January 2004 - Test - lists.nanog.org

Re: Misplaced flamewar... WAS: RE: in case nobody else noticed it, there was a mail worm released today
by Dave Temkin 28 Jan '04

28 Jan '04

On Wednesday 28 January 2004 08:37, Dave Temkin wrote: >> So? Had the virii been an application compiled for RedHat and >> everyone ran RedHat instead of Windows and they downloaded it using >> Evolution and double clicked on it, it would suddenly be RH's fault >> instead of MIcrosoft's? >If RedHat, by default had you running as root rather than an unprivledged >user, it sure would be. > >Most Windows boxes are running with administrative privledges. That >makes >Windows a willing accomplice. The issue isn't that people click on >attachments, but that there are no built in safeguards from what happens >next. > >-- >Robin Lynn Frank | Director of Operations | Paradigm-Omega, LLC Cry >havoc, >and let slip the dogs of war! Email acceptance policy: >http://paradigm-omega.com/email_policy.php You're the second person to say that and it's still wrong. The virii, once resident, opens a connection to port 25 on an open SMTP server, whether it be the user's ISP relay or local server. Sure, it can't install itself into /etc/init.d, but it sure can launch itself bg instead of fg and be running until the user either kills it or reboots the box. Also, for reference to other people - the preview pane does *not* allow the execution of attachments unless they're double-clicked on and acknowledged. Again - we're not talking about another OS or Outlook exploit, only a stupid user exploit. -- David Temkin

2 1

None
by Dave Temkin 28 Jan '04

28 Jan '04

On Wednesday 28 January 2004 08:37, Dave Temkin wrote: >> So? Had the virii been an application compiled for RedHat and >> everyone ran RedHat instead of Windows and they downloaded it using >> Evolution and double clicked on it, it would suddenly be RH's fault >> instead of MIcrosoft's? >If RedHat, by default had you running as root rather than an unprivledged >user, it sure would be. > >Most Windows boxes are running with administrative privledges. That >makes >Windows a willing accomplice. The issue isn't that people click on >attachments, but that there are no built in safeguards from what happens >next. > >-- >Robin Lynn Frank | Director of Operations | Paradigm-Omega, LLC Cry >havoc, >and let slip the dogs of war! Email acceptance policy: >http://paradigm-omega.com/email_policy.php You're the second person to say that and it's still wrong. The virii, once resident, opens a connection to port 25 on an open SMTP server, whether it be the user's ISP relay or local server. Sure, it can't install itself into /etc/init.d, but it sure can launch itself bg instead of fg and be running until the user either kills it or reboots the box. Also, for reference to other people - the preview pane does *not* allow the execution of attachments unless they're double-clicked on and acknowledged. Again - we're not talking about another OS or Outlook exploit, only a stupid user exploit. -- David Temkin

1 0

in case nobody else noticed it, there was a mail worm released today
by Paul Vixie 28 Jan '04

28 Jan '04

my copies (500 or so, before i filtered) are in a ~7MB gzip'd mailbox file called http://sa.vix.com/~vixie/mailworm.mbox.gz (plz don't fetch that unless you need it for comparison or analysis). there's a high degree of splay in the smtp/tcp peer address, and the sender is prepared to try backup MX's if the primary rejects it, though it appears to try the MX's in priority order.

8 7

How does one reach a human being at Yahoo?
by Eric Brunner-Williams in Portland Maine 28 Jan '04

28 Jan '04

A friend of mine died suddenly over the holidays, his bio is here http://triballaw.wabanaki.net/archives/000030.html He had some lists hosted by Yahoo, a native grad student list in particular, which I'm informed by someone who should be next as its manager, is no longer accessible. Basically, I need someone with clue at Yahoo who can roll up a tar ball of one or more indian (feathers, not dots) mailing lists and put it where I can move it to tribally operated unix boxen. Contact clue greatly appreciated. Eric

