- Test - lists.nanog.org

Operational focus
by Susan R. Harris 11 Aug '00

11 Aug '00

Hi everyone - given the recent volume of email regarding spam, this is just a reminder that the NANOG email list is for discussion of ISP engineering and operational topics. Other lists focus on spam specifically, including: SPAM-L (LISTSERV(a)PEACH.EASE.LSOFT.COM) spamtools(a)abuse.net For information about subscribing to these lists, please see: http://www.nanog.org/isp.html#spam Please see the NANOG email list AUP for more information: http://www.nanog.org/aup.html Thanks for your cooperation in helping to maintain the focus of the NANOG email list. Susan R. Harris, Ph.D. Merit Network/Univ. of Mich. (734) 936-2100

2 1

An example
by Roeland M.J. Meyer 11 Aug '00

11 Aug '00

I post some negative messages about ORBS and RBL and look what happens! Gee, isn't it co-incidental that my mailer is now blocked? It sounds like straight-up intimidation actions to me. If this is the action of a responsible anti-spam fanatic then it is an even greater indictment of the entire RBL/ORBS movement. The hostname is right, DNS is healthy, including my ORSC root-zone servers, and I am running current sendmail with anti-relay active. Gee, maybe they're making a statement ...ya think? That's alright, woods just hit my kill-file anyway >plonk< But, this seriously indicates that this ORBS/RBL think is getting way out of hand. Typical vigilante pattern. > -----Original Message----- > From: Mail Delivery Subsystem [mailto:MAILER-DAEMON@mhsc.com] > Sent: Thursday, August 10, 2000 11:46 PM > To: rmeyer(a)mhsc.com > Subject: Returned mail: Service unavailable > > > The original message was received at Thu, 10 Aug 2000 23:46:01 -0700 > from peregrin.lvrmr.mhsc.com [199.108.175.234] > > ----- The following addresses had permanent fatal errors ----- > <woods(a)weird.com> > > ----- Transcript of session follows ----- > ... while talking to mail.weird.com.: > >>> HELO condor.lvrmr.mhsc.com > <<< 550-You are not permitted to send mail from > condor.lvrmr.mhsc.com[199.108.175.226]. > <<< 550-All SMTP connections have been blocked from that address, > <<< 550-possibly because it has been listed in one of the many RBLs, > <<< 550-or possibly because your DNS is broken or your > hostname is wrong. > <<< 550- > <<< 550-Please forward this message to your own LOCAL > postmaster and ask > <<< 550-them to contact us regarding this issue. > <<< 550- > <<< 550-Postmaster(a)[199.108.175.226]: Please contact > <postmaster(a)most.weird.com> > <<< 550-(via an unblocked server of course!) for exact > details on why your > <<< 550-mailer's connection was rejected. You must include > your IP number > <<< 550 given above in order to receive an accurate answer. > 554 <woods(a)weird.com>... Service unavailable >

4 4

RE: Can someone test AOL's mx servers for me...
by Karyn Ulriksen 11 Aug '00

11 Aug '00

Please. Please. Everyone. Thank you. But you can all go home now! I think I've received about 50 messages now about the RFC compliant '<>' usage and have got the message. So now I know ... it's right up there with not using CNAMEs for MX records ... they use to work once upon a time in a more forgiving internet (whenever that was) or at least a less RFC compliant internet. But I can take a hint (all 50!). And I have since figured out what the flippin' other problem with the mail was. Thank you all. Karyn -----Original Message----- From: Mark Brown To: Karyn Ulriksen Sent: 8/11/00 3:47 AM Subject: Re: Can someone test AOL's mx servers for me... On Thu, Aug 10, 2000 at 06:04:56PM -0700, Karyn Ulriksen wrote: > I'm seeing some wierd errors when emailing AOL. The response for the "MAIL > FROM: user(a)domain.com" is a '501 syntax error'. Is that exactly what you are typing? In that case AOL is being perfectly reasonable - the correct syntax is "FROM:<user(a)domain.com>" (without quotes) and similarly for RCPT TO. The <> are mandatory. -- Mark Brown mailto:broonie@tardis.ed.ac.uk (Trying to avoid grumpiness) http://www.tardis.ed.ac.uk/~broonie/ EUFS http://www.eusa.ed.ac.uk/societies/filmsoc/

