Sad Old NetGoth

oops been test driving a new IM client

Wed, 21 Oct 2009 17:35:21 GMT

and apparently any/all messages for a week have been ignored due to me mis-setting it up

sorry and please re-send

The Six Dumbest Ideas in Computer Security

Thu, 13 Aug 2009 20:06:10 GMT

The Six Dumbest Ideas in Computer Security
so well written and true

Jericho another great series that never finished

Wed, 12 Aug 2009 14:57:28 GMT

just been watching it on sci-fi and can agree its great sci-fi
{ie a study of sociology {human interaction}, politics {corruption and military mindset}
in extrodanary circumstances

pity it was never really finished,
but i guess it dosn't leave too many strands untied,
it just gets to the climactic point,
then leaves the viewer to assume/hope averthing turns out good later.
so no clifhanger as such, but you know the authors coulda got a lot more drama out of the aftermath of the last episode, and youd love to see how the characters develop further

http://www.cbs.com/primetime/jericho/

http://www.tv.com/jericho/show/58068/summary.html

http://en.wikipedia.org/wiki/Jericho_(TV_series)

website designers

Wed, 12 Aug 2009 14:23:45 GMT

I can strongly adveise you add
Google Android Emulator to your arsenal

I does show up some interesting accessability and design flaws with sites {i have found several with my own and am fixin}

such as animated gif's only display as the first frame {so make your first frame the most important one in the sequence}

and many issues with inline frames and scrollable div's {which i am now gonna advise to avoid if at all possible}

{oh btw when it starts it just kinda hangs their able to do nothing, don't worry the phone is just taking forever to boot within the emulator}

For anyone who knows the story of my leaving home

Tue, 16 Jun 2009 22:48:32 GMT

I wonder now how different things would have been if I hadn't put down the sword and left by the window.
At least I wouldn't ever have had to deal with this sort of betrayal

well as the rule is never buy anything from a spammer

Fri, 05 Jun 2009 16:20:40 GMT

jaguarcompsys.ie

is now on my don't buy from them list
as recently the address i gave them for registering on their website
{multiple years ago} has started recieving "monthly offers"
from geraldine@jaguarcompsys.ie

after the 3rd {second one that they mistakenly delivered twice}

I gave her the usual phone call to remind her of the fact that repurposing email addresses this way is
A illegal
B imoral
C will result in no sales to the technically aware

and no i wouldn't give them my name or address {to be removed}
A either remove all {imported from their web registration}
B send a once off "take action to continue recieving, do nothing to be removed" mail
C continue and have me lodge an official complaint to the data-protection commissioner

so what i'm wondering is
anyone else here get these mails? so when they stop spamming me i can check to see they havn't done "D find my address and remove just it/listwash"

weirdly the mails are also illegal because they make no mention ofhow to be removed from the list {but they are typical sent by one person via outlook mass mails}

wow as i typed this i just got another copy of todays {3 total}
and a reworded version of the same

ok thats 4 today so now they get complaints to their downstream {netsource}
and followups to the data-protection commissioner if they don't remove the repurposed address'

{but 1 plus point for her she did have the wit to use bcc: firld so all her contacts don't get one anothers address'}

whee! one more malware outfit dead

Mon, 27 Apr 2009 18:01:07 GMT

http://www.theregister.co.uk/2009/04/21/zango/

now at least all their victims data isn't being read by anyone anymore

photos of the pre-roof extention

Thu, 09 Apr 2009 01:02:13 GMT

photos taken before roof went on

taken by venome_relc on her google-phone ;)

woohoo extention building nearing completion

Tue, 07 Apr 2009 14:10:53 GMT

the walls are done,
the floor joists,
the roof joists
and a little of the felting
so now you can {and are welcome to come round and try/see [after6pm]} stand in the space and get real feel for what it will be like when finished

john younge memorial tree planting on friday

Tue, 24 Feb 2009 16:50:44 GMT

http://sebzy.livejournal.com/10310.html

has all the details

new vulns or ones i havnt seen before

Wed, 18 Feb 2009 12:43:00 GMT

probes tried this month so if you have software that uses these url's there's obviously related exploit code in wild

{obviously trying these {soon} against my servers will result in getting a banned ip}

