There is a bit of context that needs to be shared before I get to this and would be a long one. For reasons known and unknown, I have a lot of sudden electricity outages. Not just me, all those who are on my line. A discussion with a lineman revealed that around 200+ families and businesses are on the same line and when for whatever reason the electricity goes for all. Even some of the traffic lights don t work. This affects software more than hardware or in some cases, both. And more specifically HDD s are vulnerable. I had bought an APC unit several years for precisely this, but over period of time it just couldn t function and trips also when the electricity goes out. It s been 6-7 years so can t even ask customer service to fix the issue and from whatever discussions I have had with APC personnel, the only meaningful difference is to buy a new unit but even then not sure this is an issue that can be resolved, even with that.
That comes to the issue that happens once in a while where the system fsck is unable to repair /home and you need to use an external pen drive for the same. This is my how my hdd stacks up / is on dev/sda7 /boot is on /dev/sda6, /boot/efi is on /dev/sda2 and /home is on /dev/sda8 so theoretically, if /home for some reason doesn t work I should be able drop down on /dev/sda7, unmount /dev/sda8, run fsck and carry on with my work. I tried it number of times but it didn t work. I was dropping down on tty1 and attempting the same, no dice as root/superuser getting the barest x-term. So first I tried asking couple of friends who live nearby me. Unfortunately, both are MS-Windows users and both use what are called as company-owned laptops . Surfing on those systems were a nightmare. Especially the number of pop-ups of ads that the web has become. And to think about how much harassment ublock origin has saved me over the years. One of the more interesting bits from both their devices were showing all and any downloads from fosshub was showing up as malware. I dunno how much of that is true or not as haven t had to use it as most software we get through debian archives or if needed, download from github or wherever and run/install it and you are in business. Some of them even get compiled into a good .deb package but that s outside the conversation atm. My only experience with fosshub was few years before the pandemic and that was good. I dunno if fosshub really has malware or malwarebytes was giving false positives. It also isn t easy to upload a 600 MB+ ISO file somewhere to see whether it really has malware or not. I used to know of a site or two where you could upload a suspicious file and almost 20-30 famous and known antivirus and anti-malware engines would check it and tell you the result. Unfortunately, I have forgotten the URL and seeing things from MS-Windows perspective, things have gotten way worse than before.
So left with no choice, I turned to the local LUG for help. Fortunately, my mobile does have e-mail and I could use gmail to solicit help. While there could have been any number of live CD s that could have helped but one of my first experiences with GNU/Linux was that of Knoppix that I had got from Linux For You (now known as OSFY) sometime in 2003. IIRC, had read an interview of Mr. Klaus Knopper as well and was impressed by it. In those days, Debian wasn t accessible to non-technical users then and Knoppix was a good tool to see it. In fact, think he was the first to come up with the idea of a Live CD and run with it while Canonical/Ubuntu took another 2 years to do it. I think both the CD and the interview by distrowatch was shared by LFY in those early days. Of course, later the story changes after he got married, but I think that is more about Adriane rather than Knoppix. So Vishal Rao helped me out. I got an HP USB 3.2 32GB Type C OTG Flash Drive x5600c (Grey & Black) from a local hardware dealer around similar price point. The dealer is a big one and has almost 200+ people scattered around the city doing channel sales who in turn sell to end users. Asking one of the representatives about their opinion on stopping electronic imports (apparently more things were added later to the list including all sorts of sundry items from digital cameras to shavers and whatnot.) The gentleman replied that he hopes that it would not happen otherwise more than 90% would have to leave their jobs. They already have started into lighting fixtures (LED bulbs, tubelights etc.) but even those would come in the same ban
The main argument as have shared before is that Indian Govt. thinks we need our home grown CPU and while I have no issues with that, as shared before except for RISC-V there is no other space where India could look into doing that. Especially after the Chip Act, Biden has made that any new fabs or any new thing in chip fabrication will only be shared with Five Eyes only. Also, while India is looking to generate about 2000 GW by 2030 by solar, China has an ambitious 20,000 GW generation capacity by the end of this year and the Chinese are the ones who are actually driving down the module prices. The Chinese are also automating their factories as if there s no tomorrow. The end result of both is that China will continue to be the world s factory floor for the foreseeable future and whoever may try whatever policies, it probably is gonna be difficult to compete with them on prices of electronic products. That s the reason the U.S. has been trying so that China doesn t get the latest technology but that perhaps is a story for another day.
HP USB 3.2 Type C OTG Flash Drive x5600c
For people who have had read this blog they know that most of the flash drives today are MLC Drives and do not have the longevity of the SLC Drives. For those who maybe are new, this short brochure/explainer from Kingston should enhance your understanding. SLC Drives are rare and expensive. There are also a huge number of counterfeit flash drives available in the market and almost all the companies efforts whether it s Kingston, HP or any other manufacturer, they have been like a drop in the bucket. Coming back to the topic at hand. While there are some tools that can help you to figure out whether a pen drive is genuine or not. While there are products that can tell you whether they are genuine or not (basically by probing the memory controller and the info. you get from that.) that probably is a discussion left for another day. It took me couple of days and finally I was able to find time to go Vishal s place. The journey of back and forth lasted almost 6 hours, with crazy traffic jams. Tells you why Pune or specifically the Swargate, Hadapsar patch really needs a Metro. While an in-principle nod has been given, it probably is more than 5-7 years or more before we actually have a functioning metro. Even the current route the Metro has was supposed to be done almost 5 years to the date and even the modified plan was of 3 years ago. And even now, most of the Stations still need a lot of work to be done. PMC, Deccan as examples etc. still have loads to be done. Even PMT (Pune Muncipal Transport) that that is supposed to do the last mile connections via its buses has been putting half-hearted attempts
Vishal Rao
While Vishal had apparently seen me and perhaps we had also interacted, this was my first memory of him although we have been on a few boards now and then including stackexchange. He was genuine and warm and shared 4-5 distros with me, including Knoppix and System Rescue as shared by Arun Khan. While this is and was the first time I had heard about Ventoy apparently Vishal has been using it for couple of years now. It s a simple shell script that you need to download and run on your pen drive and then just dump all the .iso images. The easiest way to explain ventoy is that it looks and feels like Grub. Which also reminds me an interaction I had with Vishal on mobile. While troubleshooting the issue, I was unsure whether it was filesystem that was the issue or also systemd was corrupted. Vishal reminded me of putting fastboot to the kernel parameters to see if I m able to boot without fscking and get into userspace i.e. /home. Although journalctl and systemctl were responding even on tty1 still was a bit apprehensive. Using fastboot was able to mount the whole thing and get into userspace and that told me that it s only some of the inodes that need clearing and there probably are some orphaned inodes. While Vishal had got a mini-pc he uses that a server, downloads stuff to it and then downloads stuff from it. From both privacy, backup etc. it is a better way to do things but then you need to laptop to access it. I am sure he probably uses it for virtualization and other ways as well but we just didn t have time for that discussion. Also a mini-pc can set you back anywhere from 25 to 40k depending on the mini-pc and the RAM and the SSD. And you need either a lappy or an Raspberry Pi with some kinda visual display to interact with the mini-pc. While he did share some of the things, there probably could have been a far longer interaction just on that but probably best left for another day.
Now at my end, the system I had bought is about 5-6 years old. At that time it only had 6 USB 2.0 drives and 2 USB 3.0 (A) drives.
The above image does tell of the various form factors. One of the other things is that I found the pendrive and its connectors to be extremely fiddly. It took me number of times fiddling around with it when I was finally able to put in and able to access the pen drive partitions. Unfortunately, was unable to see/use systemrescue but Knoppix booted up fine. I mounted the partitions briefly to see where is what and sure enough /dev/sda8 showed my /home files and folders. Unmounted it, then used $fsck -y /dev/sda8 and back in business.
This concludes what happened.
Updates Quite a bit was left out on the original post, part of which I didn t know and partly stuff which is interesting and perhaps need a blog post of their own. It s sad I won t be part of debconf otherwise who knows what else I would have come to know.
One of the interesting bits that I came to know about last week is the Alibaba T-Head T-Head TH1520 RISC-V CPU and saw it first being demoed on a laptop and then a standalone tablet. The laptop is an interesting proposition considering Alibaba opened up it s chip thing only couple of years ago. To have an SOC within 18 months and then under production for lappies and tablets is practically unheard of especially of a newbie/startup. Even AMD took 3-4 years for its first chip.It seems they (Alibaba) would be parceling them out by quarter end 2023 and another 1000 pieces/Units first quarter next year, while the scale is nothing compared to the behemoths, I think this would be more as a matter of getting feedback on both the hardware and software. The value proposition is much better than what most of us get, at least in India. For example, they are doing a warranty for 5 years and also giving spare parts. RISC-V has been having a lot of resurgence in China in part as its an open standard and partly development will be far cheaper and faster than trying x86 or x86-64. If you look into both the manufacturers, due to monopoly, both of them now give 5-8% increment per year, and if you look back in history, you would find that when more chips were in competition, they used to give 15-20% performance increment per year.
