- NANOG - lists.nanog.org

Re: Abuse response [Was: RE: Yahoo Mail Update]
by Paul Ferguson 15 Apr '08

15 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Suresh Ramasubramanian" <ops.lists(a)gmail.com> wrote: >Do ARF, do IODEF etc. You will find it much easier for abuse desks >that care to process your reports. You will also find it easier to >feed these into nationwide incident response / alert systems like >Australia's AISI (google it up, you will like the concept I think) > Really. How many people are actually doing IODEF? http://www.terena.org/activities/tf-csirt/iodef/ Honestly? And the other regional "formats"? This is kind of what I mean when I talk about disjointed and discombobiulated processes of reporting abuse. It should be simple -- not require a freeking full-blown "standard". - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIBEo/q1pz9mNUZTMRAvphAKCTmSmbRHBCq9wuK9U+PDR+PFxWtQCgpV8s z5EJEitF6mIhHspeNuVNMOU= =x2Qh -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

Re: Abuse response [Was: RE: Yahoo Mail Update]
by Paul Ferguson 15 Apr '08

15 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Suresh Ramasubramanian" <ops.lists(a)gmail.com> wrote: >If you send reports with lots of legal boilerplate, or reports with >long lectures on why you expect an INSTANT TAKEDOWN, and send them to >a busy abuse queue, there is no way - and zero reason - for the ISP >people to prioritize your complaint above all the other complaints >coming in. Having elided the rest of this exchange, and also understanding exactly what you are talking about, I encourage you to elaborate on the point you are trying to make... As you well know, there are many of us who have been working on this particular issue for years, with wildly varying degrees of success. There is no pat answer... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIBEFTq1pz9mNUZTMRArvBAJ0XvKGXrL5yCKttE/0g1cxpkuWwAwCcCnw8 7Y8Q1TPWRnpvVH/5fdh5r2c= =Gcoo -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Yahoo Mail Update
by Rob Szarka 15 Apr '08

15 Apr '08

At 01:58 AM 4/13/2008, you wrote: >Why should large companies participate here about mail issues? Last I >checked this wasn't the mailing list for these issues: True, though some aspects of mail service are inextricably tied to broader networking issues, and thus participation here might still benefit them. But sadly Yahoo doesn't even seem to participate in more relevant forums, such as the spam-l list. >But lets just say for a second this is the place to discuss company >xys's mail issue. What benefit do they have participating here? Likely >they'll be hounded by people who have some disdain for their company >and no matter what they do they will still be evil or wrong in some >way. I've never seen someone treated badly for trying to help resolve problems. I think we all know that it can be hard to get things done within a large company and that often the folks who participate on a list like this are taking on work that isn't strictly speaking "their job" when they try to help resolve mail issues. And when a large company that was a mess does a turnaround, they also get praised: just look at the many positive comments about AOL on this and other lists over the past few years. >It is easy for someone who has 10,000 users to tell someone who has 50 >million users what to do when they don't have to work with such a >large scale enterprise. I wouldn't presume to tell them how to accomplish something within their particular configuration. But I will, without apology, tell them that they need to accomplish it. For example, I'm quite comfortable saying that Earthlink should follow the minimum timeouts in RFC 1123, though I wouldn't presume to guess whether they should accomplish that by having separate fast and slow queues on different servers, on the same server, or not at all. Likewise, a working abuse role account is a minimum requirement for participation in the Internet email system, and I'm comfortable saying that the email it receives should be read by a competent human. >I find it funny when smaller companies always tell larger companies >what they need to be doing. When what the larger companies do enables criminal behavior that impacts the very viability of the smaller companies through de factor DoS attacks, it's not funny at all. Yahoo, for example, has chosen a business model (free email with little to no verification) that inevitably leads to spam being originated from their systems. Why should they be able to shift the cost of their business model to me, just because I run a much smaller business?

6 6

Re: Abuse response [Was: RE: Yahoo Mail Update]
by Paul Ferguson 15 Apr '08

15 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Suresh Ramasubramanian" <ops.lists(a)gmail.com> wrote: >Do ARF, do IODEF etc. You will find it much easier for abuse desks >that care to process your reports. You will also find it easier to >feed these into nationwide incident response / alert systems like >Australia's AISI (google it up, you will like the concept I think) And further, looking at IODEF in particular, this is doomed: it requires more than two simple steps to report abuse. The proof is in the pudding. - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIBEuNq1pz9mNUZTMRAt94AJ9NYRFDM1UKMs5GEO9klDeLDWajdwCfaB7M NLS2W3SAD9fZiV1ScGthlPI= =+V6W -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Abuse response [Was: RE: Yahoo Mail Update]
by Paul Ferguson 15 Apr '08

15 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -- "Paul Ferguson" <fergdawg(a)netzero.net> wrote: >Mow, this has no bearing on the original subject (which I have now >forgotten what it is -- oh yeah, something about Yahoo! mail), but >it should be additional proof that the Bad Guys know how to >manipulate the system, the system is broken, and the Bad Guys are >now making much more money than we are. :-) Actually, that was supposed to read: "Meow, this has no bearing..." Just kidding. :-) http://imdb.com/title/tt0247745/ - - ferg p.s. I guess we should all lighten up a little and actually figure out out to do abuse notification/communications a bit better. Meow. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.6.3 (Build 3017) wj8DBQFIBDq/q1pz9mNUZTMRAos2AJ9Rv3jRNc3Dmx/31Vtk8p3y0MTJ+QCfc2z8 kM2w7GkCJVc2WU6dbsp0+FI= =cp/T -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Problems sending mail to yahoo?
by Barry Shein 15 Apr '08

