Why can't DNS servers perform spam or mal-ware blocking/filtering?

[Jeffrey F. Bloss]

I think you are going to have a hard time finding evidence that a spam
challenging system resulting in such a mailbox overload that someone
experienced the effect of a DOS.

Why focus on that? ...

I assumed this was the original premise, and that some example might exist.
I really am only interested in getting a grip on what sort of real life
problem it is. I understand that the numbers work out so that the
possibility exists, but I assumed the numbers of C/R addresses were small
enough that the problem was insignificant. This week anyway.

--
Hand crafted on October 14, 2005 at 12:06:05 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Jack]

For the average driver and net stumbler

A "net stumbler" is a slang/technical term that you have evidently
stumbled across, but failed to grok. It refers to a person who uses or
searches for WiFi gateways that have been left unsecured.

http://www.netstumbler.com/

Never mind:

there is no difference. They buy the car and assume the locks work as
advertised, or they add on "The Club" or some alarm system. They Buy
the PC with the OS installed and assume the security works as
advertised, or they add on a firewall, AV/AS software, etc. In
*NEITHER* case is the user anything of what you'd call a
"technition". They have no more clue about how their car locks and
alarms work than they do their network configuration. They insert
their keys or passwords, and drive away.

The analogy is perfect, you are incorrect.

No analogy is perfect, otherwise it wouldn't be an analogy; it would
simply be an account.

Anyway, the analogy is perfectly awful.

If the analogy were appropriate, then all computers (apart from those
designed in France, perhaps would have consistent user-interfaces,
and it would be illegal to operate them on the internet without first
taking a test, and purchasing a licence and at least third-party
insurance. Net-cops would pull you over if you were hogging bandwidth or
under-taking (e.g. forging packets), and give you a ticket. You would be
required to submit your equipment for regular inspections by qualified
experts, and it would be illegal to operate it without an up-to-date
certificate of internet roadworthiness.

You are right in only one respect: computer manufacturers and buyers
alike treat computers as if they were consumer products, like cars (or
perhaps even electric kettles). This is a massive fraud that is
perpetrated by the industry (in which I work) on consumers. It is a
disgrace that the industry has failed to deliver to the market a
consumer-grade computing appliance, some 20 years after the introduction
of computers as retail products. It could have been done 15 years ago.

[Correction: you can now buy a webcam that has an ethernet port and a
TCP stack; and I think that is about as close as the industry has come
to delivering an internet appliance to the consumer market]

Only a decade or so ago, cars were machines that the average consumer
could reasonably expect to be able to learn to dismantle, repair and
reassemble himself. This is no longer possible; modern cars are equipped
with smart electronic components (read: computers) that are not
user-servicable. I learned the little I know about motor-car maintenance
on a Morris Minor - a machine on which the fuel-pump was so simple that
it could be dis-assembled into its constituents, and every part could in
principle be re-manufactured by an amateur (I think that pump had about
10 parts, including the screws).

Even If we stick to newer models, then cars are many orders of
magnitude less complex than computer systems. It is theoretically
possible to build a general-purpose digital programmable computer from
levers, cogs and wheels, and the like; but the resulting mechanism would
be overwhelmingly complicated, and it would also be delicate to the
point of being more-or-less unusable.

A piece of software such as an operating system is massively more
complex than the computer itself. I have heard educated, intelligent,
competent software technicians state that "computers are magic", meaning
that they are so complex that their behaviour is frequently inexplicable.

I forsee a future in which general-purpose computers (in the sense of
computers on which you can install arbitrary software) will no longer be
retail products; they will be purchased only by computer technicians.
Instead, consumers will buy a word-processor, or an accounting machine,
or a "internet device" that provides a browser and an email client.
These appliances will not need software patches or bug-fixes, because
they will be shipped with defect-free software. Such devices *will* be
analogous to cars - if a bug were found in such a computing appliance,
one would be entitled to return it to the manufacturer for repair,
exchange or refund.

Similarly, if one wanted an improved model of browser, one would have to
purchase it. What one chose to do with the old model would be a matter
of choice - one could, for example, give it to one's teenage child, when
they are learning to drive; or one could simply discard it. Upgrading
such devices would be an activity for enthusiasts and hobbyists - a bit
like customising cars. Such upgrades would, of course, violate the terms
of the warranty.

This is the opposite of the present situation, where software
manufacturers will refuse to even discuss support issues with their
customers, unless they are working with, at the earliest, the current
version less 1.

Infants don't steal cars. Criminals do. Infants don't crack into
computers and set up phishing scams either. That would those
criminals again.

Nor are infants charged by their parents with ther responsibility of
securing the home at night (at least not by responsible parents). My
references to "infants" was meant to denote the owners and lawful users
of the computers, i.e. Mr. and Mrs. Average. It is perfectly clear from
my previous post that I wasn't trying to refer to black-hat hackers as
"infants". Perhaps you got confused by the common usage of the term
"script-kiddie".

The only thing you're doing here is attacking the average user
because their software has holes, and you don't think they fit some
arbitrary standard of competence you've pulled out of thin air.

I'm *not* attacking the average user; I'm saying that computers are
*not* consumer appliances, and are *not* suited for use by the average
person, at least not on the public highway. At least, not yet.

