Free Technology Newsletters
» All 33 InfoWorld Newsletters
Technology & Business Daily
 
InfoWorld
 
   

Phoning It In

By Ed Foster, Section The Gripelog
Posted on Mon Oct 23, 2006 at 09:23:20 AM PDT

Forgive me if I seem a little depressed, but it's only because I am. The GripeLog website has been down or dysfunctional all weekend, apparently due to a link-spam posting attack that has gotten out of hand. Although I'm sure we'll figure out how to deal with this particular problem, it spurs me to announce something while there's still an Internet to announce it on. Starting now, in addition to posting or e-mailing your gripes, you can phone them in by leaving me a voice mail at my new toll free number: 1 888 875-7916.


As I write this Sunday night, I still do not have the ability to post anything on the GripeLog site, so I may only be able to post on InfoWorld's Gripe Line weblog, which is unaffected. For those of you who have been trying to get through to my site, or who have found that even when you do get through that you can't post comments, I apologize. All I can tell you for sure is that the problem lies with almost nightly attacks we've been suffering for over a week and that really hit us hard this weekend. Hopefully I'll soon be able to post stories myself and our comment-posting engine will return to normal, but right now we're still working on it.

The attacks make little sense, since, according to my webhost, they emanate primarily from Southeast Asia and appear to be trying to post link spam comments on my site, but then suddenly escalate into something that looks more like a concerted DDOS attack. But why would link spammers who are trying to take advantage of the fact that my site allows anonymous posting of comments deliberately create a surge that crashes it instead? I don't know.

But let's face it. In the larger picture, the spammers are winning. And the fact that their victory may very well wind up destroying the Internet, or at least Internet e-mail, isn't going to stop them for a moment. You no doubt can see this for yourself in your own inbox, either because of the overwhelming amount of junk that's in there or the occasional important missive that didn't make it there when it should because of your anti-spam defenses. The growing worthlessness of Internet e-mail is a topic we should talk about, assuming we still have a way of doing so.

OK, like I said, I'm a bit depressed right now. But isn't a toll free phone number a bit of an overreaction? Well, I don't think so. Really long-time readers will know that when I started the Gripe Line lo those many years ago, it was with a toll free number because at the time Internet e-mail wasn't yet universal And there's a certain character to phoned-in gripes that I'm sure will prove valuable in and of itself. Another motivation is my desire to do a podcast version of the Gripe Line in which I'll incorporate actual reader voices, so it's not that I'm trying to revert completely to an analog world.

So, hey, give me a call. That number again is 1 888 875-7916. Operators are not standing by, but it will brighten my day to hear a few impassioned readers venting about what's bothering them today.

< Reader Voices: Copyright Duration | A Vista of Licensed Censorship >


Display: Sort:
Phoning It In | 12 comments (12 topical) | Post A Comment
My condolences[ Reply to This ] (none / 0) (#1)
by beamdriver on Mon Oct 23, 2006 at 03:43:44 PM PDT

I've been a citizen of the internet since 1989. I saw the first spam message of all time and watched spammers grow progessively bolder and more innovative. The e-mail address I established in 1997 gets hundreds of spams every day.

That said, I think that allowing anonymous comments is more trouble than it's worth. Even without the spam issue, it allows corporate flacks, astroturfers and bomb throwers of all kinds to simply drive-by post when they see something that catches their eye.

I've set up blogs for a number of my clients and I always turn anonymous commenting off.

[ Reply to This ]



Anonymity is important to freedom. Use captchas.[ Parent | Reply to This ] (none / 0) (#2)
by Anonymous User on Mon Oct 23, 2006 at 11:31:46 PM PDT

I think it's sad that you feel this way. Truly anonymous posting encourages participation and greater openness -- people don't like hoop jumping exercises, and with more and more websites wanting you to "register" and divulge your life story and favorite sexual position before you can even read anything, people become ever more selective about where they will register, and ever more willing to respond to any login prompt with an immediate click of the "back" button, then surfing elsewhere. Hoop jumping isn't all. Invariably, the minimum registration required is an email address. At a reputable-seeming site (like this one) the risk in divulging it is admittedly small, but a small risk oft-repeated becomes a virtual certainty. Registration as a spam defense is therefore rather nastily hypocritical: it amounts to asking all of the site's participants to increase their risk of email spam to reduce the site's exposure to post spam. Doubly so as it's unnecessary for that purpose (see below).

