Another one of those emails arrived in my inbox today:
Your software needs to be removed from my work computer. I did not install it,Â do not want it and did not request it.
No mention what software or indication of what platform or what might’ve happened when my software allegedly ended up in the person’s computer. Not very friendly either.
Again I suspect that there’s some software that uses curl in some way, but I can’t tell for sure…
I replied to it, saying that I didn’t install anything on his computer.
In my mini-series of strange mails I receive, here’s another one:
Subject: Product Request
I am interested in purchasing some of your products, I will like to know
if youcan ship directly to SPAIN , I also want you to know my mode of
payment for this order is via Credit Card. Get back to me if you can ship
to that destination and also if you accept the payment type I indicated.
Kindly return this email with your price list of your products..
I assume I’ll never figure out what products he speaks of, or how on earth he ended up sending me this… I’ll admit I was tempted to make up some “interesting” products to offer.
Update: I was informed that this is probably “just” another online fraud attempt. How boring.
If you ever wonder how clever it was of me to make an FTP tool that used the default anonymous password
curl_by_daniel@... once upon a time and you want to know why I changed that to email@example.com instead? Here’s a golden snippet to just absorb and enjoy:
Date: Thu, 23 Dec 2010 22:56:00
From: iHack3r <hidden>
To: info@[my company]
Subject: Hacking me
To the idiot named Daniel, Please stop brute force attacking my FTP client. I do not appreciate it, i have an anonymous account set up for the general public to access my files that i want them to access, QUIT trying to hack the admin because 1. DISABLED unless i am leaving to go somewhere without my computer 2: THE PASSWORD is random letters and numbers.
The password was changed at Feb 13 2007 in curl version 7.16.2, but there are a surprisingly large amount of older curls still around out there…
Update: as the person responded again after having read this blog post and still didn’t get it, I felt the urge to speak up in even more clear terms:
I didn’t have anything to do with any “hacker attack” on any site. Not yours, and not anyone else’s. The fact that almost-my-email address appeared in your logs is because I wrote the FTP client. It is a general FTP client that is being used by a very very large amount of people all over the world. If I ever would attack a site, why on earth would I send along my real name or email address?
During several years I’ve been setting mailing lists I admin to only accept posts from subscribers in order to avoid having to deal with very large amounts of spam posts.
While that is slightly awkward to users of the list, the huge benefit for me as admin has been the deciding factor.
Recently however, I’ve noticed how this way to prevent spam on the mailing lists have started to fail more and more frequently.
Now, I see a rapid growth in spam from users who actually subscribe first and then post their spam to the list. Of course, sometimes spammers happen to just fake the from address from a member of a list – like when a spammer fakes my address and sends spam to a list I am subscribed to, but it’s quite obvious that we also see the actual original spammer join lists and send spam as well.
It makes me sad, since I figure the next step I then need to take on the mailing lists I admin is to either spam check the incoming mails with a tool like spamassassin (and risk false positives or to not trap all spams) and/or start setting new members as moderated so that I have to acknowledge their first post to the list in order to make sure they’re not spammers.
Or is there any other good idea of what I can do that I haven’t thought of?
This is hardly any news to anyone who cares, and those who should care the most are either not understanding what top-posting is in the first place or they’re not aware of that people like me think top-posting is an evil decease we need to extinguish.
My primary reason to hate top-posting is that it is fast and easy for the single user who writes the mail reply, but it gives more work to the large amounts of people who read it. When someone posts to a mailing list, one should rather expect that the single user would be the one to put in a little extra effort to make the result readable for the masses who will read it.
Top-posting also most often involves the habit of including the entire previous conversation in a quoted manner below.
A sensible post and quote ethic, is to only quote as much as you need from the previous conversation to make your point clear, and to respond in a way so that it is clear to what parts of the quotes you are referring to. That more or less implies doing “interlaced” or “inlined” posting, where you show a few lines of quotes and then a few lines of comments over and over until the end of the mail.
The act of doing bottom-posting but keeping the entire thing quoted above the new text you add is almost as bad as top-posting. You remove the focus of what you write by providing far too much irrelevant text. Remove the irrelevant parts!
