My Blog Is NOT Spam

Don’t get me wrong here. This is, currently, not my problem. But it was once, long ago.

I suffered the indignity of solving the Captcha, over and over, for at least a week. And unlike many here, I don’t just write a blog post. I write, and rewrite, and rewrite the rewrite. Then I add a couple links, to other posts, and reverse link those posts to my latest post. So each post, for me, would be a dozen (minimum) publishes, and a dozen (minimum) opportunities for me to solve the damn Captcha.

Then somebody wrote here about the link, which I had looked at each time I solved the Captcha.

My blog is not spam.

DOHH. I clicked on the link. Two more clicks, and I was done. I got a bot reply an hour later, and same day, a final reply.

I logged out of Blogger and back in, and posted a test. No more Captcha.

Unfortunately, not everybody has an easy experience like that. Many people write that they have submitted the request from

My blog is not spam.

at least once, and they are still waiting for service. And to them, I say

Submit it again.

It takes maybe 10 seconds to submit the request.

How long did it take for you to write your latest complaint? How long did it take for you to read this post?

Submit it again. Hourly, if you post that often.

(Edit 10/3): Some folks have reported seeing just a “?”, where the “My blog is not spam” would be. And clicking on the link brings them simply to the Blogger Help documentation. Well, nobody ever successfully accused Blogger of being totally consistent, or insightful. My regrets to you, if that’s what you’re faced with.

Publishing Problems – Classic Blogs

The problem of the week is Publishing.

You’ll have a variety of symptoms, when publishing to a Classic blog.

• The ever present spinner of death, which does not end.
• The spinner of death gives way to a white screen.
• The spinner is never seen, you get a white screen immediately.

What’s worse, the post that you’re publishing may or may not actually be posted. You’ll not find out unless you

• Open “Edit posts” in a separate window, and refresh the view periodically (when publishing a new post).
• Open “View Blog” in a separate window, and refresh the view (when publishing an update to an existing post).

The Google Blogger Help forum is buzzing with complaints. One guy has started a thread advising us how to contact Google Investor Relations (since Google itself cannot be contacted).

I, personally, experienced all of the above symptoms, in trying to publish this article. I had to resort to resubmitting the post, and risk making a duplicate post, to get around the white screen, after I hit “Publish Post” the first time.

I fear that this may be only the beginning of the end of Classic blogs, as I predicted some time ago. Maybe it’s even a (highly misguided) effort by Blogger Support to get its customers eager to switch to Beta blogs. Observations, and speculation, has already started.

• Problems publishing – I can’t even get to the end of this one, it’s being updated so frequently. Maybe we need a new forum just for this issue.
• PUBLISHING PROBLEMS, with an (excerpted) message from BS
  

  Hi there,

  Thanks for writing in. We are currently focusing all of our efforts on improving Blogger and Blogger in beta and getting beta ready for all of our users to switch over. In order to help improve Blogger as quickly as possible, we are going to focus our efforts on reading the problems you are experiencing and working on solutions immediately. We’ll follow up with you only if we require additional information or if we have additional information to share. However, we do have some other resources to help you out.

  In the Blogger Help Group, experienced users can answer your questions, or you may find that your question has already been asked and answered in the archives. We also have a Blogger employee monitoring the group to provide assistance. You can visit the help group here:
  http://groups.google.com/group/blogger-help

  which, of course, puts us back here with the other sheep. Maybe Blogger Employee or Pete Hopkins will drop by.

• Problems publishing new posts
• yep same prob here downunder, for an International flair.

Can we summon Pete Hopkins, as Candyman could be summoned?

Pete Hopkins
Pete Hopkins
Pete Hopkins
Pete Hopkins
… Shall I do it?
Pete Hopkins

I’ve come for you.

(Edit 9/28 16:30): Looks like this problem was SPLOGGERS. Dirty sploggers. Assholes.