Calling people who have their computers broken into "infants" can
bite you in the ass a couple different ways. First, you'll look like
a buffoon when someone cracks yours.

Even grown-ups can have motor accidents, or have their home broken into.
Driving is a complex task. Tea-leaves will figure out how to break even
the most sophisticated lock. Even network security consultants get
hacked. Perhaps you've never had a motor accident; if you have, you
probably felt like a buffoon, even if it was the other guy's fault.

But enabling untrained consumers to connect computers to the internet
should be a crime, rather like giving a five-year-old the keys to a car,
and telling them they can drive on the freeway.

When cars can drive themselves, and all you have to do is "dial" the
destination, then five-year-olds can in principle be given charge of a
motor car. Similarly, when computing equipment is safe for retail sale,
then Mr. and Mrs. Average can (reasonably-) safely be allowed to connect
their equipment to the internet. It still won't be possible to guarantee
their security, but their power to damage other road-users through
ignorance will be greatly mitigated.

Second, there's always someone out there whose competency is a bit
higher than yours, and you open yourself up to them suggesting you
remove your incompetent self from the internet "gene pool". And with
every justification as far as I'm concerned. What goes around, comes
around.

Well, as I've pointed out, the term "infant" wasn't intended to refer to
either a victim or a perpetrator of crime; it was meant as an analogy
for a person who is unfit to operate computing equipment on the
internet, whether that be due to age, stupidity, mental illness or lack
of training. I was comparing Mr. and Mrs. Average doing their surfing,
with an infant driving a car.

Argument by analogy usually fails, sooner or later, and it was you that
chose to argue from the comparison of computers with cars.

All of this probably makes it sound as if I'm against Joe Average being
allowed to use the internet. I'm not; the fact that Joe buys internet
services makes the ISP business a commodity business, and it makes it
cheap for me. I get very little spam in my inbox these days; I don't
fall for phishes or 419s, and I generally inspect incoming spam as
RFC2822 source, if I can be bothered at all.

 

[Jack]

There's no disclaimer in the world that's going to hold up if they
modify something so intrinsic to the service, and someone challenges
it. It's like entering into a contract with an auto leasing company
for a revolving fleet of cars where they reserve the right to adjust
color, model, etc. as they see fit, then having them suddenly offer
you something with a tire missing.

Ain't gonna cut it. Sorry.

Computers are unlike cars.

Xerox "implemented" things probably before you were born. Certainly
before much of the technology that can secure things existed, or
before it was widely accepted that it was needed. In fact, Xerox has
had a hand in developing some of that technology, using oddly enough,
their antiquated communications infrastructure.

Xerox appears to have been a company staffed by wizards, and run by
morons. Judged by the computing inventions they created, they should by
now have become the rulers of the planet. Instead, they have gone the
way of IBM, and become a firm of "consultants". They hired some
brilliant inventors, but the company itself seems to be a bit of a dog.

There's another thing you may or may not be aware of, and that's the
fact that Xerox "employees" who own or work in your local copier
store are all independent contractors. And there's a TON of them.
Getting updates to the customer database and minor upgrades to the
software that's used to calculate bids is a major production, and
it's a daily, weekly or monthly routine with all the "bugs" ironed
out. Hell, setting up a conference call with a "hub" office is a
major production that has to be scheduled weeks in advance. If you
think a dinosaur of that size can be reworked in a weekend you're
simply ignorant of the problem. It *may* not be financially feasible
to rework it at all.

I'm not surprised. As I said, they seem to be run by morons.

I've given you at least two examples now that prove differently. Your
"solution" was VPN, but for obvious reasons this isn't going to be
possible in every situation.

I'm not aware of any obvious situation in which it is inappropriate or
impossible to use VPN for accessing corporate network services.

Which is it? Either it's not a problem, or you have a solution. I can
demonstrate that either is incorrect, but I hate to have to do it
repetitively because you want to jump back and forth.

Well, try doing it once.

Yup, and guess what... SBC had to implement a semi automated "opt
out" for anyone who has some need to access an external SMTP server.
So many people chose that opt out they're considering opening up *:25
again. They're having trouble keeping up with the requests. That's
unconfirmed rumor mind you. The part about the policy change, not the
opt out.

Yes. Well, SBC are a telephone company, that tries to be an ISP. I'm not
at all surprised that their ISP arm is under-managed and under-staffed.
Most of the world's spam is emitted by the ISP arm of some telco or other.

My how arrogant and egocentric. "Leythos" is the only IT guy with his
act together. All those guys out there with their own problems you
know absolutely *nothing* about are just incompetent, huh?

This conversation is over.

Whoooo! Check her!

Not everyone that disagrees with you is "arrogant and egocentric". You
may refer to me that way, though, because I don't give a monkey's cuss.

Oh, BTW, this is Usenet; the "conversation" ends when it ends, not just
when you choose to butt out of it.

 

[Jack]

I assumed this was the original premise, and that some example might
exist. I really am only interested in getting a grip on what sort of
real life problem it is. I understand that the numbers work out so
that the possibility exists, but I assumed the numbers of C/R
addresses were small enough that the problem was insignificant. This
week anyway.

CR product vendors obviously would prefer that *everyone* used CR. If
you understand the problem that would cause, then presumably you can see
why (naive) CR is not a viable solution.

