August 2004 - Test - lists.nanog.org

O/T: Nanog Friday night useless chatter was:RE: Specialty Technical Publishers
by Michel Py 20 Aug '04

20 Aug '04

> Mike Lewinski wrote: > In any event, after doing some googling and finding other > victims of this company, I've decided to register > SpecialtyTechnicalPublishersSucks.com in order to publicly > document their abuses. As being someone that occasionally does the same kind of thing (and considers the few dollars spent entertainment, not investment), don't lose sleep over it. Although I do expect some people to visit georgebushsucks.com and johnkerrysucks.com, only in your wildest dreams anybody but search bots is ever going to visit SpecialtyTechnicalPublishersSucks.com (or goldengatevwsucks.com or haywardvwsucks.com) out of the blue. You will indeed get some non-bots hits on the site but they will all come from search engines or cross-links and none from people typing SpecialtyTechnicalPublishersSucks.com in their browser out of the blue. You would get the same number of hits on http://home.myISP.com/~mlewinski/SpecialtyTechnicalPublishersSucks.html. > Sooner or later someone will have the time and resources to > fight them all the way- perhaps I can lend some ammo. IMHO this someone is the BBB (I do use it to qualify customers). Unrelated and even more off-topic, www.resellerratings.com has worked good for me too. > Owen DeLong wrote: > Ah... But, the problem here is you registered "goldengatevw.com" > and "haywardvw.com". They'd have a much harder time fending off > an en pro per motion for summary dismissal if you had registered > domains like "godengatevwsucks.com" and "haywardvwsucks.com". > [SNIP] Agree with Owen; this was not the wisest move (and I have done a number of dumb things myself). Michel.

1 0

Fwd: YOUR EMAIL WON THE LOTTERY - Here is another one
by Henry Linneweh 19 Aug '04

