X-From_: folks-bounces@wikipedometer.net Mon Apr 27 22:13:35 2009
Return-Path: <folks-bounces@wikipedometer.net>
Message-ID: <49F6121D.7030301@post.pl>
Date: Mon, 27 Apr 2009 16:14:21 -0400
From: Piotr Konieczny <piokon@post.pl>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.8.1.21) Gecko/20090303 MultiZilla/1.8.3.4e SeaMonkey/1.1.15
MIME-Version: 1.0
To: Wikipedia statistics <folks@wikipedometer.net>
References: <982573.94167.qm@web33304.mail.mud.yahoo.com>
	<c3b2b3db0904270840m7ac81adfsf4b24a55e0d49ba0@mail.gmail.com>
In-Reply-To: <c3b2b3db0904270840m7ac81adfsf4b24a55e0d49ba0@mail.gmail.com>
X-Spam_score: -2.3
X-Spam_score_int: -22
X-Spam_bar: --
X-Spam_report: Spam detection software,
	running on the system "pakkun.mirky.net", has
	identified this incoming email as possible spam. The original message
	has been attached to this so you can view it (if it isn't spam) or
	label similar future email.  If you have any questions, see
	the administrator of that system for details.
	Content preview:  >
	http://upload.wikimedia.org/wikipedia/commons/c/c6/Kremlin_authorisation-Russian.pdf
	> > This letter disappeared for a few days (an error message), but >
	reappeared (with all words in the upper right corner blackened!) a >
	couple of hours ago. I did not tell about this letter recently to >
	anyone except you (until a couple of hours ago). [...] 
	Content analysis details:   (-2.3 points, 5.0 required)
	pts rule name              description
	---- ----------------------
	--------------------------------------------------
	0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
	-2.6 BAYES_00 BODY: Bayesian spam probability is 0 to 1%
	[score: 0.0000]
	0.2 AWL AWL: From: address is in the auto white-list
X-Spam-Checker-Version: SpamAssassin 3.1.7-deb (2006-10-05) on 
	pakkun.mirky.net
X-Spam-Level: 
X-Spam-Status: No, score=-2.3 required=5.0 tests=AWL,BAYES_00,
	FORGED_RCVD_HELO autolearn=unavailable version=3.1.7-deb
Subject: Re: [WPM] Attack on Russavia?
X-BeenThere: folks@wikipedometer.net
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Wikipedia statistics <folks@wikipedometer.net>
List-Id: Wikipedia statistics <folks.wikipedometer.net>
List-Unsubscribe: <http://wikipedometer.net/cgi-bin/mailman/listinfo/folks>,
	<mailto:folks-request@wikipedometer.net?subject=unsubscribe>
List-Post: <mailto:folks@wikipedometer.net>
List-Help: <mailto:folks-request@wikipedometer.net?subject=help>
List-Subscribe: <http://wikipedometer.net/cgi-bin/mailman/listinfo/folks>,
	<mailto:folks-request@wikipedometer.net?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: folks-bounces@wikipedometer.net
Errors-To: folks-bounces@wikipedometer.net
X-Spam_score: -2.3
X-Spam_score_int: -22
X-Spam_bar: --
X-Spam_report: Spam detection software, running on the system "pakkun.mirky.net", has
	identified this incoming email as possible spam.  The original message
	has been attached to this so you can view it (if it isn't spam) or label
	similar future email.  If you have any questions, see
	the administrator of that system for details.
	Content preview:  >
	http://upload.wikimedia.org/wikipedia/commons/c/c6/Kremlin_authorisation-Russian.pdf
	> > This letter disappeared for a few days (an error message), but >
	reappeared (with all words in the upper right corner blackened!) a >
	couple of hours ago. I did not tell about this letter recently to >
	anyone except you (until a couple of hours ago). [...] 
	Content analysis details:   (-2.3 points, 5.0 required)
	pts rule name              description
	---- ---------------------- --------------------------------------------------
	0.1 FORGED_RCVD_HELO       Received: contains a forged HELO
	-2.6 BAYES_00               BODY: Bayesian spam probability is 0 to 1%
	[score: 0.0000]
	0.2 AWL                    AWL: From: address is in the auto white-list

> http://upload.wikimedia.org/wikipedia/commons/c/c6/Kremlin_authorisation-Russian.pdf
> 
> This letter disappeared for a few days (an error message),  but 
> reappeared (with all words in the upper right corner blackened!) a 
> couple of hours ago. I did not tell about this letter  recently to 
> anyone except you (until a couple of hours ago). 

So refresh my memory: what was there that was so "dangerous" to them?
It has been publicly logged that Russavia updated the files on April 
26th. Somebody should certainly ask him why, perhaps with the (valid?) 
argument that messing with such files make make the permission invalid.

What is puzzling is that the old version is grayed out and inaccessible, 
I've just checked - revisions of past files should be preserved, I've 
seen it in many images (where you can access and revert to an old 
version) and same holds for pdf files. Example:
http://commons.wikimedia.org/wiki/File:Cheatsheet-en.pdf

I think somebody should investigate (ask on commons... maybe on IRC?) 
how one can remove ("gray") and old file. I don't think Russavia is a 
Commons admin, and nothing in his logs looks strange:
http://commons.wikimedia.org/w/index.php?title=Special:Log&user=Russavia
If the graying out is was out of protocol or illegal, that would be 
interesting :)

> Someone in Moscow reads 
> all our messages here. Please remember this.

I don't think that's very likely. Yes, we mentioned that letter, but so 
what? Sure, they have the means, but first, they would need to find out 
about us, and then, care.

Note that they don't need "spies" in our little group; they could have 
infected some of our computers with spyware; if Chinese can do it, I am 
sure the Russians are not far behind :> I'd suggest everyone takes a few 
minutes and runs a spyware check on their computers, not that I expect 
the government-level spyware will be easily detectable. Few more tips on 
computer security from a relative amateur like me:
* use some Firewall and Anti-virus software with runtime protection
* use Peer Guardian software - it's free and in theory blocks known 
governmental IPs from connecting to your computer 
(http://en.wikipedia.org/wiki/PeerGuardian)
* consider using some software that monitors and lists what soft on your 
computer can access the Internet; myself, I have to types of software 
that in theory do that: Norton Firewall and NetLimiter
* also, occasionally look at what stuff resides in your computer memory 
and make sure all looks legit. Here's the best solution I found so far 
(free from Microsoft!): 
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
Once you have the list, google the individual processes.
Again, this is not fullproof - the only way to be hacker-proof is to 
take your computer offline, and work in a Faraday Cage :D But if we are 
really compromised, I'd vote for spyware rather then a spy, and to be 
honest, I don't think it is unlikely, if Cartel USSR Forever really 
exists and is connected with Russian gov, for them to be able to request 
spyware to be put on the comps of their most dedicated opponents 
(Biophys, Digwuren - I'd really recommend you take the precautions I 
listed above!).


-- 
Piotr Konieczny

"The problem about Wikipedia is, that it just works in reality, not in 
theory."

_______________________________________________
Wikipedia statistics discussion list
folks@wikipedometer.net
http://wikipedometer.net/cgi-bin/mailman/listinfo/folks

