IBM's FairUCE

Cute name. IBM today announced an alphaWorks project that's been kicking around for a while. Precis: it tries to match the sender IP to the purported sender domain. If it can't find a match, it falls back to something similar to challenge/response. The theory goes:

1. All spam is spoofed, so it will fail the IP/domain match and won't get past the challenge.
2. The vast majority of legitimate mail will pass the IP/domain match, so will be delivered without needing a challenge.
3. The only legitimate mail that needs to be challenged is sent by "power" users, who will know how to deal with a challenge.

This could initially cause false positive problems for some legitimate direct marketers who use some bulk email service providers. However, the problem is quite easily fixed.

Note that this doesn't fight spam, so much as fight spoofed senders. Much like SPF, in fact.

Note also that there's been a deal of lousy reporting (say hello to WSJ and CNN), saying that FairUCE somehow spams the spammers back. What a load of old cobblers, as we say over here.

From the quotes attributed to an IBM exec, I’m worried that this mis-reporting might actually be IBM’s fault.

Categories: spam.

Interview with a "spam list vendor"

This post at the Spam Kings blog talks about how a vendor of alleged spam lists has been shut down (at least for now). I tracked him down and had a quick chat with him on IM just now. His name is Jarvis Fitzgerald. He seems pretty pissed off...

richij (10:28:58 pm): hey, can we talk?
[redacted] (10:29:10 pm): sure
[redacted] (10:29:16 pm): good afternoon
richij (10:29:24 pm): good evening, from England
richij (10:29:34 pm): The name's Richi
richij (10:29:54 pm): I'm doing research into what happened with OptInSupply.org
richij (10:30:06 pm): wanna talk about it?
[redacted] (10:30:17 pm): whatta u wanna know?
[redacted] (10:30:27 pm): some ***hole called my hoster and had it shut down
richij (10:30:33 pm): yeah so I see
richij (10:30:52 pm): what's your side of the story? I heard the "***hole's" side
[redacted] (10:31:00 pm): first
[redacted] (10:31:06 pm): i've never spammed
[redacted] (10:31:24 pm): and i sell full data optins, which is the only way you can spam legally
richij (10:31:58 pm): by "full data" you mean that you can track back and prove the opt in?
[redacted] (10:33:12 pm): of course
richij (10:33:42 pm): I guess some people just don't like any form of DM
[redacted] (10:34:02 pm): well, that's bull****
[redacted] (10:34:16 pm): i'm servicing a legal industry
richij (10:35:51 pm): so what sort of places do you get the names from?
[redacted] (10:36:12 pm): companies
[redacted] signed off at 10:36:25 pm.
richij (10:38:27 pm): ohhh kayyy
Previous message was not received by [redacted] because of error (10:38:27 pm): User [redacted] is not available.

Categories: spam.

How to manage software projects

Tom Evslin is right on with these observations about how to manage software projects. This is just the sort of thing I was trying to do when I led and managed developer teams at HP. Short times between milestones, design for flexibility in the level of functionality, cut stuff to fit the due date. Back then, we called it iD: "incremental development."

HP software purists scoffed at these ideas. They held the view that "it's done when it's done." No amount of explaining the true commercial realities would convince them that due dates had a valid place in development schedules.

One aspect he missed: bribes for meeting milestones ;-)

Categories: software engineering, herding cats.

Security360 replay

There's a replay of today's Microsoft Security360 on phishing here (just the panel) or here (the whole hour). I was on the panel with the chief scientist of RSA and the CSE of Corillian.

Categories: spam, phishing, Microsoft, Security 360, richi.

The Councils Of Advisors

I do a bunch of independent, part-time consulting gigs. To help me get them, I joined The Coucils Of Advisors...

The Councils of Advisors is a global network of executives and industry professionals who are compensated for providing their insights to the world's leading investors. Members of The Councils of Advisors improve investment decision-making and accelerate business innovation by providing collaborative consulting to leaders in the investment community.

Council Members provide their industry knowledge to investors through telephone consultations, online surveys and scheduled in-person meetings. These exchanges provide Council Members with unique opportunities to consult with the investment community; in turn, investment managers gain a sharper understanding of the issues fundamentally related to their investments.

I'll let you know how I get on. You can apply to The Councils at this affiliated link.