November 1998 - Test - lists.nanog.org

RE: Lawsuit threat against RBL users
by Sheryl Chapin 19 Nov '98

19 Nov '98

At 09:46 AM 11/19/98 -0500, you wrote: >That's a pretty shortsighted view, Sheryl. I suspect you haven't been on >the receiving end of some idtiot buying a leased line/virtual web presence >from you and then spamming from an AOL/PSI/earhlink/yadda yadda account. It >isn't pleasant. Folks aren't stupid. They ignore the fact that the tool >used to spam was a throwaway account and go right for the jugular (you). >It's better to have a zero tolerance policy and not have to deal with the >silliness in the first place. > You are correct, we have been lucky so far and this has not been an issue. If it becomes an issue, we may have to make changes to our AUP. However, what I don't like is the idea that we might have to make that change not based on what we think is acceptable use, but based on what some self appointed group has decided it should be. The consequences of not going along being that we get blackholed. Sheryl Chapin Senior Network Engineer CommTel Internet 207.377.3508 Winthrop, Maine schapin(a)ctel.net

3 2

Re: Lawsuit threat against RBL users
by brandon＠rd.bbc.co.uk 19 Nov '98

19 Nov '98

> >It seems to me, both from his allegations and from the > >phraseology of the "Best Practices for Being Permanently Added to the > >RBL", that web hosting services are being treated unfairly in the > >following circumstance: > > > >Company S(pam) has a web site, hosted on the servers of > >web-presence-provider Company P(rovider). ... > That's right. It stops the practice of using a sacrificial account, from > AOL or netcom, to spam for a web-site that is otherwise protected. Does it > make a difference that they didn't spam from their own ISP? Some people don't know where to draw the line though, is it just the ISP that hosts the site or all sites linked to that site and so on until there isn't a net? This isn't hypothetical as we've been in that position, a spammers site had a link to ours (and attached a copy of that page to a spam) so one spamee decided we must be spammers too and filtered us. As an innocent 3rd party who has no control over who links to our site (or mentions it in spam) it becomes a simple DOS (lets make a site that links to the top 100 web sites and make up a spam) brandon

2 1

Re: Oh no... someone had a bright idea!
by John Fraizer 19 Nov '98

19 Nov '98

We can send PMS after them. Oh, I guess I should elaborate. PMS = Pissed-off Marine Snipers. Nothing will ruin your day like being denied the squeeze when you have high confidence on a certain head-of-state over in camel-land. At 11:17 PM 11/18/98 -0800, Roeland M.J. Meyer wrote: >At 09:37 PM 11/18/98 -0500, Robert Boyle wrote: >>This was forwarded to me by a friend. I was interested in exactly what they >>meant. This is pretty bad. I think these people don't understand that this >>affects US more than it affects the people who they are targeting. I >>suppose this is a strong case for transparent caching. Any thoughts? > >Yeah, they need to be nuked for propogating DoS attacks. This kind of stuff >is definitely against AUP and TOS around here. Has someone contacted their >provider? I would in a heartbeat, but whois isn't working at the moment. > > > >>---------- Forwarded message ---------- >>Date: Tue, 17 Nov 1998 19:57:32 -0500 >>Subject: EDT Virtual Sit In >> >>November 18th 1998 Protest, ELECTRONIC DISTURBANCE THEATER >> >>EVERYWHERE: ELECTRONIC DISTURBANCE THEATER, Emergency Bulletin: Clinton: >> >>Do Not Bomb Iraq! - Join Ongoing Virtual Sit-In On White House Web Site >>Now, - The Electronic Disturbance Theater, opposes U.S. plans to bomb Iraq >>and urges like-minded people to join an emergency FloodNet action to send a >>message of peace to world leaders. EDT encourages people who oppose a U.S. >>military strike against Iraq to participate in an ongoing virtual sit-in on >>the web site of the White House by clicking on >>http://www.thing.net/~rdom/zapsPublic/ddkfoyer.htm and following the >>instructions and leaving your browser on. >> >> >> >>Garden Networks - Quality Internet Nationwide >>Access, Co-location, Development & Consulting >>http://www.garden.net (973)300-9211 Ext.103 >>It's not Area 51 I'm worried about... >>...it's Areas 1 through 50. >> > >___________________________________________________ >Roeland M.J. Meyer, ISOC (InterNIC RM993) >e-mail: <mailto:rmeyer@mhsc.com>rmeyer(a)mhsc.com >Internet phone: hawk.mhsc.com >Personal web pages: <http://www.mhsc.com/~rmeyer>www.mhsc.com/~rmeyer >Company web-site: <http://www.mhsc.com/>www.mhsc.com/ >___________________________________________ > Who is John Galt? > "Atlas Shrugged" - Ayn Rand > > ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

