- NANOG - lists.nanog.org

Re: Summary of ANTI-spam techniques now available
by Bill Woodcock 03 Aug '97

03 Aug '97

> Can i deduce from this that you have blocked PSI We did. Cut the spam attempts here by about 75%, and I haven't had any complaints from customers. We subsequently switched over to Sendmail 8.8.6 with filtering, of course, but I don't think we've bothered to remove the PSI filter from our router... :-) Bad attitude, I know, and now I'll probably have to go remove it, so I can feel like I'm still one of hte good guys, promoting connectivity and trust, etc. -Bill

1 0

Re: Summary of ANTI-spam techniques now available
by David Stoddard 02 Aug '97

02 Aug '97

FWIW, we have an anti-spam list on our site that is used by a lot of other ISPs on the net. It contains all of the known Cyberpromo domains and IP address blocks, and a ton of other stuff. You can get our active list anytime by sending an email message to: spamlist(a)us.net The list is ready to load into sendmail 8.8.6 using the filter rules available at: http://www.informatik.uni-kiel.de/%7Eca/email/chk-newmap.html BTW, we will remove any entry in the file as long as the spammer agrees to sign and notarize a contract that establishes damages at $10,000 per incident if it happens again (and we WILL enforce the contract). If they are ISPs, I want to talk personally to the owner of the company. We don't put entries into the list lightly, and we don't remove them lightly either. Dave Stoddard US Net Incorporated 301-572-5926 dgs(a)us.net

1 0

Re: An end to spam through Graphnet
by Bill Woodcock 02 Aug '97

02 Aug '97

Jon taught J.D. to suck eggs thusly: > I just implemented the check_* stuff on my server...it works > great and was fairly easy to do... I noticed that the LocalIP stuff wasn't actually working, but haven't had a chance to check into why yet... Anybody actually seen that one in action? -Bill ______________________________________________________________________________ bill woodcock woody(a)zocalo.net woody(a)nowhere.loopback.edu user(a)host.domain.com

3 2

Re: how to protect name servers against cache corruption
by Francois Beauregard 02 Aug '97

02 Aug '97

Another thing people tend to forget is the legacy systems that still need to be maintained... It's extremely easy to say "let's scrap BIND and build a better DNS system", but hey guys, you still need to support ALL PLATFORMs... Until you find me the GOD that will do this all in one shot, I'll prefer to go with Vixie's code... he got pretty good at it over time :-) And I think that Paul can confirm that like everybody else, he only have 24 hours in a day and only one head and one set of arms... Considering that, he is doing a VERY good job, give him some time and he will come up with the solution to those security issue, no one better then him knows the holes in the code/system... So unless there is some specific attacks GOING ON CURRENTLY on the net, can we get back to the main topic of discussion... At 16:09 97-08-01 -0700, Dave Crocker wrote: >Ben, > >At 10:30 PM 7/29/97 -0400, Ben Black wrote: >>so a statement from paul that the internet is effectively broken until >>DNSSEC is acceptable to you even if there are known ways to combat known >>attacks? >> >>stop worshipping long enough to think about the ramifications of this. > > Reponsible participation in public discussion is a difficult challenge for >even the most capable contributor. For others, the challenge is quite >basic. They must listen carefully. They must consider carefully. They >must stay on the topic. They must use professional language and avoid ad >hominem distractions. > > The fact that the security on your house is not optimal, it does not mean >that your house has no security. The fact that there are attacks which are >still feasible on the DNS does not mean that the DNS doesn't work. >("Broken" means doesn't work, in case there is confusion about your use of >language.) > > So please note that your response to this thread reduce it to an >inaccurate assessment. Given the importance of the DNS and the difficulty >which the general public has dealing with network security issues, it would >be highly irresponsible to propagate inaccurate statements like the one above. > >d/ >-------------------- >Dave Crocker >Internet Mail Consortium +1 408 246 8253 >675 Spruce Dr. fax: +1 408 249 6205 >Sunnyvale, CA 94086 USA info(a)imc.org , http://www.imc.org Sincerely ---------------------------------- Francois Beauregard FBorg(a)fbli.com FBLI.COM We love feedbacks and live by them Sales : Sales(a)fbli.com 1 (888) FBLI.COM Tech support : Support(a)fbli.com 1 (514) 349-0455 Internet Web : http://www.fbli.com ICQ : 1907537 Montreal, Canada ----------------------------------