64.201.189.193 - "GET /hedgehog-cms/ HTTP/1.1" 404 : 404 : 1358 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.201.189.193 - "GET /specialacts.php HTTP/1.1" 404 : 404 : 1358 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.201.189.193 - "GET /config/userconfig.php HTTP/1.1" 404 : 404 : 1358 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
208.68.93.138 - "GET /wp-login.php HTTP/1.1" 200 : 200 : 10171 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
66.187.104.20 - "GET /wp-admin/images/wordpress-logo.png HTTP/1.1" 404 : 404 : 232 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
202.210.181.209 - "GET /webmail/bin/msgimport HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
202.210.181.209 - "GET /roundcube/bin/msgimport HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
202.210.181.209 - "GET /mail/bin/msgimport HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
80.69.74.136 - "GET /twiki/bin/configure?action=image;image=|id|;type=text HTTP/1.0" 404 : 404 : 1358 "-" "DataCha0s/2.0"
84.19.184.49 - "GET /rc/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
84.19.184.49 - "GET /roundcubemail/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
84.19.184.49 - "GET /roundcubemail-0.1/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
84.19.184.49 - "GET /email/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
84.19.184.49 - "GET /js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
84.19.184.49 - "GET /program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
114.141.15.22 - "GET /roundcube//bin/msgimport HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /webmail/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /roundcube/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /rc/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /roundcubemail/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /mail/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /bin/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /roundcubemail-0.1/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /email/program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
217.160.111.160 - "GET /program/js/list.js HTTP/1.1" 404 : 404 : 1358 "-" "Toata dragostea mea pentru diavola"
195.94.0.35 - "GET /vhcs2/ HTTP/1.0" 404 : 404 : 1358 "-" "Wget/1.9+cvs-stable (Red Hat modified)"
218.86.222.90 - "GET /manager/html HTTP/1.1" 404 : 404 : 1358 "-" "Mozilla/3.0 (compatible; Indy Library)"

if your truely bored you can see a list of all the url's that vulnerability scanners have ever tried {and that if tried will result in an immediate barring} here
http://www.alandoherty.net/robots.txt

everything after the first 3 have been spotted in the wild {the first 3 are for site-admins wanting to direct malicious spiders {via hidden links to bot-traps to get them barred and off their sites}

so who has a paid account on here?

Mon, 02 Feb 2009 10:49:03 GMT

i have a favor to ask

any comments screened so volenteers need not reveal their paid status publicly

upate:secured a volenteer now for my testing stuff
may approach some of ye permanent account holders if tests go well

thanks guys

all finally finished

Thu, 29 Jan 2009 10:30:00 GMT

not as good as i'd like
gotta write up some documentation now joy

but now can {and have} finally removed the whitelisting i've had to put up for all those bloody google transcoder users

now they can suffer from it's badly written interface and their disinterest in fixing it
{by banning themselves from the server by clicking oin the {revealed by this agent only} hidden links to bot-traps}
now at least they can un-ban themselves each time they do this

and having the whitelisting removed means that google transcoder cannot be abused with impunity by harvesters/scrapers anymore {for my server at least} now to drop round the forums and let the other httpd admins know we have a solution to the issue that works so they can do the same and be protected from all the abusive users google shields {yes it may be unwitting, it may be unintended, but google IS providing tools to abusers with nill/zero/no regard for the victims, and no responses to people like myself and others in the anti-abuse community who try to alert them to the issues for over 2 years}

ok thats text based captcha wotking now

Thu, 29 Jan 2009 09:13:10 GMT

on all mailforms on the server by clicking on the alternate captcha link or adding ?ct=t to the calling pages link to use by default text ct == captcha type

try it yerselves if bored on http://www.alandoherty.net/

well stage one done!

Thu, 29 Jan 2009 05:52:38 GMT

in fixing everyhing for Satan's own "Google Wireless Transcoder"

problem 1: sites using malicious-spider-detection/blocking hidden links are revealed by GWT so GWT users can accidentally bar themselves

problem 2: GWT dosn't let users see the text of 403 error pages thus users cannot see what/why they were blocked and unblock themselves.

both reported to Google through multiple channels zero response, fixing either would fix entire issue.

to fix their issue I have had to break the golden rule of http-admins everywhere, "serve the same content to all"
yes now the 403 page if it sees the google wireless transcoder it lies and forges a 200 OK header and thus gets shown to the user

now onto stage 2 of fixing the damn thing
{as apparently it doesn't like http://recaptcha.net/ code and refuses to display the captchas or their alternative text links {that work on all text based browsers back to lynx} it just hides all content from them completely, pity as their image captchas {with audio for deaf} are great, and no cookies needed}
so am altering all my mailforms/and un-barr-me pages to offer a "click here for text-based-captcha-only mode" using the fine people at http://textcaptcha.com/ {which hopefully should be implementable without cookies too}}

