Could the AOL part be spoofed?
So, how was your summer? Mine was fun. Saw some fish. Went mad with hunger. Hallucinated a whole bunch.
Angel ,'Conviction (1)'
Buffistas Building a Better Board ++
Do you have problems, concerns, or recommendations about the technical side of the Phoenix? Air them here. Compliments also welcome.
DCJensen - Jul 28, 2005 5:29:23 pm PDT #55 of 4671
All is well that ends in pizza.
DXMachina - Jul 28, 2005 5:34:03 pm PDT #56 of 4671
You always do this. We get tipsy, and you take advantage of my love of the scientific method.
Possibly, but given that we only see it by accident, I doubt it. More likely they're just opening new aol accounts.
tommyrot - Jul 28, 2005 5:38:59 pm PDT #57 of 4671
Sir, it's not an offence to let your cat eat your bacon. Okay? And we don't arrest cats, I'm very sorry.
I'm confused. Wouldn't a human have to actually look at this site in order to figure out how to get a bot to sign up? Or are there bots clever enough to find sites on their own and try to figure out likely ways to sigh up & log in?
DXMachina - Jul 28, 2005 6:13:41 pm PDT #58 of 4671
You always do this. We get tipsy, and you take advantage of my love of the scientific method.
Beats me. We don't tell people about the confirmation e-mail until after they submit the registration.
I'm still trying to figure out what they hope to accomplish.
tommyrot - Jul 28, 2005 6:22:57 pm PDT #59 of 4671
Sir, it's not an offence to let your cat eat your bacon. Okay? And we don't arrest cats, I'm very sorry.
google jrubin3546@aol.com
see anything interesting?
eta:
especially [link]
I'm seeing an interesting new attack on my website where the attacker is hoping to exploit unchecked fields in a "web to email" form. The attack works by assuming a field used in an email header (such as the "From:" address or the "Subject:") is passed unchecked to the mail subsystem. Appending a newline character and a few more carefully crafted header lines with a BCC list and a spam message body might trick the underlying mail system into relaying spam for the attacker.
eta²: do I get a cookie?
§ ita § - Jul 28, 2005 8:23:09 pm PDT #60 of 4671
Well not canonically, no, but this is transformative fiction.
Hmmph. I'm way too tired to see if they could be hitting our e-mail Admins page too.
Thanks for the lead, tommy.
Tomorrow.
Eddie - Jul 28, 2005 11:44:02 pm PDT #61 of 4671
Your tag here.
Huh... that's kinda neat in an EVIL way.
Well, one easy fix would be to add a checkbox to both of those pages that says:
[] I am not a Buffybot.
If the box is not checked, then they're a bot. Poor man's CAPTCHA.
I've never used it, but this looks promising and fairly trivial to implement. Note that the author (rightly so) points out that CAPTCHAs are not friendly for the visually impaired, so that may be a consideration.
Edit: I just tried it out and it's very trivial to use. Pretty cool, too. However, IE doesn't render the image properly, 'cause IE isn't standards compliant. Too bad. There are other alternatives if you wish to explore this further.
DXMachina - Jul 29, 2005 1:50:11 am PDT #62 of 4671
You always do this. We get tipsy, and you take advantage of my love of the scientific method.
google jrubin3546@aol.com
Just got one from bergkoch8@aol.com which is funny because the next hit was to this story.
bergkoch8@aol.com is the other bcc address we saw.
§ ita § - Jul 29, 2005 4:05:14 am PDT #63 of 4671
Well not canonically, no, but this is transformative fiction.
I fucking hate CAPTCHA. I have 20-20 vision, and one time in four I find myself getting them wrong.
I'm going to tweak the script later today, to see what grounds we can toss these attempts on.
DXMachina - Jul 29, 2005 4:15:10 am PDT #64 of 4671
You always do this. We get tipsy, and you take advantage of my love of the scientific method.
I fucking hate CAPTCHA.
Totally agree with this. The post tommy linked to has suggestions for blocking it.
You should probably look at the "E-mail Admins" form, too.