Guy Macon http://www.guymacon.com/ wrote:

I received an email the following URLs:

http://craic.com/forensics/uscf_usen...t_20071206.pdf

http://rs235.rapidshare.com/files/62...ottershead.zip

I haven't evaluated them, but I recognize the name of the author of the
craic.com document, and he is indeed an expert who's conclusions can be
trusted.

More later.

OK, it's now later.

First I looked at the mottershead report, devoting roughly 30
minutes to it.

The mottershead.zip files says that when Truong moved from AOL to
Lubbock, the fakes moved to Lubbock and when Truong visited Mexico
city, the fakes visited Mexico city. There are six possible
explanations that I can think of, some far more likely than others.
My comments on each are further below:

Possible explanation #1:
Truong is the fake.

Possible explanation #2:
Someone else had physical access to Truong's computer or to another
computer on his local network.

Possible explanation #3:
Mottershead fabricated the data that his report was based upon.

Possible explanation #4:
Someone else fabricated the logs Mottershead relied upon.

Possible explanation #5:
Someone controlling Truong's PC remotely is the fake.

Possible explanation #6:
IP address spoofing

Can anyone think of another possibility, no matter how remote?

Next I turned my attention to the report from Robert Jones of
Craic Computing. Mr. Jones is a well-known expert in this field.
I estimate my own skills in this area to be roughly equal to those
of Mottershead, and both of us to have skills far below those of
Jones. Jones concludes that the data he examined shows that the
fake Usenet posts were sent from the IP address as USCF user
"chesspromotion."

Just to make sure, can someone here please confirm the assertion
that Truong openly identified himself as being "chesspromotion?"

My comments on the possible explanations listed above:

Possible explanation #6:
IP address spoofing

On multiple systems at multiple ISPs? Nope.

Possible explanation #5:
Someone controlling Truong's PC remotely is the fake.

....and managed to pretty much do the controlling while Truong
was at the keyboard? And managed to infect a new PC running
the Tablet PC version of Vista? Hard to believe.

Possible explanation #4:
Someone fabricated the logs Mottershead relied upon.

This requires the USCF servers to have been taken over remotely,
the USCF sysadmins to be incompetent, and no other crackers or
trojans taking over and causing ill effects other than a few logs
being changed. I don't buy it, but I would still scan that network
just to be sure


Possible explanation #3:
Mottershead fabricated the data that his report was based upon.

Hard to say. Has anyone else examined the actual servers just
in case such a fabrication was done through post editing? Or
checked the timestamps and backups of the server data to see
if the supposed fabrication missed a backup or two? Does
Mottershead have motive as well as opportunity?

Possible explanation #2:
Someone else had physical access to Truong's computer or to another
computer on his local network.

No way to tell whether a wife/girfriend or child was pretending to
be Truong, but wouldn't he notice bogus posts in his name on USCF
servers? I don't believe it. As for someone else on a local
network, did the network move to Mexico when Truong visited? Again,
I don't buy it. I would still scan those PCs, though, just to be sure

Possible explanation #1:
Truong is the fake.

Before coming to this conclusion, I would like to invite those who think
that Truong isn't the fake to please weigh in with possible explanations
I may have missed, rational analysis of my comments above, or any other
reasoned discussion. I try very hard to be fair to everyone, and welcome
anyone blowing holes in my reasoning.


--
Guy Macon
http://www.guymacon.com/

Guy Macon http://www.guymacon.com/ wrote:

Possible explanation #5:
Someone controlling Truong's PC remotely is the fake.

...and managed to pretty much do the controlling while Truong
was at the keyboard? And managed to infect a new PC running
the Tablet PC version of Vista? Hard to believe.

A recent post from one "Stray Cat" relates to my comment above.
I agree that Jones analysis was flawed on this point.
I would welcome a similar refutation of my conclusions
about such malware moving to a new PC with a different OS.

"Stray Cat" wrote:

quote Jones
It would require considerable sophistication for some one to hijack
the "chesspromotion" computer and use it to interact with remote
websites without the real user being aware of it. I do not view
this as a likely scenario.
/quote Jones


I totally disagree with you on your apparent dismissal of the
likelihood of a trojan infection explaining the observations. Your
admitted stated lack of familiarity with the people involved, and
therefore also with their levels of determination, motivation,
time-availability, financial resources and, most importantly,
technical sophistication, renders what might have been, against a
different backdrop, a perfectly reasonable view, into one that is
hard to objectively justify.


