- Test - lists.nanog.org

Re: Netgate.net.nz/ORBS spam colusion
by Dean Anderson 10 Jan '00

10 Jan '00

Around 05:28 PM 1/8/2000 -0800, rumor has it that Owen DeLong said: > >Noone has disputed that relays are necessary. > >I am as yet unconvinced that open relays are necessary. Thats nonsensical. Clearly, if one is going to offer outsourced services for which relays are necessary, one must operate open relays. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

Re: Netgate.net.nz/ORBS spam colusion
by owen＠dixon.delong.sj.ca.us 10 Jan '00

10 Jan '00

> Around 05:28 PM 1/8/2000 -0800, rumor has it that Owen DeLong said: > > > >Noone has disputed that relays are necessary. > > > >I am as yet unconvinced that open relays are necessary. > > Thats nonsensical. Clearly, if one is going to offer outsourced services > for which relays are necessary, one must operate open relays. Hmmm... It's not clear to me. I offer outsourced services, for which relays are necessary, but my relays are restricted to my customers. Owen

1 0

Re: Spam, Law and Reality
by Charles E. Yow, Esq. 09 Jan '00

09 Jan '00

That is fantastic. ----- Original Message ----- From: John S. Quarterman <jsq(a)mids.org> To: Charles E. Yow, Esq. <CYow(a)GulfSouthY2k.com> Cc: <nanog(a)merit.edu> Sent: Sunday, January 09, 2000 4:40 PM Subject: Re: Spam, Law and Reality > >The spam issue is serous no doubt, but unless everyone understands the >implications of attempting to apply U.S. law to please understand some basic >concepts and reality. First the alleged violation has to be according to >the letter of the law that is being applied, exactly by the letter of the >law. Lets be very realistic, do we really want to seek to apply U.S. law to >those outside the U.S? If this is the case then the end result could be the >reverse, perhaps China would seek to apply Chinese law to American ISP's, >network administrators, the end result being Americans who have never been >to China being sentenced to life in prison or to death for posting matters >the Chinese Government considers offensive. The witch hunt I see to address >spamming is illogical and futile. Let me be very blunt, until someone is >willing to take action all this talk about dealing with spammers is nothing >more than saber rattling and is useless. I am an attorney in Massachusetts, >and my experience is people get upset about spam and without exception no >one is willing to follow through, I used to be willing to deal with spammers >pro bono, but having been burned more than enough times by people "getting >over it" that has passed. Talk is cheap. We sued and won, http://www.mids.org/nospam/ but the spammer in question was inside the U.S., and I certainly understand your point of view. John S. Quarterman <jsq(a)mids.org>

1 0

Re: Netgate.net.nz/ORBS spam colusion
by Dean Anderson 09 Jan '00

09 Jan '00

Around 08:14 AM 1/8/2000 -0800, rumor has it that Owen DeLong said: > > >However, I must question whether the activity Dean discusses is actually >criminal. He does not accuse them of carrying out the attacks, he >accuses them of transporting information published by a third party >which notifies the world that his site is vulnerable to these attacks. Umm, for the record, I do make such an accusation. When they probe a non-public government computer, they are violating 18 USC 1030 Sections 2(b), 2(c), and 3. Those are criminal violations. You simply may not probe government computers. Doing so is immediately a crime. The $5000 limit is only for non-government computers. Then they do other things, some of which are criminal (fraud is criminal), and some of which may not be. >Since Dean has published information to NANOG and other public forums >stating that: > 1. His sites _ARE_ vulnerable. My customer shell servers' telnet sessions are vulnerable to password theft, and password guessing. So are yours. So what? > 2. He has no willingness to fix these vulnerabilities. There isn't anyway to fix them. There may be a protocol extension in the future, but its not here yet. I've been through this with 50 people in the last 6 months. That doesn't permit others to exploit them. > 3. He intends to make the internet at large responsible > for his negligence WRT these sites. We have no negligence. And we do not hold the internet at large responsible. Just those that exploit protocol vulnerabilites, and those who assist with the exploitation. If your customer commits crimes, and you don't do anything about it after complaints are made, I expect that you bear responsibility and liability. >I seriously doubt that publishing a list of known public-nuissances >is genuinely illegal. Further, unless Dean has presented netgate >with a court-order showing that the court has indeed found said >activity to be illegal, I think they would be negligent in turning >off said service. So publishing a list of sites which have vulnerabilities detected by SATAN scans wouldn't be illegal? Thats what you are saying. As far as court orders go, the point of this discussion is to make sure we have exhausted all non-litiguous options. >How would you like it if your ISP shut you down because I >complained to them that you were sending out messages that >contained information that was publicly available, but which >I didn't want published? That's what Dean's really saying. No, its not what I'm saying. Would you object if I published a list of your servers which could be broken into, and said that it was OK with you to break into those systems? I think you would. But if you wouldn't mind, I'll be happy to have your permission to scan your net with SATAN and publish a web page for the script kiddies. What was that? You don't give me permission? I didn't think so. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

