Filthy spammers! They are worse than the plague. They have even resorted to sending trash over my fax at work. We recieve two or three faxes a day that are uring us to take a trip or buy cheaper meds.

Sending spam by fax is actively illegal. Go get 'em.

-----

I haven’t yet determined whether those URLs match any of ours.

They do.

Not only are those non-existent sites, there's no evidence that they ever did exist.

Given the time delays between posts, someone was pasting those in by hand, hitting the preview and post buttons with their own personal mouse.

Congrats, guys, you're on someone's radar.

I was very disappointed to find out all the porn links were dead ends. I mean, I was very upset to hear you say the links were dead ends. Not that I would have had a reason to click on them myself. OK, I clicked, but it was all part of research for an up and coming story I'm working on. No, really!

;)

I don't know if those IP addresses are likely to point back to the actual spammers, but if so, doing a whois on most of them will give you an abuse-reporting address. Several of them are ComCast addresses (from different areas of the country, which leads me to think they will in fact not point to anything), one from Earthlink, and one from Cox.

Jim Macdonald writes:

"Congrats, guys, you're on someone's radar."

That's what I think, too, but I'm sure plenty of people will be eager to explain how this can't possibly be the case.

Certainly there's nothing suggestive of incipient fascism happening out there. Certainly no widespread thuggery or outbreaks of creepy political violence.

Are comments on older posts going to remain turned off, or is my browser wonky?

I wanted to comment on the motivational posters thing. Honestly, I thought "oh goody! links to posters!" because if I get a classroom again -- I _like_ corny things on the walls. Not that I think that they "motivate." They do something else -- they give the kids something to look at when they get bored. And if they have an interesting picture, and a couple of words on them that you sort of want them to think about sometimes, they'll look at them and think "that's corny," and then maybe think about what they really think about the topic . . . and when they snap out of it, they'll have been thinking about something. I usually put lots of maps on the walls too, and examples of work, and directions for how to do things.

Anyway, I followed the links. And I noticed three things: all of the people on all of the posters I could find were white (and I didn't see any women, either, though I supposed they must be there somewhere), and they were all involved in luxury activities (most in sports which are mostly indulged in by wealthy people), and the photographic style on most of them is cold, isolating, sculptural -- kind of like (sorry) Nazi youth sports posters.

Which makes them useless to _me_. I need representations of a variety of people, like and unlike my students, and I want them engaged in activities my students can relate to, as well as activities I want them to aspire to. What's wrong with showing _basketball_ players for teamwork, instead of just white guys rowing those boats nobody ever sees except in motivational posters? (maybe they're more common back east, but out here, if you're on the water, you're on a surfboard, or in a kayak or a fishing boat) Or for perserverance -- what's with the lonely pictures? My students use the word "loner" as a synonym for "loser." Why not show a bunch of people standing around practising free throws?

And why not show teams of firefighters, folklorico or Aztec dancers in formation, musical groups (now there's a nice nuanced message -- everybody does their individual thing, but they all cooperate in one whole venture), even line workers (think Saturn ads)? Why is "challenge" illustrated with stupid-ass endeavors that could get you killed for no reason -- and a golf course? Why not a half-pipe and a _bunch_ of guys standing around while some guy gets some air?

I suppose, if I get a classroom again, I could make a lesson or three about these: hang 'em up for a week and then invite a critique session and have them write their own analytical essays.

But in general, I guess I'm going to stick to the maps and stuff.

Oh, and I knew about the demotivational posters already, but my type of students hate irony unless they generate it themselves: I think because of the language issue, it's just too many things to be doing at once.

It was damned obvious before I even saw that nyaah-nyaah-nyaah comment on Electrolite.

Get those bastards.

Oh crap, my browser is wonky, and I posted twice because of it, and it's a long post. Can the second one be removed somehow?

