More Casey Worship

Steeve

William — Wed, 16 Nov 2005 07:12:00 GMT

What music prefer?

re: More Casey Worship

William — Tue, 08 Feb 2005 02:16:00 GMT

Peter:

The criteria are easy:
1) Promise to always never take yourself too seriously
2) Push your boundaries and never be afraid to do something that's cool becuase you might ruffle feathers
3) Always be willing to knock over the apple cart
4) Send pictures of stippers!

re: More Casey Worship

William — Mon, 07 Feb 2005 22:33:00 GMT

Is this the lineup for the cult? Where do I sign up?

re: More Casey Worship

William — Tue, 01 Feb 2005 04:33:00 GMT

DAMN!! I take one Monday off and look what I missed!

I for one am on KC's side - mostly because I think what he did was not all that bad since it was only one post on less than 100 blogs (how many is that compared to the number of blogs that are on the 'net right now?) and he didn't release the code so it's not like some script kiddie can get his hands on it and go banana's with it...I also am on KC's side because I'm a proud member of the Casey Chesnut Sycophant Cult.

re: More Casey Worship

William — Tue, 01 Feb 2005 04:17:00 GMT

BTW, this has prompted me to revisit the code I posted on my site (Turing test) and look into doing something a bit stronger. The nice thing is, GDI+ makes it SO EASY to write up this kind of code (generating images, that is).

re: More Casey Worship

William — Tue, 01 Feb 2005 04:16:00 GMT

OK, I should clarify that I'm personally not pissed at Casey ('cause it's not my server, and I don't have a blog there, and in fact, my blog is quite open to comment spamming since I haven't connected my turing code to dasBlog), and it's *not that big a deal like slammer etc.*. Really. Just a few comments. The point is that you run it against someone's site without their permission, and taunt them along with it. The point is that it starts moving the line of what's acceptable.

It's nothing I can mathematically prove. It's just about where good taste and good decision is.

The reason to overreact still stands. You agreed that if the content was modified, it's clearly vandalism. "Clearly" -- see, judgement call.

And Casey, no, it's not asking for a patch for an inherently flawed design. Everyone here understands (I hope) that. The point is how you go about telling people, and as far as I (and many, many, others) are concerned, actually running it against someone's site is a rude and childish way to go about it. Everyone is welcome to their own opinion. If you guys go join MVPSecTalk (a good list for MVPs btw) you'll see.

So, just to make myself clear, I'm all in favour of talking about, showing, discussing, etc. At my site, I teach people how to go about cracking software. I don't think it's illegal at all (nor what Casey did, that's why I said "hopefully not", but I can envision some wierd reading of DCMA / antihacking laws that can make ANYTHING illegal).

I *don't* go around downloading sample programs, cracking them, and sending them back saying "see!". I don't go around connecting to people's shared printers and printing out "You're insecure fool! lolo1l1!!"

So if Casey wants to even post a bloody library that does awesome OCR... whatever. Spammers are pro operations, and they'll hire 5 guys like Casey to write AI code day and night. So I'm not worried that there's a proof of concept or some leaked info (this isn't a security hole). I just think it's tasteless and sets a bad precedent.

re: More Casey Worship

William — Mon, 31 Jan 2005 23:52:00 GMT

And if Casey really wants to be cool - he'll write something to strip the word 'clearly' from all posts (actually, that's one of the things I'm including in the new site).

re: More Casey Worship

William — Mon, 31 Jan 2005 23:50:00 GMT

For what it's worth - I don't think it's a judgement issue at all. Like I said - I personally never would have thought people would have gotten mad. Maybe I just have poor judgement too - but again - I don't know that this means someone has bad judgement. First, he pointed to the article he wrote - sent 1 message and explained himself in the article. Put it this way - he did the absolute least intrusive way he could do it - didn't hide who he was or anything like that, did it to fellow MVPS. I mean, don't you get away with stuff in your own house or amongst your own friends that may be over the line elsewhere? And being that he took every step to be cool about it - I just don't see what the issue was.