2. While Vishal did share with me what he used and the various ways he uses the mini-pc, I did have a fun speculating on what he could use it. As shared by Romane as his case has shared, the first thing to my mind was backups. Filesystems are notorious in the sense they can be corrupted or can be prone to be corrupted very easily as can be seen above . Backups certainly make a lot of sense, especially rsync.
The other thing that came to my mind was having some sort of A.I. and chat server. IIRC, somebody has put quite a bit of open source public domain data in debian servers that could be used to run either a chatbot or an A.I. or both and use that similar to how chatGPT but with much limited scope than what chatgpt uses. I was also thinking a media server which Vishal did share he does. I may probably visit him sometime to see what choices he did and what he learned in the process, if anything.
Another thing that could be done is just take a dump of any of commodity markets or any markets and have some sort of predictive A.I. or whatever. A whole bunch of people have scammed thousands of Indian users on this, but if you do it on your own and for your own purposes to aid you buy and sell stocks or whatever commodity you may fancy. After all, nowadays markets themselves are virtual.
While Vishal s mini-pc doesn t have any graphics, if it was an AMD APU mini-pc, something like this he could have hosted games in the way of thick server, thin client where all graphics processing happens on the server rather than the client. With virtual reality I think the case for the same case could be made or much more. The only problem with VR/AR is that we don t really have mass-market googles, eye pieces or headset. The only notable project that Google has/had in that place is the Google VR Cardboard headset and the experience is not that great or at least was not that great few years back when I could hear and experience the same. Most of the VR headsets say for example the Meta Quest 2 is for around INR 44k/- while Quest 3 is INR 50k+ and officially not available. As have shared before, the holy grail of VR would be when it falls below INR 10k/- so it becomes just another accessory, not something you really have to save for. There also isn t much content on that but then that is also the whole chicken or egg situation. This again is a non-stop discussion as so much has been happening in that space it needs its own blog post/article whatever.
Till later.
Update: thanks to the very kind involvment of the widow of our wemaster, we
could provide enough private information to Dreamhost, who finally accepted to
reset the password and the MFA. We have recovered evrything! Many thanks to
everybody who helped us!
Due to tragic circumstances, one association that I am part of,
Sciencescope got locked out of its account
at Dreamhost. Locked out, we can not pay the annual bill. Dreamhost
contacted us about the payment, but will not let us recover the access to
our account in order to pay. So they will soon close the account. Our
website, mailing lists and archives, will be erased. We provided plenty of
evidence that we are not scammers and that we are the legitimate owners of
the account, but reviewing it is above the pay grade of the custommer
support (I don't blame them) and I could not convince them to let somebody
higher have a look at our case.
If you work at Dreamhost and want to keep us as custommers instead of
kicking us like that, please ask the support service in charge of ticket
225948648 to send the recovery URL to the secondary email adddresses (the
ones you used to contact us about the bill!) in addition to the primary
one (which nobody will read anymore). You can encrypt it for my Debian
Developer key 73471499CC60ED9EEE805946C5BD6C8F2295D502 if you worry it gets
in wrong hands. If you still have doubts I am available for calls any time.
If you know somebody working at Dreamhost can you pass them the message?
This would be a big, big, relief for our non-profit association.
Today I noticed bounces in my mail box. They were from ikiwiki trying
to send registration confirmation email to users who probably never
asked for it.
I'm getting truly fed up with spam in my wiki. At this point, all
comments are manually approved and I still get trouble: now it's
scammers spamming the registration form with dummy accounts, which
bounce back to me when I make new posts, or just generate backscatter
spam for the confirmation email. It's really bad. I have hundreds of
users registered on my blog, and I don't know which are spammy, which
aren't. So. I'm considering ditching ikiwiki comments altogether.
I am testing Mastodon as a commenting platforms. Others
(e.g. JAK) have implemented this as a server but a simpler
approach is toload them dynamically from Mastodon, which is what Carl
Shwan has done. They are using Hugo, however, so they can easily
embed page metadata in the template to load the right server with the
right comment ID.
I wasn't sure how to do this in ikiwiki: it's typically hard to access
page-specific metadata in templates. Even the page name is not
there, for example.
I have tried using templates, and that (obviously?) fails because
the <script> stuff gets sanitized away. It seems I would need to
split the JavaScript out of the template into a base template and then
make the page template refer to a function in there. It's kind of
horrible and messy.
I wish there was a way to just access page metadata from the page
template itself... I found out the meta plugin passes along its
metadata, but that's not (easily) extensible. So i'd need to either
patch that module, and my history of merged patches is not great
so far.
So: another plugin.
I have something that kind of works that's a combination of a
page.tmpl patch and a plugin. The plugin adds a mastodon
directive that feeds the page.tmpl with the right stuff. On clicking
a button, it injects comments from the Mastodon API, with a JavaScript
callback. It's not pretty (it's not themed at all!), but it works.
If you want to do this at home, you need this page.tmpl (or at
least this patch and that one) and the mastodon.pm
plugin from my mastodon-plugin branch.
I'm not sure this is a good idea. The first test I did was a "test
comment" which led to half a dozen "test reply". I then realized I
couldn't redact individual posts from there. I don't even know if,
when I mute a user, it actually gets hidden from everyone else too...
So I'll test this for a while, I guess.
I have also turned off all CGI on this site. It will keep users from
registering while I cleanup this mess and think about next steps. I
have other options as well if push comes to shove, but I'm
unlikely to go back to ikiwiki comments.
Mastodon comments are nice because they don't require me to run any
extra software: either I have my own federated service I reuse, or I
use someone else's, but I don't need to run something extra. And, of
course, comments are published in a standard way that's interoperable
with everything...
On the other hand, now I won't have comments enabled until the blog is
posted on Mastodon... Right now this happens only when feed2exec
runs and the HTTP cache expires, which can take up to a day. I
should probably do this some other way, like flush the cache when a
new post arrives, or run post-commit hooks, but for now, this will
have to do.
Update: I figured out a way to make this work in a timely manner:
there's a post-merge hook in my ikiwiki git repository which
calls feed2exec in /home/w-anarcat/source/.git/hooks/ took
me a while to find it! I tried post-update and post-receive
first, but ikiwiki actually pulls from the bare directory in the
source directory, so only post-merge fires (even though it's not
a merge)
feed2exec then finds new blog posts (if any!) and fires up the new
ikiwikitoot plugin which then...
posts the toot using the toot command (it just works, why
reinvent the wheel), keeping the toot URL
finds the Markdown source file associated with the post, and adds
the magic mastodon directive
commits and pushes the result
This will make the interaction with Mastodon much smoother: as soon as
a blog post is out of "draft" (i.e. when it hits the RSS feeds), this
will immediately trigger and post the blog entry to Mastodon, enabling
comments. It's kind of a tangled mess of stuff, but it works!
I have briefly considered not using feed2exec for this, but it turns
out it does an important job of parsing the result of ikiwiki's
rendering. Otherwise I would have to guess which post is really a blog
post, is this just an update or is it new, is it a draft, and so
on... all sorts of questions where the business logic already resides
in ikiwiki, and that I would need to reimplement myself.
Plus it goes alongside moving more stuff (like my feed reader) to
dedicated UNIX accounts (in this case, the blog sandbox) for security
reasons. Whee!
I think most people and everyone who reads my blog is familiar with the phone support scams that are common nowadays. There s the we are Microsoft support and have found a problem with your PC , the we are from your ISP and want to warn you that your Internet access will be cut off , and the here s the bill for something expensive and we need you to confirm whether you want to pay .
Most people hang up when scammers call them and don t call them back. But I like to talk to them. I review the quality of their criminal enterprise and tell them that I expect better quality criminals to call me. I ask them if they are proud to be criminals and if their parents would be proud of them. I ask them if they are paid well to be a criminal. Usually they just hang up and on one occasion the criminal told me to get lost before hanging up.
Today I got a spam message telling me to phone +61-2-8006-7237 about an invoice for Norton Software Enhancer and Firewall Defender if I wanted to dispute it. It was interesting that they had an invoice number in the email which they asked me for when I called, at the time I didn t think to make up an invoice number with the same format to determine if they were actually looking it up, in retrospect I should have used a random 9 digit number to determine if they had a database for this.
On the first call they just hung up on me. The second call they told me you won t save anyone before hanging up. The third call I got on to a friendly and talkative guy who told me that he was making good money being a criminal. I asked if he was in India or Australia (both guys had accents from the Indian subcontinent), he said he was in Pakistan. He said that he made good money by Pakistani standards as $1 Australian is over 100 Pakistani Rupees. He asked me if I d like to work for him, I said that I make good money doing legal things, he said that if I have so much money I could send him some. ;) He also offered to take me on a tour of Islamabad if I visited, this could have been a genuine offer to have a friendly meeting with someone from the opposite site of computer security or an attempt at kidnap for ransom. He didn t address my question about whether the local authorities would be interested in his work, presumably he thinks that a combination of local authorities not caring much and the difficulty of tracking international crime makes him safe.
It was an interesting conversation, I encourage everyone to chat to such criminals. They are right that you won t save anyone. But you can have some fun and occasionally learn some interesting things.
Related posts:
Talking Fast My previous post about my LCA mini-conf talk received an...
Today I d like to post a few updates about COVID-19 which I have gathered from credible sources, as well as some advice also gathered from credible sources.
