A less insidious way to use Facebook?

I deactivated my Facebook account a couple of months ago. I just kind of got tired of seeing silly updates from friends and “friends” – people I’d friended but wasn’t really friends with. I was also frustrated by the privacy implications of using such a service: you tell it about yourself, you tell it about who you know and how you know them, you keep adding more information about you and your friends to its huge brain that it’s free to use or abuse however it wants.

I don’t know if I’m anti-“Social” or just antisocial but most of the info streaming into my Facebook feed was just not interesting to me. I could have hidden those people, but then it seemed like it would make more sense simply to remove the connection to them, if I didn’t want to see their updates. I actually went through my list of connections and started removing people – people I knew from high school and hadn’t spoke to since then until they added me on Facebook, and then continued not talking to them, and other people who I knew but didn’t really interact with, online or offline. I didn’t really care about what they had to say and it occurred to me that they didn’t care what I had to say. Why did we friend even each other in the first place? Well, the friend suggester (suggestor?) makes it easy to friend people who are only tangentially related, since its whole purpose is to find new people for you to add.

I remember there was one person from school whom I hadn’t spoken to since probably 4th grade. This person attempted to friend me 5 times on FB (Soandso wants to be your friend…) and each time I clicked “Ignore,” but on the 6th time I finally relented. After 2 weeks of inane updates I unfriended the person. Within a month I was getting requests to refriend. Why? I don’t know you, you don’t know me, what’s to be gained by us pretending to be e-friends?

So I had some fundamental problems with Facebook. In addition to the friending of barely-friends, the feeding of so much information into the Facebook brain was starting to bother me. This is pretty similar to my worries about Google’s reach; basically every bit of information you post to Facebook to share with “friends” is also being added to Facebook’s marketing profile about you and your friends. The more you use the service, the more they know about you. And all those “Like” buttons all over the internet – a way for you to inform your Facebook friends that you like a blog post or news story – those are just a way for Facebook to know what sites you’re visiting. Whether you click the “like” button or not, your browser is loading the button of their servers, which means Facebook is reading your cookie and knows that YOU visited the page. This annoyed me so much that I edited my /etc/hosts file to redirect http://www.facebook.com to 127.0.0.1 (my own computer) where I’m running Apache, so the Like buttons just render as 404 errors now:

But I’m fine with that. I’ve also set my browser to reject all cookies from *.facebook.com. I realize this is just a drop in the ocean of data for Facebook, but screw them. Even with my account disabled they were collecting data about me, and that just pissed me off. But much like Google, Facebook’s tracking ability transcends browsers and computers, since in order to use their service you need to log in, and thus your movements around the internet can be tracked regardless of which computer or device you’re using.

Facebook wasn’t a completely worthless service for me. I found the photo album feature very useful. It was a great way to upload pictures and share them instantly with whomever wanted to see them. In my case this was usually my family plus a few friends. I doubt anything will top Facebook for this because these people are already on Facebook, and for something to come along that’s better at this than Facebook, these people would need to move to the new platform, which as of today doesn’t seem likely.

Photo sharing is the one thing I miss. I haven’t stopped taking pictures but it’s a much clumsier process now to share them with people. I put them in an album in Picasa, upload it to PicasaWeb, set the permissions on the album, send out the invitations. The recipients then have to click on a private link to get to the pictures, and if they want to see them again in the future, they need to dig through their inbox to find the link and click on it again. Not everybody uses Gmail, and even for those who do, this is just a clunky process. With Facebook albums, if the album is shared with someone, all they have to do is click on me and then click on my list of albums to see the pictures. Easy. I’m considering returning to Facebook just to get the photo album back.

So I was thinking that if I could restrict myself to using only the Facebook iPhone app, I’d still be able to take the occasional picture with the phone, upload it for people to see, and not fall prey to the tracking cookie problems I described above, since (I’m assuming) the Facebook app and Safari don’t share data. At least, not yet.

That idea prompted me to write this post in the first place, but as I’ve been writing it it occurred to me that it’s not really a workable plan. If I’m using it I’ll eventually feel the need to login via browser, meaning I’ll have to tear down all the walls I’ve erected – the hosts file entry, the cookie blocking – and I’ll be right back where I was, feeding them all my info and letting them track me everywhere I go. So I guess it’s going to come down to a question of whether or not the costs outweigh the benefits, as it always does.