 

[Art]

You are right in only one respect: computer manufacturers and buyers
alike treat computers as if they were consumer products, like cars (or
perhaps even electric kettles). This is a massive fraud that is
perpetrated by the industry (in which I work) on consumers. It is a
disgrace that the industry has failed to deliver to the market a
consumer-grade computing appliance, some 20 years after the introduction
of computers as retail products. It could have been done 15 years ago.

It was done. There were a number of personal computers available
twenty five years ago that had no internet access. Exactly which user
freedoms do you propose doing away with to arrive at a product safe
enough to market to the general public? Would it sell?

You're really stuck with the lack of user education as being the
primary problem as long as internet access, browsing and email
are required of a home computer. With sufficient user knowledge,
all the problems being discussed here evaporate. Any currently
available PC and OS is suitable for use by sufficiently educated
users. Any product "dumbed down" to the level of being ok for typical
users won't sell.

Art

http://home.epix.net/~artnpeg

 

[Jeffrey F. Bloss]

No analogy is perfect, otherwise it wouldn't be an analogy; it would
simply be an account.

Within the context of "analogy" some are better than others. Mine happens to
be spot on, which is why you're left trying to tap dance around it with
semantical quibbles and attempted misdirections like this...

If the analogy were appropriate, then all computers (apart from those
designed in France, perhaps would have consistent user-interfaces,
and it would be illegal to operate them on the internet without first
taking a test, and purchasing a licence and at least third-party

[...]

What exactly does *any* of this have to do with the fact that a property
owner who has that property wrongfully misused by others is a victim?

Nothing at all, that's what. The fact that the two tools are purchased,
licensed, and operated differently *is* what makes my example an analogy
rather than an account, but none of that in any way invalidates that
analogy.

You are right in only one respect: computer manufacturers and buyers
alike treat computers as if they were consumer products, like cars (or

They are. You go to the computer store, pick your favorite model, decide on
what accessories you'd like, pay the bill and drive it home in the other
consumer product you used to get there.

Only a decade or so ago, cars were machines that the average consumer
could reasonably expect to be able to learn to dismantle, repair and
reassemble himself. This is no longer possible; modern cars are equipped
with smart electronic components (read: computers) that are not
user-servicable. I learned the little I know about motor-car maintenance

ROTFL!

Are you *truly* trying to suggest that the average owner of a 1995 Chevy
expected to rebuild it's motor... swap out a tranny...?

LOL!

That's way over the top, Jack. Thanks for the nyuck.

A piece of software such as an operating system is massively more
complex than the computer itself. I have heard educated, intelligent,
competent software technicians state that "computers are magic", meaning
that they are so complex that their behaviour is frequently inexplicable.

What does complexity have to do with anything? To the average user, the
principals of internal combustion are no less mysterious than the inner
workings of an operating system. They're no more likely to have memorized
the blueprints of their car's locking mechanism than they are to have
poured over the source code to their AV software.

That *is* what makes both consumer products, by the way.

I forsee a future in which general-purpose computers (in the sense of
computers on which you can install arbitrary software) will no longer be
retail products; they will be purchased only by computer technicians.
Instead, consumers will buy a word-processor, or an accounting machine,
or a "internet device" that provides a browser and an email client.

That's nothing more than a different type of product. An evolved version of
a tool. Nothing more, nothing less.

These appliances will not need software patches or bug-fixes, because
they will be shipped with defect-free software. Such devices *will* be

Riiiiight... defect free. Please do feel free to provide us with an example
of *any* product at all where we can't find examples of defects.

Your perfect machine is a pipe dream. Not possible.

analogous to cars - if a bug were found in such a computing appliance,
one would be entitled to return it to the manufacturer for repair,
exchange or refund.

We do that with computers and software now. Right up to the point where your
warranty or support contract expires. Just like the warranty on your car
does after a set time.

<whew>

I really don't know where you were trying to go with this, but you lost your
way somewhere I think.

Similarly, if one wanted an improved model of browser, one would have to
purchase it.

Ummm... I thought the one you already had was "perfect"?

This is the opposite of the present situation, where software
manufacturers will refuse to even discuss support issues with their
customers, unless they are working with, at the earliest, the current
version less 1.

Sorta like the auto dealer tells you to stuff it when you drive up in your
12 year old heap and ask for a free valve job?

Sorta like you have to either pay that dealer his inflated price, buy a new
model, or take the heap to a third party repair shop?

I suppose at this point I should be thanking you for demonstrating just how
good my analogy really is.

Nor are infants charged by their parents with ther responsibility of
securing the home at night (at least not by responsible parents). My

No, but adults are. And adults have both their homes and computers broken
into. Some misguided stretch of illogic seems to make you believe that the
owner of an invaded home is a victim, but the owner of an invaded computer
is a "child". That's absolutely absurd.

Let's consider the possibility that a home owner doesn't lock their doors at
night. If a crook walks in and steal the TV do the police tell the owner
"tough titty" because not locking your doors negates that crime?

Of course not.

It might not be the wisest thing to do in most neighborhoods, but leaving
your doors unlocked is *not* an invitation for someone to rob you.
Likewise, hooking your computer up to the net isn't an invitation for some
computer crook to take control of it for their own nefarious goals. Even if
you leave the damned thing wide open, Jack. It's stupid, yes, but it
doesn't negate the crime in *any* way, or make the victim any less of a
victim.