These days large portions of the modern world use broadband connections so the actual size of the mail is not a concern for bandwidth or speed reasons, but you probably still want the receivers to focus on your actual point. Also, a lot of mails these days end up in web archives or similar so they are then searchable by internet search engines and browsable by future people and then you even more want the mail to be on topic to become more relevant and less misleading to searches.
In case it isn’t obvious: this of course primarily concerns mails sent to (largish) mailing lists.
Mark Nottingham held a very interesting one hour talk on the status of HTTP and the work on HTTPbis on a QCon conference recently, and luckily for us HTTP geeks there’s this great video/presentation from that.
curl is mentioned at least twice in the slides, unfortunately it has a wrong fact on the second mention where it says curl uses “Pragma: no-cache” as it isn’t true anymore. It used to do that, but we’ve stopped doing it in curl since a while ago.
I’m a subscriber to the httpbis mailing list and a casual contributor, but nonetheless his summary and overview of the state was refreshing as I’ve not been able to keep up with all the details and I haven’t been tracking that working group from its start either.
This is a full quote from a genuine email I received just moments ago:
What URL do I put in to get free apps ?plese tell me
Sent from my iPhone
I have no words to describe it further.
In case you’ve checked some of your spam mails recently you might’ve discovered how a large amount of them include links to sites using seemingly very random names in the domain names. Like hjsdhjerrddf.com or qwetyqfweyqt.com and so on. Hammering-the-keyboard looking names.
The explanation behind these is quite simple and sad: ICANN allows for a “tasting period” before you pay for the domain. Thus spammers register all sorts of random names, spam the world with mails referring the users to these domains and then they return the domain names again before they’ve paid anything, and go on to the next names.
With a large enough set of people and programs doing this, a large amount of names will constantly be kept in use but not paid for and constantly changing owners.
Conclusion: wherever there’s a loophole in the system, someone is there to exploit it for the purpose of sending spam.
… I don’t want my employer/wife/friends to see that I’ve contributed something cool to an open source project, or perhaps that I said something stupid 10 years ago.
I host and co-host a bunch of different mailing list archives for projects on web sites, and I never cease to get stumped by how many people are trying hard to avoid getting seen on the internet. I can understand the cases where users accidentally leak information they intended to be kept private (although the removal from an archive is then not a fix since it has already been leaked to the world), but I can never understand the large crowd that tries to hide previous contributions to open source projects because they think the current or future employers may notice and have a (bad) opinion about it.
I don’t have the slightest sympathy for the claim that they get a lot of spam because of their email on my archives, since I only host very public lists and the person’s address was already posted publicly to hundreds of receivers and in most cases also to several other mailing list archives.
People are weird!
I’ve already before mentioned my antispam setup, but today I just ran a little check on my “hispam” mailbox (the spams with so high spam points that I never even bother to check them for false positives), 43MB of 7900+ spams (received during ~40 hours), to see which ones of my own handicrafted rules that get triggered the most. I use a set of 40+ custom spamassassin rules to help it trigger more mails as spam, since some of the very short mails seem to be hard to catch otherwise, and some of the mails are in many ways looking like mail I would normally get.
Anyway, my top-10 rules are:
- 1624 6.0 DS_BODY_DRUGBRANDÂ Â Â Â Â BODY: mentions drug brand
- 1428 6.0 DS_SUBJECT_DRUGBRANDÂ Â Subject mentions drug brand
- 828 6.0 DS_FROM_HAXXÂ Â Â Â spoofed haxx.se address
- 769 4.0 DS_BODY_DISCOUNTÂ Â Â BODY: mentions percent discount
- 745 4.0 DS_SUBJECT_DISCOUNTÂ Â subject mentions percent discount
- 415 2.1 DS_TO_OWNERÂ Â To contains -owner
- 200 6.0 DS_BODY_NODOCTORÂ BODY: mentions “no doctor”
- 195 2.0 DS_MAILER_THEBATÂ sent with the bat
- 189 6.0 DS_BODY_DESIGNBRANDSÂ BODY: mentions designer brand(s)
- 158 3.0 DS_BODY_REPLICASÂ BODY: speaks of replicas
The first number is number of hits. The second is the “spam points” I assign a match. Then there’s the name of the rule and my description for it. The “spam points” can best be seen relative to the other rules, as what makes a single mail a spam in the end involves multiple factors that aren’t shown here.