Bots And You

For those of you who are maybe living in a cave (and if so, what ISP services you?), of the millions of computers in the world, a good portion of them are not controlled completely by the person who is paying for their Internet service. These computers, hijacked by a successful hacking campaign, and controlled by another person, we call bots. One bot is useless; bots are maintained in collections, called botnets. A botnet could range in size from 10,000 to 1.5 million hijacked computers.

I’ve been observing, and writing about, botnets for some time.

• In November 2004, some bad guys very deviously hijacked a German advertising server, and 4 other servers, and delivered the Bofra / IFrame exploit to 5,000 – 10,000 computers. These computers became part of a botnet.
• In May 2005, we saw a practical application of a botnet, as the Sober worm was used to distribute spam relevant to a German political battle.
• This year, we have botnets being used to hijack Blogger blogs, and create networks of blogs serving spam.

Most people don’t realise that botnets are both the origination vehicle, the medium, and the payload of a successful attack. And the smarter botnet managers use botnets to manage the botnets used in an attack.

Attack Origination
Botnets are used to originate an attack. If any of you owns a server, and you review the server access logs (and if you do, and don’t, you better remove your head from the place where the sun don’t shine, and start), you’ll notice anomalies.

• Password attempts
  

  aaaaaaaa
  aaaaaaab
  …
  aaaaaaaz
  aaaaaaba
  …

  has to be observed – it’s an obvious attack!

• Any seemingly random series
  

  Abracadabra
  MyDogHasFleas
  NowIsTheTime

  coming from the same computer, is pretty obvious too.

• You probably won’t notice
  

  Abracadabra coming from a computer in Russia
  MyDogHasFleas coming from a computer in Brazil
  NowIsTheTime coming from a computer in USA

  as an attack. That might be one, but how can you tell? Botnets are distributed widely, and are perfect for distributed, throttled attacks.

Attack Medium
Botnets are used to transmit an attack. A lot of spam consists of links to websites, and the business of the spammer will be conducted from a website. This requires 3 highly specialised servers.

• An email distribution server. This will typically be a server running Simple Mail Transfer Protocol (aka SMTP).
• A website. This will typically be a server running HTTP (and if you use the web, you know about HTTP).
• A DNS server, providing the IP address of the HTTP server.

If you know anything about reading email headers, you should know about those 3 servers, and the fact that in almost every case, professional email will use 3 separate servers, frequently on the same subnet.

You can generally consider email validity, and filter your email, based upon the servers involved. Any time you get email, and you find it using the same server for DNS, HTTP, and SMTP, it’s possibly bogus. If 3 servers are used, but they are on different subnets, or even in different countries, it’s probably bogus.

Modern spammers, though, can easily use 3 separate computers on the same subnets, so open are many ISP address spaces (customers) to being botted.

Attack Payload
Botnets are the payload of an attack. A lot of websites linked from the spam, which you have gotten used to as simply containing advertisements for products of varying legitimacy, may instead carry trojans. If you fall victim, and infect your computer, it becomes part of the botnet.

Attack Management
To understand botnet management, and how sophisticated it has become, let’s look at the history of botnet use.

• Originally, the trojans distributed would contain the IP address of the attacker. Each botted computer would load the bot, contact the computer owned by the botnet master, and await instructions. That was a major exposure to the botnet managers. So, they cloaked their identity.
• Each botted computer would attach to the Internet, frequently into an IRC forum, and await instructions. The botnet manager would login to the same forum, and provide instructions. That was a slight amount of exposure to the botnet managers, so, they further cloaked their identity.
• With botnets being so easy to use, the botnet managers will now proxy their access to the IRC forums thru another botnet. That botnet is never used in an attack, it’s only used to hide the identity of the botnet master.

This is why I have described all of this – both the attack attempt, the medium, and the payload, as hacking. That’s all it is. And botnets are at the center of it.

And that’s what botnets have to do with you.

