Bitforte: A masterclass in scamming

Comments

Earlier today I got an obvious scam email:

Return-Path: <no-reply@[redacted]>
Subject: Bitcoin Payment
To: Recipients <no-reply@[redacted]>
From: "Mr. Neves N" <no-reply@[redacted]>
Date: Mon, 11 Oct 2021 19:10:52 +0900

Hi Rob Hoffman, As requested, we have now deposited 30 BTC which amount to
($1,692,796.80 USD) into your bitcoin portfolio at bitforte.net/signin
 Customer Id: [redacted]
Customer Password: [redacted]

I was curious to see how this scam worked, so I fired up my favorite anonymizing VPN and private browser session and went to town.

UPDATE, March 31, 2022: It looks like these folks have changed their name to tatcoin.net. Same folks, same website, different name. Sorry, but that 30BTC payout sent to you by mistake is not real.

Read more…

10-year Anniversary

Comments

It’s now been 10 years since Chris died. I have now spent 5x as long grieving him, being messed up about him, than I spent with him, and that has also now covered approximately 25% of my life in total.

But he left that much of an impression on me.

Actions matter.

Garbage opinions

Comments

Today I got a market research survey from the garbage company which wanted to know my opinions about how valued I feel as a customer. One of the questions was a 1-10 scale of whether I’m “disappointed” or “delighted” with the service, and a text form where they wanted details for why I gave the rating I did. I had a lot to say, and I’m posting it here just so that it actually gets read by someone.

Never mind that the only reason I use you is that you have a local monopoly on waste management services, I am continually frustrated by how your workers will often skip my home, or will knock over the trash can and then not pick it back up or empty it out. Also, it would be great if you could institute a system where it’s paid by weight rather than container size; my garbage output varies widely from week to week and my bins are usually just half-full, but with just enough trash that going to the lower tier size wouldn’t be sufficient. Having it be based on actual weight of pickup would be a lot more fair.

It’d also be great if you’d partner with Styro Recycle to offer styrofoam recycling; right now my choices are either to drive to Kent (which is wasteful) or to put styrofoam in the trash (which is wasteful). In a perfect world things wouldn’t be packaged in styrofoam to begin with but that’s not something I, as a consumer, have control over.

An open letter to the .us domain registrar

Comments

I attempted to send this message to the .us registrar’s contact form but they kept on throwing up unreasonable, hidden barriers; it required a full first name that’s at least four letters long (sucks to have a name like “Jay” I guess) and “must only contain alphabets” (i.e. no punctuation or spaces, sucks for anyone with apostrophes) and the text input must be under 500 characters, with no indication of how many characters you’ve written.

So, I’ve submitted a very edited-down version, but am reproducing my letter in full here:

Hi, I have a number of domain names registered under several different TLDs. Most of them allow anonymous proxy registrations, with the sole exception of .us.

The lack of proxy registration causes me to get quite a lot of unsolicited calls, violations to my privacy, and attempted scams from bad actors who are all making use of the WHOIS database.

When will .us allow anonymous/proxy registrations, as is standard for pretty much every other TLD?

The current policy is especially problematic for marginalized people who are subject to protracted abuse, harassment, and threats of violence, and this makes .us unsafe for use for all but the most privileged of people.

I absolutely implore you to revisit this regressive, unfair, and downright dangerous policy that does nothing to actually improve the supposed security of the .us registration database.

9/11+20

Comments

You know what I miss about the pre-9/11 days?

People being able to go to the gate to greet the traveler as they arrived.

It was always so nice to welcome people, or be welcomed. After 9/11 that little ritual went away, because now only travelers themselves were allowed beyond the security checkpoint, and nobody wanted to wait for their loved ones outside of the security checkpoint, so that very quickly made way to people waiting in the loading zone, which then turned into waiting in the cellphone lot, trying to make the whole greet-and-pick-up process as soullessly efficient as possible.

There’s a bunch of other stuff that changed so much that people are talking about, but this is a thing that I haven’t seen anyone else mention. Just this little bit of humanity that was part of the travel experience.

Then again, everything we’ve lost comes down to little bits of humanity, in the end.

Studio and cat updates

Comments

Studio

My basement studio setup is coming along slowly but surely. I ended up buying a used ADAT preamp to expand my existing audio interface (rather than buying a new interface/patchbay/etc.) and it mostly works great, although I’m going to see if I can hack an S/PDIF decoder into a word clock source for it so that the 18i8 can be master (which makes a couple of things easier to deal with).

For now I’m using my old MacBook as the recording computer. It only has a 500GB drive, though, and I couldn’t find the power adapter for my external HDD enclosure, so I decided to try just running Native Instruments off of my NAS over gigabit Ethernet. Nearly every install failed with a nonsensical “malformed XML document” error, which turns out to be a known issue with attempting to install to a NAS. Oh well. Hopefully that PSU turns up soon. I’m sure it’s in the bottom of whichever box I end up unpacking last.

(The PSU isn’t anything particularly exotic in principle, just a 12V 2A center-positive wallwart, but for some reason all the 12V center-positive wallwarts I can find can’t accommodate its extra-thick center pin.)