There are actually three purposes for requiring registration, some or all of which may apply at any given site, and none of which add value for the user.

  1. Spam prevention. Which can be achieved in other ways, as with captchas. (Some complain that captchas discriminate against the visually impaired, but that's an implementation issue with many off-the-shelf captcha solutions, not an intrinsic problem with the basic concept. It's solvable.) Obviously only applicable where sites require registration to contribute content. Sites that require registration just to browse some content have at least one of the other two motivations.

  2. They get something tangible through forced registration. This is the primary motivation when registration is demanded merely to view material. Rather than be grateful for the traffic and ad eyeballs (and, if the user posts something, the free content to attract more ad eyeballs), they figure to extract even more (and usually end up with less, as they drive most prospective users elsewhere on the 'net). This may be reams of data for their marketing department, or for selling to databroker companies like ChoicePoint to sell on for others to misuse; it may be money directly (hint: if a credit card number must be supplied, it's money, even if they claim it's for something else, like "age verification" or "proof of real-world identity". As if they don't know that little Johnny can easily read one off Daddy's credit card! Why not ask for some other form of ID, not usable to transfer money they say they don't want? Because what they say they don't want and what they do want are the same thing! They may not dare ding the account themselves after saying they won't; so they probably sell the number to third parties, i.e. crooks and identity thieves. If they're later questioned, they "had a laptop with credit card numbers stolen". I suggest then asking why they retained credit card numbers that are supposed to be for "identity verification only" or whatever. If they say they retained the numbers, they're up the creek. If they deny retaining the numbers, the "stolen laptop" story develops a hole you can drive a truck through, and they're sunk. Either way, you have them by the short hairs.)

In case of motivation number two, expect after registering to lose money, get spammed, or both, in other words.

3. Control. Register, and you are now pseudonymous. Your activity may be tracked, more easily than otherwise, and users being registered makes them more susceptible to coercive tactics, such as threatened access restrictions, bans, or other unequal treatment. Invariably, this potential for coercion is handled in a less than equitable and democratic way, and often in a ham-fisted one. A lot of Web forums suffer from dictatorial control and suppression of dissent by a self-appointed class of "moderators". Others have moderators that behave in a relatively fair and equitable manner, but generally still cannot be held accountable in any reliable way by the membership, which inevitably has chilling effects on the discussion of controversial matters. I would tend to prefer an unmoderated Usenet newsgroup fulla spam to the ham-fisted style of moderation, and even the milder-mannered form makes me nervous. As a rule, there is no "constitution" or "user's bill of rights" in such places to enforce fairness and prevent and/or punish "moderators" who "moderate" someone out of personal animus rather than because they actually spammed or otherwise misbehaved in a serious manner.

Also, as a rule, posting pseudonymously visibly ties all your posts together with a single name or handle of some kind, and people cease to consider each one purely on its own merits and begin to confuse message and messenger. Fallacious reasoning of the "This can't be true, because it's coming from so-and-so and he's a jackass" variety gets encouraged.

Of course, it can sometimes help keep a thread of discussion making sense if sequential posts by the same person are identified as such, but that is possible (merely optional) when anonymous posting is allowed. (They can optionally register, if registration is possible, as it is here, or they can simply sign a series of posts in a common way. If they want to make forgeries detectable, they can even pgp sign a posting, in theory. But they can post without the signature anytime they want to, and nobody can "ban" the signature and take it away from them just for disagreeing with Official Doctrine(tm).)

Also of course, even anonymous posts at most places keep some record of the poster's IP address, but that's a lot less intrusive than a registration hoop-jumpathon to the user, a lot less visible an ID (often not visible to non-admins at all), and a somewhat more fluid one, granting a controversial poster (or, unfortunately, a spammer) more deniability. If they are posting certain things from inside places like China, that can be far more important than you, undoubtedly born and raised in a free country, can likely imagine. Posting via a proxy or from a Web café or similar shared computer(s) in combination with no registration greatly increases practical freedom of speech.

