Mark Turner

MSN now snooping anonymously

In a very strange occurrence, my website got visited from what appears to be an MSN spider that didn’t identify itself (fake user agent has been highlighted below):

65.55.231.117 – – [22/Oct/2009:10:02:07 -0400] “GET /robots.txt HTTP/1.1” 200 24 “-” “Mozilla/4.0”
65.55.231.117 – – [22/Oct/2009:10:02:07 -0400] “GET /wp-content/uploads/2009/10/oculan-screenshot-300×230.png HTTP/1.1” 200 120896 “-” “Mozilla/4.0”
65.55.210.80 – – [22/Oct/2009:10:02:20 -0400] “GET /page/2/?q=node%2F1699 HTTP/1.1” 200 29922 “-” “msnbot/1.1 (+http://search.msn.com/msnbot.htm)”
65.55.230.228 – – [22/Oct/2009:10:08:13 -0400] “GET /robots.txt HTTP/1.1” 200 24 “-” “Mozilla/4.0”
65.55.230.228 – – [22/Oct/2009:10:08:13 -0400] “GET /2009/10/15/big-names-in-sources-of-suspicious-traffic/ HTTP/1.1” 200 10502 “-” “Mozilla/4.0”

65.55.230.228 resolves to msnbot-65-55-230-228.search.msn.com. 65.55.231.117 is a Microsoft address but doesn’t have an entry in DNS.

Just to make sure someone wasn’t spoofing the MSN namespace, I checked the whois record for these host. Sure enough, they belong to Microsoft:
Continue reading →

Southwest will fly to Panama City

I found out today that Southwest Airlines will begin service to my hometown, Panama City, Florida this May. I can’t begin to tell you how psyched I am about this!

Getting to Panama City is an 11-hour trip by car. One can fly there, of course, but that means you’re stuck with flying Delta Airlines and that’s it. As such, there’s little or no competition – and prices are high. Southwest moving in will definitely slash the cost of getting to Panama City, possibly making it worth flying there rather than driving.

On the other hand, the tremendous growth that this will bring the city will forever change it. I’ll miss the hometown feel of my hometown. All in all, though, I think this is a good thing for Panama City. Way to go, Southwest!

Sunset, sunrise

On my way home from the City Council meeting I saw an amazing sunset! The sun had just set below the western horizon, leaving a band of warm orange in the sky near the treetops. Above the trees was a perfect crescent moon, seemingly larger than life. Then this morning I saw a beautiful sunrise, with the same band of warm light that happens only in the cooler months. In place of the moon I saw Venus shining bright in the sky.

It’s good to stop every now and then and appreciate the beauty that’s all around us.

East CAC history lesson

Tonight’s East CAC meeting was an unforgettable one. Not only was I honored to be reelected as CAC Chair, but a group of about 15 Pakistanis were here to observe an American civic meeting. After that we had a number of members tell us about the history of our area, many of these folks having lived here for almost 40 years.

The real treat in my mind was to hear from a descendant of the original property owners who once owned the property surrounding Lions Park. The history of the land was traced back to 1851 when it was purchased from the Mordecais! Even venerable old Saint Augustine’s College wouldn’t come into existence for another 16 years.

It was fascinating! I never knew there used to be a pond right in the middle of our neighborhood, or that a stream existed at the bottom of Fenton Street, or that Pigeon House Branch creek was once clean enough to drink, or that many picnics were held at the bottom of Fenton, where a beautiful wooded ravine once stood.

The “history lesson” meeting was so much fun that we’ll have to do another one soon!

N&O overreaches in its anti-Easley campaign

I know the News and Observer has had some kind of obsession with former Governor Mike Easley but today’s front-page story is really a stretch.

Easley was a member of the Old Chatham Golf Club in Chatham County, apparently getting his membership fees waived. While that’s nice to know and may have been worthy of a story, the latest story about the club getting water for irrigation during the drought of 2002 is a non-story as far as I’m concerned. The crux of the issue is right here:

Frantz, who did not return numerous phone messages, routed the request to the Chatham County commissioners, who unanimously agreed June 3 to let the club pump as much as 450,000 gallons a day for irrigation for up to three months. The water would be counted against the county’s daily allocation from Jordan Lake. State law considers pumping more than 100,000 gallons a day to be a major withdrawal.

The county was not drawing all the 4 million gallons per day it was allowed; there was no debate among commissioners about the request, according to minutes of the commisers’ [sic] meeting County Manager Charlie Horne.

