K-Squared Ramblings

The Spammers, The!

I recently noticed that the mail server was experiencing 4 times the typical number of SMTP connections. It didn’t seem to be under any stress, though, not as far as server load went. So I watched the log file trail, and saw a bunch of messages coming in to nonexistent users with the pattern, FirstnameLastname@alternativebrowseralliance.com.

My first thought was that someone was running a dictionary attack against the domain, trying many different addresses to see which might be valid. Then I noticed that they seemed to be coming from <> — in other words, they were bounce notices.

Great. A Joe Job.

I enabled a catch-all temporarily. That did cause the server to slow down, as it was now actually processing the quadruple load instead of kicking back 3/4 of it with a “User unknown” error. (I hadn’t thought to disable spam scanning on the domain first.) In the 30 seconds before I turned it off again, it picked up 25 non-delivery notices. And those are just the ones that got past the spam filter.

As it turned out, they were just random junk. Some spammer had picked the domain and was using it to forge random From: addresses, and we were getting the bounces. In the old days they made up the whole address, but it’s easy to check whether a domain exists. So now they pick some real domain and make up a fake address. That’s harder to detect unless the domain in question uses some sort of verification system like SPF or DKIM.

So it wasn’t a Joe Job: no one was trying to besmirch the site’s reputation. It still meant extra traffic to the mail server, though.

This problem is called backscatter, and it exists for two reasons:

1. The sender address on an email message is easy to forge, like writing a fake address on an envelope.
2. Many mail systems will accept a message first, then process it. If it then decides to reject it, it can’t respond to the actual sender, only to the one listed in the message—and in the case of spam, it’s usually forged (see #1).

I don’t send any mail using the domain. The only reason it even has mail pointed anywhere is so that I can receive mail sent to the webmaster for the Alternative Browser Alliance. I suppose I could set up a -all (no servers are authorized) SPF record, and hope some recipients decide not to send bounces. But I’m not sure how much it would actually accomplish.

Anyway, the two lessons to take away from this are:

• Reject messages to bad recipients in the initial SMTP transaction. It’ll protect your server from backscatter (and dictionary attacks), because you won’t have to queue and process all the extra junk.
• Don’t generate bounce messages after the fact based on something as easily forged as the supposed sender. Otherwise, you’ll be contributing to backscatter.

Survived a Mild Slashdotting

This server weathered its first Slashdotting last Friday, or at least the first I’ve noticed. But then, it was a mild one compared to some reports I’ve seen.

While writing up my commentary on IE dropping WGA last Thursday, I realized that the original story was perfect for Slashdot. It had Microsoft, anti-piracy methods with privacy concerns, Internet Explorer and browser marketshare. So I looked to see if the IE team’s post was on the Firehose already, didn’t see it, and wrote up a quick submission. I also realized that I had an opportunity to plug the Alternative Browser Alliance in the text of the submission—something that I hadn’t been able to do on previous stories I’d submitted. (This is my 6th Slashdot submission to be accepted.)

So I submitted it Thursday evening, got a couple of dozen hits from the Firehose, and it got accepted around 11:30 pm, local time. I took precautions in case the traffic spilled over onto the blog, like turning on WP-Cache and disabling a few plugins, then went to bed. Read the rest of this entry »

Will Internet Explorer 7 finally put IE6 to rest?

Microsoft’s Internet Explorer Team reports on a new IE installer release. They’ve changed a couple of defaults, updated their tutorials… and dropped the requirement for Windows Genuine Advantage validation:

Because Microsoft takes its commitment to help protect the entire Windows ecosystem seriously, we’re updating the IE7 installation experience to make it available as broadly as possible to all Windows users. With today’s “Installation and Availability Update,” Internet Explorer 7 installation will no longer require Windows Genuine Advantage validation and will be available to all Windows XP users.

As much as I prefer alternatives like Firefox and Opera, I’ve been frustrated at the relatively slow uptake of IE7. It’s just insane that 6 years after its release, we’re still stuck designing for IE6 as the world’s most-used browser.

So who’s still running IE6?

1. People running older versions of Windows that can’t run IE7, and who haven’t switched to something else. (This is a pretty small percentage, judging by OS stats.)
2. People who don’t know how to upgrade to IE7, or why they should.
3. People who actually want to stay with IE6 (whether for technical reasons or just stubbornness)
4. People who would be happy to upgrade to IE7, except they can’t/won’t run WGA (on principle, or because it’s broken on their system, or because their OS is pirated).

I don’t know how big each group is, but Microsoft seems to think it’s worth going after #4.

It’ll be interesting to see whether there’s a jump in IE7’s marketshare relative to IE6. Maybe we’ll reach that next milestone sooner than I expected.