4 3

new routing registry!
by abha 09 Jan '00

09 Jan '00

Hello Routing Registry Fans... *grin* Just wanted to let you know that there is now a free registry for your use... altb.net... Check it out http://www.altdb.net. This is a best effort service provided through the courtesy of tch.org (Thanks, Steve Rubin!) This is service is provided for those of you who only have a couple of objects and want to avoid registration fees... (money is better spent on domain names, eh?) Just kidding... So, what does best effort mean? Well, the machine is monitored and we will be paged for problems. We'll also be doing our best to answer any questions and assist with registrations, although, if you don't know what you are doing, you are better off sticking with a "real" database. :) Anyway, the service is here... Its one of those "for the community, by the community" things... So, have fun. Be good. And let us know if you have any trouble with it... Steve and I can be reached at db-admin(a)altdb.net. Automatic submissions can be sent to auto-dbm(a)altdb.net. We are mirroring the RADB, and they are mirroring us... So, as I like to say, its all good... :) -abha ;) ps - please send all comments, complaints, suggestions and spam to /dev/null, i mean db-admin(a)tch.org. *grin* thanks.

1 0

Netgate.net.nz/ORBS spam colusion
by Dean Anderson 09 Jan '00

09 Jan '00

I would like to get your opinions on this. I have been in touch with Netgate.net.nz, which now transports ORBS illegal traffic into the US. ORBS (Alan Brown) has indicated on spam-l that ORBS has (illegally by 18 USC 1030 2(b), 2(c), and 3) scanned thousands of US government computers, and that the purpose of ORBS is to enable "script kiddies" to exploit sites that relay, thus inducing those sites not to operate relay services. ORBS' advertising of our site as free misuses our trademark. ORBS commits frauds on those who believe its false advertising and then subsequently use listed sites to relay without authorization. All this has been brought to the attention of Netgate.net.nz. Netgate is unwilling to block this traffic, which results in unauthorized relay attempts on ours and others services. Netgate claims it is a "US carrier" and is exempt from any responsibility for the behavior of it customers after complaints have been made about them. Our theory is basically that Netgate must react to complaints about violations of US law by its customers or find itself named a codefendant. It seems we have reached the limit of civil discusions. Before we start suing Netgate, and listing them as the responsible party on our next relay complaint (unauthorized use of computer of more than $5000), I'd like to air out some of our non-litiguous options before some other operators. So I'd like to propose the possibility that we should start probing New Zealand sites with SATAN, and publish site vulnerabilities on a web page, just like ORBS does. We would then deny responsibility for any resulting attacks on those sites by "script kiddies". Just like ORBS does. Of course, if this were actually done, I would expect we would then find ourselves blocked, and perhaps disconnected by our upstreams. I would tend to think that most other ISP's would find this kind of behavior unacceptable. I also tend to think that our upstreams should respond to such complaints and take action to stop this activity. But perhaps I'm wrong. I'd like to find out the reaction of various operators to such activity. I'm not seriously considering using SATAN this way, but I would like to hear how others would approach the problem posed by someone who did. I hope that will be helpful in forming our response to Netgate.net.nz. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

10 9

Re: Netgate.net.nz/ORBS spam colusion
by Derek J. Balling 09 Jan '00

09 Jan '00

> >This is where it starts to get really entertaining. Dean wants to go >after netgate, because he can't go after their customer. The customer >is not doing anything illegal where the customer is. Netgate is >required to comply with uS law in so far as they are a common carrier >which provides carriage to/from the united States. Dean may actually >be able to cause them significant grief, unfortunately, but it is >extremely unlikely that he will be able to do anything to the people >he is actually trying to shut down. Worse yet, depending on NZ law, >Dean my be able to demand under US law that netgate take action which >is illegal under NZ law against their customer who has an contract >in NZ and which has not violated NZ law. Netgate may have an easy out (possibly, I haven't investigated) in that oftentimes companies will incorporate separately in many of the countries they do business in (I don't know WHY, although I suspect it makes bookkeeping significantly easier when it comes to tax law). If Netgate has done this, then Netgate (US) can point to Netgate (NZ) and say "That's their company, talk to them..." at which point Netgate/NZ tells the US to go pound sand. >I sympathize with netgate in this case. Don't we all? :) D

