- NZNOG - lists.nznog.org

RE: [nznog] Argghhh.... [Fwd: Your e-mail message was blocked]
by Donald Neal 28 Sep '03

28 Sep '03

> From: Simon Byrnand [mailto:simon(a)igrin.co.nz] > Sent: Monday, 29 September 2003 09:21 > To: Joe Abley; Russell Fulton > Cc: nznog > Subject: Re: [nznog] Argghhh.... [Fwd: Your e-mail message > was blocked] > > > At 13:48 28/09/2003 -0400, Joe Abley wrote: > > >On Saturday, Sep 27, 2003, at 14:59 Canada/Eastern, Russell > Fulton wrote: > > > >>However, some employers also have policies that forbid access to > >>alternate mail sources (hotmail & ISP accounts) for > legitimate reasons. > >>This leaves some one like Frank having to follow work > related lists that > >>run foul of the corporate filter in their own time from home. > > > >He also has the option of finding a new job, if the policies of his > >employer don't suit him. > > C'mon people (not just Joe) this thread is now getting *way* > off topic, > (I'm surprised Donald hasn't stepped in yet) although > admitedly my original > message was somewhat off topic as well. This is a list for network operators, which doesn't just mean telcos and ISP's. My view is that discussion of spam filtering is appropriate. Granted, by the time we get onto what employees should be allowed to do we may indeed have wandered a bit. Donald Neal | "And if you think virus Technical Specialist | writers are scary, you Operations Engineering | have clearly never met a Integration & Services Divn. | tort lawyer." Alcatel NZ Ltd | - The Economist 28/8/03 All opinions mine only. | ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you." ------------------------------------------------------------------------------

1 0

RE: [nznog] Argghhh.... [Fwd: Your e-mail message was blocked]
by Frank March 28 Sep '03

28 Sep '03

Apologies for not getting onto this yesterday as I was involved in a meeting offsite all day. This Ministry uses MailMarshall. I am not responsible for the way it is set up and I have complained frequently about the type of email that gets blocked by it. In the past, it has blocked, inter alia, the monthly messages outlining this list's AUP and other matters from the redoubtable Donald Neal. Given Donald's care with language and his email courtesy the mind fairly boggles at the thought. On average Mailmarshal as configured here seems to catch 50% of genuine spam 'aimed' at me (but is getting better) and about 25% of the blocking messages are false positives (despite recent problems with this list, I think this might also be improving incrementally). Nevertheless, personally, I would much rather have the spam. The record with virus filtering is, however, exemplary. Although I seldom post to this list (and when I do it is arguably off-topic on occasions), and most of the traffic is of marginal direct interest to me, I do find this list useful as a gauge of the temperature and general health of the Net in NZ which is immensely valuable for my job. However, if the problem persists, and complaints persist, I will remove myself from the list. I would regard this as being a very unfortunate outcome. And, by the way, and anticipating a message later in the thread from Juha, I dont ever recall his swearing at me (about me perhaps....) -- Frank March Telephone (+64 4) 474 2908 Senior Specialist Advisor Fax (+64 4) 474 2659 Information Technology Policy Group Mobile: (+64) 21 042 9205 Ministry of Economic Development, Wellington, New Zealand -----Original Message----- From: Simon Byrnand [mailto:simon(a)igrin.co.nz] Sent: Wednesday, 24 September 2003 23:17 To: nznog(a)list.waikato.ac.nz Subject: [nznog] Argghhh.... [Fwd: Your e-mail message was blocked] Sigh... Could the owner of this charming little content filter please see if it has an option to NOT reply to messages that aren't specifically addressed to the recipient. (EG messages comming in through mailing lists etc) Or perhaps consider subscribing via another address that isn't filtered. It gets a little tiring to have every second message I send to this list get a bounce from an overactive content filter because it might have "bad words" in it or in this case might be a "hoax and/or chain letter"..... (Huh ??? What in my message looks like a hoax ?) Regards, Simon ---------------------------- Original Message ---------------------------- Subject: Your e-mail message was blocked From: Actionline(a)med.govt.nz Date: Wed, September 24, 2003 11:09 pm To: simon(a)igrin.co.nz Cc: Frank.March(a)med.govt.nz -------------------------------------------------------------------------- MailMarshal (an automated content monitoring gateway) has stopped the following e-mail as it is likely to be a Hoax and/or Chain Letter. Message: B00013c776.00000001.mml From: simon(a)igrin.co.nz To: Frank.March(a)med.govt.nz Subject: Re: [nznog] SPAM (Fw: PLEASE ASSIST) If you believe the above e-mail to be business related please contact Actionline(a)med.govt.nz to arrange for the message to be released to its intended recipients. The blocked e-mail will be automatically deleted after 30 days. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog http://www.govt.nz - connecting you to New Zealand central & local government services Any opinions expressed in this message are not necessarily those of the Ministry of Economic Development. This message and any files transmitted with it are confidential and solely for the use of the intended recipient. If you are not the intended recipient or the person responsible for delivery to the intended recipient, be advised that you have received this message in error and that any use is strictly prohibited. Please contact the sender and delete the message and any attachment from your computer.

