Opt-out impossible - Spam from MySpace
Five weeks ago I changed my email address for MySpace and that should usually do to stop receiving emails on the previous address. To make matters more complicated, my preference is to receive notifications but not MySpace’s newsletter and one would think that should prevent the reception of promo blasts. Well, not quite, it seems ;-).
I was more than astonished not only to receive a newsletter I did not ask for today, but also one that was sent my old email address. Oddly enough, I did not receive another copy at my currently used email address, just at the old one. Things happen, and sometimes it helps to utilise the unsubscribe link. Unfortunately their implementation of opt-out does not involve removing an email address but providing a link to one’s profile preferences, which of course ensures the problem will persist. Newsletters are bulk email and each copy that reaches an inbox that did not subscribe to it is unsolicited. That makes their misdirected newsletters spam. Therefore, I flagged this message as spam in my affected Gmail account and wrote to their support stuff making them aware of the issue. Not that I expected any reaction, other than some boilerplate responses that do not fit to the actual situation, but at least future mailings will be dealt with appropriately by Gmail’s junk filters.
In any case, the outcome will have the final say as to whether I will continue using their services in the future. It does not lack some irony that a company which tries to position itself as “anti spam” fails at trivial things like mailing list management. So far, I’ve never encountered a mailing list that continued to deliver to an old email address, but then again there is always a first time…
Who are behind WebDataCentreBot?
It does not pay not to preemptively block ranges known to be occupied by popular hosting companies, unless you want to have fun with non behaving or fake bots. The pleasure of me enjoying the WebDataCentreBot was rather accidental as I was lazy in terms of blocklisting any SoftLayer ranges, so that these may not be able to do anything but sending mail to or receiving mail from me.
Sitting on 67.228.177.87 and announcing itself as:
Mozilla/5.0 (compatible; WebDataCentreBot/1.0; +http://WebDataCentre.com/)
Not only did it jump right in to start indexing without bothering in the slightest about robots.txt, but also happily accepted content that was explicitly excluded from robots.txt. But then again, how should it know without reading it in the first place? Well, I thought perhaps they want to learn about the broken behaviour of their bot and fix it, but looking at their site webdatacentre.com, all I can find is:
Web Data Centre
Web Data Centre is an internet research project driven by a small team of researchers from different parts of the world. Its aim is to get a better understanding of the link structure of the web. More info is coming shortly.
(front page as of June 29th 2008)
And that was it. No point of contact whatsoever and looking at the registration data, things turn out to look pretty spammy:
Domain Name: WEBDATACENTRE.COM
Registrant [1435225]:
Moniker Privacy Services
20 SW 27th Ave.
Suite 201
Pompano Beach
FL
33069
US
Administrative Contact [1435225]:
Moniker Privacy Services WEBDATACENTRE.COM @ domainservice.com
Moniker Privacy Services
20 SW 27th Ave.
Suite 201
Pompano Beach
FL
33069
US
Phone: +1.9549848445
Fax: +1.9549699155
Billing Contact [1435225]:
Moniker Privacy Services WEBDATACENTRE.COM @ domainservice.com
Moniker Privacy Services
20 SW 27th Ave.
Suite 201
Pompano Beach
FL
33069
US
Phone: +1.9549848445
Fax: +1.9549699155
Technical Contact [1435225]:
Moniker Privacy Services WEBDATACENTRE.COM @ domainservice.com
Moniker Privacy Services
20 SW 27th Ave.
Suite 201
Pompano Beach
FL
33069
US
Phone: +1.9549848445
Fax: +1.9549699155
Domain servers in listed order:
NS1.DOMAINSERVICE.COM 67.99.176.12
NS2.DOMAINSERVICE.COM 67.97.247.209
NS3.DOMAINSERVICE.COM 64.49.213.231
NS4.DOMAINSERVICE.COM 67.97.247.210
Record created on: 2008-06-27 05:46:23.0
Database last updated on: 2008-06-27 05:46:39.373
Domain Expires on: 2009-06-27 05:46:41.0
Registered a mere two days ago and hiding behind an anonymous privacy shield. Why would a business want to remain anonymous unless it has to conceal something? One also might expect a search engine to reveal its legitimacy by having a meaningful rDNS name that reflects the bot’s name, but nothing much to find here either:
olliver@bunkiten:~$ host 67.228.177.87 87.177.228.67.in-addr.arpa domain name pointer midphase.com.