Why is it some people just can't seem to grasp this simple logic? Is it
because of that "computers are magic" superstition you were talking about
earlier? Or is it some elitist thing that causes people who mistakenly
believe they're a bit smarter than the average user to look down their
noses at the "noobs"?

Either way it's an abominable attitude.

references to "infants" was meant to denote the owners and lawful users
of the computers, i.e. Mr. and Mrs. Average. It is perfectly clear from

My knowledge of cars may make you look like an "infant" to me. Does that
mean if yours is stolen I have the right to call you childish names and
blame your "gross incompetence" for the actions of a thief?

I'm *not* attacking the average user; I'm saying that computers are
*not* consumer appliances, and are *not* suited for use by the average
person, at least not on the public highway. At least, not yet.

So the fact that people's cars are stolen, or that motorists die in auto
accidents because because cars aren't equipped with teleportation beams
that remove the motorist from the vehicle 11.4 milliseconds before impact
makes automobiles "unfit for consumer consumption"? Right?

Pullllllease!

Anything can, and *will*, be used incorrectly. Any driver or any computer
user can shoot themselves in the foot with equal competency. The only major
difference being people don't typically expire from the mistakes they make
behind the keyboard. Which I suppose makes computers *more* of a consumer
product than cars in your "potential for disaster" world. Right?

Even grown-ups can have motor accidents, or have their home broken into.
Driving is a complex task. Tea-leaves will figure out how to break even
the most sophisticated lock. Even network security consultants get
hacked. Perhaps you've never had a motor accident; if you have, you
probably felt like a buffoon, even if it was the other guy's fault.

But enabling untrained consumers to connect computers to the internet
should be a crime, rather like giving a five-year-old the keys to a car,
and telling them they can drive on the freeway.

Nonsense. Rules governing driving are there because five year olds behind
the wheel are likely to kill themselves and others. Five year olds behind
keyboards are only likely to post to Usenet. <grinning>

In this respect the two are completely incongruous. Automobiles carry a
liability and penalty for misuse that just isn't present with computers.

Well, as I've pointed out, the term "infant" wasn't intended to refer to
either a victim or a perpetrator of crime; it was meant as an analogy
for a person who is unfit to operate computing equipment on the

Exactly what I meant. But if that's the way you want it, fine. As someone
who *has* taken apart the source code for an operating system, made custom
changes and complied his own, and as someone who *has* build a computer
from components (I mean chips and boards, not cards and cases), and as
someone who *has* had experience setting up and operating an ISP, I deem
you an "infant" and therefore unfit to operate your computer on the net.

You are hereby given 2 minutes to relinquish control of that tool to some
competent adult such as myself, until such time as you can demonstrate to
my satisfaction that you meet *my* criteria.

See how that works?

internet, whether that be due to age, stupidity, mental illness or lack

I agree. Because you don't know as much as I do you're obviously a retarded
senior suffering from Alzheimer's. I'd grind your useless carcass under my
heel, but you're obviously not worth the effort. Just step away from that
complex machine and go sit in the corner drooling on yourself quietly.

Your rules kiddo... not mine.

All of this probably makes it sound as if I'm against Joe Average being
allowed to use the internet. I'm not; the fact that Joe buys internet
services makes the ISP business a commodity business, and it makes it
cheap for me. I get very little spam in my inbox these days; I don't

The fact that your biggest concern is your wallet tells much about you, and
goes a long way in explaining the rest of your offering. Thank you for a
shining example of "me" generation mentality.

<nfgaa>

--
Hand crafted on October 14, 2005 at 12:56:15 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Leythos]

There's no disclaimer in the world that's going to hold up if they modify
something so intrinsic to the service, and someone challenges it. It's like
entering into a contract with an auto leasing company for a revolving fleet
of cars where they reserve the right to adjust color, model, etc. as they
see fit, then having them suddenly offer you something with a tire missing.

Ain't gonna cut it. Sorry.

To bad it's already done by ISP's and others. When you bought their
service you AGREED to allow them to modify the services provided at any
time - at least that's the case with most ISP's.

You keep talking about *I* and how *you* would do things, but you fail to
realize you're not the only IT guy on the planet, and your ideas aren't the
only valid ones.

No, but most of "US" that do it the proper way, based on what we've
seen, and those of "US" that understand what the ISP's are doing and
will be doing, have already implemented changes that make blocking
outbound SMTP from Dynamic IP addresses a non-issue.

Xerox "implemented" things probably before you were born. Certainly before
much of the technology that can secure things existed, or before it was
widely accepted that it was needed. In fact, Xerox has had a hand in
developing some of that technology, using oddly enough, their antiquated
communications infrastructure.

Which would mean that they understand communications and that there are
simple ways to implement email connections with users (long before the
Internet was publically accessable) and how it's changing and how easy
it is to start implementing a solution that doesn't require residential
users to directly connect to their SMTP service over the public Internet
connection.

