Below is the first paragraph of some spam I received today:

Dear Kip,

Since you recently supplied your email address to Marriott, you’ll now receive advance notice of new hotels, services to save you time and money, and hotel specials and packages.

Now, reread that, but this time use a cartoon super-villain voice, and end with “and there’s nothing you can do about it!  A-ha-ha-ha-ha-ha!!”

That’s more like it.

PS: Their unsubscribe page also told me it might take up to 10 days to complete the unsubscribe operation.  Idiots.

Last week I saw this post on Raymond Chen’s blog, which linked to two interviews with a former burglar.  The first covered the best places to hide money, the latter covered the worst places to hide money.  Which leads me to ask: are there actually people who have money in their house?  If you broke into my house, best case you’d find a hundred dollars, and it would all be in my wallet and Stephanie’s purse.  Usually we have even less cash than that on hand.  I don’t know why you would need cash these days.  I guess drug dealers only take cash, if you’re into that sort of thing.  But even then, couldn’t you stop by the ATM on the way to the drug deal?  Is there any other reason to keep large quantities of cash in your home?

P.S. I know that what is discussed here could apply to other small valuables (like jewelery), but in both interviews they are specifically talking about money.

On my way into work this morning, I heard a story on the radio about how back-to-school spending is supposed to be down this year.  One statement in particular, I felt, was worthy of blogging about.  This quote comes from one Patricia Edwards, an analyst at Storehouse Partners (whatever that is):

The trends, especially for the teens which is where a lot of the spending happens for back-to-school, they’re the same!  The only thing they’ve really added is plaid.  And, ya know, you go out and buy one or two plaid pieces of clothing, and you’re set.

Allow me to translate that to how it sounded to me:

KIDS THESE DAYS!  What is wrong with this generation?!  They care nothing about fixing the economy.  All they care about is saving their parents’ money.  We are in a financial crisis, people!  This is no time to watch your budget!  And to top it all off, they are too lazy to change their fashion styles all the time.  When I was a kid, if you wore the same outfit to school twice, you would have been ashamed of yourself.  And we made it a point to change what we wore every year, so that we could make fun of the poor kids that couldn’t keep up.  Now, all of a sudden, it’s like everyone thinks it’s cool to be poor, just because their parents all lost their jobs.  Sheesh, I don’t know where this country is heading, but we’ve got a long road to travel if these penny-pinching hooligans don’t go into debt soon.

It’s been a while since I implemented a spammer’s honeypot here on Vacant Nebula.  It has been extremely effective, so much so that I disabled the captcha.  All I do is put a hidden form before any blog posts are displayed.  Humans never see it, but spambots all see it, and apparently they are configured to submit spam to the first form on the page.  In fact the only spam that has gotten through in the last year has been spam that submitted to all forms on the page, not just the first one.  (I think this just happened once though.)

Fast-forward to a few days ago, I noticed that the excerpt of a page that Google shows displays the hidden comment submission form.  This doesn’t particularly matter, but I’d prefer it not be there.  So I added a check on useragent, and if it appears to be a search engine bot the honeypot is not displayed.  Well apparently spammers use a two-step process.  First they scan for blogs with forms while pretending to be googlebot.  Then they submit to those forms pretending to be a normal user’s browser (usually IE 5.5).

I know this because I got about fifty spam comments in the last two days.  If they were scanning the page with user agent reported as IE 5.5, they would have still seen the honeypot.  But the comments were submitted with user agent of IE 5.5.  Anyway, I’ve gone back to printing the honeypot for everyone, but only for the homepage.  Any permalink pages will not have the honeypot.  I’m pretty sure spammers don’t bother to go to the permalink pages, and search bots should only be indexing the permalinks.  Hopefully, both problems are solved.  If not, I’ll have to go back to a more fragile solution (something requiring Javascript, something requiring cookies, or even reinstating captchas).

Or maybe the spammers were just trying to wish me a happy twenty-seventh birthday by flooding my site with links to porn.

A bug report that came in from a customer a while back:

I found a fully reproducible scenario.  But the results are not the same all the times.

I’m pretty sure those two sentences contradict one another.

Last night Stephanie, Emma, Stephanie’s dad, and myself were traveling to Florida to visit Stephanie’s sister.  Along the way, we stopped for gas twice: once in South Carolina and once in Georgia.  Both times, it took far too long for no good reason.  At the first gas station, for some reason, you have to go inside and prepay for gas, even if you are paying at the pump.  This makes no sense.  The only reason to require someone to go inside and prepay is if they are paying cash, because you are afraid they will drive away.  When you pay at the pump, the gas station has already ensured that you have enough funds on your credit card to cover the gas.  The second time we stopped, an attendant walked up to us after we pulled up beside a pump and said they were changing shifts inside and the pumps were going to be off for about ten-to-fifteen minutes.  (Also, he was smoking at the time.)  Really?  It takes fifteen minutes to balance the books when you change shifts??  And again, we were paying at the pump, which means we didn’t need to pay the guy at the register anything, so why couldn’t they at least leave the pumps open for people paying there?

Anyway, I just thought I’d share.  Enjoy your Independence Day everyone!

