NoSpyMail

My previous posting got me curious enough that I decided to write a program to detect SpyMail in my own email. Not surprisingly, I get a lot. Most of it comes from spammers. But, I have seen a few from msgtag and didtheyreadit, too. Those two have been used in sending email to customer support for some other products I work on, presumably to figure out if customer support actually reads the email. (Which we do, of course!)

So, if you want to try it out – I put it up for free download. It works within Outlook, and requires .NET. It installs as a passive watcher of your email. If it sees SpyMail, it lets you know about it, keeps a hsitory of the spymail, and neutralizes the spy-threat.

Of course, it probably can’t detect everything, but I’ve already found over 20 spymails that were in my mailbox…. Frightening.

Here is where you can get NoSpyMail

Ick. Spymail.

Dan Gilmore wrote last month about a troubling issue where seemlingly legitimate companies are now participating in making more SpyMail. SpyMail isn’t new. Its been used by spammers for a long while. But now some otherwise seemlingly legitimate companies are trying to make businesses out of it….

What is SpyMail? SpyMail is the attempt by hackers, spammers, or unscrupulous people to learn more about your mail reading habits. Some companies claim that there is a legitimate use – so that the sender can know if you read the email or not. But, if its legitimate, why is it covert? Why not use the Read-Receipts feature that the receiver can see explicitly. There is no doubt in my mind that these products are clearly out to do harm. When something is veiled in secrecy, its almost always for illegitimate purposes.

What kinds of information can people collect using SpyMail? Quite a lot, actually. Turns out you can easily get:
– Knowledge of if the recipient read the email or not
– When the recipient read the email
– If the recipient forwarded the email to someone else and to whom
– The operating system of the recipient
– Version information about the recipient’s computer
– The IP address of the recipient
– The location of the recipient (tracked loosely by IP location finding)
– More.

Wow. Thats pretty dangerous. Since I write plugins for Outlook, I just may write a plugin to kill these SpyMail guys.

Outlook 2003 already has a feature to protect you from SpyMail. By default, it doesn’t load HTML images for this very purpose. You have to manually download the images you want. Its a little cumbersome, but at least it works.

Oh yeah – who are the spymailers? Here are the villains that offer these services in the name of “features”. The fact that they would dare build this indicates that they are unscrupulous, greedy, ignorant and shameless. Get the idea?
http://www.didtheyreadit.com/
http://www.msgtag.com/ (a little better because the recipient can see that the message is tagged, but the recipient still doesn’t get a chance to block it before its too late)
Read more

Bring on the competition

No good product is left uncopied!

Google
We met with Google. I guess they liked our idea. In the last week, Google’s Puffin project has received a lot of press. News of the project was apparently leaked to the press, so details are sketchy. But, it sounds like a neat idea. Here are some press thoughts. Don’t forget – Lookout did it first! 🙂

Microsoft
And now, Microsoft is entering the arena too! Here is the latest press release today.

Does this spell trouble for Lookout? I don’t think so. I think it means good things are going to happen. We’ll all soon have a better email/search experience! We’ll go home earlier! We’ll be less addicted to email! (Ok – well, hopefully someone will benefit that way…)

Well, thats what I hope for, of course…. And I hope lookout fairs well too!

Managed Code Java/C#/etc

One problem we’ve worried about with Lookout is the fact that its dependent on Microsoft’s .NET 1.1. .NET is a framework for building managed applications, and its Microsoft’s answer to Java. Its fully featured, but comes with a 23MB download! So, while Lookout is nice and compact at 1MB, its dependent on this huge 23MB download!

Yesterday, I was pointed at another application which is a bit of a competitor to Lookout. Its a very nice tool, and I liked what they had done. But, its install file was 25MB in size. When I looked at what was in there, I found the complete Java runtime + java libraries. Its coincidental that this app with Java was almost exactly the same size as Lookout + .NET!

So, it gets you thinking about what tools to use for building your applications. Obviously, any 20MB+ download is something to be concerned about. But I sure am glad I chose .NET instead of Java. With .NET, I know that Microsoft will be bundling it into their distributions in the future. (In fact, its already bundled in their newest releases). But Java will likely never be bundled – despite the recent news that Sun & Microsoft are friends.

So, this was interesting to me because of Lookout’s size. I hadn’t really thought about the poor Java developers out there. Sorry guys!

Blogs as a technical resource

I love blogs. There are a lot of smart people out there writing really great stuff about technical topics – especially from people that have actually *used* the technology rather than just documentation people…. But, being that anyone can write a blog, and being that everyone has a slightly different standard for what is “publish worthy”, there is a fair amount of misinformation out there!

As I dive into more obtuse topics of MC++ and C# and Office/Outlook, there are fewer and fewer resources to draw on. As such, when there is misinformation out there it becomes all the more apparent! I’m seeing a lot of it lately.

I wish I had a good answer. I’ve written to a few authors – and they are generally very receptive to trying to cleanup mistakes. But, boy, be careful.

But I’m probably guilty of it too. Who knows how much misinformation exists in this blog!

GAC PIAs

In my previous entry, you heard a little about the trouble of installing into the GAC without using MSIs. I just found some useful information about choices with interop libraries for Outlook from here.