There's another thing you may or may not be aware of, and that's the fact
that Xerox "employees" who own or work in your local copier store are all
independent contractors. And there's a TON of them. Getting updates to the
customer database and minor upgrades to the software that's used to
calculate bids is a major production, and it's a daily, weekly or monthly
routine with all the "bugs" ironed out. Hell, setting up a conference call
with a "hub" office is a major production that has to be scheduled weeks in
advance. If you think a dinosaur of that size can be reworked in a weekend
you're simply ignorant of the problem. It *may* not be financially feasible
to rework it at all.

So what are you saying, Xerox doesn't have an ability to setup secure
connections or to setup simple VPN solutions between remote
offices/workers? We have offices all over the USA and clients with
offices all over the USA + China, India, Singapore and a couple other
countries - we setup VPN's between all their locations and they work
fine. This also permits users in Hotels, homes, other locations to VPN
into the branch or main office to work, and it's easy to setup and
manage.

Anecdotal evidence. Meaningless. I've given you several examples of
situations where it *is* necessary. Your experience in no way translates to
the needs or desires of others. Sorry.

It really doesn't matter what others "want" it's about applying a
technology solution to a business need - and there are many means around
the blocking of residential SMTP outbound connections. It doesn't matter
if you "like" it or not, it's going to happen more and more, and the
solution is actually very simple to implement.

I've given you at least two examples now that prove differently. Your
"solution" was VPN, but for obvious reasons this isn't going to be possible
in every situation. Now you're back to arguing that closing down *:25 won't
have an impact again.

No, you've said that a major technology company, that designed much of
the communications we use, can't provide that level of communications
solutions to it's own employees.

The only impact is to the people that are still doing business the OLD
way, a ways that's changing, a way that's already being blocked by many
IPS's.

Which is it? Either it's not a problem, or you have a solution. I can
demonstrate that either is incorrect, but I hate to have to do it
repetitively because you want to jump back and forth.


Yup, and guess what... SBC had to implement a semi automated "opt out" for
anyone who has some need to access an external SMTP server. So many people
chose that opt out they're considering opening up *:25 again. They're
having trouble keeping up with the requests. That's unconfirmed rumor mind
you. The part about the policy change, not the opt out.

That's great - and that's the way it should be. Allow knowledgeable
people to OPT out. I also thing that all ISP's users modems/routers
should default to NAT with no inbound forwarding unless the customer
specifically asks for a Public IP.

My how arrogant and egocentric. "Leythos" is the only IT guy with his act
together. All those guys out there with their own problems you know
absolutely *nothing* about are just incompetent, huh?

No, I'm not the only one, there are at least 47 companies that we
consult with and others that we designed the networks for that agree,
we're not stuck with the old ways of doing things just because of the
"It's always worked and will always work" type of managers.

This conversation is over.

based on your inability to see that you're wrong, I agree.

 

[Leythos]

The only thing you're doing here is attacking the average user because their
software has holes, and you don't think they fit some arbitrary standard of
competence you've pulled out of thin air.

In this day and time with all of the public announcements of hackers,
viruses, malware, people's computers being cracked, the news print, news
on TV, etc... Now count all the people that know someone that's been
cracked, hacked, infected....

The only way that people can own a computer and not protect it from the
above is by being too stupid to own a computer. Ignorance is not an
excuse, willful ignorance is unacceptable.

I've had many home users accounts pulled because their machines were
probing our networks endlessly, and I'm happy they got their account
disabled by their ISP - it will teach them a valuable lesson about being
responsible for their use of a public resource.

 

[Jack]

Any product "dumbed down" to the level of being ok for typical users
won't sell.

I think you are right - as long as driving around on the internet while
unfit due to incompetence or stupidity remains the norm. It's obviously
cheaper to buy a general-purpose computer and install multiple
software-packages on that, than to buy an appliance for each networked
task you want a machine for.

Of course, the word "obviously" demands that the sentence in which it is
used is subjected to special scrutiny. In this case, it appears to be
cheaper for the purchaser. But they will be rapidly infected with a
virus; and "worming" a PC is apparently quite costly. It seems to
require that you:

[a] deliver your PC to the de-worming shop, or
[a.1] Pay UKP35.00 as a call-out charge.
pay UKP50.00 per hour, for work that may or may not succeed, and
for which there is no useable estimate
[c] risk having your hard-disk reformatted, as a part of the
de-worming process.

So my view is that actually, appliances will be cheaper. After all, a
lot of the cost of a PC comes down to the software, and the trouble
involved in supporting it. There is some good research supporting the
idea that shipping defect-free software is cheaper (for the
manufacturer) than shipping buggy stuff and then fixing the bugs as the
punters report them.

And I don't think it's a question of "dumbing down" - it's a question of
producing products that work, first-time, without updates or patches.
The term "bug", as used in the software-manufacturing industry, refers
to what in any other manufacturing industry is called a "defect". I once
worked for a company that explicitly referred to bug-reports as "defect
reports". I have adopted the same terminology; calling these errors
"bugs" makes them seem somehow less objectionable than (for example) a
car-tyre that has a tendency to explode in warm weather. A mistake in
product-design or product-engineering leads inevitably to a defect in
the product - not an unavoidable accident, for which the consumer is
somehow responsible.

Software products should be defect-free, same as any other product. One
day we'll get there; meantime, we seem to be stuck with Micro$oft.

