March 2005 - Test - lists.nanog.org

Re: IBM to offer service to bounce unwanted e-mail back to the
by Henry Linneweh 23 Mar '05

23 Mar '05

This software is free at http://www.alphaworks.ibm.com/tech/fairuce -henry --- "Anne P. Mitchell, Esq." <amitchell(a)isipp.com> wrote: > > > On Mar 23, 2005, at 12:37 PM, RSK wrote: > > > On Tue, Mar 22, 2005 at 10:24:37AM -0800, Andreas > Ott wrote: > >> > http://money.cnn.com/2005/03/22/technology/ibm_spam/ > > > > If this write-up is accurate, > > It's not. From the http://www.aunty-spam.com > website: > > IBM Not Spamming Spammers! FairUCE is About Fair > Use, Not Abuse! > > Did you hear? IBM is spamming spammers! It�s all > over the Internet, and > tongues are a�wagging! Except, it ain�t so. IBM is > not spamming > spammers. > > > Whether you think that spamming spammers is right > or wrong, IBM ain�t > doing it, and shame on CNN for getting it so wrong, > and making IBM look > so irresponsible, and in league with the likes of > Lycos� �Make Love Not > Spam� DOSsing Screensaver program, and the notorious > Mugu Maurauder > bandwidth sucking program. > > You can�t really blame the folks who read CNN�s > horribly wrong piece > for spreading the rumour, after all it was quite > sensationalist: > > �Spamming spammers? > IBM to offer service to bounce unwanted e-mail back > to the computers > that sent them. > March 22, 2005: 12:22 PM EST > > NEW YORK (CNN/Money) - IBM unveiled a service > Tuesday that sends > unwanted e-mails back to the spammers who sent them. > > The new IBM (Research) service, known as FairUCE, > essentially uses a > giant database to identify computers that are > sending spam. E-mails > coming from a computer on the spam database are sent > directly back to > the computer, not just the e-mail account, that sent > them.� > > Wrong, wrong, wrong. > > About the only thing which the article got right is > that the program is > called �FairUCE". FairUCE, according to IBM�s own > FairUCE website, > readily available for anyone to read (cough�CNN > reporters..cough), is a > �spam filter that stops spam by verifying sender > identity instead of > filtering content". > > Let�s say that again: FairUCE is a spam filter that > stops spam by > verifying sender identity instead of filtering > content. > > If FairUCE can�t verify sender identity, then it > goes into > challenge-response mode, sending a challenge email > to the sender, to > which the sender must reply, to demonstrate that it > is not a spambot > sending the mail in question, but a real live > person. > > Here is IBM�s explanation of how the FairUCE system > works: > > �Technically, FairUCE tries to find a relationship > between the envelope > sender�s domain and the IP address of the client > delivering the mail, > using a series of cached DNS look-ups. For the vast > majority of > legitimate mail, from AOL to mailing lists to vanity > domains, this is a > snap. If such a relationship cannot be found, > FairUCE attempts to find > one by sending a user-customizable > challenge/response. This alone > catches 80% of UCE and very rarely challenges > legitimate mail.� > > Now, being kind, it�s possible that the good folks > at CNN mistook the > sending of the challenge for �spamming the > spammer".... > > (Rest at > http://www.aunty-spam.com/ibm-not-spamming-spammers-fairuce-is-about- > > fair-use-not-abuse/) > > Anne > > > >

1 0

Re: IBM to offer service to bounce unwanted e-mail back to the
by MARLON BORBA 23 Mar '05

23 Mar '05

"Revenge" methods won't work against spam. Spammers may be using "owned" machines belonging to a "botnet". The sysadmins of the infected servers may not even to know that their systems are serving to spammers. So attacking back the spam sources, besides ethical and legal reasons, may be futile and just cause problems to a legitimate company/service provider/etc. The way to fight the problem, IMHO, is to attack the real cause of spam, i.e., to make spam an expensive advertising medium. According to a recent IDG research, one out of ten Internet users buy products from spammers. Spam has a low cost and an high ROI (better than several advertising media). So money flows to the spammers' pockets. Regards, Marlon Borba, CISSP. >>> "Anne P. Mitchell, Esq." <amitchell(a)isipp.com> 03/23/05 5:54 PM >>> On Mar 23, 2005, at 12:37 PM, RSK wrote: > On Tue, Mar 22, 2005 at 10:24:37AM -0800, Andreas Ott wrote: >> http://money.cnn.com/2005/03/22/technology/ibm_spam/ > > If this write-up is accurate, It's not. From the http://www.aunty-spam.com website: IBM Not Spamming Spammers! FairUCE is About Fair Use, Not Abuse! Did you hear? IBM is spamming spammers! It's all over the Internet, and tongues are a'wagging! Except, it ain't so. IBM is not spamming spammers. [...]