Summary
Coronavirus causes health impacts requiring hospitalization in a significant percentage of all adult age groups.
Coronavirus also can cause no symptoms at all in many, especially children.
Be serious about social distancing.
COVID-19 is serious for young adults too
According to this report based on a CDC analysis, between 14% and 20% of people aged 20 to 44 require hospitalization due to COVID-19. That s enough to be taken seriously. See also this CNN story.
Act as if you are a carrier because you may be infected and not even know it, even children
Information on this is somewhat preliminary, but it is certainly known that a certain set of cases is asymptomatic. This article discusses manifestations in children, while this summary of a summary (note: not original research) suggests that 17.9% of people may not even know they are infected.
How serious is this? Serious.
This excellent article by Daniel W. Johnson, MD, is a very good read. Among the points it makes:
Anyone that says it s no big deal is wrong.
If we treat this like WWI or WWII and everyone does the right things, we will be harmed but OK. If many but not all people do the right things, we ll be like Italy. If we blow it off, our health care system and life as we know it will be crippled.
If we don t seriously work to flatten the curve, many lives will be needlessly lost
Advice
I m going to just copy Dr. Johnson s advice here:
You and your kids should stay home. This includes not going to church, not going to the gym, not going anywhere.
Do not travel for enjoyment until this is done. Do not travel for work unless your work truly requires it.
Avoid groups of people. Not just crowds, groups. Just be around your immediate family. I think kids should just play with siblings at this point no play dates, etc.
When you must leave your home (to get groceries, to go to work), maintain a distance of six feet from people. REALLY stay away from people with a cough or who look sick.
When you do get groceries, etc., buy twice as much as you normally do so that you can go to the store half as often. Use hand sanitizer immediately after your transaction, and immediately after you unload the groceries.
I m not saying people should not go to work. Just don t leave the house for anything unnecessary, and if you can work from home, do it.
Everyone on this email, besides Mom and Dad, are at low risk for severe disease if/when they contract COVID-19. While this is great, that is not the main point. When young, well people fail to do social distancing and hygiene, they pick up the virus and transmit it to older people who are at higher risk for critical illness or death. So everyone needs to stay home. Even young people.
Tell every person over 60, and every person with significant medical conditions, to avoid being around people. Please do not have your kids visit their grandparents if you can avoid it. FaceTime them.
Our nation is the strongest one in the world. We have been through other extreme challenges and succeeded many times before. We WILL return to normal life. Please take these measures now to flatten the curve, so that we can avoid catastrophe.
I d also add that many supermarkets offer delivery or pickup options that allow you to get your groceries without entering the store. Some are also offering to let older people shop an hour before the store opens to the general public. These could help you minimize your exposure.
Other helpful links
Here is a Reddit megathread with state-specific unemployment resources.
Scammers are already trying to prey on people. Here are some important tips to avoid being a victim.
Although there are varying opinions, some are recommending avoiding ibuprofen when treating COVID-19.
Bill Gates had some useful advice. Here s a summary emphasizing the need for good testing.
Work has been hellishly busy lately, so that's pretty much all I've been
doing. The major project I'm working on should be basically done in the
next couple of weeks, though (fingers crossed), so maybe I'll be able to
surface a bit more after that.
In the meantime, I'm still acquiring books I don't have time to read,
since that's my life. In this case, two great Humble Book Bundles were
too good of a bargain to pass up. There are a bunch of books in here that
I already own in paperback (and hence showed up in previous haul posts),
but I'm running low on shelf room, so some of those paper copies may go to
the used bookstore to make more space.
Kelley Armstrong Lost Souls (sff)
Clive Barker Tortured Souls (horror)
Jim Butcher Working for Bigfoot (sff collection)
Octavia E. Butler Parable of the Sower (sff)
Octavia E. Butler Parable of the Talents (sff)
Octavia E. Butler Unexpected Stories (sff collection)
Octavia E. Butler Wild Seed (sff)
Jacqueline Carey One Hundred Ablutions (sff)
Richard Chizmar A Long December (sff collection)
Jo Clayton Skeen's Leap (sff)
Kate Elliot Jaran (sff)
Harlan Ellison Can & Can'tankerous (sff collection)
Diana Pharoh Francis Path of Fate (sff)
Mira Grant Final Girls (sff)
Elizabeth Hand Black Light (sff)
Elizabeth Hand Saffron & Brimstone (sff collection)
Elizabeth Hand Wylding Hall (sff)
Kevin Hearne The Purloined Poodle (sff)
Nalo Hopkinson Skin Folk (sff)
Katherine Kurtz Camber of Culdi (sff)
Katherine Kurtz Lammas Night (sff)
Joe R. Lansdale Fender Lizards (mainstream)
Robert McCammon The Border (sff)
Robin McKinley Beauty (sff)
Robin McKinley The Hero and the Crown (sff)
Robin McKinley Sunshine (sff)
Tim Powers Down and Out in Purgatory (sff)
Cherie Priest Jacaranda (sff)
Alastair Reynolds Deep Navigation (sff collection)
Pamela Sargent The Shore of Women (sff)
John Scalzi Miniatures (sff collection)
Lewis Shiner Glimpses (sff)
Angie Thomas The Hate U Give (mainstream)
Catherynne M. Valente The Bread We Eat in Dreams (sff collection)
Connie Willis The Winds of Marble Arch (sff collection)
M.K. Wren Sword of the Lamb (sff)
M.K. Wren Shadow of the Swan (sff)
M.K. Wren House of the Wolf (sff)
Jane Yolen Sister Light, Sister Dark (sff)
Summer vacations have been getting tougher in recent years. Airlines cut into your precious vacation time with their online check-in procedures and a dozen reminder messages, there is growing concern about airport security and Brexit has already put one large travel firm into liquidation leaving holidaymakers in limbo.
If that wasn't all bad enough, now there is a new threat: while you are relaxing in the sun, scammers fool your phone company into issuing a replacement SIM card or transferring your mobile number to a new provider and then proceed to use it to take over all your email, social media, Paypal and bank accounts. The same scam has been appearing around the globe, from Britain to Australia and everywhere in between. Many of these scams were predicted in my earlier blog SMS logins: an illusion of security (April 2014) but they are only starting to get publicity now as more aspects of our lives are at risk, scammers are ramping up their exploits and phone companies are floundering under the onslaught.
With the vast majority of Internet users struggling to keep their passwords out of the wrong hands, many organizations have started offering their customers the option of receiving two-factor authentication codes on their mobile phone during login. Rather than making people safer, this has simply given scammers an incentive to seize control of telephones, usually by tricking the phone company to issue a replacement SIM or port the number. It also provides a fresh incentive for criminals to steal phones while cybercriminals have been embedding code into many "free" apps to surreptitiously re-route the text messages and gather other data they need for an identity theft sting.
Sadly, telephone networks were never designed for secure transactions. Telecoms experts have made this clear numerous times. Some of the largest scams in the history of financial services exploited phone verification protocols as the weakest link in the chain, including a $150 million heist reminiscent of Ocean's 11.
For phone companies, SMS messaging came as a side-effect of digital communications for mobile handsets. It is less than one percent of their business. SMS authentication is less than one percent of that. Phone companies lose little or nothing when SMS messages are hijacked so there is little incentive for them to secure it. Nonetheless, like insects riding on an elephant, numerous companies have popped up with a business model that involves linking websites to the wholesale telephone network and dressing it up as a "security" solution. These companies are able to make eye-watering profits by "purchasing" text messages for $0.01 and selling them for $0.02 (one hundred percent gross profit), but they also have nothing to lose when SIM cards are hijacked and therefore minimal incentive to take any responsibility.
Companies like Google, Facebook and Twitter have thrown more fuel on the fire by encouraging and sometimes even demanding users provide mobile phone numbers to "prove they are human" or "protect" their accounts. Through these antics, these high profile companies have given a vast percentage of the population a false sense of confidence in codes delivered by mobile phone, yet the real motivation for these companies does not appear to be security at all: they have worked out that the mobile phone number is the holy grail in cross-referencing vast databases of users and customers from different sources for all sorts of creepy purposes. As most of their services don't involve any financial activity, they have little to lose if accounts are compromised and everything to gain by accurately gathering mobile phone numbers from as many users as possible.
Can you escape your mobile phone while on vacation?
Just how hard is it to get a replacement SIM card or transfer/port a user's phone number while they are on vacation? Many phone companies will accept instructions through a web form or a phone call. Scammers need little more than a user's full name, home address and date of birth: vast lists of these private details are circulating on the black market, sourced from social media, data breaches (99% of which are never detected or made public), marketing companies and even the web sites that encourage your friends to send you free online birthday cards.
Every time a company has asked me to use mobile phone authentication so far, I've opted out and I'll continue to do so. Even if somebody does hijack my phone account while I'm on vacation, the consequences for me are minimal as it will not give them access to any other account or service, can you and your family members say the same thing?
What can be done?
Opt-out of mobile phone authentication schemes.
Never give the mobile phone number to web sites unless there is a real and pressing need for them to call you.
Tell firms you don't have a mobile phone or that you share your phone with your family and can't use it for private authentication.
