Re: Re: Drop Dynamic Querying - It only benefits Spammers these days

I'm sure there's bots out there that are manipulating preinstalled
LimeWires (and that's a problem), but that's not actually what I was
referring to.  There's some degenerate code in LimeWire that allows
hosts to easily flood their addresses into the pool of addresses and
cause each LimeWire to try connecting to them over and over.  This
leads to a huge portion of clients foolishly connecting to the same
few hosts, making the network lopsided towards those hosts.

We're first looking to fix the configuration of the network.  Once
that settles down again, we have some ideas (very hazy ones, right
now) for spam.

FWIW, I have no personal opposition to injecting 'ad-style' results
into the network, so long as there's a mechanism for displaying them
as something other than spam-search-results.  Perhaps we should
consider thinking of ways to allow these business-minded folks to
display these ads in a friendly way.  Then we can let the user decide
if they want to see relevent ads, and concentrate better on getting
rid of the real spam.

Sam

On 3/27/07, Serguei Osokine <[email protected]> wrote:
> --- In [email protected], "Sam Berlin" <sberlin@...> wrote:
> >
> > There's a large range of IP addresses out there that have managed to
> > insert themselves into the core of the network, by abusing problems
> > within LimeWire's code.
>
>   Oh. So you mean that by your estimate most of the spam is caused
> by the bots that have remotely gained control over LimeWire servents?
> I didn't realize that. Sorry to hear about it.
>
>   But still - I dunno... Even when you fix that, I have a feeling
> that spam is not going away any time soon. Even a perfectly legit
> modified client can inject quite a lot of it - and since people have
> actually started writing business plans that rely on polluting the
> network with crap, getting rid of it might be a bit more complex
> than just "toughening up the code" of one single vendor.
>
>   But - I wish you luck anyway.
>
>   Best wishes -
>   Oso.
>   27 Mar 2007.
>
>
> --- In [email protected], "Sam Berlin" <sberlin@...> wrote:
> >
> > There's a large range of IP addresses out there that have managed to
> > insert themselves into the core of the network, by abusing problems
> > within LimeWire's code.  These problems range from being not being
> > wary enough of network-damaging messages to plain old bad code (such
> > as thinking the first item [hashcode-wise] in a hash map is random).
> >
> > We've got some good ideas planned for toughening up the code, which
> > should make damaging the network much harder.  This isn't addressing
> > spam as a "spam is the problem" approach, but should have much of
> the
> > same effect.
> >
> > Sam
> >
> > On 3/27/07, Serguei Osokine <osokin@...> wrote:
> > > On Sunday, March 25, 2007 Zlatin Balevsky wrote:
> > > > Any protocol-level ideas will be published here.  So far we
> have the
> > > > OOBv3 proposal.
> > > >
> > > > Any limewire-specific measures will be discussed in limewire-
> specific
> > > > places.
> > >
> > >        I was not talking about measures. I was talking about the
> data
> > > that I thought you might already have, assuming that you spent
> some
> > > time looking into spam-related issues. Is the spam coming from
> some
> > > relatively limited IP ranges, or it is injected by the routers
> into
> > > the spoofed TCP sessions that make it look like coming from the
> > > legitimate servent IPs; is it possible to filter out such IP
> ranges,
> > > assuming that they exist; does PeerGuardian already know about
> these
> > > ranges or it is not tracking spam; does the situation improve with
> > > just display blocking of the results, or the spam actually maxes
> out
> > > some result number limits en route, and filtering it out leaves
> you
> > > with few useful results; do the spam sources migrate from one IP
> to
> > > another a lot - this kind of thing.
> > >
> > >        If you don't have this data - just say so. If you have it,
> but
> > > do not want to discuss it - that's cool, too. All this can be
> collected
> > > independently; it will just take some time.
> > >
> > >        Best wishes -
> > >        Oso.
> > >        26 Mar 2007.
> > >
> > >
> > > -----Original Message-----
> > > From: [email protected] [mailto:[email protected]]On
> Behalf
> > > Of Zlatin Balevsky
> > > Sent: Sunday, March 25, 2007 9:36 PM
> > > To: [email protected]