Let us hypothetically assume that you possess all the qualities
stated in the preceding para, saving the technical expertise,
which I guess I do not have to go hypothetical about. Are you
honestly suggesting that, given the opportunity for installing
malware such as |Back Orifice v3.X.X|, that you could not have
"pulled off" the sting yourself? Of course you could have, and so
could tens of thousands of other people. There are thousands of
virus-writers "out there", and the sophistication needed for the
surreptitious, mala fide (sic) operation of a backdoor requires
notably less skill than the creation and dissemination of (say) a
handcrafted virus.


Hence the requirement for technical sophistication is not, in my
expert opinion, the limiting factor, but the question of whether
people with the other qualities (motive, determination etc.) exist
in sufficient numbers to make it reasonable to suppose that at
least one of them would have the required skills. Both the stars
the drama are accomplished self-publicists and each may at times
appear abrasive. One of them, in the opinion of many, including
myself - apparently craves notoriety. Solely for the purpose of
assessing whether it is likely that there are literally thousands
of people bearing a grudge against this prostating protagonist,
you could do worse than follow some of the 30-40 links posted by an
unnamed fan in an expiring message, preserved by myself on 12/20 at
http://google.com/group/alt.privacy....8caa3804f5edc1
Strong emotions may be stirred by material that many will see as
scandalous.


In the light of the above, your implied view that it is unlikely
that sufficiently many people exist with a grudge against one or
both of the protagonists for it to be probable that at least one
exists with the technical sophistication to carry out the covert
and extended hijack of the computer of the accused is seen to be at
odds with the available evidence.




--
Guy Macon
http://www.guymacon.com/

On Jan 16, 9:17 pm, Guy Macon http://www.guymacon.com/ wrote:

First I looked at the mottershead report, devoting roughly 30
minutes to it.

In view of the fact that this report was posted here
and discussed *many times* by the real SS, all that
can be said is "it's about time!"


The mottershead.zip files says that when Truong moved from AOL to
Lubbock, the fakes moved to Lubbock and when Truong visited Mexico
city, the fakes visited Mexico city. There are six possible
explanations that I can think of, some far more likely than others.
My comments on each are further below:

Possible explanation #1:
Truong is the fake.

The above paragraph used the plural, "fakes",
while there is a sudden switch to the singular.

As I've noted before, SS is plagued by this
same problem; nobody seems to be able to
keep things straight in their mind, instead
switching back and forth on a whim.


Possible explanation #2:
Someone else had physical access to Truong's computer or to another
computer on his local network.

Possible explanation #3:
Mottershead fabricated the data that his report was based upon.

Possible explanation #4:
Someone else fabricated the logs Mottershead relied upon.

Possible explanation #5:
Someone controlling Truong's PC remotely is the fake.

Possible explanation #6:
IP address spoofing

Can anyone think of another possibility, no matter how remote?

How about this: Paul Truong has an invisible
twin, who follows him everywhere and frames
him by posting with his computer as Fake SS?

Or this: some people don't like the idea that SS
"caught" the/a Fake SS, so they desperately try
to avoid facing facts, like the strange way in
which the/a Fake SS traveled to the same places,
at the very same times as PT? It's hard to take,
sort of like when Bill Brock lost the grudge match
to Sam Sloan, so some people tend to go into
denial.


Next I turned my attention to the report from Robert Jones of
Craic Computing. Mr. Jones is a well-known expert in this field.
I estimate my own skills in this area to be roughly equal to those
of Mottershead, and both of us to have skills far below those of
Jones. Jones concludes that the data he examined shows that the
fake Usenet posts were sent from the IP address as USCF user
"chesspromotion."

Just to make sure, can someone here please confirm the assertion
that Truong openly identified himself as being "chesspromotion?"

My comments on the possible explanations listed above:

Possible explanation #6:
IP address spoofing

On multiple systems at multiple ISPs? Nope.

Possible explanation #5:
Someone controlling Truong's PC remotely is the fake.

...and managed to pretty much do the controlling while Truong
was at the keyboard? And managed to infect a new PC running
the Tablet PC version of Vista? Hard to believe.

Possible explanation #4:
Someone fabricated the logs Mottershead relied upon.

This requires the USCF servers to have been taken over remotely,
the USCF sysadmins to be incompetent, and no other crackers or
trojans taking over and causing ill effects other than a few logs
being changed. I don't buy it, but I would still scan that network
just to be sure

Possible explanation #3:
Mottershead fabricated the data that his report was based upon.