This article illustrates a few interesting things! If you are writing an Outlook addin, you have a few choices:

  1. Write your addin exclusively for Outlook 2003 and use the Office 2003 PIA
  2. Write your addin for multiple versions of Outlook and use the Office XP PIA
  3. Write code to custom load PIAs at runtiume

#3 is no small amount of work. #1 doesn’t make sense for anyone other than Microsoft. Microsoft wants everyone to use the latest version (and upgrade), so they love this option. For the rest of us, that actually want a reasonably sized user base to draw from, you’ve got to use option #2.

And, the XP PIA has a number of known bugs – only fixed in the 2003 PIA. For instance, I ran into this bug the hard way. There is no fix unless you are using Outlook 2003.

Sigh.

On the good news front, I am glad that folks from Microsoft (like Omar, mentioned above) are helping to document this stuff along the way.

gacutil & GAC install

If you are looking for a way to install into the GAC without using a Microsoft Installer package (msi), here are a couple of ways to do it.

Option 1:
Bundle the gacutil.exe. This will require a library, msvcr71.dll. The sum total is about 440K to be added to your install. They’ll compress down to about 200K. This seems to be the most frequently used mechanism. You have to redistribute gacutil.exe because its part of the Microsoft.NET SDK and not installed on most people’s machines.

Option 2:
Write your own c# code to do it. After searching for a very long time, I did manage to find some obscure APIs to do the same thing. The good news is that now you can write managed code to do this, and it only takes about 16K of code. Woo hoo!

    System.EnterpriseServices.Internal.Publish foo = new System.EnterpriseServices.Internal.Publish();
    foo.GacInstall(“myassembly.dll”);

If you want Microsoft’s gory details of the GAC API, you can check here.

Lookout

Its been a while since I posted here, so I figured I’d write a note.

Released a new version of Lookout today – finally one that should be pretty stable. 0.89. We even sent out a little end-user poll to see how people like it. So far, the responses are pretty good. Its probably all relatives and friends saying what I want to hear? 🙂 Fortunately, I don’t know that many people!

ASP.NET and missing the easy stuff

I wrote my first ASP.NET program the other day. I was so amazed. Microsoft has made it unbelievably easy. Using all Microsoft tools, the steps were something like:
– open webserver to my ASP.NET ISP
– use their admin tool to “create a new Web Application”
– open Visual Studio.NET
– create a new project
– point it at my ISP
– create code.

It was so easy, I couldn’t believe it. You have to try it for yourself to believe me.

So I created a little subroutine which just detects whether .NET is installed on a client’s machine. Nothing magic about that, right?

Now, try to use that subroutine anywhere other than .NET!

.NET seems to take the approach that if you use ANY code to generate your web page, you should put the entire webpage into .NET code. I mean real code here – code that you have to compile before you can run it. This makes no sense to me and violates all principles of separating UI and code.

Example – if you’ve got some static HTML, why would you ever want to put the static HTML into code? Now, if you want to change a comma on your website, you’ve got to go to your web developer who knows how to build code to do it.
And most websites are made of a lot of static elements.

Most web pages end up being a collection of elements that are combined together. Each element may be created by a completely different source. For example, I may have a page which includes:
– a static HTML header
– a side menu created by a perl program
– a main content page created by ASP.NET
– a right-hand-sidebar contianing ads from a third party app
– a static footer

Now, how are you going to assemble these into a single page? Do you want to write code to do all this? Of course not. But the ONLY way to do it in .NET is to write .NET code to include it all. ACK! You can’t include “blobs” of ASP.NET from ASP!

ASP (like JSP) had simple HTML with callouts to code. This allowed for easy separation of UI and Code. And, I could hire web-designers rather than programmers to create 99% of that website and iterate on the UI. The programmers created code components which the web designers would “include”. Now, ASP.NET wants me to make the developer do all the work. In ASP.NET, you need to know how to open visual studio and WRITE CODE in order to spit out anything.

I like what they’ve done with ASP.NET. The integration with Visual Studio is astounding FOR DEVELOPERS.

But, unless you want to write code for every closing

and other html markup, its a bad choice.

C# #define. Missing the easy stuff

The OO crowd sometimes just goes overboard. C# and #defines are an example. C# does provide support for defines, but not for defines with values. So you can write code like:

      #if foo
              Console.WriteLine("foo is defined");
      #else
              Console.WriteLine("shoot, its not defined");
      #endif

But, the designers left out support for #define FOO=VALUE on the grounds that its “macros are a bad idea in general”. See other non-thinkers that spout the same idea here.

The reason these guys think its okay to not have macros is because they’ve never coded in the large. They’ve never built real projects. For any developer that HAS actually written real code, they know that real code invariably requires a set of tools and resources to fully assemble the final product. This includes utility libraries, installers, uninstallers, profilers, memory checking tools, etc, etc. And you always want to have a few key things that you pass between each of these tools. One of the simplest ways to do this is to use the #define NAME=VALUE syntax. Its not graceful, but its so simple that almost every tool out there provides support for it. When you are using someone else’s tool, you just don’t have the luxury to be screwing around with ideals of “macros are bad”.

Ack. Well, if you haven’t guessed it already, today I’m trying to automate my build processes. I have different tools to link together, and the WEAK LINK in the chain is the C# compiler lacking macros.

Solution
The solution I’ve settled on so far is use of environment variables. Its not too bad, and mostly usable in other programs as well. Code looks about like this:

   string version = System.Environment.GetEnvironmentVariable("PROG_VERSION");

But this is a lot more cumbersome that using pre-processor macros because its inline code. Now you’ve got to make sure this is initialized and loaded in the right place, etc etc. I’ll keep looking.

Ack. Get off your high-horse and allow macros!!!!!
Read more