I have to agree with this Google blog post: this would be bad. Yahoo! seems to “get it” (where “it” is an open Internet) much better than Microsoft does.

Actually, it reminds me a little of Disney vs. Pixar in the past decade. Pixar, in adddition to mastering computer animation, had a great sense of story—something which Disney lost track of in the mid-1990s. They saw Pixar’s movies doing better than their own, and while they were still getting a cut, they didn’t understand why they did better. They thought it was the 3D animation, when really, it was the fact that they were churning out forgettable animated films like that cattle movie whose name escapes me, while Pixar was doing Finding Nemo and The Incredibles.

Actually, the only way I can see a Microsoft takeover of Yahoo! being good for anyone but Microsoft would be if it went down like the Disney-Pixar merger, and the Yahoo! people ended up in charge of web services. Not that I expect it to be likely, and even if they were, I’m sure the higher-ups would cripple them. I get the impression that sort of thing is going on with the IE team as it is.

This, of course, hasn’t stopped a flood of knee-jerk reactions. (via Spamroll)

What’s funny is that this conundrum has been almost exactly like the controversy two years ago over Microsoft choosing Bonded Sender as an accreditation service/whitelist for Hotmail—knee jerking and all.

Back then I wrote the following article and never got around to posting it. Thanks to AOL, it’s finally topical again. Sadly, I haven’t had to change much to bring it up to date.

The Tradition of Flame Wars

The flame war has been part of the Internet for years. Get enough people together with strong, differing opinions and without the mediating effects of body language or tone of voice, and you get heated arguments. And some arguments never seem to end. Like bringing up politics or religion at a family gathering, be careful when you mention PC vs. Mac, Windows vs. Linux, Red Hat vs. SuSE, etc. I created a website for the express purpose of cooling down Opera/Firefox flamewars (not that it seems to have helped much).

Two topics that always seem to set off raving are Microsoft and spam. Bring up the question of just who’s responsible for spreading computer viruses, and you get people suggesting that Microsoft developers should be arrested.

Putting Senders in Bondage

Spam makes some people so angry that they can’t see the difference between legitimate, opt-in, you-asked-for-it-and-they-made-sure-it-was-really-you bulk mail and absolute sleaze. So you get sensationalist articles like IronPort Arms Both Sides In Spam War. The article mixed up SenderBase, a database of email senders, with IronPort’s mail server business… and somehow concluded that selling mail servers made them a spam supporter. Well, I guess we’d better shut down Microsoft over Exchange, Sendmail over, well, Sendmail, and take out Dell, HP, and anyone else who sells servers that could be used for spam.

IronPort and Microsoft were later targeted with more FUD in Microsoft Will Sell Whitelist Services For Hotmail, which transformed Microsoft’s agreement to use IronPort’s Bonded Sender whitelist as part of their spam filtering into “Microsoft will let you spam their customers if you pay them.”

Blessed are the cheesemakers, indeed!

Bonded Sender, like Goodmail, is a whitelist to cut down on false positives (like when your airline ticket confirmation looks too much like spam and ends up blocked or in your spam folder). Basically you post a bond with them, promise not to send spam, and they put your server on a whitelist. For every complaint they get, they deduct money from the bond, and eventually two things happen: you get taken off the list, and you lose the money.

Yet in both Slashdot and the SpamAssassin mailing lists people started saying they’d use this list as a blacklist—despite the fact that it had been working fine in SpamAssassin for over a year and a half. Don’t these people pay any attention to the software they’re using? I mean, this is a server program, not something your average desktop user double-clicks to install.

Forging Habeas

The same thing happened a few months earlier when spammers started forging the Habeas mark. At the time, you could license a haiku from Habeas and add it to your outgoing mail as an “I am not a spammer” mark. Their license required that you stick to responsible mailing practices, and if you didn’t… well, that means you’ve used it without permission, and that’s copyright and trademark infringement. The wheels of copyright law turn slowly, so they used an IP-based blacklist to identify known infringers. The spam landscape changed drastically in the fall of 2003, and now most spam comes from virus-infected home computers acting as relays. It doesn’t do much good to block one IP address anymore, because an hour later they’ll be using another one. Habeas has since phased out the haiku in favor of an IP-based whitelist similar to Bonded Sender.

Anyway, people started to see spam getting through because it was forging the Habeas headers, and assumed it was a start-up, a front for spammers, etc., despite the fact that, again, Habeas had been in SpamAssassin for over a year. Again, they started talking about using it as a sign of spam instead of just disabling it. Even when one of the SA developers pointed out that all his outgoing mail was marked, the “block it all” crowd wouldn’t budge.

Why?

What is it that makes some people lose any sense of rationality? In the case of Slashdot I don’t expect much, but the SpamAssassin users list is made up of people who are acting as sysadmins, at least on some level. You’d like to think they have some ability to use reason.

It turns out that on certain issues, people react emotionally before rational thought has a chance to take hold. Brain scans show that conscious reasoning literally doesn’t happen. The research was done on political opinions, but it explains why people don’t take the time to RTFA and make up their minds based on the facts. As we’ve often heard, the facts are irrelevant when your mind is already made up.

