Dallmayr und Conrad lassen spammen

Und zwar von [Polen][ip] aus. Haben Dallmayr und Conrad das denn wirklich nötig?

[ip]: http://dnstools.com/?lookup=on&wwwhois=on&arin=on&portNum=80&target=80.55.232.214&submit=Get+Info

Hier zeigt sich mal wieder das *Masse vor Klasse*-Pattern der Spammer. In diesem Blog ist weder HTML in den Kommentaren nicht erlaubt, noch werden URL in Links umgewandelt.

Praesentkoerbe
Dallmayr
Schokolade
Dallmayer
Elektro
Modellbau
Autoradio
Modellbau

Den Bindestrich im Domainnamen habe ich hinzugefügt.

Self-Publishing

Where do you have the best thoughts? Me, usually in a quiet place where I can let my brain jump from node to node. In my case this place often is the bathroom, sitting on a particular inventory.

Just a few minutes ago my brain jumped again and led me to the concept of self publishing and what this concept has done to *the Internet*.

Before we start we need to distinguish what this term, Internet, actually means. First, Internet is stuff done by TCP/IP. This ranges from IRC, NNTP, Mail including SMTP, POP, IMAP and so on, to FTP, several other services and of course HTTP. But today, I think I can savely say, Internet mainly means stuff done by HTTP, or in the word of laymen, the Web.

Here comes the second term we need to have a closer look at: user. Generally spoken, a user is a person using a tool to accomplish a task. The crucial points are *tool* and *task*.

It’s some ten years since the internet took off. In the first half of the decade, being a user meant using a browser, mail client, ftp tool, newsreader to surf or to take part in the various types of communications. With one type of tool users were on the receiving end of the information stream, with others types they could also send. The paradigm was that you had to use a certain tool for each single task you wanted to accomplish.

Within a few month it was clear, that even if mail was — maybe it still is — the most used service, the most significant service was the Web. Sadly enough, back then the web was not very interactive or communicative. Communication was targeted away from the web towards the users, so called surfers. If a surfer wanted to talk back, she had to use another tool, another interface, another context.

There were different kind of tools and tasks to establish communication between users. A user needed to use a text editor or one of the very early specialized Web editors to create content. She then had to move to her website, again using a different tool, namely a FTP client. The task of creating content was rather technical. It was not focused on the content, but on fancy syntax she needed to know to make the content surfable — usable — to the surfer.

Perhaps a year or two later, the first Web based user-to-user-communication places came along. Users could communicate directly, using a single tool, not switching context or interface, inside of boards or forums, modeled after the bulletin boards of the mailbox era.

But wait, we already had the Usenet at this time, and for some time before, too. As pointed out earlier, users were not able to use it without special tools and thus breaking up the experience of using the Internet in different islands, each one represented by a single icon on your desktop — CLI users forgive me ;) Breaking things in islands is not good. Islands are not directly connected to each other and you have to either swim or use a boat of some sort to navigate between them. This takes time and generally requires an effort.

With the Web, it was different. As soon as the first people discovered that the content making up a website didn’t have to be premade HTML documents written with a special editor by a human, Dynamic Webpages came into being. Sure enough CGI was hardly older than HTTP, but it was not used to faciliate communication between users. The [CGI Intro][cgiintro] says: *[…] to transmit information to the database engine, and receive the results back again and display them to the client.* Even if it was technically possible, using CGI to make users communicate was not intended, hence the name *gateway*.

[cgiintro]: http://hoohoo.ncsa.uiuc.edu/cgi/intro.html

Some people thought about it and concluded that CGI was a waste of time if its sole purpose would be to transfer content from one isle to the other without letting users actually work on the content, grab it, do something to it.

Let me focus on self publishing, not on the technical terms surrounding web applications. You all know well the importance of enabling technologies like PHP.

Meanwhile services like Hotmail and GMX built a bridge between the Web and e-mail islands. Now we could use both services using the same interface, staying in context, hardly noticing that we were using different services and tools. The distance between the islands began to lessen.

What happened was that we started to realize that the Web could integrate all other services. Using the Web, we could not only write an e-mail to a friend, we could also use newsgroups, navigate FTP servers, build bridges to fast outdated services like Gopher and other specialized services. We could use the Web to accomplish virtually every Internet-related task. Our desktop became cleaner, since we could delete most icons, just keeping the one saying *Internet Browser*.

To publish today, you sign up to one of the many hosting services available and pay less per month than one night at town. You can get your own website up and running within 24 hours using nothing more than a browser. Taking part in discussion groups on the Web is nothing new or revolutionary. But with only very basic knowledge about some details, you can even become a forum host yourself.