Unless I can just write a browser plugin to strip the “Like” button from non-Facebook websites. Maybe AdBlock can do this. Hmm… The dog woke me up early today and everyone else is asleep still, and this all sounded a lot better in my head before I started writing it down.

Why is my laptop so freaking hot?

HP Compaq nc8430, Core 2 Duo T7200 2.0GHz. Fedora Core 12 x86_64, kernel 2.6.32.19-163.fc12.x86_64 (just updated via yum).

At idle, with nothing running in the foreground, the CPU is around 70-72° Celsius, and the other sensors are 80°+. Why is this? It seems like every time I run yum update the machine gets hotter. I wonder if there’s any way to figure out what’s causing this. In any case, it’s pretty annoying. It’s uncomfortable putting the thing on my lap for any length of time.

Notice the temperatures at the top. The first two are Core0 and Core1, the other 2 are other sensors. The CPU is running at 1.0 GHz due to SpeedStep and the temp is still 70°C.

Edit: I forgot I’ve been logging temperature via sensord. I just turned the computer on after having it off all night and within 10 minutes the CPU is back up to > 60°C.

Aug 26 00:01:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 00:06:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 00:11:34 ehoffman sensord:   Core 0: 66.0 C
Aug 26 00:16:34 ehoffman sensord:   Core 0: 66.0 C
Aug 26 00:21:34 ehoffman sensord:   Core 0: 66.0 C
Aug 26 00:26:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 00:31:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 00:36:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 00:41:34 ehoffman sensord:   Core 0: 66.0 C
Aug 26 00:46:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 00:51:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 00:56:34 ehoffman sensord:   Core 0: 66.0 C
Aug 26 01:01:34 ehoffman sensord:   Core 0: 66.0 C
Aug 26 01:06:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:11:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:16:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:21:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:26:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:31:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:36:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:41:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:46:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:51:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 01:56:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 02:01:34 ehoffman sensord:   Core 0: 64.0 C
Aug 26 02:06:34 ehoffman sensord:   Core 0: 64.0 C
Aug 26 02:11:34 ehoffman sensord:   Core 0: 64.0 C
Aug 26 02:16:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 02:21:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 02:26:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 02:31:34 ehoffman sensord:   Core 0: 65.0 C
Aug 26 02:36:35 ehoffman sensord:   Core 0: 64.0 C
Aug 26 02:41:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 02:46:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 02:51:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 02:56:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:01:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:06:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:11:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:16:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:21:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:26:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:31:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:36:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:41:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:46:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:51:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 03:56:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 04:01:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 04:06:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 04:11:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 04:16:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 04:21:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 04:26:35 ehoffman sensord:   Core 0: 66.0 C