Hard to say. Has anyone else examined the actual servers just
in case such a fabrication was done through post editing? Or
checked the timestamps and backups of the server data to see
if the supposed fabrication missed a backup or two? Does
Mottershead have motive as well as opportunity?

Possible explanation #2:
Someone else had physical access to Truong's computer or to another
computer on his local network.

No way to tell whether a wife/girfriend or child was pretending to
be Truong, but wouldn't he notice bogus posts in his name on USCF
servers? I don't believe it. As for someone else on a local
network, did the network move to Mexico when Truong visited? Again,
I don't buy it. I would still scan those PCs, though, just to be sure

Possible explanation #1:
Truong is the fake.

Before coming to this conclusion, I would like to invite those who think
that Truong isn't the fake to please weigh in with possible explanations
I may have missed, rational analysis of my comments above, or any other
reasoned discussion. I try very hard to be fair to everyone, and welcome
anyone blowing holes in my reasoning.

My guess is that the real SS provided a list of
postings (to which he took strong offense) for
examination by Mr. Mottershead. I don't like
that approach. It seems better if an independent
analyst were to examine many postings,
selected at random, by many different posters,
and then draw any conclusions. That way, if
there were two or three different Fake SS's,
this would have a shot at catching the fact.

The approach of specifically targeting Paul
Truong is a bit unfair, in my view. Suppose
there were three Fake SSs, but because only
one person was "investigated" it was concluded
that "the" Fake SS was PT; in effect, he is
convicted not only for his own crimes, but for
the crimes of all the "copycat killers" as well.

Another issue is that some folks simply aren't
smart enough to perform this kind of work. Take
Larry Parr, for instance; he claims to have
performed what he calls a syntax analysis, and
concluded that the people he fears most are
responsible for all his recent troubles. In this
example, the conclusion was predetermined, not
by facts or methodology, but by personal bias
and emotion. Now when you look at it, Mr. Sloan
also seems to suffer from emotional issues with
regard to Paul Truong, so any "work" he does in
this area is automatically suspect.

In conclusion, I think it wise to keep an open
mind as to the possibility of more-than-one
Fake Sam Sloan, and certainly, more than one
Fake everybody-offended. Even if Paul Truong
can be proved responsible for many of these
postings, that is not proof that he did them all.


-- help bot

help bot wrote:
My guess is that the real SS provided a list of postings (to which
he took strong offense) for examination by Mr. Mottershead. I don't
like that approach. [...]

Mottershead, in his report, says that he examined nearly 2,500 Usenet
posts. He says `a number of "Fake Sam Sloan" posts came to my
attention', which may mean that somebody contacted him with a list of
suspect posts. However, it's almost certain that the data on which
the report is based was obtained just by searching for all posts from
the suspect E-mail addresses. It would take forever to compile a list
of 2,500 posts and to look at them one by one.

The approach of specifically targeting Paul Truong is a bit unfair,
in my view. Suppose there were three Fake SSs, but because only one
person was "investigated" it was concluded that "the" Fake SS was
PT; in effect, he is convicted not only for his own crimes, but for
the crimes of all the "copycat killers" as well.

I agree that the report does not prove that Truong was the *only* Fake
Sam Sloan. However, there are four IP addresses tied quite closely to
Truong: the long-term Roadrunner address, the two Suddenlink addresses
Lubbock TX and the one in Mexico City. Over the period from July 2006
to September 2007, it many Fake Sam Sloan posts originated from these
addresses. Even if he didn't send all the others, that's still
massively improper behaviour.


Dave.

--
David Richerby Addictive Mexi-.com (TM): it's like
www.chiark.greenend.org.uk/~davidr/ an E-commerce portal that comes from
Mexico but you can never put it down!

help bot wrote:

In view of the fact that this report was posted here
and discussed *many times* by the real SS, all that
can be said is "it's about time!"

Some of us have actual lives to live. I spent 3 weeks
last month at a remote jobsite, too busy to read chess
newsgroups, and I go back Sunday. If you have a
requirement that I read everything posted here, let me
know and I will give you an estimate of how much you
would have to pay me. Otherwise, me asking for a URL
for something that has not been recently posted is
something you will have to accept. Feel free to use
your killfile if my not reading every post upsets you
too much.

The above paragraph used the plural, "fakes",
while there is a sudden switch to the singular.