2 1

Re: Black Hole Vixie/RBL
by David Lesher 19 Nov '98

19 Nov '98

I find it absolutely incredible that the NANOG crowd is wasting ANY time debating with Allisat. Have you folks had your heads in IOS too long, or been sniffing reactor fuel? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Re: Another site attempt? (Was Re: Exodus/Clue problems)
by TTSG 19 Nov '98

19 Nov '98

> > Yes, in my Popper ? > Should I be concerned? > Bob > I received a call from the admin there. Anyone with logs of any sort please email "John.Stier(a)SUNYSB.EDU". Otherwise the box was removed from service without trying to trace the hacker. SIGH.......... Tuc/TTSG > On Thu, 19 Nov 1998, TTSG wrote: > > > Hello, > > > > Anyone seeing attempts from : pulse.physics.sunysb.edu > > > > > > heimdall:~# telnet pulse.physics.sunysb.edu > > Trying 129.49.30.248... > > Connected to pulse.physics.sunysb.edu. > > Escape character is '^]'. > > > > Red Hat Linux release 5.0 (Hurricane) > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > Kernel 2.0.32 on an i486 > > > > > > Only reason I ask....... > > > > Tuc/TTSG > > >

1 0

Re: Lawsuit threat against RBL users
by Karl Denninger 19 Nov '98

19 Nov '98

On Thu, Nov 19, 1998 at 05:58:10PM -0500, Bret McDanel wrote: > but its my network and I will decide what to let in and out.. If I dont > like someone and decide that they are guilty by association, then that is > still my choice.. Why should I be forced to let anyone do anything to my > network? If that were the case, why is there packet filtering routers and > firewalls? Why are tcp wrappers and other ACLs around? Becuase its > simple, I decide what I let in and out, and I dont have to have a good > reason to do it.. I can do whatever I want.. You are ABSOLUTELY right. Until the "you" obtains market power. Then you're absolutely WRONG. That market power can be obtained by one company, or one individual. It can also be obtained by a lot of companies and/or individuals all doing the same thing through joint decisions, whether formally documented or not. I STRONGLY suggest that you, and others who beleive that you are acting in a vacuum here, go talk to your counsel. Today. Seriously. This kind of stuff is no laughing matter; Sherman and RICO contain *criminal* provisions as well as civil (ie: sue your butt) ones. Vix is right in that a simple lawsuit is probably baseless. However, I'd be very concerned about either a Sherman or Sherman+RICO action. The congruence of AUPs, along with the widespread adoption of them by lots of people, gives rise to liabilities for joint actions that *do not exist* when you act alone. -- -- Karl Denninger (karl(a)denninger.net) http://www.mcs.net/~karl I ain't even *authorized* to speak for anyone other than myself, so give up now on trying to associate my words with any particular organization.

