May 2001 - Test - lists.nanog.org

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> From: Eric A. Hall [mailto:ehall@ehsco.com] > Sent: Thursday, May 24, 2001 11:03 AM > > > > The negative side effect is that it cripples people who use email > > > as a file transfer protocol. > > > > Which I do, quite extensively. Transit providers shouldn't be doing > > this. > > I agree. Access providers should be, however. That depends on your definition of access provider. I would be livid, were my upstream to do such traffic shaping on my feed. We would also be in court for breach of contract. I buy bandwidth and IP space. I expect to get what I pay for. I don't pay to have my traffic restricted by other than my pipe size.

1 0

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> The negative side effect is that it cripples people who use email as a > file transfer protocol. Which I do, quite extensively. Transit providers shouldn't be doing this.

2 1

RE: Query: What policies do backbone providers use to determine IP ownership
by Richard A. Steenbergen 24 May '01

24 May '01

On Thu, May 24, 2001 at 03:16:17AM -0400, Deepak Jain wrote: > > I have seen dueling routes more often than I'd like to recall. > > No one wants to use space that isn't 100% routable. Assuming A has any > peers, some traffic will go there and dead-end. Any customer in the > block will be unhappy. B will eventually give up. A would be foolish > to assign customers in the block until B has given up. > > If A is a much better connected network than B (since B is acting like > an ass) the process is much more definitive. When in doubt, A's lawyers contacting B usually helps them convince C to stop it. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

RE: Domain-Policy?
by Roeland Meyer 24 May '01

24 May '01

If you'd been following some of the responses there ... It was an ex-employee making allegations wrt a legal matter, in process, between them and NSI. Rather than leave it with the courts, that ex started spamming the DP list with their version of events. This created a legal problem for NSI. Caught between a rock and a hard place, the DP list got squashed. I would have done the same thing. The first time I saw flip's note, combined with some stuff on the DNSO/GA list, I started building a mail server, on a spare amdK6-233 Linux box, to run under DNSO.NET. Frankly, I could use some help with that effort (Postfix/MailMan/INN). I was not expecting this to happen for at least another week. The DP list was the only impartial list around. Everything else is under ICANN/DNSO control. -- ROELAND M.J. MEYER Managing Director Morgan Hill Software Company, Inc. TEL: +001 925 373 3954 FAX: +001 925 373 9781 http://www.mhsc.com mailto: rmeyer(a)mhsc.com > -----Original Message----- > From: David Howe [mailto:DaveHowe@gmx.co.uk] > Sent: Thursday, May 24, 2001 9:00 AM > To: nanog(a)merit.edu > Subject: Domain-Policy? > > > > Got two emails in reasonably close order (this follows an > argument about > Netsol selectively deleting emails from the DP archive) > > -------------------------------- first > message ------------------------------------------------------------- > Subject: We Are Mad As Hell And Doing Something! > > NOTE: NSI is refusing to post this email message for over 10 > hours. This is > -------------------------------- end of first > message --------------------------- > -------------------------------second > message -------------------------------- > From: Tom Newell <tomn(a)LISTS.NETSOL.COM> > Subject: List deactivation > To: DOMAIN-POLICY(a)LISTS.NETSOL.COM > > This list will be closed effective immediately. When > --Tom > -------------------------------- end of first > message --------------------------- > > > and Domain-Policy is **gone** - gone from the website > (archive and all), > email to the list bounces, resub requests to the majordomo fail. > > any ideas what is going on here (other than the obvious > impression that the > easiest way to stop the argument is to delete the forum)

1 0

RE: Remote Area Satellite Internet Access
by Jeremy Furr 24 May '01

24 May '01

Yep, try www.starband.com Jeremy Furr Network Engineer > -----Original Message----- > From: Dennis Dayman [mailto:dennis@swbell.net] > Sent: Wednesday, May 23, 2001 5:34 PM > To: Nanog > Subject: Remote Area Satellite Internet Access > > Any suggestions as to satellite companies or equipment to use for remote > area Internet access? > > > --------------------------- > Thanks > Dennis Dayman > dennis(a)swbell.net > Voice 972-682-7555 > FAX 972-682-7556 > -------------------------------------------------------------------------- > ---- > What goes up, must come down. Ask any system administrator. > -------------------------------------------------------------------------- > ---- > > >