The cost? Spammers and disrupters. Only massive, automated bot posting binges pose a genuine threat and a captcha can keep those out. (It can't stop the load functioning as a denial-of-service attack, but neither can requiring registration.) Individual disruptive posters not using automation can have disruptive posts manually deleted. Futility will deter them far more than registration hoops and bans and other punishments. Futility and not even receiving any attention, not even recognition in the form of a ban, will make them look elsewhere for their entertainment. (Disruptive posters trying to use automation are, like spammers, blocked by captchas.)

Individuals are sometimes harder to classify anyway. Some people are simply controversial: opinionated, often insightful, but often angering at least a minority of other users. If postings by them that are purely inflammatory crap disappear without fanfare while postings of genuine value (whether controversial or not; so long as they are on-topic and not purely for the purpose of trolling) are kept, they will quickly learn what isn't worth bothering typing in. No other reinforcement necessary. (Most such posters don't post any "pure crap"; just posts that generate some significant amount of disagreement and maybe on a hot-button issue. Those posters never last long at moderated Web forums and are the life of the party on unmoderated Usenet newsgroups. They are also essential to a functioning society, and Constitutional guarantees of free speech are principally there to protect exactly such personalities. As is often said, it's unpopular or controversial free speech that most needs protecting, particularly dissent the Guys In Charge(tm) would like to stifle. I'd be concerned even with an arbitrary ability to delete individual posts without some mechanism of due process or review of some kind. Quarantine them from general view and invite twelve randomly-picked jurors to decide whether they are crap, maybe; so as not to give widespread attention to the post in the event that it truly is crap and the decision is to delete; but with due process.)

My recommendation: If a site is truly honest and truly has users' best interests at heart (rather than charging them money, robbing them blind, spamming them, or coercing them to toe some company line), then it will permit anonymous participation and use a captcha to keep spammers and any other automated blitzing away. Captchas are a humans-only stateless, accountless access control -- perfect for maximizing user freedom. The only possible reason to object to their use and insist on registration of any kind instead is therefore if there is an ulterior motive that a stateless, accountless access control can't support. Which means $$$, in one form or another. Directly, via spam, or by suppressing embarrassing dissenting opinions.

Think of the money value in that last item! A Web forum for "freely" discussing and reviewing software can make a quiet deal with Microsoft for lots of moolah in exchange for finding trumped-up excuses to ban or otherwise harass, make feel unwelcome, or generally suppress any bad reviewing of Microsoft software. A Web forum run by a company can suppress any prickly remarks (or worse sticky questions) asked about their products or services.

Requiring registration here at the Gripe Log would be, in light of the above, an extraordinarily bad idea. Infoworld would want to exert some editorial control over comment postings, if they don't already with comment deletions. (Could they have anything to do with "supergenius"? Why was respected poster ekuns' post on one particular topic nuked? It surely wasn't spam or anything else users would consider evil, and it was never explained adequately. Perhaps someone else found it evil, someone obviously in a conflict of interest with the user base and therefore patently the wrong person to make such a decision?)

Now consider the pressure Ed would come under to misuse the registration requirement. Symantec would want to suppress user recommendations of NOD32 and AVG. They might be able to name a price high enough to buy even Ed. Microsoft certainly could.

Perhaps they have already, or at least are trying.

Which company are you astroturfing for, sir? Perhaps your company not only wants gripes about one of its products ... limited ... but has even engineered this weekend's attack to give weight to your questionable suggestion here? I bet you're real mad that I've suggested using captchas instead, arencha? And pointed out that registration (or captchas) won't do anything to prevent DoS attacks anyway?

[ Parent | Reply to This ]



TEST[ Parent | Reply to This ] (none / 0) (#14)
by Anonymous User on Tue Nov 21, 2006 at 03:44:00 AM PDT

good site really

[ Parent | Reply to This ]


If the spammers win, they lose.[ Parent | Reply to This ] (none / 0) (#6)
by Anonymous User on Tue Oct 24, 2006 at 02:41:00 PM PDT

> In the larger picture, the spammers are winning.