If you need to use two-factor authentication, only use technical solutions such as smart cards or security tokens that have been engineered exclusively for computer security. Leave them in a locked drawer or safe while on vacation. Be wary of anybody who insists on SMS and doesn't offer these other options.
Rather than seeking to "protect" accounts, simply close some or all social media accounts to reduce your exposure and eliminate the effort of keeping them "secure" and updating "privacy" settings.
If your bank provides a relationship manager or other personal contact, this
can also provide a higher level of security as they get to know you.
What happened in the reproducible
builds effort this week:
Media coverage
Nathan Willis covered our DebConf15 status
update in Linux Weekly News. Access to
non-LWN subscribers will be given on Thursday 24th.
Linux Journal published a more general
piece
last Tuesday.
Unexpected praise for reproducible builds appeared this week in the form of
several iOS applications identified as including spyware. The malware was
undetected by Apple screening. This actually happened because
application developers had simply downloaded a trojaned version of XCode
through an unofficial
source. While reproducible builds can't really help users of non-free software, this is exactly the kind of attacks that we are trying to prevent in our systems.
Toolchain fixes
#799410 on segment by Chris Lamb: use date of the latest debian/changelog entry as build date.
reproducible.debian.net
Tests for Coreboot, OpenWrt, NetBSD, and FreeBSD now runs weekly (instead of monthly).
diffoscope development
Python 3 offers new features (namely yield from and concurrent.futures) that could help implement parallel processing. The clear separation of bytes and unicode strings is also likely to reduce encoding related issues.
Mattia Rizolo thus kicked the effort of porting diffoscope to Python 3. tlsh was the only dependency missing a Python 3 module. This got quickly fixed by a new upload.
The rest of the code has been moved to the point where only incompatibilities between Python 2.7 and Pyhon 3.4 had to be changed. The commit stream still require some cleanups but all tests are now passing under Python 3.
Documentation update
The documentation on how to assemble the weekly reports has been updated. (Lunar)
The example on how to use SOURCE_DATE_EPOCH with CMake has been improved. (Ben Beockel, Daniel Kahn Gillmor)
The solution for timestamps in man pages generated by Sphinx now uses SOURCE_DATE_EPOCH. (Mattia Rizzolo)
Package reviews
45 reviews have
been removed, 141 added and 62 updated this week.
67 new FTBFS reports have been filled by Chris Lamb, Niko Tyni, and Lisandro Dami n Nicanor P rez Meyer.
New issues added this week: randomness_in_r_rdb_rds_databases, python-ply_compiled_parse_tables.
Misc.
The prebuilder script is now properly testing umask variations again.
Santiago Villa started a discussion on debian-devel on how binNMUs would work for reproducible builds.
I would expect brute-force login attacks to be more common. And yes, at some point I got tired of ssh scans, and added rate-limiting firewall rules, even switched the daemon to a nonstandard port... But I have very seldom received an IMAP brute-force attack. I have received countless phishing scams on my users, and I know some of them have bitten because the scammers then use their passwords on my servers to send tons of spam. Activity is clearly atypical.
Anyway, yesterday we got a brute-force attack on IMAP. A very childish atack, attempted from an IP in the largest ISP in Mexico, but using only usernames that would not belong in our culture (mosty English firstnames and some usual service account names).
What I find interesting to see is that each login was attempted a limited (and different) amount of times: Four account names were attempted only once, eight were attempted twice, and so on following this pattern:
(each dot represents four attempts)
So... What's significant in all this? Very little, if anything at all. But for such a na ve login attack, it's interesting to see the number of attempted passwords per login varies so much. Yes, 273 (over of the total) did 22 requests, and another 200 were 18 and more. The rest... Fell quite shorter.
In case you want to play with the data, you can grab the list of attempts with the number of requests. I filtered out all other data, as i was basically meaningless. This file is the result of:
Another post about the Valve/Collabora free games thing. This time, the bad bit people trying to scam free games from us.
Before I start, I want to make one thing clear there are people who have requested keys who don t meet the criteria, but are honest and legitimate in their requests. This blogspam is not about them at all. If you re in that category, you re not being complained about.
So. Some numbers. At time of writing, I ve assigned keys to 279 Debian Developers or Debian Maintainers almost 25% of the total eligible pool of about 1200.
I ve denied 22 requests. Of these 10 were polite requests from people who didn t meet the conditions stated (e.g. Ubuntu developers rather than Debian). These folks weren t at all a problem for us, and I explained politely that they didn t meet the terms we had agreed at the time with Valve. No problem at all with those folks.
Next, we have the chancers, 7 of them, who pretended to be eligible when they clearly weren t. For example, two people sent me signed requests pointing to their entry on the Debian New Maintainers page when challenged over the key not being in the keyring. The NM page showed that they had registered as non-uploading Debian Contributors a couple of hours previously. A few just claimed I am a DD, here is my signature when they weren t DDs at all. Those requests were also binned.
DENIED
And then we move onto the final category. These people tried identity theft, but did a terrible job of it. There were 5 people in this category:
This is not a signature, it s a fingerprint. Amusingly, it s not the fingerprint for the person who sent my mail, but that of Neil McGovern a co-worker at Collabora. Neil assured me he knew how to sign a mail properly, so I shitcanned that entry.
From: "Xxxxx, Xxxxxxxxx" <x.xxxxx@bbw-bremen.de>
Subject: Incoming!
Hey dude,
I want to have the redemption code you are offering for the Valve Games
mQGiBEVhrscRBAD4M5+qxhZUD67PIz0JeoJ0vB0hsLE6QPV144PLjLZOzHbl4H3N
...snip...
Lz8An1TEmmq7fltTpQ+Y1oWhnE8WhVeQAKCzh3MBoNd4AIGHcVDzv0N0k+bKZQ=3D=3D
=3Du/4R
Wat? Learn to GPG!
From: Xxxxxx-Xxxx Le Xxxxxxx Xxxx <xx.xxxxxxxxx@gmail.com>
Subject: pass steam
Hey me voila
Merci beaucoup
valve
2069 1DFC C2C9 8C47 9529 84EE 0001 8C22 381A 7594
Like the first one, a fingerprint. This one is for S bastien Villemot. Don t scammers know how to GPG sign?
From: "Xxxxxxxxx Xxxxxxx" <xxxxxxxx@web.de>
Subject: thanks /DD/Steam gifts us finally something back
0x6864730DF095E5E4
Yet again, a fingerprint. This one is for Marco Nenciarini. I found this request particularly offensive due to the subject line the haughty tone from an identity thief struck me as astonishingly impertinent. Still, when will scammers learn to GPG?
From: Sven Hoexter <svenhoexter@gmail.com>
Subject: Valve produced games
I'm would like to get the valve produced games
My keyring: 0xA6DC24D9DA2493D1 Sven Hoexter <hoexter> sig:6
Easily the best scam effort, since this is the only one which both a) registered an email address under the name of a DD, and b) used a fingerprint which actually corresponds to that human. Sadly for the scammer, I m a suspicious kind of person, so my instinct was to verify the claim via IRC.
31-01-2014 16:52:48 > directhex: Hoaxter, have you started using gmail without updating your GPG key? (note: significantly more likely is someone trying to steal your identity a little to steal valve keys from collabora)
31-01-2014 16:54:51 < Hoaxter!~sh@duckpond6.stormbind.net: directhex: I do not use any Google services and did not change my key
So yeah. Nice try, scammer.
I m not listing, in all of this, the mails which Neil received from people who didn t actually read his mail to d-d-a.
I m also not listing a story which I ve only heard second ha actually no, this one is too good not to share. Someone went onto db.debian.org, did a search for every DD in France, and emailed every Jabber JID (since they look like email addresses) asking them to forward unwanted keys.
All in all, the number of evildoers is quite low, relative to the number of legitimate claims 12 baddies to 279 legitimate keys issued. But still, this is why the whole key issuing thing has been taking me so long and why I have the convoluted signature-based validation system in place.
Enjoy your keys, all 279 of you (or more by the time some of you read this). The offer has no explicit expiry on it Valve will keep issuing keys as long as there is reason to, and Collabora will continue to administer their allocation as long as they remain our clients. It s a joint gift to the community thousands of dollars worth of games from Valve, and a significant amount of my time to administer them from Collabora.
Email spam is a plague, but sometimes there is at least on category of
spammers it is easy to have fun with: naive manual spammers. People that try to
do more or less legal business, using Internet in an illegitimate way, for
instance (this is a real example, including the spammer's address: spamming
bots, please use it ;-) !):
From: Emma Perroni <emmaperroni@gmail.com>
Subject: Hello
Hello,
Do you have a Facebook page? If you do, I can offer you to add fans by
hunders/thouthands in a single day using an original (and confidential)
technique. We can also add subscribers to Twitter, Youtube or Google+1.
Prices: 10 for 100 fans, -20% for more than 1000 fans ordered.
Regards
Reporting
Well, in that case it may or may not be a scam, but even if it is not a
criminal activity such as selling fake drugs, it is not a very honest business.
Anyway, that lady is using her Google account to send her crap, so neutralizing
her is quite easy:
checking that it really comes from Google Mail, using DKIM or SPF;
writing to Google, reporting that spam (and, in that specific case, the
abuse they are offering to commit on Google +1);
optional, do not do that with scammers: replying to the spammer explaining that this is spamming, that
you reported it and that she can expect to loose her Google account and
everything on it.
