- NANOG - lists.nanog.org

Re: Black Hole Vixie/RBL
by David Lesher 19 Nov '98

19 Nov '98

I find it absolutely incredible that the NANOG crowd is wasting ANY time debating with Allisat. Have you folks had your heads in IOS too long, or been sniffing reactor fuel? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Re: Another site attempt? (Was Re: Exodus/Clue problems)
by TTSG 19 Nov '98

19 Nov '98

> > Yes, in my Popper ? > Should I be concerned? > Bob > I received a call from the admin there. Anyone with logs of any sort please email "John.Stier(a)SUNYSB.EDU". Otherwise the box was removed from service without trying to trace the hacker. SIGH.......... Tuc/TTSG > On Thu, 19 Nov 1998, TTSG wrote: > > > Hello, > > > > Anyone seeing attempts from : pulse.physics.sunysb.edu > > > > > > heimdall:~# telnet pulse.physics.sunysb.edu > > Trying 129.49.30.248... > > Connected to pulse.physics.sunysb.edu. > > Escape character is '^]'. > > > > Red Hat Linux release 5.0 (Hurricane) > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > Kernel 2.0.32 on an i486 > > > > > > Only reason I ask....... > > > > Tuc/TTSG > > >

1 0

Re: Lawsuit threat against RBL users
by Karl Denninger 19 Nov '98

19 Nov '98

On Thu, Nov 19, 1998 at 05:58:10PM -0500, Bret McDanel wrote: > but its my network and I will decide what to let in and out.. If I dont > like someone and decide that they are guilty by association, then that is > still my choice.. Why should I be forced to let anyone do anything to my > network? If that were the case, why is there packet filtering routers and > firewalls? Why are tcp wrappers and other ACLs around? Becuase its > simple, I decide what I let in and out, and I dont have to have a good > reason to do it.. I can do whatever I want.. You are ABSOLUTELY right. Until the "you" obtains market power. Then you're absolutely WRONG. That market power can be obtained by one company, or one individual. It can also be obtained by a lot of companies and/or individuals all doing the same thing through joint decisions, whether formally documented or not. I STRONGLY suggest that you, and others who beleive that you are acting in a vacuum here, go talk to your counsel. Today. Seriously. This kind of stuff is no laughing matter; Sherman and RICO contain *criminal* provisions as well as civil (ie: sue your butt) ones. Vix is right in that a simple lawsuit is probably baseless. However, I'd be very concerned about either a Sherman or Sherman+RICO action. The congruence of AUPs, along with the widespread adoption of them by lots of people, gives rise to liabilities for joint actions that *do not exist* when you act alone. -- -- Karl Denninger (karl(a)denninger.net) http://www.mcs.net/~karl I ain't even *authorized* to speak for anyone other than myself, so give up now on trying to associate my words with any particular organization.