Minor variation of wording that is of no import.
fake posts = plural (there was more than one post).
Fake posters may be plural or singular; I refuse to
assume without evidence one or the other.

As I've noted before, SS is plagued by this
same problem; nobody seems to be able to
keep things straight in their mind

Do you have evidence that I am unable to keep
things straight in my mind, or are you just
being an asshole out of habit?

Can anyone think of another possibility, no matter how remote?

How about this: Paul Truong has an invisible
twin, who follows him everywhere and frames
him by posting with his computer as Fake SS?

Sure. That fits the definition given, "another possibility,
no matter how remote?" If you or anyone else provides evidence
of such an invisible twin, I will evaluate it.

Another remote possibility is documented in the movie
_The Matrix_. That's another one I will evaluate when
someone provides evidence.

Or this: some people don't like the idea that SS
"caught" the/a Fake SS, so they desperately try
to avoid facing facts, like the strange way in
which the/a Fake SS traveled to the same places,
at the very same times as PT? It's hard to take,
sort of like when Bill Brock lost the grudge match
to Sam Sloan, so some people tend to go into
denial.

I can't speak for the "some people" you reference.
I can only speak for myself.

I might also point out that personal attacks on me and
arguments based upon them do not strengthen your case.
Rather the opposite, in fact.

Just to make sure, can someone here please confirm the assertion
that Truong openly identified himself as being "chesspromotion?"

Nor does ignoring a direct question such as I posed above
strengthen your case.

My guess is that the real SS provided a list of
postings (to which he took strong offense) for
examination by Mr. Mottershead. I don't like
that approach. It seems better if an independent
analyst were to examine many postings,
selected at random, by many different posters,
and then draw any conclusions. That way, if
there were two or three different Fake SS's,
this would have a shot at catching the fact.

That seems to be a reasonable request.

The approach of specifically targeting Paul
Truong is a bit unfair, in my view. Suppose
there were three Fake SSs, but because only
one person was "investigated" it was concluded
that "the" Fake SS was PT; in effect, he is
convicted not only for his own crimes, but for
the crimes of all the "copycat killers" as well.

Not by me. I don't assume things without evidence.

In conclusion, I think it wise to keep an open
mind as to the possibility of more-than-one
Fake Sam Sloan, and certainly, more than one
Fake everybody-offended. Even if Paul Truong
can be proved responsible for many of these
postings, that is not proof that he did them all.

Indeed.

Another issue is that some folks simply aren't
smart enough to perform this kind of work.

Again, I can't speak for the "some folks" you
reference. I can only speak for myself, and I am
quite able to do this sort of work. My main
limitation at this point is interest; I was willing
to devote 30 minutes to checking a few of the posts
that I chose at random, but am unwilling to give it
the time needed to do the analysis needed to fully
evaluate the report.

Take Larry Parr, for instance; he claims to have
performed what he calls a syntax analysis, and
concluded that the people he fears most are
responsible for all his recent troubles. In this
example, the conclusion was predetermined, not
by facts or methodology, but by personal bias
and emotion. Now when you look at it, Mr. Sloan
also seems to suffer from emotional issues with
regard to Paul Truong, so any "work" he does in
this area is automatically suspect.

I don't know about Larry, but what you write is
certainly true about Sloan. But what about Help
Bot? Are you sure that *you* are free of personal
bias and emotional issues? That might explain some
of your unwarranted personal attacks against me.
I think not, though. My personal opinion is that
you are simply in the habit of being an asshole.


--
Guy Macon
http://www.guymacon.com/

On Jan 17, 9:07 am, Guy Macon http://www.guymacon.com/ wrote:

help bot wrote:
In view of the fact that this report was posted here
and discussed *many times* by the real SS, all that
can be said is "it's about time!"

Some of us have actual lives to live. I spent 3 weeks
last month at a remote jobsite, too busy to read chess
newsgroups

Look, dufus: if you're so busy, then how is it you
were posting comments on this issue without
knowing the first thing about the evidence? It
seems to me, those comments were just shots
in the dark since you didn't bother to get up to
speed on the facts of the case which had been
posted and discussed here *repeatedly*.

The behavior reminded me of Larry Parr and his
evil ratpack -- a bunch of imbeciles who also
posted comments but who, unlike you, continued
to deny having ever seen the Mottershead report
so as to avoid any inconvenient evidence which
might get in the way of their baseless opinions.

