- Test - lists.nanog.org

Re: Stealth Blocking
by dlr＠bungi.com 24 May '01

24 May '01

[In the message entitled "Re: Stealth Blocking" on May 24, 14:05, Mitch Halmu writes:] > > On Thu, 24 May 2001, Dave Rand wrote: > > > The MAPS RSS(sm) is a list of open relays *which have been abused*. These > > are sites which have been reported to MAPS as open relays, and have spam > > samples. Once the spam has been verified, a test is performed to verify > > that the site is, indeed, an open relay. If a sample message is accepted, > > and then returned by the site as a relay, the host is listed. Removal from > > the RSS requires that the host no longer relays. Automated probes are never > > done - a human must request the test, and spam must be available. Because > > of the very large number of hosts listed (around 100,000 as I write this), > > it's generally used in DNS mode only. It's pretty easy to get a host which > > is an open relay that has transmitted spam onto the list. Between 100 and > > 1,500 hosts per day are added, and hundreds per day are taken off (as soon > > as they let MAPS know that the relay has been closed). > > Very interesting statistics. It gives you a clear picture of the magnitude > of the squeeze. Now I understand why such heavy hammer was needed at the > helm full-time. Supposing that 100,000 server owners plus those forcibly > 're-educated' get together and do something about it, like scream, or jump > of a 12 inch stool, or donate $10 each, would they be able to shake Dave > off his high horse? How about if they also rally their users that were > suddenly cut off? The vast majority of the open relays that are left are on systems that are unmanned. Another is on systems that "aren't running a mail server" (the classic case is "that is my DNS server, not my mail server! Why is it on the RSS?" - of course, they didn't realize that they had, in fact, left the mail server enabled). No need to shake me off a horse - just close the open mail server. It's a few minutes of work, in most cases, and a few hours in some. Yes, there are some "hard cases" that take much longer to close for various reasons, but it is 2001, not 1997. There's been plenty of time for people to close their mail servers. And note, again, that these hosts are on the RSS. A BGP feed of the RSS is not practical, so only hosts that choose to run the DNS version of RSS on their mail servers will have their mail affected. > > The collateral damage in blocking 100,000 hosts is simply unacceptable. > Especially because there are only a few hundred die-hard professional > spammers that need to be rooted out, and the problem diminishes, or at > least becomes manageable in another way. As an ISP, I have yet to see > a list of black sheep compiled consisting of individuals, spam companies, > or credit cards used to defraud that should not be subscribed. Banks > share such information, why can't ISPs? It would be wonderful if we could. And I do agree that there are relatively few hard-core spammers. And we are rooting them out, one by one, and forcing them into a smaller, and smaller number of ISPs that still permit anonymous sign-up, or unrestricted port 25 access from their dialup ports. The latest kick is to break into machines, and install spamware on them. That's a great sign that the spammers have well and truely crossed the line into already illegal ground. It can also be argued that the collateral damage from *not* blocking spam is unacceptable. But *no one* is forcing you to use any blocking methods. If you don't want to, don't. If you want to, go ahead. Your wires: your rules. Your equipment: your rules. If you choose not to accept mail from people with two wives, that's your choice to make. If you want to accept traffic only from even-numbered IP addresses, that's also your choice. The RSS simply gives you a method to choose from. "These host have be abused in the past, and we have verified them as still open. The traffic you get from here might be spam.". Some people reject it, some mark it. Others don't. What's the problem? > > No matter how noble the cause, the methods are wrong. In all the debate, > it was perhaps lost that no viable technological solution to roaming, > meaning one that is happily accepted by the end user, exists yet. And > please don't mention SMTP Auth, it's not perfected yet. > Many large ISPs are quite happily using pop-before-smtp, and other secondary authentication schemes. Other ISPs are using various other methods to ensure that only their customers get to relay through their mail server. If you have a better method for ferreting out spam, please let us know. If you think you can find a way to stop known spammers (when court orders, fines, ANI blocking, and the like have failed), I'm all ears. Until a better method comes along, I'll continue to make the RSS available. It's my earnest desire that the count of hosts in the RSS reach zero. It's my earnest desire that the count of hosts in the RBL reach zero. Help achiving this goal, by eliminating spam, is appreciated. --