In purely practical terms, the latest MT Blacklist plug-in 2.x, which requires MovableType 3.x, is much more than just a blacklist for stopping comment spam in blogs. It's got some flexible settings that will shut down spam based on, for example, multiple comments from the same source, postings in older inactive entries, and multiple URLs within one comment. Rather than simply block these, it will notify you and allow you to review the comments -- "forced moderation" they call it. And each of those parameters can be fine-tuned in the configuration pane of MovableType -- for example, you can set how many URLs within a comment will trigger forced moderation. It's very slick. The plug-in also stops spam based on a GREP-like matching that looks for combinations of words in the subject.

These new capabilities have come in really handy on my photoblog, where the plug-in has successfully stopped spam that isn't yet part of the master blacklist. I looked at my MT Blacklist log today and saw dozens of spams that had been turned away. I'm normally blissfully unaware that anyone is attempting to post that shit. Only two or three spams get past the plug-in each week for me.

That sounds heavenly.

Sending spam by fax is actively illegal. Go get 'em.

Illegal, huh? I had no idea, I thought it was just an annoyance. I will see what I can do about them first thing Monday morning.

Thanks for the info.

Re: unsolicited commercial faxes. They're illegal and you can collect as much as $2500 per junk fax by suing the faxers in small claims court. Info here:

http://www.junkfax.org/fax/action/outside_how_to_sue.html
http://ftp.fcc.gov/cgb/consumerfacts/unwantedfaxes.html
http://www.junkfax.org/fax/basic_info/junk_fax_qa.htm
http://www.junkbusters.com/fax.html

Nothing will stop these people faster than taking lots of their money.

I got about 400 comment spams when I was in Boston for the WorldCon. I didn't check whether they fed through to real sites. But it was really discouraging. The spammers found some chink inf MT Blacklist's armor and exploited it.

I've got Comment Moderation turned on in my MT3.11 install at this point because the Perl on my ISPs server is too crude to run MT Blacklist. It's still really irritating to get large batches of comment spam (which I do from time to time) but since spammers get no gratification of seeing their comments appear, I'm getting a lot less than I used to.

If I was getting more, I would change the name of the comment script once a week. (I do it now whenever I begin to receive comment spam regularly). These attacks are automated now, so the spammers aren't actually visiting you site at all. Rather, your comment script is in someone's malign database.

(Beware, those of you thinking about changing the name of your comment script for the first time. It is possible to screw up your MT install doing it. Back up everything first. Delete the mt.cfg file entirely before uploading a modified version.)

Patrick, thanks for those links. That reaches levels of disturbing and creepy I wasn't even aware existed in this election. (Which obviously means I hadn't been paying enough attention.) It also makes me wonder what sort of collateral violence will occur with a Kerry win.

By the way, Googlung for "hello from zimbabwe!" garfield produces over 700 results. My best guess is that the post is used to find out the name of the comment script.

If I recall correctly, P&T, this is the second time y'all have been hit with over a hundred nasty-porno comment spams each. Check the timing.

(Note that the Friday Evening time is designed to hit when most moderators are away from their keyboards.)

Strangely, the day after a political troll who was trying to bait my readers found my LJ blog, I woke up to 140 (and still counting) bounces in my email box from someone spoofing my domain for spam. I think the bounces are up over 400 only a few hours later, and still coming in. No way to shut it off without shutting down my email server entirely.

If this blacklists my domain for email, you're going to hear the screams all the way down in NYC.

Any advice?

The number of viruses in my email (the address I use for posting here) is up by two standard deviations, starting last Thursday.

Could just be a statistical fluke.

"Marat we're poor, and the poor stay poor...."

Given that certain political black ops have flooded phone banks with hang-up calls to prevent voters who needed rides to the polls from calling in to say they needed that ride and given that all too many of the new voter and get out the vote sites are relying completely on the internet, I can only extrapolate that a lot of the internet is gonna go down shortly.
If you can't just walk next door and ask your neighbor if she needs a ride or a baby-sitter Tues, may I strongly suggest that you get a way to contact your new voter OTHER than the internet by tomorrow? ---And that you give her a way to contact you other than a known Democratic/other phone bank?
(Oh, and take down all those other phone numbers you might need, too, like Election Protection.)