This post has been retracted.  It discussed this overreaching Supreme Court ruling by doing precisely what the court ruled a felony: I made a link that claimed to point to the kind of content I don’t want to be associated with this site in search engine indexes, but in fact it pointed to www.google.com.  I guess you had to be there.

I’m sure you’ve heard that the Happy Birthday song is protected under copyright by the Happy Birthday Nazis, who actively seek compensation whenever the song is used in a movie or on TV.

As it turns out, their copyright claim has never been challenged in court and it may in fact be invalid.  Now we just need someone to challenge it.

Preventing spam comments is one of the most annoying things about having a blog.  In the past I’ve tried a few different methods to control spam.  My first attempt involved flagging messages as potentially spam if they had a bad referrer, came from certain IP ranges, contained certain keywords, or contained too many links.  The flagged messages wouldn’t be displayed until I approved them.  This method worked some of the time, but overall it wasn’t very effective and created a lot of work for me.

My next attempt was to implement a captcha system.  This has worked out pretty well, and I was surprised to find that it has been fifteen months since I started this policy.  Basically, any comment containing anything that looks like a link (“http”, “://”, “www.”, “.com”, “.net”, “.org”, “@”, “href”, and some others I can’t remember off the top of my head) would be sent to the captcha page.  This allows real humans to post comments with links, but stops most of the spam.  However, there was an occasional spam comment that had no links.  I’m not sure why the spammers would do this, unless they are trying to game systems where an IP is deemed “safe” after a non-spam comment is made.  In any case, I grew annoyed with cleaning up these comments, and I didn’t like that cookies are required if you get to the captcha page.

Over the break, I decided I would implement a type of honeypot.  I noticed that spam comments were always in response to my most recent post, even when comments were still open for other posts.  So I guessed that the spambots are looking for the first form in the HTML.  So I just stuck a comment form at the top of my page, and wrapped it in a hidden div.  No humans see it, but spambots do.

To judge the effectiveness, I logged any comments submitted to the honeypot.  Since I don’t value the privacy of spammers, I’ll let you view the log if you wish.  As of right now, 212 spam comments were submitted in 10 days.  Where it says “honeypot” means that the message was submitted to the honeypot form.  If it were submitted from a valid form but contained links (and hence, was given a captcha), you’d see “contains_links.”  But there aren’t any of those.

So now I have a system that is so far 100% effective, without requiring cookies and without breaking under tabbed browsing.  If this continues to be effective I’ll probably disable the captchas altogether.  Of course, the spammers could pretty easily overcome this obstacle if they tried.

This has been a crazy week for me.  It started last Saturday with the move and the craziness we encountered from both Budget and Time Warner.

Then on Sunday afternoon, thirteen days after buying our house and one day after we moved in, our air conditioner broke.  I called some of the people in the yellow pages that advertised 24-hour service, to see what it would cost to send someone out at 10:00 pm.  That ranged from $129 to $199, just to send someone out (not counting any work they would have to do).  We opted to wait until the morning.

Side note: I had two phone calls that went something like this:

“Our air conditioner is broken and I was wondering how much it would cost to send someone out tonight and how soon they could get here”
“You want someone to come out now?”
“Well... I mean, your ad says 24-hour service...”

That was a miserable night, it was at least 85 degrees, and very humid, inside our house, preventing anything that resembled sleep.  First thing in the morning we called someone out to fix it.  It turned out to be a problem with the tube that drains condensation being clogged, causing the unit to shut off (so that water does not overflow).  We may have a warranty that will cover the cost of the repairs, but we have to find that paper among the five hundred or so pieces of papers we signed.

So then Tuesday afternoon, on my way home from work, I got into a car accident.  Fortunately it was not serious, and I was hit from behind so it is not my fault, but we’re down to one car for a few days at least.  I’ll describe the accident with the aid of this diagram from the police report (what you see is this intersection):

So I’m car 2, and the guy who hit me is car 1.  Not shown is that there was a car in the eastbound lane of Poplar Tent Rd, waiting for an opportunity to turn left onto I-85.  I saw that this car would have to wait a while to make a left turn, so I started to make my turn.  But then another car heading east drove around the car turning left, in the shoulder, so I had to stop.  But the guy behind me thought I had gone and was looking left to see when he would get an opportunity to go as he moved forward, unaware that I had stopped.  He at least was cooperative, and didn’t raise a fuss when I said I wanted to get a police report (a police officer I know said to always do that, no matter how minor the incident, so that the other guy can’t change his story later).  We did have to wait about thirty minutes for the police officer to show up, and it was very hot while we waited.

You may not know this if you’re reading this from another part of the country, but we have had extremely hot and humid weather this week.  In fact, as I type this, it is 100°F, making this the third day in a row to hit 100.  And that’s not a heat index; that’s the actual temperature.  Yesterday it was 103, and it may get that hot again later this afternoon.

Something else I learned: lawyers and chiropractors are very quick to send you things in the mail after you get in an accident.  Our police report was made available at 9:00 AM on Wednesday, and we got things in the mail from two lawyers and one Chiropractor on Thursday, wanting to make sure they can cash in on our misfortune.  I anticipate many more such letters.

Lastly, if you’re feeling adventurous, view the Concord Police Department’s web page with Firefox.  Fantastic!  I’m guessing this is the result of a developmestuction environment.

All in all, quite a crazy week.