2 1

RE: spammers will move offshore?
by Morgan Dollard 11 Aug '00

11 Aug '00

Im confuesed about the origin of this discussion, since i mised the kick off, but i see way too much concern over spam, we've all been receiving junk mail in our Mailboxes (paper plastic stuff) for years, and has any1 ever been sued or banned from the US postal service for it? Im gona add real quick that im not american, and quicky disagree with the fact that americans arent liked, its jsut that the fact that you try to control the rest of the world, INCLUDING, the internet, makes people think twice. the internet belongs to no one, and child pornography might be legal in some weird country in the world, but thats not the issue here. SPAM, typically unsolicited mail, is no differnet from having jehova witnesses knock at your door, or one of them salesman try to sell u insurance a house a boat, the moon, hell his underwear even. Do u actually SUE that guy for it? i agree that spam is anoying, even mailign lsitst like this one get picked up email addresses, and that there should be something done to fix it, but how can u prosecute people on the internet when u allow the same practice to go unbothered in real life. Morgan Dollard NSC Technology -----Original Message----- From: Derek J. Balling [mailto:dredd@megacity.org] Sent: Thursday, August 10, 2000 15:36 To: Barry Shein; nanog(a)merit.edu Subject: Re: spammers will move offshore? At 12:21 AM -0400 8/10/00, Barry Shein wrote: >Where did this dopey "spammers will just move offshore" idea come >from? Me. >The legal term is "agency", hire someone to do something illegal to >promote your US business and you're in trouble. But what if you don't KNOW that they're doing something illegal? e.g., you hire Joe's Marketing Company, and without your knowledge Joe's Mktg Co spams people. I'm no lawyer, but it seems silly that you'd be liable for stuff you weren't even aware of (or perhaps that you had told them not to do but they did anyway, who knows). >Besides there are a million cooperating treaties between major nations >and, etc... For major criminal activities like kiddie porn and drug smuggling? Sure. For spam complaints? You'd probably get laughed at all the way from one side of the globe to the other (Sadly). >Do people really believe you can open a mail order crack house in >the UK and sell to US customers...??? No. >Besides, that's making the best the enemy of the good, it's not like >spamming is some multibillion dollar biz that's going to open glass >and steel skyscraper complexes in Afgahnistan. > >It's the same pimply sociopaths who smurf, junk fax (do you find >yourself getting lots of offshore junk faxes???), etc. > >Make it illegal in the US, assume they'll make it illegal in other >countries which don't want to see their internet access disrupted >because they're rogue countries and blocked or severely whitelisted. Maybe you haven't been keeping track, but us Merkins aren't really well-liked or respected outside the borders of the land we live in. Other countries won't "cave in" that easily, methinks. >It's a heckuva lot more promising than whining that spammers might >launch their own space stations to spam from. Who said anything about space programs? ;-) >Cripes, as it stands you can't even stop that schmuck in Georgia who >has been mass spamming copier toner supplies for years. You can't >touch him (obviously, he keeps doing it and putting his name and 800 >number in the spam.) > >He ain't going to Libya to operate his toner business any time >soon...trust me on this. But why bother he's perfectly safe in >Georgia. My point exactly... when his lucrative source of income is gone, you don't think he'll move the operation somewhere that he can continue to make money? (I must assume its lucrative or he wouldn't still be wasting time on it) >It's just like the junk fax stuff, just make it illegal and no one >will hire the spammers except for a few miscreants who can be dealt >with. Just like that's working for crack sales? ;-) >And spammers won't be able to incorporate (limit liability), open bank >accounts, solicit investment money, get loans, business licenses, >etc. You can't do those kinds of thing for illegal activities. It's not like you put down "spamhaus" on your articles of incorporation. ;-) D Disclaimer ---------- This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. This communication represents the originator's personal views and opinions, which do not necessarily reflect those of the NSC Group. If you are not the original recipient or the person responsible for delivering the email to the intended recipient, be advised that you have received this email in error, and that any use, dissemination, forwarding, printing, or copying of this email is strictly prohibited. If you received this email in error, please immediately notify administrator(a)nscglobal.com.

