- NANOG - lists.nanog.org

RE: trapdoor.merit.edu and other impatient Postfix mailers everyw here (fwd)
by Roeland Meyer 03 Aug '01

03 Aug '01

> From: Steven J. Sobol [mailto:sjsobol@NorthShoreTechnologies.net] > Sent: Thursday, August 02, 2001 5:31 PM > > On Thu, 2 Aug 2001, Matt Martini wrote: > > > I never liked the idea of someone else, with an agenda that I'm sure > > doesn't coinside with mine, telling me who I should talk to > > or not. When > > the source code defaulted to using these "services" that's > > when I bailed on sendmail. > > No one forces people to use the dnsbl feature, nor are they > forced to use > the default settings. dnsbl is turned off by default. Give me a break. > > I can't believe I'm hearing the crap I'm hearing from people > who should know better. Agreed. For the record, when I was still using sendmail, I had to build a new sendmail.cf on every install. The default, from Caldera, doesn't do RBL by default, or a lot of anything else. I am now using MS-Exchange for corporate groupware and am deploying Postfix for end-user usage. Since MAPS is no longer freeware (a fact that I do NOT begrudge them), I will no longer be using the RBL. It was of limited use anyway because, I have way too many Earthlink based users and Earthlink seems to have taken up permanent residency in the RBL <sigh>.

1 0

Re: trapdoor.merit.edu and other impatient Postfix mailers everywhere (fwd)
by Mathias Koerber 03 Aug '01

03 Aug '01

|> Sure. But you claim to have proof (in the two links you posted) that |> that feature was implemented on request of PV. That is not true, |> those links only refer to PV having requested that sendmail not |> relay. | |The claim was made that Paul Vixie had enough clout to influence |modifications to sendmail features according to his wishes, and have |someone write a best practices RFC intended to modify vendor behavior. |He was, after all, the daddy of the RBL. You seem to claim his server |rbl.maps.vix.com was perhaps referenced in the source against his will. I claim nothing of that sort. I was not talking about the RBL function at all. I was pointing out that the links you posted with 'proof' do not prove your claim that PV influenced the RBL feature in sendmail. Your links only prove that he was asking for sendmail to stop relaying, a *totally different* feature which has nothing to do with RBL or any other external blacklist!! How you can contrue from that that I claim anything about the RBL feature is not apparent. I do quite think he was possibly quite happy that it was referenced in the default dnsbl config. But that is a long way from having actually influenced that fact. I believe that whoever wrote the original rbl feature (and no, I do not know who wrote that!) used the MAPS server reference because it was available. |There's much more on the subject, but for the sake of this argument, |you win: it was miraculously introduced by the elves! Having not claimed anything about how rbl or dnsrbl got introduced I am puzzled why you want to concede to me on this point. methinks you could use some time off

1 0

Re: trapdoor.merit.edu and other impatient Postfix mailers everywhere (fwd)
by Mathias Koerber 03 Aug '01

03 Aug '01

|On Fri, 3 Aug 2001, Mathias Koerber wrote: | |> | |> |http://www.dotcomeon.com/relay_default.html |> |http://www.dotcomeon.com/allman_sendmail_qa.html |> |> |> These sources say that 'not relaying by default' was implemented |> on suggestion by Paul Vixie. They do not talk about checking MAPS |> (feature('dnsbl')) at all. | |And how, may I ask then, is the MAPS RSS implemented? By which |mechanism, and whose default server was specified? 'Not relaying' is totally unrelated to checking MAPS or any other RBL. It refers to the mailer not to relay mail from an outside address to another outside address not served by the mailer. There is no need to check any RBL for that. |Historically, the first feature was called (rbl), now superceded |by (dnsbl), and was introduced in sendmail rel. 8.9.1 (1998). Sure. But you claim to have proof (in the two links you posted) that that feature was implemented on request of PV. That is not true, those links only refer to PV having requested that sendmail not relay. | |> |Don't believe me. [...] |> |> I won't. Not after this. | |Okay then, perhaps you can come up with evidence to the contrary. You are making the claims, so it is upto you to provide proof. |BTW Mathias, we did have a few users from Singapore. They were |trying to avoid their country's strict censorship, and were relaying |their private correspondence through our server, although they had |accounts there. I wonder why? Perhaps it was the fear of rattan |canes that made them do it... Nice ad-natiomen :-) That has nothing to do with the topic at hand. Trying to deflect from unproven claims and apparent inability to prove them?

