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>That depends on how inteligent your filter is. I had a former ISP do that to my email, and then I stopped getting email from the ESUG list or most people in Europe, since adding an &eacute; &nbsp;was sufficent to block the email.&nbsp; </p></div> blogView?showComments=true&printTitle=Spam_Overload&entry=3373174668 blogView?showComments=true&printTitle=Spam_Overload&entry=3373174668 Lex Spoon 2007-11-22T19:18:23-05:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>SpamAssassin will factor in the language of a message. I don't know what it does to detect the language, but I have found it pretty effective. </p> <p>Of course it's not perfect. When I have visited non-English universities, I have lost email because the emails were half English and half non-English, and so SpamAssassin tossed them until I told it the other language was okay.</p> </div> SpamAssassin does that http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3373174668 The Spam Fight Might Create Casualties http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=The_Spam_Fight_Might_Create_Casualties&entry=3370685194 spam Wed, 24 Oct 2007 13:26:34 EDT

Ok, this is interesting in a "inside Google" sort of way. TechCrunch reports that Google has launched a de-ranking offensive against blog link farms. This is a good thing, because search results will often take you to these bogus sites rather than the original content source.

However - as with any such battle, it looks like there's been some collateral damage:

The AOL owned Weblogs Inc was not immune, with leading Gadget blog Engadget dropping from PR 7 to PR5, Autoblog (6 to 4) and DownloadSquad (5 to 4).

That caught my attention, because the PageRank of this site is a decent 7 (scale of 10). It's just weird for my blog to have better PageRank than a site as popular as Engadget. I suspect that this move is going to create an awful lot of tooth grinding.

]]> 3370685194 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3370685194 http://www.cincomsmalltalk.com/blog/blogView?guid=3370685194 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3370685194 The Spam Storm Explained? http://www.cincomsmalltalk.com/blog/blogView?showComments=true&printTitle=The_Spam_Storm_Explained&entry=3370444325 spam Sun, 21 Oct 2007 18:32:05 EDT

The Guardian may have the reason for the last round of spam attacks that I (and everyone else) have been seeing on the net: a growing botnet:

It gets worse. Storm's delivery mechanism changes regularly. It began as PDF spam, then morphed into e-cards and YouTube invites. It then started posting blog-comment spam, again trying to trick viewers into clicking infected links. Similarly, the Storm email changes all the time, with new, topical subject lines and text. And last month Storm began attacking anti-spam sites focused on identifying it. It has also attacked the personal website of a malware expert who published an analysis of how it worked.

I had been wondering about those waves (PDFs and e-cards) of spam. More recently (I mentioned this the other day), I've been seeing tons more comment spam than normal. I wonder if there's a specific plan, or whether someone is building a huge "rent a bot" (or heck, maybe they already have) network? Would I see a difference between spread attempts and spam campaigns that were paid for?

Technorati Tags:

]]> 3370444325 http://www.cincomsmalltalk.com/blog/servlet/CommentAPIPBServlet?guid=3370444325 http://www.cincomsmalltalk.com/blog/blogView?guid=3370444325 blogView?showComments=true&printTitle=The_Spam_Storm_Explained&entry=3370444325 blogView?showComments=true&printTitle=The_Spam_Storm_Explained&entry=3370444325 denis bider 2007-10-21T20:19:58-04:00 <div xmlns="http://www.w3.org/1999/xhtml"> <p>Here you might find some answers:</p><p><a href="http://www.schneier.com/blog/archives/2007/10/future_of_malwa.html">http://www.schneier.com/blog/archives/2007/10/future_of_malwa.html</a></p><p>This talks probably about a different system than Storm, but yeah,&nbsp;this is&nbsp;fully-fledged Russian business now. To draw a parallel with centuries past - it used to be that governments used to sanction their captains&#39; attacks&nbsp;(read: piracy)&nbsp;against a foreign country&#39;s ships. Today, the Russian government is sanctioning internet-based crime against foreign nations&#39; citizens.</p><p>They might even see it as&nbsp;a national goal - using foreigners&#39;&nbsp;technologies to subvert the foreigners themselves, so to speak.</p><p>It will pass as long as they keep to petty crime that&#39;s avoidable with users&#39; diligence rather than&nbsp;inflicting damage on&nbsp;important infrastructure. In a sense, the fact that no legal reprieve is available provides incentive for software vendors to&nbsp;work more on&nbsp;the security of our products, which makes for a more solid foundation overall. The fact that there is an actual and ongoing practical challenge rather than merely hypothetical threat may actually contribute to the robustness of our infrastructure in the long run.</p> </div> http://www.cincomsmalltalk.com/blog/servlet/CommentAPIServlet?guid=3370444325