2 1

Re: Stealth Blocking
by dlr＠bungi.com 24 May '01

24 May '01

[In the message entitled "Re: Stealth Blocking" on May 24, 17:00, Mitch Halmu writes:] > > On Thu, 24 May 2001, Jason Slagle wrote: > > > Along those lines, let me get this straight. You support someone > > compiling a list of spammers that you won't sell to, but you oppose > > someone compiling a list of people that I choose not to accept mail > > from. That is quite interesting, and somewhat hypocritical. > > Not at all. "People" is the key. The list in question is of servers > used by innocent people. The bad people are someone else's clients. > I don't feel that it's hypocritical to refuse service to an individual > that just cheated a fellow ISP, just like a bank will not issue an > unsecured loan or credit card to someone that cheated another bank. Until you have to fill out the same amount of paperwork (and have the same level of penalties for misrepresentation on that paperwork) to get an account, this can not happen. And it will _never_ happen for $20/mo accounts. Too much overhead. There's a huge difference between a $1000 limit credit card, and a $10/mo ISP account, wouldn't you say? --

1 0

Request for a clue!
by Thomas Gainer 24 May '01

24 May '01

I have heard a whisper about a network equipment evaluation standard called FCATS. I have never heard of it (only NEBS) and I can not find any information on it. All my searches turn up information on the Florida standardized tests but nothing regarding technology evaluation and reporting. Does anyone have a hint I can follow to find information, like maybe what the acronym stands for? Thanks, Thomas

5 4

Re: Stealth Blocking
by dlr＠bungi.com 24 May '01

24 May '01

[In the message entitled "Re: Stealth Blocking" on May 24, 15:12, Mitch Halmu writes:] > > On Thu, 24 May 2001, Dave Rand wrote: > > > That's why I think that port 25 blocking is the only way. That, and > > closing open relays, of course. > > No, that is NOT the only way. We presume that the spammer had 8 dial-up > accounts. Who is this professional spammer, and how come he/she/it can > still find a provider? That is the question. Perhaps also who is the > merchant that ordered the promotion? Many of these spammers are using phished accounts, or credit cards. Or they use stored-value cards, if they are even a little bit legit. And, he likely only needed one account, with 8 machines signing into that one account (most ISP's don't have the ability to restrict multiple logins). Dialup providers make it easy to become a customer. This is good, because Mom & Pop can sign up. This is bad, because a spammer willing to lie can open an account with a minimum of information. Most providers are unwilling to make the sign-up proceedure tougher. > > The identity of such individual or company belongs on a black list. > Yet the spammer is able to subscribe again tomorrow, next week, next > year... and nothing happens to them. That is the point where control > should be exercised. > As mentioned earlier, even with court orders against it, spammers still sign up, and send out spam. They do not operate by the same rules, or even care about potential liability. As an analogy to the real world, I was speaking with the head of a 911 call center recently. It used to be that crooks would go to some trouble to conceal their identity. With the recent rise in the use of crank, there is now *no* attempt to hide. They will steal blank cheques, then go to the bank and forge them in front of tellers, regardless of the cameras, and the ability for the teller to identify them. Spammers might not be doing crank, but *they just don't care* if we id them. --

1 0

Re: Scanning (was Re: Stealth Blocking)
by Paul Vixie 24 May '01

24 May '01

jtk(a)titania.net ("Joseph T. Klein") writes: > What is the effect of scanning the whole operational address space > four times a week? If history is to be our guide, then the principle effect will be to inspire 400 imitators, and the secondary effect will be to inspire a lot of people to complain about it, block it, or both.