1 0

Re: Lawsuit threat against RBL users
by George Herbert 19 Nov '98

19 Nov '98

Karl Denninger <karl(a)Denninger.Net> writes: >On Thu, Nov 19, 1998 at 01:58:40PM -0800, George Herbert wrote: >> RBL policy is that they won't block anything more general than >> is warranted by particular spam complaints and the subsequent >> actions in response to those complaints or to a pattern of complaints. >> For example, a bunch of complaints come in reporting that various >> dialups spammed ads for www.biteme.com, a masochist oriented porn site, >> which is hosted on an IP address which is part of wehost.net . >> The proper procedure is that people complaining to RBL have to >> have contacted wehost.net and not gotten appropriate responses. >> RBL people will (always?) contact wehost.net for a final warning >> and status check prior to the block, and will only block >> the /32 corresponding to www.biteme.com's actual IP address. >> Thus, no wehost.net customer other than biteme will be inconvenienced. > >That does nothing at all, since the only listener on www.biteme.com's >address is a web server. It punishes biteme.com for having spammed by blocking access to their web server. That's the point. >> So yes, under (as I understand them) existing RBL rules, it is possible >> for purely innocent parties to get bitten (other non-spam related >> customers of wehost.net) if the ISP fails to respond properly >> for a significant length of time and number of incidents. >> I feel that's fair; if the ISP becomes the problem, then they >> should feel some heat. As long as the criteria for the ISp >> being RBled as a whole are sufficiently demanding so ISPs that >> are merely slow or not-entirely-cooperative don't get unnecessarily >> RBLed, that makes sense to me. > >That's not the scenario that was postulated and led to the latest threat. Which exact "scenario" did you have in mind? There have been a whole bunch posted recently by a number of people. Are you referring to the NSI block threat, which falls under a similar scenario where it's parts of one company rather than an ISP and its varied customers? Last I saw, Paul stated that NSI's systems were in distinct IP blocks from internic and internic wasn't being approached as a potential blockage target. I've seen a lot of "scenarios" fly around which bear little semblance to reality and greatly misunderstand how the RBL is (as far as I can tell from the outside) operating. Those scenarios are only worth considering as a theoretical exercise in how a RBL-like entity could go bad and as examples of how RBL isn't publicizing some of its policies enough so that people won't be confused about what they do. RBL in the maps.vix.com sense simply don't do some of the things that have been at one time or another accused of them, to my knowledge. Again, one can postulate a scenario about a generic blacklist service unfairly affecting innocent parties, but the actual RBL has what ppear to me to be adequate policies in place to protect third parties. People afraid of it really should at least listen enough to assuage fears based on policies it doesn't really have. -george william herbert gherbert(a)crl.com I speak for myself only

1 0

Re: Black Hole Vixie/RBL
by Paul Vixie 19 Nov '98

19 Nov '98

I will at some point today drink enough coffee to gain the self control it would take to not answer crazies. Because that time has not yet come, I can only hope that you, the reader, will delete this message without reading any further. bob(a)fcn.net (Bob Allisat) writes: > Mr. Vixie and his cohorts increasingly > imagine themselves to be the final and > ultimate arbiters in matters of Network > integrity. Having them sit in judgement > over the Black Holing of successive and > alleged perpetrators violates numerous > protections and freedoms all citizens Yup. Well, your freedoms anyway. Note that the MAPS RBL is a subscription service; no second and third parties are ever denied the opportunity to communicate freely unless one of them subscribes to the MAPS RBL and the other list listed on it. > It is my opinion that these activities > have reached their zenith and something > should be done to finally Black Hole > Vixie/RBL should they continue on their > renegade mission of uncontrolled and > arbitrary censorship. Maybe it is time > to pull the plug on the ultimate plug > pullers, black hole the black holers! I suppose that you'd prefer "controlled" censorship? Well, anyway, the sysop.com guy is spamming threats far and wide in hopes of scaring away my subscribers, but this doesn't appear to be having his desired effect. Maybe "renegade" is the wrong word? As for your suggestion, I would like it, and I mean I would really, really like it, if you (Bob Allisat) would please blackhole my route in your upstream router. I'm 204.152.184/21. Leave 192.5.4/23 out, since that's where F lives, but I promise that none of my mail or web servers are outside 204.152.184/21. -- Paul Vixie <paul(a)vix.com>

4 3

Latest outage analysis from the telephone companies
by Sean Donelan 19 Nov '98

19 Nov '98

I stumbled across the lates telephone Network Reliability Steering Committee report on US Telephone Network reliability. Through June 30, 1998. As always, they report the state of the nation to be good, stable, and reliable. Ok, so what everyone really wants to know. The number of facility outages (aka cable cuts) is increasing. The number of CO power problems is increasing. The number of Procedural Errors is increasing. As always, these are based on reports from the field affecting at least the minimum reportable event by the FCC. Just because something wasn't reported didn't mean it didn't happen. Puerto Rico was treated as a special case during this reporting period. The good news The number of CCS outages is decreasing. Since Illuminet didn't report their SS7 outage, I don't know if the report included its affects. Most events were within the 'green' zone limits established as a baseline in 1992-1993. Which is a fancy way of saying there were a 'normal' number of outages. Source of disruptions Facility failures (45%) CO Power (16%) Tandem Switch (14%) Local Switch (11%) CCS (9%) ftp://ftp.atis.org/pub/nrsc/exam2q98.doc -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

