September 2002 - NZNOG - lists.nznog.org

RE: So cool a flash,enjoy it
by Donald Neal 10 Sep '02

10 Sep '02

> -----Original Message----- > From: Joe Abley [mailto:jabley(a)automagic.org] > Sent: Wednesday, 11 September 2002 12:02 [...] > The best AV solution I can think of is for all possible holes and > exploits in Microsoft mail clients to be exploited as soon as > possible, and as violently as possible. Maybe if that happens fewer > people will run stupid Microsoft mail clients, and the whole issue > will just go away. > > By making half-hearted attempts at stripping virus-infected bits > from e-mail, you're just interfering with the natural order of > things and prolonging the life of **** software. > > > Joe > - This message was bounced by teletech.co.nz on the ground that it contained offensive language. I felt that whoever on the list is using this company's mail service should know that. - Donald Neal ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------ - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: So cool a flash,enjoy it
by Ewen McNeill 10 Sep '02

10 Sep '02

In message <9146DBDC8503D411B18A204C4F4F50200A65DB(a)172-16-1-2.static-dialup.xtra.co.nz>, James Guidera writes: >>[Joe Abley says: don't strip the viruses, let the natural order prevail] > >There is no point blaming the mail client. No matter who makes the mail >client, if it is popular it will be open to attach. Be it Notes, GroupWise, >Outlook. Whoever is the biggest and most common would be the target. There is every point in blaming the mail client -- it's the "automagically do stuff" behaviour of the mail clients which makes all of these viruses spreading around possible. The "automatically run programs when clicked on" is bad enough (where programs == "anything executable", including "documents" with embedded programming languages and auto execute features); the preview bugs are even worse. There were far far fewer mail viruses in the days when you had to work rather hard to run a program sent to you by mail (eg, cut out encoded section, manually feed to uudecode or unshar it, compile the source, and run it). cat, more, less and other similar mail clients have far fewer security problems. Even telnet has fewer security problems as a mail client (although it does suffer from plain text passwords over the wire). And mail/mailx don't have that many security problems on the _reading_ side (on the sending side they're a bit of a festering pile of security holes). There might be an argument that only mail clients vulnerable to being infected will be popular (the converse of what you're suggesting) -- because they're more point'n'drool. However I'm with Joe: if you let the viruses do their thing, preferably as dramatically as possible, then the natural order will prevail eventually, as people get tired of reinstalling their machine for the third time that week (and/or confidental documents leaking and/or their clients shunning them). To bring it vaguely back on topic: mail scanners at ISPs (eg, the Xtra ones) would do need to either forward on the bones, or bounce the whole message back to the "sender" -- silently dropping things is bad, as it just hides the problem (and can hide more stuff). For messages which appear to be viruses that send their own mail (ie, spreading as worms), I'd personally go for just bouncing the whole message back. (Yes I know Klez, et al, forge the from address too, so you can't usefully bounce it -- but the recipient doesn't want it either. I'm going to get stray Klez as either "sender" or recipient whichever way you go.) Ewen - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Re: So cool a flash,enjoy it
by Simon Byrnand 10 Sep '02

10 Sep '02

At 13:40 10/09/02 +1200, simon wrote: [snip] Normally I wouldn't reply to this sort of thing on list, but I've already received about 10 replies to this message which I did *not* send. Half of them were virus scanner reports, the other half were people saying "huh?", or "who are you?". For those that didn't bother to check the headers, here are the last few: Received: from mta204-rme.xtra.co.nz (mta204-rme.xtra.co.nz [210.86.15.147]) by mailserv.waikato.ac.nz (8.11.3/8.10.2) with ESMTP id g8A1eL732069 for <nznog(a)list.waikato.ac.nz>; Tue, 10 Sep 2002 13:40:21 +1200 Received: from mta2-rme.xtra.co.nz ([210.86.15.140]) by mta204-rme.xtra.co.nz with ESMTP id <20020910014016.CDID5662.mta204-rme.xtra.co.nz(a)mta2-rme.xtra.co.nz> for <nznog(a)list.waikato.ac.nz>; Tue, 10 Sep 2002 13:40:16 +1200 Received: from Anqm ([203.96.107.54]) by mta2-rme.xtra.co.nz with SMTP id <20020910013935.DSEG19105.mta2-rme.xtra.co.nz(a)Anqm> for <nznog(a)list.waikato.ac.nz>; Tue, 10 Sep 2002 13:39:35 +1200 The message clearly comes from an Xtra user, presumably infected with a virus. Which begs an interesting question, why did Xtra's much-touted virus scanner let it through ? :) Regards, Simon Byrnand (The real one :) - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