If you're Susan and you got 20 emails from people who were pissed off , then ok - she was inconvenienced. But heck, we've all spent more time talking about it then it ever cost to deal with.

No harm no foul - especially if you do something cool and no foul. If it was lame, then it might be annoying - but you have to admit, it was pretty damned cool. I've heard the stuff about other folks can do it - but I don't know I buy that - sure some people can but from a tech perspective - it's impressive. From figuring out how the captcha worked to analyzing it. I didn't even know that there were only x number of letters there and I sure as hell didn't know about the timing issue. THat explains a lot. At worst the 'offense' rises to the level of jaywalking - and I just don't see the big deal.

re: More Casey Worship

William — Mon, 31 Jan 2005 23:47:00 GMT

Michael: I don't work *in* security, but I have a fair amount of exposure to it. I'm not sure that's the point, and I'm not sure I like being harpooned, but okay. No I don't work in security and I wouldn't call myself a security professional by any stretch of the imagination.

Maybe I was irresponsible in my choice of words, but I don't think that comparing this thing to Slammer is fair. My position, simply put, is that the code he wrote was cool. I mean..i'm a total geek, and this is just a technically cool hack. I don't care if someone else has a way to beat it, or if it doesn't work on some CAPTCHA implementations. This was a quick and dirty, targeted to one CAPTCHA, hack. Having no expertise in neural networks or character recognition, there's a wow factor. And the fact of the matter is that I thought it was a succinct way to point out what may have been the obvious, that captca sucks. But sometimes we need the obvious pointed out.

I think you and some others are looking too hard to find some evil ulterior motive in casey, and it's just not right. I don't know...maybe you don't read his blog and have never been exposed to his sense of humor, but the quote you cite about "blowing you out of the water with comment spam" was clearly (I know bill loves that word) tongue-in-cheek jesting if you are at all familiar with the way he writes.

Anyway, it's cool. Bill doesn't think it's a big deal about the spam, I didn't get spammed so I don't have an opinion on that either way. As someone above pointed out it was a good test bed, pick a bunch of blogs and run it, but maybe he should have asked permission first. Hindsight being 20/20 and all I guess we can say he did it poorly. But is it really the important thing, and worth all the fighting and pissing and moaning? Or should the focus be on the technical part, and what can be done to build a better mousetrap in light of this?

Just my two cents. And thanks for your comments on my blog earlier...it's why we do this blog thing, to get other input you know?

re: More Casey Worship

William — Mon, 31 Jan 2005 23:39:00 GMT

You security guys want there to be a patch before you publish a security break. Thats fine for the products you work with, but CAPTCHA is a flawed concept ... you cant patch it ... its the best we have now, but we need to move to something else. And the web site has BIGGER problems. Note the comments above on how Roland used the CommentAPI to post ... totally bypassing CAPTCHA. Never mind people manually doing it or social engineering ... or that most blogs dont have CAPTCHA at all.

It is definitely not illegal ... how do you even think that it might be? What I did was post a single comment to 94 different public web logs. Totally legal ... just because you dont like it ... is moot. The 'blow you out of the water' has 'just kidding' right after it. Its meant to be funny. Have a sense of humor (period). Overstep my bounds? ... what bounds? What permission? ... the web pages are open to the public for comments. Legality is the only bound ... and its clear that this was not illegal. There is nothing wrong with my judgement at all.

re: More Casey Worship

William — Mon, 31 Jan 2005 23:33:00 GMT

<<However, he ran a bot against someone elses server without permission. Is it illegal? Hopefully not. Is it correct/ethical or mature? Nope. >>

To that end, Susan has a right to be upset - it's her servers, bandwidth et al. But for most of us - it's one email.

<<Today it's "I posted a comment to show your image protect didn't work". Tomorrow it's "I modified your articles to show you had an error in your authentication module." >> I guess it's a matter of where you draw boundaries - and if it was I modified your articles that's clearly vandalism.

<<Bill, it's an HONOUR to get spammed like this? What if it had been the same software spamming 100 male 'enhancement' products? >> If it was 100 of anything I'd be pissed about it. But that distinction is the difference between someone flipping me off and someone punching me.