1 0

Re: how to protect name servers against cache corruption
by William Allen Simpson 02 Aug '97

02 Aug '97

The Ferguson quote was on the NANOG list, and seemed very mild, but I don't understand where the other quotes came from. Am I experiencing mail loss? > From: craig(a)ishiboo.com > Can we please get back to the more adult discussion of the issues and > leave the childish attacks on peoples intelligence, heritage, personal > habits and the like to a more proper forum? this list is begining to > remind me of a bad Beavis and Butthead nightmare. It would be most > enjoyable to not have to see the following in the future. > > For example: > > From: "Perry E. Metzger" <perry(a)piermont.com> > From: Paul A Vixie <vixie(a)vix.com> > From: Paul Ferguson <pferguso(a)cisco.com> > ---------------- > Craig Nottingham > craig(a)mil.net > WSimpson(a)UMich.edu Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32 BSimpson(a)MorningStar.com Key fingerprint = 2E 07 23 03 C5 62 70 D3 59 B1 4F 5E 1D C2 C1 A2

1 0

Re: An end to spam through Graphnet
by Jon Stevens 01 Aug '97

01 Aug '97

"J.D. Falk" <jdfalk(a)priori.net> said the following at 8/1/97 2:36 PM: > The /best/ idea is to have them use a local SMTP server. If > they can't or won't do that, there are a few recipes floating > around that let you exempt messages from specific sources; I > haven't investigated those much, but they're out there. I just implemented the check_* stuff on my server...it works great and was fairly easy to do... <http://www.informatik.uni-kiel.de/%7Eca/email/check.html> It has already stopped quite a bit of spam and I'm being very good about keeping my junk database up to date... -jon stevens

1 0

DNS Root server updating auth zone
by Wayne Hall 01 Aug '97

01 Aug '97

I have been asked to take over the DNS/Sendmail services at my company and in looking over the system I noticed several messages in the logs that look like the following: named[85]: [192.5.5.241].53 attempted update to auth zone "vie.com" (VIE.com) Because the IPs are all from the root DNS servers and the db.cache was out of date, I updated it with the most current and restarted in.named. A day later and I am still receiving the errors. Everything looks to be correct when compared to my DNS and Bind manual. Is this a normal message or any ideas what might be wrong? We are running SunOS 4.1.3 with the native BIND. Thanks Wayne Hall Network Manager VIE PS - I apologize if this is the wrong area to post this type of question.

1 0

Re: how to protect name servers against cache corruption
by craig＠ishiboo.com 01 Aug '97