18 34

Re: [nznog] New Team Cymru IP2ASN whois server
by Simon Lyall 25 Sep '03

25 Sep '03

A similar thing that people might like is the recent new service from routeviews.org. They have a little route server to DNS gateway so you can do things like: $ host -t txt 252.109.203.asn.routeviews.org 252.109.203.asn.routeviews.org text "7657" "203.109.252.0" "22" $ host -t txt 252.109.203.aspath.routeviews.org 252.109.203.aspath.routeviews.org text "2914 4565 7657 7657 7657" "203.109.252.0" "22" $ host -t txt 132.92.96.203.asn.routeviews.org 132.92.96.203.asn.routeviews.org text "4648" "203.96.64.0" "19" $ host -t txt 132.92.96.203.aspath.routeviews.org 132.92.96.203.aspath.routeviews.org text "2914 1239 4648" "203.96.64.0" "19" Very cool imho. -- Simon J. Lyall | Very Busy | Web: http://www.darkmere.gen.nz/ "To stay awake all night adds a day to your life" - Stilgar | eMT. I've seen things you people can't imagine. Chimneysweeps on fire over the roofs of London. I've watched kite-strings glitter in the sun at Hyde Park Gate. All these things will be lost in time, like chalk-paintings in the rain. Time for my nap. -- Julie Andrews, Bladestroller ( by Peter da Silva )

1 0

New Team Cymru IP2ASN whois server
by Rob Thomas 25 Sep '03

25 Sep '03

Fellow networkers, Team Cymru is happy to announce the availability of a public whois server dedicated to mapping IP numbers to ASNs, located at whois.cymru.com. You can find the link to this tool at: http://www.cymru.com/BGP/whois.html This link has been added to our main BGP data page available at: http://www.cymru.com/BGP/index.html We have also extended the functionality of this daemon to support BULK IP submissions for those who wish to further optimize their queries with netcat. Following is a quick overview of how to use it: $ whois -h whois.cymru.com <IP> Where <IP> is replaced by the IP you'd like to map, like so: $ whois -h whois.cymru.com 4.2.2.1 ASN | IP | Name 3356 | 4.2.2.1 | LEVEL3 Level 3 Communications You can also include port information, and/or timestamps in your queries. Be sure to include quotes around your queries, or the daemon will interpret your request as multiple lines: $ whois -h whois.cymru.com "4.2.2.1 -0600 GMT" ASN | IP | Info | Name 3356 | 4.2.2.1 | -0600 GMT | LEVEL3 Level 3 Communications For instructions on how to submit BULK queries via netcat, simply issue the following command: $ whois -h whois.cymru.com help We hope you find this tool useful. Stay tuned for more features! If you have any comments or suggestions as to how we might improve this service, feel free to let us know! Thanks, Rob, for Team Cymru. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty);

1 0

Re: [nznog] MS viruses
by Ewen McNeill 25 Sep '03

25 Sep '03

In message <006c01c383e5$51ffe4a0$6403c80a(a)uranus.clear.co.nz>, "Barry Murphy" writes: >Hmm, I just had one of the MS update viruses slip through, how many >variants of this are there? 1Kb file ;/ I've seen several copies of Swen which have come through in "neutered" form, with the executable atachment either completely missing, or the MIME headers there for it but no encoded body, or a very short encoded body. (The only reason they're getting through is because of that: I'm filtering on the executable's MIME encoding, amongst other things.) As far as I can tell they're not varients so much as the email having been through some sort of (transparent?) email filter which stripped off the executable attachement. One of my clients had a bit of a panic over one of those "neutered" versions getting in (with a 78 byte attachement instead of the executable), but it all turned out to be harmless. That said, they were planning on adding more filter rules, just to avoid confused users (and the resulting flood of calls into the helpdesk). Of course I suspect there'll be a few more copycats before the year is out. Ewen

