- Test - lists.nanog.org

RE: sorbs.net
by Hannigan, Martin 16 Mar '05

16 Mar '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Robert Bonomi > Sent: Tuesday, March 15, 2005 2:11 PM > To: nanog(a)merit.edu > Subject: Re: sorbs.net > > > > > From owner-nanog(a)merit.edu Tue Mar 15 12:53:30 2005 > > Date: Tue, 15 Mar 2005 10:53:22 -0800 > > From: Micah McNelly <micah(a)style.net> > > Subject: Re: sorbs.net > > > > > > Actually I got a response quickly from a list member who > represent sorbs > > at some level. Do you really think opinion has a place in mail > > delivery? > > *MY* opinion on that matter doesn't count for sh*t. > > Neither does yours. > > The _only_ opinion that matters is that of the *owner* of the > destination > mail-server. As in "My server, *my* rules." ObOps: Blocking by SP ip addr + asking for user cash = operational problem for SP -M<

3 3

Re: sorbs.net
by Robert Bonomi 15 Mar '05

15 Mar '05

> From owner-nanog(a)merit.edu Tue Mar 15 14:28:29 2005 > To: Robert Bonomi <bonomi(a)mail.r-bonomi.com> > Cc: nanog(a)merit.edu > Subject: Re: sorbs.net > From: Valdis.Kletnieks(a)vt.edu > Date: Tue, 15 Mar 2005 15:28:17 -0500 > > > On Tue, 15 Mar 2005 13:42:24 CST, Robert Bonomi said: > > > As with any other 'voluntary use' blocklist, it's "clout" is only as good > > as the number of people using it. If serious questions arose as to the > > 'integrity' of the list, or the list operator, the vast majority of the > > mail-server operators using it would *stop* doing so. And any lack of > > integrity would be a moot issue, since 'practically nobody' would still > > be using it. It is _textbook_perfect_ "self regulation" at work. > > This is, of course, making the rather big assumption that the person who > decided to use said blocklist: > > a) was fully cognizant of the list's goals and policies when they chose to use it. nope. > *and* > b) is willing and able to track deviations on an ongoing basis. Yup. That _is_ an implicit part of *any* filtering/blocking job -- and many other tasks as well. That you _check_ on an ongoing basis, to make sure that the automation *is* doing what you "think" it is doing. > *and* > c) whoever replaces them is also able to do so. If they aren't competent to do the job, they shouldn't *have* the job. If management doesn't know what all the job requirements are, that is managements failing, and they _deserve_ the consequences thereof. <wry grin> > If it was in fact "textbook perfect", we'd never hear about stuff breaking > when a block list goes belly up with six month's warning, and people *still* > being surprised when suddenly everything returns 127.0.0.2 and a lot of mail > goes kaboing. Beg to differ. "textbook perfect" self-regulation means that when the list starts returning excessive numbers of false positives, that 'practically everybody' _stops_using_it_. And in fairly short order. Which is, in fact, precisely what DID happen. The list operator was relying on the effectiveness of said "self regulation" mechanism to "get the word out" to those who had _not_ heard about the shutdown from other sources.

5 4

"Bernie Ebbers Guilty"
by Paul Vixie 15 Mar '05

15 Mar '05

NEW YORK - Bernard Ebbers, the former chief executive of WorldCom and perhaps the most powerful American businessman ever to face a criminal trial, was found guilty today of securities fraud, conspiracy and filing false documents with regulators. ... http://www.forbes.com/home/management/2005/03/15/cx_da_0315ebbersguilty.html

2 1

Would You Trust "Secure Enterprise Instant Messaging" From a Spam Source?
by Jon R. Kibler 15 Mar '05

15 Mar '05

Greetings all, Would you trust a "Secure Enterprise Instant Messaging" product that advertises via spam? We just received the following email advertising "safe" IM software. It was sent to a spambait email address that was clearly harvested from a newsgroup or other Internet posting. > From: "Omnipod" <reply-1472(a)elabs3.com> > Subject: Secure Enterprise Instant Messaging > To: (spambait email address deleted) > > Consumer Instant Messaging (IM) is not safe for business users: > > March 2005: The MSN Kelvir worm and its Trojan horse counterpart are just the latest viruses aimed at exploiting the vulnerabilities of consumer IM systems. > > February 2005: The Bropia worm was discovered propagating across users of the MSN Messenger network and acting as a carrier for an additional, more dangerous > worm called Agabot. > > February 2005: The Agabot worm performed a distributed denial-of service attack, similar to the notoriously destructive Slammer, Blaster and Sasser worms. > > New prevention solutions are needed as virus writers become more creative in their goal of wreaking havoc through soft spots in Microsoft software. Omnipod's private IM > network prevents these security problems by prohibiting the transfer of executable text (and denying file transfers with consumer IM) while combining strict administrative > controls with 168-bit encryption and 3DES SSL. Simply put, Omnipod protects users from hackers as well as from the common viruses and worms that routinely infect > consumer IM networks. > > Try Omnipod risk free at http://www.omnipod.com <SNIP!> Anyone ever heard of this outfit? Is this a legitimate product, or is it some kind of Trojan? The company that owns the domain elabs3.com (uptilt.com) claims to be a CRM organization, yet they advertise an email marketing capability. Anyone know anything about this organization? If this is a legit product, you REALLY have to wonder why in the world they would advertise via SPAM! Jon Kibler -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.