2 1

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> From: David Schwartz [mailto:davids@webmaster.com] > Sent: Wednesday, May 23, 2001 5:24 PM > > > > From: David Schwartz [mailto:davids@webmaster.com] > > > Sent: Wednesday, May 23, 2001 4:54 PM > > > > > > > In the PURE war, one ONLY shoots confirmed bad-guys and has ZERO > > > > collateral damage. > > > > > > So if someone has a machine gun and is firing randomly, > > > you don't act to stop him until he happens to hit someone? > > > > Lottsa mitigating circumstances here; > > .Are they shooting spam? > > .Are they trying to hit anyone? > > How can you tell if you don't check? As soon as you > have reason to believe > they're creating a hazzard to innocent people, you are > justified in checking > if they really are. This has been standard Internet practice > since day one. I don't need to check because I have a piece of confirmed spam from them. A smoking gun. That's the way MAPS RBL has been working for years. That is the way I expect it to continue to work. The main reason that I posted to this thread is that some of the posts lead me to believe otherwise. They were confused. > > One spammer is no justification for nuking their entire > city. Targeted > > response, sir ... targeted response. That's what MAPS is, a laser > > beam, not > > a hand granade. > > Absolutely. Probe the machine that is of concern, not > whole blocks randomly. Also, only block the proven spam-host. No one else. > > > That's madness. [I] don't advocate > > > random scanning, as it is unethical to probe random people for > > > vulnerability. However, once you know there is in fact an > > > open relay, you are entirely justified in blocking it. > > > Agreed, but its open-relay status is irrelevent. The fact > that one has > > proof-positive of spam, from that site, is. > > No, its open-relay status is not irrelevant. If you > know a site is an open > relay, however you know this, and you want to block open > relays (which I do) > and it's my right to block open relays, then I will block > them. How I find > out they're an open relay is another story. The usual way is > you probe a > site when it becomes an actual problem. I submit that if you have a piece of spam, from a site, and are blocking them, why do you need to probe them? > So let me ask you three questions: > > 1) If I find out a site is an open relay by legitimate > means, do you agree > that I have the right to block it if I want to? Sure. > 2) If a site sends me spam or otherwise inconveniences > me, do you agree > that I have the right to probe it to see if it's an open > relay if I wish to > do so? sure > 3) Do you think it's unreasonable to block known open > relays as a > protection against future spam. Absolutely not. Our entire Norte Americano culture is biased AGAINST apriori restrictions. You DO NOT spank someone for something that they have NOT, in fact, done. It's called prior restraint and there is a reason that it is considered unjust. It violates the PURE WAR ethos. There is no excuse for collateral damage. Innocents should not be involved, period. This is important because we DO have the technology to wage the PURE WAR and are ethically compelled to use it. > > > And if you have legitimate reason to > > > suspect a site is an open relay, you are entirely justified > > > in probing it to see whether or not it is. > > > No you are not, by your own ethical standards. Suspicion is not > > proof. Only > > a piece of spam, in hand, from that specific site, is > sufficient grounds. > > If you really believe what I think you're saying, then > you would have to > object to, for example, the ident protocol. I think we have [only] a slight disconnect here. ident is part of the protocol. [side note: I'm setting up a new Postfix host (my first Postfix host ... used to doing sendmail). Does Postfix do SMTP AUTH?] > > > If your neighbor is aiming a gun at you, you are > > > justified in checking to see if it's loaded. > > > No you are not, you assume that it is and fire first > <grin>. But, you are > > not justified in taking out his whole block, including the other > > neighbors. > > You are not allowed ANY collateral damage. Anything less is > sloppy anyway. > > What's the matter, ain't you that good? Can't you aim? > > The only collateral damage is that the man's children > lose their father. There's nothing you can do about that. Yes, but with ORBS, they take out the entire town, even if there aren't any spammers there. That's serious collateral damage. It is unacceptable. It is not the PURE WAR. > Similarly, if you block a site that's > a known problem, you inconvenience any legitimate mail > traffic that might have passed through that site. > But that's the kind of collateral damage > that's unavoidable. Not really, since it is the owner of the site that is directly responsible for that site's mail delivery. The atomic unit is the site, not the users of that site. To go effectively below that level of granularity is, IMHO, not technologically feasible. > Unfortunately, you have to make hazardous > misconfigurations inconveniencing or they won't be fixed. There is a major distinction between a spam hazard and a proven spam site.