Automatic Metrics and The Ability To Roam Wirelessly

If you have a portable computer, and you’ve setup a WiFi LAN in your house or office, you’ll enjoy the freedom of moving around the house, at will, while still connected to the LAN. Even so, sometimes there will be times when the WiFi connection isn’t enough. You’ll never get rid of Ethernet, completely.

Most portable computers come with an Ethernet adapter, and a WiFi adapter, installed and activated. The Automatic Metric feature in Windows XP let you leave both connections activated, and will use the fastest connection, that is working, at any time.

You can use automatic metrics (by default), or you can manually change the settings to prefer either connection, using the TCP/IP Properties – Advanced wizard.

NOTE: Using the Automatic Metric feature on a laptop having a role as a server on your LAN may cause problems with the browser infrastructure. Don’t carry a server around without understanding the complications.

Know Who’s Accessing The Server

Most computers in a workgroup will run as a server, and some computers in a domain will too. Servers do not have unlimited capacity to serve you, and occasionally, they run out of available connections. You’ll be trying to access another computer, and you’ll see a message that you don’t want to see

No more connections can be made to this remote computer at this time because there are already as many connections as the computer can accept.

And this can also be an issue, when you need to know, in general, what your computer is doing.

So what do you do now? Do you run around, turning off some computers, just so another computer can connect, or just to see if this computer will stop doing what you’re wondering about? Sometimes, that’s the only diagnostic left to us, but just maybe you can be a bit more methodical, this time.

You can start by identifying who’s accessing the server right now. And you can use either one of two tools.

• The Computer Management – Shared Folders wizard.
• The “Net” commands.

Computer Management
Computer Management is a tool in the Administrative Tools section of Control Panel.

Under Computer Management, you find System Tools, then Shared Folders.

Shares enumerates each share on the server, and the number of connections that are in use for each share. This is where you start, when the server has exceeded its connection limit.


Sessions enumerates the accounts being used for access, and the remote computers, by IP address.


Open Files enumerates the open files and folders, and what accounts are being used for access.


The command window based Net command, with 3 of its sub commands, will provide information similar to the Shared Folders wizard.

Net Shares enumerates the shares on the server.

C:\>net share

Share name   Resource                        Remark

-------------------------------------------------------------------------------
E$           E:\                             Default share                     
IPC$                                         Remote IPC                        
D$           D:\                             Default share                     
ADMIN$       C:\WINDOWS                      Remote Admin                      
C$           C:\                             Default share                     
CDrive       C:\                             
DDrive       D:\                             
EDrive       E:\                             
Quarantine   E:\Quarantine                   
System Resources
             E:\System Resources             
Utility      C:\Utility                      
The command completed successfully.

Net Sessions enumerates the remote computers (by IP address) and the accounts being used for access.

C:\>net sessions

Computer               User name            Client Type       Opens Idle time

-------------------------------------------------------------------------------
\\192.168.203.100      CCROLL_ADMIN         Windows 2000 2195     1 00:42:48    
The command completed successfully.

Net Files enumerates the shared files or folders being accessed, and the accounts being used for access.

C:\>net file

ID         Path                                    User name            # Locks

-------------------------------------------------------------------------------
3          E:\Temp\20060925                        CCROLL_ADMIN          0     
The command completed successfully.

The NT Browser and Windows Networking

To find the various computers on a LAN, from each other, you generally open Windows Explorer (don’t confuse this with Internet Explorer, please), and look in My Network Places. On a fully working LAN, this will work just fine. It doesn’t always work that way though.

The contents of My Network Places (Network Neighbourhood, in some cases) are provided by a subsystem known as the NT Browser. The browser depends upon Server Message Blocks, and anything that interferes with SMBs will cause browser problems, and consequent problems in Network Neighbourhood.

In most cases, browser problems are symptoms of more basic network issues. Computer A and B should be equally visible, and accessible, from each other.

