Just wanted to let everyone know about a great site for getting answers to your technical questions... http://itknowledgeexchange.techtarget.com
Great site for researching issues already solved or throwing new questions out there! Not as limited as some of the other sites out there as well..
Tuesday, August 24, 2010
Tuesday, July 27, 2010
Email SPAM prevention
So we all know there are plenty of products out there that are designed to fight SPAM. Most of them use some sort of algorithm to detect "spammy" emails, or block senders by email address, domain, or IP. Many of the web-based email providers also offer basic SPAM protection with your account.
None of the methods employed by any anti-spam product, however, is perfect. They all seem to have some amount of false-positives (valid email classified as spam), they don't catch 100% of spam, and are usually late to pick up on new attack vectors.
I have a new idea in SPAM prevention. It may not be revolutionary, it may not sound pretty, and it's surely not perfect. It is, however, simple - and may just work better than most methods out there. Why not have an email PIN - a number of your choosing that MUST be in the Subject line of any emails sent to you. For example, instead of the Subject being "Hello, how are you?", it would have to be "Hello, how are you? *6738*". If that *6738* isn't there, the email is automatically put in a Junk folder, or simply deleted/bounced back to the sender. All you need to do is give your PIN to anyone who you want to receive email from. Now you know that if you receive an email, the sender must know you, and either had contact with you or saw your PIN on your business card or website, etc. Why wouldn't spammers be able to just scan your website for your email address and PIN? Simple - it would be too complicated to track down your PIN along with your email address, because you could disguise it in many ways, and place it away from your email address. It would be easy enough, however, for legitimate human customers to find it.
Nobody would ever be able to guess your PIN - there would just be too many combinations, and they'd have to send one email after another just to find out if it was correct. Afraid a spammer got your PIN? Change it.
How would websites that you register with be able to send you email? Easy - they'll put another field on their form for your email PIN. They'd then include it with any emails they send you. Now you know that email you received from some website isn't just SPAM, because you must have filled out a form on that website. (Okay realistically, sites could still sell your PIN along with your email address when they sell or rent mailing lists, but there's probably some way around this too - how about a "disposable" PIN you can use just for one website - then if some company in a different domain emails you with that PIN, it won't be recognized!)
This could be easily implemented in just about any email system. In fact you could do it right now in any system that allows some type of mail rules or filtering based on the Subject line. Just create a rule that basically says "Don't allow any mail unless it has *1234* in the Subject line", where 1234 is your PIN. The asterisks around the number are just to ensure that other numbers in the subject line aren't mistaken for the PIN. It's really optional, as of course there is no standard (yet) and this is totally customizable. Of course right now this would only work if it's a human emailing you, and you tell them they have to include *1234* in the Subject line. But if this were widely adopted, that would quickly change.
What do you think? Comments/questions? Improvements?
None of the methods employed by any anti-spam product, however, is perfect. They all seem to have some amount of false-positives (valid email classified as spam), they don't catch 100% of spam, and are usually late to pick up on new attack vectors.
I have a new idea in SPAM prevention. It may not be revolutionary, it may not sound pretty, and it's surely not perfect. It is, however, simple - and may just work better than most methods out there. Why not have an email PIN - a number of your choosing that MUST be in the Subject line of any emails sent to you. For example, instead of the Subject being "Hello, how are you?", it would have to be "Hello, how are you? *6738*". If that *6738* isn't there, the email is automatically put in a Junk folder, or simply deleted/bounced back to the sender. All you need to do is give your PIN to anyone who you want to receive email from. Now you know that if you receive an email, the sender must know you, and either had contact with you or saw your PIN on your business card or website, etc. Why wouldn't spammers be able to just scan your website for your email address and PIN? Simple - it would be too complicated to track down your PIN along with your email address, because you could disguise it in many ways, and place it away from your email address. It would be easy enough, however, for legitimate human customers to find it.
Nobody would ever be able to guess your PIN - there would just be too many combinations, and they'd have to send one email after another just to find out if it was correct. Afraid a spammer got your PIN? Change it.
How would websites that you register with be able to send you email? Easy - they'll put another field on their form for your email PIN. They'd then include it with any emails they send you. Now you know that email you received from some website isn't just SPAM, because you must have filled out a form on that website. (Okay realistically, sites could still sell your PIN along with your email address when they sell or rent mailing lists, but there's probably some way around this too - how about a "disposable" PIN you can use just for one website - then if some company in a different domain emails you with that PIN, it won't be recognized!)
This could be easily implemented in just about any email system. In fact you could do it right now in any system that allows some type of mail rules or filtering based on the Subject line. Just create a rule that basically says "Don't allow any mail unless it has *1234* in the Subject line", where 1234 is your PIN. The asterisks around the number are just to ensure that other numbers in the subject line aren't mistaken for the PIN. It's really optional, as of course there is no standard (yet) and this is totally customizable. Of course right now this would only work if it's a human emailing you, and you tell them they have to include *1234* in the Subject line. But if this were widely adopted, that would quickly change.
What do you think? Comments/questions? Improvements?