Dashboard is, of course, Mac OS X only. Yahoo! Widgets (formerly Konfabulator) is Windows XP and Mac OS X only. The KDE Desktop (mostly used on Linux and *BSD), has plans to include floating applets in KDE4’s revamped desktop, Plasma. Opera runs on Windows, Mac, Linux, and a number of other platforms.

Opera’s taken a very similar approach to Apple’s. A widget is a bundle of HTML, CSS, and JavaScript. The most obvious difference is the structure of the bundle: Dashboard widgets are in a whatever.wgdt directory that’s been zipped, and Opera widgets are in a zip file that’s been renamed as whatever.wdgt. On the Opera Forums, Non-Troppo determined that they use different XML formats for metadata (name, version, author, etc.), and Rijk suggested that “As long as the Dashboard widgets don’t use Mac-specific API, it should indeed be easy to convert them.”

Yahoo widgets are a completely separate XML format, but it looks like it should be possible to build a widget that works on both Opera and Dashboard, or at least one you can convert easily to two downloads.

• Opera Widget Howto
• Dashboard Widget Howto
• Yahoo Widget Howto

After installing the A9 toolbar for testing, I decided I wanted to know just when they were contacting their server. I installed the Firefox versions of four toolbars and used netstat to see when they connected.

• A9 Toolbar: Constant connections to hosts at amazon.com and alexa.com, but only when the toolbar is visible.
• Google Toolbar: Opens initial connection to a Google-owned IP address. If PageRank display is enabled, or was earlier in the session, maintains continuous connections—even when the toolbar is hidden!
• Yahoo! Toolbar: Opens initial connections to a Yahoo server and to unknown.Level3.net (which, based on traceroute, appears to be on the way from here to Yahoo). Sometimes the latter remains open for a long time before closing. It does not appear to reconnect on its own.
• StumbleUpon: Only connects when you press its buttons.

Overall, these toolbars seem to behave in a privacy-friendly way. But it was disturbing that the Google toolbar keeps a connection open even when it’s hidden, and that disabling PageRank display doesn’t seem to stop the connections until you restart Firefox. (Maybe it does eventually, and I didn’t wait long enough.) If I’ve hidden the toolbar, I don’t need the functionality right then. There’s no reason to hold a network connection open until I re-show the toolbar.

If I only want to use these toolbars occasionally, I can just hide most of them through the View→Toolbars submenu. But to keep the Google Toolbar from phoning home, I have to either disable PageRank and restart Firefox, or disable the toolbar in the Extensions—and restart Firefox.

Anyway, it seems that Yahoo still offers $4.98 domains—depending on how you get there. Some of their ads offer the lower price, and if you come into the service through the ad, you get the discount.

It’s kind of like an automatic coupon.

It’s also a bit annoying that I could have spent half as much if I’d clicked on a different link.

Still, it’s only a $5 difference. I spend that much on lunch.

Sadly, it seems the IM wars have returned.

This time it’s Yahoo that’s blocked other clients from connecting to their networks. The most high-profile victim has been Trillian, another client which talks to multiple IM networks, but of course Gaim was hit as well. What’s interesting, this time, is that Yahoo claims it’s doing this to cut down on spam.

Now let’s think about this: In order to send and receive instant messages on Yahoo’s network, you need a Yahoo account, correct? So no matter what software a spammer uses to connect, he still needs to log in, which means Yahoo can control them inside the network. This is where current IM systems are fundamentally different from email: instead of many independently-controlled systems talking to each other, each IM service is one system with many accounts, more like a website with required registration. Place limits on what clients can do, and (barring bugs in your server) no matter what client someone uses, he can’t get around your spam/virus/hack controls.

To use the ever-popular phone analogy, let’s say that SBC, Verizon and AT&T each has its own phone system. You use an SBC phone to talk to someone else with SBC, a Verizon phone to talk to someone else with Verizon, etc. But Trillian makes a phone with three cables, that you can plug into all three networks (assuming you have service with all three). Now SBC says you have to use the SBC phone, no exceptions, and they say they’re doing it to save you from telemarketers. But the telemarketers can get free SBC phones too, so what does it accomplish?

The obvious explanation has always been the ads. If Yahoo/AOL/Microsoft doesn’t control the client, it can’t pump in ads, it can’t tie menu items and toolbar buttons to its other services, etc.

To be fair, Yahoo does provide a version of its client for Linux and FreeBSD (another reason I’ve avoided MSN – can you imagine Microsoft admitting there’s a market for it?), though the Linux client is only available for Debian and a few versions of Red Hat. (Even if they don’t want to release an open-source version, it would be nice if they provided a generic installer or just an unzip-and-run-it package). Of course, there’s nothing on the page to indicate whether they’ve updated it yet to deal with the protocol changes – we Linux users have to hope that either Yahoo will keep the client up to date or that third-party clients like Gaim will be able to catch up quickly.

Update June 25: Well, that was fast. Yahoo changed their protocol Wednesday evening. By Thursday evening, not only had both Trillian and Gaim released new versions, but the new Gaim had worked its way into the Fedora Core official updates!

Yahoo! will grant a royalty-free, worldwide, non-exclusive license under any Yahoo! patent claims that are essential to implement or use any Implementations so that licensees can make, use, sell, offer for sale, import, or yodel Implementations; provided that the licensee agrees not to assert against Yahoo!, or any other Yahoo! licensees of Implementations, any patent claims of licensee that are essential to implement or use any Implementations.

Yodel?