Aug 26 04:31:35 ehoffman sensord:   Core 0: 66.0 C
Aug 26 04:36:35 ehoffman sensord:   Core 0: 66.0 C
Aug 26 04:41:35 ehoffman sensord:   Core 0: 66.0 C
Aug 26 04:46:35 ehoffman sensord:   Core 0: 66.0 C
Aug 26 04:51:35 ehoffman sensord:   Core 0: 66.0 C
Aug 26 04:56:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 05:01:35 ehoffman sensord:   Core 0: 66.0 C
Aug 26 05:06:35 ehoffman sensord:   Core 0: 66.0 C
Aug 26 05:11:35 ehoffman sensord:   Core 0: 66.0 C
Aug 26 05:16:35 ehoffman sensord:   Core 0: 65.0 C
Aug 26 05:21:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 05:26:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 05:31:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 05:36:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 05:41:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 05:46:36 ehoffman sensord:   Core 0: 66.0 C
Aug 26 05:51:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 05:56:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:01:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:06:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:11:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:16:36 ehoffman sensord:   Core 0: 66.0 C
Aug 26 06:21:36 ehoffman sensord:   Core 0: 66.0 C
Aug 26 06:26:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:31:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:36:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:41:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:46:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:51:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 06:56:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 07:01:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 07:06:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 07:11:36 ehoffman sensord:   Core 0: 65.0 C
Aug 26 07:16:36 ehoffman sensord:   Core 0: 64.0 C
Aug 26 07:21:36 ehoffman sensord:   Core 0: 64.0 C
Aug 26 07:26:36 ehoffman sensord:   Core 0: 64.0 C
Aug 26 07:31:36 ehoffman sensord:   Core 0: 63.0 C
Aug 26 07:36:36 ehoffman sensord:   Core 0: 63.0 C
Aug 26 07:41:36 ehoffman sensord:   Core 0: 63.0 C
Aug 26 07:46:36 ehoffman sensord:   Core 0: 64.0 C
Aug 26 07:51:36 ehoffman sensord:   Core 0: 64.0 C
Aug 26 07:56:36 ehoffman sensord:   Core 0: 64.0 C
Aug 26 08:01:36 ehoffman sensord:   Core 0: 64.0 C
Aug 26 08:06:37 ehoffman sensord:   Core 0: 64.0 C
Aug 26 08:11:37 ehoffman sensord:   Core 0: 64.0 C
Aug 26 08:16:37 ehoffman sensord:   Core 0: 64.0 C
Aug 26 08:21:37 ehoffman sensord:   Core 0: 65.0 C
Aug 26 08:26:37 ehoffman sensord:   Core 0: 65.0 C
Aug 26 08:31:37 ehoffman sensord:   Core 0: 65.0 C
Aug 26 08:36:37 ehoffman sensord:   Core 0: 65.0 C
Aug 26 08:41:37 ehoffman sensord:   Core 0: 65.0 C
Aug 26 08:46:37 ehoffman sensord:   Core 0: 65.0 C
Aug 26 08:51:37 ehoffman sensord:   Core 0: 65.0 C
Aug 26 08:56:37 ehoffman sensord:   Core 0: 65.0 C
Aug 26 09:01:37 ehoffman sensord:   Core 0: 65.0 C
Aug 26 09:06:37 ehoffman sensord:   Core 0: 66.0 C
Aug 26 09:11:37 ehoffman sensord:   Core 0: 66.0 C
Aug 26 09:16:37 ehoffman sensord:   Core 0: 78.0 C
Aug 26 09:21:37 ehoffman sensord:   Core 0: 83.0 C
Aug 26 09:26:37 ehoffman sensord:   Core 0: 70.0 C
Aug 26 09:31:37 ehoffman sensord:   Core 0: 72.0 C
Aug 26 09:36:37 ehoffman sensord:   Core 0: 74.0 C
Aug 26 09:41:37 ehoffman sensord:   Core 0: 72.0 C
Aug 26 09:46:38 ehoffman sensord:   Core 0: 71.0 C
Aug 26 09:51:38 ehoffman sensord:   Core 0: 71.0 C
Aug 26 09:56:38 ehoffman sensord:   Core 0: 72.0 C
Aug 26 10:01:38 ehoffman sensord:   Core 0: 73.0 C
Aug 26 10:06:38 ehoffman sensord:   Core 0: 71.0 C
Aug 26 10:11:38 ehoffman sensord:   Core 0: 78.0 C
Aug 26 10:16:38 ehoffman sensord:   Core 0: 71.0 C
Aug 26 10:21:38 ehoffman sensord:   Core 0: 72.0 C
Aug 26 10:26:38 ehoffman sensord:   Core 0: 72.0 C
Aug 26 10:31:38 ehoffman sensord:   Core 0: 73.0 C
Aug 26 10:36:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 10:41:38 ehoffman sensord:   Core 0: 76.0 C
Aug 26 10:46:38 ehoffman sensord:   Core 0: 73.0 C