That should work with any good email provider, that is, any provider that
listens to complaints at <abuse@> and takes action on them. For what I
have seen, Google and Yahoo! are, but fossils such as traditional national
telephonists are not. If the message headers allow you to identify it, you can
also report the abuse to the spammer's network operator if it is a good one
(this is rarely the case).
Consequences
With a bit of luck, that can seriously damage the business of the spammer,
and if he was really careless (e.g. storing important documents on the same
Google account with no local backup), cause serious trouble in his personal
stuff. If you replied to the spammer, you can get fun answers such as (these
are taken from real examples I got):
Ha ha ha, why not calling the FBI? That's it, laugh while you can,
do you think your provider does not care? Too bad, he does, so
you may change of mood when you see the effects loosing one's online
account.
We are doing legal business, you will stop your harrassment or we will
file a complain. Yes, please do so if you dare, but may I remember
you that you are the one at fault here? (in fact, such a reaction is
a very good sign, since it shows that the spammer is actually afraid,
probably for his business)
Why did you do that? I promise, I shall not do it again, please Too
late, lamer, you should have thought of that before sending your
crap
Conclusion
This is too complicated to be done for each spam of course, but it is worth
doing for spam messages that are not catch by one's antispam. And the rules for
email marketing are well known: only write to people that explicitly allowed
you to do so, full stop, so there is no reason to show any mercy for a
spammer.
When Facebook became "the next big thing", you had the "like" buttons pop
up on various web sites. An of course "going viral" was the big thing everybody
talked about, in particular SEO experts (or those that would like to be that).
But things have changed. In particular Facebook has. In the beginning, any
"like" would be announced in the newsfeed to all your friends. This was what allowed
likes to go viral, when your friends re-liked the link. This is what made it
attractive to have like buttons on your web pages. (Note that I'm not referring
to "likes" of a single Facebook post; they are something quite
different!)
Once that everybody "knew" how important this was, everbody tried to make
the most out of it. In particular scammers, viruses and SEO people. Every other
day, some clickjacking application would flood Facebook with likes. Every
backwater website was trying to get more audience by getting "liked". But at
some point Facebook just stopped showing "likes". This is not bad. It is
the obvious reaction when people get too annoyed by the constant "like
spam". Facebook had to put an end to this.
But now that a "like" is pretty much worthless (in my opinion). Still,
many people following "SEO Tutorials" are all crazy about likes. Instead, we
should reconsider whether we really want to slow down our site loading by
having like buttons on every page. A like button is not as lightweight as you
might think it is. It's a complex JavaScript that tries to detect clickjacking
attacks, and in fact invades your users' privacy, up to the point where for
example in Germany it may even be illegal to use the Facebook like button on a
web site.
In a few months, the SEO people will realize that the "like"s are a fad
now, and will likely all try to jump the Google+ bandwagon. Google+ is probably
not half as much a "dud" as many think it is (because their friends are still
on Facebook and because you cannot scribble birthday wishes on a wall in
Google+). The point is that Google can actually use the "+1" likes to improve
everyday search results. Google for something a friend liked, and it will show
up higher in the search results, and Google will show the friend who
recommended it. Facebook cannot do this, because it is not a search engine (well,
you can use it for searching people, although Ark
probably is better at this, and one does nowhere search as many people as one
does regular web searches).
Unless they go into a strong partnership with Microsoft Bing or Yahoo, the
"like"s can never be as important as Google "+1" likes. So don't underestimate
the Google+ strategy on the long run.
There are more points where Facebook by now is much less useful as it used
to be. For example event invitations. When Facebook was in full growth,
you could essentially invite all your friends to your events. You could also
use lists to organize your friends, and invite only the appropriate subset,
if you cared enough. The problem again was: nobody cared enough. Everybody
would just invite all their friends, and you would end up getting "invitation
spam" several times a day. So again Facebook had to change and
limit the invitation capabilities. You can no longer invite all, or even just
all on one particular list. There are some tools and tricks that can work
around this to some extend, but once everybody uses that, Facebook will just
have to cut it down even further.
Similarly, you might remember "superpoke" and all the "gift" applications.
Facebook (and the app makers) probably made a fortune on them with premium
pokes and gifts. But then this too reached a level that started to annoy the
users, so they had to cut down the ability of applications to post to walls.
And boom, this segment essentially imploded. I havn't seen numbers on Facebook
gaming, and I figure that by doing some special setup for the games Facebook
managed to keep them somewhat happy. But many will remember the time when
the newsfeed would be full of Farmville and Mafia Wars crap ... it just does no
longer work this way.
So when working with Facebook and such, you really need to be on the move.
Right now it seems that groups and applications are more useful to get that
viral dream going. A couple of apps such as Yahoo currently require you to
install their app (which then may post to your wall on your behalf and get your
personal information!) to follow a link shared this way, and then can actively
encourage you to reshare. And messages sent to a "Facebook group" are more
likely to reach people that aren't direct friends of yours. When friends
actually "join" an event, this is currently showing up in the news feed. But
all of this can change with 0 days notice.
It will be interesting to see if Facebook can on the long run keep up with
Googles ability to integrate the +1 likes into search results. It probably
takes just a few success stories in the SEO community to become the "next big
thing" in SEO to get +1 instead of Facebook likes. Then Google just has to
wait for them to virally spread +1 adoption. Google can wait - its Google Plus
growth rates aren't bad, and they have a working business model already that
doesn't rely on the extra growth - they are big already and make good profits.
Facebook however is walking on a surprisingly thin line. They need a tight
control on the amount of data shared (which is probably why they try to do this
with "magic"). People don't want to have the impression that Facebook is hiding
something from them (although it is in fact suppressing a huge part of your
friends activity!), but they also don't want to get all this data spammed onto
them. And in particular, it needs to give the web publishers and app developers
the right amount of that extra access to the users, while in turn keeping the
major spam away from the users.
Independent of the technology and actual products, it will be really
interesting to see if we manage to find some way to keep the balance in "social"
one-to-many communication right. It's not a fault of Facebook that many people
"spam" all their friends with all their "data". Googles Circles probably isn't the
final answer either. The reason why email still works rather well was probably
because it makes one-to-one communication easier than one-to-many,
because it isn't realtime, and because people expect you to
put enough effort into composing your mails and choosing the right receipients
for the message. Current "social" communication is pretty much posting
everything to everyone you know adressed as "to whoever it may concern". Much
of it is in fact pretty non-personal or even non-social. We have definitely
reached the point where more data is shared than is being read. Twitter is
probably the most extreme example of a "write-only" medium. The average number a
tweet is read by a human except the original poster must be way below 1, and
definitely much less than the average number of "followers".
So in the end, the answer may actually be a good automatic address
book, with automatic groups and rich clients, to enable everybody
to easily use email more efficiently. On the other hand, separting "serious"
communication from "entertainment" communication may be well worth having a
separate communications channel, and email definitely is dated and is having
spam problems.
On Wednesday, February 1, a new virtual server May First/People Link recently rented went offline. We contracted the virtual server through Server4All because we need their un-metered 100Mbit connection to help us handle the bandwidth for Sahara Reporters, one of the most important independent news sources for Saharan Africa. With the server offline, the web site was down as well.
We scrambled to setup alternative caching servers to handle the bandwidth.
When I logged into our control panel, I saw the message: This virtual server has been suspended by the administrator. Please contact support.
I immediately contacted support and then received the message:
Hello
We have received the following complaint associated with your server/service.
IP: 76.73.121.164
To prevent any further abuse we have suspended this service. In order to
resume, we request you to cooperate with our investigation as promptly as
possible. Please respond to us with the following details:
(1) What has caused the complaint
(2) What is the server used for. Purpose?
(3) How can you resolve the complaint and make sure it will not be repeated.
Depending on the nature of the complaint and your response, we will put back
the server online. Please note, this has violated our Terms Of Service. We
expect your response within 24 hours, otherwise your account will be
terminated permanently. Thank you
What?? What complaint?? I followed up but had to wait til the next day to get the response.
Here is the full log,
An email advertizing the Domain Name: saharareporters.com
has been sent to the blacklist.woody.ch spamtrap.
This Domain does resolve to IP addresses one of which your are responsible:
76.73.121.164
Please investigate why this Domain has been advertized.
Attached you find the headers and reports in ARF for automatic processing.
Feedback is appreciated.
Actual listing periods:
Bounce: 1 Hour in DNS.
Whitelisted IP: Not lised in DNS.
Spam: 24 hours in DNS.
Every Hit: 14 days in evidence DB.
For any questions or Feedback, contact abuse@woody.ch
From: is intentionally set to a bit-bucket.
Kind regards
-Benoit Panizzon-
There is no attachment. I went to woody.ch and it was in German. Then tried blacklist.woody.ch, but no luck. Finally I found the Woody's World Blacklist Page. I plugged in our IP address into their checker and I got:
Output from the Check, if empty the IP is not listed.
164.121.73.76.[name of the blacklist] being tested.