Midphase.com is the generic PTR record of a Softlayer reseller:
%rwhois V-1.5:003fff:00 rwhois.softlayer.com (by Network Solutions, Inc. V-1.5.9.5) network:Class-Name:network network:ID:NETBLK-SOFTLAYER.67.228.160.0/19 network:Auth-Area:67.228.160.0/19 network:Network-Name:SOFTLAYER-67.228.160.0 network:IP-Network:67.228.177.0/24 network:IP-Network-Block:67.228.177.0-67.228.177.255 network:Organization;I:Hosting Services Inc. network:Street-Address:223 West Jackson Blvd STE# 1014 network:City:Chicago network:State:IL network:Postal-Code:60606 network:Country-Code:US network:Tech-Contact;I:sysadmins @ softlayer.com network:Abuse-Contact;I:abuse @ midphase.com network:Admin-Contact;I:IPADM258-ARIN network:Created:20080128 network:Updated:20080324 network:Updated-By:ipadmin @ softlayer.com
An aggregated range of consecutive ip addresses registered to the bot building outfit would seem more practical, especially to direct complaints to the appropriate persons. However, there is no info about the number of ip addresses in use by this anonymous entity, which effectively helps Midphase’s publicity shy customers remain anonymous. Putting all together, it seems more likely to assume they are content/email/webform seeking spammers building a list for themselves or to sell to other spammers than an actual search engine. Even if I am all mistaken, I am still not particularly keen on bots that do ignore established standards like robots.txt. Absent any communication channels one has to conclude that one may not be able to opt out from their crawling by ordinary means.
Therefore, firewalling this particular range seems an appropriate solution to me:
iptables -A INPUT -s 67.228.177.0/24 -i eth0 -p tcp -m tcp ! --dport 25 --syn -j REJECT
This rule rejects all incoming TCP traffic except for SMTP, as there may be legit sites we like to receive mail from or sent mail to. We have to specify that only incoming syn packages be rejected, because otherwise outgoing mail to this address range would remain stuck in our queue and never got delivered. If this potential need for communication is not an issue to be worried of, one still can apply the BOfH method and drop the range altogether:
iptables -A INPUT -s 67.228.177.0/24 -i eth0 -j DROP
Apache servers may also be happy about another SetEnvIfRule, preferably in httpd.conf/apache2.conf or .htaccess if the former is not an option due to a shared hosting account:
SetEnvIfNoCase User-Agent "WebDataCentre(Bot|\.com)" block Deny from env=block
Update July 1st, 2008:
The bot has been spotted with another ip address, 66.150.224.245, this time without any rDNS record at all:
olliver@bunkiten:~$ host 66.150.224.245 Host 245.224.150.66.in-addr.arpa. not found: 3(NXDOMAIN)
Familiar set up, within a /24 of a presumable Internap reseller and still without any details concerning the company/project.
CustName: Networld Internet Services Address: P.O box 551 City: Skippack StateProv: PA PostalCode: 19474 Country: US RegDate: 2007-01-16 Updated: 2007-01-16 NetRange: 66.150.224.0 - 66.150.224.255 CIDR: 66.150.224.0/24 NetName: INAP-PHI-NETWORLDINT-12098 NetHandle: NET-66-150-224-0-1 Parent: NET-66-150-0-0-1 NetType: Reassigned Comment: RegDate: 2007-01-16 Updated: 2007-01-16 RTechHandle: INO3-ARIN RTechName: InterNap Network Operations Center RTechPhone: +1-877-843-4662 RTechEmail: noc @ internap.com OrgAbuseHandle: IAC3-ARIN OrgAbuseName: Internap Abuse Contact OrgAbusePhone: +1-206-256-9500 OrgAbuseEmail: abuse @ internap.com OrgTechHandle: INO3-ARIN OrgTechName: InterNap Network Operations Center OrgTechPhone: +1-877-843-4662 OrgTechEmail: noc @ internap.com
In case you want to add another iptables rule based on the sample further above, simply replace 67.228.177.0/24 with 66.150.224.0/24 and you should be set.