BTW: I once heard an apocryphal story about a newbie Micro$oftie who
complained loudly about a particularly notorious bug in the MS-DOS
graphics FILL code (if the polygon to be filled had apices with abuse
angles, the routine didn't work). It seems he was overheard, and
promptly sacked. The person who overheard his remarks was the CEO, who
was also the person responsible for writing the defective code - a
certain Mr. Gates.

Maybe it isn't true, but it should be - it certainly figures.

 

[tim]

Just out of curiosity, why would you consider challenge/response methods,
like the ones implemented by almost every mailing list in existence to
thwart the subscription of a third party, "insane"?

I see others have answered far more eloquently than I ever could
So lets just say, I personally find C/R even more annoying than those
frickin return receipts. Neither of them get answered. And I don't
include a confirmed opt-in with a unique token from some sane mailing
list software as C/R.

 

[Guest]

Although this thread started as a discussion on how a DNS server can
(or should) impliment selective domain blocking based on various
rules, it has changed to a discussion on why ISP's should (or
shouldn't) block port-25 on it's network (or, in other words, to
configure their network such that the only e-mail that leaves their
network comes from their own SMTP servers and not directly from their
customers computers).

For those that are adament that they must have the ability to directly
send e-mail to the internet from their own PC's, consider this and
explain why it won't work for you:

1) we are considering a typical home or residential high-speed
internet service, otherwise known as "broad-band", supplied either
through your phone line (ADSL) or cable TV provider (cable-modem).
You have a conventional "internet" service, your IP is assigned
dynamically, your ISP (let's say your ISP is ACME) has a pop server
(pop.acme.com, IP = 1.2.3.4).

2) you are affiliated with another organization (your place of work, a
school, special interest group, etc). In any case, an important (or
perhaps main) source of e-mail is handled by some other machine.
Let's say you work for Xerox, and the mail server there is
pop.xerox.com (IP = 9.8.7.6).

So ok, you're at home, and you have an e-mail client (outlook, eudora,
communicator, pine, etc). That software has a setting (setting #1)
for your "e-mail address" or your "reply-to address" (or both). It
has a setting (#2) for the identity of your out-bound server. It has
a setting (#3) for your in-bound server.

Let's say Acme puts a block on out-bound port-25 on their network
boundary.

So here's what you do:

Setting #1 is set to "(e-mail address removed)".
Setting #2 is set to "1.2.3.4" or "pop.acme.com".
Setting #3 is set to "9.8.7.6" or "pop.xerox.com".

You work from home. You fire up your e-mail client, and you check for
new mail. Any mail for you sitting on pop.acme.com is transfered to
your home computer.

You have to reply to one of the e-mails. You hit "reply", you
hand-craft a reply, and you hit send. The e-mail is handed off to
"pop.acme.com", where it does all necessary MX-stuff and gets the ID
of the recipient's SMTP server and sends it there. The recipient
looks at his in-box, and sees an e-mail from "(e-mail address removed)". He
doesn't know that it physically came from joe at home.

What on earth in the above scenario is so hard to do or limiting that
it wouldn't act as a sufficient substitute or work-around for acme
blocking port-25?

 

[Jeffrey F. Bloss]

Spam Guy wrote:

You have to reply to one of the e-mails. You hit "reply", you
hand-craft a reply, and you hit send. The e-mail is handed off to
"pop.acme.com", where it does all necessary MX-stuff and gets the ID
of the recipient's SMTP server and sends it there. The recipient
looks at his in-box, and sees an e-mail from "(e-mail address removed)". He
doesn't know that it physically came from joe at home.

What on earth in the above scenario is so hard to do or limiting that
it wouldn't act as a sufficient substitute or work-around for acme
blocking port-25?

Here's two reasons off the top of my head...

First, the From: header isn't the only identifying characteristic of an
email. There's Received, Message-ID, Return-Path, etc. Any one of them and
possibly others show that the mail did not come from a "Xerox" server. To
some customers this is a big deal.

Second, in many business environments company emails *must* go through
company servers for QA, auditing, and legal reasons. Employees simply
aren't permitted to do business any other way.

The fact that there's valid reasons to use third party servers isn't in
question really, it's a debate on of the amount of "damage" that's caused
by blocking *:25, and the viability of implementing alternative access to
those third party servers.

--
Hand crafted on October 15, 2005 at 00:48:59 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Mark G]

So here's what you do:

Setting #1 is set to "(e-mail address removed)".
Setting #2 is set to "1.2.3.4" or "pop.acme.com".
Setting #3 is set to "9.8.7.6" or "pop.xerox.com".

You work from home. You fire up your e-mail client, and you check for
new mail. Any mail for you sitting on pop.acme.com is transfered to
your home computer.

You have to reply to one of the e-mails. You hit "reply", you
hand-craft a reply, and you hit send. The e-mail is handed off to
"pop.acme.com", where it does all necessary MX-stuff and gets the ID
of the recipient's SMTP server and sends it there. The recipient
looks at his in-box, and sees an e-mail from "(e-mail address removed)". He
doesn't know that it physically came from joe at home.

What on earth in the above scenario is so hard to do or limiting that
it wouldn't act as a sufficient substitute or work-around for acme
blocking port-25?

That will work for some networks. Unfortunately, some ISPs require
that the from: be something at ISPdomain dot com.

I've been watching this thread and I don't understand the issue with
port 25 blocking. I've been dealing with port 25 blocking for years.

