But mail for Russell Brown (always addressed to RUSSELL BROWN in block caps) kept arriving, and I realized that it was all from travel companies. Again, if you’ve gotten added to a particular spam list you’ll soon be added to related ones.

But these were from reputable companies. Holiday Inns. Princess Cruises. La Quinta. Not generally spammers. It seemed that Russell Brown (uh, I mean RUSSELL BROWN) was using my email address to subscribe to newsletters and such. Which I didn’t understand. There’s a Brown in my name, but there’s no Brown in my email address, so it’s hard to see how he could claim to have accidentally used Iain Brown’s email.

More recently I’ve started receiving booking confirmations. RUSSELL BROWN is still using my email address for travel, but it isn’t just subscribing to websites now, it’s making reservations. And the way he consistently uses my email address convinces me that it’s deliberate.

It’s not generally easy to register at a website with someone else’s email address. Unless you can log in to the mail account you can’t get confirmation numbers. Either none of these sites required confirmation, or he created the account using one address and then logged in and switched it later. Or maybe he’s selecting hotel companies based on whether he needs to provide a working email address.

Maybe he doesn’t have an address. He can figure out how to create an account and make an online reservation, but he doesn’t understand Yahoo, Hotmail or Google. That might account for the all-caps name.

Or else he doesn’t want his travel details known. Maybe Mrs. RUSSELL BROWN isn’t supposed to know about these overnighters at La Quinta.

The email rings all alarm bells for being a phishing attempt. If I didn’t have relatively safe command-line tools to evaluate it, I wouldn’t have touched it.

In an era where all personal data is on the line, when anti-fraud companies are warning everyone to be very careful about trusting email, and especially to avoid clicking links, it’s stupid for a major company to encourage you to take risks.

If I knew who to report this to, I would. But it isn’t phishing, it only masquerades as being phishing.

The email is in html. One of the certain signs of spam is if you mouse over a link in email, and the mouseover text is different from the link. This one is.

So if you click on the link, you don’t go to where the text says. Instead, it takes you to a redirector at email1.paypal.com. Had the redirector been anywhere else, I’d have known beyond any reasonable doubt that the mail was phishing. But for it to be within the paypal.com domain, a phisher would have had to take control of a paypal server, or find a vulnerability in one. Neither of which is out of the question, and it could be done to make the mail look more legitimate, but another option is that the sender is an idiot, so I decided to keep looking.

The redirector at email1.paypal.com redirects to somewhere else, outside of the paypal.com domain. So now it looks like a spammer did take control of a paypal server to make the redirection look more legitimate.

The site that it redirects to is link.p0.com. If p0.com is a legitimate business, it keeps a very low profile. There’s nothing at the root of the website. There’s nothing useful in its whois entry. But googling p0.com comes up with several other businesses that seem to be sending email traffic through p0.com. Maybe it’s a high-volume web/email service, like akamai.com. But if it is, why doesn’t it at least publicize that fact, so that it doesn’t scare customers away? (One forum entry I found was a post by someone who refused to respond to email from p0.com without knowing what it was.)

But then, following the redirection chain further did bring me back to PayPal; to the same place as the text version of the links.

Also: the mail was sent to my primary PayPal email address. That’s one I don’t use anywhere. I don’t get spam on it. I’ve never seen spam there, while I get lots of PayPal phishing mail at my other addresses.

So, either:

- This is an incredibly sophisticated phishing email that involves a compromised server at paypal.com and a redirector at (what appears to be) a large business site that sends you back to PayPal rather than to the phisher’s site for some unknown purpose, since it didn’t get to steal passwords and account info on the way, or

- This is a legitimate mail that looks exactly like phishing email from a company that’s a prime target of phishing, which redirects through a shrouded external business for no apparent reason.

I guess there could be a third option. Maybe this is PayPal sending out apparent phishing email to collect statistics on who is gullible enough to click through links they should clearly avoid. Looked at that way, maybe it isn’t so stupid after all. Something tells me this isn’t the right answer, though.

