home links tools blog about
home

« May 2005 | Main | July 2005 »

June 29, 2005

Rewinding Request.InputStream

UPDATE: The info in this post has been re-addressed here.

So, ReverseDOS 1.0 has a bug in it. I was totally oblivious to it until I was working on the code for ReverseDOS 1.2 and was thinking post filters through again.

Jerome Laban also caught the bug and commented about it in a previous post. And last night I got an email from Joseph Cooney who not only noticed the bug, but sent me an email with the fix. I liked his fix much better than mine, so I'm pinching it.

First of all, what was the problem In reverseDOS 1.0, postfilters (and their regex, and keyed counterparts) scanned the Request.InputStream to gain access to the body of the POST. But, because that's a stream, reading it 'winds' it out to the last byte/position. Subsequent attempts to read, in ReverseDOS 1.0, were then trying to filter against the POST body, and there was nothing to scan. In other words, the bug was my failure to 'rewind' the InputStream back to it's starting postion.

Here was my fix:

long originalPosition = this._request.InputStream.Position;			
string output;
using(StreamReader sr = new StreamReader(this._request.InputStream))
output = sr.ReadToEnd();

// reset the stream for further reads:
this._request.InputStream.Position = originalPosition;

Here is Joseph's fix, and the one that will go in to ReverseDOS 1.2:

string output;
request.InputStream.Seek(0, SeekOrigin.Begin);
using(StreamReader sr = new StreamReader(request.InputStream))
output = sr.ReadToEnd();

As you can see, his fix requires just one line where mine required two, and is still readable (i.e. has good factors), so it's an obvious win in my book.

Posted on June 29, 2005 | | Comments (1) | TrackBack (0)

June 28, 2005

The best news I've heard in MONTHS

In case you missed it, America STOPPED being the land of the Free last week when the Supreme Court ruled that land could be taken from private citizens and given to other private citizens if said land could then produce more tax revenue.

But maybe some good can come from this decision. In fact, I've just learned that some good news HAS come out of this decision. Logan Darrow Clements, a private developer, has filed papers requesting that Justice David H. Souter's house in NH be condemned through eminent domain.

He plans to build the "Loss of Liberty" Hotel, and in order for the venture to be successful (i.e. attract tourists, and therefore boost tax revenues/etc.), it MUST be built on the land currently occupied by Justice Souter's home.

Read the whole article. It doesn't appear to be a prank.

Sounds like he's got a pretty solid argument. There is NO DOUBT that the land will easily allow for better tax revenues. Hopefully the Board of Selectmen in Weare will do the RIGHT, and MORAL, thing by taking Justice Souter's home from him to further serve the cause of Life, Liberty, and the Pursuit of Increased  Tax Revenues that the Founding Fathers fought for.

My only suggestion: Make the "Loss of Liberty Hotel" a national chain. It shouldn't be hard to find enough private developers and investors to fund FIVE of these hotels to start out with. Then as the Justices are able to relocate, more hotels can be proposed -- Just think of the GOOD that these Justices will perform for city governments all over America as they move in and then are evicted to help cities foster tax revenue (it brings tears to my eyes).

Posted on June 28, 2005 | | Comments (1) | TrackBack (0)

June 24, 2005

ReverseDOS: Past, Present, Future

When I first created ReverseDOS I was really hoping that I'd be able to 'trap' spammers and other miscreants with a slow stream of bits that would bring their vile clients to their knees.

That was a cool fantasy. Spammers, obviously, weren't dumb enough to wait around for a complete HTTP response, let alone a slow stream of bits designed to 'DOS' their spambots. But the detection algoritms were simple, and worked amazingly well.

Bloggers using Community Server and .Text have already seen great results:
Chris Frazier saw it remove his comment spam problems in a jiffy.
David Hayden also saw it destroy his problems with referrer spam.
(And I saw it destroy my referrer spam problem too.)

Some unexpected benefits:
Because ReverseDOS was built as a framework, it's quite flexible. I never anticipated turning it against CommentAPI spam, or against TrackBack spam, but it will work fine against both.

