- Test - lists.nanog.org

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> From: David Schwartz [mailto:davids@webmaster.com] > Sent: Wednesday, May 23, 2001 5:24 PM > > > > From: David Schwartz [mailto:davids@webmaster.com] > > > Sent: Wednesday, May 23, 2001 4:54 PM > > > > > > > In the PURE war, one ONLY shoots confirmed bad-guys and has ZERO > > > > collateral damage. > > > > > > So if someone has a machine gun and is firing randomly, > > > you don't act to stop him until he happens to hit someone? > > > > Lottsa mitigating circumstances here; > > .Are they shooting spam? > > .Are they trying to hit anyone? > > How can you tell if you don't check? As soon as you > have reason to believe > they're creating a hazzard to innocent people, you are > justified in checking > if they really are. This has been standard Internet practice > since day one. I don't need to check because I have a piece of confirmed spam from them. A smoking gun. That's the way MAPS RBL has been working for years. That is the way I expect it to continue to work. The main reason that I posted to this thread is that some of the posts lead me to believe otherwise. They were confused. > > One spammer is no justification for nuking their entire > city. Targeted > > response, sir ... targeted response. That's what MAPS is, a laser > > beam, not > > a hand granade. > > Absolutely. Probe the machine that is of concern, not > whole blocks randomly. Also, only block the proven spam-host. No one else. > > > That's madness. [I] don't advocate > > > random scanning, as it is unethical to probe random people for > > > vulnerability. However, once you know there is in fact an > > > open relay, you are entirely justified in blocking it. > > > Agreed, but its open-relay status is irrelevent. The fact > that one has > > proof-positive of spam, from that site, is. > > No, its open-relay status is not irrelevant. If you > know a site is an open > relay, however you know this, and you want to block open > relays (which I do) > and it's my right to block open relays, then I will block > them. How I find > out they're an open relay is another story. The usual way is > you probe a > site when it becomes an actual problem. I submit that if you have a piece of spam, from a site, and are blocking them, why do you need to probe them? > So let me ask you three questions: > > 1) If I find out a site is an open relay by legitimate > means, do you agree > that I have the right to block it if I want to? Sure. > 2) If a site sends me spam or otherwise inconveniences > me, do you agree > that I have the right to probe it to see if it's an open > relay if I wish to > do so? sure > 3) Do you think it's unreasonable to block known open > relays as a > protection against future spam. Absolutely not. Our entire Norte Americano culture is biased AGAINST apriori restrictions. You DO NOT spank someone for something that they have NOT, in fact, done. It's called prior restraint and there is a reason that it is considered unjust. It violates the PURE WAR ethos. There is no excuse for collateral damage. Innocents should not be involved, period. This is important because we DO have the technology to wage the PURE WAR and are ethically compelled to use it. > > > And if you have legitimate reason to > > > suspect a site is an open relay, you are entirely justified > > > in probing it to see whether or not it is. > > > No you are not, by your own ethical standards. Suspicion is not > > proof. Only > > a piece of spam, in hand, from that specific site, is > sufficient grounds. > > If you really believe what I think you're saying, then > you would have to > object to, for example, the ident protocol. I think we have [only] a slight disconnect here. ident is part of the protocol. [side note: I'm setting up a new Postfix host (my first Postfix host ... used to doing sendmail). Does Postfix do SMTP AUTH?] > > > If your neighbor is aiming a gun at you, you are > > > justified in checking to see if it's loaded. > > > No you are not, you assume that it is and fire first > <grin>. But, you are > > not justified in taking out his whole block, including the other > > neighbors. > > You are not allowed ANY collateral damage. Anything less is > sloppy anyway. > > What's the matter, ain't you that good? Can't you aim? > > The only collateral damage is that the man's children > lose their father. There's nothing you can do about that. Yes, but with ORBS, they take out the entire town, even if there aren't any spammers there. That's serious collateral damage. It is unacceptable. It is not the PURE WAR. > Similarly, if you block a site that's > a known problem, you inconvenience any legitimate mail > traffic that might have passed through that site. > But that's the kind of collateral damage > that's unavoidable. Not really, since it is the owner of the site that is directly responsible for that site's mail delivery. The atomic unit is the site, not the users of that site. To go effectively below that level of granularity is, IMHO, not technologically feasible. > Unfortunately, you have to make hazardous > misconfigurations inconveniencing or they won't be fixed. There is a major distinction between a spam hazard and a proven spam site.