Aug 26 10:51:38 ehoffman sensord:   Core 0: 73.0 C
Aug 26 10:56:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 11:01:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 11:06:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 11:11:38 ehoffman sensord:   Core 0: 75.0 C
Aug 26 11:16:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 11:21:38 ehoffman sensord:   Core 0: 75.0 C
Aug 26 11:26:38 ehoffman sensord:   Core 0: 75.0 C
Aug 26 11:31:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 11:36:38 ehoffman sensord:   Core 0: 75.0 C
Aug 26 11:41:38 ehoffman sensord:   Core 0: 73.0 C
Aug 26 11:46:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 11:51:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 11:56:38 ehoffman sensord:   Core 0: 73.0 C
Aug 26 12:01:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 12:06:38 ehoffman sensord:   Core 0: 74.0 C
Aug 26 12:11:38 ehoffman sensord:   Core 0: 73.0 C
Aug 26 12:16:38 ehoffman sensord:   Core 0: 86.0 C
Aug 26 12:21:38 ehoffman sensord:   Core 0: 77.0 C
Aug 26 12:26:39 ehoffman sensord:   Core 0: 74.0 C
Aug 26 12:31:39 ehoffman sensord:   Core 0: 73.0 C
Aug 26 12:36:39 ehoffman sensord:   Core 0: 77.0 C
Aug 26 12:41:39 ehoffman sensord:   Core 0: 79.0 C
Aug 26 12:46:39 ehoffman sensord:   Core 0: 96.0 C
Aug 26 12:51:39 ehoffman sensord:   Core 0: 95.0 C
Aug 26 12:56:39 ehoffman sensord:   Core 0: 75.0 C
Aug 26 13:01:39 ehoffman sensord:   Core 0: 94.0 C
Aug 26 13:06:39 ehoffman sensord:   Core 0: 73.0 C
Aug 26 13:11:39 ehoffman sensord:   Core 0: 94.0 C
Aug 26 13:16:39 ehoffman sensord:   Core 0: 94.0 C
Aug 26 13:21:39 ehoffman sensord:   Core 0: 77.0 C
Aug 26 13:26:39 ehoffman sensord:   Core 0: 94.0 C
Aug 26 13:31:39 ehoffman sensord:   Core 0: 94.0 C
Aug 26 13:36:39 ehoffman sensord:   Core 0: 95.0 C
Aug 26 13:42:18 ehoffman sensord:   Core 0: 80.0 C
Aug 26 13:47:18 ehoffman sensord:   Core 0: 72.0 C
Aug 26 13:52:18 ehoffman sensord:   Core 0: 70.0 C
Aug 26 13:57:18 ehoffman sensord:   Core 0: 71.0 C
Aug 26 14:02:18 ehoffman sensord:   Core 0: 69.0 C
Aug 26 14:07:18 ehoffman sensord:   Core 0: 77.0 C
Aug 26 14:12:18 ehoffman sensord:   Core 0: 78.0 C
Aug 26 14:17:18 ehoffman sensord:   Core 0: 72.0 C
Aug 26 14:22:18 ehoffman sensord:   Core 0: 70.0 C
Aug 26 14:27:18 ehoffman sensord:   Core 0: 70.0 C
Aug 26 14:32:18 ehoffman sensord:   Core 0: 72.0 C
Aug 26 14:37:18 ehoffman sensord:   Core 0: 71.0 C
Aug 26 14:42:18 ehoffman sensord:   Core 0: 70.0 C
Aug 26 14:47:18 ehoffman sensord:   Core 0: 71.0 C
Aug 26 14:52:18 ehoffman sensord:   Core 0: 70.0 C
Aug 26 14:57:18 ehoffman sensord:   Core 0: 69.0 C
Aug 26 15:02:18 ehoffman sensord:   Core 0: 69.0 C
Aug 26 15:07:18 ehoffman sensord:   Core 0: 69.0 C
Aug 26 15:12:18 ehoffman sensord:   Core 0: 70.0 C
Aug 26 15:17:18 ehoffman sensord:   Core 0: 70.0 C
Aug 26 15:22:18 ehoffman sensord:   Core 0: 70.0 C
Aug 26 15:27:18 ehoffman sensord:   Core 0: 69.0 C
Aug 26 15:32:19 ehoffman sensord:   Core 0: 69.0 C
Aug 26 15:37:19 ehoffman sensord:   Core 0: 68.0 C
Aug 26 15:42:19 ehoffman sensord:   Core 0: 70.0 C
Aug 26 15:47:19 ehoffman sensord:   Core 0: 69.0 C
Aug 26 15:52:19 ehoffman sensord:   Core 0: 70.0 C
Aug 26 15:57:19 ehoffman sensord:   Core 0: 70.0 C
Aug 26 16:02:19 ehoffman sensord:   Core 0: 70.0 C
Aug 26 16:07:19 ehoffman sensord:   Core 0: 70.0 C
Aug 26 16:12:19 ehoffman sensord:   Core 0: 71.0 C
Aug 26 16:17:19 ehoffman sensord:   Core 0: 70.0 C
Aug 26 16:22:19 ehoffman sensord:   Core 0: 70.0 C
Aug 26 16:27:19 ehoffman sensord:   Core 0: 71.0 C
Aug 26 16:32:19 ehoffman sensord:   Core 0: 72.0 C
Aug 26 16:37:19 ehoffman sensord:   Core 0: 71.0 C
Aug 26 16:42:19 ehoffman sensord:   Core 0: 73.0 C
Aug 26 16:47:19 ehoffman sensord:   Core 0: 73.0 C
Aug 26 16:52:19 ehoffman sensord:   Core 0: 72.0 C
Aug 26 16:57:19 ehoffman sensord:   Core 0: 75.0 C
Aug 26 17:02:19 ehoffman sensord:   Core 0: 71.0 C
Aug 26 17:07:19 ehoffman sensord:   Core 0: 71.0 C
Aug 27 08:23:10 ehoffman sensord:   Core 0: 43.0 C
Aug 27 08:28:10 ehoffman sensord:   Core 0: 55.0 C
Aug 27 08:33:09 ehoffman sensord:   Core 0: 62.0 C