Update July 4th, 2008
Another sighting, this time crawling from Sweden using 77.110.52.67 as ip address:
olliver@bunkiten:~$ host 77.110.52.67 67.52.110.77.in-addr.arpa is an alias for 77-110-52-67.univation.riksnet.nu. 77-110-52-67.univation.riksnet.nu domain name pointer ip67.univation.riksnet.nu.
So the pattern of using generic rDNS records obviously persists, as does their ignorance concerning robots.txt.
Whois:
inetnum: 77.110.52.64 - 77.110.52.79 netname: SE-RIKSNET-UNIVATION2 descr: Stockholm Univation AB site2 country: SE admin-c: BEER3-RIPE tech-c: BEER3-RIPE status: ASSIGNED PA mnt-by: MNT-RIKSNET mnt-lower: MNT-RIKSNET mnt-routes: MNT-RIKSNET source: RIPE # Filtered person: Bengt Erik Sandstrom address: Graddvagen 7 address: S-906 20 Umea address: Sweden phone: +46 768 272022 nic-hdl: BEER3-RIPE source: RIPE # Filtered
That range would translate to 77.110.52.64/28, a rather small block this time, and this is also the value you would like to use for blocking them via iptables or other means.
Eight weeks a day without life
I’ve been waiting for a guide to come and take me by the hand
Could these sensations make me feel the pleasures of a normal man?
These sensations barely interest me for another day
I’ve got the spirit, lose the feeling, take the shock away
Ian Curtis - Disorder
Perhaps a summary of the past two months:
Some people may appear like helpful or in favour of you, but taken at their words they turn out to be just more professional poseurs with decades of practice in society compliant obedience. Should you ever happen to get too close to the edge of nowhere, they will quickly let you know about their priorities. In line of society means transposing the laws of capitalism to everyday’s life, which of course is nothing else but a political correct form of Darwinism. You are not welcome as a human, but as a human resource to deploy, as a commodity, institution, object or vessel for silly prejudices and hatred. Right is not a matter of the better argument, but merely a matter of dependence and abusing it for one’s own end.
There is not really a good reason to live on like nothing ever happened, because it has alway been around like this. Perhaps one was lucky to be spared, not to come into someone else’s crosshairs, but that alone does not make the world a better place. Nor does it mean that people will think of someone as a useful member of society. You are judged by what you own by people who do not have the authority to judge and not by what you achieved. There is a place, confirmed and assigned, but no matter how hard you try you do not get to change the rules others will apply to you. Should you ever become too careless to forget about it someone will gracefully remind you of it.
Giorgos Stefanou - Travelling in Space-Time
Giorgos Stefanou’s Travelling in Space-Time has been released on Petcord: Described as an imaginary journey to a future form of civilisation, the hope for success appears to be of a rather limited nature. What is the driving factor behind this journey? One may conclude it could be related to the religious notion of salvation, the eventual reward after a troubled life, however does not seem to fit to the scenery and its lack of euphoria. Instead there is solitude and isolation, thrown into a rather hostile environment with a lifeless machinery as the only communication offer. A journey which seems to meet its (lack of) expectations like a disillusioned look into the mirror with no one or any circumstances to blame. On the other hand even a pointless occupation serves as an option to keep oneself busy, at least until an alternative option will occur on the horizon.