> > > Subject: Re: [the_gdf] Drop Dynamic Querying - It only benefits
> Spammers
> > > these days
> > >
> > >
> > > Any protocol-level ideas will be published here.  So far we have
> the OOBv3
> > > proposal.
> > >
> > > Any limewire-specific measures will be discussed in limewire-
> specific
> > > places. ( http://limewire.org )
> > >
> > > On 24 Mar 2007 13:52:50 -0700, Serguei Osokine <osokin@...> wrote:
> > > >
> > > >   On Monday, January 23, 2007 Arne Babenhauserheide wrote:
> > > > > Could you shed some light on your thoughts?
> > > > >
> > > > > They seem somehow blackboxed just now :)
> > > >
> > > > Yeah, I'd be very interested to hear these thoughts too, Sam :-)
> > > >
> > > > Or maybe not. Maybe they are secret thoughts. Anyway, forgive
> > > > me for jumping into this discussion two months late, but that
> is not
> > > > because I was not paying attention, but rather because I was
> thinking.
> > > > And the result of all this thinking is that the spam fight is
> hopeless
> > > > without the PeerGuardian plugin - maybe together with some kind
> of a
> > > > content filter.
> > > >
> > > > Let's backtrack a little. For many years, spam was not a serious
> > > > problem, because it would not replicate. Who'd store it on his
> machine?
> > > > So the spam content was always present, but was not much of a
> problem,
> > > > because it comprised just a small share of all content in the
> network.
> > > >
> > > > The situation changed when people started to deploy the
> > > > specialized high-performance servers to inject the massive
> amounts
> > > > of fake content into the system. It probably started with the
> various
> > > > attempts to destroy the P2P nets with pollution, but now it is
> more of
> > > > a commercial endeavour, with people like P2Pads and Skyrider
> using
> > > > high-performance methods to deliver lots and lots of spam. (And
> even
> > > > claiming that they've got a novel business model. Yeah, right.
> Ever
> > > > got an anatomy enlargement e-mail offer?)
> > > >
> > > > So the spam comes in two forms: from their machines and through
> > > > poor souls who were duped into downloading this crap and now
> are the
> > > > rebroadcasters. I'd say that the first channel is more serious
> (that
> > > > is, it produces lots and lots of new spamming content in
> virtually
> > > > unlimited quantities). Fortunately, it is also easier to break:
> it
> > > > is hard to constantly move a massive server farm from one IP
> range
> > > > to another, so I think that the PeerGuardian plugin can take
> care
> > > > of it.
> > > >
> > > > The second part (killing the spam that is already present) is
> > > > trickier, but once the inflow of this crap is limited, maybe
> Credence
> > > > or something like that can help (right now it must be basically
> useless,
> > > > because the spamming farm can mutate its content all the time).
> Heck,
> > > > maybe with the spam farms blocked by the PeerGuardian from the
> majority
> > > > of the network nodes, the usual natural selection process would
> be
> > > > enough to bring the spamming problem into reasonable bounds.
> After
> > > > all, any node that sees a result from the blocked IP range can
> kill
> > > > it, so hopefully much of the spam can be blocked by a small
> percentage
> > > > of nodes having such a plugin. (Though direct replies do
> complicate
> > > > things, of course.) Maybe having a PeerGuardian plugin should
> be a
> > > > requirement for at least every Ultrapeer?
> > > >
> > > > Anyway, the rebroadcasters lack one very important quality:
> > > > they can no longer create the artificial spam file name and
> stuff
> > > > it as a result into every request coming through them. I'd guess
> > > > that most of the spam is generated by the spam farms, and taking
> > > > them out should lower the spam volume a lot. We should do it
> first,
> > > > see what happens, and go from there.
> > > >
> > > > And the beauty of this situation is that this spamming problem
> > > > is capable of giving a huge boost to the PeerGuardian
> development -
> > > > from a privacy protection service (which is not something that
> many
> > > > people are worried about), it becomes a spam-fighting service,
> which
> > > > is something that everyone is aware of. Everyone sees spam, and
> is
> > > > totally sick and tired of it. With a few donations from the
> servent
> > > > vendors and from the community, PeerGuardian might really
> become a
