Saturday, August 23, 2003

Schlock Mercenary

Another interesting web comic that's been around since Jun 2000. I just happened to stumble onto their mid-March 2003 archives and found it interesting enough that I read a few dozen days off the bat.

The first strip is here and the current strip is here.

posted by Wuphon's at 11:34 AM

Thursday, August 21, 2003

RMX Status

Been searching around the web for status on the RMX draft to see where it stands. Right now, it still seems to be in draft form. The ASRG mailing list is full of threads full of FUD from back in May 2003. So far it looks like it's still in the "baking" phase, along with 2 other counter-proposals.

Resources (Google Search):

Good explanation of mail routing and how RMX will work
- Well written, shows how simple the idea is and covers most of the minor issues involved.

Microsoft on board?
- MS has published an "executive e-mail" back on June 24 2003 and hints at a reverse-MX record type system under the section titled, "Bringing Spammers into the Sunshine", but (as usual) they don't indicate support of any existing drafts.

[SLL] bounce creator
- This is an e-mail on the SSC's linux-list mailing list and references the above article as well as the IETF draft and the www.mikerubel.org explanation page.

SMTP+SPF
- Seems to be a competing draft to the RMX and DMP drafts that attempts to use the existing TXT records (which are also used for things like Microsoft's Active Directory) by prefixing the domain with "_smtp_client." to indicate status.

[RANT] RE: [Asrg] seeking comments on new RMX article
- Just one of the many ASRG list threads to give you an idea of how resistant people are to making a change like this, solely because it won't solve the entire problem in one fell swoop, therefore it's not worth making any effort. Gets even more vitrolic down around message id 04411. And finally someone leaves the list and posts a well written goodbye note. I agree with the poster after spending a few hours reading the ASRG mailing list from back in May/June - the spam issue will be solved in spite of ASRG unless those attitudes drastically changed in the past 2 months. Another poster complaining about the ASRG in late June.

Fight Spam With the DNS, Not the CIA
- Early July 2003 article posted at CircleID (a weblog that deals with the internet core infrastructure). I'm putting this site down on my list of things to read later on.

Re: [anti-spam-wg@localhost] it could be sooo easy - Solution to Spam
- Discusses the problem that using something like RMX can result in big packets that are larger then 512 bytes. I don't know if DNS records are always less then 512 bytes or not, or how the protocol handles multiple packet responses.

Tame Junk E-Mail
- Recent article (posted yesterday). Mostly about what you can do to keep yourself off of junk e-mail lists, but also lists articles from other sources (most from the June/July timeframe though).

(ugh, my eyeballs are tired after 2 hours of poring over mailing lists, web sites, etc... while listening to a Radio One Essential Mix by Sander Kleinenberg.)

Re: [Asrg] 0.General - News Article - NYT Reports Porn Spam Hijacking Network
- Okay, one more... DRIP is yet another attempt to fix the spoof issue / the ability for arbitrary IP addresses to claim that they are authorized to send e-mail for a particular domain. Downside that I see right off the bat from this message is that DRIP depends on the domain name in the HELO/EHLO command, which, from other readings, doesn't always exist, and doesn't work for situations where a single mail server delivers multiple domains in a single session. (The mail software would have to disconnect/reconnect everytime they needed to send e-mail for a different domain.) But then, to implement DRIP and most of the others, you're assuming that SMTP has to be rewritten to some extent anyway...

Labels: Spam

posted by Wuphon's at 6:24 PM

SoBig Worm (Why RMX is Useful)

Yet another reason why the RMX (reverse-MX) records need to be added to the DNS system and SMTP servers need to be re-written so that they do some level of verification that the SMTP server that sends e-mail is authorized to send mail for the purported recipient's domain. The way Sobig spreads is that it has it's own built-in SMTP engine which it uses to spread itself to other systems (hence, the originating IP is that of the infected system). In addition, it forges the return e-mail address in order to make it more difficult to track down the exact PC that is infected.

If the RMX system was in place, my mail server would look at that inbound bit of e-mail, which has a forged return address, check the RMX records for the forged domain and conclude that the inbound e-mail is not valid for delivery. Which would put a good dent in the ability of e-mail worms to spread themselves without leaving tracks in a company's outbound SMTP logs.

I've already gotten a few hundred messages in my bulk mail foder as a result, as well as some mail bounces where the virus forged my e-mail address in the return address field. Interestingly, all of the ones that I checked came to me from the same IP address. Even more interesting is that when I plugged that particular IP address into both Google and Yahoo! I found multiple web sites over in Germany that listed that IP address in their publically readable and indexed usage statistics pages. (The sort of pages that should be excluded from the search engine, not to mention put behind a password - unless they don't care that their competitors are able to monitor their site statistics.)

BTW, here's an excellent explanation of mail routing.

posted by Wuphon's at 4:54 PM

Tuesday, August 19, 2003

Games

Well, since I quit playing EQ, here's the short list of what I've been playing (at least, what's sitting in my game CD rack) over the past 3 months:

SimCity4 - still good, but I'm waiting on the Rush Hour expansion pack to come out this fall to perk my interest again..

Medal of Honor : Allied Assault - still my favorite FPS so far, most missions worth playing twice.

MoH : Spearhead (expansion pack) - not as magical as MoH:AA, the missions that I've completed are too linear.

Myst3D - old favorite, best interface of the series (it's a redo of the original Myst).

Riven - finally finished up all of the puzzles.

Myst 3 Exile - 's okay, but the plant island is extremely confusing. One of these days I'll digitize the maps that I've made of the various ages and post them (the maps help a lot).

Grim Fandango - my reaction to this after completing it is that it's like being in a movie. Excellent cut scenes, good dialogue, puzzles that mostly make sense and fit the storyline (and don't feel like puzzles). In fact, I did a video capture of the entire game to burn off to DVD later.

Curse of Monkey Island - Very fun game. Great humor and the cartoon style works well.

Escape from Monkey Island - I'm about 1/2 way done, but CoMI was more enjoyable so I've set EfMI aside for a few weeks.

Master of Orion 2 - Came out in, what, 1995 and I'm still playing? I mostly play now on Impossible, Huge, 8 races, but I'll hot-seat 2 races so that the enemy AI doesn't just steamroll me out of the gate if I get a bad starting position.

Master of Orion 3 - First patch is done, but they introduced some bugs in the final revision of the patch and don't say that they're going to fix the new bugs or fix any more of the old bugs. (/rude IG/Atari) The game is pretty much DOA, but would have been a great game if the publisher (Atari) would have done things proper or patched it up proper. Frustrating for the players when you can feel a great game buried underneath all of the bugs that Atari refuses to fix. Bottom line? Don't buy IG/Atari games until they've been out for 3 months and the *real* reviews have come out.

Heavy Gear II - was an okay game, but trying to control the mech was very frustrating and the AI is weak. I've pretty much replaced playing it with playing MoH:AA when I want some FPS action. (HG2 is another oldie that I dig out from time to time.)

Unreal Tournament - MoH:AA blows this away for game play, so I think this will be relegated to the old game bin soon.

Roller Coaster Tycoon - I liked it the last time I played it a few years ago, so I have the CD out but haven't installed it again yet. I think I had too much fun picking up the patrons and dropping them in the lake.

posted by Wuphon's at 6:30 AM

Monday, August 18, 2003

VillainSupply.com

VillainSupply... for all of your world domination needs.

posted by Wuphon's at 4:01 PM

Purple Encryption Scheme

Used by the Japanese during WW2 to encrypt communications.

Secure4Net - The History of Cryptography

posted by Wuphon's at 3:19 PM