The few times I needed to mail from my domain,instead of
Earthlink/Mindspring, I used port 587 to connect. I would imagine that
most competent providers would support the use of port 587 with
appropriate authentication.

So, either VPN or a port 587 connection should solve any problem with
using a mailserver other than the ISP's for most users.

 

[Norman L. DeForest]

Over 200 is a start. To be sure, I've had personal accounts that were
subject to this sort of SPAM (not bounces) over the course of a day or two
quite routinely. It really wasn't a huge hairy problem to keep things under
control, but it *is* a problem. I was looking for something that fit the
premise that "thousnads" of bounces basically ammounted to some sort of
denial of service.

Not discrediting your example. I see the problem here, but I'm trying to
wrap my tiny brain around its actual scope.


I've only seen these sort of bounces two or three times in my entire life,
and the numbers were in the single digits. I've seen people asking "what
the hell is this" questions about similar levels on a number of occasions.
I think some of them were probably right here in this group, from people
thinking they had some flavor of mass mailing worm. But I don't ever recall
having heard of anything even in the "200" range so my opinion was at least
that skewed by limited experience.


When I get the time I fully intend to do so.

Quoting from one report at the Chebucto Community Net Annual General
Meeting:

http://www.chebucto.ns.ca/Chebucto/AGM-2002/policy.shtml

[snip]
: >> AGM 2002 Policy Committee Report
:
: Serving Your Community's Online Needs Since 1994.
[snip]
: There were several cases of users being abused however, when viruses
: and spammers used some innocent third party's email address as the
: forged reply address on their junkmail. In one case, the user received
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: thousands of bounced messages a day for a three week period due to a
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: badly organized spammer bulk mailout. The Policy Committee generally
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: gets a complaint or two a month from people spammed with email falsely
: claiming to come from Chebucto and only examining the originating IP
: address of the email in the full message headers tells the true source
: of the spam (which was not Chebucto in each case).
:
: The onslaught of spam and virus laden email this year has been
: staggering. We are filtering out hundreds of viruses a day from
: incoming Chebucto email and thousands upon thousands of spam messages.
: In the last year it is estimated that spam has gone from making up 8%
: of all email to making up 40% - 50% of all email. The burden of
: dealing with this on the different levels called for, from technical
: solutions to policy decisions, has been a heavy one, taking personnel
: and technical resources that could have been used more productively
: elsewhere.
[snip]

 

[Jack]

Jeffrey F. Bloss wrote:

[Lots of snipped rhetoric with no significant content]

Riiiiight... defect free. Please do feel free to provide us with an
example of *any* product at all where we can't find examples of
defects.

Your perfect machine is a pipe dream. Not possible.

I'm not demanding perfection; I'm saying that a retail product should be
fit for the purpose for which it is sold; it should work, and it should
not require upgrades or patches to make it work.

It's different in the business environment; a lot of business software
is heavily-customised, like a hand-made car. You pay a lot for it, and
part of what you are paying for is the people who get to fix the
inevitable defects.

We do that with computers and software now. Right up to the point
where your warranty or support contract expires. Just like the
warranty on your car does after a set time.

Bollocks. If I find a defect in a software product, and report it, I get
told to wait fore the next patch-release. I'm not told when that release
is expected. And it's not in any way guaranteed that the next release
will fix the defect I reported.

<whew>

I really don't know where you were trying to go with this, but you
lost your way somewhere I think.

I may have lost you, but I know exactly where I started, and where I was
going. If it's too much for you, quit the "conversation" (I thought you
said you had already terminated it).

Ummm... I thought the one you already had was "perfect"?

You use quotes, as if I had used the word "perfect". I didn't. I said
that the consumer's expectation would be that software would be free of
defects. I take it you are familiar with the difference between a
bug-fix and an enhancement?

Sorta like the auto dealer tells you to stuff it when you drive up in
your 12 year old heap and ask for a free valve job?

Yuh, sorta - except that your 12-year-old heap was bought in 2002; and
the defect isn't snarled valves, but a TCP stack that was ****ed at the
time it was sold.

Sorta like you have to either pay that dealer his inflated price, buy
a new model, or take the heap to a third party repair shop?

Exactly like that, not sorta.

I suppose at this point I should be thanking you for demonstrating
just how good my analogy really is.

Your analogy is awful. The only thing it's good for is for demonstrating
how crap the software industry is, by comparison with the used-car industry.

No, but adults are. And adults have both their homes and computers
broken into. Some misguided stretch of illogic seems to make you
believe that the owner of an invaded home is a victim, but the owner
of an invaded computer is a "child". That's absolutely absurd.

Most home computer users have not the faintest idea of the nature of the
threats they are facing when they connect to the internet. Fergawdssake,
they let their children download and install server software! This is
like allowing your kids to replace the brake system on your SUV. It's mad.

Let's consider the possibility that a home owner doesn't lock their
doors at night. If a crook walks in and steal the TV do the police
tell the owner "tough titty" because not locking your doors negates
that crime?

Of course not.

And (of course) they don't get to claim on the insurance. It's called
"contributory negligence". If you can't manage home security, or if you
delegate it to children, then you are ****ed.

But what if the thing that got stolen was not your TV, but your shotgun?
What if it got used in a murder? Now you are up in court, and the words
the police will be using will be similar to "tough titty".