> > > > major spam-fighting service and a household word.
> > > >
> > > > Of course, this integration with PeerGuardian requires not
> > > > only blocking the connections to the blacklisted IPs (as it is
> > > > normally done), but it should also include the filtering of the
> > > > result list on every node for these same IPs. Every node should
> > > > remove the spam results once it sees them. And since it also
> > > > includes the displaying (requestor) node, such an integration
> > > > should bring immediate benefits to the node user - he should
> stop
> > > > seeing many spam results at once. So the upgrade to the servent
> > > > version that takes such a plugin should be a snap - the users
> will
> > > > stand in line for it.
> > > >
> > > > The PeerGuardian scalability should be carefully controlled,
> > > > of course - but that is not anything unsurmountable.
> > > >
> > > > If I'd work for P2P spammers, my next step would be to move my
> > > > operation to the individual users' machines and to the machines
> that
> > > > are controlled by the bots, but I dunno... First, these
> machines are
> > > > as easily to identify by the PeerGuardian, and second, the P2P
> spam
> > > > operators are currently trying to position themselves as
> legitimate
> > > > businessmen. I'm not sure how willing they would be to shift to
> the
> > > > networks of bots controlled by the Trojans from Nigeria-based
> control
> > > > center. They are carefully avoiding even the very word 'spam'
> in their
> > > > press releases lest they be confused with universally hated e-
> mail
> > > > spammers. Utilizing the same shady methods as Viagra pushers do
> might
> > > > not look good for the public and for investors.
> > > >
> > > > Sam, did you guys try integrating PeerGuardian or some analog
> > > > into the system? What was the result? To put it shortly, why do
> P2P
> > > > nets still have spam? What is the hole in my reasoning? Or
> maybe you
> > > > are already shipping this thing, and I simply missed it? In this
> > > > case, I want a premium version of it, right now. And never mind
> my
> > > > Java allergy - a spamless servent is worth waiting twenty
> seconds
> > > > for its launch :-)
> > > >
> > > > Best wishes -
> > > > Oso.
> > > > 24 Mar 2007.
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: [email protected] <the_gdf%40yahoogroups.com>
> [mailto:
> > > > [email protected] <the_gdf%40yahoogroups.com>]On Behalf
> > > > Of Arne Babenhauserheide
> > > > Sent: Monday, January 23, 2007 11:25 PM
> > > > To: [email protected] <the_gdf%40yahoogroups.com>
> > > > Subject: Re: [the_gdf] Drop Dynamic Querying - It only benefits
> Spammers
> > > > these days
> > > >
> > > > Could you shed some light on your thoughts?
> > > >
> > > > They seem somehow blackboxed just now :)
> > > >
> > > > I know that LimeWire is the biggest player in the GNet at the
> moment,
> > > > but
> > > > LimeWire can only reach a certain kind of users, so there are
> quite a
> > > > lot of
> > > > niches for other programs, and I for my part want to see
> Gnutella a
> > > > vivid
> > > > community which evolves ever further into the most efficient p2p
> > > > network.
> > > >
> > > > And I believe, that this can only happen, if different
> developers
> > > > with a lot
> > > > of different ideas and ways of thinking work together.
> > > >
> > > > And aside from that, a heterogenous network is far harder to
> > > > attack :)
> > > >
> > > > So: What's your thoughts till now?
> > > >
> > > > Besides: Why don't you use the description of Gnutella from
> > > > http://gnufu.net
> > > > on the LimeWire pages? They are intended to be used :)
> > > > If it's licensing problems, you just need to ask me to get a
> > > > differently
> > > > licensed version (of the parts I wrote, which is most of the
> texts).
> > > >
> > > > Best wishes,
> > > > Arne
> > > >
> > > > El Martes, 23 de Enero de 2007 21:11, Sam Berlin escribi�:
> > > > > We are actively looking into the spam problem, Arne, and
> intend to
> > > > > address it effectively.
> > > > >
> > > > > Sam
> > > >
> > > > [Non-text portions of this message have been removed]
> > > >
> > > > --- End forwarded message ---
> > > >
> > > >
> > > >
> > >
> > >
> > > [Non-text portions of this message have been removed]
> > >
> > >
> > >
> > >
> > > Yahoo! Groups Links
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > Yahoo! Groups Links
> > >
> > >
> > >
> > >
> >
>
>
>
>
>
> Yahoo! Groups Links
>
>
>
>