Safe as Milk

Spam stuff

The most interesting thing for me of the responses I’ve gotten to the “I am a false positive” blog entry I wrote earlier is the defense of the blacklist system by a number of people.

It seems the theory goes “your ISP is doing bad stuff that’s hurting the internet. We’re only hurting you so that you can make them stop.” That might be “not doing good stuff to help the internet” instead of actively being bad, but you get the point.

But this is a hugely flawed logic. It’s the same logic that says that economic sanctions work because the people actually affected by the sanctions, that is, the less well off, will rise up and force their government, who aren’t affected by the sanctions, to change their ways. Blocking France doesn’t hurt spammers – they have lots of zombie PCs – it hurts me.

There are lots of ways to avoid false positives – greylisting, temporary blacklists based on who is actually sending out spam, bayesian filters like bogofilter, and so on. A case study in spam filtering without blocking real mail is here – this guy gets a million spams a day, and filters 99.999% of them automatically. Now if only everyone did this at the mail server level, I could pretend like spam didn’t exist and get on with my life.

In his Hall of Shame, he includes DNS-RBLs, and has this to say about them:

Well, I don’t know why, but in practice every single DNS-RBL eventually comes under the control of power-hungry weenies. They start listing sites unreliably, and if you complain you find yourself listed. And there’s usually no way to get off the list.
…
If the lists you use have not yet descended into corruption and chaos, consider yourself temporarily lucky.

Do not use DNS-RBLs.

My life as a false positive

I feel a rant coming on.

More and more these days the email I send is bouncing back from third-party blacklist sites. Paul Graham has written about why blacklist based filters were so bad.

I am subscribed to one of the biggest ISPs in France (free.fr) at home. At work, my company is subscribed to the biggest ISP in France, Orange, formerly Wanadoo. I do not send spam from either work or home.

And yet, when I send mail to some people, it will come back with “Undelivered mail returned to sender”, with the painful message “550 receiving service provider policy blocks mail from dneary@xxxxx” in the reply.

This has happened to me so often, with so many people, that I really can’t quantify how much damage has been done. The worst part is, since email is pretty much the only way I have to communicate to these people, I can’t even let them know that they can’t receive my mail.

I have recently found out that one person I was trying to mail was behind a blacklist which was banning all email from France. That’s right, and entire country. That is antisocial behaviour of the highest order.

So, as an innocent victim in the (cue dramatic music) War on Spam, what can I do? Change ISPs? Raise my hand and say “Not I” to the blacklisters every time I get one of these? Complain to my ISPs that they aren’t doing enough to be part of the Coalition for a Spamless Web? Move out of France?

Joshorn

So Jono got shaved at LRL – and now he needs a new hackergochi.

Before the shaving, I was anticipating the event, and with my reknowned GIMP skillz, decided to see what he’d look like afterwards. So now I give you the Jono shaved hackergochi.

Oracle to ship RedHat?

There’s an interesting article on ZDNet about comments from Larry Ellison that Oracle should be shipping “a full stack of software” to customers.

What’s most surprising about this is that it’s news.

HP already ships a choice of full stacks of software which are certified for their servers (and laptops). Nokia ships a full stack of software which is taylor-made for the 770. OLPC will be shipping a full custom-tailored stack of software on their laptops.

A common usecase for Oracle customers is to have one server doing nothing but serving a database. Doesn’t it make sense for Oracle to do the tuning work and make sure that the system is optimised for that usecase, and then ship a fully functional system to their clients?

In addition, your clients suddenly no longer have to ask themselves what distribution is best for their Oracle database server – the answLiveCDs for everything and anything and VMWare and Xen appliances?

Free software gives you the freedom to take and adapt software to your needs, and also to the needs of your clients. The only real question is what took them so long?

Hands up…

…anyone who has ever been confronted with “budget chicken” at work.

/me raises hand.

Nous sommes dans le caca

Wow. Just saw hub’s blog. What a way to start the weekend.

The French executive, legislature and courts have combined to produce a law that wipes out vast chunks of fair use law in the state, and which has previsions to put people who try to get around DRM in jail. For years. No exceptions.

Maybe it’s not too late to move…

GNOME Foundation membership

At the foundation general meeting during GUADEC, a person who shall remain anonymous asked the question “why should I get foundation membership? What does it enable me to do that I can’t do already?”

Membership of the foundation is an odd thing. It doesn’t really give you the right to do anything new except participate in foundation-list and vote in foundation elections. Since foundation-list is a list to talk about stuff related to the foundation, if you’re not a member you’re probably not interested anyway.

But foundation membership means something more than that to some people. I happened on this blog entry today, and I was moved. Honestly, tears welling up moved.

The one of the most awaited things in my life.. Its a really dream come true.. On the may 3rd morning, i got a confirmation mail from gnome.org that i have been added to members list. I just pinched myself to check whether it was real. It was.. I was overflowing with happiness.

Being a GNOME Foundation member for someone outside of the community is another way of saying “Come in! Make yourself at home.” For lots of people in this community, they don’t know how much other people appreciate their work.

The first time you feel appreciated is a special moment. It might be when you get a mail saying “I’m spending too much time checking in your great patches, it’s time we got you CVS access”, or it might be having someone you admire in the community saying “Wow! You’re the guy doing jhautobuild! You rock!”.

Or it might be “We are pleased to inform you that you are now part of the GNOME Foundation Membership”.

XCF update

After the small flurry of controversy last month about the GIMP’s XCF format, Henning Makhomlm (author of the excellent XCF tools) stepped up to the plate and wrote a complete spec for the XCF format.

It’s still a draft, awaiting feedback from any interested GIMP developers, but I have the feeling that no-one understands the format better than Henning, and this is already vastly better than what went before.

Every time a community member goes above & beyond like this, I really am amazed. This is a huge amount of work, and really well done.

What’s the number?

I’ve seen these before, but this page is making me lose more time than I can afford to. Although I just about hit my boredom limit last night – I’ll let others lose time figuring out what the trick is.

Getting up and running with a CRM

We have lots of contacts we need to organise – friends of GNOME, journalists, distributions, user groups, governments, deployments, ISDs, ourselves, and people whose paths we cross from time to time – people from other projects, or employees of big GNOME users, or previous keynote invitees.

I’ve worked out the main usecases for a CRM system for GNOME – using it for anything outside this would be excessive.

• Adding a new CRM administrator or user
• Importing an address-book, and filtering GNOME contacts from non-GNOME contacts
• Adding a new contact
• Associating a new event (IM conversation or mail) with a contact
• Receiving a notification when a contact you’re related to has some new content added (being able to watch people or groups of people)
• Associate people with events (centralise information about user-group participation in events)

There may be others I haven’t thought of – that’s what blog comments are for 😉

So far, the feedback I’ve received says “don’t use SugarCRM if you value your sanity, CiviCRM is where it’s at”. As a non-connaisseur, I’m going to probably take that advice, unless there are othr recommendations that people might have that I should consider.

I would love something which had a possibility to integrate with desktop apps (mail, contacts, IM) via a web service API, but that’s not a requirement.

A problem I’ve thought a bit about is what the default level of visibility for a non-privileged user should be. I would like to have 3 levels of security – anonymous users see some stuff (names & events, but not email addresses, for example), authentified users can add contacts and events, and see everything, and administrators can add new users. Anything more than that seems overly complex.

Anyone have experiences with CiviCRM – or anything else – which they’d like to share? Is there anything we’d like to do which isn’t available?