Now you are aping the behavior of prior PT
apologists, by looking for any explanation which
might somehow turn PT into the victim, not the
perpetrator. I find that to be just plain silly, in
view of certain facts which you no doubt could
also claim ignorance of; like SP's vainglorious
Web site, for instance, which is filled with lies
and fabrications -- reputedly the handiwork of
none other than Paul Truong. It fits a pattern,
if you bother to think about it. Unless SP is
wholly responsible, there is no reason whatever
to fumble around for "PT is the victim here"
nonsense. Just look at the facts. IMO, even
if PT was "framed" as a/the Fake SS, he is
probably guilty as hell of the travesty that is
SP's Web site, hence a scumbag loser.

Count 'em: numerous commentaries were
posted by Mr. Too-busy, who now doesn't like
it when I point out the fact of his cluelessness
as to the evidence already presented here.
At least Sam Sloan's comments, biased as
they may be, were not based on complete
ignorance of the evidence.


-- help bot

On Jan 17, 8:07*am, Guy Macon http://www.guymacon.com/ wrote:

Some of us have actual lives to live. *I spent 3 weeks
last month at a remote jobsite, too busy to read chess
newsgroups, and I go back Sunday. *If you have a
requirement that I read everything posted here, let me
know and I will give you an estimate of how much you
would have to pay me. *

Yes the old "I am busier than you" nonsense, and of course, demands
for payment of the time. Underneath all the bravado resides a self-
righteous jackass.

TO GUY MACON

Dear Sir,

We all owe you a debt of gratitude for your analysis
of the Mottershead Report. Yours is an infrequent voice
of reason on these forums.

For the record, Greg Kennedy (help bot) lies when stating
that this writer denies seeing the Mottershead Report.

You need not consult much that Greg writes here.
He is a deeply embittered factory worker in Indiana who
hates his job and hates anyone who has some success
in this life.

Mind you, there is nothing wrong with working in
a factory. That's called honest labor in most
instances. The problem is blaming others for his
blight and plight and the hatred of those whom he
regards as his betters, such as grandmasters.

Guy: here is how our Greg conducts his
intellectual business. Several years back, I
published here several long essays about Edward
Winter's attack on GM Larry Evans. In an initial
posting, Greg said these essays were boring and so
forth. A few days later, forgetting about his little
lie (as all who lie tend to do) Greg said that he
stayed up an entire night reading my stuff.

He also claimed that GM Evans "brainwashed"
America into accepting Fischer's conditions against
Karpov in 1975 when, in point of fact, the 5-time U.S.
champion was virtually the sole voice in Chess Life
opposing Fischer's conditions.

Alas, that's how our Greg happens to be.

JACKASS

Your next attacker here is one Stephen Dowd/James
Rynd. He bifurcates quite a lot here and will
disappear at some point. He then returns angrily.

Stephen Dowd, for your info, is NOT
self-righteous, though "jackass" is not a bad
predicate nominative to represent the man, though
there are still better phrases.

Dowd/Rynd once forged my name at a university
site -- so filled with spite was he.

Forgers are seldom self-righteous types, and our
Dowd does not break the mould.

Yours, Larry Parr

SBD wrote:
On Jan 17, 8:07?am, Guy Macon http://www.guymacon.com/ wrote:

Some of us have actual lives to live. ?I spent 3 weeks
last month at a remote jobsite, too busy to read chess
newsgroups, and I go back Sunday. ?If you have a
requirement that I read everything posted here, let me
know and I will give you an estimate of how much you
would have to pay me. ?

Yes the old "I am busier than you" nonsense, and of course, demands
for payment of the time. Underneath all the bravado resides a self-
righteous jackass.

Guy Macon http://www.guymacon.com/ wrote:
Some of us have actual lives to live. I spent 3 weeks last month at
a remote jobsite, too busy to read chess newsgroups, and I go back
Sunday. If you have a requirement that I read everything posted
here, let me know and I will give you an estimate of how much you
would have to pay me. Otherwise, me asking for a URL for something
that has not been recently posted is something you will have to
accept.

http://www.just****inggoogleit.com/?...ershead+report


Dave.

--
David Richerby Confusing Flower (TM): it's like a
www.chiark.greenend.org.uk/~davidr/ flower but you can't understand it!

help bot wrote:

Look, dufus:

I deleted the rest of your post unread. Repeated
personal attacks will gain you nothing except plonking.

If you decide to be civil, we can have a reasoned
discussion.

--
Guy Macon
http://www.guymacon.com/