15 Apr '08

Is it just us or are there general problems with sending email to yahoo in the past few weeks? Our queues to them are backed up though they drain slowly. They frequently return: 421 4.7.0 [TS01] Messages from MAILSERVERIP temporarily deferred due to user complaints - 4.16.55.1; see http://postmaster.yahoo.com/421-ts01.html (where MAILSERVERIP is one of our mail server ip addresses) Yes I followed the link and filled out the form but after several days no response or change. Despite the wording of their message we're not aware of any cause for "user complaints". For example if there were a spam leak you'd expect to see complaints in general to postmaster, abuse, etc. None we're aware of. We host quite a few mailing lists and it seems like whatever they're using is being touched off by the volume of (legitimate) mailing list traffic. I'm automatically moving all their email to a slower delivery queue to see if that helps. Just wondering if this was a widespread problem or are we just so blessed, and any insights into what's going on over there. -- -Barry Shein The World | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

22 36

Bell/bellnexxia admin or postmaster around?
by Mark Jeftovic 14 Apr '08

14 Apr '08

Could a bell/bellnexxia admin or postmaster contact me offlist? -mark -- Mark Jeftovic <markjr(a)easydns.com> Founder / President, easyDNS Technologies Inc. Company Website: http://www.easyDNS.com I ramble pointlessly from my blog: http://www.PrivateWorld.com

1 0

Fwd: Problems sending mail from .mumble
by Barry Shein 14 Apr '08

14 Apr '08

I was asked to forward this to the list by Eric: > Date: Sun, 13 Apr 2008 10:27:40 -0700 > From: Eric Brunner-Williams <ebw(a)abenaki.wabanaki.net> > User-Agent: Thunderbird 2.0.0.12 (Macintosh/20080213) > MIME-Version: 1.0 > To: nanog(a)merit.edu > Subject: Problems sending mail from .mumble > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > Content-Transfer-Encoding: 7bit > > Howdy folks, > > This isn't as much fun as tracking ships, but at Friday's meeting of > ICANN's GNSO Council (think "Hairspray") and ICANN staff on the process > for new gTLDs, the issue of file suffixes as proposed strings came up. > > Obviously the people who thought of wildcards (Sitefinder) didn't think > through the full joy of the consequences. > > So this is (yet another) fishing expidition -- as MIME types are a handy > list, if any of those strings were present in a header, as in > mail-from-foo(a)bar.MIME-TYPE, would any well-known thingee choke? > > Clues on a clue-by-four. > > I'll summarize replies off-list (unless requested otherwise) and Thanks > in Advance, > Eric > -- -Barry Shein The World | bzs(a)TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

9 11

Re: Problems sending mail to yahoo?
by Roger Marquis 14 Apr '08

14 Apr '08

Joe Greco wrote: >> So it's a vast sea of security by obscurity and standards be damned. >> It's a real and serious failure of the IETF et al. > ... >Having nearly given up in disgust on trying to devise workable anti-spam >solutions that would reliably deliver requested/desired mail to my own >mailbox, I came to the realization that the real problem with the e-mail >system is so fundamental that there's no trivial way to "save" it. Sounds like the party line inside Yahoo, but there are plenty of ISPs that do a really good job of combating spam. They do it with standard tools like RBLs, Spamassassin, OCR, ClamAV and without ineffective diversions like SPF or DKIM. Add a few local customizations (I know, this is the time consuming part), IP-layer IDS, stir carefully and voila, spam to real mail ratios well below 1 to 100. All without big junk folders, with very rare false positives, and little or no effort on the part of end-users. The problem is that it is an art, not well documented (without reading 5 or 6 sendmail/postfix and anti-spam mailing lists for a several years), is not taught in school (unlike systems and network administration), and rarely gets measured with decent metrics. Not that spam really has much to do with network operations, well, except perhaps for those pesky Netcool/Openview/Nagios alerts... Roger Marquis

20 34

Re: Fwd: Problems sending mail from .mumble
by Valdis.Kletnieks＠vt.edu 14 Apr '08

14 Apr '08

On Mon, 14 Apr 2008 08:47:04 PDT, Eric Brunner-Williams said: > The issue is whether "exe" in the root will break something. Rather than > just ask for a few well-known suffixes, and forgetting some, and leaving > out "ps" as it is already assigned to a ccTLD, I've picked on the > MIME-TYPE set of labels. Are you asking about actual MIME times 'text.plain', 'application.ps', and so on, or are you asking about the labels that one popular operating system sometimes uses to denote them, such as .exe, .ps and so on? Some of us use systems that don't insist on extensions - and the major one that does has a history of doing so poorly (how many times have we seen something with a name of foo.exe labelled an image/jpg and ending up executed rather than displayed?)

1 0