1 0

RE: Utah governor signs Net-porn bill
by Kathryn Kessey 23 Mar '05

23 Mar '05

...this bill... requires the attorney general to establish and maintain a database, called the adult content registry, of certain Internet sites containing material harmful to minors... ...$100,000 from the General Fund to the attorney general, for fiscal year 2005-06 only, to establish the adult content registry... They are going to create publicly accessible, highly available database service of the all the world's porn sites and maintain it with up to the minute data... with 100K. Right. Seems like a more rational answer to Utah's pr0n phobia is for a certain religious entity to publish their own net-nanny software/service for their parishioners. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Rachael Treu Sent: Tuesday, March 22, 2005 11:35 AM To: Bill Woodcock Cc: Richard Irving; Roy; Fergie (Paul Ferguson); nanog(a)merit.edu Subject: Re: Utah governor signs Net-porn bill On Tue, Mar 22, 2005 at 09:33:44AM -0800, Bill Woodcock said something to the effect of: > > > > It's also voluntary on the part of the service provider. > > What !?! Surely you Jest! > > Uh, yes, I was joking. Unfortunately, I do believe, on credible evidence, > that there are people stupid enough to be trying to legislate the > operation of the Internet without having first understood how it's done > right now. Case in point. > > -Bill What do you mean?! I'm writing an email right now to my service provider, demanding that I get *only* porn. I want all pr0n, all the time. No need to wast bandwidth on this smtp garbage, or any other http-type hooey, for that matter. I want my OPoIP (only porn over IP)! I want it secured, even! Encrypted porn with an SLA I can wave SLA about if anything else slips through like pesky news or children's pages or something icky. Are you telling me my provider reserves the right to refuse me this service? <sniff> --ra ;) -- k. rachael treu, CISSP rara(a)navigo.com ..quis custodiet ipsos custodes?.. (this email has been brought to you by the letters 'v' and 'i'.)

10 9

RE: 72/8 friendly reminder
by Hannigan, Martin 23 Mar '05

23 Mar '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Christopher L. Morrow > Sent: Wednesday, March 23, 2005 2:12 PM > To: Randy Bush > Cc: nanog(a)merit.edu > Subject: Re: 72/8 friendly reminder > > > > > On Wed, 23 Mar 2005, Randy Bush wrote: > > > > > >> We were recently assigned a 72.244/16 allocation from > ARIN. Friendly > > >> reminder that ARIN started allocating 72/8 since Aug. If > you have a > > >> static bogon filters, can you please make sure they are > updated. Thank > > > if you are really worried about this, and i can understand your > > > being so, then make it easy for the busy folk here (not those > > > pontificating on law and morals in the rocky mountains) to test. > > > give us an address we can ping. > > > > a bit more coffee made me realize that what might best occur would > > be for the rir, some weeks BEFORE assigning from a new block issued > > by the iana, put up a pingable for that space and announce it on > > the lists so we can all test BEFORE someone uses space from that > > block. > > So, it's probably a multifaceted problem: > 1) acls (router) > 2) firewalls (host) > 3) route acceptance (routers) > > Some can be audited 'easily' some are 'set and forget' (or forgot :( ) > > Ping might just be dropped to destinations, before any idea > of 'ip space' > filters (think www.sun.com filters). You really have to test with the > protocols your main user base might be using (http/https). I believe this would have to be an RIR policy, though. ARIN is holding an open mic to present a few blurbs on potential policy at the Orlando meeting. It might be an idea for some operators to hook up at the meeting prior to the open mic and talk more. It's too late to make a proposal for this upcoming meeting, but not the next one. And that's a joint NANOG/ARIN meeting, IIRC. -M<