1 0

Re: Netgate.net.nz/ORBS spam colusion
by Dean Anderson 09 Jan '00

09 Jan '00

Its more pernicious. I've discussed the technical details on other lists, just to demonstrate necessity. Suffice it to say there are good reasons that the _default_ relay behavior was changed instead of removing relay capability altogether. And I'm not the only one who operates relays. I'm just the only one dumb enough to try to explain to the junior anti-spammer league why relays are necessary, which is how we became listed in ORBS. I admit that was a mistake. Prior to that, we had no relay problems in the previous 4 years of relay operation. Most spammers don't have the resources to scan a large chunk of the net without detection. They depend on someone else to tell them where the relays are. Now I'm saddled with having to shut down ORBS to stop people from abusing our servers. It could get expensive. But I don't have a choice now. --Dean Around 11:22 PM 1/8/2000 -0000, rumor has it that fischer(a)sacred.net said: >I for one am curious why it is impossible to close them down >as relays. There are solutions although sometimes they can >inconvenience your users -- I'm thinking of the cases where >you have to provide mail service to customers that are coming >in from arbitrary networks -- is that it? Or is it something >more pernicious? If the former, an extension to qmail modifies >a list of allowed networks, once they've used pop to check their >mail. That's the inconvenient part (they have to pop before >they can send). Homegrown solutions abound, I am sure. > >I understand that ORBs think they are doing a service by >publishing these exploitable sites, and that they are doing a >diservice as well. I have no idea how it balances out, >but that's irrelevant. Maybe someone here has a fix for >this fellow's problem? What, exactly, *is* the reason >that you are stuck with open relays? > > Randy Fischer > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: Netgate.net.nz/ORBS spam colusion
by owen＠dixon.delong.sj.ca.us 08 Jan '00

08 Jan '00

However, I must question whether the activity Dean discusses is actually criminal. He does not accuse them of carrying out the attacks, he accuses them of transporting information published by a third party which notifies the world that his site is vulnerable to these attacks. Since Dean has published information to NANOG and other public forums stating that: 1. His sites _ARE_ vulnerable. 2. He has no willingness to fix these vulnerabilities. 3. He intends to make the internet at large responsible for his negligence WRT these sites. I seriously doubt that publishing a list of known public-nuissances is genuinely illegal. Further, unless Dean has presented netgate with a court-order showing that the court has indeed found said activity to be illegal, I think they would be negligent in turning off said service. How would you like it if your ISP shut you down because I complained to them that you were sending out messages that contained information that was publicly available, but which I didn't want published? That's what Dean's really saying. Owen > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > On 08-Jan-2000 William Allen Simpson wrote: > > > > Dean Anderson wrote: > >> > >> I would like to get your opinions on this. > >> > > My opinion is that you should sue them vigorously -- and lose. This > > would help the rest of us immensely by providing a solid precedent for > > common carrier liability regarding the activities of our subscribers. > > Every law I have seen limits common carrier liability exemption when the > carrier has knowledge of the illegal activity. It is only protection when the > carrier is not aware of the activity. > > - -- > William X. Walsh <william(a)dso.net> > DSo Networks http://dso.net/ > Fax: 877-860-5412 or +1-559-851-9192 > GPG/PGP Key at http://dso.net/wwalsh.gpg > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.1 (GNU/Linux) > Comment: DSo Networks > > iD8DBQE4drtE8zLmV94Pz+IRAvBTAKDD9O9amegIE65UJ1Lj2htV44EurwCgrTaN > Ua63qpzcXJK//Rs1PuRDfPc= > =Xy8H > -----END PGP SIGNATURE----- > >

4 3

Cisco CEF question
by Rubens Kuhl Jr. 08 Jan '00

08 Jan '00

Hi. Does someone know a good reference describing possible values and meanings for the "fast switching type" and "fast flags" fields of a "show cef interface" on a Cisco 7500 router ? Command referece for this command (http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/12cgcr/swit ch_r/xrcef.htm) does not describe these fields in detail. Running with IOS 12.0(8)S, the output is like this for each interface: FastEthernet0/0/0 is up (if_number x) (...) Fast switching type 1, interface type 18 IP Distributed CEF switching enabled IP Flow switching turbo vector IP Flow CEF switching turbo vector Input fast flags 0x1, Output fast flags 0x1 (...) Previous CEF-enabled versions may show little diferences, such as listing fast-flags as one field. Any pointers ? Rubens Kuhl Jr.

1 0