2 1

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> From: Eric A. Hall [mailto:ehall@ehsco.com] > Sent: Thursday, May 24, 2001 11:03 AM > > > > The negative side effect is that it cripples people who use email > > > as a file transfer protocol. > > > > Which I do, quite extensively. Transit providers shouldn't be doing > > this. > > I agree. Access providers should be, however. That depends on your definition of access provider. I would be livid, were my upstream to do such traffic shaping on my feed. We would also be in court for breach of contract. I buy bandwidth and IP space. I expect to get what I pay for. I don't pay to have my traffic restricted by other than my pipe size.

1 0

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> The negative side effect is that it cripples people who use email as a > file transfer protocol. Which I do, quite extensively. Transit providers shouldn't be doing this.

2 1

RE: Query: What policies do backbone providers use to determine IP ownership
by Richard A. Steenbergen 24 May '01

24 May '01

On Thu, May 24, 2001 at 03:16:17AM -0400, Deepak Jain wrote: > > I have seen dueling routes more often than I'd like to recall. > > No one wants to use space that isn't 100% routable. Assuming A has any > peers, some traffic will go there and dead-end. Any customer in the > block will be unhappy. B will eventually give up. A would be foolish > to assign customers in the block until B has given up. > > If A is a much better connected network than B (since B is acting like > an ass) the process is much more definitive. When in doubt, A's lawyers contacting B usually helps them convince C to stop it. -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

RE: Domain-Policy?
by Roeland Meyer 24 May '01

24 May '01

If you'd been following some of the responses there ... It was an ex-employee making allegations wrt a legal matter, in process, between them and NSI. Rather than leave it with the courts, that ex started spamming the DP list with their version of events. This created a legal problem for NSI. Caught between a rock and a hard place, the DP list got squashed. I would have done the same thing. The first time I saw flip's note, combined with some stuff on the DNSO/GA list, I started building a mail server, on a spare amdK6-233 Linux box, to run under DNSO.NET. Frankly, I could use some help with that effort (Postfix/MailMan/INN). I was not expecting this to happen for at least another week. The DP list was the only impartial list around. Everything else is under ICANN/DNSO control. -- ROELAND M.J. MEYER Managing Director Morgan Hill Software Company, Inc. TEL: +001 925 373 3954 FAX: +001 925 373 9781 http://www.mhsc.com mailto: rmeyer(a)mhsc.com > -----Original Message----- > From: David Howe [mailto:DaveHowe@gmx.co.uk] > Sent: Thursday, May 24, 2001 9:00 AM > To: nanog(a)merit.edu > Subject: Domain-Policy? > > > > Got two emails in reasonably close order (this follows an > argument about > Netsol selectively deleting emails from the DP archive) > > -------------------------------- first > message ------------------------------------------------------------- > Subject: We Are Mad As Hell And Doing Something! > > NOTE: NSI is refusing to post this email message for over 10 > hours. This is > -------------------------------- end of first > message --------------------------- > -------------------------------second > message -------------------------------- > From: Tom Newell <tomn(a)LISTS.NETSOL.COM> > Subject: List deactivation > To: DOMAIN-POLICY(a)LISTS.NETSOL.COM > > This list will be closed effective immediately. When > --Tom > -------------------------------- end of first > message --------------------------- > > > and Domain-Policy is **gone** - gone from the website > (archive and all), > email to the list bounces, resub requests to the majordomo fail. > > any ideas what is going on here (other than the obvious > impression that the > easiest way to stop the argument is to delete the forum)

1 0

RE: Remote Area Satellite Internet Access
by Jeremy Furr 24 May '01

24 May '01

Yep, try www.starband.com Jeremy Furr Network Engineer > -----Original Message----- > From: Dennis Dayman [mailto:dennis@swbell.net] > Sent: Wednesday, May 23, 2001 5:34 PM > To: Nanog > Subject: Remote Area Satellite Internet Access > > Any suggestions as to satellite companies or equipment to use for remote > area Internet access? > > > --------------------------- > Thanks > Dennis Dayman > dennis(a)swbell.net > Voice 972-682-7555 > FAX 972-682-7556 > -------------------------------------------------------------------------- > ---- > What goes up, must come down. Ask any system administrator. > -------------------------------------------------------------------------- > ---- > > >

2 1