ldapsearch example on Active Directory

Just putting this here for safekeeping since I couldn’t remember the exact syntax.

[evan@ehoffman 10:35:50 ~]$ ldapsearch -x -LLL -D "ldapuser@example.com" -w password -b "OU=Users,DC=example,DC=com" -s sub -H ldaps://activedirectory.example.com "(sn=hoffman)" cn mail displayName samaccountname
dn: CN=Evan Hoffman,OU=Tech,OU=Users,DC=example,DC=com
cn: Evan Hoffman
displayName: Evan D. Hoffman
sAMAccountName: ehoffman
mail: Evan.Hoffman@example.com

Explanation: Connect to activedirectory.example.com using ldaps (SSL) with simple authentication, binding as ldapuser@example.com with password password; search for (sn=hoffman) within the OU=Users,DC=example,DC=com search base (branch), and search the subtree. Return the cn, displayName, and samaccountname fields.

Refer to the ldapsearch man page for more options.

ldapsearch on Active Directory

Just putting this here for safekeeping since I couldn’t remember the exact syntax.

[evan@ehoffman 10:35:50 ~]$ ldapsearch -x -LLL -D "ldapuser@example.com" -w password -b "OU=Users,DC=example,DC=com" -s sub -H ldaps://activedirectory.example.com "(sn=hoffman)" cn mail displayName samaccountname
dn: CN=Evan Hoffman,OU=Tech,OU=Users,DC=example,DC=com
cn: Evan Hoffman
displayName: Evan D. Hoffman
sAMAccountName: ehoffman
mail: Evan.Hoffman@example.com

The Thrill Is Gone

I have nowhere to vent. I’m just tired of it all. I keep telling myself I should just suck it up and deal with it but it’s really frustrating.

I’m easily amused

I don’t know why I find the visitor geo-tracking widgets so entertaining, but I do. I just found Revolver Maps and added it on the right side. It’s Flash-based so it takes a while to load but it’s interesting to look at.

I'm easily amused

I don’t know why I find the visitor geo-tracking widgets so entertaining, but I do. I just found Revolver Maps and added it on the right side. It’s Flash-based so it takes a while to load but it’s interesting to look at.

Blocking comment spammers by IP

I use Akismet to block comment spam, but it still annoys me that it even exists. Last night I put a simple IP ban into my httpd config. But who to block?

I used a grep & Perl to get a rough guess of which IPs were submitting the most comments (working on the assumption that one IP address submits many spam comments) It took me about 20 minutes to write this mess but it does what I wanted to do:

[root@lunix ~]# zgrep POST /var/log/httpd/evanhoffman-access_log-201008??.gz | grep comment | perl -ne 'chomp; $_ =~ m/(?:\d{1,3}\.){3}\d{1,3}/; print "$&\n";' | perl -e '%a = (); while (<>) { chomp; $a{$_} += 1; } while (my ($key, $value) = each (%a)) { if ($value > 1) { print "$value\t=>\t$key\n";}}'
2 => 218.6.9.140
180 => 91.201.66.34
2 => 213.5.67.41
2 => 188.187.102.74
[root@lunix ~]#