1 0

Delegating /24's from a /19
by Mike Sawicki 15 Mar '05

15 Mar '05

Our organization has a /19 assignment from ARIN. We have given portions of this space to several other companies within our corporate umbrella. Several of these other companies have their own nameservers, and would like to be able to manage DNS on their own for their in-addr.arpa. blocks. What would be the best way to delegate authoritiy for them? ARIN is pointing to our 2 nameservers for the entire /19. Do I need to use some sort of RFC2317 method here, or would I be able to just install zones for each /24 with NS records pointing to the other companies' servers? Also, what are some good ways to test and verify that this is all working? Any pointers would be appreciated. Thanks. -- -- Mike Sawicki (fifi(a)HAX.ORG)

5 4

Re: sorbs.net
by Robert Bonomi 15 Mar '05

15 Mar '05

> From owner-nanog(a)merit.edu Tue Mar 15 13:21:45 2005 > From: Randy Bush <randy(a)psg.com> > Date: Tue, 15 Mar 2005 11:21:35 -0800 > To: nanog(a)merit.edu > Subject: Re: sorbs.net > > > a few questions > > o could this be used as a dos and then become extortion? > has this actually happened, or is it just black heli? _Legally_, it is *not* extortion, unless the thing that is 'taken' (*with* the 'under duress' consent of the victim) goes, directly or indirectly, to the party making the 'threat'. Noting also, that the legal definition of extortion requires a the property, goods or services be given up in response to a "threat" to do something if that property, goods or services are *not* turned over to the threatener; Thus, a situation where somebody does *not* act unless something is recieved, cannot be, legally, extortion. SORBS has been running for "much longer" than a year. To the best of my knowledge, strictly within their published guidlines. As with any other 'voluntary use' blocklist, it's "clout" is only as good as the number of people using it. If serious questions arose as to the 'integrity' of the list, or the list operator, the vast majority of the mail-server operators using it would *stop* doing so. And any lack of integrity would be a moot issue, since 'practically nobody' would still be using it. It is _textbook_perfect_ "self regulation" at work. > o the ts&cs would seem to indicate that the donation is > voluntary, and proportional to the spam generated. e.g., > if you generated no spam, no donation. do i understand > this correctly? As I understand it -- and I'm -not- an expert on SORBS -- they list individual IP addresses on various lists, for various different kinds of problems. Far and away,the biggest being originating spam. Listings _do_ "age off", taking an unknown period of time after 'someone' makes a request for removal. The donation is purely voluntary, and when provided, the SORBS operator does 'expidate' handling of the removal request. For some strange reason he believe that those people are 'more serious' about ensuring that problems don't occur from their machines again. I have no opinion as to the validity of that reasoning.

2 1

Traceroute to 207.65.163.1
by Ejay Hire 15 Mar '05

15 Mar '05

Hi all. I have an outside-in reachability problem I can't nail down. If you have a second, can you email me a traceroute to 207.65.163.1? Especially if you transit AS1239. Thanks to all, Ejay Hire Ejay.hire(a)isdn.net

2 2

Re: Traceroute to 207.65.163.1
by Luke Parrish 15 Mar '05

15 Mar '05

You can run these on your own at traceroute.org or telnet to route-server.cerf.net C:\>tracert 207.65.163.1 Tracing route to host1-163-65-207.aimhealth.com [207.65.163.1] over a maximum of 30 hops: 1 <10 ms <10 ms <10 ms my network 2 <10 ms <10 ms <10 ms my network 3 <10 ms <10 ms <10 ms my network 4 <10 ms 15 ms <10ms my network 5 16 ms <10 ms 15 ms so0-0-0-2488m.ar1.dal2.gblx.net [67.17.73.30] 6 <10 ms 15 ms <10 ms 208.51.134.18 7 <10 ms 15 ms <10 ms 0.so-1-3-0.XL1.DFW9.ALTER.NET [152.63.99.210] 8 16 ms 15 ms 16 ms 0.so-0-0-0.TL1.DFW9.ALTER.NET [152.63.0.193] 9 16 ms 31 ms 31 ms 0.so-0-0-0.TL1.ATL1.ALTER.NET [152.63.101.57] 10 16 ms 31 ms 31 ms 0.so-1-3-0.XL1.ATL1.ALTER.NET [152.63.87.29] 11 15 ms 32 ms 31 ms 0.so-7-0-0.XR1.ATL1.ALTER.NET [152.63.86.86] 12 15 ms 31 ms 32 ms 195.ATM7-0.GW3.ATL1.ALTER.NET [152.63.83.101] 13 47 ms 47 ms 47 ms bna-cr1b-s1-0.nrep.net [157.130.69.254] 14 32 ms 31 ms 31 ms nreprtr01.isdn.net [207.65.70.97] 15 31 ms 47 ms 31 ms nreprtr03.isdn.net [207.65.70.102] 16 47 ms 31 ms 32 ms host1-163-65-207.aimhealth.com [207.65.163.1] Trace complete. C:\> At 11:26 AM 3/15/2005, Ejay Hire wrote: >Hi all. > >I have an outside-in reachability problem I can't nail down. If you >have a second, can you email me a traceroute to 207.65.163.1? >Especially if you transit AS1239. > >Thanks to all, >Ejay Hire >Ejay.hire(a)isdn.net Luke Parrish Centurytel Internet Operations 318-330-6661

2 1

sorbs.net
by Micah McNelly 15 Mar '05

15 Mar '05

Nanog, Anyone on the list involved with this project? I need to speak to someone ASAP. No, I am not going to pay your ridiculous fine. -- /m "I bet the human brain is a kludge." - Marvin Minsky

1 0

NANOG 33 (Las Vegas) Meeting Information
by Carol Wadsworth 15 Mar '05

15 Mar '05

Registration is now open for the NANOG 33 meeting, January 30-February 1, 2005 in Las Vegas, Nevada. The meeting will be hosted by UltraDNS and will be held at The Rio. Please see www.nanog.org for additional meeting information. See you there!

1 1