Host 164.121.73.76.blacklist.woody.ch not found: 3(NXDOMAIN)
Host 164.121.73.76.blacklist.woody.ch not found: 3(NXDOMAIN)
Host 164.121.73.76.rbl.maps.vix.com not found: 3(NXDOMAIN)
Host 164.121.73.76.rbl.maps.vix.com not found: 3(NXDOMAIN)
Host 164.121.73.76.relays.mail-abuse.org not found: 3(NXDOMAIN)
Host 164.121.73.76.relays.mail-abuse.org not found: 3(NXDOMAIN)
;; connection timed out; no servers could be reached
;; connection timed out; no servers could be reached
;; connection timed out; no servers could be reached
;; connection timed out; no servers could be reached
Host 164.121.73.76.relays.ordb.org not found: 3(NXDOMAIN)
Host 164.121.73.76.relays.ordb.org not found: 3(NXDOMAIN)
Host 164.121.73.76.dev.null.dk not found: 3(NXDOMAIN)
Host 164.121.73.76.dev.null.dk not found: 3(NXDOMAIN)
Host 164.121.73.76.blackholes.five-ten-sg.com not found: 3(NXDOMAIN)
Host 164.121.73.76.blackholes.five-ten-sg.com not found: 3(NXDOMAIN)
Host 164.121.73.76.bl.spamcop.net not found: 3(NXDOMAIN)
Host 164.121.73.76.bl.spamcop.net not found: 3(NXDOMAIN)
Host 164.121.73.76.relays.visi.com not found: 3(NXDOMAIN)
Host 164.121.73.76.relays.visi.com not found: 3(NXDOMAIN)
164.121.73.76.blacklist.spambag.org has address 208.91.197.182
164.121.73.76.blacklist.spambag.org descriptive text "v=spf1 -all"
So, Woody's World thinks we are listed in spambag.org. I went to spambag.org and learned that the domain is for sale. I then tried blacklist.spambag.org and got the same page. This page has many links all pointing to advertisements. The "RBL List" link takes me to a page advertising "5 foods you must not eat."
Next, out of curiousity, I tried Mxtoolbox. I got one hit from Barricuda. Barricuda says the reputation of the IP address is "poor". Why? According to Barricuda, the reasons could be:
Your email server contains a virus and has been sending out spam.
Your email server may be improperly configured.
Your PC may be infected with a virus or botnet software program.
Someone in your organization may have an infected PC with a virus or botnet program.
You may be using a dynamic IP address which was previously used by a known spammer.
Your marketing department may be sending out bulk emails that do not comply with the CAN-SPAM Act.
You may have an insecure wireless network which is allowing unknown users to use your network to send spam.
In some rare cases, your recipient's Barracuda Spam Firewall may be improperly configured.
Keep in mind, this IP address is not used for sending email. It's just the web site.
I then took a step back and re-read the complaint and noticed that it says that the domain name saharareporters.com was listed in a spam email. Hm. More concerted searching for the terms "woody spamtrap blacklist" and I found a pattern in URLs that suggested I plug in the following:
http://news.scoutnet.org/rblhostlist.php?id=saharareporters.com.uri
And sure enough, there was a result. In short, it was a classic Nigerian Oil scam in which the person claims to be "JAMES IBORI ex-governor of DELTA STATE oil city." The scammer acknowledges that he has been arrested, but promises lots of cash to the person who can help him. In an effort to boost their credibility, the scammer included a link to a Sahara Reporters article about the real James Ibori.
And that, my friends, is enough to have one of the most prominent independent African news organization taken offline.
But, Sahara Reporters shouldn't necessarily feel singled out. Sahara Reporters should feel singled out. They exist to illuminate news from Africa. They were taken offline because a series of individuals don't know the difference between a prominent independent African news service and a criminal scammer. To most of the Internet, Nigeria and email scams are synonymous. That has to change.
Although Sahara Reporters is particularly vulnerable, any site hosted with Server4All can potentially be taken down. All you have to do is write a fake spam/scam email, including a link to the web site you want to be taken offline, and then send that email to: listme@blacklist.woody.ch.
I'm currently following up with both Woody's World and Server4All. However, once this particular issue is resolved, we're left with a much bigger and ominous problem. If your hosting provider (or their upstream provider) takes your site offline when it receives a complaint first and then asks questions second, you have a big problem.
All of our legal fights over our rights to keep content online are moot if our providers, without any legal pressure to do so, still take down our services based on spurious complaints.
Apparently I ve won the lottery. What is even more amazing is that it is one based not in Australia but in the UK ELO (England Lottery Organisation) and I didn t even buy a ticket. Even more amazing is even though this organisation is based in England, they don t write English very well; perhaps its declining school standards. They re so concerned about giving you the maximum return on the dollar (or pound) they don t even use a proper co.uk email address but a free webmail from umail.
It is, of course a scam. Popularly known as Nigerian 419 or advanced-fee fraud. You can win the money but.. well it seems there is some holdup and you need to pay some release fee or some bribe to get your dollars. What makes me a little sad is it was for only 250,000 UK pounds. I feel ripped off as a few google searches showed people being offered over 500,000 pounds on the same scam. Don t these crooks know I have a high aussie dollar exchange rate to overcome?
About the only interesting thing about it was that my dspam filters missed it but they ve now been retrained with that miss. I think sending it as a pdf was why it made it through.
And I now cannot get ELO (Electric Light Orchestra) songs out of my head, thanks a lot scammers! (It s a livin thing, ya know)
It's incredible how many people are of the misguided belief that just
because I happen to run a company, I
am automatically interested in their newsletter about whatever it is
that they are doing, no matter how far it is removed from the kinds of
things my company actually does.
Are these people spammers? Yes, definitely, and I don't want to do
business with them. But there's a major difference between this kind of
mails and your common nigerian scammer or counterfeit blue pill
"salesperson". Unlike the latter, some newsletter spammers are
interested in forming a genuine business relationship with my company.
They're going about it the wrong way, but that doesn't necessarily mean
they're trying to trick me into doing something that would not be in my
best interest they're not just after my money.
Although their methods are wrong, that does not mean they're entirely
clueless. Some of these unwanted newsletters are sent with VERP-style
return paths, which suggests that if the mail bounces at SMTP time, I
would no longer receive their junk. So bouncing them is what I do. Exim makes this very easy:
acl_check_mail:
deny
message = Your domain has been blacklisted
log_message = domain blacklisted
condition = $
lookup $sender_address_domain
wildlsearch /etc/exim4/blacklist-domains
true
false
accept
What this does is use a wildlsearch lookup to verify whether
the domain of the envelope sender (i.e., as specified in the MAIL FROM:
SMTP command) exists in the /etc/exim4/blacklist-domains file.
Since we use a wildlsearch, we can use the * as a
wildcard *grep.be would mean 'grep.be, or any of its
subdomains', whereas *.grep.be would mean 'any of the grep.be
subdomains'. This is because at least one of the people I've blacklisted
that way sends their newsletter through a distributed service, and the
VERP-style header is based upon the server that actually communicates
with my system; and others have a subdomain for the newsletter, but
don't use it (or use a different one) for regular mail. If I'm not
interested in their spam, I'm probably also not interested in their
other mail, so therefore the wildcard (is this overkill? Maybe, but I
don't care I don't do business with spammers).
This ACL is then activated for the SMTP MAIL FROM: command (search
for acl_smtp_mail variable in the exim specification). This
makes it impossible for the spammer to reach postmaster@ from the same
domain, too, but that doesn't matter; they can always use a different
address.
One might be wondering why I'm using this kind of domain-based
blacklisting rather than a regular bayesian spamfilter, or anything of
the sorts. The reason is fairly simple: because the general format of
these newsletters is distinctly different from regular spam. For
instance, some of these newsletter spammers are in fact competitors who
didn't bother to check who they're sending mail to. As a result, their
newsletters would contain key words that would appear in mails which I
send to my regular customers, too; if I were to classify them as spam in
my bayesian classifier, that would increase the chance of the classifier
misclassifying a mail from an actual customer as spam. Most of these are
very similar in format to newsletters that I did consciously subscribe
to, and which are therefore not spam, etc.
Finally, bouncing mail rather than blackholing it or filing it in a
separate folder (as I have spamassassin do) has the added advantage of
making it clear to a newsletter spammer that their junk is not wanted.
Most (though certainly not all) will then remove me from their
newsletter, saving me bandwith and processing power. And since we do
this at MAIL FROM: time, rather than upon completion of the RCPT TO: or
DATA commands, I'm not actually giving away any information that they
don't have, either.
Reading Scott's recent
announcement
on his move to Google was both surprising and a pleasure. Surprising,
because it'll take time to stop associating his name to Ubuntu, Canonical,
and the nice experiences I had while I worked with them. A pleasure,
because his blog post was full of reminiscences of the very early days of
a project that ended up being way more successful in just a few years than
probably anyone in the Oxford conference could imagine.
Scott, best of luck for this new adventure!
Scott's write-up includes a sentence that made me remember I had been
wanting to write a blog post related to all of this, but was pending Mark
Shuttleworth's permission for posting:
Ok, Mark wasn t really a Nigerian 419 scammer, but some people did
discard his e-mail as spam!