That’s pretty hard to read. Here’s a quick explanation of each piece:

zgrep POST /var/log/httpd/evanhoffman-access_log-201008??.gz

Use zgrep to search for the string “POST” in all of the gzipped Apache logs for August. Pipe the results (the matching lines) to the next part:

grep comment

grep for the string “comment”. This isn’t really scientific, but I feel safe in assuming that if “POST” and “comment” both appear in the HTTP request, it’s probably someone posting a comment. Pipe the matches to…

perl -ne ‘chomp; $_ =~ m/(?:\d{1,3}\.){3}\d{1,3}/; print “$&\n”;’

This is a perl one-liner that uses a regular expression to match an IP address in a given line and print it out. The original regex I used was \d+\.\d+\.\d+\.\d+, this one was slightly fancier but did the same work in this case. It’s worth noting that this will only print out the first match in the given line, but since the requester’s IP (REMOTE_ADDR) is the first field in Combined Log Format, that’s fine this case.

The output (the IPs from which comment posts have been made) is piped to…

perl -e ‘%a = (); while (<>) { chomp; $a{$_} += 1; } while (my ($key, $value) = each (%a)) { if ($value > 1) { print “$value\t=>\t$key\n”;}}’

This is another perl one-liner. Basically, it maintains a hash of String=>count pairs, so each time it sees a string it increments a “counter” for that line. Then when it’s done receiving input (i.e. all the data has been processed) it prints out the contents of the hash for keys that have a value > 1 (i.e. IPs that have POSTed more than 1 comment).

The output shows pretty clearly where the spam is coming from:

2 => 218.6.9.140
180 => 91.201.66.34
2 => 213.5.67.41
2 => 188.187.102.74

180 submits from 91.201.66.34. Out of curiosity I looked up that IP in whois:

[root@lunix ~]# whois 91.201.66.34
[Querying whois.ripe.net]
[whois.ripe.net]
% This is the RIPE Database query service.
% The objects are in RPSL format.
%
% The RIPE Database is subject to Terms and Conditions.
% See http://www.ripe.net/db/support/db-terms-conditions.pdf

% Note: This output has been filtered.
%       To receive output for a database update, use the "-B" flag.

% Information related to '91.201.64.0 - 91.201.67.255'

inetnum:        91.201.64.0 - 91.201.67.255
netname:        Donekoserv
descr:          DonEkoService Ltd
country:        RU
org:            ORG-DS41-RIPE
admin-c:        MNV32-RIPE
tech-c:         MNV32-RIPE
status:         ASSIGNED PI
mnt-by:         RIPE-NCC-END-MNT
mnt-by:         MNT-DONECO
mnt-by:         MNT-DONECO
mnt-lower:      RIPE-NCC-END-MNT
mnt-routes:     MHOST-MNT
mnt-routes:     MNT-PIN
mnt-domains:    MHOST-MNT
source:         RIPE # Filtered

organisation:   ORG-DS41-RIPE
org-name:       DonEko Service
org-type:       OTHER
address:        novocherkassk, ul stremyannaya d.6
e-mail:         admin@pinspb.ru
mnt-ref:        MNT-PIN
mnt-by:         MNT-PIN
source:         RIPE # Filtered

person:         Metluk Nikolay Valeryevich
address:        korp. 1a 40 Slavy ave.,
address:        St.-Petersburg, Russia
e-mail:         nm@internet-spb.ru
phone:          +7 812 4483863
fax-no:         +7 901 3149449
nic-hdl:        MNV32-RIPE
mnt-by:         MNT-PIN
source:         RIPE # Filtered

% Information related to '91.201.66.0/23AS21098'

route:          91.201.66.0/23
descr:          Route MHOST IDC
origin:         AS21098
mnt-by:         MHOST-MNT
source:         RIPE # Filtered

[root@lunix ~]#

Not much info other than the IP is based in Russia. Well, anyway, I IP blocked 91.0.0.0/8 (sorry, Russia), so if you’re in that subnet you’re probably seeing a 403 now.

Edit: It occurred to me that I can accomplish the same thing while being less draconian if I wrap the Deny in a <Limit></Limit> clause. This way everyone can still see the site but certain IP ranges won’t be able to POST anything:

<Limit POST PUT DELETE>
Order Allow,Deny
Allow from all
Deny from 218.6.9.
Deny from 173.203.101.
Deny from 122.162.28.
Deny from 91.
Deny from 213.5
</Limit>