1 0

Re: Lawsuit threat against RBL users
by George Herbert 19 Nov '98

19 Nov '98

Karl Denninger <karl(a)Denninger.Net> writes: >On Thu, Nov 19, 1998 at 01:58:40PM -0800, George Herbert wrote: >> RBL policy is that they won't block anything more general than >> is warranted by particular spam complaints and the subsequent >> actions in response to those complaints or to a pattern of complaints. >> For example, a bunch of complaints come in reporting that various >> dialups spammed ads for www.biteme.com, a masochist oriented porn site, >> which is hosted on an IP address which is part of wehost.net . >> The proper procedure is that people complaining to RBL have to >> have contacted wehost.net and not gotten appropriate responses. >> RBL people will (always?) contact wehost.net for a final warning >> and status check prior to the block, and will only block >> the /32 corresponding to www.biteme.com's actual IP address. >> Thus, no wehost.net customer other than biteme will be inconvenienced. > >That does nothing at all, since the only listener on www.biteme.com's >address is a web server. It punishes biteme.com for having spammed by blocking access to their web server. That's the point. >> So yes, under (as I understand them) existing RBL rules, it is possible >> for purely innocent parties to get bitten (other non-spam related >> customers of wehost.net) if the ISP fails to respond properly >> for a significant length of time and number of incidents. >> I feel that's fair; if the ISP becomes the problem, then they >> should feel some heat. As long as the criteria for the ISp >> being RBled as a whole are sufficiently demanding so ISPs that >> are merely slow or not-entirely-cooperative don't get unnecessarily >> RBLed, that makes sense to me. > >That's not the scenario that was postulated and led to the latest threat. Which exact "scenario" did you have in mind? There have been a whole bunch posted recently by a number of people. Are you referring to the NSI block threat, which falls under a similar scenario where it's parts of one company rather than an ISP and its varied customers? Last I saw, Paul stated that NSI's systems were in distinct IP blocks from internic and internic wasn't being approached as a potential blockage target. I've seen a lot of "scenarios" fly around which bear little semblance to reality and greatly misunderstand how the RBL is (as far as I can tell from the outside) operating. Those scenarios are only worth considering as a theoretical exercise in how a RBL-like entity could go bad and as examples of how RBL isn't publicizing some of its policies enough so that people won't be confused about what they do. RBL in the maps.vix.com sense simply don't do some of the things that have been at one time or another accused of them, to my knowledge. Again, one can postulate a scenario about a generic blacklist service unfairly affecting innocent parties, but the actual RBL has what ppear to me to be adequate policies in place to protect third parties. People afraid of it really should at least listen enough to assuage fears based on policies it doesn't really have. -george william herbert gherbert(a)crl.com I speak for myself only

1 0

Re: Black Hole Vixie/RBL
by Paul Vixie 19 Nov '98

19 Nov '98

I will at some point today drink enough coffee to gain the self control it would take to not answer crazies. Because that time has not yet come, I can only hope that you, the reader, will delete this message without reading any further. bob(a)fcn.net (Bob Allisat) writes: > Mr. Vixie and his cohorts increasingly > imagine themselves to be the final and > ultimate arbiters in matters of Network > integrity. Having them sit in judgement > over the Black Holing of successive and > alleged perpetrators violates numerous > protections and freedoms all citizens Yup. Well, your freedoms anyway. Note that the MAPS RBL is a subscription service; no second and third parties are ever denied the opportunity to communicate freely unless one of them subscribes to the MAPS RBL and the other list listed on it. > It is my opinion that these activities > have reached their zenith and something > should be done to finally Black Hole > Vixie/RBL should they continue on their > renegade mission of uncontrolled and > arbitrary censorship. Maybe it is time > to pull the plug on the ultimate plug > pullers, black hole the black holers! I suppose that you'd prefer "controlled" censorship? Well, anyway, the sysop.com guy is spamming threats far and wide in hopes of scaring away my subscribers, but this doesn't appear to be having his desired effect. Maybe "renegade" is the wrong word? As for your suggestion, I would like it, and I mean I would really, really like it, if you (Bob Allisat) would please blackhole my route in your upstream router. I'm 204.152.184/21. Leave 192.5.4/23 out, since that's where F lives, but I promise that none of my mail or web servers are outside 204.152.184/21. -- Paul Vixie <paul(a)vix.com>

4 3

Latest outage analysis from the telephone companies
by Sean Donelan 19 Nov '98

19 Nov '98

I stumbled across the lates telephone Network Reliability Steering Committee report on US Telephone Network reliability. Through June 30, 1998. As always, they report the state of the nation to be good, stable, and reliable. Ok, so what everyone really wants to know. The number of facility outages (aka cable cuts) is increasing. The number of CO power problems is increasing. The number of Procedural Errors is increasing. As always, these are based on reports from the field affecting at least the minimum reportable event by the FCC. Just because something wasn't reported didn't mean it didn't happen. Puerto Rico was treated as a special case during this reporting period. The good news The number of CCS outages is decreasing. Since Illuminet didn't report their SS7 outage, I don't know if the report included its affects. Most events were within the 'green' zone limits established as a baseline in 1992-1993. Which is a fancy way of saying there were a 'normal' number of outages. Source of disruptions Facility failures (45%) CO Power (16%) Tandem Switch (14%) Local Switch (11%) CCS (9%) ftp://ftp.atis.org/pub/nrsc/exam2q98.doc -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Lawsuit threat against RBL users
by George Herbert 19 Nov '98