Worst Case Scenario: The internet (or huge chunks of it on the left side of my screen) goes down late night on Nov. 1 and stays down through several weeks of disputed ballots.

No, I am not crushed. The staunch Republicans in my family are so alarmed by Bush's policies that they'll be voting Kerry this year..."so long as you understand this is only gonna happen just this once, Janet, and just because of Bush." One of them called Bush "the Anti-Republican"; I won't tell you what another one called him because it shocked even me.

Hang tough and we'll see ya again when the internet's back up and running (I hope)...
Janet K

But Janet, I want to know what it was your relative called Bush that shocked even you! [I started referring to him as the schmuck, except that that doesn't work for people who don't think he's a bumbling malevolent [etc.]. I think used "the Residency" as the mildest term I was willing to apply to his Residency... I am NOT calling him by the title that a court that includes a corrupt sexual harrasser and at least one religious fanatic who doesn't let civil law get in the way of what he regards as Right because of his religious zealotry appointed him to.]

Nancy

Contact the ISP who is hosting your server; it's in their interest to help you track down the spammer, and they have the tools to do it. I'd be surprised if they won't--and if they aren't responsive, I've got a fabulous ISP for you, and I'm pretty picky. You should never have gotten all those bounces if your ISP was proactive in the least.

And as little as I trust or respect the current regime, I do respect the underlying technology in the 'net. It may hiccup but it'll go on.

Janet - I've received a few canvassing calls over the last few days, all of them coming from the numbers of either local businesses, individuals or mobile phones and none from recognizable Democratic sources. I suspect that this distributed network thing for outbound calling will work, although I don't know if it's typical.

I do think that the GOP and its agents, as part of their Block The Vote™ program, will be jamming the voter protection hotlines.

If a good chunk of the web does go down (which I doubt will happen), they're sure to blame it on Osama.

Paula---
Once or twice a month, my staunch Republican and I have lively political debates over dinner. We run up one side of an issue and down the other. Neither of us shies from playing devil's advocate. We have a wonderful time having at it, and he's convinced me as many times as I've convinced him to shift positions. Sometimes we both wind up somewhere in the middle. (Ricky and his lady play at keeping score and throwing in the best of the zingers.) Great fun, and we always wind up laughing.
But the last time we had dinner with them, he shook his head wearily and said, "No politics." Then he leaned across the table and said, "Janet, this administration is evil."

You may think that all Republicans toss off the word "evil" with abandon but I assure you I have never heard that word come out of his mouth as long as we've been debating each other. Sometimes being shocked is all in the context.
Since then I've been officially scared spitless.
Janet

Teresa --

Most of those IPs are from IP broadband pools, it looks like, and one doesn't properly exist.

14:05 graydon % host 66.245.112.144
144.112.245.66.in-addr.arpa domain name pointer user-11fas4g.dsl.mindspring.com.

14:05 graydon % host 68.42.46.205
205.46.42.68.in-addr.arpa domain name pointer pcp09341499pcs.albqrq01.nm.comcast.net.

14:05 graydon % host 68.9.210.50
50.210.9.68.in-addr.arpa domain name pointer ip68-9-210-50.ri.ri.cox.net.

14:05 graydon % host 68.97.20.217
217.20.97.68.in-addr.arpa domain name pointer ip68-97-20-217.ok.ok.cox.net.

14:05 graydon % host 24.99.203.58
Host 58.203.99.24.in-addr.arpa not found: 2(SERVFAIL)

TypeKey shut out the robots who were spamming my comments. I had MT Blacklist before, but it took too much time to use it. I was getting hundreds of spam messages on some days.

However, a few days ago, I realized Trackback was being spammed: So far, I've deleted more than 100 hard-core pornographic trackbacks. I eliminated Trackback from recent posts, but I've got thousands of old posts that they can hit.

Today there were only four new ones that came in overnight, and not as vile in content.

Graydon, what are the implications?

Teresa --

Widespread comment spam from a lot of varied telco DSL IP address pool addresses like that would indicate to me that it's likely that the comment spam is being piped through a botnet.