3 2

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

I'm getting seriously confused here. I thought that the open-relay issue was irelevent to MAPS. That MAPS only black-holed confirmed SPAM sites (a little tougher, but more granular, charter). Further, that it was ORBS that listed open-relay sites specifically, whether they were involved in a spam or not (unacceptable due to punishing potential anti-spammers for proliferating spam that never saw their systems). To me, these are two entirely different charters. If MAPS starts to look like ORBS then I will stop using MAPS. Can someone please clarify? > -----Original Message----- > From: Robert Sharp [mailto:rsharp@appliedtheory.com] > Sent: Wednesday, May 23, 2001 1:04 PM > To: Valdis.Kletnieks(a)vt.edu > Cc: nanog(a)merit.edu > Subject: Re: Stealth Blocking > > > > I would like to make the point that I do run two mail servers > and both a maps approved. > Please don't tell me I don't know how to run a mail server. > Again I am not discussing your > ability , please don't poke fun at me. In fact I had some > trouble with spam on one of them > because someone was signing up a list I use for the owl > networks mailing list. I infact > installed MAPS to see if it helped the problem. It did not > because the user didn't run an > open relay site but rather a no confirmation email list. > Would I be correct to assume they > should be in the MAPS list too? As you can see sometime > spam/annoying emails is not always > sent throught an open relay but sometimes it's a problem with > mailing lists..... What should > maps do, start adding sites that act like this? > > I am just making the point that if MAPS wasn't run by one > person with total control maybe > some of us "retards who don't know what we are doing" would > be a bit more will to support the > effort. > > > Rob > > Valdis.Kletnieks(a)vt.edu wrote: > > > On Wed, 23 May 2001 14:36:15 EDT, Robert Sharp said: > > > > > And if you use the MAPS list by your choice you are most > definetly filtering out email > > > or traffic for people who are legitimate. I know I have > been filtered before. MAPS is > > > using a very large hammer to kill a not so large bug. > > > > Hmm.. you won't configure it correctly. RFC2505 is "Best > Current Practice". > > > > You get filtered because you won't configure it correctly. > > > > You say you've been filtered *before* because you won't > configure it correctly. > > > > Yes, we *admit* we're using a large hammer. Bouncing your > e-mail didn't > > get your attention. Maybe irate users will get your > attention. But I > > am doubting it. > > -- > > Valdis Kletnieks > > Operating Systems Analyst > > Virginia Tech > > > > > -------------------------------------------------------------- > ---------- > > Part 1.2Type: application/pgp-signature > >