In one common scenario, Computer A shows both Computers A and B, as it should, and files on Computer B are accessible. On Computer B, either you don’t see Computer A, or when you try to access Computer A, you get an error. You may, or it may not, see Computer B from itself. This visibility problem may be observed constantly, or it may come and go.

• Since Computer B is accessible from Computer A, a permanent physical connectivity issue is unlikely, but still possible.
• Besides physical problems, browser problems can have several possible causes. Browser functionality depends upon several relationships:
  • The browser server (ie the browser), and this computer. If this computer can’t access its designated browser server, it may lack browse information, and / or have outdated information.
  • The browser server, and the client server (ie any computer being enumerated by the browser). A server, remember, is any computer being displayed in Network Neighborhood. If the browser server can’t contact a client server, or if the client server uses a different browser, that server may not appear in Network Neighborhood.
  • The browser server, and the master browser (if not the same computer). If a browser server can’t contact the master browser, it won’t get the browse list aggregated by the master browser. Any client computers that use that browser won’t have the browse list aggregated by the master browser.
  • The master browser for this domain / workgroup, and master browsers for other domains / workgroups. Any master browsers that can’t contact other master browsers won’t be able to exchange browse lists with them, and their clients won’t have the browse lists for the other domains / workgroups.
• Problems with any of the above relationships – now, or in the past – can cause various problems with Network Neighborhood. All computers won’t try to access the browser simultaneously; if a browser problem just started, all computers won’t reflect the problem immediately.

You will probably best address your problem by continuing with my troubleshooting guide, Irregularities In Workgroup Visibility.

How Long Do I Have?

This question has come up a few times this year.

If my blog gets deleted (by me or by a Blogger anti-splog bot), or if I move my blog to an external host, how quickly should I setup a stub blog, to replace what I just deleted or moved? How many hours, days, weeks am I safe?

I, typically, would assume the worst possible case, and suggest

Minutes.

Do you think this to be fiction, or perhaps paranoid delusions? Then please read Spammers stole my old URL during transfer to FTP hosting!.

Under the right conditions, protecting yourself with a stub blog should take maybe 30 seconds.

• Go to the Dashboard, and select Create A Blog.
• Name your blog. What did you just delete? DOHH.
• Select a template – just pick the first one.
• Create a stub post.
• Publish.
• Done.
• If you take as much as a minute, and the problem is the computer or network I can probably help you to get the time down to 30 seconds.
• If you take much more than a minute, though, it’s likely that you have a problem. In that case, I’ll advise you to get yourself checked up by a real doctor. I can’t help you completely.

Just do it. And do it now.

Peer Support – It Works ONLY If You Help

Blogger Blogging uses peer support. They provide a Google private group, where Bloggers with various problems can write in and say

I have a problem [My Problem]. Can anybody help me?

If you write in, and state your version of [My Problem], one of several things may happen.

1. A solution will be known, and will be instantly provided by one of the many helpers.
2. A solution will be derived, from subsequent questions by one of the many helpers.
3. You will be advised to report your problem, to Blogger Support.

Now, if you are so fortunate to have scenario 1 or 2 apply in your case, it is possible that the solution can be found in either Beta Known Issues, Blogger Help, or Blogger Status. It’s possible – but not too likely – if it was, you (or someone like you) would have found it, and publicised it, long ago.

If the solution is provided by a helper, the chances are that it came from a prior thread in the forum, under scenario 3. And here’s the problem. Of all of the threads mentioned in the many posts linked from Beta Blogger Problems, and from Classic Blogger Problems, how many of those threads end with somebody actually saying

YAY! It’s fixed! And this was [The Solution]

Blogger Support, whether posting as Blogger Employee, Pete Hopkins, or anybody posting in Beta Known Issues, Blogger Help, or Blogger Status, very seldom publicises problem resolutions. I have previously discussed this issue as The Silence.

When a thread actually is closed, by anybody (preferably by the original poster of the thread), I would greatly prefer to transcribe the solution, into the appropriate Classic Blogger Problems or Beta Blogger Problems detail problem post. I would prefer. Very few can I do this way, though.

