A couple of hours of today went on dealing with the effects of a big spam attack on a managed server. One user had installed the Joomla ExtCal component on their web site, while another reported that email was running slowly. The attacker was exploiting com_extcalendar/admin_events.php to send spam and trying to send 9000 emails meant they hit the maximum permitted sending rate quite quickly. As soon as I spotted it, I shut down outgoing mail, killed the sending process, disabled the exploited site and component, cleaned the spam from the queue and restarted mail. I'm searching the rest of the server for any other com_extcalendar installations and then I should contact the other exploited servers I've seen during this attack. It looks like there's an entire class of evil "Mambots" out there, using exploitable Mambo and Joomla sites to crawl in search of others. I don't think the exploited site's owner will be billed for the clean-up, because I can't find a security advisory for this. Neither the mambo site (whose site search doesn't work for me) nor the joomla site seems clear about security alerts. I didn't find a third-party advisory that was clearly about this (but there were a few maybe-relevant ones). The homepage at Mambo last released in 2005 and doesn't mention this in its release notes, while the homepage listed by Joomla 404s (and I don't enjoy using the Joomla site because, as it says,

"we are aware, and regret, that our website does not comply with many WCAG/508 requirements"

). If you are using com_extcalendar on your site, check whether it's safe, or replace it with a better calendar.

We've just harvested a bumper crop of mint (spearmint, I think) which was threatening to take over its part of the garden. Anyone got any good recipes that use kilos of mint? Please put them in the comments form and help me use this stuff before it wilts! Alternatively, anyone nearby (BS22) want some freshly-picked mint?

Like much of the UK, it's election day in Kewstoke. There's no vote for Kewstoke council because there weren't enough candidates to make a contest. 10 candidates for 11 posts, I think. I was approached by a couple of people and asked to run (quite strongly in one case) and I seriously considered it, but I only moved to this village six months ago, I don't know how things work yet and there are many other things I want to do in the next four years (the term of office AIUI). I was also approached by one person at a recent meeting and told that I should have stayed in Norfolk! Of course, that made me feel that I should run just to mix them up, but no, I'll stick to my decision. That comment did tickle me, as I only went to Norfolk to university - and stayed a bit too long. I'm not from round there. There is a vote today for North Somerset council and it's been interesting to compare the campaigning: no doorstepping or hustings from anyone (unlike in King's Lynn), three Conservatives leaflets, three Liberal Democrat leaflets but I didn't even find a web page for the Labour candidate. It's also been interesting to see the campaign coverage in the press: Weston and Worle News have been quite good, while the Mercury seems to prefer gibberish stories like the EU makes our post late. I'll go along, vote and watch for the results, but I suspect this green village of farms and tourism is safe Conservative Hold territory. Although there's been some new building of a largish house estate in the ward, which I suppose might change things. How's election day going elsewhere? I see Conservative Norwich City Councillor Antony Little has already posted the sort of partiality we all know and love...

james wrote:

"I came across your page. I wanted to suggest adding a link to http://www.FreePatentsOnline.com This is a free patent searching site with PDF downloading, world patent searching, alerts, and other account functions -- all free. It is a great resource for intellectual property professionals, reearchers, students, small businesses, and anyone else who needs such legal or scientific information."

I thought the idea was that we shouldn't search for invalid patents, because ignorant infringement is punished less severely than wilful infringement?

I love email newsletters that move slickly from ranting to advertising. Here's one from Gossypium:

"We believe that something is critically wrong with all those head in the sand neoclassical giant companies, that have been built on economical models that we would now consider antique and even dangerous for the human evolution. New business models like Gossypium have managed to rebalance the relationships between the economy, society and the environment. It is now accepted by all that we will need to change and that there is no turning back. We as a brand are trying to make this easier by offering positive alternatives. So here is our great T-shirt collection"

Source I just wish I could do that in such an amusing way. But I can't, so I'm currently shuffling a few things around to make my Business feed a bit more work-relevant. If you are subscribed to my Business-only feed for the Media items, please switch to the Hacks feed. Meanwhile, Webmastering articles will change from the Hacks feed to the Business one. And there's some more changes which I'm still working out. Watch this space.

David Berry wrote:

"Spread this number 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0. [...] It's the HD-DVD Processing Key for most movies released so far. I was not aware that a string of numbers and letters was copyrightable."

Source and Original.

I'm installing Paul Martin's iptables ssh-rate-limiter on the public machines that I run, to reduce the amount of logfile rubbish that ssh-scanning crackers produce. I've also added an iptables-restore line to the pre-up of the relevant sections of /etc/network/interfaces So far, there doesn't seem to be any disadvantage to doing this. Is there one? If not, why doesn't everyone do this?