4 3

RE: Stealth Blocking
by Roeland Meyer 23 May '01

23 May '01

> From: David Schwartz [mailto:davids@webmaster.com] > Sent: Wednesday, May 23, 2001 7:10 PM > > Roeland Meyer wrote: > > > I don't need to check because I have a piece of confirmed spam > > from them. A > > smoking gun. That's the way MAPS RBL has been working for years. > > That is the > > way I expect it to continue to work. The main reason that I > posted to this > > thread is that some of the posts lead me to believe > otherwise. They were > > confused. > > I think you're missing the big picture. If you receive > a single piece of > spam from a site, that's not automatically grounds to block > the site. That's > a recipe for maximizing collateral damage. > So the receipt of a spam from a site is the beginning > of the process, not > the end. Actually, I simplified the process. I agree with you 100% here. I don't have the time for such an investigation therefore I use MAPS RBL. > > > Absolutely. Probe the machine that is of concern, not > > > whole blocks randomly. > > > Also, only block the proven spam-host. No one else. > > That's a more complex judgment. In most cases, I agree > that this is > appropriate, but I can think of (and have personally > witnessed) more extreme > circumstances. I've seen ISPs who say, "no, we like to spam > and we will spam > in the future". In those extreme cases, I'll block their > entire address > space from reaching my mail servers until their policy changes. Another reason to use MAPS RBL. > > > No, its open-relay status is not irrelevant. If you > > > know a site is an open > > > relay, however you know this, and you want to block open > > > relays (which I do) > > > and it's my right to block open relays, then I will block > > > them. How I find > > > out they're an open relay is another story. The usual way is > > > you probe a > > > site when it becomes an actual problem. > > > I submit that if you have a piece of spam, from a site, and > are blocking > > them, why do you need to probe them? > > Well, if you're blocking them because they're an open > relay and they say > they've fixed the problem, it's certainly reasonable to probe > them to decide > whether you should begin allowing mail from them. Or do you think it's > better to block them indefinitely just so that you don't 'trespass' by > probing them? I'm actually not advocating blocking all open relays. I am advocating blocking all spammers, whether they have open relays or not. There are actually open relays that a spammer can never use, because the open relay site uses MAPS RBL. The are collateral damage, with ORBS. Show me how such a site can be used by a MAPS RBL'd spammer. BTW, yet another reason to use MAPS RBL. > > > 3) Do you think it's unreasonable to block known open > > > relays as a > > > protection against future spam. > > > Absolutely not. Our entire Norte Americano culture is biased > > AGAINST apriori > > restrictions. The following is a real good example of why I don't like argument by analogy. Your analogy is broken. Let's deal with the issue directly. We actually seem to be on the same side here or not very far apart. > Nonsense! This argument would say that you should allow > children to bring > guns into school provided they haven't yet shot them. Our > culture is biased > against a priori restrictions upon speech imposed by the > government, but > there is nothing inherently bad about a priori restrictions. > > > You DO NOT spank someone for something that they > > have NOT, in > > fact, done. It's called prior restraint and there is a > reason that it is > > considered unjust. It violates the PURE WAR ethos. There is > no excuse for > > collateral damage. Innocents should not be involved, period. This is > > important because we DO have the technology to wage the PURE WAR and are > > ethically compelled to use it.

2 1

RE: Stealth Blocking
by Roeland Meyer 23 May '01

23 May '01

> From: Christopher B. Zydel [mailto:czydel@cv.net] > Sent: Wednesday, May 23, 2001 7:01 PM > > On Wed, May 23, 2001 at 07:02:45PM -0700, Roeland Meyer wrote: > > > From: Christopher B. Zydel [mailto:czydel@cv.net] > > > Sent: Wednesday, May 23, 2001 4:03 PM > > > > > ISPs that subscribe to MAPS RBL are saying that > > > they believe > > > that open relays should not exist, that MAPS should be able > > > to test for this > > > condition, and that they don't want to receive e-mail from > > > non-compliant > > > hosts. > > > > This is the source of confusion... right here. This person > does not know the > > difference between MAPS and ORBS. > > Wow, this text was incredibly ambiguous. MAPS offers three different lists: RBL -- the traditional realtime black hole list, of confirmed, unrepentant spam sources DUL -- the list of provider dial ports, as you shouldn't be receiving email directly from some other ISP's dial pool in most cases RSS -- 'relay spam stopper', an open relay list which is much more tightly run than ORBS, as RSS requires samples of spam that have come through the relay, whereas ORBS actively hunts open relays, whether they are being used for spam or not. In all cases, proof of spamhood is required. The do not scan for innocent open relays.

1 0

RE: Stealth Blocking
by Roeland Meyer 23 May '01

23 May '01

> From: Christopher B. Zydel [mailto:czydel@cv.net] > Sent: Wednesday, May 23, 2001 4:03 PM > ISPs that subscribe to MAPS RBL are saying that > they believe > that open relays should not exist, that MAPS should be able > to test for this > condition, and that they don't want to receive e-mail from > non-compliant > hosts. This is the source of confusion... right here. This person does not know the difference between MAPS and ORBS.

2 1