See that? Chatham County wasn’t using its 4 million gallon allocation and the the Chatham County Commissioners unanimously agreed to let the club pump the water. It was Chatham County’s water and the state didn’t have a problem with Chatham spending it as it saw fit. The state’s “getting involved,” as the N&O alleges, amounted to the state shrugging its shoulders, and rightfully so.

The Governor can order state agencies to reduce water use but he or she does not have the power to order private businesses or individuals to conserve. It’s ludicrous for the N&O to suggest otherwise.

I’ll be happy when the N&O catches up to 2009 and starts covering the issues we face today. Then again, my faith in the so-called “Old Reliable” has pretty much run out.

No Sissies

What a great song. If I had a band I would cover this in a heartbeat.

No Sissies (YouTube)
Hawksley Workman

You’re being so tough to me
Like a leather jacket
I know you’ll have no sissies
No baby, you just wouldn’t hack it
Gotta be a strong man
To carry the beautiful burden of your love

No sissies get your love
No slackers get your love
No weaklings get your love
No suckers for your love
No actors for your love
No gangsters for your love
No sissies get your love
Continue reading →

IBM’s computer archives

IBM-5520

As a kid I remember my dad taking us to his office at IBM on an occasional weekend. While he’d fetch something from his office we’d all look around at the technology around us. The darkened offices were full of mysterious, silent computer displays and massive copiers. In those days before the IBM PC these strange, exciting boxes always fascinated me.

I recently stumbled again upon IBM’s Computer Exhibits Archives, where IBM’s earlier computers still live on, if only as webpages. It was fun checking out the hardware I remember as a kid.

Another mystery bot example

Here’s another example of bizarre hits. Two hits for this six-year-old page coming in within 30 minutes of each other:

138.162.8.57 – – [15/Oct/2009:12:12:16 -0400] “GET /2003/07/28/blimps-and-other-things-bizarre/ HTTP/1.1” 200 5094 “-” “Mozilla/4.0 (compatible;)”

[snip]

138.163.106.72 – – [15/Oct/2009:12:44:33 -0400] “GET /2003/07/28/blimps-and-other-things-bizarre/ HTTP/1.1” 200 5094 “-” “Mozilla/4.0 (compatible;)”

The first resolves to gate2-jacksonville.nmci.navy.mil and the second resolves to gate2-bremerton.nmci.navy.mil. It looks like there’s a full-scale botnet attack going on behind the DoD firewalls right now.

More clues in the government botnet mystery

The plot thickens in the government botnet mystery I recently wrote about. This morning I got hits from the Navy-Marine Corps-Internet, specifically a host identified as gate3-norfolk.nmci.navy.mil:

Again, it started off innocently with a Google search, with the browser properly identified:

138.162.0.41 – – [15/Oct/2009:08:36:27 -0400] “GET /2008/12/19/beware-the-police-protective-fund/ HTTP/1.1” 200 6377 “http://www.google.com/search?hl=en&source=hp&q=police+protective+fund&aq=f&oq=&aqi=g10” “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)”

A few more hits down, I see the random jumping around I’d seen before:

138.162.0.41 – – [15/Oct/2009:08:36:30 -0400] “GET /2008/12/20/a-mange-in-a-wager/ HTTP/1.1” 200 4191 “-” “Mozilla/4.0 (compatible;)”
138.162.0.42 – – [15/Oct/2009:08:36:30 -0400] “GET /2003/07/29/goodbye-bplog-hello-drupal/ HTTP/1.1” 200 14042 “-” “Mozilla/4.0 (compatible;)”
138.162.0.44 – – [15/Oct/2009:08:36:30 -0400] “GET /2003/07/27/action-packed_weekend/ HTTP/1.1” 200 4371 “-” “Mozilla/4.0 (compatible;)”
138.162.0.43 – – [15/Oct/2009:08:36:30 -0400] “GET /2003/07/24/keys_keys_keys/ HTTP/1.1” 200 5531 “-” “Mozilla/4.0 (compatible;)”
138.162.0.45 – – [15/Oct/2009:08:36:31 -0400] “GET /2008/12/18/progress/feed/ HTTP/1.1” 200 1973 “-” “Mozilla/4.0 (compatible;)”

My site is apparently being indexed by computers on a government-run network, but the question is exactly what is indexing it? Is this some sort of proxy technology that government gateways are now using, sampling websites that government users are viewing to ensure that these websites don’t have questionable content? Or, is this a botnet of compromised government computers as I recently suggested? Or (tinfoil hats, please), is this a secret spidering project run by a three-letter agency that uses the gateways of various government departments as cover?

The bottom line is these hits are inconsistent with a human browser. Beyond that I’m not sure what to make of them.