Firefox and IE Users: Time to Upgrade

Are you still using Firefox 1.5 or Internet Explorer 6? If so, it’s time to start seriously thinking about an upgrade.

Firefox 1.5 reached the end of its life today. That means that security and other fixes will only be available for Firefox 2 and later. Firefox 2 will run on all the same systems as the version you have right now, plus it gives you enhancements like spell check, phishing protection, and improvements to the features you already use.

Internet Explorer 6 is outmoded. It has limited support for the languages that make up the web (particularly CSS), and often disagrees with every other browser out there, forcing developers to write complicated code so that it will work on IE6. If you’re running Windows XP, you can upgrade to Internet Explorer 7. If you’re running an older version of Windows, you can benefit by switching to an alternative browser such as Firefox
or Opera. Whether you switch or upgrade, I highly recommend moving away from Internet Explorer 6.

Update: Mozilla has extended Firefox 1.5 support through mid-May.

Firefox too mainstream for Alternative Browser Alliance

I’ve been thinking about this for a while, but it’s time to refocus the Alternative Browser Alliance. Mozilla’s Asa Dotzler has referred to Firefox and Internet Explorer as the “mainstream browsers” for more than a year now, and it looks like that’s become true.

The web is no longer an IE monopoly. It’s become an IE/Firefox oligopoly. Firefox is no longer an alternative web browser. It’s sold out, its ads are everywhere, and it even allows people to build Firefox-only code.

So, starting today (April 1, 2007), the Alternative Browser Alliance will no longer promote Firefox.

So what will replace it? I thought about Opera, but most of its install base is on cell phones and PDAs, and we all know the mobile web browser is dead, right? Safari? Well, it turns out that WebKit is shutting down.

So the site will be putting its weight behind iCab. It’s as alternative as they come, and it’s guaranteed to remain that way (since it won’t run on Vista).

Update: Yes, it’s an April Fools joke.

Firefox and Opera: Allies?

Opera Watch posted an interview with Firefox co-founder Blake Ross yesterday, in which he talks about Firefox, Opera, and the relationship between the two. When asked about the rivalry between fans of the browsers, he says, “I think it’s ridiculous. Millions of people out there rely on us to make the Web better, not have pissing contests.” I couldn’t agree more. In fact, I launched The Alternative Browser Alliance primarily in response to that rivalry.

I found it interesting that when asked to describe Opera in three words, Ross’ response was: “Our best ally.”

IE7 got you down? Try Firefox or Opera!

Microsoft will be releasing the long-overdue Internet Explorer 7 any day now (possibly as soon as Wednesday, if rumors prove correct). It will only be available for Windows XP SP2, Windows Server 2003, and the upcoming Windows Vista.

I know there are people out there still using Windows 2000, Windows 98, Windows Me, and other older systems that won’t run IE7. Why not take the opportunity to check out something new? Firefox 2 is also due out this month, and Opera 9 just came out this summer.

Despite what you may have heard, the vast majority of websites really do work on all major browsers. And with alternative browsers gaining popularity, the number of websites that block anyone but Internet Explorer is shrinking.

Opera and Firefox will bring you tabbed browsing, RSS Feeds, security and privacy controls, built-in searching, pop-up blocking—all the advantages IE7 boasts over IE6. Plus you get more customization, built-in spell checking, download management, session saving, and support for up-and-coming web technologies like SVG graphics and WebForms 2. Opera adds blazing fast display, voice commands and mouse gestures (leave that keyboard behind!), and per-site preferences.

Check out Opera. Check out Firefox. Or check out a dozen other alternative web browsers. Try them out, and see what works best for you.

Tertiary Slashdotting

Today I noticed a spike in traffic coming from a post on Spread Firefox where I had made a comment. Not a ton of traffic, just ~10 ~15 hits from the same page on the same day, but that’s unusual for traffic from SFX posts—especially old ones. I checked to see if it had climbed into the site’s list of top posts (the usual explanation), but it wasn’t there. I just couldn’t figure out what was causing the traffic.

Then I realized the author of that post had another story show up on Slashdot today. I discovered this chain of links:

1. Slashdot: Just what has Microsoft been doing for IE 7?
2. Idealog: Microsoft Drops The Ball on Internet Explorer 7 Standards Compliance
3. SFX: Should NewsCloud.com Remain Firefox Only?
4. The Alternative Browser Alliance (via signature in comment)

You can see how powerful the Slashdot effect is, if it can cause a noticeable (if minor) spike in traffic to a page 3 degrees away!

Of course, it pales next to being linked from the ISC Handler’s Diary, which seems to have pulled in 15 10 times as many visitors in 2 days. (Thanks!)

ABA Publicity

It’s been a good week for the Alternative Browser Alliance.