The intensity of its nihilism Travelling in Space-Time seems to imply turns it into an electro-acoustic masterpiece. By deliberately avoiding significant culmination points and creating a cavernous sound similar to Martin Hannett’s production of Joy Division’s Unknown Pleasures this approach appears as an effective means to an kafkaesque end. Form follows function follows spectromorphology, but does not follow mainstream conversations.
binding qpopper to one ip address with xinetd
In its default package on Debian, qpopper is a pop3 daemon, which is easy to configure and quite complete in its implementation (supporting apop and ssl encryption), however has the nasty disadvantage of listening to port 110 on all the interfaces a server provides. The reason is that on Debian, qpopper is started via inetd and inetd does not know how to listen to specific interfaces. If we want to change this, we have two possibilities to choose from:
1. Compiling qpopper ourselves as standalone server and have it listened to one interface.
2. Replacing inetd with xinetd.
The latter is the one I would like to focus on because it allows what we want to reach with minimal changes. At first it might be useful to explain xinetd is: xinetd is thought as a replacement of inetd and one of its biggest advantages is that it make services listen to specific interfaces only, even if they themselves do not provide such a configuration option. Xinetd can be easily retrieved via the usual apt-get install command. /etc/xinetd.d is the directory where all the services that are supposed to be run by the daemon should have their configuration file. As we like to run qpopper, we simply create a new file called “pop3″ (after the service) and fill it with the following values:
service pop3
{
disable = no
id = pop3
socket_type = stream
protocol = tcp
user = root
wait = no
flags = nameinargs
server = /usr/sbin/tcpd
server_args = /usr/sbin/in.qpopper -f /etc/qpopper.conf
bind = 1.2.3.4
}
Of course you want to replace 1.2.3.4 with the ip address of the interface you would like to use for qpopper. Restart xinitd by invoking
# /etc/init.d/xinetd restart
as root and if things went well, you should see qpopper now listening at your specified ip address:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:587 0.0.0.0:* LISTEN 20888/sendmail: MTA tcp 0 0 1.2.3.4:110 0.0.0.0:* LISTEN 14263/xinetd [...]
Composing is really strange: Each completion of a circle already spawns its follow-up. And so, after weeks of collecting and generating new audio sources, the work has begun once more. A larger track is currently in the making and may see its completion in the next days, depending on how much time I can spend with it. There is another shift in sound, perhaps an influence of Giorgos work, in that some elements that have not encountered in my music since Concrete Muser seem to reappear: Weird noise, sometimes like delusive voices or sonic splinters of a broken speaker bouncing from left to right in the stereo panorama, breaking the dominance of theme progression and variation. Perhaps it is more like an event than a planned happening and as such the music is harder to catch and more irritating. One has to see what course this will take and whether it will prevail in the other tracks too. At this time, I am not sure whether to compose another set of movements or single tracks without relationship to each other.
Photo retrospect first quarter of 2008
The first quarter of the year is gone and I think it is about time to reflect it with a photographic retrospect:
For armchair botanists and others interested in plants I added the scientific names where it made sense (requires at least a prominently featured plant in the first place ;-), providing I know what it was. This is only a small selection of what I considered worth keeping and the decision process was quite hard, as there were much more pictures of equal quality than usual. In case you wish to see more, you can have a peek at my Picasa repository, but please note that these images are copyrighted and may not be incorporarated into someone else’s work, republished or reproduced without my prior permission, whether commercial or non-profit. For this matter please contact me and if I like your project or offer, we may even get to discuss details and conditions.
How to do PHP based 301 redirects
One common problem with script based redirects is that often they default to using 302 (moved temporarily) as response code. However, as the meaning moved temporarily already implies, that code is not meant for pointing to permanent locations like linked sites of a redirector script (for instance an outbound click tracker). In this case it would be more appropriate to tell both browsers and search engines that the endpoint of the redirect should be preferred over the link that caused the redirect. So how to get it done the correct way, when the stock location header sent by PHP defaults to code 302?
The answer lies in reading the PHP documentation thoroughly, especially the provided examples ;-). As long as no html output has been spilt (sometimes accidentally via whitespace as result of sloppy editing) you can send as much headers as you like. The documentation specifically mentions two cases:
There are two special-case header calls. The first is a header that starts with the string “HTTP/” (case is not significant), which will be used to figure out the HTTP status code to send.
[...]
The second special case is the “Location:” header. Not only does it send this header back to the browser, but it also returns a REDIRECT (302) status code to the browser unless some 3xx status code has already been set.
