- NANOG - lists.nanog.org

Re: on a different "manners" topic, was Re: Phishing...
by Brandon Butterworth 03 Jan '07

03 Jan '07

> Some say that top-posting reverses the conversation, but if you > are thumbing through the archives of top-posted threads, each > contribution is on the first screen and you can navigate message > to message in time-order Don't include the email you're responding to then it's no longer top posting, plus you can still read the archive easily. Bottom posting is just as bad as top posting when you include the entire message Usually there is no need to include previous emails, it's a waste of space. The only time including the previous emails automatically is good is when you want to see a previous conversation thread before they included you. I see lots of information leakage from Outlook users this way. Is this done now? > As far as the HTML, I don't think I use it, but I fail to see why it's rude. Next thread, red or blue text? brandon

4 3

Re: Phishing and BGP Blackholing
by Scott Weeks 03 Jan '07

03 Jan '07

: It also says 'If you are not the intended recipient...' : Since the post is being made to NANOG, : ... so I fail to see why a big deal should be made out of it Because it's bad manners in a public forum. It's impolite in the same way SHOUTING! is. scott --- blakjak(a)blakjak.net wrote: From: Mark Foster <blakjak(a)blakjak.net> To: Randy Bush <randy(a)psg.com> Cc: "Joy, Dylan" <DJoy(a)becu.org>, nanog(a)nanog.org Subject: Re: Phishing and BGP Blackholing Date: Wed, 3 Jan 2007 17:44:28 +1300 (NZDT) I have to ask. The 'stock' disclaimer message says 'may'. It also says 'If you are not the intended recipient...' Key words - 'if' and 'may'. Since the post is being made to NANOG, we can assume the NANOG Audience (defined as anyone whos on the list _or_ who can read the web archive; ala; everyone) is infact the intended recipient, and we can ignore the rest of it. ... so I fail to see why a big deal should be made out of it. Especially when they're generally enforced on large companies by their lawyers, and the Network Operators likely have very little to do with it. So why the big deal? (Personally I still vote for the use of non-corporate mail addresses on mailing lists. Tends to filter out the roge out-of-office notices too...) Mark. On Tue, 2 Jan 2007, Randy Bush wrote: > > you have sent a message to me which seems to contain a legal > warning on who can read it, or how it may be distributed, or > whether it may be archived, etc. > > i do not accept such email. my mail user agent detected a legal > notice when i was opening your mail, and automatically deleted it. > so do not expect further response. > > yes, i know your mail environment automatically added the legal > notice. well, my mail environment automatically detected it, > deleted it, and sent this message to you. so don't expect a lot > of sympathy. > > and if you choose to work for some enterprise clueless enough to > think that they can force this silliness on the world, use gmail, > hotmail, ... > > randy > >

1 0

Re: Phishing and BGP Blackholing
by Fergie 03 Jan '07

03 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 One more thing: If anyone thinks that fast-flux hosting isn't a problem, then you haven't dealt with it. I cannot imagine inject a /32 continuously into a BGP community-set. That just sounds... insane. More: http://www.spamhaus.org/faq/answers.lasso?section=ISP%20Spam%20Issues#164 Cheers! - - ferg - -- "Fergie" <fergdawg(a)netzero.net> wrote: Instead of quoting earlier submissions, let me just add two thoughts to this Bad Idea (tm): (1) Proxy bypasses; and (2) Fast-Flux place-shifters... These are two hard problems, by themselves, although not impossible. Having said that, injecting candidate host-routes into BGP (given the already intolerable churn) is a horribly worse idea. Good luck with all that... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.2 (Build 4075) wj8DBQFFm1dTq1pz9mNUZTMRAgN2AJ0ZvWf0ikxt8dpmzdVjuRX5MmcEagCg668t NNFPoVJlAH1cNvSaiY+DmT4= =3zHg -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Phishing and BGP Blackholing
by Fergie 03 Jan '07

03 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Instead of quoting earlier submissions, let me just add two thoughts to this Bad Idea (tm): (1) Proxy bypasses; and (2) Fast-Flux place-shifters... These are two hard problems, by themselves, although not impossible. Having said that, injecting candidate host-routes into BGP (given the already intolerable churn) is a horribly worse idea. Good luck with all that... - - ferg -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.2 (Build 4075) wj8DBQFFm1DNq1pz9mNUZTMRAqyxAJwOrUTIs1Olrj8Gt2jB+Uc9557WqgCfQO+R LSsa8HsYTOkZPi4sjtQFUyY= =HvaD -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Regarding NDU.EDU
by Fergie 03 Jan '07