Last weekend, Opera Watch linked to it in the follow-up to the RSS icon controversy. (I use the site as my URL when posting on browser-related blogs and forums, and Daniel was kind enough to include the link when he highlighted the news I’d posted in the comments.)

On Tuesday, I linked to it myself in a comment on Slashdot. For once, a couple of hundred people clicked on the link. Not long afterward, it started popping up on StumbleUpon after a dry spell. (Coincidence? Well, maybe.)

On Thursday morning, the site got posted to Linkfilter, which led to a few dozen visits.

And finally, Thursday night, BBSpot posted it in their daily links, resulting in over 1500 visits over the past three days!

Thanks to everyone helping to spread the word!

Now I have to start replying to comments…

In related news, I’ve finally broken down and added Flock to the list. Mainly I stayed away from it because I’d already listed 7 Gecko-based browsers (8 if you count SeaMonkey separately from the Mozilla Suite), and it seemed overkill to add one more. I first tried out Flock back in October, and while it seemed interesting, it didn’t really grab me. Now that it’s in beta, it looks like progress is solid, and it’s different enough from Firefox or SeaMonkey to warrant inclusion.

Browser Zealotry

I found a three-year-old blog post by Arve Bersvendsen on web browser zealots that, sadly, is just as true today. Only the names have changed (Phoenix to Firefox).

Seriously, I think these people are hurting the fight for standards….In having to choose whether to believe the Operanians or The Mozillians, I believe J. Random User will believe both. He’ll believe the Opera fans when they say “Phoenix [Firefox] sucks”, and he (or she) will also believe Phoenixers who say “Opera stinks”. And so, J. Random sticks with MSIE.

Arve mentioned his earlier post when he weighed in on the Opera splash page download kerfuffle, which is a great example of why I created the Alternative Browser Alliance. Both Mozilla and Opera have stated goals of promoting choice on the web. Both want to unseat the current dominant browser (i.e. IE). Those goals are better accomplished, if not by outright cooperation, at least by civility. As Arve puts it:

Please, instead of wasting all that time on endless flamewars against the “other browser”, spend your time evangelizing the product you actually use!

Also, a big thanks to Rijk for the shout-out on his blog!

Flashy sites

I’ve been struggling to promote my new site, the Alternative Browser Alliance, since I launched it in August. It’s a tough sell. I get the most traffic when I post something visible on Slashdot and people follow the link in my signature. You can barely even find it in Google—search for “Alternative Browser Alliance” and blog posts about it show up ahead of the site itself! (On the other hand, it seems to be #1 for “alternative browser” on MSN. Not that it seems to be helping much.)

By contrast, Flash: Those Who Ride the Lightning pulls in tons of visitors. Last week I put up an article on the Three Dimwits, the Flash’s comedic sidekicks from the 1940s. Within 24 hours it had received more than 150 hits. Within 3 days it was the top result for “three dimwits” on Google.

Why the difference? Well, my Flash site is long-established and authoritative. More importantly, it fills a specific niche. You can find a zillion pages about web browsers. But there are only a handful of large sites dedicated to the Flash, and mine is the longest-lived of them, aside from DC Comics’ own site. And until I wrote one, I could not find a page anywhere that actually focused on the Three Dimwits, just a set of stubs and the occasional comment in articles about the Flash.

Last Thursday I posted a suggestion box on the front page of the site. The results have been interesting. The freakiest part was probably that the first suggestion came in just five minutes after I uploaded the form! There’ve been 22 suggestions in the first week, which I’ve divided into three categories. Read the rest of this entry »

The Alternative Browser Alliance

I’m launching a new browser switch site, with a bit of a twist. It’s promoting all alternative browsers, kind of like Browse Happy, but a bit more inclusive and aimed at a slightly different audience.

The idea is that a diverse browser “market”—one with three or four major browser suppliers all competing with each other—is the best way to maintain innovation and security. Anyone following the classic browser wars, the lull in IE development, and the sudden appearance of IE7 can see the difference competition makes for innovation. As for security… If someone can hit 90% of the world’s computers by hitting IE on Windows, we’re in trouble. But if they have to hit 30% each on IE, Firefox, and Opera, and even those are split among Windows, Mac and Linux, it’s a lot more effort for the bad guys.

I got the idea back in May, during some rather heated Firefox/Opera flame wars. It seemed to me that fans of the two browsers had more in common than they thought, if they’d just stop fighting each other. I worked on it during June, and launched a test version last month, asking for feedback from friends and from the Spread Firefox and My Opera communities. It’s still not where I’d like it to be (Comic-Con, then procrastination), but after the net went crazy over Paul Thurott’s “Boycott IE” article I realized I’d better launch what I had and refine it later.

So, without further ado, I’m officially launching the Alternative Browser Alliance.