Re: Drop Dynamic Querying - It only benefits Spammers these days

--- In [email protected], "Sam Berlin" <sberlin@...> wrote:
>
> There's a large range of IP addresses out there that have managed to
> insert themselves into the core of the network, by abusing problems
> within LimeWire's code.

   Oh. So you mean that by your estimate most of the spam is caused
by the bots that have remotely gained control over LimeWire servents?
I didn't realize that. Sorry to hear about it.

   But still - I dunno... Even when you fix that, I have a feeling
that spam is not going away any time soon. Even a perfectly legit
modified client can inject quite a lot of it - and since people have
actually started writing business plans that rely on polluting the
network with crap, getting rid of it might be a bit more complex
than just "toughening up the code" of one single vendor.

   But - I wish you luck anyway.

   Best wishes -
   Oso.
   27 Mar 2007.


--- In [email protected], "Sam Berlin" <sberlin@...> wrote:
>
> There's a large range of IP addresses out there that have managed to
> insert themselves into the core of the network, by abusing problems
> within LimeWire's code.  These problems range from being not being
> wary enough of network-damaging messages to plain old bad code (such
> as thinking the first item [hashcode-wise] in a hash map is random).
> 
> We've got some good ideas planned for toughening up the code, which
> should make damaging the network much harder.  This isn't addressing
> spam as a "spam is the problem" approach, but should have much of 
the
> same effect.
> 
> Sam
> 
> On 3/27/07, Serguei Osokine <osokin@...> wrote:
> > On Sunday, March 25, 2007 Zlatin Balevsky wrote:
> > > Any protocol-level ideas will be published here.  So far we 
have the
> > > OOBv3 proposal.
> > >
> > > Any limewire-specific measures will be discussed in limewire-
specific
> > > places.
> >
> >        I was not talking about measures. I was talking about the 
data
> > that I thought you might already have, assuming that you spent 
some
> > time looking into spam-related issues. Is the spam coming from 
some
> > relatively limited IP ranges, or it is injected by the routers 
into
> > the spoofed TCP sessions that make it look like coming from the
> > legitimate servent IPs; is it possible to filter out such IP 
ranges,
> > assuming that they exist; does PeerGuardian already know about 
these
> > ranges or it is not tracking spam; does the situation improve with
> > just display blocking of the results, or the spam actually maxes 
out
> > some result number limits en route, and filtering it out leaves 
you
> > with few useful results; do the spam sources migrate from one IP 
to
> > another a lot - this kind of thing.
> >
> >        If you don't have this data - just say so. If you have it, 
but
> > do not want to discuss it - that's cool, too. All this can be 
collected
> > independently; it will just take some time.
> >
> >        Best wishes -
> >        Oso.
> >        26 Mar 2007.
> >
> >
> > -----Original Message-----
> > From: [email protected] [mailto:[email protected]]On 
Behalf
> > Of Zlatin Balevsky
> > Sent: Sunday, March 25, 2007 9:36 PM
> > To: [email protected]
> > Subject: Re: [the_gdf] Drop Dynamic Querying - It only benefits 
Spammers
> > these days
> >
> >
> > Any protocol-level ideas will be published here.  So far we have 
the OOBv3
> > proposal.
> >
> > Any limewire-specific measures will be discussed in limewire-
specific
> > places. ( http://limewire.org )
> >
> > On 24 Mar 2007 13:52:50 -0700, Serguei Osokine <osokin@...> wrote:
> > >
> > >   On Monday, January 23, 2007 Arne Babenhauserheide wrote:
> > > > Could you shed some light on your thoughts?
> > > >
> > > > They seem somehow blackboxed just now :)
> > >
> > > Yeah, I'd be very interested to hear these thoughts too, Sam :-)
> > >
> > > Or maybe not. Maybe they are secret thoughts. Anyway, forgive
> > > me for jumping into this discussion two months late, but that 
is not
> > > because I was not paying attention, but rather because I was 
thinking.
> > > And the result of all this thinking is that the spam fight is 
hopeless
> > > without the PeerGuardian plugin - maybe together with some kind 
of a
> > > content filter.
> > >
> > > Let's backtrack a little. For many years, spam was not a serious
> > > problem, because it would not replicate. Who'd store it on his 
machine?
> > > So the spam content was always present, but was not much of a 
problem,
> > > because it comprised just a small share of all content in the 
network.
> > >
> > > The situation changed when people started to deploy the
> > > specialized high-performance servers to inject the massive 
amounts
> > > of fake content into the system. It probably started with the 
various
> > > attempts to destroy the P2P nets with pollution, but now it is 
more of
> > > a commercial endeavour, with people like P2Pads and Skyrider 
using
> > > high-performance methods to deliver lots and lots of spam. (And 
even
> > > claiming that they've got a novel business model. Yeah, right. 
Ever
> > > got an anatomy enlargement e-mail offer?)
> > >
> > > So the spam comes in two forms: from their machines and through
> > > poor souls who were duped into downloading this crap and now 
are the
> > > rebroadcasters. I'd say that the first channel is more serious 
(that
> > > is, it produces lots and lots of new spamming content in 
virtually
> > > unlimited quantities). Fortunately, it is also easier to break: 
it
> > > is hard to constantly move a massive server farm from one IP 
range
> > > to another, so I think that the PeerGuardian plugin can take 
care
> > > of it.
> > >
> > > The second part (killing the spam that is already present) is
> > > trickier, but once the inflow of this crap is limited, maybe 
Credence