01 Aug '97

You know I can understand how discussing problems in DNS is an valid concern for netowrk operations I cant for the life of me figure out exactly how supposed netowrk and security professionals can show a complete lack of maturity and restraint. Thomas Ptacek is attempting to discuss in a level headed straight forward manner a serious problem and is being met with repeated insults, open hostility and down right rude behavior. Thomas is to be thanked for being the obviously better man, regardless of the validity of his opinions, for coming to the table in a direct, polite fashion. In an open forum it is sad to see people such as Perry Metzger, Paul Vixie, Paul Ferguson all stooping to attack people whose idea they dont like instead of addressing the issue. Can we please get back to the more adult discussion of the issues and leave the childish attacks on peoples intelligence, heritage, personal habits and the like to a more proper forum? this list is begining to remind me of a bad Beavis and Butthead nightmare. It would be most enjoyable to not have to see the following in the future. For example: From: "Perry E. Metzger" <perry(a)piermont.com> I see my opinion of you was more than correct. You're a jerk. I'm sure you've never asked yourself why it is that the people who've written widely deployed software and standards and make the world work hold you in contempt. I'm sure you never will. That's because you're a jerk. Paul has been doing a very good job of slowly but surely getting BIND cleaned up, getting vastly improved code out there into the real world, and largely been paying for the effort out of his own pocket. He's worth about seven thousand Thomas Ptaceks -- perhaps worth more. Frankly, if I had a choice between saving you from drowning by some minimal action like pushing a button under my index finger and, for example, keeping someone from spilling a cup of coffee on Paul's pants, I'd say the latter would be more important for the world and would be the choice I'd almost certainly make. I mean this in the greatest of seriousness. I suspect that the more you post, the more that will become general community consensus as to your worth as a human being. From: Paul A Vixie <vixie(a)vix.com> you are sloppy, ill mannered, and ignorant. it's clear that you have not read rfc 1034 or rfc 1035 (much less 2010 or 2136), or that if you have read them you did not understand them. i have been sloppy, ill mannered, and ignorant in the past. but i did not display those traits when speaking to people who had been doing DNS work for ten years before i started. you have an uphill climb if you expect me to take you seriously in the future. it's not impossible. but from your continued arrogance and inability to see yourself through the eyes of others, i hold out very little hope. From: Paul Ferguson <pferguso(a)cisco.com> Sure, smart guy. And there are also issues with IP packets which are passed across untrusted nodes in the Internet. -craig ---------------- Craig Nottingham craig(a)mil.net

1 0

Re: how to protect name servers against cache corruption
by salo＠msc.edu 01 Aug '97

01 Aug '97

> From: craig(a)ishiboo.com > Subject: Re: how to protect name servers against cache corruption > Date: Fri, 1 Aug 1997 15:26:53 -0500 (EST) > [...] > ... this list is begining to > remind me of a bad Beavis and Butthead nightmare. It would be most > enjoyable to not have to see the following in the future. > [...] I agree with you that some of the mail on nanog appears to bolster the assertion the some of those who develop and operate the Internet appear to have missed the socialization part of the preschool curriculum. On the other hand, I have been known to save some of these e-mails, particularly in my "Great Quotes for use in Proposals" and "I Wonder if I Will Ever Review a Proposal from this Person" folders. -tjs

1 0

ASExplorer 1.0 Beta Announcement
by ipma-support＠merit.edu 01 Aug '97

01 Aug '97

The University of Michigan and Merit Network, Inc. are pleased to announce the 1.0 Beta release of ASExplorer. The new ASExplorer is the first of a series of visualization tools being developed by the Internet Performance Measurement and Analysis project (IPMA). Please see: http://www.merit.edu/ipma/asexplorer The new, light-weight ASExplorer Java client displays routing instability data received from one or more user-selected channels. We are currently providing channels for routing instability data collected at the AADS, MAE-East, MAE-West, PacBell, and PAIX exchange points. Some of the new features of ASExplorer include: * Who is AS1239? Well, just float your mouse cursor over AS1239, and we'll tell you! Dynamically updated Internic information tells you more than just an AS number -- try it and see. * Instability levels are monitored via graphs of BGP announcements and withdrawals, both updated in real-time. * Lists of currently flapping prefixes are hooked into the main ASExplorer window, and allow you to jump to an AS with a single click. * ASExplorer now lists all of the announced routes by an AS within the last time window (currently fixed at 75 minutes). * You can jump directly to an AS if you know its AS number. No more hunting through layers of HTML. * Can't figure out how the darn tool works? Use the on-line help! Also note that if you just want to look at the real-time graphs, you can view them at http://www.merit.edu/ipma/realtime/. The new version of ASExplorer relies on the Salamander Data Distribution infastructure to provide real-time updates to the client applets/application via a platform-independent webcasting technology. If you have any questions, comments, or any form of criticism, please feel free to send mail to ipma-support(a)merit.edu. P.S. If you have any problems running the ASExplorer software, please mail us the contents of your Java console and a brief description of your problem. The ASExplorer team will be more than willing to help you get the software up and running. - Jimmy vecna(a)eecs.umich.edu

1 0