As of 30 April, I had 26 responses to my survey asking which business directories people actually use to find people like me, and 15 of them looked like an attempt to rig the poll! Of the others, only W3CSites, FreeIndex and the Chambers of Commerce got much support. I also asked a couple of other forums, where only FreeIndex got much support. A very interesting result and quite different to what I expected. Thanks to Alan Pope and Sandy for participating - everyone else ticked the box for no publicity!

Ben O commented:

"One blog that spans the divide between paper-bound librarians and the digital world is the Disruptive Library Technology Jester I found it as we both are working with a piece of software called 'Fedora' (not the RedHat distro, but http://www.fedora.info/ an interesting open source XML-centric file repository software.)"

I boggled at getting used as a throwaway line in LugRadio and then: Jono Bacon's PA (is this for real?) commented:

"I will get Jono to schedule a call with you sometime to discuss these problems if thats fine with you. He can probably fit you in before Bill Clinton at 2pm on Tuesday."

It also appeared (with a few comments from me) on as days pass by: Die Broadcom (and yes, Die Broadcom!)

• Please skip this item if the f-word offends you... LugRadio season 4 episode 16 minute 45ish:

  "I mean, it's... It's... I think, it's... You know... If you look away from... I think, in my mind... Going back to the discussion about Wiis, I mean... For me personally, I like sitting on a couch and playing a game with a joypad, y'know? I'm not really into standing up and f... Getting some exercise? ...hitting an invisible fucking tennis ball. If I... If I thought about doing that, I... I think it would put me off. That's why I'd suggest that the Wii for some people is a novelty. For me it would be a novelty. I think a lot of people enjoy playing it. They are very cool. For traditional games players, absolutely. But I'm more of a traditional games player and I like playing on Playstation and I feel a bit shitty that I've bought a Sony machine and I don't like the fact that it's got BluRay in it and all the rest of it but uh... Better than MJ Ray! Harsh! Fucking the witmeister strikes fuck. He isn't listening to the fucking show anyway. No, he said we jumped the shark. Did he? What the fuck does that mean? Really? I don't know, but he er... Is that on the foot? Fucked the pooch? Right. So the PS3. Good one. Or not. (muttering) If you hate freedom, go out and buy one!"

  Yes, that show has jumped the shark at some point in season 2, when they stopped editing properly and let it become a 90-minute or 2-hour show instead of a 1-hour one. The above is typical of recent non-interview clips that I've heard: little to do with Linux or LUGs, gratuitously offensive and personal, everyone talking across each other with lots of incoherent waffle. It's almost like they're scared to shut up and let another presenter speak while they work out what they're trying to say. Are they spraying their territory with their voices or something? If there's an interview you're interested in, it's still worth the download for that, but don't bother otherwise. If they had the guts to publish it under a free software licence, I expect there'd be more user-friendly cuts, tightly-edited short versions (like alterslash does for slashdot) and probably other stuff I wouldn't guess. Maybe the competition would bring a bit of freshness back, instead of the show slowly getting longer and longer, padded out with rambles that make John Prescott seem like a master of tact and eloquence. I doubt they'll free LugRadio - they don't seem to rate freedom highly, with the exception of one presenter - and that's their choice, just like it's my choice not to listen to most of it any more. As you can tell from the above, I did tell them when I stopped and why. That in-show comment was their first response. I guess they feel too famous to reply to emails directly any more. (Thanks to Aaron for the tip about the above. Now, I wonder if they'll use any of this in a promo, like I did when the Tories said "I'd rather join a group of tree-hugging lesbian hippies from Ipswich"? Did wonders for my recruitment drive, that did.)
• Seen on URC: "A bicycle is stolen every 71 seconds in England... - I guess the owner is getting pretty fed up by now :-)" -- Paul Boyd

I was away when the results were announced, so I didn't comment on it at the time, but this seems a good result. For those of you who are non-graphical and maths-blind: Sam Hocevar is the new DPL. Steve McIntyre was arguably second, with Rapha l Hertzog and Wouter Verhelst also in the second group. Gustavo Franco and Anthony Towns were also above None Of The Above, with Simon Richter and Aigars Mahinovs below. With the exception of the scarily high placings of Anthony Towns and Steve McIntyre, that seems a good result to me. Hopefully it was just the "don't change horses in mid-stream" silly ticket boosting those two. Sam Hocevar's first Bits from the DPL has just gone out so: where do you want debian to go today?

