February 2010 - Test - lists.nanog.org

RE: Spamhaus
by Joel M Snyder 21 Feb '10

21 Feb '10

On Sat, Feb 20, 2010 at 7:25 PM, Jon Lewis <jlewis(a)lewis.org> wrote: > > IMO, the original question in this thread was on-topic, but unfortunately it > > got very little discussion >I like spamhaus, they run a quality list, but they want between $1900 >and $19000 per year for their rsync service and you have to tell them >how many email customers you're supporting in order to pay less than >the max. That would be an acceptable price to pay for antispam efforts >overall, but I couldn't afford to pay that for *each* of the dozens of >services spamassassin consults while analyzing a message. I wonder if the pricing you've got is old. I just did a test of a product and got pricing of $420/year for 600 users when I queried them. Essentially, less than $1/user/user. I understand that you are querying dozens of services with SpamAssassin, but I can guarantee you're not getting value for all that traffic you're generating. In our research, we've found very little value to stacking reputation services. And even stacking content filters can cause more problems than it solves if you don't pick them VERY carefully. Just as an example, last month one of the content filters (think of it as an anti-spam product like SpamAssassin, but NOT including any reputation component) I tested ran with approximately an 81% catch rate. Add in a single reputation filter, and that jumps up to 92.36%. Add in three reputation filters, and the new rate is 92.99%. Add in every single reputation filter I'm testing (that was 32 of them last month) and the rate barely jumped to 93.02%---but the false positive count jumped by 112 messages per 10,000 (because APEWS was somehow having a lousy month). In general, the more reputation services you include, the more likely it is you're going to have false positives. jms -- Joel M Snyder, 1404 East Lind Road, Tucson, AZ, 85719 Senior Partner, Opus One Phone: +1 520 324 0494 jms(a)Opus1.COM http://www.opus1.com/jms

2 1

Call for papers: ISP-10, Orlando, USA, July 2010
by James Heralds 21 Feb '10

21 Feb '10

It would be highly appreciated if you could share this announcement with your colleagues, students and individuals whose research is in information security, cryptography, privacy, and related areas. Call for papers: ISP-10, Orlando, USA, July 2010 The 2010 International Conference on Information Security and Privacy (ISP-10) (website: http://www.PromoteResearch.org<http://www.promoteresearch.org/>) will be held during 12-14 of July 2010 in Orlando, FL, USA. ISP is an important event in the areas of information security, privacy, cryptography and related topics. The conference will be held at the same time and location where several other major international conferences will be taking place. The conference will be held as part of 2010 multi-conference (MULTICONF-10). MULTICONF-10 will be held during July 12-14, 2010 in Orlando, Florida, USA. The primary goal of MULTICONF is to promote research and developmental activities in computer science, information technology, control engineering, and related fields. Another goal is to promote the dissemination of research to a multidisciplinary audience and to facilitate communication among researchers, developers, practitioners in different fields. The following conferences are planned to be organized as part of MULTICONF-10. • International Conference on Artificial Intelligence and Pattern Recognition (AIPR-10) • International Conference on Automation, Robotics and Control Systems (ARCS-10) • International Conference on Bioinformatics, Computational Biology, Genomics and Chemoinformatics (BCBGC-10) • International Conference on Computer Communications and Networks (CCN-10) • International Conference on Enterprise Information Systems and Web Technologies (EISWT-10) • International Conference on High Performance Computing Systems (HPCS-10) • International Conference on Information Security and Privacy (ISP-10) • International Conference on Image and Video Processing and Computer Vision (IVPCV-10) • International Conference on Software Engineering Theory and Practice (SETP-10) • International Conference on Theoretical and Mathematical Foundations of Computer Science (TMFCS-10) MULTICONF-10 will be held at Imperial Swan Hotel and Suites. It is a full-service resort that puts you in the middle of the fun! Located 1/2 block south of the famed International Drive, the hotel is just minutes from great entertainment like Walt Disney World® Resort, Universal Studios and Sea World Orlando. Guests can enjoy free scheduled transportation to these theme parks, as well as spacious accommodations, outdoor pools and on-site dining — all situated on 10 tropically landscaped acres. Here, guests can experience a full-service resort with discount hotel pricing in Orlando. We invite draft paper submissions. Please see the website http://www.PromoteResearch.org <http://www.promoteresearch.org/> for more details. Sincerely James Heralds