(emphasis mine)
There lies the answer: If we want to use a 301 redirect, we will have to send two headers:
<?php
header("HTTP/1.1 301");
header("Location: http://www.example.com/");
?>
which results in:
HTTP/1.1 301 Moved Permanently Date: Fri, 11 Apr 2008 21:22:56 GMT Server: Apache/1.3.34 (Unix) Location: http://www.example.com/ Content-Type: text/html
Exactly what we wanted.
Also, this response demonstrates that headers mentioned will replace similar ones and the rest will be accomplished by server defaults. Another usage of this “replace” feature could be to fool nasty bots with unexpected error codes like:
<?php
header("HTTP/1.1 402");
?>
Which yields in:
HTTP/1.1 402 Payment Required Date: Fri, 11 Apr 2008 21:29:57 GMT Server: Apache/1.3.34 (Unix) Content-Type: text/html
You may wish to add an error page with a credit card payment form to complete the confusion :-).
Yet another release on Petcord: Giorgos Stefanou - Elati
I know, a lot of time has passed since my last entry and that I used to write more frequently in former times, but I had been busy over the last days. Part of that was related to programming a backend of a website and preparing a new Petcord release by Giorgos Stefanou called Elati. As you may have guessed already, this music is not likely equipped with a mass appeal and catchy melodies, else it would not wind up with Petcord ;-). But fear not, my dearest friends, it is a very fine work that deserves to be called electo acoustic, maybe even electro acoustics, as the virtual room created by the stereo panorama play an important role in Elati, namely being just as a parameter as tone length, pitch, volume or tempo.
Even better, the release does not endorse contemporary tendencies of flattening dynamic ranges by means of heavy compression, so that a song can be played on any equipment and any environment (independent from the background noise level). Instead, low volume really means hardly discernable sounds, since a huge dynamic range was carefully preserved during the mastering. Something this kind of music really benefits from as culmination points really get noticable just by the immense gain of volume. The cover art’s history is not less interesting either. Originally I made a draft similar to previous Petcord covers, but somehow the result was not convincing. Giorgos then had another draft, but I found it too conventional, as it featured just the run-of-the-mill “photo with subject line” type of cover. However combining the best of both surprisingly resulted in a satisfying solution and only little adjustments were necessary as most things worked out of the box.
The link between Elati and the music is unkown to me, or perhaps undefined by default, as Giorgos Stefanou does not care about carrying a message that is so important that every listener has got to identify it in order to qualify as worthy audience. Perhaps similar to my conviction that music is all about the listener can think of and the creator in this process is entirely irrelevant. If stated otherwise the music has become supplemental to the ritual of stage adolation. There are people in desperate need of someone they can look up to and project any of their unfulfilled dreams into as well as there are inflated egos who constantly need someone to tell them how great they are, before they doubt it.
Music as vehicle for attention craving sociopaths can be easily identified by its lack of substance and identity. Curiously, the most peculiar and controverse star shamans publish the most trivial and anonymous type of music. Stereotypes that could apply to anything and anyone. It comes in bulk, it lacks personal identification and we are exposed to unsolicited presentations. It perfectly fits to the definiton of spam. Musical spam, junk music. I laugh about their efforts of their marketing departments to have them considered as geniusses. If someone actually is, it will show and no justifications, redefinitions or explanations are necessary.
Last.fm and their notion of “similar artists” somehow leaves a thing or two to be desired, so it seems:
Nodepet on last.fm
(The corpus delicti is the box to the left)
How on earth is my music similar to big bands, blues or some yodling bozo from the 40ies? I really feel sorry for those who unsuspiciously click “play similar artists” and will be amazed by this interesting selection (or not). Vice versa, someone not knowing my music and catching sight of the similar artists block will most likely turn away in disgust. Last.fm state this list would be compiled based on listening habit. Maybe those who listened to my music did happen to have a rather eclectic music taste, but I somehow doubt that. Other musicians do not seem to be affected by this feature, so it is not that this automation would not work at all.
An alternative conspiracy theory would be someone is willfully “polluting” the list by exploiting a “feature” (some call it sloppy programming). But where is the benefit? Featuring some obscure music? Or just seeing that my music never gets heard by an appropriate audience? Whatever, I have to look for a way to manually clean up the list, so similar artists actually means what it promises.