The Apple user interface has an irritating bouncy icon that lets you know when another program requires your attention. Which is fine; it is as obvious as the Windows-style modal dialog, but it doesn’t start stealing your keystrokes and acting on them.

This morning I wiped out Firefox and Adobe Reader because some ugliness between them makes Firefox go into a loop of loading / attempting to render that it never gets out of. I had to cancel and restart re-installing Adobe because of a stupid popup dialog that I dismissed without seeing what it was while I was typing a message. Even afterwards, Firefox and Adobe have the same problem – but in a virtual machine Firefox and Adobe co-exist perfectly well. So something in another Windows component is breaking it.

Maybe it’s another application that’s only partly installed. Or maybe it’s Skype, which apparently has hooked into Firefox, redirecting it to the Skype website even after a full, clean install. Which is another one of the ridiculous program practises that we’ve come to accept – no way in hell would I have allowed Skype to do that, if I’d been prompted, but with no application security, the installer can do what it likes.

It seems not to introduce any extra instability. (Saying that any particular package is stable on a LifeDrive really isn’t possible, given the instability of the device itself, but TealScript appears to be stable.) It has excellent documentation, and it seems that it has good support.

So I can finally get back to doing something useful with my LifeDrive – beyond playing Sudoku and watching videos.

Sigh.

I can’t go back to Graffiti 2. I’ve read several comments to the effect that “if you practice, you can make it work.” Well, I’ve practiced for a year, and it doesn’t work.

Next step: replace the buggy Palm browser with an alternative. The only one I’ve found so far is Opera Mini. Now, I like Opera, but Opera Mini requires Java, which is another layer of complexity and likely source of reliability problems.

We’ll see.

Update: BOOM. Device reset. As soon as I tried to browse to Google. So I went back to a page I’d encountered that mentioned JVM settings, tweaked them accordingly, and… guess what? BOOM.

I am hating this device more every moment.

Update again: Plan C is TealScript, from TealPoint Software. The demo version recognizes my Graffiti 1-style writing better than the old Palm. Plus it can learn my writing style (well, so they claim. Personally I don’t think anything could ever learn my writing style) and can use the entire screen for accurate character entry. It looks like it’s exactly what I need. Costs $30 for something that ought still to be part of the device, but I stopped expecting Palm software to be free or reliable a long time ago.

I don’t really know why I didn’t replace the IIIc when it finally fell apart, but last year I decided it was time to upgrade to a LifeDrive. It has 4 gigabytes internal storage, enough for several compressed video files, a large viewing area for watching those videos, WiFi, and all of the old Palm software. What could be wrong with that?

Reliability, for one thing. It crashes regularly, usually when using WiFi. The WiFi doesn’t recognize range extenders, so it’s unreliable around the house; either the signal is too weak (since its range is poor anyway) or it keeps switching between the router or the extender.

The 3.5mm audio jack seems very fragile. You can feel that a regular plug doesn’t fit well. Mine collapsed on me, and I called Palm to have it repaired. This was slightly under a year, and they agreed to repair it under warranty, which I was very pleased about; with mechanical damage I thought I’d have to pay for the repair.

Before I sent the LifeDrive to the repair office, I tried to do a full reset to wipe all of my personal data. Something happened, and it locked up completely. Black screen, wouldn’t power up. Reset button inoperative and hard reset failed. Still, I sent it back for the jack repair, and Palm sent me a replacement. They will repair or replace at their option, which is fine by me. All of my data is hotsynced.

I synced the new unit and it worked fine – for a few hours. Then black screen, no possibility of reset. I called the repair center, and they gave me a new return number.

The repair center is excellent. They’ve been very fast, very helpful, they’ve given me useful advice and have never tried to lay blame on me. The call center is in India, of course…

So the second replacement device arrived, and it ran overnight and then died in exactly the same way. Clearly there’s something wrong in software. Something I’ve done has caused the device to lock up. But a hard reset should never be dependent on current data. Obviously it isn’t really a hard reset.

This time when I called the service center I explained the issue before sending it back. The helpful operator showed me how to move all of my program data out so it wouldn’t be hotsynced. Then I’d be able to reinstall all of my programs and hope that I don’t get back into the same situation. Of course, if I do, I’m screwed… The operator also gave me an account number so that this time the repair cost me nothing at all, not even shipping.