(Telco DSL address pools are under constant attack -- integer-attempts-per-second -- and the machines at the addresses are generally not protected in useful ways. This makes them prime candidates for botting.)

If it is a botnet, it's not a garden variety moron but an actual criminal.

It's also impractical to track backwards through the botnet, which is why they're used.

Graydon mentioned:
14:05 graydon % host 24.99.203.58
Host 58.203.99.24.in-addr.arpa not found: 2(SERVFAIL)

The 24.98.0.0 -> 24.99.255.255 block belongs to Comcast, according to arin.net.

Yet another case of PC users not bothering to keep antivirus and firewall software up to date.

Graydon wrote:
(Telco DSL address pools are under constant attack -- integer-attempts-per-second

If I disable my firewall, I generally receive 5-10 blatantly obvious scans per minute on my DSL line, and 2-4 'less obvious' scans.

I've got a nice set of firewall rules that take care of most problems.

I'm at work, so can't really look properly at this, but just wanted to post a link I thought people might find helpful for this - Sam Spade. (Also some more detailed tools provided there).

It's original purpose was to help people in tracking down spammers (which is something I used to play around with), but it's useful for this kind of stuff too.

"If it is a botnet, it's not a garden variety moron but an actual criminal."

Have to disagree somewhat there as nowadays a garden variety moron with a minimum of motivation can easily acquire access to a botnet or build one up from scratch. A few months back we had a security incident on our server, some Brazillians used a web server vulnerability to kill off our IRC server and replace it with their own, they then redirected a domains of their choosing to our server's address and parked a botnet of +-750 clients on the hijacked IRC server to wait for commands. Now at first glance you might think these guys were pretty good to pull all that off, they weren't, here's the facts about what they did:

1. They never rooted the server (i.e. never gained admin rights), everything they did was under a single user's limited priviliges.
2. They couldn't shut down our server, they just got lucky that theirs loaded before ours at the next reboot, causing ours to fail as the ports were in use.
3. They only ever had any control on the server at all because one of our clients installed PHPNuke, a package with massive security flaws in its design.
4. Once the offending package was removed the intruders lost ALL ability to affect the server, they couldn't think of any other way to get in nor had they even tried to provide themselves with alternate means of access whilst they did have control.
5. The intruders failed to realize their botnet was still being allowed to log in to OUR IRC server after I dumped theirs, and was as of that moment being actively observed by the police.
6. The intruders were unable to keep up with me switching IP addresses to avoid their DDoS attack on me when I did finally confront them head on and dump em off the server for good. One individual vs 4 allegedly experienced hackers and a 750 client botnet, they couldn't touch me.

In short, they were very well equipped for spamming, DDoSing, and generally causing chaos, but they were baseline idiots following pre-written instructions to get anything done and completely incapable of improvising a response when the scenario turned on them.

As regards "Actual criminal", keep in mind it doesn't matter whether one is insane enough to spam by hand or are using a botnet (owned or hired), the individual in question IS a criminal when he starts spamming. Even without cybercrime legislations the sort of activity seen here and elsewhere constitutes harassment, disruption of business, and a number of other criminal activities. Hiring or building a botnet just means the spammer's commited MORE crimes above and beyond the spamming.

Lucy Kemnitzer: re motivational posters

The Festival Shop here in the UK produce a great range of multicultural/inspirational posters & resources for the classroom. Unfortunately their catalogue (still) isn't online yet, but it'll be well worth checking out when it is, and you can request a paper catalogue.
http://www.festivalshop.co.uk/

Syracuse Cultural Workers also have wonderful posters
http://www.syrculturalworkers.com/catalog/posters/Poster1.html

(My favourites are 'How To Build Community' & 'How To Build Global Community', on that first page, closely followed by 'Other Cultures Are Not Failed Attempts At Being You' on page 6 of the online catalogue)

I don't know if they were quite what you were looking for, but both Festival Shop & SCW produce posters with wonderful & positive messages.

(Many many commiserations on the election result)