Lukey wrote:

Hi Jonathan,

Was nice to meet yourself, Brett, Peter and Jurgen the other evening. I had a good time and was prompted to try out ubuntu - splendid distro, excellent hardware detection & setup, great in everyway - as long as you like GNOME !!!

It is very GNOME-centric and I've been spoilt by kde a bit. Call me shallow if you want.

Look forward to our next meeting - hope more of you can make it next time, Luke.

Welcome to the group Luke. I suspect Ubuntu, being debian based, has problems with the QT licence (KDE is written using the QT widget set). There is no reason why you cannot download a kde binary, in deb, rpm or tgz format, and install kde.

Ian

Brett Parker wrote:

KDE and family are now under dual licences, the TrollTech licence and the GPL, there are packages for KDE in debian (certainly testing and unstable, I can't remember if they made it in to woody before that was released, I could check, but that's far too much like hard work).

Yep, there's KDE in Woody. can't remember the version, but it was before they started to get into eye-candy big time ;)

(I must remember to change my .sig sometime)

--------------------------------

I'm getting pissed for xmas, just like the rest of the year, There's no future in this world of ours, so I might as well have a beer.

On 2005.01.17 19:46, Lukey wrote:

I had a good time and was prompted to try out ubuntu - splendid distro, excellent hardware detection & setup, great in everyway - as long as you like GNOME !!!

It is very GNOME-centric and I've been spoilt by kde a bit. Call me shallow if you want.

Welcome Lukey.

I installed Ubuntu a few months ago as a trial, I normally use Debian, and that install included KDE so Ubuntu must have KDE packages on their lists somewhere. Sorry can't remember exactly what I did but it can't have been difficult.

Barry Samuels http://www.beenthere-donethat.org.uk The Unofficial Guide to Great Britain

On Thu, Jan 27, 2005 at 09:51:06AM +0000, Luke Russell Anderson BSc. Hons wrote:

Hi,

Thanks to brett, jonathon and jurgen for expounding their method for countering spammers which I will recount here for those that were not present or do not know it.

First get a domain name (ukreg.com do cheap ones w/ free mail forwarding) called www.mydomain.com, and setting up mail forwarding on the domain such that mail sent to anything@mydomain.com will be sent to your private mailbox.

Then, when you are giving your email address to a company or submit it to a mailing list, simply state it is companyOrMailingListName@yourdomain.com. Jurgen gave the example of giving ones e-mail address to Canon Cameras where you would give them canon@yourdomain.com. The idea being that you can identify which company has sold your e-mail address, and/or block e-mail based on the "To:" Field.

One question though, how can you counter those who send e-mails out to you via the "bcc:" field?

If you're a very lucky bunny, that address will be in the X-Envelope-To header, otherwise you need to treck through the Recieved headers and look for which address it was sent to.

Thanks,

On Saturday 29 January 2005 10:57 am, Tim Green wrote:

There is flaw in this scheme - what if you want to continue receiving email on that address? Spammers find your email address in the ALUG archive, you block it, then you never receive another ALUG email again.

It is useful to use different email addresses for different websites to help notice which ones leak to spammers, but you're still going to need a good filter.

Yes this is very true, I do it out of interest and so that I can answer the "how the hell did they get my address" question. But it only has a very small value when it comes to actually blocking spam. You could of course write some new spamassassin rules to add weighting to addresses that have been 'leaked' (or do any of the popular mail filters take the To: header in to account when training ?)

One side effect is that spammers seem to have clicked on to the catchall domain idea and (at least on my work email domain) I now get spam addressed to random_string@domain.com or common_name@domain.com. So having a catchall domain can actually increase the volume of spam you receive.

At home the only spam I seem to get is addressed to my email address as harvested from the Alug archives, but this is super minimal (say 3 a week, sometimes little periods of more). This is unavoidable if we want the archives to be unmolested and publicly available as has been discussed before.

On Mon, 2005-01-31 at 10:18 +0000, Mark Rogers wrote:

...

companyOrMailingListName@yourdomain.com.

I actually recommended yourusername-companyOrMailingListName@yourdomain. Like Wayne mentioned, spammers often try dictionary attacks to your mta, and if you accept anything@yourdomain, you can't easily block those. If you use a static prefix, you can filter all the others out at the SMTP conversation stage.

Has anyone actually found any vaguely reputable website or mailing list that has sold an address on?

Canon UK has sold/leaked my email address, as has cec.co.uk; now it appears to be exclusively used by spammers. Even if Canon did send some legitimate mail, I no longer care if I get it; it's probably only marketing material anyway.