If the spammers win, they lose. Don't they realize that the more they spam the less useful email is and the fewer people will use it? I already have family and friends who are abandoning email because they cannot wade through all the junk. Many are switching to free long distance via cell phone to communicate.

[ Parent | Reply to This ]



Cell phones? Pah![ Parent | Reply to This ] (none / 0) (#11)
by Anonymous User on Tue Oct 31, 2006 at 03:03:52 PM PDT

Where is this? Europe? I have never heard of free anything with a cell phone in north america (or japan). Usually, if it's free with a landline it's expensive with a cell phone and if it's expensive with a landline it's ludicrously expensive with a cell phone. Then there's all the other stuff that doesn't even apply to landlines, like ringtones -- also expensive.

Sometimes the phone is free, but invariably it's with strings attached that end up costing you a fortune.

[ Parent | Reply to This ]



Spam spam spammity spam[ Reply to This ] (none / 0) (#3)
by James Farmer on Tue Oct 24, 2006 at 01:57:09 AM PDT

It's so sad the way the Internet is getting ruined by the spammers.  I used to get three thousand email messages a day - last week I changed some spam-filtering settings at my ISP and got it down to about five hundred a day, but that's still ridiculous - I haven't actually read anything in my inbox since June.

I had a blog site that was forced offline from the sheer volume of trackback and referrer spam that was hitting it - even though I didn't display a list of referrers, the spammers must have bots to detect certain blog software and hit it automatically.

I wrote a custom system for adding comments to some technical pages, and I get five or six comments trying to hawk viagra every day.  The comments have to get approved before they appear on the web, and of course these get filtered out by me, but the spammers keep trying.  Is this a bot or is this some guy in the third world being paid peanuts to surf the web and find places to spam for viagra?

I have to admit, and it's a painful thing to do having being involved in spam-fighting in earlier years, Ed is right and the spammers are winning.  Or maybe they've won.

Such a shame because I used to like email.

[ Reply to This ]



I cringe[ Reply to This ] (none / 0) (#4)
by TonyK on Tue Oct 24, 2006 at 05:54:39 AM PDT

every time a utility or financial institution wants me to go paperless. They want to trust e-mail to deliver important statements or notices.

Or when they feel the need to contact me via e-mail with offers. Why?

With the amount of spam, and the off/on again nature of e-mail, I just don't trust it for criticle things like receiving statements or notices. The USPS may not be 100% reliable but I trust them more than any ISP who does not offer guarantees of reliability.

Think I'm kidding? Look at a cable service agreement sometime. I know RoadRunner in TX called their service "entertainment" and services could not be guaranteed. To add insult they even said they could change or remove services at will.

For the bad behavior of a few the many get to suffer. :(

[ Reply to This ]



Evil stalks among us.[ Parent | Reply to This ] (none / 0) (#5)
by Anonymous User on Tue Oct 24, 2006 at 09:11:24 AM PDT

"Every time a utility or financial institution wants me to go paperless. They want to trust e-mail to deliver important statements or notices."

I don't do online banking or e-shopping. Two reasons why.

1. I don't have a credit card, and I have no intention of getting one.

Good rating, but currently tiny income; don't trust the companies; don't like the way every year the unsubtly-coercive pushing of the consumer-debt narcotic gets ever shriller, more obnoxious, and more ubiquitous. This starts with the decision someone made in the nineties to make online commerce vary from "unusable" to "outright impossible", depending on who-with, for anyone who doesn't have a credit card. Obnoxious TV ads. And now every damn store pitching their own separate brand of credit card at you every time you make a purchase using cash or debit. Why are they pushing this so hard, unless it will somehow make the lending companies (which apparently now includes every Tomco, Dick Inc, and Home Depot) richer? And how will it do that, unless it somehow makes me poorer? Don't give me that "you don't overspend and pay each bill in full as it comes due and you don't get dinged for any interest" bullcrap. They can't be purely counting on the people that will stupidly overspend. Certainly, they can't expect to get more than the customers' take home pay. Or can they? See below.