But anyway, today I finally got to the point where I could hook up my piano, and so I played piano for the first time since April, which felt nice. I can’t believe I let it be this long. I guess I really thought the backyard shed studio would go a lot more quickly!

Read more…

Indieweb vs. Fediverse

Comments

Indieweb

You get someone’s profile URL, example.com/bob. You put that URL into a browser, and it shows you a human-readable profile which also contains machine-parseable data. You add the URL to your feed reader, and it subscribes to their posts with full attribution. The content is presented in your feed reader in a freeform way which allows a high degree of expressiveness, and it’s easy to go to the original post in case there’s some missing nuance or visual context.

All subsequent interactions are either directly between you and the person in question, or are webmentions which only get seen by your direct subscribers if you put them in your public feed.

Fediverse

You get someone’s address, @bob@example.com. You put that into your web browser, and you get a warning that says, “You are about to log in to the site ‘example.com’ with the username ‘%40bob’, but the website does not require authentication. This may be an attempt to trick you. Is ‘example.com’ the site you want to visit?” You back out of the error message and try to manually reformat the address. example.com/bob? 404. Maybe it’s example.com/@bob? That doesn’t work either. You read a tutorial on Webfinger addresses and learn that you can load their “resource profile” by going to example.com/.well-known/webfinger?resource=acct:bob@example.com. So you put that into your web browser, which then downloads a blob of JSON text. Buried in it is the URL example.com/user/bob. Finally, progress.

Now to follow them. You try putting the user address into your feed reader. Error. You try putting the profile URL into your feed reader. Error. You see a “Follow bob” button. It brings up a “remote follow” page which requires you to put in your own Fediverse username. You think you have a Mastodon account, so you try putting that in. It starts to initiate a weird three-way handshake, but fails.

You go back to your Mastodon instance and try searching on @bob@example.com. Nothing comes up. You try to figure out why. No users from example.com appear. You search through both your instance’s and example.com’s blocklists, which are hidden deep in their respective “about this instance” pages. It turns out that five years ago one admin on one server said something mean to an admin on a completely different server and that led to a widespread level of discourse that resulted in a bunch of instances blocking each other, and others joining in solidarity.

Finally you dig up an Atom feed for the user via finding a HOWTO that someone wrote seven years ago. The feed shows no posts, because the instance admin decided to disable Atom because it allowed blocked people to still follow the person who blocked them and they don’t understand Internet privacy. But it turns out it wouldn’t have mattered because this particular instance is set up so that the only way that posts appear on other peoples' timelines is by push notification.

You give up and get an account on their instance so that you can participate in the conversation. Now you have another instance to check all the time. 90% of your notifications are random spambots following you. The other 10% are you either getting tagged into random conversations by mistake, or some random person on another instance replying to something you said totally out of context and attacking you for their interpretation of a thing that had nothing to do with anything you were talking about. They get downright abusive, so you report the user. It turns out that the abusive user is also one of the admins of that instance so the report just goes to them anyway. They start posting anime memes about you. Your blocklist grows exponentially.

Finally you find some thoughtful long-form content. All of the posts are displayed in the form of a block of unformatted text followed by up to four badly-cropped images; no images can be inline, and even basic text options like bold and italics are unavailable, and web links either only appear as bare URLs, or aren’t obviously links because your instance’s stylesheet removes all formatting from them. You try to see a post in its original context, and it takes you to your instance’s view of their profile, which looks the same. You finally figure out that you can click on the date and that shows you the post on their public timeline. It looks the same, except now there’s no widget to let you automatically unfurl every CWed post in the thread for some reason like there was on your instance’s local view. But the instance’s local view is missing the first half of the thread because it happened before you subscribed to them.

One month later your timeline gets flooded with random unordered posts from 3 years ago because some forgotten instance’s Sidekiq queue suddenly got unjammed.

Finally setting up a recording space

Comments

I’ve been trying to make music in my small second bedroom/office, but it’s ridiculously constraining in here, and kind of frustrating. My long-term plan is to build a separate studio building in the back yard, but that’s slow-going and there’s a lot of barriers to it, and in the meantime, ever since I upgraded my house’s furnace to a ductless minisplit system, my basement actually seems to have enough space for my recording setup, so I’ve been looking into moving it down there.

Read more…

Setting up Postfix + Mailgun for multiple outgoing domains

Comments

For quite some time I’ve been having trouble with Gmail categorically classifying most of my outgoing mail as spam purely on the basis of my SMTP host being on a Linode VPS. No matter how much care and feeding went into my SPF+DKIM configuration, the Almighty Google would just arbitrarily decide that no, my email is not to be trusted after all. (This is pretty much the biggest reason why email is bad.)

After a brief kvetch about this with David, he pointed me at Mailgun, an enterprise-level SMTP relay (among other things). I’d looked at SMTP relays in the past but most of them are ridiculously expensive, but Mailgun has one very compelling feature:

It costs 80 cents per 1000 outgoing emails.

I send about 50 emails per month, so that means Mailgun will cost me a whopping… 4 cents per month.

I think I can afford that.

Read more…