Thursday, October 22, 2009
Mail Rules Not Working
A client had an issue where one or two of his mail rules in Notes 8.5 (Notes 8 template, Domino 8.0.1 server) stopped working. He played around several times with disabling rules, deleting them, etc. We even disabled & deleted all his rules, ran some script to recompile his rules, and I even deleted the calendar profile. When he re-created 2 of the rules, still no luck. Then I looked more closely at the 2 rules he had re-created. To my surprise, the OrderNum fields of the 2 rules were numbered "1" and "3"....but no "2". On a whim, I decided to use my "Edit Any Field" SmartIcon to change that "3" to a "2". Surprise, surprise: after that, the rules worked fine! I'm not sure if Notes was seeing a rule numbered "2" that was disabled, and therefore was not applying the other rules, or what. All I know is it seems to be fixed!
Wednesday, May 27, 2009
Single sign-on error with Lotus Sametime 8.0.2 Standard client
At my workplace, we recently deployed the Sametime 8.0.2 client throughout our company and had several instances of the following issue:
(Text reads: Single sign-on account is invalid, the possible reason is your operating system account has been changed. You can try to recover your operating system's password to the old one, or inform the administrator.)
After seeing this error, the Login button stays grayed out, and normally we have to kill the process (if ST doesn't crash). Well I contacted Lotus support and finally got the following resolution:
The Sametime UIM client stores the hashed Sametime password in the following keystore file;
\Application Data\Lotus\Sametime\.metadata\.plugins\com.ibm.rcp.security.auth\.keystore.jks.J9
Can you please delete or remove the keystore file, restart the client and save the password/auto-login options. Please let me know if this does not resolve your issue.
This seems to have resolved the issue. I'm still waiting to hear back from support to see why this happens and if there's a way to resolve it.
(We also saw this issue at one site where ST 8.0.2 was installed, working ok, and then due to a transition project the domains of the PCs were changed, which caused the error to come up again. By the way, we don't use single sign-on, so not really sure where the error is coming from!)
(Text reads: Single sign-on account is invalid, the possible reason is your operating system account has been changed. You can try to recover your operating system's password to the old one, or inform the administrator.)
After seeing this error, the Login button stays grayed out, and normally we have to kill the process (if ST doesn't crash). Well I contacted Lotus support and finally got the following resolution:
The Sametime UIM client stores the hashed Sametime password in the following keystore file;
Can you please delete or remove the keystore file, restart the client and save the password/auto-login options. Please let me know if this does not resolve your issue.
This seems to have resolved the issue. I'm still waiting to hear back from support to see why this happens and if there's a way to resolve it.
(We also saw this issue at one site where ST 8.0.2 was installed, working ok, and then due to a transition project the domains of the PCs were changed, which caused the error to come up again. By the way, we don't use single sign-on, so not really sure where the error is coming from!)
Thursday, April 23, 2009
Tractor-trailers on parkways
So this isn't on the topic of technology, but just something that annoys me. I am sitting on the on-ramp to the Saw Mill River Parkway southbound in Mt. Kisco, NY, and what do I see coming up the right-hand lane? A tractor-trailer. Keep in mind, this road explicitly forbids COMMERCIAL VEHICLES ("Passenger cars only" is the rule). So I wait for the truck to pass and merge on to the parkway. A state road service vehicle pulls up next to the truck and motions for the truck driver to follow him and has him pull over at the next exit.
We have several incidents every year where tractor-trailers get on these parkways (many times per their GPS unit) and then end up hitting an overpass that their vehicle was too tall for, and causing all sorts of trouble. One truck a few weeks ago actually hit an overpass, which tore off the top of his trailer, then continued driving 8 miles or so until he jack-knifed going around a curve, destroying the guardrail in the process and closing all lanes of the parkway for several hours.
What I don't understand is why some national news channel doesn't grab these stories and put them out there so that truck drivers around the country can be warned about where they shouldn't be driving. That would be the easiest & fastest way to disseminate this information and hopefully avoid a few accidents. There's other options such as: better signage, better training, placing height bars at on-ramps, etc....but just getting the information out into the public domain would probably help.
We have several incidents every year where tractor-trailers get on these parkways (many times per their GPS unit) and then end up hitting an overpass that their vehicle was too tall for, and causing all sorts of trouble. One truck a few weeks ago actually hit an overpass, which tore off the top of his trailer, then continued driving 8 miles or so until he jack-knifed going around a curve, destroying the guardrail in the process and closing all lanes of the parkway for several hours.
What I don't understand is why some national news channel doesn't grab these stories and put them out there so that truck drivers around the country can be warned about where they shouldn't be driving. That would be the easiest & fastest way to disseminate this information and hopefully avoid a few accidents. There's other options such as: better signage, better training, placing height bars at on-ramps, etc....but just getting the information out into the public domain would probably help.
Thursday, April 16, 2009
First post
Hello, thanks for taking a look at my Blog. I'm sure I'll be posting stuff here regarding technology, probably relating to Lotus Notes/Domino, Windows, web development, and other subjects.
Subscribe to:
Posts (Atom)