Regardless of the type of content you want to publish, you can do it within hours. You can do it yourself, right from your desk. You don’t need to know about fancy syntax or about the inner workings of FTP or HTTP.

As it is with any topic given, this has advantages and disadvantages. Some people argue that the Internet was better when only people who knew about each gory detail could actually publish. They argue the Internet suffered from [AOL users][aoluser], it suffered from amateurish done homepages (some complain about personal or private homepages in general) and distinguish good from bad by using the terms homepage and website. The complaining usually ends with pointing out that most novice users cannot quote correctly, have no sense about spelling and punctation or have other improprieties making them bad users in general.

[aoluser]: http://vowe.net/archives/005275.html

While these discussions are fun, they cover the fact that the same people complaining about users who use easy-to-use-services are using them theirselves. Maybe the complainer know *why* and *how* the services function. But does that make them better user or publisher?

Back to topic…

Allowing every one to create, maintain and manage her own content on the Web provided a voice to people who weren’t heard before. We can reach not only hundreds, but thousands of people all around the world. Reality check. You can reach perhaps 100 people speaking the same languages and sharing the same interests. But you can do so from your desk, you can do so with a click of your mouse and you can do it *now*.

For professional users, professional publishers, writers, librarians and people of simliar trades, self publishing has impacts, too. Sure there will be groups that suffer more than they benefit. The Pony Post vanished when the telephone came, and some professional publishers might vanish when self publishing hits the minds of writers and researchers. But after all, information is the means of production today. Delivering information is vital for most businesses, as is multilateral communication – both we can enable and simplify using means of self publishing.

In the first 5 years we tried to figure out how this whole thing works. In the next five years we sat up services that faciliated the usage, aggregating a whole bunch of services into a single interface, building huge bridges between all kinds of services.

What’s next? Will we aggregate even more services into this interface? Will we shift to a different interface and live through all this again? Will there be new services superseding the Web?

Thanks to [Stefan Rubner][stefan] for improving the readability and orthography ;)

[stefan]: http://whocares.de/

Josef Kolbitsch and Hermann Maurer - Journal of Universal Computer Science 12.2:

To date, one of the main aims of the World Wide Web has been to provide users with information. In addition to private homepages, large professional information providers, including news services, companies, and other organisations have set up web-sites. With the development and advance of recent technologies such as wikis, blogs, podcasting and file sharing this model is challenged and community-driven services are gaining influence rapidly. These new paradigms obliterate the clear distinction between information providers and consumers.

T-Online-Plagiat

Was hat Mallemaxe mit T-Online zu tun? Eigentlich nichts, dennoch finden sich auf seiner Site deutliche Hinweise auf die T-Online’sche Herkunft des HTML-Codes.

Zum Beispiel die Einbindung des IVW-Javscripts über die URL *http://toi.ivwbox.de/cgi-bin/ivw/XP*. TOI steht für T-Online International (AG), den offiziellen Firmennamen von T-Online.

Auch bestimmte Bilder sprechen eine deutliche Sprache: *<img src=”onnachrichten.t-online.de/t.gif” width=”5” height=”1” />*

Das Plagiat ist leider nicht mehr vollständig online, nur über [Google][google] sind noch Fragmente auffindbar.

[google]: http://www.google.com/search?q=mallorcamaxx “Mallemaxe bei Google”

Was lernt man daraus? Prinzipiell wird alles geklaut ;)

Weblog Software Matrix

[Blane Warrene][blane] hat eine Weblog-Software-Übersicht gebaut. (Weblog hier im Sinne von Logs eines Webservers, nicht im Sinne von Blogs.)

[blane]: http://www.practicalapplications.net/index.php?p=76

Und wo wir schon mal dabei sind: Weblog-Software-Übersichten, diesmal im Sinne von Blogs, gibts [hier][1], [hier][2] und [hier][3].

[1]: http://www.asymptomatic.net/blogbreakdown.htm
[2]: http://www.bloghaus.net/blogtools/
[3]: http://www.onlinejournalismus.de/forschung/blogware_tabelle.php

(Da sieht man mal wieder, warum man aus MS-Office-Produkten tunlichst keine HTML-Exporte machen sollte.)

PS: Sowas [gibts][foren] auch für Foren und Boards.

[foren]: http://www.forensoftware.de/

Bock auf Moblogging?

Es ist ja bald Weihnachten, und deswegen schenken Alp und ich Euch [mobock][mobock].

[alp]: http://uckan.info/
[mobock]: http://mobock.de/

1. Mach ein Bild mit Deinem Handy oder Deiner Digicam.
2. Sende es per E-Mail an pic@mobock.de
3. Dein Bild erscheint innerhalb von fünf Minuten auf mobock.de.