3 2

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

I'm getting seriously confused here. I thought that the open-relay issue was irelevent to MAPS. That MAPS only black-holed confirmed SPAM sites (a little tougher, but more granular, charter). Further, that it was ORBS that listed open-relay sites specifically, whether they were involved in a spam or not (unacceptable due to punishing potential anti-spammers for proliferating spam that never saw their systems). To me, these are two entirely different charters. If MAPS starts to look like ORBS then I will stop using MAPS. Can someone please clarify? > -----Original Message----- > From: Robert Sharp [mailto:rsharp@appliedtheory.com] > Sent: Wednesday, May 23, 2001 1:04 PM > To: Valdis.Kletnieks(a)vt.edu > Cc: nanog(a)merit.edu > Subject: Re: Stealth Blocking > > > > I would like to make the point that I do run two mail servers > and both a maps approved. > Please don't tell me I don't know how to run a mail server. > Again I am not discussing your > ability , please don't poke fun at me. In fact I had some > trouble with spam on one of them > because someone was signing up a list I use for the owl > networks mailing list. I infact > installed MAPS to see if it helped the problem. It did not > because the user didn't run an > open relay site but rather a no confirmation email list. > Would I be correct to assume they > should be in the MAPS list too? As you can see sometime > spam/annoying emails is not always > sent throught an open relay but sometimes it's a problem with > mailing lists..... What should > maps do, start adding sites that act like this? > > I am just making the point that if MAPS wasn't run by one > person with total control maybe > some of us "retards who don't know what we are doing" would > be a bit more will to support the > effort. > > > Rob > > Valdis.Kletnieks(a)vt.edu wrote: > > > On Wed, 23 May 2001 14:36:15 EDT, Robert Sharp said: > > > > > And if you use the MAPS list by your choice you are most > definetly filtering out email > > > or traffic for people who are legitimate. I know I have > been filtered before. MAPS is > > > using a very large hammer to kill a not so large bug. > > > > Hmm.. you won't configure it correctly. RFC2505 is "Best > Current Practice". > > > > You get filtered because you won't configure it correctly. > > > > You say you've been filtered *before* because you won't > configure it correctly. > > > > Yes, we *admit* we're using a large hammer. Bouncing your > e-mail didn't > > get your attention. Maybe irate users will get your > attention. But I > > am doubting it. > > -- > > Valdis Kletnieks > > Operating Systems Analyst > > Virginia Tech > > > > > -------------------------------------------------------------- > ---------- > > Part 1.2Type: application/pgp-signature > >

4 3

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> From: David Schwartz [mailto:davids@webmaster.com] > Sent: Wednesday, May 23, 2001 7:10 PM > > Roeland Meyer wrote: > > > I don't need to check because I have a piece of confirmed spam > > from them. A > > smoking gun. That's the way MAPS RBL has been working for years. > > That is the > > way I expect it to continue to work. The main reason that I > posted to this > > thread is that some of the posts lead me to believe > otherwise. They were > > confused. > > I think you're missing the big picture. If you receive > a single piece of > spam from a site, that's not automatically grounds to block > the site. That's > a recipe for maximizing collateral damage. > So the receipt of a spam from a site is the beginning > of the process, not > the end. Actually, I simplified the process. I agree with you 100% here. I don't have the time for such an investigation therefore I use MAPS RBL. > > > Absolutely. Probe the machine that is of concern, not > > > whole blocks randomly. > > > Also, only block the proven spam-host. No one else. > > That's a more complex judgment. In most cases, I agree > that this is > appropriate, but I can think of (and have personally > witnessed) more extreme > circumstances. I've seen ISPs who say, "no, we like to spam > and we will spam > in the future". In those extreme cases, I'll block their > entire address > space from reaching my mail servers until their policy changes. Another reason to use MAPS RBL. > > > No, its open-relay status is not irrelevant. If you > > > know a site is an open > > > relay, however you know this, and you want to block open > > > relays (which I do) > > > and it's my right to block open relays, then I will block > > > them. How I find > > > out they're an open relay is another story. The usual way is > > > you probe a > > > site when it becomes an actual problem. > > > I submit that if you have a piece of spam, from a site, and > are blocking > > them, why do you need to probe them? > > Well, if you're blocking them because they're an open > relay and they say > they've fixed the problem, it's certainly reasonable to probe > them to decide > whether you should begin allowing mail from them. Or do you think it's > better to block them indefinitely just so that you don't 'trespass' by > probing them? I'm actually not advocating blocking all open relays. I am advocating blocking all spammers, whether they have open relays or not. There are actually open relays that a spammer can never use, because the open relay site uses MAPS RBL. The are collateral damage, with ORBS. Show me how such a site can be used by a MAPS RBL'd spammer. BTW, yet another reason to use MAPS RBL. > > > 3) Do you think it's unreasonable to block known open > > > relays as a > > > protection against future spam. > > > Absolutely not. Our entire Norte Americano culture is biased > > AGAINST apriori > > restrictions. The following is a real good example of why I don't like argument by analogy. Your analogy is broken. Let's deal with the issue directly. We actually seem to be on the same side here or not very far apart. > Nonsense! This argument would say that you should allow > children to bring > guns into school provided they haven't yet shot them. Our > culture is biased > against a priori restrictions upon speech imposed by the > government, but > there is nothing inherently bad about a priori restrictions. > > > You DO NOT spank someone for something that they > > have NOT, in > > fact, done. It's called prior restraint and there is a > reason that it is > > considered unjust. It violates the PURE WAR ethos. There is > no excuse for > > collateral damage. Innocents should not be involved, period. This is > > important because we DO have the technology to wage the PURE WAR and are > > ethically compelled to use it.