19 Aug '04

--- Mrs Brigit Willem <louisvanhansen(a)netscape.net> wrote: > X-Apparently-To: hrlinneweh(a)sbcglobal.net via > 66.218.79.74; Thu, 19 Aug 2004 08:28:12 -0700 > X-YahooFilteredBulk: 82.35.148.130 > X-Originating-IP: [82.35.148.130] > Return-Path: <louisvanhansen(a)netscape.net> > Received: from 82.35.148.130 (EHLO > mailapps2-int.prodigy.net) (207.115.63.126) > by mta829.mail.sc5.yahoo.com with SMTP; Thu, 19 > Aug 2004 08:28:12 -0700 > X-Header-Overseas: > Mail.from.Overseas.source.82.35.148.130 > X-Originating-IP: [82.35.148.130] > Received: from 24.203.20.91 > (82-35-148-130.cable.ubr04.enfi.blueyonder.co.uk > [82.35.148.130]) > by mailapps2-int.prodigy.net (8.12.10 shim/8.12.10) > with SMTP id i7JFS2pe127626 > for <hrlinneweh(a)sbcglobal.net>; Thu, 19 Aug 2004 > 11:28:11 -0400 > Message-Id: > <200408191528.i7JFS2pe127626(a)mailapps2-int.prodigy.net> > Received: from mail0.fatcow.com (mail0.fatcow.com > [209.12.212.5]) by mx.wdl.net with ESMTP; Aug, 19 > 2004 4:25:00 PM -0200 > From: Mrs Brigit Willem > <louisvanhansen(a)netscape.net> > To: Undisclosed.Recipients(a)mailapps2-int.prodigy.net > Subject: YOUR EMAIL WON THE LOTTERY > Sender: Mrs Brigit Willem > <louisvanhansen(a)netscape.net> > Mime-Version: 1.0 > Content-Type: text/plain; charset="iso-8859-1" > Date: Thu, 19 Aug 2004 17:28:08 +0200 > X-Mailer: Microsoft Outlook Express 6.00.2462.0000 > Content-Length: 1510 > > FROM: THE DESK OF THE LOTTO CHANCELLOR, > INTERNATIONAL PROMOTIONS/PRIZE AWARD DEPARTMENT, > REF: KIY/47560460037/02. > BATCH: 24/23519/YHI > > ATTENTION: > > RE/ AWARD NOTIFICATION; FINAL NOTICE We are pleased > to > inform you of the announcement today 15-8-2004 of > winners of the REAL > EXCHANGE LOTTO PROMO ,THE GLOBAL MEGA LOTTERY INT., > PROGRAMS AMSTERDAM held > on 26 June,2004 through computer ballot system Your > company/You email,is attached to ticket number > 023-5876-790-279, with serial number 3673-10 drew > the lucky numbers 43-14-42-37-69-25, and > consequently won the lottery in the first category > > You have therefore been approved for a lump sum pay > out of US$800 000:00 in cash credited to file > REF:KIY /47560460037/02. This is from total prize > money of US$90,000,000.00 shared among the 25 i > nternational winners in > this category. All participants were selected > through a computer ballot system drawn form 30,000 > names > from Australia, New Zealand, America, Europe, North > America, Asia, and Africa as part of International > Promotions Program, which is conducted annually. > > CONGRATULATIONS! Your fund is now deposited with a > Finance House insured in your name. Due to > the mix up of some numbers and names, we ask that > you keep this award strictly from public notice > until > your claim has > been processed and your money remitted to your > account. This is part of our security protocol to > avoid > double claiming or unscrupulous acts by > participants of this program. We hope with a part > of you prize, you will participate in our end of > year > high stakes US$1.0 Billion Netherlands International > Lottery. To begin your claim, please contact our > > international claim agent: > > Mr Tony van More > email:tonyvanmore123@netscape.net > Tel:+31-62-00-79-843 > INTERNATIONAL COORDINATOR, > > > For due processing and remittance of your prize > money to a designated account of your choice. > Remember, all prize money must be claimed not later > than 30th september, 2004. After this date, all > funds will be returned as unclaimed. NOTE: In order > to avoid unnecessary delays and complications, > please remember to quote your reference and batch > numbers in every one of your correspondences > with your agent.Furthermore, should there be any > change of your address, do inform your claim's > agent > as soon as possible. > > Congratulations again from all our staff and thank > you for being part of our promotions program. > > Sincerely, > Mrs Brigit Willem > > THE PROMOTIONS MANAGER,GLOBAL MEGA LOTTERY > INTERNATIONAL > N.B. Any breach of confidentiality on the part of > the winners will result to disqualification. > > THANKS FOR WINNING. >

4 3

Re: DNS Blocking
by Paul Vixie 19 Aug '04

19 Aug '04

i wrote: > > ... confuse and make errors for whoever queries it: > > > > @ SOA localhost hostmaster.localhost > > NS localhost > > localhost A 127.0.0.1 > > * MX 0 localhost > > A 127.0.0.1 > > > > if you put a zone like that in place on a server that's receiving > > unwanted queries for some zone, they will soon stop, or not. you > > win either way -- the queries stop, or you laugh your ass off. dan answered: > There weren't rfc1918. i'm sorry if i mixed too many topics in one post. it doesn't have to be rfc1918. let's say that someone registers a zone, let's call it nanogtest.vix.com, and points it at your nameservers without your permission. in response, let's create a zone file with this content: --- @ SOA localhost hostmaster.localhost 42 3600 1800 604800 3600 NS localhost localhost A 127.0.0.1 * MX 0 localhost A 127.0.0.1 --- note that this content is all-purpose. it doesn't matter what the real zone is called. in bind's named.conf, add something like this: --- zone "nanogtest.vix.com" { type master; file "pri/nanogtest.vix.com"; }; --- and you're done. any query that anyone sends to your server for that zone will be sent something that will hurt them. eventually they will realize that it's hurting them, and they will stop.