[Bock auf Moblogging?][mobock]

Secret Tags - An alternative to Captchas?

[11/14/2004] Update: Adam Kalsey has a piece from Sep 2003 that includes more or less what I call Secret Tags. Since it’s from Sep 2003, the credit goes to him, even I discovered his piece just today. Adam, too, says one should alter field names.

And while being there, pay Yoz and Shelley a visit.


Captchas are quite useful to identify real users and bots. While a real user is likely to be able to read and understand the captcha and enter to correct characters into a form field, a bot cannot — at least cannot without logic to read the captcha, understand what it says and enter it into the right field (setting the correct URL parameter, that is). By providing a means to lock out bots, captchas help to decrease the amount of spam or other unsolicited requests to web applications.

But captchas have a few drawbacks. They are rather expensive when it comes to server load as they need to be created on every page view. They can be difficult to read, thus making them unusable for some people. They are intrusive and lessen the user experience.

In social terms, by using captchas a website discriminates the legitimate user, making her justify herself again and again.

Using challange-response sets, captchas try to tell humans from machines. The challenge usually is an image, showing a machine-generated series of characters the user has to enter as the response. The captcha system then compares the challenge to the response. If they match, the turing test is passed.

Using machine-generated challenges makes them harder to guess and easier to maintain on the one hand, and easier to crack on the other. If a programmer knows how the captcha is made, he can easily write a tool to read it and is thus able to answer correctly to all challenges the system might throw at him. A few misses are not important since spammers go for quantity, not quality. While all web applications of a certain kind use the same captcha system — i. e. all phpBB forums, Movable Type or WordPress blogs, … use the same captcha system — by cracking one captcha system we gain access to many websites.

Of course you can write a more creative challenge-response generator, using real questions the user has to answer (C: Where is the city of New York, USA or Canada? R: USA). This can solve the crack-issue, but increases intrusiveness even more.

To make a long story short: captchas can help fight spam, annoy legitimate users and are — more or less — easy to crack, and if once cracked no longer useful.

Secret Tags
For a website where users can enter content, register and comment, I needed a system to hold bots at bay regarding registration and commenting. I did not want to use captchas, reasons see above.

I came up with the following concept, called Secret Tags. On every page view for the registration and comment form, a secret tag is generated. For generating the tag I use a function that returns a eight characters long string consisting of lowercase letters (these are 3*10^23 variantions).

The tag is written in a database table, in my case a MySql heap table, together with a timestamp. Heap tables have the advantage of living completly in RAM, which makes them noticeable faster than usual table types.

When outputting the form, a hidden input field is inserted. Its value equals to the just created Secret Tag.

The form is sent to the client and is returned after some time, including the Secret Tag.

When analysing the returned form data the Secret Tag returned is compared to the Secret Tags in the table. If there is a match, the returned form data comes from a legitimate user and is further processed. The tag is deleted from the table, making it usable only once, and the form data gets processed as it was originally intented.

If the tag returned with the form data is not in the database, or if there is no tag at all, the form data is ignored. Either an error message is shown or the script silently exits.

Secret Tags are timely bound and valid only for a certain period of time, after which they get deleted from the table, making all later requests using these tags render useless.

Using Secret Tags gives users no headache, they don’t even notice them — web browsers return hidden input fields silently and without bugging the user. A bot can easily access ST-protected forms and read them, using them in his request. Granted, this is easier than downloading a picture and running an OCR over it. But basically it’s just the same: download the form and read the challenge.

Absolute protection is nearly impossible, and the more security you want, the less freedom you can provide. Secret Tags perhaps are less secure, but give legitimate users more freedom, blocking most spam bots as captchas do.

Regardless what system you use, there are some tweaks how you can make it even harder for the bots.

  • Alter field names. Maybe even alter them every once in a while, maybe even automated.
  • Alter script names. Maybe even alter them every once in a while.

Quite simple, ain’t it? As mentioned earlier, spam bots go for quantity, not quality. If they can hit some thousend standard blogs/forums, some they do not hit are not important. So even by using less secure, less intrusive Secret Tags you lock out 99% of spam.

USB hats geschafft - Wann kommt Bluetooth?

Ohne USB geht heute nichts mehr, keine Mäuse, Tastaturen, Drucker, Scanner, Digicams, PDA, alle wollen sie per USB verkabelt werden.

Nach einer Volkszählung meines EDV-Zubehörs komme ich auf acht USB-Geräte, nicht eingerechnet den USB-Stick und das externe Diskettenlaufwerk des Notebooks.