1 1

NANOG30 PGP Key Signing
by Majdi S. Abbas 28 Jan '04

28 Jan '04

When you stop by the registration desk at NANOG30, there will be colored stickers available for your nametag that indicate if you have an interest in signing PGP keys. If people keep trying to peer with you, you've picked up the wrong color sticker and should go back. Additionally, there will be a PGP key signing party held during NANOG30 in (hopefully) sunny Miami. We are scheduled to meet on Monday night at 10:30 or so, after the Peering BOF. If the Peering BOF is running a little late, I'll delay us and ask Bill to tell jokes until everyone leaves. :-) Those of you who plan to participate should email an ASCII extract of your public key to msa(a)latt.net by noon on Monday, February 9th. Please include 'NANOG PGP KEY' in the subject, and if possible, don't send your key as a MIME attachment. I realize that some MUAs make this difficult, and I will attempt to fix any MIME attached keys. Instructions for extracting your key to an ASCII file are below. After 5pm on the 9th, a complete key ring with all of the submitted keys will be available at http://www.latt.net/nanog30.pgp in binary form, and as an ASCII file at http://www.latt.net/nanog30.txt Handouts with the details of each key submitted will be provided. All you should need to bring with you is: * Photo ID (driver's license, passport, etc.) * Your key ID, and its fingerprint * A pen Thank you, and I'm looking forward to seeing you all in Miami! How to extract your public key to an ASCII file: ------------------------------------------------ PGP 2.x: pgp -kxa your_email_address mykey.asc PGP 5.x: pgpk -xa your_email_address > mykey.asc GnuPG: gpg --export --armor your_email_address > mykey.asc PGP on Windows: Start the PGPkeys application, select your key in the list, click on the Keys menu, select Export, name the resulting file, and make sure that Include Private Keys is NOT checked. PGP on a Mac: I assume the procedure is similar to the one for Windows, but cannot confirm this. Hopefully it's easy enough to figure out.

1 0

Re: in case nobody else noticed it, there was a mail worm released today
by Brent_OKeeffe＠asc.aon.com 28 Jan '04

28 Jan '04

>I've been wondering lately, after about 10 years of email worms spreading in >exactly the same manner with every incarnation ... why do you think people >haven't learned not to open unexpected attachments yet? It would seem to me >that even the most clueless user would modify his/her behavior after, say, >the 25th time they've been infected and had to 1) call tech support or 2) >reinstall their OS (or more likely, have someone else reinstall their OS). (Uh oh... I think I am about to start something here...) What you are really touching on here is a social issue that plagues the United States (and most other cultures) repeatedly. The people want to believe in a peaceful, harmless community so we can sleep sound at night and have fluffy dreams of puppies and flowers. Time and again, we try to forget the bad experiences and focus on the benefits we receive from the conveniences we demand. Therefore, born from those conveniences, the bad element sees opportunity and strikes. This is evidenced in many facets of our world. Email, air travel, 24 hour ATMs, and roofing contractors! Can we change this? Most likely not. But can we complain about it? What else would we do on our lunch hour? Take care, Brent

2 1

How does one reach a human being at AT&T?
by Jay Hennigan 28 Jan '04

28 Jan '04

I have an AT&T T-1 taking errors. Their trouble reporting number dumps me into the IVR from hell. It even has machines calling me back at intervals with status. The status says "A test was run..." No hint as to the results of the test. One of the choices is to say or hit "2" if you need further assistance. Doing so gets a response telling you to call their maintenance center which is the same machine that I used to generate the ticket in the first place. Furrfu! The telephone company doesn't have anyone to answer the telephone. Even "Floyd"[1] is looking pretty good at this point. Anyone have a secret number or touchtone sequence to share? Swearing at it doesn't work. This is a point-to-point circuit, not an Internet T-1. [1] http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2003/02/2… -- Jay Hennigan - CCIE #7880 - Network Administration - jay(a)west.net WestNet: Connecting you to the planet. 805 884-6323 WB6RDV NetLojix Communications, Inc. - http://www.netlojix.com/

3 2

Not only do /24's run amuk...
by Anton L. Kapela 28 Jan '04

28 Jan '04

...They seem to come & go as they please! Inspired by RAS's prior posts regarding /16's that were hastly de-agged, I took some time this weekend to answer a few questions which came up; how many updates do I hear about a specific prefix, and does the length have any relationship? Well, several hours later, I knew pretty straight away how many updates I heard about various prefixes in the STS Telecom looking glass, at least. Consider this v0.0.1-alpa of the "Most-Heard Prefix" list, a sort of web-based and rule-less implementation of 'sh ip bgp flap-statistics.' The sorted list, updated every 60 minutes, is available here in gzip format due to excessive size (indeed, 10 peers act as a amplifier): http://eng.ststelecom.com/bgp-data/top-prefixes.txt.gz Incidently, many of the most-updated prefixes are included in the list of RAS's /16 de-aggs. Todo: ignore the effects of a peer session resets (i.e. don't consider a reload as part of the per-prefix flap count) and look at path changes with each update (is it a normal flap, or mid-day traffic-engineering session gone wrong?). Any comments or suggestions for changes are very welcome; please reply off-list. Thanks, --Tk

2 1

who tripped over the power cord at l3?
by John Kinsella 27 Jan '04

27 Jan '04

Seems like Level3 in SFO(at least) just went poof for a minute or two...

1 0

Kourou (French Guiana) seacable problem since last week, France telecom
by juan.bontje＠bt.com 27 Jan '04

27 Jan '04

Hi Anyone aware of an sea cable problem between kourou (French Guiana) and Europe? (France?), since 21jan04 Unfortunate don't have more sufficient information besides this. TIA JC

2 1