2 1

Re: Utah governor signs Net-porn bill
by David Barak 23 Mar '05

23 Mar '05

--- Daniel Senie <dts(a)senie.com> wrote: > Anyone want to publish a definitive list of IP > addresses for Utah? A week > of null-routing all such traffic by many web sites > would, I think, would be > a measured response to idiot legislators. It could > be "give Utah the Finger > Day" or some such. Wouldn't you then be guilty of doing the exact thing which the legislature is doing? Besides any discussion regarding collusion or anticompetitive behavior, how does this type of action improve free speech? Personally, I WANT everyone in Utah to get to my content. -David Barak need Geek Rock? Try The Franchise! http://www.listentothefranchise.com __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

2 1

Re: Utah governor signs Net-porn bill
by Daniel Senie 23 Mar '05

23 Mar '05

At 08:41 PM 3/22/2005, Steven J. Sobol wrote: >On Tue, 22 Mar 2005, Owen DeLong wrote: > > > Were I running an ISP of which Utah subscribers were not a large portion > > of my customer base, I would probably seriously consider simply > > disconnecting > > all of my Utah customers. > >Of course, you're making sure none of the web servers under your purview >are reachable from Utah either. Anyone want to publish a definitive list of IP addresses for Utah? A week of null-routing all such traffic by many web sites would, I think, would be a measured response to idiot legislators. It could be "give Utah the Finger Day" or some such.

4 3

Weird Cisco Behavior
by Joel Perez 22 Mar '05

22 Mar '05

Hey Guys, I was wondering if any of you are seeing anything weird going on with any Cisco gear you may have? It started earlier today. I have some AS5850's in remote pop's around the US and all of a sudden they all started to drop packets at the same time. Some of them actually rebooted themselves and when this happened it made several other ones also either reboot themselves or drop packets. None of my other non-cisco gear was affected by this. I dont see any weird activity except some probing going on on port 445. I have a call in to Cisco-Tac but wanted to know if anybody is seeing the same thing. Thanks, Joel Perez ntera.net

1 0

Resolution -> RE: Known communities for AS174?
by David Hubbard 22 Mar '05

22 Mar '05

Talked with Cogent IP Engineering today, was doing my own prepending in the meantime. I received a number of replies on and off list with quite a bit of conflicting info from Cogent doesn't support any communities other than do not announce to they support this or that to references of RIPE and RADb both of whom seem to have some outdated info. It turns out they do support a bunch of communities, including path prepending of one, two and three times which are what I was looking for, and for at least the US market, they're all in the customer user guide which I hadn't received; no I really didn't receive it not just didn't read it. :-) The person I spoke with was going to have someone update RADb with current information as what's there is about eight months old I think. I ended up having to clear the peer session hard but then my community was applied and is functioning as intended. Only thing missing that would be really nice would be something like Level 3 where you can selectively prepend to a specific peer AS of theirs. :-) But they were very responsive as soon as got in touch with the right group. David

1 0

Proofpoint
by just me 22 Mar '05

22 Mar '05

If you are running Proofpoint appliances or software in a relatively high (25k to 30k messages per hour) traffic environment, I would love to hear from you regarding your experiences. I will summarize to the list if there is aany interest; until then, please reply to me directly. thanks much, matt ghali --matt(a)snark.net------------------------------------------<darwin>< The only thing necessary for the triumph of evil is for good men to do nothing. - Edmund Burke

1 0

Re: sorbs.net
by Robert Bonomi 22 Mar '05

22 Mar '05

> From owner-nanog(a)merit.edu Tue Mar 15 12:53:30 2005 > Date: Tue, 15 Mar 2005 10:53:22 -0800 > From: Micah McNelly <micah(a)style.net> > Subject: Re: sorbs.net > > > Actually I got a response quickly from a list member who represent sorbs > at some level. Do you really think opinion has a place in mail > delivery? *MY* opinion on that matter doesn't count for sh*t. Neither does yours. The _only_ opinion that matters is that of the *owner* of the destination mail-server. As in "My server, *my* rules." Quite obviously, the server operator at the place you were trying to mail _to_ *DOES* believe that 'opinion' has a place in e-mail delivery. Like I said, the _first_ place you should take your 'problem' is to *them*. *NOBODY* is 'forced' to use SORBS, or any othe blocklist. The mail-system owners/administrators that *CHOOSE* to do so, have made a voluntary decision to restrict incoming mail to their system on that basis. THEY did it, nobody else.

11 15