Dominion: Resurection, We have a new home

Mon, 12 Jan 2009 18:41:03 GMT

well for those not there on the night our trial was a success {despite an unexpected early close that one night}

so the new venue is now our regular venue for weekly club
entry price{s} for {at least*} next week will be back to the usual
€5 before 11pm
€6 after

http://dominion.gothic.ie/

for all news and updates

*we will have to keep price under review depending on numbers it may rise or fall
{but hopefully neither or far}

Dominion: Resurrection

Thu, 08 Jan 2009 21:40:43 GMT

The people who brought you Dominion are very pleased to announce a special night this Saturday 10th January - DOMINION: Resurrection.
The venue is the Cellar in Peadar Kearney's (formerly Rogue), 64 Dame Street, Dublin 2. Entrance is free! Standard times of 9.30 till 2.30.

The venue is a green building near the corner of Sycamore Street, a minute or so past Central Bank.

The DJs will be Conor and Greg, playing their patented mix of goth, industrial, ebm and alternative, with the usual smattering of indie, metal and random stuff we like.

We realise this is very short notice, but we were literally offered the venue today. Initially this is a one-off, but if Saturday goes well there is the likelihood the successor to Dominion will be ensconced there on a WEEKLY regular basis. Hence, if you can possibly come, even for a little while, please do; pass this on to your friends not on this list. The more that turn up early and prove that Dublin deserves a regular weekly goth club the better! And hey, the price is right :)

Hope to see you there,

Team Dominion

further info and updates on
http://dominion.gothic.ie/
http://community.livejournal.com/dominion_ie/tag/resurrection

newest entry in the spam hall of shame

Mon, 08 Dec 2008 13:13:26 GMT

irishjobs.ie

most of you know that i give all corporate entities/webforms etc tagged e-mail addresses ony
{ie they are the only ones given the address that exists and is recordered nowhere else}

so i can {if future spam arrives} easily trace the leak/source

irishjobs.ie were given such a tagged address in 2004
first e-mail arrived 10 Aug 2004 02:16:11 and continued daily till Fri, 17 Sep 2004 01:26:00 +0100 when i unsubscribed from their job-alert service
{all e-mails from their own systems}

then they re-used the address in a please come back type mail on Thu, 21 Aug 2008 12:37:52 +0200 (CEST)
{sent from some french mail outsourcing group called cccampaigns.net EMV-CampagneId: 1100610050$ EMV-MemberId: 1001770774187$ all links pointed at emv3.com}

ten they re-used the address in to advertise online training courses Wed, 17 Sep 2008 03:16:00 +0200 (CEST)
sent from same french mail outsourcing group called cccampaigns.net EMV-CampagneId: 1100725037$
X-EMV-MemberId: 1001770774187$ all links pointed at emv3.com}

all the above sent with subject referancing irishjobs.ie

then the today the spam arrives, interestinly from france telecom dialup thus i'm guessing an emv3.com employee selling mailinglists to spammers rather than irishjobs themselves, but nonetheless irishjobs.ie chose to share my details with this company {against my wishes as it had been years since i subscribed to their services, and now this 3rd party that they shared my details with, is apparently selling them to others
obvious spam below

Return-path: <aanddn@jadetech.com>
Envelope-to: {removed}
Delivery-date: Mon, 08 Dec 2008 11:30:57 +0000
Received: from smtp27.orange.fr ([80.12.242.96])
by bigsvr.alandoherty.net with esmtp (Exim 4.69)
(envelope-from <aanddn@jadetech.com>)
id 1L9eJr-00035Q-Kh
for {removed}; Mon, 08 Dec 2008 11:30:57 +0000
Received: from me-wanadoo.net (localhost [127.0.0.1])
by mwinf2716.orange.fr (SMTP Server) with ESMTP id 172991C000A6;
Mon, 8 Dec 2008 12:30:09 +0100 (CET)
Received: from SERVEURFORGET (LRouen-152-83-37-42.w80-13.abo.wanadoo.fr [80.13.244.42])
by mwinf2716.orange.fr (SMTP Server) with SMTP id B8AD01C0009F;
Mon, 8 Dec 2008 12:30:08 +0100 (CET)
X-AD-RPFS-HEAD: for info on below codes http://www.alandoherty.net/mailsystem/mail-tagging/
X-AD-RPFS-WARN-0: ES-SPF-HARDFAIL
X-AD-RPFS-DUMB-1: SA-SCORE-3.6 SA-BAR-(+++)
X-AD-RPFS-DUMB-0: HELO-SPF-NONE HELO-CSA-NONE
X-AD-RPFS-INFO-0: IP-CC-FR IP-DNS-WL-DNSWL.ORG-0 "orange.fr http://www.dnswl.org/search.pl?s=4924"
X-AD-RPFS-GOOD-0: HELO-DNS-PERFECT IP=80.12.242.96 HELO=FQDNS=smtp27.orange.fr AV-SCAN-PASS
X-ME-UUID: 20081208113008756.B8AD01C0009F@mwinf2716.orange.fr
Message-ID: <000201c9598c$c8ffbdc8$1dae53cd@qhwp>
From: "Al N" <aanddn@jadetech.com>
To: {removed}
Subject: I know YOU are out there!
Date: Mon, 8 Dec 2008 12:30:05 +0100
MIME-Version: 1.0
Content-Type: text/plain;
charset="windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4522.1200
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200
X-VIRUS: NONE {no virus found, This is no guarentee}
X-SPAM-SCORE: 3.6 (+++)