19 Nov '98

Karl Denninger <karl(a)Denninger.Net> writes: >On Thu, Nov 19, 1998 at 12:51:05PM -0800, George Herbert wrote: >> Karl Denninger <karl(a)Denninger.Net> writes: >> >[...] >> >The collusive aspect of this is downright scary, especially when coupled >> >with threats of depeering, active denial of service attacks, etc. >> >> Let's put two scenarios forwards. >> [...] >> In the first case, there is clearly a connection between the >> spamming and the website that gets RBLed; it was directly advertised >> by the spams. That direct link is sufficient under current RBL rules >> and meets my definition of terminatable customer. >> In the second case, one of the sites meets the above definition, >> but the sites at U and V (which may be for completely unrelated >> subsidiaries or groups within B) don't necessarily. This might >> begin to approach an illegal blacklist. >> The question is, are any cases similar to scenario 2 actually happening? >> As far as I know, no. Companies that have many websites that are having >> all their ISPs pressed to nuke them generally are spamming to advertise >> most or all of them, not just one or a few. > >Ok, let's put another scenario out there, one which IS somewhat likely: >Company A has a web site hosted at ISP Z, and a bunch of throw-away dial-up >accounts on ISPs P, Q, R and S. They spam through P, Q, R and S, advertising >the site hosted at ISP Z and giving a "freemail" (ie: hotmail, juno, etc) >reply EMAIL address. All four of those dial providers cut *THE SPAMMER* >off. >The spammed people also complain to ISP Z, and ISP Z tells the complainers >to stuff it, because (1) there is no PROOF that Company "A" actually did >the spamming, and (2) no offensive data was emitted by ISP Zs machines. >ISP Z gets RBLd, even though *ISP Z* was not a party to the spamming, >and ISP Z *never touched or emitted the spam*. Worse, what gets RBLd >is ISP Zs mail server, which (if Company A is web hosting there ONLY) >was not only uninvolved, but is irrelavent to the offense (since ISP Z >only sold Company "A" web service). >ISP Z has just had its business policies dictated by unrelated people and >NOT because they committed (either directly or through a customer acting >on their system) an offense - further, OTHER customers of ISP Z (who buy >mail service from them) have been harmed, even though (1) ISP Z wasn't >involved in the infraction, (2) Company "A" didn't do anything objectionable >*ON* ISP Z, or THROUGH ISP Zs equipment, and (3) the sanction is not in any >way related to the offense (ISP Zs mail service is damaged, although their >mail server was not abused, and in fact Company A doesn't get their mail >through ISP Z). While your scenario is a distinct possible problem with a RBL-like list, I don't think it's possible under the existing RBL rules and procedures that exist. [Please keep in mind in the following that I am not an RBL volounteer, so I may be getting details wrong... Dave and Paul are on nanog and can correct anything I misstate, though, I assume] RBL policy is that they won't block anything more general than is warranted by particular spam complaints and the subsequent actions in response to those complaints or to a pattern of complaints. For example, a bunch of complaints come in reporting that various dialups spammed ads for www.biteme.com, a masochist oriented porn site, which is hosted on an IP address which is part of wehost.net . The proper procedure is that people complaining to RBL have to have contacted wehost.net and not gotten appropriate responses. RBL people will (always?) contact wehost.net for a final warning and status check prior to the block, and will only block the /32 corresponding to www.biteme.com's actual IP address. Thus, no wehost.net customer other than biteme will be inconvenienced. What begins to approach your scenario is the situation where wehost.net has had a really significant number of customers who did the same thing and refused to act appropriately about any of them. At that point, (that point being defined somewht nebulously here, but bear with me), it changes from an innocent ISP scenario to one where the ISP is acting as a knowledgeable and culpable host to multiple spamming sites. At that point, the ISP may be acted against as a whole, under current RBL rules. But not before. So yes, under (as I understand them) existing RBL rules, it is possible for purely innocent parties to get bitten (other non-spam related customers of wehost.net) if the ISP fails to respond properly for a significant length of time and number of incidents. I feel that's fair; if the ISP becomes the problem, then they should feel some heat. As long as the criteria for the ISp being RBled as a whole are sufficiently demanding so ISPs that are merely slow or not-entirely-cooperative don't get unnecessarily RBLed, that makes sense to me. -george william herbert gherbert(a)crl.com I neither speak for nor work for CRL at this time.