So I have unit #4. It’s been working for a couple of weeks now. I’m adding all of my third-party programs; the only one I haven’t installed yet that I need is Sudoku, and I had that for a long time on #1, so it won’t cause me any problems. I think it’s most likely Filez and some changes I’d used it for. I won’t touch that this time around.

Reliability is why I will never buy another Palm. That isn’t the reason I hate it, though.

That reason is this: Graffiti II sucks.

Graffiti, the writing system for the original Palm, was quirky, but effective. To create some letters you had to use a highly stylized representation. To make a K, you draw an alpha. A T is a square 7. But once you’d gotten into the habit, it was very easy to create accurate text.

Graffiti was dropped because of a patent suit brought by Xerox. At this point, it seems that Palm is ahead in the appeals process, but in the meantime, they’ve dropped Graffiti and replaced it with Graffiti II, based on Jot.

Graffiti II is close to worthless. The two-stroke method is horribly unreliable. T especially is impossible to render accurately. T consists of a vertical stroke, top to bottom, followed by a horizontal stroke, left to right. I have tried and failed to create a T more than 10 times in a row on more than one occasion. I can see the lines on the screen, crossing correctly, but the T won’t appear. It will either be a space or an L followed by a space.

Even when it works, the method of constructing a T causes problems. You can’t end a word with L followed by space. You have to wait for the L to appear so that the two strokes don’t combine to form a T. Or you can ensure that the two strokes are in two separate parts of the tiny writing window, which is hard to do (except when you’re trying to create a T, it seems).

I is a line and a dot, so it usually appears as L. @ is an @, and it usually takes me 4-5 times to get it not to be an o.

With Graffiti I I would occasionally make errors, but I could tell what I was writing and fix the notes later. Graffiti II was so bad that it was worthless for taking notes in real-time.

So a few days ago, after some Googling, I found this link which told me how to “downgrade” to Graffiti I. I’ve done it, and – wheee! I can’t say I love the device, because it’s still unreliable, but after owning it for a year I can finally use it. And for now, that’s good enough.

Apple ad targeting Vista.

I’m still in pain from migrating my mail system from mireille (my server in Tool, TX) to kirika (my supposed replacement server in Plano, TX).

With one exception, every package has somewhat adequate documentation, but none do a very good job of explaining the connection between this package and all the others that are required. Mail Transfer Agent, spam checker, virus scanner, delivery agent, authentication agent, management / configuration utilities, mail server (the piece that your mail client actually connects to) – all of these have to work together. If they don’t, you will a) lose legitimate mail, b) get inundated with spam, c) act as a relay for spammers / malicious software, d) any or all of the preceding.

There are HOWTOs around which cover subsets of the whole system, but I haven’t found a single one that adequately covers everything. Then, we used the most complete HOWTO to set up the mail system at the office. A few months later, a stupid configuration mistake in this instructions led to a cumulative problem that caused our mail system to go into meltdown, and took a few days to fix. Still, I had everything mostly working (having done it before) in just a couple of days.

The one piece that has woefully inadequate documentation is the mail server component, cyrus-imapd. It supports “virtual domains”, which I need, except that the configuration utility supports a different implementation of virtual domains, which required some serious hacking. And then it’s not directly compatible with its own authentication server. That took many hours googling, and I found the workaround by accident in an unrelated thread. And even so, it can’t support my primary domain, which required a “roll-your-own” kludge on my part.

The upside is that the 25,000 spam emails or so that I’ve accumulated in the last few months has dropped to 3-4 per day, which I can live with. It’s definitely been worth the effort.

All this makes commercial packages look attractive. In a homogeneous system, all of the parts designed to work together will be documented together. Until you start to consider that the main reason I’ve had so much trouble is that I’m trying to do something not quite standard. I dread to think what an Exchange admin has to go through to do anything that wasn’t directly intended by the developers. At least I can do what I need, even if it’s painful.

Now, just another twelve or so domains to migrate… (sigh).