June 2003 - NANOG - lists.nanog.org

Mailing list for AADS participants
by John Kristoff 26 Jun '03

26 Jun '03

Regardless of what many of you may think of AADS generally, are there people who would be interested in joining an AADS mailing list, primarily to be used for broadcasting downtime notices or for discussing Chicago NAP specific issues. Perhaps a mailing list for other specific exchanges may be in order also and I'll entertain hosting those as well, but I'm presently interested in AADS since that is where we are at. Please reply offline. If there appears to be enough interest I'll setup the list and make a single announcement here. Please pass this on to others as appropriate. John

4 3

RE: Mailing list for AADS participants
by Malayter, Christopher 26 Jun '03

26 Jun '03

Even more sad, The product manager for AADS does not return phone calls, even after multiple calls and voicemails. -Chris/AS4181 -----Original Message----- From: Jeff Bartig To: John Kristoff Cc: nanog(a)merit.edu Sent: 6/26/03 5:24 PM Subject: Re: Mailing list for AADS participants On Tue, Jun 24, 2003 at 06:12:21PM -0500, John Kristoff wrote: > Regardless of what many of you may think of AADS generally, are > there people who would be interested in joining an AADS mailing > list, primarily to be used for broadcasting downtime notices or > for discussing Chicago NAP specific issues. > > Perhaps a mailing list for other specific exchanges may be in > order also and I'll entertain hosting those as well, but I'm > presently interested in AADS since that is where we are at. > > Please reply offline. If there appears to be enough interest > I'll setup the list and make a single announcement here. Please > pass this on to others as appropriate. People still use the AADS NAP? :-( All of the departures are getting frustrating, especially after we upgraded our full OC-3 to an OC-12. All our big peers went bankrupt or depeered with us after that. Sure, I would like to join this type of list. It is too bad that SBC doesn't already run a list like this or make any effort to promote peering at the NAP. Have you gotten any other interest in it? Jeff -- Jeff Bartig | University of Wisconsin - Madison jeffb(a)doit.wisc.edu | Division of Information Technology (608) 262-8336 | Network Services/WAN Engineering

1 0

companies like microsoft and telia...
by Paul Vixie 26 Jun '03

26 Jun '03

...are doing more to help spam than to stop it, in spite of themselves. consider microsoft-yahoo-aol's big fad of the moment which is suing spammers and blaming asia. the number one (#1) contributor to spam is open proxies running on windows/xp, several of which are installed by default as side effects of other user activities. spam can now come from tens of millions of untraceable places, and since it's an open proxy rather than an open relay there isn't even a Received: header trail. WHAT a marketing department, though, to be able to (successfully!) blame spam on asia. but what have we here? i would not have imagined that in 2003 any company could be as blatantly irresponsible as to behave the way telia documents here: route: 217.208.0.0/13 descr: TELIANET-BLK remarks: Abuse issues should be reported at remarks: http://www.telia.com/security/ remarks: Mail to abuse(a)telia.net will be auto-replied remarks: and referred to the URL above. origin: AS3301 mnt-by: TELIANET-RR changed: rr(a)telia.net 20010508 source: RIPE excuse me, telia, but your customers are spamming me, and i have no plans to teach lartomatic (my homebrew complaintbot) how to log into your web site. it is the year 2003, and you bloody well need to learn how to accept complaints about YOUR CUSTOMERS using a format that is most convenient to THE VICTIMS. (and you should be THANKING US FOR IT since we are DOING YOUR WORK FOR YOU.) grrrrrrrrrrrrr. clearly i need to stop accepting e-mail from 217.208.0.0/13.

7 6

Re: Weird email messages with "re:movie" and "re:application" in the subject line..
by Steven M. Bellovin 26 Jun '03

26 Jun '03

In message <2147483647.1056635153(a)[192.168.1.102]>, John Payne writes: > > >--On Wednesday, June 25, 2003 23:37 -0400 "Steven M. Bellovin" ><smb(a)research.att.com> wrote: > >> And I've gotten bounces from mail allegedly from me. It's not L3's >> fault; this particular worm forges From: lines on its email. > >fault is debatable. Because forgeries are now so common, particularly in >worms, why would you send these notifications to anyone other than the >recipient? Let the human decide if the right thing to do is notify the >sender. > > Personally, I blame the anti-virus companies who market the software. They know which viruses forge From: lines; why should their "alert the poor infected fool" software send notes to folks whose addresses are being spoofed? --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

2 1

Re: Weird email messages with "re:movie" and "re:application" in the subject line..
by Steven M. Bellovin 26 Jun '03