2 1

The RBL & Bob.
by gstewart＠river.netrover.com 19 Nov '98

19 Nov '98

Wait... Before adding to this thread, please check out the following... http://www.netizen.org/Howling/Kooks/Allisat/ ... just something I found on a search engine ;)

1 0

Re: Lawsuit threat against RBL users
by George Herbert 19 Nov '98

19 Nov '98

Karl Denninger <karl(a)Denninger.Net> writes: >The problem with this is that someone, sooner or later, is going to >take a run at people trying to set up what amounts to a set of contractual >requirements that exceed legal requirements - and then enforce them network >wide. >The collusive aspect of this is downright scary, especially when coupled >with threats of depeering, active denial of service attacks, etc. >I happen to be an "anti-spammer", but when you get to the point that you >start telling people what they have to put in their contracts as an industry, >such that if Person #1 commits an act on a *completely unrelated* system >they get their contract voided you're treading on very, very thin ice. >That looks an awful lot like an industry-wide blacklist, and those are >dangerously close to being per-se illegal. Let's put two scenarios forwards. Scenario 1: Company A has a web site hosted at ISP Z, and a bunch of throwaway dialup accounts on ISPs P, Q, R, and S. A spams ads for the web site on ISP Z via those throwaway dialups. P, Q, R, and S kill the dialup accounts used; people also complain to Z. If Z fails to close the web site that was spam advertised, someone complains to RBL who blackhole the web site server. Scenario 2: Company B has a set of web sites for various subsidiaries, hosted at ISPs T, U, and V. The marketing department for the group hosted at T spams via a bunch of dialups. People complain and dialups get nuked; people also complain to T, U and V asking that B be nuked. It isn't, so it gets reported to RBL and MAPS do thier thing on the website servers at T, and also on U and V which were not involved in the initial spam but are related to the company. In the first case, there is clearly a connection between the spamming and the website that gets RBLed; it was directly advertised by the spams. That direct link is sufficient under current RBL rules and meets my definition of terminatable customer. In the second case, one of the sites meets the above definition, but the sites at U and V (which may be for completely unrelated subsidiaries or groups within B) don't necessarily. This might begin to approach an illegal blacklist. The question is, are any cases similar to scenario 2 actually happening? As far as I know, no. Companies that have many websites that are having all their ISPs pressed to nuke them generally are spamming to advertise most or all of them, not just one or a few. -george william herbert gherbert(a)crl.com I speak for myself only, I am not a CRL employee

2 1

Re: Black Hole Vixie/RBL
by Bob Allisat 19 Nov '98

19 Nov '98

Nathan Stratton writes: > ...I signed NetRail up to the RBL because I felt like it. It was > my network and I could block all the spam I wanted. This is not US > mail, spam cost me money to transport. I have every right to > blackhole it. Sure I had a few dedicated customers that were not > happy with it, but they also had the right to find a new ISP if > they wanted. If I am a backbone provider or a ISP I have every > right to do whatever I want with my network. You have the same > thing with porn, I had users who tried to sue me for blocking it, > but they did not win. I have a right to not let my customers reach > spam, porn, or whatever. > > I was not infringing with my customers human rights or freedoms. > If they did not like it they could go find another provider. If > customers were forced to use a provider or the provider was > receiving money from USF or something then you MAY be able to > argue your point, but as long as the customer has a choice then I > can offer or not offer whatever I want. Mr. Stratton is describing the exact reason we all require a Digital Bill of Rights. In his universe we have no freedoms outside of his alleged Property Rights. Our mail, WWW viewing, Internet Telephony, etc, are at his mercy and according to his whim. To view the Digital Bill of Rights please visit: <http://fcn.net> Bob Allisat Free Community Network _ bob(a)fcn.net . http://fcn.net http://fcn.net/allisat _ http://fcn.net/draft

1 0