> > > or something like that can help (right now it must be basically 
useless,
> > > because the spamming farm can mutate its content all the time). 
Heck,
> > > maybe with the spam farms blocked by the PeerGuardian from the 
majority
> > > of the network nodes, the usual natural selection process would 
be
> > > enough to bring the spamming problem into reasonable bounds. 
After
> > > all, any node that sees a result from the blocked IP range can 
kill
> > > it, so hopefully much of the spam can be blocked by a small 
percentage
> > > of nodes having such a plugin. (Though direct replies do 
complicate
> > > things, of course.) Maybe having a PeerGuardian plugin should 
be a
> > > requirement for at least every Ultrapeer?
> > >
> > > Anyway, the rebroadcasters lack one very important quality:
> > > they can no longer create the artificial spam file name and 
stuff
> > > it as a result into every request coming through them. I'd guess
> > > that most of the spam is generated by the spam farms, and taking
> > > them out should lower the spam volume a lot. We should do it 
first,
> > > see what happens, and go from there.
> > >
> > > And the beauty of this situation is that this spamming problem
> > > is capable of giving a huge boost to the PeerGuardian 
development -
> > > from a privacy protection service (which is not something that 
many
> > > people are worried about), it becomes a spam-fighting service, 
which
> > > is something that everyone is aware of. Everyone sees spam, and 
is
> > > totally sick and tired of it. With a few donations from the 
servent
> > > vendors and from the community, PeerGuardian might really 
become a
> > > major spam-fighting service and a household word.
> > >
> > > Of course, this integration with PeerGuardian requires not
> > > only blocking the connections to the blacklisted IPs (as it is
> > > normally done), but it should also include the filtering of the
> > > result list on every node for these same IPs. Every node should
> > > remove the spam results once it sees them. And since it also
> > > includes the displaying (requestor) node, such an integration
> > > should bring immediate benefits to the node user - he should 
stop
> > > seeing many spam results at once. So the upgrade to the servent
> > > version that takes such a plugin should be a snap - the users 
will
> > > stand in line for it.
> > >
> > > The PeerGuardian scalability should be carefully controlled,
> > > of course - but that is not anything unsurmountable.
> > >
> > > If I'd work for P2P spammers, my next step would be to move my
> > > operation to the individual users' machines and to the machines 
that
> > > are controlled by the bots, but I dunno... First, these 
machines are
> > > as easily to identify by the PeerGuardian, and second, the P2P 
spam
> > > operators are currently trying to position themselves as 
legitimate
> > > businessmen. I'm not sure how willing they would be to shift to 
the
> > > networks of bots controlled by the Trojans from Nigeria-based 
control
> > > center. They are carefully avoiding even the very word 'spam' 
in their
> > > press releases lest they be confused with universally hated e-
mail
> > > spammers. Utilizing the same shady methods as Viagra pushers do 
might
> > > not look good for the public and for investors.
> > >
> > > Sam, did you guys try integrating PeerGuardian or some analog
> > > into the system? What was the result? To put it shortly, why do 
P2P
> > > nets still have spam? What is the hole in my reasoning? Or 
maybe you
> > > are already shipping this thing, and I simply missed it? In this
> > > case, I want a premium version of it, right now. And never mind 
my
> > > Java allergy - a spamless servent is worth waiting twenty 
seconds
> > > for its launch :-)
> > >
> > > Best wishes -
> > > Oso.
> > > 24 Mar 2007.
> > >
> > >
> > > -----Original Message-----
> > > From: [email protected] <the_gdf%40yahoogroups.com> 
[mailto:
> > > [email protected] <the_gdf%40yahoogroups.com>]On Behalf
> > > Of Arne Babenhauserheide
> > > Sent: Monday, January 23, 2007 11:25 PM
> > > To: [email protected] <the_gdf%40yahoogroups.com>
> > > Subject: Re: [the_gdf] Drop Dynamic Querying - It only benefits 
Spammers
> > > these days
> > >
> > > Could you shed some light on your thoughts?
> > >
> > > They seem somehow blackboxed just now :)
> > >
> > > I know that LimeWire is the biggest player in the GNet at the 
moment,
> > > but
> > > LimeWire can only reach a certain kind of users, so there are 
quite a
> > > lot of
> > > niches for other programs, and I for my part want to see 
Gnutella a
> > > vivid
> > > community which evolves ever further into the most efficient p2p
> > > network.
> > >
> > > And I believe, that this can only happen, if different 
developers
> > > with a lot
> > > of different ideas and ways of thinking work together.
> > >
> > > And aside from that, a heterogenous network is far harder to
> > > attack :)
> > >
> > > So: What's your thoughts till now?
> > >
> > > Besides: Why don't you use the description of Gnutella from
> > > http://gnufu.net
> > > on the LimeWire pages? They are intended to be used :)
> > > If it's licensing problems, you just need to ask me to get a
> > > differently
> > > licensed version (of the parts I wrote, which is most of the 
texts).
> > >
> > > Best wishes,
> > > Arne
> > >
> > > El Martes, 23 de Enero de 2007 21:11, Sam Berlin escribió:
> > > > We are actively looking into the spam problem, Arne, and 
intend to
> > > > address it effectively.
> > > >
> > > > Sam
> > >
> > > [Non-text portions of this message have been removed]
> > >
> > > --- End forwarded message ---
> > >
> > >
> > >
> >
> >
> > [Non-text portions of this message have been removed]
> >
> >
> >
> >
> > Yahoo! Groups Links
> >
> >
> >
> >
> >
> >
> >
> > Yahoo! Groups Links
> >
> >
> >
> >
>