2 1

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> From: Christopher B. Zydel [mailto:czydel@cv.net] > Sent: Wednesday, May 23, 2001 7:01 PM > > On Wed, May 23, 2001 at 07:02:45PM -0700, Roeland Meyer wrote: > > > From: Christopher B. Zydel [mailto:czydel@cv.net] > > > Sent: Wednesday, May 23, 2001 4:03 PM > > > > > ISPs that subscribe to MAPS RBL are saying that > > > they believe > > > that open relays should not exist, that MAPS should be able > > > to test for this > > > condition, and that they don't want to receive e-mail from > > > non-compliant > > > hosts. > > > > This is the source of confusion... right here. This person > does not know the > > difference between MAPS and ORBS. > > Wow, this text was incredibly ambiguous. MAPS offers three different lists: RBL -- the traditional realtime black hole list, of confirmed, unrepentant spam sources DUL -- the list of provider dial ports, as you shouldn't be receiving email directly from some other ISP's dial pool in most cases RSS -- 'relay spam stopper', an open relay list which is much more tightly run than ORBS, as RSS requires samples of spam that have come through the relay, whereas ORBS actively hunts open relays, whether they are being used for spam or not. In all cases, proof of spamhood is required. The do not scan for innocent open relays.

1 0

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> From: Christopher B. Zydel [mailto:czydel@cv.net] > Sent: Wednesday, May 23, 2001 4:03 PM > ISPs that subscribe to MAPS RBL are saying that > they believe > that open relays should not exist, that MAPS should be able > to test for this > condition, and that they don't want to receive e-mail from > non-compliant > hosts. This is the source of confusion... right here. This person does not know the difference between MAPS and ORBS.

2 1

Re: Stealth Blocking
by Richard A. Steenbergen 24 May '01

24 May '01

On Wed, May 23, 2001 at 11:42:21PM +0100, Alex Bligh wrote: > > > 1) MAPS is a single self appoint law enforcement agency on the INTERNET. > > a) MAPS creates the LAW, ie. no open relay > > b) MAPS enforces the law > > I didn't think I'd ever be drawn into this debate, however... Ditto... I hate spam as much as the next guy, and I don't believe MAPS is part of any grand scheme to take over the internet, yada yada, but... > MAPS publishes a list of IP addresses. It might use whatever > bizarre mechanism it likes to generate them. However, in my > personal view, and many many other people, this lists bears a very > good correlation to IP addresses which I don't want sending > email to my mail server. They do this for free. Noone is forced > to use them. If you think the way they identify these IP Have you ever had a run-in with the check verification system Chex Systems? They have an argument similar to this one for MAPS, they don't actually stop anyone from getting a checking account, they just "maintain a list", and individual banks make the decision to deny you if you are on that list, with the seemingly noble goal of "preventing check fraud and keeping costs lower for everyone else". But the reality of the situation is that if you ever have the slightest problem with your checking account, you are marked for 7 years. I had a $14 overdraft on one checking account, and to make things worse it was the bank's fault and they supposidly removed it from their records. But Chex Systems doesn't want the incidents removed from their records, they ask banks to report every incident even if it is resolved promptly. Trying to call them and get through to a person is like trying to find the free porn by following the free porn links, the best you can get is a free copy of your Chex Systems record (required by law) so you can see why you are marked. And I challange you to find a bank who doesn't use them to disqualify potential checking account applicants, the best you'll find is 0.1% who will overlook a single resolved incident on your record. I'm not saying MAPS is anything like this, infact they aren't, which is why they are respectable while ORBS is not. But there is something to be said for fear of the power of the people who are just "publishing a list". Unfortunantly, the spam situation of the modern internet requires that you have some degree of trust in the servers which bring you mail. You might have better luck trying to restrict the domains or ips to those where you have actual customers, or try coming to some other reasonable compromise. P.S. Notice I didn't have to call anyone an idiot to get my point across. P.P.S. After reading dotcomeon.com, I didn't say I didn't think it. :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