12 12

RIPE-181 server to be decommissioned
by gerald＠merit.edu 11 Aug '00

11 Aug '00

As many of you know, Merit began a production RPSL service on 11/1/99. RIPE-181 and RPSL coexisted on our production server until 1/1/00; after that date, RIPE-181 updates were no longer accepted and only queries were available on the special RIPE-181 server. Merit will now complete the final stage of its transition to RPSL by decommissioning its RADB RIPE-181 server on Wednesday, August 23, between 5:00-8:00 A.M. EDT. Query activity has been extremely light on the RIPE-181 server and the remaining users have been notified by private email about the termination of this service. This change will not impact our production RPSL service. Please send your questions and comments to db-admin(a)radb.net. IRRd Team --Gerald Winters

1 0

Can someone test AOL's mx servers for me...
by Karyn Ulriksen 11 Aug '00

11 Aug '00

I'm seeing some wierd errors when emailing AOL. The response for the "MAIL FROM: user(a)domain.com" is a '501 syntax error'. I'm not sure if they are messed up or if we somehow ended up on their bunk list... --------------------------------------------------------------------- Best regards, Karyn Ulriksen Director of Network Operations PublicHost, A SiteStream Company 22 Mauchly, Suite 200 Irvine, California 92618 USA Phone: (949) 743-2000 email: kulriksen(a)publichost.com URL: http://www.publichost.com

1 0

Re: surge in spam email (fwd)
by multics＠ruserved.com 10 Aug '00

10 Aug '00

Forwarded message: [snip] > No, we need a legislative approach, with some technical support to > help increase the likelihood that spammers who break the law will get > caught. But first it has to be illegal, or else it's all for naught. > > Put it this way: I consider my house locked up even if I do have glass > windows, and even if glass is rather easy to break. > > If it were legal for a person of ill intent to break the glass to get > into my house to rob me the first approach would not in my mind be to > board up all the glass unless I really lived in some mad max anarchy. > > I'd first want to see it made illegal to break into my property. [snip] > -Barry Shein IMO, spam is already illegal, the problem is getting any police agency to take action. It's theft of service of any system that's relay raped and it's harasssment of the people being targeted as well as theft of service. It takes resources to bounce all those no longer existing email addresses and then even more processing to end up bouncing the bounces. I end up going into our mail spool every now and then and deleting all the bounced spam that can't be delivered. A royal pain in the neck when the outgoing spool is 90% to 100% spam bounces. -- Richard Shetron multics(a)ruserved.com multics(a)acm.rpi.edu NO UCE What is the Meaning of Life? There is no meaning, It's just a consequence of complex carbon based chemistry; don't worry about it The Super 76, "Free Aspirin and Tender Sympathy", Las Vegas Strip.

1 0

spammers will move offshore?
by Barry Shein 10 Aug '00

10 Aug '00

Where did this dopey "spammers will just move offshore" idea come from? The legal term is "agency", hire someone to do something illegal to promote your US business and you're in trouble. Assuming the point of sending spam to US addresses is to sell some product in the US, which means you have a business presence in the US, which means you're subject to US laws. etc. Besides there are a million cooperating treaties between major nations and, etc... Do people really believe you can open a mail order crack house in the UK and sell to US customers...??? Besides, that's making the best the enemy of the good, it's not like spamming is some multibillion dollar biz that's going to open glass and steel skyscraper complexes in Afgahnistan. It's the same pimply sociopaths who smurf, junk fax (do you find yourself getting lots of offshore junk faxes???), etc. Make it illegal in the US, assume they'll make it illegal in other countries which don't want to see their internet access disrupted because they're rogue countries and blocked or severely whitelisted. It's a heckuva lot more promising than whining that spammers might launch their own space stations to spam from. This sort of int'l legal stuff is hardly unique to spam or even the internet. Cripes, as it stands you can't even stop that schmuck in Georgia who has been mass spamming copier toner supplies for years. You can't touch him (obviously, he keeps doing it and putting his name and 800 number in the spam.) He ain't going to Libya to operate his toner business any time soon...trust me on this. But why bother he's perfectly safe in Georgia. It's just like the junk fax stuff, just make it illegal and no one will hire the spammers except for a few miscreants who can be dealt with. And spammers won't be able to incorporate (limit liability), open bank accounts, solicit investment money, get loans, business licenses, etc. You can't do those kinds of thing for illegal activities. -- -Barry Shein Software Tool & Die | bzs(a)world.std.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 617-739-0202 | Login: 617-739-WRLD The World | Public Access Internet | Since 1989 *oo*