4 3

DNS Blocking
by Dan Mahoney, System Admin 19 Aug '04

19 Aug '04

Hey guys, I was recently hammered by someone making a ton of requests for a non-existent subdomain of a domain that I host. The requests were coming in from forged ips, and presumably being used to flood other people. Because DNS is udp based, and the sender of the queries honestly didn't care about getting a response back, traditional firewalls were useless. I imagine a sniffing firewall that can look at the packet payloads would have been more useful, but I was wondering if anyone knew a way to better mitigate this type of attack. I posted on comp.protocols.dns.bind, didn't get back anything of use. I posted on webhostingtalk, and got a pointer at the "securing bind" paper (which neither addresses the situation, nor includes anything to prevent it). What I was basically asking for was a "silently drop queries for X-domain" option. But one doesn't exist in bind. I know it's a little off-topic, but I'd appreciate any pointers. -Dan Mahoney -- "...Somebody fed you sugar. Shit!" --Tracy, after noticing Gatorade on my desk. Ezzi Computers, October 18th 2003 Approx 11PM --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---------------------------

3 3

Re: OT - 3 Free Gmail invites
by Robert Bonomi 19 Aug '04

19 Aug '04

> From owner-nanog(a)merit.edu Thu Aug 19 12:43:05 2004 > Date: Thu, 19 Aug 2004 10:39:43 -0700 > From: Lou Katz <lou(a)metron.com> > To: nanog(a)nanog.org > Subject: Re: OT - 3 Free Gmail invites > > > On Wed, Aug 18, 2004 at 10:13:29PM -0700, Jonathan Nichols wrote: > > > > Joshua Brady wrote: > > > > >I've got 2 Gmail invites up for grabs for the first 2 to email me offlist. > > > > > > > You know, I'm having trouble finding people that *don't* have gmail.com > > accounts already. :P > > Because G-mail scans INCOMING mail without the sender's consent, we will NEVER > have a G-mail account and have considered blocking them. Are you seriously considering blocking _everybody's_ mail? In today's world practically *everybody* scans incoming mail. Spam, viruses, scams, bogus bounce messages, etc., etc., ad nauseum. > have a G-mail account and have considered blocking them. We actively discourage > our clients from using this service. Do you similarly discourage the use of ATT WorldNet, MSN, Yahoo, Earthlink, Hotmail, AOL, Earthlink, Panix, Flashnet, Netscape.net, RCN, Corecomm, Comcast, Cogent, RoadRunner, Cox, Adelphia, etc. ? *EVERY*ONE* of those providers also scans all INCOMING mail. *Without* the sender's consent. Do you do any anti-spam and/or anti-virus scanning of *your* incoming mail? Why does it seem like the description 'two-faced' applies to your attitude? > If you want to let a service scan YOUR mail, > it is your perogative, but you cannot give them permission to scan MY mail to you. > And, just BTW, legally, _yes_ I *can* give a third-party permission to scan any/all of my incoming mail, including yours. And you, the sender, do =not= have anything to say about the matter. LEGAL FACT: I can hire _anybody_ to read my mail, on my behalf, 'annotate' it for me, and provide me with the 'marked up' copy, *without* violating any of your 'intellectual property rights' (e.g., "copyright"). You have absolutely no say in the matter, whatsoever. And it doesn't matter whether the 'mail' in question is postal mail, or 'e-mail'. The law is _exactly_ the same. *ANYTHING* that _I_ can legally do with/to my incoming mail, I can hire an 'agent' (someone acting 'at my direction', and 'on my behalf') to do. Now, if that person I hired were to give copies of my incoming mail to _someone_else_ (other than myself), *then*and*only*then* would you have a cause for action against "someone". If that person distributed those copies _at_my_direction_, they would be immune; your 'cause for action' would be against _me_. OTOH, if they did it *without* my permission, then and =only= then, would you have cause for action against _them_. Of course, if _I_ were to do that self-same thing -- give copies of incoming mail to 'someone else', then *I* would be liable to the sender for those acts.