Some room for growth, and the coming arms race:
_If_ word gets out, and _if_ people begin to use ReverseDOS, it will put a major dent in comment, referrer, and trackback spam. But if that happens, spammers aren't likely to rollover and play dead. I expect to see spammers regroup, and launch newer, nastier attacks. In other words, I expect an arms race. In fact David Hayden has already seen hints of that on his site - he reported seeing referrer spammers change their referrals to trackbacks after he blocked them from referring on his site.

Now the good news is that ReverseDOS can handle trackback spam, but it may be a bit clunky (because trackbacks can be done as either POST or GET -- so you'll need two filter definitions for ReverseDOS to catch them (a querystring filter, and a post filter). And that clunkiness got me thinking: if ReverseDOS is going to be able to compete in an 'arms race' with spammers, it needs to be very easy to configure. So I've decided to begin work on version 1.2 as soon as I can.

I'll announce the details of version 1.2 shortly, but for now the main point to get across is that functionality will still be very similar to what it is now, but a greater focus will be placed on making filters much more powerful (as well as letting them work in tandem towards an overall threashold/rating), and making them much more easy to manage and configure.)

Posted on June 24, 2005 | | Comments (4) | TrackBack (0)

June 18, 2005

Observations on Referrer Spam

So, I've been secretly paying attention to some patterns I've seen among Referrer/Comment Spammers. Here are some things I've noticed:

     
  1. While some sites list referrers, most do not. This doesn't stop referrer   spammers from spamming the HELL out of sites that do not. AngryPets.com, for   example, does not list referrers. But in the space of 15 days, I was hit 1300+   times with bogus referrers. MAYBE they think that I'll see those referrers in   my internal analytics, and will click on the link -- I kind of doubth that's   their hope. What I really think: They simply don't care. From what I've seen,   referrer spammers ONLY pay attention to the HTTP Response Code returned in the   header (they don't wait around for the body/content/etc). If they get a 200   (OK), they keep spamming. Period. However, if they see that access was denied,   they stop. Period. (So it would appear that it's a bit like email spam: the   cost to them is so minimal to spam, they might as well hit everything they   can. (And if you think about it, opening an SMTP connection is probably way   more expensive than thumpin an HTTP site a few times with a special 'browser'   that only cares about the response code.))  
  2. Comment spammers APPEAR to monitor how long their comment spam stays   'active.' My SQL Server blog is hosted by sqladvice.com, and uses .Text (it will   be transitioning to Community Server shortly). CAPTCHAs managed to stop   most/all comment spam to the blogs on aspadvice.com but haven't been   deployed to sqladvice.com yet. Consequently I get a slow trickle of comment   spam to my RepeatableRead blog. Here's what I've noticed: I sit in front of my   computer way too much. As such, when new comment spam   arrives, I quickly squelch it. Doing that has had some   interesting effects (or so I think, it could be coincidental). First   of all, I had losers posting GIGANTIC comments with scads of   links. After continously removing them immediately, the posts started   getting MUCH shorter (2 or 3 links instead of 20+). But I kept squelching   them. Eventually the comment spam almost died out (My blog is unique, I   think, in that it gets some traffic but not LOTS, so it's not a huge target).   Then I went on vacation. And decided to leave my machine off. Comment spammers   RAPED my blog. Not only is the spam back at all time high levels, but   the comments are back up to being gigantic. It sure SEEMS that when I   went on vacation, they quickly clued in to the fact that their comments were   'living' longer, and seemed to see that as an invitation to spam me even more   (and invite their buddies--on the second day of ignoring my comment spam I got   spam for 'good deals' I hadn't seen before).
    So, now I'm back in the   process of trying to 'inform' these spammers that I don't appreciate   poker, drugs, mortgages and other crap that much.   If that has an effect, then that makes for some interesting info   about the way these losers operate...

Posted on June 18, 2005 | | Comments (1) | TrackBack (0)

June 16, 2005

ReverseDOS Configuration Issue

Chris Frazier, maker of the invaluable PostXING (I'm using it to make this post) ran in to some configuration issues with ReverseDOS on his CommunityServer enabled site. He was able to quickly solve it, and was kind enough to blog about his solution.