2. It's unsafe. I'm something of a technophile, and certainly no Luddite, or I wouldn't be here posting to a blog's comment roll. I know the risks and I do not accept them. Too many scams -- from fly-by-night vendors to identity thieves and who knows who. Too many leaks, by the Choicepoints of the world. You swipe your card, it's one transaction. You put your number into a web page somewhere and Christ alone knows how many transactions. Hell, even swiping your card is no longer safe, when unscrupulous companies will keep sending you crap and dinging your account over and over again after only one card swipe. There've already been more than enough gripelogs about that type of scam, as I'm sure all of us know! Or not, since "enough" might be best defined as "so many the scam stopped being tried, at least outside Nigeria".

The legitimate but dubious-looking emails the banks and CC companies purportedly put out only make things worse. My theory is, on purpose.

How does the whole "getting everyone and his brother to sign up for a credit card" thing make them richer, given the gobs more they spend on advertising every year and the unchanging (often dismal) incomes of the advertisees? Simple. The money doesn't ultimately come from the cardholders. Some of it comes from merchants (who often eat the costs of fraudulent transactions), but mostly, I guess, they're scamming their own insurers and reinsurers.

Of course, they can only make vendors eat some transactions and their insurance company pay out if there's lots of fraudulent transactions.

Ah. Now the lights go on.

They still pocket the interest payments, and whatever service charges (probably numerous, dubious, and frequent) they see fit to ding cardholders for. Everyone else loses: customers have spiraling debt and credit-rating problems or even bankruptcy, if not from their own bad financial planning then from identity theft. Vendors eat one in N transactions. Of course they pass the pinch on to their customers (credit-card using and otherwise) in the form of higher prices. Insurance companies get hit with massive claims. Even customers that don't use credit cards get hit, though less hard, in the form of merely raised prices at merchants. At least the effect there is not going to blindside them like a bill for $10,000 for someone else's car repairs and furniture-buying spree.

Oh, yeah. Besides the lenders, there is another winner. Identity thieves. I wonder how much of the $600 for my sofa is the hidden "tax" that pays for all the credit card company Superbowl advertising. Levied when they raised the price after yet another furniture-buying spree by an identity thief produced uncollectable bills they were owed, hiked their insurance, or whatever. Subsidizing, if indirectly, the whole scam.

Identity thieves and lendors -- what an unholy alliance.

What a scam.

Oh, I forgot to mention reason number 3. It's especially topical, too.

3. All the email spam to get people to sign up, often implying they already have an account they should be checking regularly. (Oops, our mistake. But we know you want one. Sign up now!) Plus the additional spam trying to scam you. (Often looks very similar.) As far as I am concerned, the companies are responsible for all of the spam, however much of it genuinely comes from them -- they also create the environment that encourages the rest of it. Actively, it seems, and intentionally.

I won't do anything spam wants me to do. Simple, really.

Ever.

  1. And don't get me started on PayPal. I will never touch them with a ten foot Firefox browser tab. Never, ever, ever, ever. They can pry my money from my cold, dead fingers. Actually, no, they can't, because I have willed every last dime to my close kin, and none of them use PayPal either.

  2. Why can't they at least pay lip service to honesty, and format CC numbers as three groups of six digits each, so at least "he who has wisdom" will recognize the threat? :P


[ Parent | Reply to This ]


Who do we have to thank for spam?[ Reply to This ] (none / 0) (#7)
by rodak on Wed Oct 25, 2006 at 01:14:10 PM PDT

Yeah, the spammers, but they'd have been out of business a long time ago if it weren't for the IDIOTS who waste money on their crap.  It's the one out of a thousand bozos who really think:

* you can get rich stuffing envelopes
* you can enlarge body parts or grow hair with chemicals
* you can make a killing buying real estate with no money down

etc, etc, etc.

As long as THOSE fools are around, and the spammers can manage to contact them via email, then we're all going to be suffering for it.  I don't get much spam personally, but my employer pays thousands of dollars per year (on hardware, software and my time) to block 95% of the spam that gets thrown at us every day.