Scott James Remnant
Many know the story of how I ended not being part of the
Super-Secret-Debian-Startup Scott mentions. I even wrote about it in a
blog post, 3 years
ago:
[...] nothing beats the next email which sat for some dramatic 6
months in my messy inbox until I found out in the worst of the possible
scenarios. Let's go back to late February, 2004, when I had no job, and I
didn't have a clue on what to do with my life.
From: Mark Shuttleworth <mark@hbd.com>
Subject: New project to discuss
To: Jordi Mallach <jordi@debian.org>
Date: Sun, 29 Feb 2004 18:33:51 +0000
[...]
I'm hiring a team of debian developers to work full time on a new
distribution based on Debian. We're making internationalisation a prime
focus, together with Python and regular release management. I've discussed
it with a number of Debian leaders and they're all very positive about it.
[...]
I'm not sure if I totally missed it as it came in, or I skimmed through it
and thought WTF?! Dude on crack or I just forgot I need to reply to this
email , but I'd swear it was the former. Not long after,
no-name-yet.com popped up, the rumours
started spreading around Debian channels. Luckily, I got a job at
LliureX two months later, where I worked
during the following 2 years, but that's another story. I guess it was July
or so when Ubuntu was made public, and
Mark and his secret team organised a conference (blog entries
[1][2][3][4][5]),
just before the Warty release, and I was invited to it, for
the same reasons I got that email.
During that conference, probably because Mark sent me some email and I
applied a filter to get to it, I found the lost email, and felt like digging
a hole to hide for a LONG while. I couldn't believe the incredible opportunity
I had missed. I went to Mark and said "hey, you're not going to believe this",
and he did look quite surprised about someone being such an idiot.
I wonder if I should reply to his email today...
When the usual suspects in the secret Spanish Debian Cabal channel read this
blog post, they decided Mark deserved a reply, even if it would hit
his inbox more than three and a half years late. :)
With great care, we crafted an email that would look genuinely
stupid in late 2007, but just arrogant and idiotic in 2004, when Ubuntu was
just an African word, and the GNU/Linux distribution landscape was quickly
evolving at the time, Gentoo Linux had the posh distribution crown,
that Debian had held for quite a few years. I even took enough care to forge
the X-Operating-System and User-Agent headers so
they matched whatever was current in Debian in February 2004, and of
course, top-posting seemed most appropriate.
So Mark woke up that Monday, fired up his email client, and got... this:
Date: Mon, 1 Mar 2004 09:47:55 +0100
From: Jordi Mallach <jordi@sindominio.net>
To: Mark Shuttleworth <mark@hbd.com>
Subject: Re: New project to discuss
Organization: SinDominio
X-Operating-System: Debian GNU/Linux sid (Linux 2.6.3 i686)
User-Agent: Mutt/1.5.5.1+cvs20040105i
Hi Mark,
Thanks for your email. I nearly deleted this e-mail because for some
reason I thought it was targetted spam.
Your project looks very interesting, almost like a dream come true.
However, I feel a bit uneasy about your proposal. Something just doesn't
fit.
Why would someone start a company to work on /yet another/ Debian
derivative? Have you heard about Progeny's sad story? I think it's a
great example to show that Debian users don't want Debian-based distros,
they want people to work on the "real thing". Besides, I don't think
there's much more place for successful commercial distros, with Red Hat
and SuSE having well-established niches in the US and Europe.
Also, why focus on Debian specifically, Why not, for example, Gentoo,
which has a lot of buzz these days, and looks poised to be the next big
distribution?
To be honest, I think only a few people have the stamina or financial
stability to undertake a project like this, so I'd like to know
a bit more about you, and details on how you plan to sustain the
expenses.
Those are the main issues that worry me about your project. Other than
that, I would be interested in taking part in it, as I'm currently
unemployed and working on something Debian-based would be just too good
to miss.
You can reach me at +34 123 45 67 89, or if you feel like flying people
around Europe, I probably can be in the UK whenever it fits you.
Thanks, and hoping to hear from you again,
Jordi
On Sun, Feb 29, 2004 at 06:33:51PM +0000, Mark Shuttleworth wrote:
> Hi Jordi
>
> We haven't met, but both Jeff Waugh and Martin Michelmayr recommended that
> I get in touch with you in connection with a new project that I'm starting.
>
> I'm hiring a team of debian developers to work full time on a new
> distribution based on Debian. We're making internationalisation a prime
> focus, together with Python and regular release management. I've discussed
> it with a number of Debian leaders and they're all very positive about it.
>
> Would you be available to discuss it by telephone? I'm in the UK, so we
> could probably find a good timezoine easily enough ;-) Let me knof if
> you're keen to discuss it, when and what number to call.
>
> Cheers,
> Mark
>
> --
> Try Debian GNU/Linux. Software freedom for the bold, at www.debian.org
> http://www.markshuttleworth.com/
As you can imagine, his reaction was immediate:
Date: Mon, 22 Oct 2007 11:13:54 +0100
From: Mark Shuttleworth <mark@hbd.com>
To: Jordi Mallach <jordi@sindominio.net>
Subject: Re: New project to discuss
Jordi! I just got this now! Did you recently flush an old mail queue?
With thanks to all the Spanish Cabal members who were involved!
On a private mailing list there was some discussion, and I had an
outburst. Summarising very roughly, someone said bad things about
their competitor, without (at first) offering any justification.
Here's a version of my outburst, edited to remove references to
the actual topic and identifyable people. I thought it might amuse
me in fifty years or so to see how full of myself I was.
Oh dear.
I have no experience with this service. Or the person saying bad things about
them. I am entirely ignorant about everything.[0] I am not biased towards or
against any of them. There's another point I would like to raise. Or rather,
an opinion I would like to express. I feel very strongly about this.
There are two reasons to not show respect. The proper reason is because
the target has thoroughly proven themselves to not deserve it, by their
words and action, or lack of them. The wrong reason is anything related
to anyone else than the target: your own low self-esteem, your fears,
your evil schemes, your own bad day.
Even when the right reason exists, it is a sign of respect to the
audience to be respectful towards someone who does not need it: it
avoids shoving the discussion down the drain. Showing respect, even when
undeserved, indicates strength and moral high ground. (Please note the
difference between showing respect to and agreeing with or approving of
the other party.)
To me, as a total outsider, these remarks about the service give a bad
impression, but not of the service. It may well be that they are a scammy
corporation that gives lousy service. However, nothing in this
discussion has given me a reason to think so.
They may be well-known in your circle. They may be well-known for their bad
quality and bad service. But the rest of us don't know that. When you
denigrate them, you just look like a whiner[1]. Especially someone who
wants to promote their own service over that of a competitor, looks bad,
because they're saying bad things about them, without giving any
reasons.
If you're going to be criticising your competition, you need to be very
careful of how you do it, or you'll look bad instead. Or also, since
it's easy to make everyone in a discussion look bad.
If you'd like promote your company you can explain its virtues and benefits and
the good deals it provides. You don't need to denigrate anyone else.
If you'd like to get people to avoid your competitor, because they are bad or
evil, then show why they are bad, or evil, with examples and references.
[0] This is a true statement in every context.
[1] After decades of experience as a whiner, I have a finely tuned
sensor for detecting fellow whiners.
Paypal didn t recognise UK company registration numbers that contain letters (like ours) for years after they first occurred, so we couldn t register as a seller;
the terms and conditions are very unequal, there are shedloads of complaints like paypalsucks.com and I don t believe they re all fiction.
We ve not boycotted it yet because there are two of our current suppliers who are very expensive for us to pay by international bank transfer, accept Paypal and don t offer much alternative. I think I ll go ask them again. At least one of them should be sympathetic to Xorg.
This afternoon I tried to unlock my old Three mobile phones for the purpose of getting cheap net access as described in my previous post [1]. I wanted to use Dodo 3G Internet (via the Optus network) for my parents which would cost them $139 per year and I wanted to use my old Three phone tethered to their PC as the 3G modem (cheaper than buying a new 3G modem). I took in 3 Three phones to the Three store to get unlocked, I actually have 4 old Three phones (my wife and I are each on our third Three phone) but I seem to have misplaced one. It turned out that the two newer phones (LG U890) can t be unlocked as they are permanently locked to the Three network. The older LG U8110 can be unlocked, doing this took 30 minutes of the Three employee speaking to other Three employees on the phone and I will now have to wait 4 days to receive an SMS with the unlock code.
So the Three anti-competitive behavior of making it unreasonably difficult to get a phone unlocked and of selling phones that (supposedly) can never be unlocked wasted them 30 minutes of store employee time when other potential customers were queuing up as well as 30 minutes of employee time in their call center. If the call-center employee was based in Australia then as the minimum wage is $14.31 per hour [2] that would have cost them at least $14.31 for 2*30min of work, as a rule of thumb it s generally regarded that the costs of employing people are twice the salary (including costs of maintaining office/shop space, paying managers, doing paperwork, etc). So it probably cost Three about $29 to unlock one of my phones and tell me that the others can t be unlocked, when I find phone 4 it will cost them another $29. As $29 is my typical monthly bill this has got to make an impact on the profitability of Three. If they were smart they would have sent me an SMS when I got a new phone telling me whether the old phone can be unlocked and if so giving me the code to do so. For phones that can be unlocked I doubt that would make anyone unlock their phone who wouldn t do so anyway, and for phones that can t be unlocked they could encourage the owner to give the phone to someone who wants a phone for pre-paid use (thus locking in a new customer).
