La loi 78 et le filtre antipourriel de Vidéotron

Je voulais revenir sur le problème de filtre antipourriel chez Vidéotron qui a eu la malheureuse conséquence de bloquer tous les courriels contenant un lien vers la Pétition d’appui à la requête en nullité du Projet de loi spéciale 78 pour au moins plusieurs heures hier.

Pour résumer le problème d’hier, tout message transitant à travers le serveur de courriel de Vidéotron et contenant la mention loi78.com était effacé et jamais livré à destination. L’explication mise en ligne sur la page Facebook de Vidéotron est qu’un trop grand nombre de messages contenant un lien vers ce site furent reçus en un laps de temps trop court, ce qui entraîna leur ajout à une liste noire de manière automatique. On peut accepter cette explication; c’est raisonnable. C’est raisonnable de bloquer les courriels entrants qui sont des pourriels. Le lien loi78.com n’est par contre absolument pas du contenu problématique, mais acceptons pour le moment que c’est le cas et qu’on se doit donc de bloquer les courriels entrant contenant ce lien.

Les courriels sortants sont pour moi quelque chose de complètement différent. En effet, selon les tests que j’ai faits hier et qui ont été confirmés par de nombreuses personnes, un client de Vidéotron envoyant un courriel à quiconque était affecté par ce problème. Si je suis client et que j’écris à mon ami qui a un compte Gmail, le message sera bloqué. Pas par Gmail, mais par le serveur de messagerie sortante de Vidéotron. Pour ce serveur de messagerie, un client est donc en train d’envoyer un message contenant un lien classifié comme indésirable et qui mérite d’être bloqué. Pourquoi un client serait-il en train d’envoyer un tel message et que devrait-on y faire?

L’ordinateur du client est contaminé par un virus

Il est tout à fait plausible de penser que l’ordinateur de l’expéditeur est contaminé par un quelconque virus qui utilise sa liste de contacts et son logiciel de messagerie à son insu. Si tel était le cas, en plus de bloquer le pourriel, un message devrait être renvoyé au client l’avertissant du problème. Il s’agit là d’une mesure de sécurité élémentaire. À ma connaissance, aucun client de Vidéotron n’a été contacté à ce sujet ou n’a reçu un message automatisé l’informant qu’il envoyait des pourriels.

Le client est un véritable polluposteur

Si tel est le cas, des mesures devraient être entreprises contre le client. Au minimum, l’avertir, mais encore mieux couper son service internet. Les pourriels sont un fléau et les polluposteurs ne devraient pas être tolérés. À ma connaissance, aucun client de Vidéotron n’a reçu d’avertissement à ce sujet.

Le lien n’est pas problématique. Est-ce un faux positif?

Il est raisonnable de supposer qu’en temps normal, la vaste majorité de ses propres utilisateurs ne sont pas des polluposteurs. On doit principalement se méfier des courriels entrants plutôt que sortants, car ils proviennent de serveurs et d’expéditeurs inconnus. Dans notre cas à nous, il devait y avoir environ autant de clients de Vidéotron que de clients d’autres compagnies qui envoyaient des courriels contenant le lien loi78.com. Pour apprendre correctement, un bon filtre automatique est capable d’utiliser des exemples de pourriels, mais aussi de messages qui sont propres. Une rétroaction devrait être en place dans le système pour que l’antipourriel réalise automatiquement que plusieurs utilisateurs auxquels on peut faire confiance envoient aussi ce lien. Le lien n’est donc probablement pas problématique et devrait être soit retiré de la liste noire ou être contre-vérifié par un humain.

Ne pas trop y penser et effacer silencieusement les messages

On peut aussi complètement se fier au système antipourriel et effacer silencieusement les messages contenant ce lien.

 

En conclusion…

Le quatrième scénario est ce qui semble être en place chez Vidéotron, et ça me semble problématique. J’ai de la difficulté à comprendre qu’on n’avertisse pas un de ses clients quand on efface les messages qu’il envoie parce qu’on les considère comme étant des pourriels.

Absolument rien ne laisse croire que Vidéotron a volontairement filtré ces messages et les accuser de censure n’est pas très crédible. Le résultat non intentionnel a tout de même été d’effacer des messages à caractère politique en temps de crise. Ça mérite au minimum une petite réflexion.

Loi 78: Courriels contenant un lien vers la pétition non livrés par Vidéotron? (Maintenant réglé)

Voir mise à jour au bas du message. À 20h le problème semble avoir été réglé. Une explication a été publiée sur Facebook vers 21h.

Après avoir vu des rumeurs sur Facebook prétendant que Vidéotron bloquait les courriels de ses membres mentionnant la Pétition d’appui à la requête en nullité du Projet de loi spéciale 78, je n’y croyais simplement pas. Administrant un serveur web et ayant donc accès aux fichiers journaux (log files), j’ai fait un petit test pour tenter de vérifier ces affirmations.