Aloha, my friend

Hope springs eternal in the human breast...
I am warm-hearted, good, listener, and friendly, sincere,
balanced, tidy, romantic, sexy, and sensitive, with sense of humour,
intelligent person. I like go to nature (sea, forest), theatre,
exhibitions, museums, cinema. I like to create home cosiness. I am
looking for intelligent, optimistic, with sense of humour, reliable,
tidy, kind and sincere man. I hope to meet my second half with mutual
love, passion, wonderful, understanding without words, caring. I want to
make happy my future partner. I would like to give him all my saved
tenderness, care and love. Smile from you will make me
happy www.mylovewon.net/happy/

Warm hugs
Lyna

probably an attempt to confirm the address or spread malware via the website or just to promote hits to the website/needless to say i'm not checking to see

why auto-replies are bad illustrated

Mon, 03 Nov 2008 09:10:53 GMT

classic fail!!

http://news.bbc.co.uk/1/hi/wales/7702913.stm

it seems google is becoming the next microsoft

Thu, 30 Oct 2008 12:58:16 GMT

adopting the familiar mantra
"embrace, extend, extinguish"

by creating a new federated login system, then misleadingly naming it OpenID and claiming it is the well known and usefull existing standard {even though it is entirely NOT OpenID}

http://neosmart.net/blog/2008/google-doesnt-use-openid/

like so many others it is offering to provide ID but not interoperate with other providers
{but worse than M$ yahoo etc who provide-only {no one needs new providers}, they also don't even provide an ID system that is compatable with OpenID sites}

I like OpenID for its intended use, that i can use 1/any provider {of my choice} to control my identity verification to/on multiple websites.

the concept is if Im trusting of livejournal/M$/yahoo whoever i use them as my provider
if i'm a little more paranoid i use a provider that requires me to use a crypro-card/sms/s-key/or some other heavily secure metod of authentication. or even brew/run my own OpenID provider on my own server.

all OpenID providers are supposed to be equal/compatable with all OpenID enabled sites, unfortunatly this move by google throws a total spanner in the works

{additionally using a gmail address as an ID means you HAVE to submit your e-mail to untrusted third parties as part of their login process, DUMB MOVE for those of us who don't like feeding spammers new addresses to sell {as many 'free' sites sell e-mail addresses as part of their 'buisness plan'}}

that was the beauty of openid it used a URI/URL to id a user, usually one that could be followed if contact with the owner was needed {ie your website/blog/whatever } but this way the contact details offered/withheld on the openid url were entirely at the discresion of the openid user

test entry please ignore

Sun, 19 Oct 2008 19:01:52 GMT

test entry please ignore

2x bigger through html scaleing

original image no scaleing

test of same image 2x smaller through just html scaleing

test of same image 10x smaller through just html scaleing

end of test entry

found a very usefull diagnosic tool

Tue, 16 Sep 2008 12:39:20 GMT

though it may prove to be not will test it against the next known to be trojaned pc to come in

http://www.mynetwatchman.com/tools/sc/

another trusted site that would have infected you businessweek.com

Tue, 16 Sep 2008 02:20:47 GMT

http://www.theregister.co.uk/2008/09/16/businessweek_hacked/

interesting info about bin laden

Mon, 15 Sep 2008 23:47:42 GMT

http://en.wikinews.org/wiki/Wikileaks_obtains_10_years_of_messages,_interviews_from_Osama_bin_Laden_translated_by_CIA

best not to use chrome ATM

Wed, 03 Sep 2008 21:31:41 GMT

as currently its uela is beond a little flawed

http://www.theregister.co.uk/2008/09/03/google_chrome_eula_sucks/

though even though its going to be a hog on resources, i can see the different process per tab is good
though think we need a better way to protect against XSS attacks