It probably won t be worth the effort of cracking an LG U890 phone to save my parents $10 per annum. As I couldn t get the LG U8110 to talk to my laptop I guess that forces my parents to eventually use Three for 3G net access. But they could have just matched the Dodo price and got the same result without having me spend half an hour in their store.
Update: I just enquired about ending my Three contract for 3G net access ($15 per month for 1G of data) in favor of the yearly prepaid option of $149 per annum for 12G. The prepaid option would save me $31 per annum and allow me to use more than 1G in the busy months. But it seems that I subscribed to a two year contract for that one and I have 6 months to go. Over those 6 months they will make about $15 extra in revenue from me while annoying me in the process, this probably isn t a good deal. As my 3G modem is locked to the Three network even if I didn t have a contract I would still be unable to use a different provider.
My mother phoned Optus about her Internet connection and discovered that she had supposedly renewed her Optus cable Internet contract in September last year. Presumably someone from Optus phoned my parents and asked what seemed like a routine do you want to keep using the Internet? question but was really a do you agree to a 2 year contract with a $250 penalty clause for exiting early? . This isn t the first time that Oprus has scammed my parents (previously they charged them rental for a phone that they never supplied), I guess that they have a practice of pulling such stunts on pensioners. I guess I ll have to call the TIO, which will end up costing them more than the $250 penalty clause.
The irony here is that as Dodo uses the Optus network I would have used Optus by choice for my parents, but now that they are being scum I will willingly pay the extra $10 per annum to use Three (which while annoying aren t actually hostile).
Finally while Google is admirably living up to their don t be evil motto in regards to China [3] their conduct regarding Google Talk leaves a lot to be desired. Two employees of a company I work for use Google Talk for their instant messaging, this has a Windows client but also allows general access via the Jabber protocol. So these two guys wanted to talk to me via Jabber but Google would just send me email saying X has invited you to sign up for Google Talk so you can talk to each other for free over your computers , I received 5 such messages from a colleague who was particularly persistent. It seems impossible for the Google Talk server to send a chat request to my personal Jabber server (which works well with a variety of other Jabber servers).
So I have now started using my Gmail address to talk via the Jabber protocol to other Gmail users. This means that I have a TCP connection to the Google servers open most of the time and Google can boast of having one more active Gmail user. But it doesn t seem to really provide them a benefit. I am going to keep using my main email address as my primary Jabber ID and only use my Gmail address for talking to Google Talk users and only when paid to do so.
But as a result of this I recommend that everyone avoid Google Talk as much as possible. Use open Jabber servers such as the ones run by Jabber.org.
It seems to me that none of these companies are really gaining anything from trying to lock customers in. They would be better off spending their efforts on being friendly to people and making them want to be repeat users/customers.
There is a bit of context that needs to be shared before I get to this and would be a long one. For reasons known and unknown, I have a lot of sudden electricity outages. Not just me, all those who are on my line. A discussion with a lineman revealed that around 200+ families and businesses are on the same line and when for whatever reason the electricity goes for all. Even some of the traffic lights don t work. This affects software more than hardware or in some cases, both. And more specifically HDD s are vulnerable. I had bought an APC unit several years for precisely this, but over period of time it just couldn t function and trips also when the electricity goes out. It s been 6-7 years so can t even ask customer service to fix the issue and from whatever discussions I have had with APC personnel, the only meaningful difference is to buy a new unit but even then not sure this is an issue that can be resolved, even with that.
That comes to the issue that happens once in a while where the system fsck is unable to repair /home and you need to use an external pen drive for the same. This is my how my hdd stacks up 
The main argument as have shared before is that Indian Govt. thinks we need our home grown CPU and while I have no issues with that, as shared before except for RISC-V there is no other space where India could look into doing that. Especially after the Chip Act, Biden has made that any new fabs or any new thing in chip fabrication will only be shared with Five Eyes only. Also, while India is looking to generate about 2000 GW by 2030 by solar, China has an ambitious 20,000 GW generation capacity by the end of this year and the Chinese are the ones who are actually driving down the module prices. The Chinese are also automating their factories as if there s no tomorrow. The end result of both is that China will continue to be the world s factory floor for the foreseeable future and whoever may try whatever policies, it probably is gonna be difficult to compete with them on prices of electronic products. That s the reason the U.S. has been trying so that China doesn t get the latest technology but that perhaps is a story for another day.
. Backups certainly make a lot of sense, especially rsync.
The other thing that came to my mind was having some sort of A.I. and chat server. IIRC, somebody has put quite a bit of open source public domain data in debian servers that could be used to run either a chatbot or an A.I. or both and use that similar to how chatGPT but with much limited scope than what chatgpt uses. I was also thinking a media server which Vishal did share he does. I may probably visit him sometime to see what choices he did and what he learned in the process, if anything.
Another thing that could be done is just take a dump of any of commodity markets or any markets and have some sort of predictive A.I. or whatever. A whole bunch of people have scammed thousands of Indian users on this, but if you do it on your own and for your own purposes to aid you buy and sell stocks or whatever commodity you may fancy. After all, nowadays markets themselves are virtual.
While Vishal s mini-pc doesn t have any graphics, if it was an AMD APU mini-pc, something like this he could have hosted games in the way of thick server, thin client where all graphics processing happens on the server rather than the client. With virtual reality I think the case for the same case could be made or much more. The only problem with VR/AR is that we don t really have mass-market googles, eye pieces or headset. The only notable project that Google has/had in that place is the Google VR Cardboard headset and the experience is not that great or at least was not that great few years back when I could hear and experience the same. Most of the VR headsets say for example the Meta Quest 2 is for around INR 44k/- while Quest 3 is INR 50k+ and officially not available. As have shared before, the holy grail of VR would be when it falls below INR 10k/- so it becomes just another accessory, not something you really have to save for. There also isn t much content on that but then that is also the whole chicken or egg situation. This again is a non-stop discussion as so much has been happening in that space it needs its own blog post/article whatever.
Till later.
Update: thanks to the very kind involvment of the widow of our wemaster, we
could provide enough private information to Dreamhost, who finally accepted to
reset the password and the MFA. We have recovered evrything! Many thanks to
everybody who helped us!
Due to tragic circumstances, one association that I am part of,
If that wasn't all bad enough, now there is a new threat: while you are relaxing in the sun, scammers fool your phone company into issuing a replacement SIM card or transferring your mobile number to a new provider and then proceed to use it to take over all your email, social media, Paypal and bank accounts. The same scam has been appearing around the globe, from 
For phone companies, SMS messaging came as a side-effect of digital communications for mobile handsets. It is less than one percent of their business. SMS authentication is less than one percent of that. Phone companies lose little or nothing when SMS messages are hijacked so there is little incentive for them to secure it. Nonetheless, like insects riding on an elephant, numerous companies have popped up with a business model that involves linking websites to the wholesale telephone network and dressing it up as a "security" solution. These companies are able to make eye-watering profits by "purchasing" text messages for $0.01 and selling them for $0.02 (one hundred percent gross profit), but they also have nothing to lose when SIM cards are hijacked and therefore minimal incentive to take any responsibility.
Companies like Google, Facebook and Twitter have thrown more fuel on the fire by encouraging and sometimes even demanding users provide mobile phone numbers to "prove they are human" or "protect" their accounts. Through these antics, these high profile companies have given a vast percentage of the population a false sense of confidence in codes delivered by mobile phone, yet the real motivation for these companies does not appear to be security at all: they have worked out that the mobile phone number is the holy grail in cross-referencing vast databases of users and customers from different sources for all sorts of creepy purposes. As most of their services don't involve any financial activity, they have little to lose if accounts are compromised and everything to gain by accurately gathering mobile phone numbers from as many users as possible.
I would expect brute-force login attacks to be more common. And yes, at some point I got tired of ssh scans, and added rate-limiting firewall rules, even switched the daemon to a nonstandard port... But I have very seldom received an IMAP brute-force attack. I have received countless phishing scams on my users, and I know some of them have bitten because the scammers then use their passwords on my servers to send tons of spam. Activity is clearly atypical.
Anyway, yesterday we got a brute-force attack on IMAP. A very childish atack, attempted from an IP in the largest ISP in Mexico, but using only usernames that would not belong in our culture (mosty English firstnames and some usual service account names).
What I find interesting to see is that each login was attempted a limited (and different) amount of times: Four account names were attempted only once, eight were attempted twice, and so on following this pattern:
Another post about the Valve/Collabora 
Email spam is a plague, but sometimes there is at least on category of
spammers it is easy to have fun with: naive manual spammers. People that try to
do more or less legal business, using Internet in an illegitimate way, for
instance (this is a real example, including the spammer's address: spamming
bots, please use it ;-) !):
It's incredible how many people are of the misguided belief that just
because I happen to 
Reading 
On a private mailing list there was some discussion, and I had an
outburst. Summarising very roughly, someone said bad things about
their competitor, without (at first) offering any justification.
Here's a version of my outburst, edited to remove references to
the actual topic and identifyable people. I thought it might amuse
me in fifty years or so to see how full of myself I was.