2 1

Re: trapdoor.merit.edu and other impatient Postfix mailers everywhere (fwd)
by Mathias Koerber 03 Aug '01

03 Aug '01

| |http://www.dotcomeon.com/relay_default.html |http://www.dotcomeon.com/allman_sendmail_qa.html These sources say that 'not relaying by default' was implemented on suggestion by Paul Vixie. They do not talk about checking MAPS (feature('dnsbl')) at all. |Don't believe me. [...] I won't. Not after this.

2 1

Re: MAPS changes
by Larry Sheldon 03 Aug '01

03 Aug '01

Ok, let's put a cork in it--we have more important things to do. Here is my final puclic say on the matter--I'll answer specific questions in private email, if I've made grievous error I'll acknowledge it here. > > We are sort of minimalist when it comes to modifying mainstream code, so > > I betting we got it of the box and plugged it. But that would have been > > on my watch, and I don't remember for sure. > > You have to build a configuration file for sendmail, and there are no > defaults that work out of the box. When I built my config file, I went > through the documentation saying "yes, I will take that feature, and that > one, ..." and one of them was the DNS RBL interface. In another message > you mention that you use HP's sendmail so I have no idea how that process > works, but I rarely use any vendor's shipping version of important code > like BIND, sendmail, ssh, etc as they are almost always out of date. Seems like I've already answered this somewhere--briefly, this is wrong. By the time I get through doing a cold install-plus-patches to H-PUX 11.0, BIND, Sendmail and so forth are up, up-to-date, and running. I'll remind (or inform) y'all that this is actually the second time this calendar year that MAPS did this. We found out quite by accident that the vix.com servers (which are in the H-PUX distribution) were about to be shut down. Then a month or two later, seems likem, they did the exact same thing again except this time in order to play we have to (in the first week of the new fiscal year) go hat-in-hand to beg for money to keep going. (Yes, I know, they have since said something about "free" if we sign some kind of contract. I'd rather beg for money, than get such a contract signed in my lifetime.) Let's go back to work.

1 0

MAPS changes (was RE: trapdoor.merit.edu and other...etc)
by Larry Sheldon 03 Aug '01

03 Aug '01

> Yes, you can lookup contact information for IP blocks. However, we all > know how up-to-date that is, and the person listed there may or may not > be involved with the mail server. The spammers seem to think its OK. Seems like anti-spammers could give it a try. > If there had been a notice here, would you have been as unhappy? Remember > this was a free service. If I decided I could no longer make chess endgame > databases available for free, I would not feel inclined to look up everyone > who had been using them and notify them. At first cut, I could not agree more. But at second and third thought when I realized that just yanking the thing would have, you might say, unanticipated consequences, I would try to find a way of (think of imploding a building) firing the trigger without having it fall in on me. > As I recall, the first modifications to use RBL in sendmail were done > elsewhere, eventually a link was included on the sendmail site, and then > it was part of the configuration. We are sort of minimalist when it comes to modifying mainstream code, so I betting we got it of the box and plugged it. But that would have been on my watch, and I don't remember for sure. > I can see you are bitter about the impact on your mailservers. I am not > happy about the way it was done as well, but assuming it was malacious > seems excessive. I don't think bitter is right--and I did in fact get wind of this in the anti-spam community several weeks ago so we had actually pulled the code out last week, I think. I'm just really tired of the cult-of-personality stuff. Lots of us are just trying to keep our tiny corner of the world running for reasons that do not glorify bits and bit-fiddlers against a growing tide of bad guys. Having trouble telling who is on your side and who isn't does not enhance the experience. And if I can figure out what IP addresses to block, I will try to ensure that we are not now part of their problem--self imposed it might be.