1 0

Re: Lawsuit threat against RBL users
by George Herbert 19 Nov '98

19 Nov '98

Karl Denninger <karl(a)Denninger.Net> writes: >On Thu, Nov 19, 1998 at 12:51:05PM -0800, George Herbert wrote: >> Karl Denninger <karl(a)Denninger.Net> writes: >> >[...] >> >The collusive aspect of this is downright scary, especially when coupled >> >with threats of depeering, active denial of service attacks, etc. >> >> Let's put two scenarios forwards. >> [...] >> In the first case, there is clearly a connection between the >> spamming and the website that gets RBLed; it was directly advertised >> by the spams. That direct link is sufficient under current RBL rules >> and meets my definition of terminatable customer. >> In the second case, one of the sites meets the above definition, >> but the sites at U and V (which may be for completely unrelated >> subsidiaries or groups within B) don't necessarily. This might >> begin to approach an illegal blacklist. >> The question is, are any cases similar to scenario 2 actually happening? >> As far as I know, no. Companies that have many websites that are having >> all their ISPs pressed to nuke them generally are spamming to advertise >> most or all of them, not just one or a few. > >Ok, let's put another scenario out there, one which IS somewhat likely: >Company A has a web site hosted at ISP Z, and a bunch of throw-away dial-up >accounts on ISPs P, Q, R and S. They spam through P, Q, R and S, advertising >the site hosted at ISP Z and giving a "freemail" (ie: hotmail, juno, etc) >reply EMAIL address. All four of those dial providers cut *THE SPAMMER* >off. >The spammed people also complain to ISP Z, and ISP Z tells the complainers >to stuff it, because (1) there is no PROOF that Company "A" actually did >the spamming, and (2) no offensive data was emitted by ISP Zs machines. >ISP Z gets RBLd, even though *ISP Z* was not a party to the spamming, >and ISP Z *never touched or emitted the spam*. Worse, what gets RBLd >is ISP Zs mail server, which (if Company A is web hosting there ONLY) >was not only uninvolved, but is irrelavent to the offense (since ISP Z >only sold Company "A" web service). >ISP Z has just had its business policies dictated by unrelated people and >NOT because they committed (either directly or through a customer acting >on their system) an offense - further, OTHER customers of ISP Z (who buy >mail service from them) have been harmed, even though (1) ISP Z wasn't >involved in the infraction, (2) Company "A" didn't do anything objectionable >*ON* ISP Z, or THROUGH ISP Zs equipment, and (3) the sanction is not in any >way related to the offense (ISP Zs mail service is damaged, although their >mail server was not abused, and in fact Company A doesn't get their mail >through ISP Z). While your scenario is a distinct possible problem with a RBL-like list, I don't think it's possible under the existing RBL rules and procedures that exist. [Please keep in mind in the following that I am not an RBL volounteer, so I may be getting details wrong... Dave and Paul are on nanog and can correct anything I misstate, though, I assume] RBL policy is that they won't block anything more general than is warranted by particular spam complaints and the subsequent actions in response to those complaints or to a pattern of complaints. For example, a bunch of complaints come in reporting that various dialups spammed ads for www.biteme.com, a masochist oriented porn site, which is hosted on an IP address which is part of wehost.net . The proper procedure is that people complaining to RBL have to have contacted wehost.net and not gotten appropriate responses. RBL people will (always?) contact wehost.net for a final warning and status check prior to the block, and will only block the /32 corresponding to www.biteme.com's actual IP address. Thus, no wehost.net customer other than biteme will be inconvenienced. What begins to approach your scenario is the situation where wehost.net has had a really significant number of customers who did the same thing and refused to act appropriately about any of them. At that point, (that point being defined somewht nebulously here, but bear with me), it changes from an innocent ISP scenario to one where the ISP is acting as a knowledgeable and culpable host to multiple spamming sites. At that point, the ISP may be acted against as a whole, under current RBL rules. But not before. So yes, under (as I understand them) existing RBL rules, it is possible for purely innocent parties to get bitten (other non-spam related customers of wehost.net) if the ISP fails to respond properly for a significant length of time and number of incidents. I feel that's fair; if the ISP becomes the problem, then they should feel some heat. As long as the criteria for the ISp being RBled as a whole are sufficiently demanding so ISPs that are merely slow or not-entirely-cooperative don't get unnecessarily RBLed, that makes sense to me. -george william herbert gherbert(a)crl.com I neither speak for nor work for CRL at this time.

2 1