RE: Re: Drop Dynamic Querying

On Monday, March 26, 2007 Bill Pringlemeir wrote:
> PeerGaurdian might be great for Windows users.  Most *nix users will
> have ip blocking capabilities that can be automated with a script and
> a list of hostile peers.

	IP blocking is only half of it. Servent integration is required
to hide the search results from the spam farm IP range. The user is
not supposed to even see these screens filled with junk.

	Best wishes -
	Oso.
	26 Mar 2007.


-----Original Message-----
From: [email protected] [mailto:[email protected]]On Behalf
Of Bill Pringlemeir
Sent: Monday, March 26, 2007 7:11 AM
To: [email protected]
Subject: [the_gdf] Re: Drop Dynamic Querying



> 1a. Re: Drop Dynamic Querying - It only benefits Spammers these days
>     Posted by: "Serguei Osokine" [email protected] osokin_paragraph_com
>     Date: Sat Mar 24, 2007 1:52 pm ((PDT))

> 	So the spam comes in two forms: from their machines and through
> poor souls who were duped into downloading this crap and now are the
> rebroadcasters.

This is a good point.  One small change that might prevent the second case
is
that all downloaded files are immediately made available for upload.  This
was
done in order to prevent "free loading".  However, downloaded files haven't
had
time to be reviewed by the user.  This helps to propogate SPAM.

PeerGaurdian might be great for Windows users.  Most *nix users will have ip
blocking capabilities that can be automated with a script and a list of
hostile
peers.  Eg,

# Loop over hostiles.txt and deny any connections...
echo -n "Hostile"
for i in `grep -v ^# hostiles.txt | sort -n`; do iptables -A INPUT -i
$EXTIF -s
$i -d $ANY -j REJECT && echo -n "."; done;
echo "Done"

Some Gnutella clients (like gtk-gnutella) also refuse to connect to hostile
peers at the application level.  The problem with this is that the SPAMers
are
not static and this list has to be constantly updated all the time.  One can
also find references to people who have aquired new IP address ranges and
been
blacklisted, because the previous owner was a SPAMMER (or they are included
in
a bogon list).  This can also happen with P2P spammer lists.

Credence addresses both cases, but requires that users vote wisely (and
often);
DQ should be altered to exclude low correlated nodes from searches.  GUESS
shifts searching from the network to the node, so it *seems* more difficult
for
SPAMers to monopolize queries with their responses.  GUESS can also exclude
any
nodes with SPAM responses from future searches.  Spam responses can be found
via credence type voting or by static hash lists and/or response text [ie,
*Im_a_spammers*.mp3].  Unfortunately, DQ can only exclude a top-level ultra
which may prevent all connected nodes from being queried.  I don't think
there
is an easy (secure) way to propogate this information towards the direct
connections to the spam source.  Maybe queries could have a "deny list"
attached (or some way to obtain).  Ie, don't forward my query to these
nodes.

fwiw,
Bill Pringlemeir.




____________________________________________________________________________
________
TV dinner still cooling?
Check out "Tonight's Picks" on Yahoo! TV.
http://tv.yahoo.com/



Yahoo! Groups Links