Hint to Canon: if you better protected your customer's privacy, you might improve your customer's willingness to receive your emails.

The difficulty in using the suggested strategy is taht when you return to the site later (eg to buy add-ons for your Canon camera) you have to remember which email address you sued when you first visited. I find that near impossible given the number of sites I work with.

I tend to use the domain name, minus .com/.co.uk, that makes things easy to remember. Of course that does mean people can easily guess and forge.

If the pain has some gain, of-course, that would make sense. But does it?

The nice thing is that it provides a really cheap filtering method; email to such address gets discarded at the smtp conversation stage, (postfix smtpd_recipient_restrictions) before incurring the cost of running my spam content filters.

This method also makes it trivial to filter mailing list email into separate folders, rather then scanning for headers, which might change if the provider changes mailing list software. This does mean that if you get spam sent directly to you, and it evades your spam filtering, it may end up in your mailing list folder, even though it wasn't sent to the mailing list. That's happened a couple of times with my alug address.

It also provides some protection against phishing: if I get email from "my bank", and it it's not to myusername-mybank@mydomain, I know for sure it's yet another phishing attempt.

Hint to online banks/services: If you allowed your customers to register a pgp key and send/receive signed/encrypted email, they would be less likely to fall victim to fraud.

[It goes without saying, I hope, that anywhere that is publically archived should be treated with more caution. Mailing lists, news groups, contact addresses on websites (unless spam-blocked in some way), etc.]

Public bug databases for open source projects also appear to be harvested for addresses a lot. So if I contribute to a bug, I might allow those emails through for a while, then go back to discarding them.

I've been using this method for a couple of years now, and it hasn't been too much of a bother. Previously I experimented with time-limited and challenge-response mechanisms (like http://tmda.net/), and found that too much of a pain (it failed the Mum test).

I did once run into a bit of hassle: I sent mail to letterland.com, and before they were prepared to answer the issues I raised, they started getting all defensive about my use of their copyright/trademark in my email address, apparently thinking that I was somehow trying to impersonate them or whatever. So I had to educate them. :)

All in all, I find it a useful tool.

-- Martijn

On Monday 31 January 2005 12:26 pm, Chris Green wrote:

To be honest the amount of junk mail I get is not so enormous that it's worth huge efforts to get rid of it. I do filter a bit using procmail. I have a couole of explicitly blacklisted addresses, I split out all my mailing list mail and then I mark anything not explicitly To: or Cc: me as junk, I just glance through the subjects hitting 'd' as I go. Using mutt makes deleting mail fast and easy.

Another thing worth mentioning is that a lot of spammers are only in the business of collecting/buying/selling harvested addresses.

These people will generally obtain a list of "unverified" addresses (i.e. ones that may or may not lead to a dead/forgotten account) and turn them into verified ones (i.e. ones where there is a reasonable chance of a human reading them)

The verified address lists are worth £££ on the spam market, this is why it is always a bad idea to follow unsubscribe links on spam, you prove that the address is valid.

However consider that an out of office autoreply that goes to a valid reply address (quite rare with spam but it does happen) or a broken mail client that can follow links to external images etc also essentially proves that the address is valid and mail sent to it is being read. In theory at least those things can get your address from the "unverified" lists to the "verified" ones and trust me that's a place you don't want to be.

On Monday 31 January 2005 10:18 am, Mark Rogers wrote:

Has anyone actually found any vaguely reputable website or mailing list that has sold an address on?

Not really, well at least not since I started doing the catchall domain thing.

In order of the amount of spam they created here are the actions that did result in me getting spam.

Accidental posting to a newsgroup using my real email address, I did this once in a spate of drunkeness. Literally within a few weeks my spam intake went from nil to about 100 messages a week.....nasty but fortunately it was with an old (now discarded) BT Internet address.

A funny thing with BT Internet where I believe they were unintentionally leaking addresses. Whether it was an intentional leak or not I created a new mailbox as a test (called foofoo@btinternet.com I seem to remember) did nothing with it, gave the address to nobody and yet within a month or so it was getting spam. I sent the results of my tests to BT technical support but got the usual response I'd expect....none at all

Use of my email address on mailto: links on various websites, I don't do that much anymore (and if I did I would use some scripting to hide the address from harvesters now)

Some so called friend sending me one of those online greetings cards, resulted in a works email address going from nill spam to about 50 a week

All of these things are a bit coincidental so take the results with a pinch of salt. Now I get hardly any spam to my home address and half a ton a day to the work one (which is registered with all sorts of suppliers and customers so I have no idea how it got picked up)

Wayne