Why is this?

Because of the dozens of individual threads about the various problems, please tell me how many actually end in

YAY! It’s fixed! And this was [The Solution]

The majority of these threads simply end. And there is The Problem.

Because not everybody realises the benefits, and the requirements, of peer support. Peer Support works – if you make it work.

So, if you are involved in any of these threads, or other threads, and you find your problem solved, please post back in your thread

YAY! It’s fixed! And this was [The Solution]

Provide your version of [The Solution]. The helpers are constantly learning, as they help others. Your feedback may help them learn.

And having provided your your version of [The Solution], you are now experienced in your problem. Now you need to do some research. Find out what caused your problem, and why the solution was necessary.

Then come back to the forum occasionally, and look for other folks with what looks like your problem. When you see someone reporting their version of your problem, describe your solution to them.

But be selective here. Remain aware of computer and system uniqueness. Mention your problem, and your solution, but be aware of possible reasons why neither will be 100% universal. Read other folks reports of their problem, too.

Become part of The Solution, not The Problem.

Migration From Blogger Classic To Blogger Beta – In Place Process

So I guess congrats are in order. You just got the notice.

Your blog can now be migrated to Beta. Click here to start.

or whatever. See, I haven’t gotten the notice.

If you are ready for the journey, then go. Beta is a pretty fantastic improvement, regardless of the shortcomings.

But.

Before you start, backup your blog.

I say again.

Backup your blog.

Please.

(Note): More detail – a lot more detail is coming. This is almost a stub post. But I have seen enough problem reports recently

I just migrated my blog to Beta. And now it’s hosed. What do I do now?

Well, first, you have to report the problem, and reply to the botmail. And be patient.

But while you’re being patient, maybe you could work from a backup copy. If you had a backup copy.

Maybe if I say this again, you will next time.

So, I now tell you three times

Backup your blog, before migrating it.

Areas Of Google Blogger Help

The Google Blogger Help Group is the official help area for (Google) Blogger Blogs, where the users help themselves (with slight exception). There are 5 forums in Google Blogger Help.

1. Customizing Templates
2. Publishing Trouble
3. How Do I?
4. Something Is Broken
5. Share Your Blog

Some people confuse the first four with the last.

1. Customizing Templates
2. Publishing Trouble
3. How Do I?
4. Something Is Broken

are for providing help. People write in needing help, ask for help, and the helpers try and answer their questions.

Share Your Blog is a different forum. There, everybody gets up and yells,

Hey everybody check out my blog!

Check out this neat article that I just wrote!

Some people ignore the amenities of Share Your Blog, and post in one of the 4 help forums

Hey everybody check out my blog!

ignoring the focus of those forums. The people who need the help will be doing several things.

• Most Frequently: Posting pleas for help
  

  Hey somebody please help me with My Problem!

  and waiting for a solution to My Problem.

• Occasionally: Looking for posts
  

  Hey somebody please help me with My Problem!

  to see what solution, if any, was found for My Problem.

• Seldom to Never: Looking for posts
  

  Hey everybody, check out this neat article that I just wrote!

There are other problems with the

Hey everybody, check out this neat article that I just wrote!

approach.

• It produces clutter in the forums.
• It encourages the other helpers to spend their time writing marginally helpful articles, and less time helping.
• It encourages the other helpers to likewise write
  

  Hey everybody, check out this neat article that I just wrote!

  which leads to still more clutter.

• The
  

  Hey everybody check out my blog!

  posts, which cannot be pinned, and generate no responses, will disappear below the many help requests, helping nobody.

All around,

Hey everybody, check out this neat article that I just wrote!

is a bad practice.

If you want to help, answer questions. Post the links to your articles in your posts, and make the links relevant. Post links to your blogs in your signature. But don’t get in a help forum, and yell

Hey everybody, check out this neat article that I just wrote!