SearcSecurity.org story
Unit1911
http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1190407,00.html
I will post the questions & answers email so that others can learn:
Eric,
Here are the answers you requested, let me know if you need any other
info.
Also please let me know the web address when you post it.
Where are you based?
- Okopipi is completely an online volunteer effort, and like most open
source projects there is no physical office. Our core project team is
spread over 3 countries and 2 continents, and we have contributors and
members from all over the world.
How did Okopipi get started?
- When Blue Security closed it's doors a large number of its users met
on different forums to discuss an alternative. The two largest
projects, Okopipi & Black Frog, decided to join forces under the
Okopipi name.
When did it get started?
- The idea was brought forward almost immediately after Blue Frog
announced it's closing and within 48 hours the site www.okopipi.org was
created this was about a week ago.
How did you decide on the name?
- Okopipi is a type of poison dart frog found in South America; it is
the actual name of the Blue Frog that Blue Security named their product
after.
How many developers do you have involved so far? What's your goal
number?
- Our development froum has over 160 members and is growing daily.
How will this project be like what Blue Security did, and how will it
be different?
- PharmaMaster (The spammer who brought down Bluefrog) was quoted in an
ICQ session saying "Blue found the right solution to stop spam, and I
can't let this continue." So our method to get spammers to cleanse
their lists will be the same, one opt-out message will be posted to the
website for each spam sent to a member. We will also have a review team
to insure the opt-outs are going to the correct websites and are sent
in the most effective way possible.
Where we are different is how the backend will work, Blue Securities
weakness was it's central servers, we hope to transfer their methods to
a peer-to-peer network with no single point of weakness to be attacked.
I read that the peer-to-peer technology is supposed to prevent spammers
from identifying the origin of the opt-out messages. How does that
works?
- Peer-to-peer isn't going to prevent the spammer from identifying the
origin of the opt-out, but one sugested idea is an option to use public
proxies if a user wishes to hide their IP address. The purpose of the
peer-to-peer network is that there are no central servers to attack.
When Blue Security's servers went down the clients on everyone's PCs
became useless, with a peer-to-peer network a spammer may be able to
bring down a single node or small portion of the network but the
majority of the clients would continue to do their tasks.
Let's say I'm an organization potentially using the product. How would
it help protect me from spam?
- When a spam is sent to your organization that is protected by Okopipi
the system will automatically send an opt-out request to the website
referenced in the spam. This request will not reference your actual
E-mail address (possibly opening you to further attacks) but will tell
the site how to cleanse their list of Okopipi members.
Are you actually acquiring IP from Blue Security, or is it more
accurate to say you're following its methods?
- The source code for Blue Frog was open sourced from the beginning,
and one of open sources many advantages is that the code is available
for public use even after the original writers or company is gone. We
already have people dissecting the code as a starting point for our
project, this allows us to have our main focus be the modification of
the backend peer-to-peer system instead of writing everything from
scratch.
Obviously this is a controversial approach. Are you worried that it
might expose you as individuals -- or the companies you work for -- to
potential attacks?
- The approach is legal as the Can-Spam Act says spammers must provide
a mechanism to opt-out , but some spammers have shown they do not care
about the law and will do anything to keep earning money including
illegal DDOS attacks. Many of our core members do wish to remain
anonymous, and core members and myself don't even know each others real
names or locations in many instances.
What project specifics are you focusing on right now?
- Design of the peer-to-peer system along with safeguards to prevent
misuse of the network.
When do you expect to enter the product development stage, and when do
you estimate you might have the first version available?
- The project is only a week old and still in it's infancy so don't
expect anything by next week, but we have a good starting point with
Blue Security's source code so it will speed the process up
substantially. The stability and security of the peer-to-peer network
is our top priority. But with so many developers it will be a matter of
months not years
Spy der Mann
and interesting.
