Recognizing phish spam from exceedingly RFC compliant mailers
Here is how to tell if you were getting phish spam from a compromisedserver with an exceedingly RFC complaint mailers: you were getting emailfrom addresses like service@park.funnel.revenuedirect.com.akadns.net.
What was going on is that paypal.us was a CNAME to that hostname.(I say was because paypal.us has since been changed to an A recordand an MX to localhost. , possibly because they got tired of beingforged on phish spam.)
According to the RFCs,
A realization about breadcrumbs
Our internal user support web pages don't currently have breadcrumbs , those littlebits that show a web page's location in some hierarchy and let youpop up to higher levels. This makes a lot more sense than for mostwebsites, because hopefully we don't have our users landing on randompages through search engines; in theory they come into our supportpages at the top and then navigate down from there, so they alwayshave the Back button available.
Then, recently, someone had a question that
Weekly spam summary on August 18th, 2007
This week, we:
- got 12,100 messages from 261 different IP addresses.
- handled 22,629 sessions from 2,180 different IP addresses.
- received 434,144 connections from at least 121,837 different IPaddresses.
- hit a highwater of 31 connections being checked at once.
So much for any chance that volume would go down compared to last week . I believe that the highersession volume is at least partly
A thesis about language niches
Here's a thesis: in the current environment, there are threesignificant ecological niches for general purpose languages. They canbe expressed as combinations of features:
- low level, with strong control over what happens when you do things;such a language is above all predictable by default: C, C++
- loose control (with features such as garbage collection), butstatically and strongly typed for compile-time assurance: Java, C#
- loose control and dynamically typed: Python, Ruby
(There is no '
How not to set up your DNS (part 17)
Here is an interesting one that caused me to go digging into themoderate depths of DNS arcana:
; sdig ns just-dust.comdns1.name-services.com.dns2.name-services.com.dns3.name-services.com.dns4.name-services.com.dns5.name-services.com.; dig mx servidor134.just-dust.com[...];; [...] status: SERVFAIL
How to tell a DNS no data reply from a lame delegation
When you query an authoritative nameserver for a record that doesn'texist, what you get back is a reply with status NOERROR, the aa bit set, no ANSWER section, and the zone's SOA record asthe sole record in the AUTHORITY section. (And no ADDITIONAL section.)
When you query a nameserver for a record in a zone that it doesn'tserve, what you get back is a reply with status NOERROR, no ANSWERsection, some zone's NS records, and some
The problem that built C++ (a thesis)
At least at one point, there were a lot of people who loudly couldn'tunderstand why C++ was still around as a going concern. After all,didn't Java have it beat hollow, as Java was a much more productiveobject oriented language to develop in?
Such people implicitly believe that that problem that built C++ is'building object oriented programs'; now that there was a well knownbetter solution to that problem, they couldn't see why C++ didn'
The benefits of growing your toolbox
Although we weren't going to use our new gigabit backbone connection immediately, I wanted to check that we reallycould get something close to gigabit performance through it and thateverything was working smoothly. When you're doing network performancetesting, you really need to do it from a platform that you trust, sothat any slowness can be attributed to the stuff in the middle andnot to your end having issues.
As it happened, the most trustworthy machine for this was my officeworkstation. But since it was
One problem with distributed identity systems
From one perspective, using someone else's identity system sounds verynice. Imagine the convenience of being able to just use LiveJournal useraccounts on your site, or (for an example closer to home) a centraluniversity database of campus-wide accounts.
(Yes, I am conjoining 'identity' and 'authorization' here, because Ibelieve that it's what a lot of people do in practice when thinkingabout this sort of thing.)
The problem with this is that any time you use a
Weekly spam summary on August 11th, 2007
This week, we:
- got 11,040 messages from 245 different IP addresses.
- handled 20,069 sessions from 1,915 different IP addresses.
- received 344,743 connections from at least 97,338 different IPaddresses.
- hit a highwater of 42 connections being checked at once.
Connection volume is down from last week .This week the volume peak was clearly on Monday instead of Wednesday:
| Day | Connections | different IPs |
| Sunday | 4 |