[ Reply to This ]



Fight spam by fighting botnets[ Parent | Reply to This ] (none / 0) (#8)
by Anonymous User on Thu Oct 26, 2006 at 02:41:04 PM PDT

We should fight botnets. Keep our PCs clean and look for e-mail providers that don't allow incoming SMTP connections from user-machine IP address ranges.

http://www.freedom-to-tinker.com/?p=1079

Note the suggestions in the comments, particularly the one by "Neo", as well as the actual blog post itself, which gives good background into the problem.

Botnets are also involved in other forms of online nastiness. The recent problems right here at this site probably included.


[ Parent | Reply to This ]



Captcha needed[ Reply to This ] (none / 0) (#12)
by foxyshadis1 on Tue Oct 31, 2006 at 07:07:13 PM PDT

Can we get at least a very basic captcha on anonymous comments? I'm talking as simple as a constant word, which you can even mention in the articles, or an easy-to-see one. (Not one of those gruesomely gnarled ones made to stop OCR engines.) Even if you only make it show on posts more than a week or two old, even if it uses javascript trickery to only show for those w/o javascript, that would help immensely against the current spam waves. In another year or two you might need a stronger captcha, but this is a problem that needs solving now.

The other problem from my point of view is that searching by comments is incredibly slow, which means I'm practically DoSing your site by trying to clean up another DoS. It's the only effective way to find random spam though. I'm not sure if an update to the blog software would help that, or if it needs custom changes.

Although I've been willing to help the site with its spam problems, and I think it made a difference when I could do a full search 2-3 times a day, I simply can't compete with automation without help from Jeff.

[ Reply to This ]



Re: Captcha needed[ Parent | Reply to This ] (none / 0) (#13)
by Ed Foster on Thu Nov 02, 2006 at 04:47:40 PM PDT

Jeff is looking for a way to put a captcha on anonymous posts, but he needs to figure out how to do it in a way that the spammers won't be able to bypass too easily. -- Ed

[ Parent | Reply to This ]


Phoning It In | 12 comments (12 topical) | Post A Comment
Display: Sort:
Recent Entries
Bill Gates and PC history
21 comments

Borderline searches and seizures
15 comments

Reader voices: Angry at eBay
12 comments

Teleblend's terrible terms
2 comments

Spyware bill cloaks a mini-UCITA
9 comments

Reader Voices: Autorenewal Defenses
23 comments

More The Gripelog...

Submit a gripe
About the Author
Email Ed Foster

Help Ed and his readers build these projects:
The Gripewiki
The EULA Library

Login
Make a new account
Username:
Password:

Live Gripes
Has AOL Changed Their Ways?
12 comments

A Nestle SweeTarts Conspiracy
13 comments

AT&T Kills "Bad" Username
26 comments

DESPERATE! AOL HAS TAKEN OVER MY COMPUTER
47 comments

parkingticket.com SCAM on refunds
22 comments

Don't let Net Enforcers Ruin Your Day.
14 comments

More Live Gripes...

Sign up for my newsletter

To have my column automatically e-mailed to you, submit your email address in the form below. Of course, I will not turn your address over to any other party or send you any unrequested e-mail.

Infoworld Blogs

Recomended Sites
The AFFECT Coalition
Electronic Frontier Foundation
Electronic Privacy Information Center
Free Software Foundation
HearUsNow.org
Public Knowledge
StopBadware.org

Jeff Angus
Ben Edelman
Dan Gillmor
Bob Lewis
Brian Livingston
Freedom to Tinker
Lawmeme
PC World's Techlog
SunBeltSoftware Blog
Troubleshootsers.com

Rss Feeds
How this works
 Top News 
 Columnists 
 Tech Watch 
 Test Center Reviews 
 Applications 
 App Development 
 E-Business Solutions & Strategies 
 End-user Hardware 
 Networking 
 Operating Systems 
 Platforms 
 Security 
 Standards & Protocols 
 Storage 
 Telecommunications 
 Wireless 
 Web Services 

 

create account | faq | search