Paul's Down-Home Page

I leveraged McDonald’s wireless service when I was in rural Louisiana, but it looks like I’ll have a tougher time getting connected while I’m at Sturgis. The nearest McD locations to Hill City, where we’re staying, are in Rapid City, and none have Wi-Fi. Verizon’s coverage map shows no coverage for Hill City, although the surrounding areas have digital service– hopefully I’ll be able to use my aircard. There’s a local ISP, RapidNet, that may be able to help, too.

Interesting press release this morning from Blue Security, touting their new “Do Not Intrude Registry”. The basic concept is simple: you sign up for their service and install an agent on your local computer. Blue creates honeypot mailboxes, which it then monitors. If spammers spam those mailboxes with messages that don’t comply with the CAN-SPAM law, Blue asks the spammers to stop. If they don’t, the Blue agent (which they call a Blue Frog, after the blue poison arrow frog) starts spamming the spammers by posting junk data to their order form. This is no big deal if only one agent does it– but the agents are cooperative, so if the spammer sends out 10,000 messages, they get 10,000 junk order submissions.

The PR calls this “ethical and effective”. I disagree on both counts; it’s nothing more than a botnet in disguise. If it’s wrong for J. Random Attacker to mount a DDoS against a website they don’t like, it’s wrong for Blue to mount DDoSes against spammers. Despite the fancy language deployed by Blue’s CEO in this InformationWeek article, it’s pretty clear that this is a clear-cut DDoS approach– Blue is trying to hit the spammers where it hurts by degrading their operational capacity to take orders.

I don’t condone spammers, but descending to their level isn’t an ethical approach. In a remarkable coincidence, most of the sentiment on /. seems to agree that this is a bad idea.

Update: but don’t take my word for it; legendary guru John Levine has weighed in with his thoughts (including the interesting fact that Blue tried to get sponsorship from a number of anti-spam orgs, all of whom rejected the idea).

I missed this in all the hubbub here at el rancho, but Alexander Nikolayev posted a terrific treatment of the Exchange 2003 SP2 anti-spam process at the Exchange team blog. He covers how the new SPF/Sender ID filtering process works in conjunction with the existing filtering features. Exchange 2003 SP2 is the only spam filter that Microsoft’s using for their 90,000+ worldwide mailboxes; I think that’s a pretty strong endorsement of its capabilities.

Just got the press release: Microsoft is buying FrontBridge, a hosted message hygiene service provider. This is primarily interesting because of FrontBridge’s strength in compliance solutions; they have a broad range of services built around compliance for email and IM. Their hosted anti-spam services got good props from eWeek, but I think the combination of their data centers (which promise a 99.999% uptime SLA) and their compliance services opens the door for MS to diversify beyond Windows OneCare into a broader scope of direct service provision. I can’t wait to see what part they play in the promised Exchange 12 updates for better compliance and message hygiene.

Unless you read the “Book of SP1” very closely, you might have missed out on the fact that Windows 2003 SP1 enables auditing of metabase object access. The IIS documentation for the feature is of little help, since it’s missing some steps. This can be very handy for Exchange administrators, given how much heavy lifting the IIS core components do. IIS MVP Ken Schaefer has written a simple explanation of how to configure metabase auditing here.

Here’s an interesting development: IBM made a Notes-related acquisition, buying PureEdge. PureEdge makes a set of XML-based forms tools– not too dissimilar from another familiar XML tool, InfoPath. Could it be that IBM is feeling the pain of having a relatively poor XML story in Notes and Domino? Are they trying to play catch-up? Maybe.

Microsoft is widely reported to be preparing a server-based version of InfoPath, which would give them a pretty complete story for form management on the client, the server, and the back-end (via WSS, SPS, and BizTalk). Looks like form-based application development will become another front in the IBM-MS platform battle. I’ll be interested to see how (or if) IBM integrates the new solutions into its products; clearly it’s too late for Domino 7.x, so I’d expect these to be part of a future Workplace technology release in some form.

Ever get tired of trying to explain (or, worse, remember) the difference? Check these handy diagrams: RAID-10 and RAID-0+1.

Update: edited to fix a bad link for the first diagram (thanks, Devin!)