26 Jun '03

In message <200306260325.h5Q3PP5U025759(a)nic-naa.net>, Eric Brunner-Williams in Portland Maine writes: > > >> W32/sobig.e@MM per McAffee..... > >I seem to have done one better ... according to a M$ host in Level3-land, >the Unix box right in front of me sent the mail in question. > >Someone at L3 needs to call home. The only L3 turd in my mail log is their >inbound... > >Jun 25 18:21:11 nic-naa sm-mta[24589]: h5PMLB5U024589: from=<administrator@Lev >el3.com>, size=1711, class=0, nrcpts=1, msgid=<012d01c33b68$2bd14b40$d706010a@ >corp.global.level3.com>, proto=ESMTP, daemon=MTA, relay=machine77.Level3.com [ >209.244.4.106] And I've gotten bounces from mail allegedly from me. It's not L3's fault; this particular worm forges From: lines on its email. Another day, another worm. --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

2 1

Re: companies like microsoft and telia...
by Paul Vixie 26 Jun '03

26 Jun '03

> Closely related to the problems of open proxies and arcane > abuse reporting procedures is the problem of offering so-called > "bullet proof" web site hosting. ISPs that adopt AUPs that > permit the hosting of sites being spamvertised should be shot > on site. www.spamhaus.org tries to do just that. for example, i'm very concerned about my friends over at optigate at the moment. > Note that this would include your friends at Telia, I believe, > as well as ATT/AS7018. i don't think telia or at&t are signing so-called "pink" contracts.

1 0

RE: Fiber cut in PA?
by Temkin, David 26 Jun '03

26 Jun '03

According to Yipes it was just two customers affected - a landscaping truck caught fire and took out a spur at Route 30 & Route 100... -----Original Message----- From: Nick Nelson [mailto:nick@lunarpages.com] Sent: Thursday, June 26, 2003 1:14 PM To: nanog(a)nanog.org Subject: Fiber cut in PA? Has anyone heard any details on the fiber cut in PA affecting AT&T, and possibly from what I understand Yipes and webreseller.net? >From my understanding it's an auto accident, but beyond that I haven't been able to find any details.. Anyone? cheers, nick -- Nick Nelson // USA: 1-877-Lunarpages nick(a)lunarpages.com // UK: 0800 0729150 Lunarpages.com // INTL: 1-714-521-8150 IMPORTANT:The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

1 0

Fiber cut in PA?
by Nick Nelson 26 Jun '03

26 Jun '03

Has anyone heard any details on the fiber cut in PA affecting AT&T, and possibly from what I understand Yipes and webreseller.net? >From my understanding it's an auto accident, but beyond that I haven't been able to find any details.. Anyone? cheers, nick -- Nick Nelson // USA: 1-877-Lunarpages nick(a)lunarpages.com // UK: 0800 0729150 Lunarpages.com // INTL: 1-714-521-8150

1 0

Re: companies like microsoft and telia...
by Steven M. Bellovin 26 Jun '03

26 Jun '03

In message <g3u1ac23g8.fsf(a)sa.vix.com>, Paul Vixie writes: > >Kauto.Huopio(a)ficora.fi (Huopio Kauto) writes: > >> How about IODEF? Lots of CERT:s and company-internal abuse teams:s ticketing >> systems are going to eat it with ease - if not now, soon. > >please post a url so we can all take a look at the "IODEF" complaint format. >-- >Paul Vixie > See http://www.ietf.org/html.charters/inch-charter.html --Steve Bellovin, http://www.research.att.com/~smb (me) http://www.wilyhacker.com (2nd edition of "Firewalls" book)

1 0

RE: companies like microsoft and telia...
by Huopio Kauto 26 Jun '03

26 Jun '03

>> Perhaps someone could write a bcp for an email-form that lays out the same >> information so we can make the complaints use this format and all abuse >> departments can accept using this form, to get some structure to it? >yow. i first asked that this be done in 1998, and for this very reason >among others. can anybody beat that date (with an earlier one?) this is >a hard problem but with outlook forms and sri-style ascii templates it's >quite achievable. note though that many abusebots will reject MIME >since it might contain a virus. and, there will be huge controversies >about header munging, list cleaning, complaint forwarding, and >definitions of >"abuse", "consent", "implied consent", "recourse", and "standing". >so if ``someone'' writes this up, count me as a grateful&willing >reviewer. >-- >Paul Vixie How about IODEF? Lots of CERT:s and company-internal abuse teams:s ticketing systems are going to eat it with ease - if not now, soon. --Kauto FICORA / CERT-FI

2 1