RE: Stealth Blocking
by Roeland Meyer 24 May '01

24 May '01

> From: David Schwartz [mailto:davids@webmaster.com] > Sent: Wednesday, May 23, 2001 4:54 PM > > > In the PURE war, one ONLY shoots confirmed bad-guys and has ZERO > > collateral damage. > > So if someone has a machine gun and is firing randomly, > you don't act to stop him until he happens to hit someone? Lottsa mitigating circumstances here; .Are they shooting spam? .Are they trying to hit anyone? One spammer is no justification for nuking their entire city. Targeted response, sir ... targeted response. That's what MAPS is, a laser beam, not a hand granade. > That's madness. [I] don't advocate > random scanning, as it is unethical to probe random people for > vulnerability. However, once you know there is in fact an > open relay, you are entirely justified in blocking it. Agreed, but its open-relay status is irrelevent. The fact that one has proof-positive of spam, from that site, is. > And if you have legitimate reason to > suspect a site is an open relay, you are entirely justified > in probing it to see whether or not it is. No you are not, by your own ethical standards. Suspicion is not proof. Only a piece of spam, in hand, from that specific site, is sufficient grounds. > If your neighbor is aiming a gun at you, you are > justified in checking to see if it's loaded. No you are not, you assume that it is and fire first <grin>. But, you are not justified in taking out his whole block, including the other neighbors. You are not allowed ANY collateral damage. Anything less is sloppy anyway. What's the matter, ain't you that good? Can't you aim?

2 1

Remote Area Satellite Internet Access
by Dennis Dayman 23 May '01

23 May '01

Any suggestions as to satellite companies or equipment to use for remote area Internet access? --------------------------- Thanks Dennis Dayman dennis(a)swbell.net Voice 972-682-7555 FAX 972-682-7556 ---------------------------------------------------------------------------- -- What goes up, must come down. Ask any system administrator. ---------------------------------------------------------------------------- --

1 0

RE: Reference to the internet traffic growth
by Frank Coluccio 23 May '01

23 May '01

Maybe this analysis from BCR may be helpful. I've followed Sevcik for a long time and I've come to trust his sober approach in such matters. Of course, attempting to actually track bandwidth utilization, as opposed to simply the amount that is being made available - there is a gaping difference there - is another story, altogether. Interesting topic, though. http://www.bcr.com/bcrmag/2001/01/p10.asp This site at ATT Research is somewhat surprisingly candid, and in depth,, as well. Enjoy. http://www.research.att.com/~amo/doc/networks.html ------Original Message------ From: Sudheer Dharanikota <sudheer(a)nayna.com> To: nanog(a)merit.edu Sent: May 22, 2001 9:00:37 PM GMT Subject: Reference to the internet traffic growth Could somebody point me to a well respected referece on the Internet traffic growth trends. Thank you for the help. Regards, sudheer

1 0

A rare and isolated event
by Sean Donelan 23 May '01

23 May '01

Our regularly scheduled NANOG provider problem was right on time again this meeting. http://dailynews.yahoo.com/h/ap/20010522/tc/instant_messenger_outage_1.html "The problems were fixed by early afternoon. Graham said one Internet provider under contract with AOL had connection trouble. The company uses several outside companies to let users connect with computers that run Instant Messenger and other services. The outage, which Graham termed ``a rare and isolated event,'' "

2 1