3 2

RE: spammers will move offshore?
by Martin Cooper 10 Aug '00

10 Aug '00

Roeland M.J. Meyer <rmeyer(a)mhsc.com> writes: > SPAM is a side-issue here and not really relevent to losing > connectivity with an entire continent. I don't know -- I think we could probably afford to lose connectivity to large parts of the APNIC database without major issues; it would probably halve the amount of SPAM we get and the amount of time wasted complaining about it to unresponsibe admins as well. M.

2 1

RE: surge in spam email (fwd)
by rdobbins＠netmore.net 10 Aug '00

10 Aug '00

We have a zero-tolerance policy for spam, too, and do our best to stop it -before- we get complaints. If we receive a complaint, we do a quick (within minutes, not hours or days) investigation to verify the facts, then shut down the spammer. It's funny, though - the only reason -I- care about spam on a personal level is when it chokes a mail server, or someone starts spamming a listserv. I have a pretty good set of filtering rules on my relay and my client, and the little bit that gets through I just delete. When it's in my own inbox, it annoys me about as much as junk postal mail, or telephone solicitors - i.e., not at all. I toss the former in the trash, and tell the latter to toss -themselves- in the trash. Life's too short to waste on developing an ulcer because of morons, you know? I guess the traffic does add up to significant $$$ in transport for the larger transit providers, though. -----Original Message----- From: John Fraizer [mailto:nanog@EnterZone.Net] Sent: Wednesday, August 09, 2000 10:14 PM To: Brad Cc: David Charlap; nanog(a)merit.edu Subject: Re: surge in spam email (fwd) On Wed, 9 Aug 2000, Brad wrote: > > On Wed, 9 Aug 2000, David Charlap wrote: > > > With a proper set of laws on the books, law enforcement could simply > > read the content of the spam to get a phone number, address or PO box, > > and prosecute whoever owns it. The fact that they abused a foreign > > server in the process shouldn't change anything. > > The only problem with that is the simple fact that geting > innocent people in trouble is more likely. For example: > "Dumb Person A" sends a million SPAMs to anyone who will > complain about it. In the message, they put a note telling > the recipiant to send $5 to "Innocent Victim B"'s Home/PO > BOX address. Then person B gets all kinds of complaints, > and if the law read the email message, then they would pay > the price too. > > -Brad > This is precisely the problem with some providers current policy. Case in point: Someone SPAMvertized a website hosted by one of our customers. The SPAM was injected from a UUNet dialup port by one of THEIR customers. What was their response? They threatened to blackhole the /20 that contained the IP address of the website that was SPAMvertized. We try to make our BGP announcements responsibly but, actions like this will force us to announce specific /24's, especially when further investigation showed that the individual who SPAMvertized the site had no affiliation with it what-so-ever and had done so in attempt to get the site shut down. In the conference call with one of our upstreams and UUNet, I asked them if this was their firm policy -- no exceptions -- they blackholed ANY site that was SPAMvertized. I was told yes -- UNTIL I asked what they would do if someone SPAMvertized _THEIR_ site to 10,000,000 newsgroups as a test of their policy. For what it's worth, we, along with the customer in question have a ZERO TOLERANCE policy on SPAM. The site in question _was_ shut down during our investigation. Punishing someone without proof that they indeed have done something that is unacceptable is just opening ourselfs up for the newest, _EASIEST_ DoS attack ever. Now, a single 14.4 modem connect SPAM injector site can shut down a site sitting on OC192. Tons of bang for the buck to the DoS kiddies, Huh? Want to hurt the IPO of the latest .com to go public? Just SPAMvertize about it. --- John Fraizer EnterZone, Inc

2 1