1 0

MS viruses
by Barry Murphy 25 Sep '03

25 Sep '03

Hmm, I just had one of the MS update viruses slip through, how many variants of this are there? 1Kb file ;/ Barry

3 3

19" Server Rack in Auckland area?
by Dan Clark 25 Sep '03

25 Sep '03

Hi Guys, Does anyone have a spare 2nd hand 19" server rack in the Auckland area (or there abouts). Please contact me off list. Kind Regards, Dan Clark Network Manager Scarfies.Net Ltd Wickliffe Ltd

1 0

Re: [nznog] IP / domain blocking for SPAM prevention
by david＠farrar.com 25 Sep '03

25 Sep '03

> On Fri, 2003-09-26 at 14:00, david(a)farrar.com wrote: > > > Oh I agree they do - but at the scale of the ISPs with > > 10 million+ customers or products that are in wide use. > > I can't see a spammer adjusting anything just because > > they read on a website that Ihug with 80,000 customers > > uses Spam Assassin. > > The key phrase there is "I can't see", it doesn't matter > what you can't see, it matters what the people (the ISP > industry) see, if they aren't comfortable giving out the > measures they take then any central page where people can > easily see what people are using will be useless. Well I don't think I have suggested it is going to be compulsory or anything. In fact it is only one of hundreds of possible aspects of an overall anti spam campaign. Of course it is up to ISPs to list whatever details they want. If no-one lists anything then we just have a very short page. I would suggest that more and more consumers will pick an ISP on the basis of services like spam filtering. I have helped several people swap ISPs from those who do not have anti spam technology to those who do. Ihug's spam assassin (free plug) has been a huge benefit to me and it's the best $2.50/mth I spend. Anyway enough bandwidth wasted on this. My last post on the topic. DPF

1 0

Re: [nznog] IP / domain blocking for SPAM prevention
by david＠farrar.com 25 Sep '03

25 Sep '03

Quite the opposite. It is because they are in wide use spammers will try and get past them. But the NZ market is so miniscule that a list of what NZ ISP uses what is going to have IMO zero effect on what products spammers try to work around. I have never said that spammers do not try to get around anti spam filters. I have just said that publicising what anti spam filter a NZ ISP uses, is not going to affect the behaviour of the spammer (Unless they were for some reason targetting that ISP as a revenge thing). DPF > Hi David, > > So are you saying that in your estimation, products like > spam assassin are not in wide use? > > jamie > > >>> <david(a)farrar.com> 26/9/2003 2:00:38 PM >>> > > david(a)farrar.com wrote: > > > > > I actually think it is highly unlikely that with the > > > way spammers work they would try to tailor spam > > > individually for each ISP to get past what they think > > > are its filters. We are not big enough for that. > > > They just throw out 100 million of them and hope say > > > 10 million of them get through and are not too worried > > > if it is 10.0 million or 10.05 million. > > > > Spammers do try to get past filtering, and use different > > methods for AOL, Hotmail, etc. Some try to poison > > auto-learning filters as well. > > Oh I agree they do - but at the scale of the ISPs with 10 > million+ customers or products that are in wide use. I > can't see a spammer adjusting anything just because they > read on a website that Ihug with 80,000 customers uses > Spam Assassin. > > DPF > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > >

1 0

Re: [nznog] IP / domain blocking for SPAM prevention
by david＠farrar.com 25 Sep '03

25 Sep '03

> david(a)farrar.com wrote: > > > Oh I agree they do - but at the scale of the ISPs with > > 10 million+ customers or products that are in wide use. > > I can't see a spammer adjusting anything just because > > they read on a website that Ihug with 80,000 customers > > uses Spam Assassin. > > And yes, spammers do try to get past Spam Assassin as > well. This is probably getting to the point of off topic, but I never said they didn't. But they try to get past spam assassin because it is a widely used spam filter, not because they are going to go a NZ website, read that hey Black Albatross use Spam Assassin, so hey I'd better try and get around it. DPF

1 0