2 1

Re: MAPS Changes
by Larry Sheldon 03 Aug '01

03 Aug '01

> At 7:55 PM -0500 8/2/01, Larry Sheldon wrote: > >But in the meantime, I am going to allege that the default .cf > >that HP sends with H-PUX 10.20 and 11.0 has it in it. > > Blame your vendor, not the software author, then. Don't really think I was blaming anybody, exactly. The topic drift is pretty fierce here, and I won't play IsaidShesaidYousaid with anybody-- but I think the point somebody was trying to make was that MAPS is deeply embedded in the world (probably aided, abetted and assisted by people close to MAPS) and that yanking MAPS support out from under that base could have been expected to have "unanticipated" consequences. I think I also tried to say that it might have been possible to give better warning, and enlisted the assistance of a friendly community instead of opening fire on them. And if that is too inflamatory, I'm sorry, and I'm tired. > Again, the OP implied some sinister conspiracy to incorporate the > dnsbl code into sendmail defaults where none exists. If you are > blindly doing what $VENDOR tells you to do without actually knowing > the results and consequences of those actions, I'd like to become > your vendor. :) If I implied "sinister" [1] or "conspiracy" I'm sorry--I did not mean to do that. I meant to explicitly say there were missed opportunities, bad planning, poor planning, no planning, and a PR effort that was not even wrong. We have more important things to be doing. [1] that is actually unlikely, since my left-handed friends tend to bruise me badly when I do that.

1 0

MAPS Changes (was RE: trapdoor.merit.edu and other ... etc)
by Larry Sheldon 03 Aug '01

03 Aug '01

> Where does sendmail "default" to using the MAPS RBL? Not a single > "default" mc file contains any reference to it: If I get some time in between spammers sending me "snowwhite", half the known world trying to send me "code red worm", and people reporting yet another copy of "SirCam", (did I mention marginal-to- senseless flame-fights here?) I'll look it up. . . But in the meantime, I am going to allege that the default .cf that HP sends with H-PUX 10.20 and 11.0 has it in it. I'll give you that it may be commented outm=, but the HP folk (I think) tell you to uncomment it. As usual, I reserve the right to be wrong. > > $ grep dnsbl /usr/local/src/sendmail-8.12.0.Beta17/cf/cf/*.mc > $ > > It must be explicitly enabled with the FEATURE(dnsbl) rule in your > sendmail.mc file. > > Try to connects facts and reality before making statements like that, > ok? Unless, of course, you work in M$'s FUD department, in which > case, its part of the job description, and understandable. > > D > > -- > +---------------------+-----------------------------------------+ > | dredd(a)megacity.org | "Conan! What is best in life?" | > | Derek J. Balling | "To crush your enemies, see them | > | | driven before you, and to hear the | > | | lamentation of their women!" | > +---------------------+-----------------------------------------+ > -- -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.- . . - L. F. (Larry) Sheldon, Jr. - . Unix Systems and Network Administration . - Creighton University Computer Center-Old Gym - . 2500 California Plaza . - Omaha, Nebraska, U.S.A. 68178 Two identifying characteristics - . lsheldon(a)creighton.edu of System Administrators: . - 402 280-2254 (work) Infallibility, and the ability to - . 402 681-4726 (cellular) learn from their mistakes. . - 402 332-4622 (residence) - . http://www.creighton.edu/~lsheldon Adapted from Stephen Pinker . -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-

2 1

RE: trapdoor.merit.edu and other impatient Postfix mailers everywhere (fwd)
by Larry Sheldon 03 Aug '01

03 Aug '01

> Do you log every single DNS query to your DNS servers (if you have any)? I do when I want to know who is hitting them. And [cute] I have 18 or 20 that I know of in our address space, three others in somebody else's. > I'm not aware of anyone who does, simply because the resulting log would be > gigantic... especially for a DNS-based service as huge as MAPS. Yeah, I guess if you are tiny it is hard to provide for basic operational needs. Thanks for writing. Please don't bother again.

1 0

Re: trapdoor.merit.edu and other impatient Postfix mailers everyw here(fwd)
by Dickson, Brian 02 Aug '01

02 Aug '01

>> ..., I would have figured they could afford to pay 5¢ per mailbox per >> year (and MAPS might have even worked out a better rate than that for >> the big guys).. > >http://www.mail-abuse.org/feestructure.html > >Per year, for $1,000 users, cheapest option, standard pricing > RBL+ $1,250 > DUL $500 > RSS $700 > $2,450 > >or $2.40/per mailbox per year. Sorry my budget does not go there... As I'm sure others will point out... RBL+ (which *includes* DUN and RSS) is $1250 *plus* $50/1000users per year. So it starts at $1300/yr/1000 users (or $1.30/yr, ie $0.11/month/user). It asymtotically approaches $50/yr/1000 users (ie when you reach Aleph-null users), or $0.05/year/user, or $0.004/month/user. Unless you only have a thousand users, I'd find it very surprising if anyone had problems fitting this into their business model. (My opinion here is academic; we don't have "mailboxes" - we're an NSP, no dial/DSL/cable.) Brian

1 0