- Test - lists.nanog.org

Re: SORBS Insanity
by Matthew Sullivan 15 Apr '04

15 Apr '04

Jeremy Kister wrote: >Hi Matthew, > >I highly appreciate your time in replying to my emails. I further >appreciate you removing 64.115.0.0/16 from the sorbs duhl. > >One of my partners in crime sent the first email (via web-form) to sorbs on >April 6th. On april 10th, I repeated. both were addressed from >abuse(a)broadviewnet.net. I havent received anything further about these. > Most of the time we investigate them first - if the contact is from the RIR PoC we contact them immediately (as soon as we get to the ticket of course) >On april 11th i helped a friend who is using 64.115.47.0/24 by filling out >the web-form, addressed from sorbs.net(a)jeremykister.com. i received >sorbs.net # 5799 on this. but again, this was only for that /24. > That's the one that I saw. >on april 13th at about 7pm, i sent the following email to duhl(a)sorbs.net >from jkister(a)broadviewnet.net > Ok didn't see this one - but it depends on the subject - I searched on the IP in the subject in this case. >>true dynamic ranges out of the 64.115.0.0/16 are: >> >> <snip> Got them and fixed up the DUHL. >>to prevent further hysteria, dns now shows >>"static-64-115-x-x.isp.broadviewnet.net". it would have been quite >>simple to send an email to {abuse,ipadmin,isp-noc}(a)broadviewnet.net >>(as listed in ARIN lookup), call our support line (as listed in ARIN, >>whois, and our web site), or send us a letter (as listed on our web site, >>and whois information) to confirm your unfounded opinions about our >>network. Next time, you should give it a try; you may not receive such >>emotional emails from frustrated Systems Engineers trying to deal with >>worthless projects ran by ignorant half-wits. >> >As you can see I was quite frustrated at the time, and may have been a bit >harsh. At that point i was dealing with the problem for 10 days -- and saw >no end in sight. > End is awlways in sight, unfortunately not fast enough for some people - there is always the option of mailing me direct - the problem is (as always) I am probably the most busiest person at SORBS and have the least time to deal with tickets - the last 48-72 hours have have left me with time to answer 3 tickets. All done now, I'll fix up the ticket closures when I get a chance. Yours Mat

1 0

Gambling on power: Learning lessons
by Sean Donelan 15 Apr '04

15 Apr '04

The power at the Bellagio failed for about three days. The failure involved about 1,000 feet of internal primary power cable. Although the Bellagio had emergency and backup power, because it was an internal cable, the backup generators couldn't supply power either. The Las Vegas Sun has one of the best general media coverage I've seen of a technical issue involving power failures. Some data centers and colo facilities would be vulnerable to the same type of problem. Its difficult and expensive to protect against everything in a single location. Geographic diversity is almost always and advantage. http://www.lasvegassun.com/sunbin/stories/gaming/2004/apr/15/516694304.html The power outage that shut down the Bellagio and caused the evacuation of thousands of employees and customers could happen at any resort on the Las Vegas Strip and at any time, Clark County's top building inspector said Wednesday.

1 0

Lazy network operators
by Chris Boyd 15 Apr '04

15 Apr '04

NTL World no longer accepts abuse@ email. You have to go to a web form that requires javascript be enabled and enter all of the information for them. I guess that they got tired of processing the the abuse@ mail load and just bit bucketed it. From the email I got back from them: Please note that we no longer accept any network abuse reports at this address. Any reports must be submitted by using the following web form: http://www.ntlworld.com/netreport Any reports sent to this email address will not be read and will be automatically deleted. -- Will do networking for PowerMac G5 dual 2GHz. Outlook, the exploding Pinto on the information superhighway. - Sean Donelan Chris Boyd

27 50

Re: Lazy network operators
by Miquel van Smoorenburg 15 Apr '04

15 Apr '04

In article <cistron.407CDBCC.60004(a)he.iki.fi>, Petri Helenius <pete(a)he.iki.fi> wrote: > >Paul Vixie wrote: > >>that's somewhat the opposite of empowerment. if a "spam solution" can >>take away that crisis and the expense is that my dsl-connected end host >>has to tunnel its e-mail to someplace out in <www.vix.com/personalcolo> >>then that's a tradeoff i can live with. >> >> >> >You, sure, how about the people who are not really computer literate and >use SMTP AUTH to send their mail from various places? Remember that >convinience almost always outweighs security with the general >population. If it wouldnŽt, the ICT market would not look like it looks >today. That was solved 6 years ago. You let them use port 587 instead of 25. http://www.faqs.org/rfcs/rfc2476.html Mike.

8 9

Re: Lazy network operators
by Stewart, William C (Bill), RTSLS 15 Apr '04

15 Apr '04

As far as your own incoming mail is concerned, you get the same results by either requiring almost every ISP in the world to block outgoing SMTP from almost all of their users, or by using a blocking list that blocks the same users. The blocking list approach preserves the end-to-end behavior of the Internet, and lets the end users decide whose opinions to follow about which Internet users are first-class citizens vs. second-class citizens. Of course, I was planning to write that comparison before the recent complaints about how bad a job SORBS is doing on deciding who to block. :-) But it's still equivalent. If an ISP wants to be "responsible" about preventing untrustworthy users from sending SMTP that bothers people, they can contribute to blocking lists rather than dropping the users' packets, and the blocking lists can provide some convenient mechanism for the ISPs to update them. Where the two approaches diverge is that the recipient-based approaches can also support whitelists, either individually run or shared exception systems such as Habeas or bonded sender things, while the ISP-blocking approach isn't something you can easily override, except by doing tunneling or other protocol-heavy workarounds. Bill Stewart, bill.stewart(a)pobox.com