2 1

RE: "scanning" e-mail [WAS: 3 Free Gmail invites]
by Joe Johnson 19 Aug '04

19 Aug '04

Plus, didn't the courts rule that an ISP can read their customer's emails? The wire-tap laws say you can't read communications in-transit, but once it hits the server's NIC, it is no longer in transit. May be sleazy, but it is legal. Joe Johnson > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > Patrick W Gilmore > Sent: Thursday, August 19, 2004 12:56 PM > To: nanog(a)nanog.org > Cc: Patrick W Gilmore > Subject: "scanning" e-mail [WAS: 3 Free Gmail invites] > > > On Aug 19, 2004, at 1:39 PM, Lou Katz wrote: > > > On Wed, Aug 18, 2004 at 10:13:29PM -0700, Jonathan Nichols wrote: > >> > >> Joshua Brady wrote: > >> > >>> I've got 2 Gmail invites up for grabs for the first 2 to email me > >>> offlist. > >>> > >> > >> You know, I'm having trouble finding people that *don't* have > >> gmail.com > >> accounts already. :P > > > > Because G-mail scans INCOMING mail without the sender's consent, we > > will NEVER > > have a G-mail account and have considered blocking them. We actively > > discourage > > our clients from using this service. If you want to let a service scan > > YOUR mail, > > it is your perogative, but you cannot give them permission to scan MY > > mail to you. > > I believe your last statement is factually incorrect. I absolutely > _can_ do anything I please with "your" e-mail you send to me. Not only > that, I also believe I _may_ do it. You send me e-mail, the e-mail is > now mine. I can post it publicly, put it into a search engine, or > deleted it, and you have no say in the matter. Might not be polite, > but it certainly it not illegal. Don't like it, don't send me e-mail. > (Please. :) > > Google is simply indexing mail for their users as a service - an > unobtrusive, completely benign service just like virus checking or > procmail scripts which have been used for years. And it certainly does > not require the consent of the sender. How I manage my mailbox is MY > business. You have exactly zero say over whether I let Google do it or > Mail.app. > > Perhaps you are worried that Google will read your e-mail? Or maybe > let others read it? Well, I hope you never send e-mail to anyone who > does not run their own dedicated mail server on their own dedicated > hardware and encrypt the SMTP session. 'Cause you are worried about > something that has been happening for decades. (Plus I think you have > to be more than a little arrogant to think anyone at Google gives a > fart about the e-mail you send.) > > But hey, it's your e-mail, send it or not as you please. I like the > idea behind G-mail, I just can't deal with a web-based e-mail client. > You don't, then don't use it. > > Just please don't spout factual fallacies like saying I can't give > someone permission to do things to my inbox. > > -- > TTFn, > patrick >

1 0

Re: OT - 3 Free Gmail invites
by Alon Tirosh 19 Aug '04

19 Aug '04

Ksowa! I leave my desk for 5 minutes and theres like 50 requests. Im out on this account, Ill open my other one and serve the 5 I have on there in a couple minutes. The window is now closed though, sorry.

1 0

Nix on free accounts
by Susan Harris 19 Aug '04

19 Aug '04

Folks, let's abandon the gmail thread, which is not relevant to network operations.

1 0

Re: OT - 3 Free Gmail invites
by John Neiberger 19 Aug '04

19 Aug '04

>Uh, could we _please_ get back to something with operational content, or >nothing at all? > >Anyone have anything concrete on the SHA-0 / MD5 compromise, for instance? >Any operational impact there, that we need to worry about in the near >term? No worries. I don't think your gmail account is susceptible to this vulnerability. :) John --

1 0

Blocked port 25? -- problem discovered, thanks!
by Byron L.Hicks 19 Aug '04

19 Aug '04

Thanks for everyones help and good information. The problem has been discovered and a solution is pending. NMSU peers with UNM, and we provide backup Internet routing for each other. UNM is in the process of adding Time Warner Telecom as a peer, and they are not advertising NMSU's routes correctly. The result is that all customers connected to Time Warner Telecom are using UNM as a transit to get to NMSU. UNM also has a filter on their border router to prevent access to unauthorized SMTP servers, and this affectively blocked the Time Warner Telecom to NMSU mail traffic. I am presently working with the UNM engineers to fix this problem. I didn't see the Time Warner Telecom correlation in my traceroutes, because many of the places were multihomed, and the traffic from NMSU was taking a different ingress into their network. It would seem that my byronhicks(a)byronhicks.com email is broken, too. It would appear that I let my domain expire, and the email address I have on record with Network Solutions is not longer valid. bleah.. Too early in the morning to have to deal with this stuff. Thanks again to all the NANOG members that helped me quickly diagnose this problem. -- Byron L. Hicks Network Engineer NMSU ICT

1 0