J’ai donc envoyé deux courriels à un client de Vidéotron, un contenant le lien vers le site de la pétition (loi78.com), l’autre contenant un lien vers loi79.com, pour qu’ils soient le plus similaires possible. Ci-dessous, les deux messages au format brute ainsi que les extraits du fichier journal qui confirment qu’ils ont tous deux été acceptés par le serveur de messagerie de Vidéotron.

Message contenant loi78.com

Confirmation de livraison:

Message contenant loi79.com

Confirmation de livraison:

 

Le client de Vidéotron a uniquement reçu le message contenant le lien loi79.com, et ce en une minute. J’ai ensuite envoyé un message à partir de GMail contenant loi78.com qu’il n’a pas reçu. J’ai ensuite envoyé 6 messages un après l’autre très rapidement: trois contenants loi78, et trois autres contenants loi79. À ma grande surprise, il a reçu les 3 mentionnant loi79 et aucun mentionnant loi78.

Envoie via le serveur de Vidéotron

Le client de Vidéotron m’a ensuite envoyé deux courriels comme j’avais fait: un contenant la mention du site de la pétition et l’autre non. Il l’a envoyé en utilisant le serveur SMTP de Vidéotron (relais.videotron.ca). Je n’ai jamais reçu le message contenant le lien et il n’y a aucune trace dans mes fichiers journaux d’une tentative du serveur de Vidéotron d’effectuer la livraison de ce message. J’ai par contre reçu celui sans lien très rapidement:

Ni lui ou moi n’utilisons de logiciel antipourriel sur nos ordinateurs et rien dans mes fichiers journaux n’indique que mon serveur a bloqué une tentative de livraison pour quelque raison que ce soit.

Cette situation est très étrange et j’invite d’autres personnes à faire des tests pour confirmer l’existence du problème. Considérant le climat politique actuel et la nature du site qui semble être bloqué, cette situation me rend très inconfortable et il serait souhaitable que quelqu’un de chez Vidéotron clarifie la situation. Je suis prêt à fournir les fichiers journaux avec toute l’information présente s’ils en ont besoin pour éclaircir la situation.

Mise à jour 19h50: Vidéotron ont publié plusieurs messages via leur compte Twitter disant qu’ils ne bloquent pas de messages de manière intentionnelle. Possiblement un problème d’antispam.

Mise à jour 20h: Je viens de refaire les mêmes tests et mes messages ont passé. Le problème semble donc avoir été réglé.

Mise à jour 21h: Vidéotron viennent de publier cette explication sur leur page Facebook: Compte tenu du volume inhabituel de courriels envoyés avec la mention “www.loi78.com”, nos systèmes automatisés de sécurité informatique ont mis en place des mesures de protection pour nos clients, identifiant à tort cette situation comme une opération d’envoi massif de pourriels. Nous sommes intervenus afin de modifier les paramètres et permettre la transmission normale des messages.

La situation est complètement rétablie depuis 19 h 30. Vidéotron s’excuse des inconvénients que cette situation a pu causer à ses clients.

Voir aussi

Hibernating in OSX Lion

In OSX Lion (might also be the case for older versions to), there is no direct way to hibernate a laptop except running out of battery power. The only available option is sleep, which will wake from memory; so it keeps draining the battery. It is possible to change this default behavior with the utility pmset. From the man page:

So by default, the system uses hibernatemode=3. All we need to do it change it to 25 and the sleep function will hibernate the computer:

Don’t forget to change it back to 3 to get the default behavior back.

Efficient log processing

I’ve recently learned a couple of neat tricks to process large amounts of text files more efficiently from my new co-worker @nicolaskruchten. Our use-case is efficiently going through tens of gigabytes of logs to extract specific lines and do some operation on them. Here are a couple of things we’ve done to speed things up.

Keep everything gziped

Often, the bottleneck will be IO. This is especially true on modern servers that have a lot of cores and ram. By keeping the files we want to process gziped, we can use zcat to directly read the compressed files and pipe the output to whichever script we need. This reduces the amount of data that needs to be read from the disk. For example:

If you’re piping into a Python script, you can easily loop over lines coming from the standard input by using the fileinput module, like this:

Use parallel to use all available cores

GNU parallel is the coolest utility I’ve discovered recently. It allows you to execute a script that needs to act on a list of files in parallel. For example, suppose we have a list of 4 log files (exim_reject_1.gz, exim_reject_2.gz, etc) and that we need to extract the lines that contain gmail.com. We could run a grep on each of those files sequentially but if our machine has 4 cores, why not run all the greps at once? It can be done like this using parallel:

Breaking down the previous command, we tell parallel to run, using 4 cores, the command zcat {} | grep gmail.com, where {} will be substituted with each of the files matching the selector exim_reject*.gz. Each resulting command from the substitutions of {} will be run in parallel.