I think what the boundaries are varies depending on who's involved. Would I be pissed off if it was my server and it was someone I didn't know or wasn't friends with? No, if it was the exact same thing. Some people get insulted for instance, over everything. Some folks don't get insulted over anything. Where is that line? I don't know. This is the same thing. But honestly, if you would have asked me "Bill, do you think that this will upset a lot of people or really upset anyone, two days ago I would have said "No way". Obvsiously I'd have been wrong though.

There are no doubt other people who wouldn't care about stuff that would piss me off. To that end, I've maintained that Susan - who's the owner of this site has the right to be mad. But what about me for instance. At worst it would take me all of 10 seconds to delete the post. Maybe I'm just too impressed with the technical content of it - in comparison to the 'inconvenience'.

I see what your point Michael - I really do. I just don't think that what he did was a big enough deal to matter but I see I'm in the minority.

So how in the h3ll did you hack your ISP? That takes some serious cojones.

re: More Casey Worship

William — Mon, 31 Jan 2005 23:11:00 GMT

Scott: "I disagree completely Michael - What better way to prove the point than to defeat the CAPTCHA"

Do you work in security at all?

"What better way to show that SQL had problems than Slammer?"

"What better way to show you don't follow safe computing practices than send $1 from your account to mine?"

Scott and Bill:

The REASON we 'overreact' to small things is to set the standard. There are lines when it comes to investigating and publishing and executing. In this case, it's not a "hole", as in an overflow. So it's fine for Casey to write about AI.

However, he ran a bot against someone elses server without permission. Is it illegal? Hopefully not. Is it correct/ethical or mature? Nope.

When I was in my mid-teens, I hacked my ISP, downloaded their customer DB, and then printed stuff out on their printer telling them to call me. It did a good job of "showing they had issues". But it was the wrong way.

Also, his attitude about the whole things show's that he's acting rather immature and foolish. "OK, I'll stop unless you spam me and then I'll blow you out of the water"? WTF?

Want to act all cool and write cool software? Go ahead. Want to publish how you do things? Fine. Just don't overstep your bounds (other's peoples systems are not in your bounds).

Today it's "I posted a comment to show your image protect didn't work". Tomorrow it's "I modified your articles to show you had an error in your authentication module."

Bill, it's an HONOUR to get spammed like this? What if it had been the same software spamming 100 male 'enhancement' products?

For the record, I'm annoyed at Casey's immature attitude about it, and that he didn't bother asking anyone for permission first. He would have still got the "cool points" for being so smart and writing AI if he had just emailed everyone and shown them, as well as posting the same article to his blog. Going and executing the attack just shows that while his tech skills are great, his judgement skills need some refinement.

re: More Casey Worship

William — Mon, 31 Jan 2005 22:38:00 GMT

Aha! Casey found the timeout problem. 1 minute to download the image, 1 minute to post and submit? O-U-C-H. Of course he only used this CAPTCHA and there are a couple of others out there. His point is valid that any generated image can be trained to be read. Using a computer to make the image doesn't mean you can't use the computer to decode the same image.

Spamming 94 people may have been excessive but without a proper (semi) high test case, how can you prove the algorithm? I find in my coding that I often miss test cases (where I can't unit test) and if I were to simply test EVERYTHING I'd have found a couple major bugs. I don't get the number 94 though. Sounds like he used 100 but 6 of them didn't go through. Why choose that specific number? I would have chosen an odd number or possibly a rounded one like 100, not 94.

Casey did the right thing by exposing the "security through obscurity" that has been presented through CAPTCHA. It's not the best answer to comment spam nor do I propose it be an answer at all. It's just an extra layer that people don't even want to deal with. Introduce better techniques like filtering SQL input or dealing with the problem directly. Patching symptoms with small bandaids isn't going to solve this one.