Diese Schwemme führt unweigerlich zu Kabelsalat, kommen zu den USB-Kabeln ja oft noch stromführende, von den Audikabeln (1x Line-Out zum Logitech-Soundsystem, 1x Phone zum Mikro, 1x Line-In von der TV-Karte, natürlich plus Stromkabel für den Sound) und diversen anderen Monitorkabeln, Stromkabeln und Verlängerungen garnicht zu sprechen.

Der Trend geht hin zu immer mehr Gadgets — und damit zu immer mehr Kabeln. Es sei denn, man ist bereit, den einen oder anderen Euro zusätzlich zu investieren und auf Bluetooth umzusatteln.

Schaun wir doch mal, ob uns das wirklich helfen würde.

Tastatur, Maus: Mein [Schreibwerkzeug][1] gibts (noch?) nicht in einer Bluetooth-Variante. Die Konkurrenz bietet sowas jedoch schon an, leider nur in Form von Brotkästen oder überteuerten Sondermodellen.

Drucker: Hmm, warum sollte ich schon wieder [einen neuen Drucker][2] kaufen? Außerdem scheint es nur die mobilen Drucker mit Bluetooth zugeben, der Rest möchte verkabelt werden.

Handy und PDA: Da hab ich wohl das falsche Handy [gekauft][3], und auch mein PDA hat ein paar Jahre zuviel auf dem Buckel, um mit BT was anfangen zu können.

Bis auf eine Sony scheint es keine Digicams mit Bluetooth zu geben, man möge mich belehren, sollte ich etwas übersehen haben.

Ein Bluetooth-Stick wäre ganz klar ein nettes Spielzeug, allerdings auch mit noch höherer Verliergefahr. Den USB-Stick *muss* ich in die Handnehmen, der BT-Stick kann ruhig immer in der Jackentasche bleiben. Hmm, wie war das mit Wearables?

Sieht so aus, als ob mir BT (noch) nicht helfen könnte. Klar, wäre ich früher auf den Zug gesprungen, wäre es jetzt einfacher USB den Rücken zu kehren — wenn es auch viele Geräte (noch) nicht in Bluetooth-Ausführungen gibt. An den Desktop als Einsatzgebiet für BT denkt man bei den Hardwareherstellern anscheinend noch nicht. (Oder planen die alle mit WLAN?) Hoffentlich ändert sich das bald, sonst quellen mir die Kabel hinterm Tisch hervor, und das wäre doch ein wirklich häßlicher Anblick ;)

[1]: http://www.itst.org/web/216-schreibwerkzeug.shtml
[2]: http://www.itst.org/web/172-nehm_ich_ihn_oder_nehm.shtml#c000101
[3]: http://www.itst.org/web/266-mitsubishi_m342i.shtml

Änderung der Nutzungsrechte der Inhalte dieser Website/New copyright regulation für WWWorker

Aufgrund aktueller Geschehnisse ändere ich die Nutzungsrechte der Inhalte dieser Website.

[Sie dürfen][de]:

* den Inhalt vervielfätigen, verbreiten und öffentlich aufführen
* Bearbeitungen anfertigen

Zu den folgenden Bedingungen:

**Namensnennung.** Sie müssen den Namen des Autors/Rechtsinhabers nennen.

**Keine kommerzielle Nutzung.** Dieser Inhalt darf nicht für kommerzielle Zwecke verwendet werden.

* Im Falle einer Verbreitung müssen Sie anderen die Lizenzbedingungen, unter die dieser Inhalt fällt, mitteilen.
* Jede dieser Bedingungen kann nach schriftlicher Einwilligung des Rechtsinhabers aufgehoben werden.

Die gesetzlichen Schranken des Urheberrechts bleiben hiervon unberührt.
[(Volltext der Lizenzbestimmungen.)][de-full]

[You are free][en]:

* to copy, distribute, display, and perform the work
* to make derivative works

Under the following conditions:

**Attribution.** You must give the original author credit.

**Noncommercial.** You may not use this work for commercial purposes.

* For any reuse or distribution, you must make clear to others the license terms of this work.
* Any of these conditions can be waived if you get permission from the copyright holder.

Your fair use and other rights are in no way affected by the above.
[(Fulltext of legel code.)][en-full]

[de]: http://creativecommons.org/licenses/by-nc/2.0/deed.de
[en]: http://creativecommons.org/licenses/by-nc/2.0/
[de-full]: http://creativecommons.org/licenses/by-nc/2.0/de/legalcode
[en-full]: http://creativecommons.org/licenses/by-nc/2.0/legalcode