What’s great about it is that you can also collect all the results from the parallel executions and pipe them into another command. We could for example decide to keep the resulting lines in a new file like this:

Use a ramdisk

If you’ll be doing a lot of reading and writing to the disk on the same files and have lots of ram, you should consider using a ramdisk. Doing so will undoubtedly save you lots of IO time. On Linux, it is very easy to do. The following command would create an 8GB ramdisk:

In the end…

By using all the tricks above, we were able to considerably improve the overall runtime or our scripts. Well worth the time it took to refactor our initial naive pipeline.

64-bit Scientific Python on Windows

Getting a 64-bit installation of Python with scientific packages on our dear Windows isn’t as simple as running an apt-get or port command. There is an official 64-bit Python build available but extensions like numpy, scipy or matplotlib only have official 32-bit builds. There are commercial distributions such as Enthought that offer all the packages built in 64-bit but at around 200$ per license, this was not an option for me.

Stumbled upon the Python Extension Packages for Windows page that contains dozens of extensions compiled for Python 2.5, 2.6 and 2.7 in 32 and 64 bits. With these packages, I was able to get a working installation in no time.

Boston Music Hackday

I was thrilled to attend the Boston Music Hackday this week-end. A lot of people hacked up some pretty cool projects, many of us coding until the very early morning Sunday (aka 4am), only to get back up a few hours later (aka 8am) to keep at it until the dreaded 15h45 deadline, when we all had to submit our demos. The organisers did a wonderful job and the event was a success at every level.

The hack I did was called the PartyLister. The goal was mainly trying to come up with a way to generate steerable playlists that would also be personalized for a group of people (ie.: taking into account each of their musical taste and making sure everyone gets a song he likes once in a while). Given the very limited amount of time available to hack this up, I had to keep things simple and so I decided to use only social tags to do all the similarity computation. I excepted the quality of the playlists would suffer but the goal was really to develop a way to include multiple listeners in the track selection process. The algorithm should then be used in conjunction with something like the playlist generation model I presented at this year’s ISMIR.

My hack: PartyLister

Imagine you’re hosting a party and using the PartyLister as DJ for the night. Each of your guests will need to supply the software with his last.fm username and we’ll be good to go.

We go out and fetch from the last.fm API the social tags associated with the artists (and their top tracks) that our listeners know about. We also use the EchoNest API to get similar artists so we can present new artists to our listeners. From a user’s top artists, we can create a tag cloud that represents the user’s general musical taste (UMT). We’re also allowing each user to specify a set of tags that represent their current musical taste using a steerable tag cloud.

Suppose you have 3 guests at your party, where two like pop and the other likes metal. By doing a naive combination of the users’ musical taste, we’ll probably end up playing pop music, leaving our metalhead friend bored. To solve this, I added a user weight term which is determined by looking at the last 5 songs that played and computing the average similarity between the user’s musical taste and those songs. If we’re only playing pop songs, the metalhead will have a very low similarity between his taste and what played and so we’ll increase his weight and lower the pop lovers’ weights. When we pick the next song, this weighting scheme will allow the metalhead’s taste to count more than the pop lovers’, even if there are more of them. This will make us play a more metal-like track. After a while the weights will equal out and we’ll start playing pop music again.

For sparseness reasons, I operated on artists instead of tracks. A simplified version how I weighted each candidate artist is below. Lambda is simply a knob to determine how much the users’ musical taste will count, cd() represents the cosine distance and UMT represents a combination of the user’s general musical taste and his steerable cloud.

The following plot represents a running average of the cosine distance (dissimilarity) between users’ musical taste and the last 5 songs that played. It represents a 160 songs playlist with 3 listeners in the system.

dave_paul_frank_160

As you can see, as a user’s running average increases, his weight is also increased so that we start playing more songs that fit his taste. His average then decreases as the other users’ weights go up forcing a return to music that fits their taste a little more. The plot shows that the system seems to be doing what we want, that is taking into account the musical taste of multiple users and playing music that each person will like once in a while. Integrated in a real playlist generation model, I believe this could produce interesting results.

I also played with a discovery setting, where users could specify if they wanted to discover new songs or stick to what they know. This was achieved by adding a bonus or penalizing each candidate’s score, based on the discovery setting (float between 0 and 1) and the proportion of users who knew (had already listened to) the artist in question.

PartyLister was not a very visually or sonically attractive hack like some of the others but I still managed to win a price based on popular vote. Thanks to all the great sponsors, there were a lot of prizes and so lots of winners.