I'm swamped at work right now, but as I get time I'll pull down a copy of Community Server, plop it on a VPC, and do some configuration testing of my own. Once that's done I'll add some configuration instructions to my main instructions page.

(I'm also planning on putting up a roadmap for ReverseDOS here within the next week or so. (Nothing fancy.))

Posted on June 16, 2005 | | Comments (5)

June 15, 2005

Anti Virus Stupidity

I think most people should run memory resident Anti-virus programs. I don't, because I practice 'safe computing.'

That said, my dad and I were talking the other day about one terribly stupid feature of Anti-Virus Software: Checking your email before it goes out. Hey, I get it. The concept makes perfect sense: Check outgoing emails as a form of protection for the end user, so that they never have to hear: "Hey, you sent me a legit email, I let it in, and it had a virus -- YOU contaminated ME."

That sounds good on paper. But since we're on a piece of paper, let's use the pencil to draw a little picture shall we The picture would look like a box. And we could label it: My computing environment. Then draw an arrow from inside the box to outside of the box, and label it: outgoing stuff. The idea here, is that you want your virus scanner to catch outgoing virii to stop you from spreading them right With me so far Good.

Question: This outgoing stuff that is soooo bad How did it get on your box in the first place Wasn't the AV supposed to block it from getting on your box And if it missed it getting on to the box, we're supposed to believe it would catch it LEAVING the box

Like I said... it's an AV stupidity.

Posted on June 15, 2005 | | Comments (0) | TrackBack (0)

June 14, 2005

ReverseDOS DogFood Report

About a month ago I posted that I was putting ReverseDOS to work on my site to stop Referrer Spam.

Results:
First Half of May: 1347+ Hits from Referrer Spammers
First Half of June: 36 Hits from Referrer Spammers (35 of those were 'caught' and sent an HTTP 403 - Access Denied, and therefore didn't even show up in my analytics with legit referrers).

That's a HELL of an improvement. (i.e. it's roughly a 99.75% reduction in Referrer Spam)

So, it would appear that Referrer Spammers DO pay attention to Response Headers. And because I kept sending them an HTTP 403 - Access Denied each time they tried to access my site with a 'blocked' referrer, they got the message and stopped comming.

Pretty cool if you ask me.

So, what's next I'm working on creating a library where people can post their 'filter' patterns. The patterns/filters I've got set up work fine for me. They'd work fine for other people too, but there are bound to be other types of referrer spam out there. That, and I'd like to set up a bunch of filters for comment spam -- so a library where people can post (and then copy/paste) will be beneficial.

I should have that up and running soon....

Posted on June 14, 2005 | | Comments (0) | TrackBack (0)

June 13, 2005

Geena Davis Can't Act

Listening to Stuart Little while it entertained the kids on a long road trip helped me realize something (above and beyond the fact that portable DVD players are a life-saver in long trips). What did I learn That anything is possible.

No really, anything is possible. Geena Davis simply CAN NOT ACT. Yet she's been in a BOAT LOAD of movies I've only seen her in 3 (both of the Stuart Littles, and that NASTY movie: CutThroat Island) -- but she sucked in all of them. I saw part of Beetle Juice too... but her acting there was also horrible. (Maybe she's just super hot, and I don't see it)

So, go ahead, dream big. If Geena Davis can keep landing movies... you can do anything you put your mind to.

Posted on June 13, 2005 | | Comments (0) | TrackBack (0)

June 08, 2005

Don't make me login to get a patch

Seriously. I hate it when I go out to a site, looking for a patch to software that I bought, and I find the patch, them I'm required to login/register before I can do the actual download.

I DIDN'T agree to that when I bought the software off the shelf . Don't make me do it. In fact, I won't. I'll just use http://www.bugmenot.com to get in and grab the download.

Mike 1. Roxio 0.

(Actually, for companies that do this... somebody tell your marketing dept that they are actually HURTING business.)

Posted on June 08, 2005 | | Comments (3) | TrackBack (0)