Bill Hay wrote:

"You think this is bad. At least they're only counting crimes he did commit. IIRC the police have been known to get captured criminals to confess to additional crimes they didn't commit in exchange for a recommendation of leniency. Helps the clear up rate no end."

After noticing the Library of Congress Blog (thanks for the anonymous link correction) via librarian.net, I asked the British Library and they told me they had a blog for the London in Maps exhibition and will soon launch a new content blog called Sacred. Which other libraries are blogging?

As many of the Planet Debian readers know, I bemoan Galeon 1.2 and therefore Woody. For a long time I haven’t found an appropriate browser replacement for Galeon 1.2 in Sarge, so I never switched my home workstation called “gsa” (Pentium II, 400 MHz, 572 MB RAM) to Sarge, since Woody was rockstable and just worked. Though, after a few Galeon 1.3/2.0 rants, someone pointed me to Kazehakase, which indeed is a fine Galeon 1.2 replacement. But I noticed that Kazehakase in Sarge was in an early stage and the Kazehakase from testing (now Etch) were already much more matured. So in comparison to Sarge with Etch I won’t have the problem of not having a mature and sage web browser in main. And due to security support for Woody ceased a few months ago and Etch is now declared stable, it’s time to reinstall my last Woody box with Etch. For that, a repartioning of it’s two hard disks (8 GB and 40 GB) sounds like a good idea and so I had look, what’s on all those partitions where I once had a shot on quite a few Linux distributions and other unix-like operating systems. (Although I was already a big fan of Debian at that time, I wanted to look over my own nose and ordered a few CDs of free operating system at LinISO.de.) So here’s what I found, never really used and will throw away quite soon:

• RedHat 9
• Mandrake 9.2beta2
• FreeBSD 4.8
• OpenBSD 3.3
• one more, not yet identified (or perhaps even never formatted) Linux partition

That should give enough space for an Etch installation without touching the Woody installation first. Thanks to Venty, I’ve got a DVD drive for that box, so I can install from DVD. And for toying around with all those other neat and free operating systems nowadays, I’ve got my MicroClient Jr. named “c2”.

I'm looking at placing our directory adverts for the coming year, but most directory salespeople won't give useful statistics. So I'll run a SLOPpy poll: Which of the following directories would you use to find webmasters, sysadmins or software developers in England? Just tick the boxes, put any I've forgotten in the others box and click Send (and put your name if you want to be in the thank-you message).

Your name: 118118: Applegate: BusinessLink: BusinessPages: ChamberOfCommerce: EuroPages: FreeIndex: ITVLocal: IWA: Kompass: MarketingTool: ODP: PamsCom: Scoot: Thomson: TouchLocal: UFindUs: UK.Coop: UKWDA: W3CSites: WikiCompany: Yell: YellowPages: Others:

Thursday 26 April 2007 (7pm - 9pm), The Campus, Locking Castle, Weston-super-Mare. (Map) Topics to include: The Joint Local Transport Plan: How the forum may maintain pressure to implement cycling benefits in the plan? Appointment of new chair for the meetings Diversion of the Avon Cycleway onto the old NCN33 to Portishead New Local Rural Routes to be sign posted Date of next meeting: Thursday 28 June 2007 @7pm, The Campus - WSM Cycle Forum homepage

Scott Lamb commented:

"Measuring police on the absence of crime is even easier to game, with horrible consequences."

In more detail, Baruch wrote:

"The result of measuring absence of crime will be that reports of crime will be rejected if the cops will think that they won't be able to catch the criminals. You will have to seperate the group that takes the reports and the group that handles them to make it work and even then I'm not sure someone won't find a way to go around that with another trick."

Well, if you read any cycling online forum, you'll have seen some reports of police rejecting reports of 'too hard' crimes like harassing cyclists. I think I've had one report accepted in the last year, about a moped user riding along a cycle track near a playground where I had noted the number plate, and two pretty certainly discarded. So, police discarding or discouraging reports of no-obvious-solution crimes seems to be happening already. andy r wrote:

"Hi there, Don't talk to me about tragedy of targets... As a teacher the word 'target' fills me with both fear and laughter. Last year my year 6 class and I worked our butts off and achieved the highest set of grades for any school in North Somerset, thereby rescuing the school from a very sticky situation with Ofsted. Within days of these results being known the senior LEA advisor suggested to me that the targets had, perhaps, in hindsight been too low. My reply was curt and Anglo-Saxon. Hindsight! Looking out of her hind? The LEA love targets. If you hit them you have not pushed the kids enough. If you exceed them you should have pitched them higher. Woe betide anyone who fails to meet their targets (I will this year, different cohort and those % from last year have been INCREASED!)... My kids have targets (though they have so many that they actually fail to remember them all). Teachers have targets for the numbers of children who are 'supposed' to achieve certain grades but the idiots who set them frequently have only a rudimentary grasp of mathematics. In my current school there are 45 children in a year group, so each one represents a little over 2%. In schools with small classes (perhaps 10 per year in some rural schools) 1 child can equate to 10%. If he's sick on exam day or is just not bright enough, that's 10% gone. And with the government expecting 75-80% of children to achieve a level 4 in their KS2 SATS, it's all too easy to drop blow your 'targets' through illness alone. But here's an even worse tragedy of targets in primary schools... a couple of years ago I had to disapply 2 children from SATS, simply because they have profound special needs and could not take the tests. In addition, the school had an Autistim Unit (now called something PC, but I forget what) which that year had 4 children in year 6. Therefore we had 6 children who could not take the exams. We filled in the paper work but were horrified when the results came in to discover that these children (who all had official exemption on disability grounds) were counted as having taken the test, even though they couldn't. For 'statistical' purposes these kids were classified as having scored zero! Out of a cohort of 36 children, 6 were classified as not having done a thing! The department of education acknowledged that this didn't help our statistics, but stated that it was their policy. In a school with a lot of very deprived kids this 16% scoring zero, added to a significant quanitity of under-achievers was enough to push us down to the bottom 100 primary schools nationally. You can only imagine how damaging that was for the school's reputation - parents took kids out, we were slated in the local press and had to fight like mad to justify our continued existence... Targets... bah! Hey, talking of which. The Health Trust has recently done a survey of local primary school children's weights and heights. In our day this sort of thing was compulsory. Not any more. Parents had to 'opt in' to the survey... And guess what? The parents of the largest kids refused to take part - as did the ignorant b*strds, but that's another story. So the WAHT will now be collating a totally skewed data set. I'm just waiting for the press release highlighting our slim North Somerset children... And of course, someone will be complemented on achieving targets for reducing childhood obesity, whilst infact the problem has probably - as it were- grown. I used to like the way that 'on time targets' were displayed in Didcot railway station. There was a board in foyer which highilighed punctuality. The impressive looking bar chart had these words written on it: "% of trains on time, compared to last month." And the brightly coloured chart was always up around 95%, ish. I was always suprised that nobody commented on that. 0.95*0.95*0.95...... month on month those trains were getting less and less punctual! But nobody bothered to point this out because 95% looks impressive! On many occasions I took the time to read, and re-read, the wording of those graphs so I know with 100% confidence that this was what they quoted. We never had a month with more than 100% punctuality compared to the previous month. Shame. That's enough. I'm off to the dog house."

I asked if anyone had seen the Barclays PINsentry keypad before... Kris Marsh wrote that:

"it looks a lot like the way secureid cards work. In which case, it won't physically connect to your PC, would provide you with proper two factor (password + token) and would definitely be a Good Thing(tm). Not only then, would a phisher have to take your password, but they'd have to steal your actual card and PINsentry device to get access to your online account. Thus pushing the phishing emphasis elsewhere (different banks? phone scamming?). I guess time will tell if they manage to mess it up to make it only work on Windows somehow. :-)"

Adam Bower opined:

"The Barclays devices just look like a challenge response system. Someone I know has something similar for a bank account which when you login the website presents you with a 4 digit number. You then type that number into the pad and then enter a pin and it presents another number that you enter onto the webpage and the online banking lets you in (along with a username and password). I should imagine that these new devices won't make any difference to people running Linux."

Neil McGovern noted:

"It seems that they're external devices for generating OTPs from C+P cards, so won't affect compatability."

Roger Gammans commented:

"Barclay use GEM plus usb smart card readers with their business internet banking. IIRC, this requires windows and IE so that the activeX controls on the page can talk to the reader. Having said that one desciription of the new device I heard sounded like it was a standard alone device with a display. You put your card into it and push a button and then it produces a code number which you copy onto the web page. But I haven't seen one yet - and the media are good at getting the wrong end of the stick."

So, let's wait and see.

Sign EFF's Petition Against IPRED2 On April 24th, the European Parliament will vote on IPRED2, the Second Intellectual Property Enforcement Directive. With one stroke, they risk turning thousands of innocent EU citizens and businesses into copycriminals. If IPRED2 passes in its current form, "aiding, abetting, or inciting" copyright infringement on a "commercial scale" in the EU will become a crime. (Source)