To be thorough nofollow doesn't solve or attempt to address comment spam. It simply keeps commenters from being as relevant as the bloggers which is only one incentive to comment spam (not the only one, nor will it ever be). Spam has to be plugged as the holes are found as there's really no holy grail. Even baysian filters are proving to be inadequate so there really is no single reliable method for preventing spam. We can only hope for a decent layered approach.

re: More Casey Worship

William — Mon, 31 Jan 2005 21:46:00 GMT

Well Randall - it looks like it came from her address but it's possibly a spoof. I don't know - I've known Susan to be a really cool lady and well - this whole thing sucks b/c Casey was just trying to do something cool and it's turned into a mess. Maybe it's a spoof - maybe it's not. I appreciate you looking out for me my man.

I just want to know what Casey is going to do now to top this feat ;-)

RE: More Casey Worship

William — Mon, 31 Jan 2005 21:35:00 GMT

'So how' --> 'some how'. Shoot, RSS Bandit doesn't check my grammer.

RE: More Casey Worship

William — Mon, 31 Jan 2005 21:33:00 GMT

Bill, so how 'Susan' doesn't sound authentic to me. She commented on KC's article and signed 'Susan Bradley', yet here it is 'Susan Bradley [MVP]'. Also, what is written doesn't makes sense to me. Maybe someone is trying to proof to her that you can steel identity as well. And, if she really meant it, and be a 'man' about it, she would make an entry on her own blog.

If it gets through, then this message is spam is well. I used the CommentAPI via RSS Bandit and didn't even had to add an e-mail address. But as KC said, using the CommentAPI is too simple. :-)

re: More Casey Worship

William — Mon, 31 Jan 2005 16:55:00 GMT

Susan:

You are the only one that had any right to be pissed IMHO - it's your site, bandwidth etc and you were just looking out for people. I haven't been wronged by anyone and no apologies are necessary.

re: More Casey Worship

William — Mon, 31 Jan 2005 16:49:00 GMT

hey casey,

There's two different issues here, one is your spamming folks, and the other is the usefulness of captcha. Yes we agree that Captcha is bad (although at present it has reduced spammers, be it only temporary)

But I think you are missing the point. There was no need for you to spam so many for your POC. Simple fact.
And I really don't think because soemone critices that action, that you should then say they got mad and try to belittle the wrongness of your action. SPAM is SPAM.

And as to your 24 hours, well you could have spent that far more productively... I'm amazed you limit yourself to CAPTCHA when you could have written a filter, or implemented a simple conversation key.
http://msmvps.com/bill/archive/2005/02/01/34478.aspx

So when all is said and done, what have you added ? AHve you fixed the problem, had any cool code you could or should share ? Anything constructive ??
And no spamming 90+ people is NOT constructive ;)

My Apologies

William — Mon, 31 Jan 2005 16:46:00 GMT

I just wanted to make a formal apology for my earlier words on Casey's comment section on his website. I realize that not everyone wants to live in a world that I fully control. Further, I have come to understand that a resource that I place on the internet has a certain degree of public ownership in addition to private responsibility. As such, I have come to the conclusion that I have been arrogant and conceited in my dealings with the MVP community. You are not my children, and I am not your "Mom", rather, you are able, thinking adults, and have the free will to serve the community as you see fit. Please accept my apologies.

Susan Bradly [MVP]

re: More Casey Worship

William — Mon, 31 Jan 2005 16:13:00 GMT

Casey - Bill's a good dude but I'm not agreeing with him here. I know that I can hold my own in .NET and just reading the pixels took me a while. I'm sure there are others that can do it - but I don't think it's greasy kids stuff by any means.

And the thing that seems to come up is that you were being an attention whore or a show off. I just don't see it - because if you were, then youre a total dumb a33 that couldn't tie his own shoes - there's a lot better ways to get attention and you could have gotten a lot more bang for the buck - and somehow I don't think you missed that point. If you were looking for attention - you'd have done it in a much more compelling fashion - no doubt about that. Plus the 40 disclaimers you wrote about it....

No harm, no foul - and the article is kick a33 - If someone wants to prove me wrong -fine, write one that's more accurate in less time but I think it's a lot easier to say how easy it is to do something than actually do it.