2 1

Re: Spamhaus...
by Robert Bonomi 21 Feb '10

21 Feb '10

> From nanog-bounces+bonomi=mail.r-bonomi.com(a)nanog.org Fri Feb 19 22:32:48 2010 > From: William Herrin <bill(a)herrin.us> > Date: Fri, 19 Feb 2010 23:32:10 -0500 > Subject: Re: Spamhaus... > To: Larry Sheldon <LarrySheldon(a)cox.net> > Cc: nanog(a)nanog.org > > On Fri, Feb 19, 2010 at 8:35 PM, Larry Sheldon <LarrySheldon(a)cox.net> wrote: > > On 2/19/2010 7:20 PM, William Herrin wrote: > >> "If an SMTP server has accepted the task of relaying the mail and > >> later finds that the destination is incorrect or that the mail cannot > >> be delivered for some other reason, then it MUST construct an > >> "undeliverable mail" notification message and send it to the > >> originator of the undeliverable mail (as indicated by the > >> reverse-path)." > > > > Does the RFC say what to do if the reverse-path has been > > damaged and now points to somebody who had nothing > > what ever to do with the email? > > Hi Larry, > > Re-reading the paragraph I quoted and you repeated, I'm going to say > that the answer is "yes." > I'll bite. *HOW* do you send to the _originator_ (as *required* by the RFC you quoted) of the undeliverable mail, when the reverse path points to 'someone else'? Note well the exact lanugage used -- it does not say 'the party named in the reverse path', the 'claimed sender', 'putative sender' or any other similar equivocation that justifies sending to a forged address. It says "the originator". To me, that can be only iterpreted in _one_ way. To wit: as the party that _actually_ created and transmitted the message, _regardless_ of what the declared return path is. Since such a message is 'defective' (not RFC-compliant -- because the true point -of-origin is *NOT* in the reverse path, as it MUST be for an RFC-compliant message) on it's face, I will argue that there is no need to apply the 'required' handling for a 'proper' message to it.

9 15

Re: Messages in junk/spam box
by chaim.rieger＠gmail.com 21 Feb '10

21 Feb '10

You should head over to the mail groups and ask this, more on topic there. Sent via BlackBerry from T-Mobile

1 0

"Cyber Shockwave" on CNN
by andrew.wallace 21 Feb '10

21 Feb '10

US carried out "Cyber Shockwave" - an exercise by non-government actors who have close relations to the government past. The results will be aired on CNN this weekend. Intelligence suggests the scenario was not standard and that a crash in the smart phone network was used as a concept of how US National Security *could* be compromised in 2011. CNN had exclusive television access to the national security cyber “war game” scenario. The simulated attack took place on Tuesday and was host by members of The Bipartisan Policy Center and will debut on Saturday, Feb. 20 and Sunday, Feb. 21 at 8pm, 11pm and 2am ET on CNN. I hope the Nanog community can tune in or watch later on catch up services and give feedback on your thoughts. Kind regards, Andrew

11 17

centeralized server management solutions
by Mehmet Akcin 21 Feb '10

21 Feb '10

...so few months ago I was wondering which vendor to pick that has the best global delivery experience and deliver quality product.. after few weeks of research decided to go with Dell. There are few options for centralized management such as pushing images, backing up, restoring/re-installing servers for Dell servers using DRAC cards. KACE which recently was bought by dell is one option, Dell OpenManage seems another option with less options available. What are your thoughts / suggestions on centralized management solutions for Dell servers with DRAC cards?. Few things to keep in mind. Centralized solution and server wont be on the same network , but each will have internet access Drac cards come with Compact Flash cards Bandwidth may not be quite fast and latency might be higher when connecting to the centralized solution. Monitoring can be apart from the server maintenance solution as I already primarily use cacti/nagios/IMapper. appreciate help on this. Mehmet

5 4

CNN LIVE stream?
by andrew.wallace 21 Feb '10

21 Feb '10

I am from the UK and don't know how to watch CNN Cyber Shockwave via an internet live stream. The programme starts 8PM ET, 1AM UK. What do I do? Andrew

4 3

Re: "Cyber Shockwave" on CNN
by charles＠knownelement.com 20 Feb '10

20 Feb '10

Alright can someone moderate this thread and shut it down please? ------Original Message------ From: Tomas L. Byrnes To: andrew.wallace To: Randy Bush Cc: nanog(a)nanog.org Subject: RE: "Cyber Shockwave" on CNN Sent: Feb 20, 2010 7:49 PM Right, because GCHQ doesn't/hasn't/never would do such a thing... At least the US has a written constitution and the concept of the people being sovereign. I'll take that over trusting "Her Majesty's..." whatever. But then again, I'm Irish, so I have a bit more direct personal and familial experience of the darker side of British "civilization". (EG: While detention without trial is relatively NEW in the US, it's been a fact of life in the UK for most of its history). > -----Original Message----- > From: andrew.wallace [mailto:andrew.wallace@rocketmail.com] > Sent: Saturday, February 20, 2010 2:13 PM > To: Randy Bush > Cc: nanog(a)nanog.org > Subject: Re: "Cyber Shockwave" on CNN > > --- On Sat, 20/2/10, Randy Bush <randy(a)psg.com> wrote: > > > From: Randy Bush <randy(a)psg.com> > > Subject: Re: "Cyber Shockwave" on CNN > > To: "andrew.wallace" <andrew.wallace(a)rocketmail.com> > > Cc: nanog(a)nanog.org > > Date: Saturday, 20 February, 2010, 21:58 > > > It looks like this demo is > > > > a bunch of sick press and sick ex-gov wishtheycouldbeagains > > trying to > > get as much mindshare as they can. and you're helping > > them. > > > > randy > > > > I refuse to let you say I am helping them -- I am from UK, I don't > agree with them wanting to allow The NSA to take over private sector > networks or citizens smart phones 'in an emergency'. > > Andrew > > > Sent via BlackBerry from T-Mobile

1 0

Slightly OT. Good IMAP search tool?
by Mike Lyon 20 Feb '10

20 Feb '10

Howdy Folks, What are people using these days to suck down an IMAP account, search it and then export the search results? Any suggestions. Cheers, Mike

7 7

CNN Cyber Shockwave only available in US
by andrew.wallace 20 Feb '10

20 Feb '10

It is not being broadcast world wide... Provide links. Andrew

2 3