03 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sure. That's what it is: "architectural changes". I heard the Naval War College was doing that, too. :-) http://blogs.abcnews.com/theblotter/2006/12/mystery_hacker_.html - - ferg - -- "Chris L. Morrow" <christopher.morrow(a)verizonbusiness.com> wrote: On Tue, 2 Jan 2007, Steven M. Bellovin wrote: > > They took their systems offline a few weeks ago: > > http://www.fcw.com/article97160-12-19-06-Web > Right -- something's definitely going on on that part of the world. > See http://fcw.com/article97178-12-22-06-Web which talks about how DoD > is banning HTML email (what a wonderful thought in any event!) and > Outlook Web Access. Why? The threat level has been raised from > Information Condition 5 to Information Condition 4 -- but they won't > say why.... why terrorists of course... :) in all seriousness, perhaps they are doing some architectural changes to better secure their perimeter in light of (as the hawaii.edu gentleman pointed out) the internet becoming more and more critical to the common person? -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.2 (Build 4075) wj8DBQFFmvd8q1pz9mNUZTMRAtmdAJ9Ywah+H+vITdYSI5nMtvia1deOaQCggnxn m7+UFpHQwDFr2a/fa6+iYfU= =i5RY -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Re: Regarding NDU.EDU
by Fergie 03 Jan '07

03 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 They took their systems offline a few weeks ago: http://www.fcw.com/article97160-12-19-06-Web Cheers, - - ferg - -- Robert Mathews <mathews(a)hawaii.edu> wrote: Ladies & Gentlemen: I thought to post here - that NDU.EDU' (National Defense University') MX record and A record seems to be missing. This has been going on for nearly TWO weeks (since before Christmas 2006)! One can reach their WEB servers.. but, all mail to NDU is presently bouncing. Technical and Admin Contacts have been unreachable over the same duration of time. Does anyone have any idea (more than just an extemporaneous ref.) as to why this is happening? Appreciate having some insight. If you wish to reply privately, I welcome it. All my best, Robert. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.5.2 (Build 4075) wj8DBQFFmtMlq1pz9mNUZTMRAnH0AJ9APYWTyOsOzFhpYstkZNuIwFFqVQCg6N78 6t/Zam6sI6Vek38YoM45K4o= =p3D6 -----END PGP SIGNATURE----- -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

3 2

Re: Regarding NDU.EDU
by Robert Mathews 02 Jan '07

02 Jan '07

On Tue, 2 Jan 2007, Chris L. Morrow wrote: > REINISHJ(a)jfsc.ndu.edu > > Trying 24.248.20.30... > Connected to ip-24-248-20-30.jfsc.ndu.edu (24.248.20.30). > Escape character is '^]'. > 220 mx1.jfsc.ndu.edu ESMTP (11497e0f29573a89e48fcb5a6c1ccaca) > helo me > 250 mx1.jfsc.ndu.edu > > [ .... ] > > tried that? Dear Chris: It appears that Fergie had the answer... However, I wish to thank you, and the others for the response. I appreciate having it. Yes, it does seem like a PART of NDU, the Joint Forces Staff College is accepting E.mail but, other parts are not. Some of us who have been on travel were NOT advised of the Net Disconnection. Calls to NDU have gone unanswered -- even at levels above Network admins. While I 'have been in touch' with those that I needed to establish contact - via other means, this disconnection has been more than just plain inconvenience to many. Thank you, for all your responses. I appreciate having them. Kind regards, Robert. --

1 0

Regarding NDU.EDU
by Robert Mathews 02 Jan '07

02 Jan '07

Ladies & Gentlemen: I thought to post here - that NDU.EDU' (National Defense University') MX record and A record seems to be missing. This has been going on for nearly TWO weeks (since before Christmas 2006)! One can reach their WEB servers.. but, all mail to NDU is presently bouncing. Technical and Admin Contacts have been unreachable over the same duration of time. Does anyone have any idea (more than just an extemporaneous ref.) as to why this is happening? Appreciate having some insight. If you wish to reply privately, I welcome it. All my best, Robert. --

2 1

RE: would you run this little script, please
by Randy Bush 02 Jan '07

02 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 > I would be glad to run the script but I just want to verify that it was you > who sent it. darned good point, ron. <blush> yes, it was i. randy -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) Comment: Processed by Mailcrypt 3.5.8 <http://mailcrypt.sourceforge.net/> iQCVAwUBRZqTePvCP42xMxQ5AQo1fgP9EkgUcKnjNXfpU3hgVAG0oVwVyxZZtmXq xdpUv0oDDeTBeu8QrbgU6UHRY4hWHqHVj30tUq9BQP8+knyYLImPj6ZBoVhtnEta uuTo9wUyfZovhpWJtsTNflMHaE1QlhCyLUESAJVHiEQeT0LeY7urA7N9GVWRsH/f GZii7iIpna0= =0bdG -----END PGP SIGNATURE-----

4 4

Re: Security of National Infrastructure
by Scott Weeks 02 Jan '07

02 Jan '07

--- shadow(a)geek-guy.com wrote: Why is it that every company out there allows connections through their firewalls to their web and mail infrastructure from countries that they don't even do business in. Shouldn't it be our default to only allow US based IP addresses and then allow others as needed? The only case I can think of would be traveling folks that need to VPN or something, which could be permitted in the Firewall, but WHY WIDE OPEN ACCESS? We still seem to be in the wild west, but no-one has the b@lls to be braven and block the unnecessary access. ------------------------------------------------------------- Please don't feed the troll... scott

2 1