2 1

SORBS Insanity
by Jeremy Kister 15 Apr '04

15 Apr '04

I became aware that just about all of 64.115.0.0/16, a network that I (among others) run, has been listed as "dynamic ip space" in sorbs as of April 2nd. On April 6th I sent my first email (via web-form) to sorbs telling them they were mistaken. Finding no documentation on how they deem networks "dynamic" or "static" I changed my rDNS scheme from ppp-64-115-x-x to 64-115-x-x Note to all: "ppp" in no way signifies dial-up; we run ppp over almost every circuit we have -- from dialup to OC12, to Ethernet and ATM. I also stated how all of our network was scanned twice a day for open-relay mail servers. Being a bigish ISP, we are _huge_ on our abuse policies, and our abuse bucket [usually] has only memories of tumbleweed blowing by. On april 10th I again wrote, only to be ignored further. Yesterday, April 13th, One of my customers opened a trouble ticket stating that he had successfully received a response from SORBS, and had forwarded me the conversation. I sent an email to duhl(a)sorbs.net (the author of the email) quoting what they had written one of my customers. They said to my customer that I had to either provide custom reverse DNS for each customer who was not dynamic, or I had to provide sorbs with POCs for all my non-dynamic customers. I stated how this was absurd, and that there was already a functioning medium for this task -- rwhois. In this same email, I also stated: 1. exactly which 64.115 networks were dynamic 2. that to prevent further hysteria, I had changed the reverse dns from ppp-64-115-x-x to static-64-115-x-x and dynamic-64-115-x-x, respectively. 3. their blindness was very unprofessional, deeming SORBS a Worthless Project ran by Ignorant Half-Wits As of this date I have not received a response from anyone at sorbs, and do not expect one. Our support crew is overwhelmed with upset customers who cant send email to their associates. Our only response to them is that we have tried to resolve the issue, but could not, and that the remote ISP should stop using sorbs. I am upset that they blindly blacklisted most of 64.115.0.0/16 because some of the reverse dns was generic. 64.115.47.0/25, for example, hasnt very much generic rDNS at all, but was blacklisted just the same. I hope all stop using SORBS. I especially hope Mr. Vixie reconsiders his helpfulness to such a harmful organization. For google: <a href="http://www.sorbs.net">A Worthless Project</a> Jeremy Kister www.jeremykister.com/jeremy/ Argus: The World's Most Advanced Monitoring Software: http://argus.tcp4me.com

5 7

RE: Lazy network operators
by Michel Py 15 Apr '04

15 Apr '04

> Paul Vixie wrote: > (dunno if you heard, but in spite of 128 bits of address space, > the enterprise user community is now asking for IPv6 NAT.) Not exactly, as most enterprise operators avoid NAT like the plague when they have a choice. Address scarcity has never been an operational problem in the enterprise and in fact, what the enterprise user community is asking for is not NAT but what NAT provides which is mostly two things: a) portable and stable address space and b) scoped addresses. Since they can't get either one with IPv6 they fall back to the next best thing which is NAT, despite its loads of problems. If they ever deploy IPv6, that is. Michel.

1 0

Packet anonymity is the problem?
by Sean Donelan 15 Apr '04

15 Apr '04

If you connect a dialup modem to the public switched telephone network, do you rely on Caller ID for security? Or do you configure passwords on the systems to prevent wardialers with blocked CLIDs from accessing your system? Have a generation of firewalls and security practices distracted us from the fundamental problem, insecure systems. http://www.ecommercetimes.com/perl/story/security/33344.html Gartner research vice president Richard Stiennon confirmed that packet anonymity is a serious issue for Internet security. [...] "Because of the way TCP/IP works, it's an open network," Keromytis said. "Other network technologies don't have that problem. They have other issues, but only IP is subject to this difficulty with abuse." [...] Bellovin compared the situation to bank robberies. "[S]treets, highways and getaway cars don't cause bank robberies, nor will redesigning them solve the problem. The flaws are in the banks," he said. Similarly, most security problems are due to buggy code, and changing the network will not affect that.

14 19

Anyone from AT&T here? (AT&T bogus DNSBL answers)
by Steve Linford 14 Apr '04

14 Apr '04

AT&T customers have contacted us saying they can't reach any of our DNSBLs, seems AT&T have defined a fake sbl.spamhaus.org zone in their DNS servers so when AT&T customers ask AT&T's NS 12.149.189.2 for sbl.spamhaus.org they get: ;; ANSWERS: sbl.spamhaus.org 86400 IN SOA loopback root.loopback ( 1 ; serial 3600 ; refresh 600 ; retry 3600000 ; expire 86400) ; minimum ;; AUTHORITY RECORDS: sbl.spamhaus.org 86400 IN NS loopback ;; ADDITIONAL RECORDS: loopback 61703 IN A 127.0.0.1 And it's not just affecting our users... blackholes.mail-abuse.org 86400 IN SOA loopback root.loopback blackholes.mail-abuse.org 86400 IN NS loopback loopback 61520 IN A 127.0.0.1 cbl.abuseat.org 86400 IN SOA loopback root.loopback cbl.abuseat.org 86400 IN NS loopback loopback 61480 IN A 127.0.0.1 list.dsbl.org 86400 IN SOA loopback root.loopback list.dsbl.org 86400 IN NS loopback loopback 60855 IN A 127.0.0.1 -- Steve Linford The Spamhaus Project http://www.spamhaus.org

2 1

who not ARIN for route registry?
by Jeff Behl 14 Apr '04

14 Apr '04

Anyone good reason why a major ISP would not accept/mirror ARIN as a route registry? They do mirror others (altdb arcstar bell cw enterzone gt level3 radb rgnet ripe sinet), just not ARIN...

1 0