Below is the Université de Montréal delegation, Mike Mandel (who also won a price for his Bowie S-S-S-Similarities) and myself, with our bounty.

P1020732

I really hope to attend another hackday soon as it was all a lot of fun. Time to go get some sleep now.

ISMIR 2009

I had a paper accepted with an oral presentation at this year’s ISMIR held in Kobe, Japan. The paper is called Steerable Playlist Generation by Learning Song Similarity from Radio Station Playlists and is co-authored with Eck, Desjardins and Lamere. It outlines two new ideas:

  1. Using commercial radio station playlists to learn a similarity space from audio features
  2. Use a steerable tag cloud to allow the user to influence the playlist generation

Here is the abstract:

This paper presents an approach to generating steerable playlists. We first demonstrate a method for learning song transition probabilities from audio features extracted from songs played in professional radio station playlists. We then show that by using this learnt similarity function as a prior, we are able to generate steerable playlists by choosing the next song to play not simply based on that prior, but on a tag cloud that the user is able to manipulate to ex- press the high-level characteristics of the music he wishes to listen to.

My time at Sun Labs and pyaura

My internship at Sun Microsystems Labs, which has been going on for about 15 months – 9 of those full time at their campus in the Boston area – is coming to an end. During the course of those months, I’ve met a lot of very smart and fun people, I’ve worked on very challenging and stimulating problems and I’ve discovered a bunch of really good New England beers.

All my work has been centered around the Aura datastore, an open-source, scalable and distributed recommendation platform. The datastore is designed to handle millions of users and items and can generate content-based recommendations based on each item’s aura (aka tag cloud).

Last summer, under the supervision of Paul Lamere, I worked a lot more on our music recommendation web application, called the Music Explaura and designed a steerable recommendation interface. (We also have a Facebook companion app to the Explaura that was created by Jeff Alexander.)

This summer, I worked with Steve Green on many different things, including what I’d like to talk about in this post, pyaura, a Python interface to the datastore.

pyaura

The idea behind pyaura is to get the best of both world. While the datastore is very good at what it does – storing millions of items and being able to compute similarity between all of them very quickly – the Java framework surrounding it is a bit too rigid to quickly hack random research code on top of it. While my actual goal was to experiment with ways of doing automatic cleanup and clustering of social tags, I felt I was missing the flexibility I wanted and was used to getting when working on projects using Python’s interactive environment.

Without going into details, since the datastore is distributed and has many different components, it uses a technology called Jini to automatically hook them all up together. Jini takes care of automatic service discovery so you don’t have to manually specify IP adresses and so on. It also allows you to publicly export functions that remote components can call. A concrete example would be the datastore head component allowing the web server component to call it’s getSimilarity() function on two items. The computation goes on in the datastore head and then the results get shipped across the wire to the web server so it can serve its request. However, Jini only supports Java leaving us no direct way to connect to the datastore using Python.

After looking around for a bit, I stumbled upon a project called JPype, which essentially allows you to launch a JVM inside Python. This allows you to instantiate and use Java objects in a completely transparent way from within Python. Using JPype, I built two modules which together, allow very simple access to the datastore though Python.

  • AuraBridge: A Java implementation of the Aura datastore interface. The bridge knows about the actual datastore because it can locate it and talk to it using Jini.
  • pyaura: A set of Python helper functions (mostly automatic type conversion). pyaura instantiates an AuraBridge instance using JPype and uses it as a proxy to get data to and from the datastore.

Example

To demonstrate how things become easy when using pyaura, imagine you are running an Aura datastore and have collected a lot of artist and tag information from the web. You might be interested in quickly seeing the number of artists that have generally been tagged by the each individual tag you know about. With these few lines of code, you can get a nice histogram that answers just that questions:

The above code produces the following plot:

tag_counts_histo

This is the result we expect, as this was generated with a datastore containing 100,000 artists. As less and less popular artists are added to the datastore, the effects of sparsity in social data kick in. Less popular artists are indeed tagged with less tags than popular artists, leading to the situation where very few tags were applied to more than 5000 artists.

This is a small example but it shows the simplicity of using pyaura. With very few lines of code, you can do pretty much anything with the data stored in Aura. This hopefully will make the Aura datastore more accessible and attractive to projects looking to take advantage of both its scalability and raw power as well as have the flexibility to quickly hack on top of it.

Restore sparsebundle extended attributes after rsync

If you rsync a sparse bundle to another Mac without the -E flag (or if you copy it to a non Mac system), you will loose the ability to double click on it in the Finder to mount it. This is because the extended attributes telling the Finder the folder is actually a bundle are lost in the transfer.

The following piece of code I found here fixed the problem for me. Simply compile and run the code giving the path to the bundle in parameter and it will restore the attributes.