12 32

RE: So cool a flash,enjoy it
by James Guidera 10 Sep '02

10 Sep '02

There is no point blaming the mail client. No matter who makes the mail client, if it is popular it will be open to attach. Be it Notes, GroupWise, Outlook. Whoever is the biggest and most common would be the target. -----Original Message----- From: Donald Neal [mailto:Donald.Neal(a)telecom.co.nz] Sent: Wednesday, 11 September 2002 12:16 p.m. To: nznog(a)list.waikato.ac.nz Subject: RE: So cool a flash,enjoy it > -----Original Message----- > From: Joe Abley [mailto:jabley(a)automagic.org] > Sent: Wednesday, 11 September 2002 12:02 [...] > The best AV solution I can think of is for all possible holes and > exploits in Microsoft mail clients to be exploited as soon as > possible, and as violently as possible. Maybe if that happens fewer > people will run stupid Microsoft mail clients, and the whole issue > will just go away. > > By making half-hearted attempts at stripping virus-infected bits > from e-mail, you're just interfering with the natural order of > things and prolonging the life of **** software. > > > Joe > - This message was bounced by teletech.co.nz on the ground that it contained offensive language. I felt that whoever on the list is using this company's mail service should know that. - Donald Neal ---------------------------------------------------------------------------- -- "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ---------------------------------------------------------------------------- -- - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 2

Updated DNS monitoring, take 2
by Rob Thomas 05 Sep '02

05 Sep '02

Hi, NZNOG folks. [ Apologies to those of you who see this note in other fora. ] Rodney Joffe (thanks, Rodney!) correctly pointed out that my gTLD monitoring was only tracking the Verisign gTLD (com, net, org) name servers. I have now added the other TLDs to the mix. It can all be found in two places: http://www.cymru.com/DNS/ http://bgp.lcs.mit.edu/dnsmirror/ I will shortly have an additional web server on a much faster set of links, as well as another mirror. For the impatient, I recommend the MIT site. Don't forget to check the Lame Report while you're there. :) Comments and feedback are always welcome! Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: input required - Conference 2003
by Stephen Andrew 05 Sep '02

05 Sep '02

No - I'd suggest Alan Brown moderate. That should be fun. -- Andrew > -----Original Message----- > From: Roger De Salis [mailto:roger(a)desalis.gen.nz] > Sent: Thursday, September 05, 2002 7:36 PM > To: Simon Lyall > Cc: nznog(a)list.waikato.ac.nz > Subject: Re: input required - Conference 2003 > > > You can moderate the plenary session.... > > Simon Lyall wrote: > > > > On Thu, 5 Sep 2002, Juha Saarinen wrote: > > > Dan Bernstein? > > > > Why don't we invite Richard Stallman, Patrick O'Brien, Alan > Brown, Maurice > > Williamson and Roger Sheppard at the same time? . That way > we can get them > > all in one go. > > > > :-) > > > > -- > > Simon Lyall. | Newsmaster | Work: > simon.lyall(a)ihug.co.nz > > Senior Network/System Admin | Postmaster | Home: > simon(a)darkmere.gen.nz > > ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz > > - > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog -- \_ Roger De Salis rdesalis(a)fx.net.nz </' FX Networks +64 25 481 452 /) Wellington, New Zealand roger(a)desalis.gen.nz (/ ` DSL - the 56k modem technology of 2004 - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog This email with any attachments is confidential and may be subject to legal privilege. If it is not intended for you please reply immediately, destroy it and do not copy, disclose or use it in any way. - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

input required - Conference 2003
by Roger De Salis 04 Sep '02

04 Sep '02

I think many of you enjoyed Paul Vixie's visit this year. Does anyone have any suggestions for a speaker next year? I have polled several of the "nog" informally, but I'd like to get a wider view. R -- \_ Roger De Salis rdesalis(a)fx.net.nz </' FX Networks +64 25 481 452 /) Wellington, New Zealand roger(a)desalis.gen.nz (/ ` DSL - the 56k modem technology of 2004 - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 4

(no subject)
by Mohamad Simawy 04 Sep '02

04 Sep '02

auth 3b71458c subscribe nznog mohamad(a)zip.co.nz

1 0

shopping for a new gig
by David Anso 04 Sep '02

04 Sep '02

Does anyone know of jobs going for IP/Lucent/Linux/perl/database/network type engineers, preferably in Auckland or Wellington (but my arm is pretty twistable atm). It's time for some different challenges I feel. --- David Anso Systems/Network Administrator ZIP Internet/ZIPFone/Zip Kiosks - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Re: Did Domainz apologise in public to Strongnet?
by Roger De Salis 04 Sep '02

04 Sep '02

Au contraire. I have an apology from Strongnet to DOmainz for using an old zone file (we had withdrawn the Zone Xfers by this time) for spamming the Asia Online customer base, when Asia online were in difficulties. The mild apology was accompanied by an assurance from Strongnet that this zone information would not be used for this purpose again. I let the matter rest at that point. I could dig out the relevant emails if further info is wanted, but I regarded it as a individual matter, rather than one that needed a wide audience. /R Juha Saarinen wrote: > > Hi Roger, > > That's what Seeby of Orcon and Bruce Morris of Cardlink (a > Strongnet/Orcon customer) both claim. > > However, I can find no traces of the public apology anywhere... would you > happen to know where it was posted? > > Cheers, > > -- > Juha Saarinen -- \_ Roger De Salis rdesalis(a)fx.net.nz </' FX Networks +64 25 481 452 /) Wellington, New Zealand roger(a)desalis.gen.nz (/ ` DSL - the 56k modem technology of 2004 - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1