It might not be the wisest thing to do in most neighborhoods, but
leaving your doors unlocked is *not* an invitation for someone to rob
you. Likewise, hooking your computer up to the net isn't an
invitation for some computer crook to take control of it for their
own nefarious goals. Even if you leave the damned thing wide open,
Jack. It's stupid, yes, but it doesn't negate the crime in *any* way,
or make the victim any less of a victim.

I guess you live in the USA. You folks seem to think that the law is a
solution to everything. It isn't. There is no law on the internet, and
it's down to each of us to deal with the big, bad world as best we can.
That means blocklists, firewalls, and blocking port 25 outbound.

Why is it some people just can't seem to grasp this simple logic?

Because it's simplistic, perhaps?

Is it because of that "computers are magic" superstition you were
talking about earlier?

The whole point of that remark was specifically that the person who made
it was *not* a believer in magic. Please remove your head from your arse
before typing an utterance.

Or is it some elitist thing that causes people who mistakenly believe
they're a bit smarter than the average user to look down their noses
at the "noobs"?

Either way it's an abominable attitude.

The "abominable attitude" to which you are referring seems to be the
view that certain computers should not be allowed to connect to the
internet; and if those computers can find an ISP that *will* connect
them, then the ISP should be boycotted. Is that what you are saying?

So if that is your position, you seem to have given up. Everyone will be
exposed to virmware, and most people will be infected. The internet will
become an ocean of bogus packets, and we might as well all kill
ourselves. Is that the story?

My knowledge of cars may make you look like an "infant" to me. Does
that mean if yours is stolen I have the right to call you childish
names and blame your "gross incompetence" for the actions of a thief?

Heh - you just ran into the problem with analogies again. I have no car.

So the fact that people's cars are stolen, or that motorists die in
auto accidents because because cars aren't equipped with
teleportation beams that remove the motorist from the vehicle 11.4
milliseconds before impact makes automobiles "unfit for consumer
consumption"? Right?

Pullllllease!

Well, the fact that pedestrians and cyclists get knocked-down by the
drivers of stolen cars is also a relevant matter. I think the owner of
the stolen car has partial responsibility. YMMV.

Anything can, and *will*, be used incorrectly. Any driver or any
computer user can shoot themselves in the foot with equal competency.
The only major difference being people don't typically expire from
the mistakes they make behind the keyboard. Which I suppose makes
computers *more* of a consumer product than cars in your "potential
for disaster" world. Right?

It's not my world. And I do not concur with that observation, as you
know; I've taken some trouble to make the case that computers are *not*
consumer products.

Nonsense. Rules governing driving are there because five year olds
behind the wheel are likely to kill themselves and others. Five year
olds behind keyboards are only likely to post to Usenet. <grinning>

It's obviously not "nonsense". Incompetent users with always-on
connections to the internet are the immediate source of the majority of
spam. Of course spam doesn't kill; but then again, this thread isn't
being cross-posted to alt.death. If you think spam is harmless, you are
mistaken.

In this respect the two are completely incongruous. Automobiles carry
a liability and penalty for misuse that just isn't present with
computers.

Oh, so smashing up someone's mailserver is OK, but smashing up their car
isn't?

Exactly what I meant.

Well, that's exactly not what you said.

But if that's the way you want it, fine. As someone who *has* taken
apart the source code for an operating system, made custom changes
and complied his own, and as someone who *has* build a computer from
components (I mean chips and boards, not cards and cases), and as
someone who *has* had experience setting up and operating an ISP, I
deem you an "infant" and therefore unfit to operate your computer on
the net.

You've disassembled an OS? Kewl. Perhaps also a stupid waste of time,
unless you just did it for bragging rights. "Complying" an OS is of
course a routine activity for many Linux users - there's nothing there
to brag about, although I suspect you were trying to suggest that you
also wrote it.

And as you may have guessed, I don't give a shit what you do or don't
"deem".

The fact that your biggest concern is your wallet tells much about
you, and goes a long way in explaining the rest of your offering.
Thank you for a shining example of "me" generation mentality.

You are an idiot. I spend most of my time on voluntary work. You weren't
to know that, of course; but I don't belong to the generation to which
you seem to have assigned me.

 

[Norman L. DeForest]

Spam Guy wrote:



Here's two reasons off the top of my head...

First, the From: header isn't the only identifying characteristic of an
email. There's Received, Message-ID, Return-Path, etc. Any one of them and
possibly others show that the mail did not come from a "Xerox" server. To
some customers this is a big deal.

Second, in many business environments company emails *must* go through
company servers for QA, auditing, and legal reasons. Employees simply
aren't permitted to do business any other way.

The fact that there's valid reasons to use third party servers isn't in
question really, it's a debate on of the amount of "damage" that's caused
by blocking *:25, and the viability of implementing alternative access to
those third party servers.

Why can't they connect to these third party servers as per RFC 2476 by
using port 587 with appropriate authentication instead of port 25?
(Only a *really stupid* ISP would block port 587.)

 

[Robert Moir]

It's similar to what Spybot or AdAware does (or MVP hosts file) and
no-one makes the same claim that the bad guys are "moving around" the
blocks in that situation.

Sure about that? They _do_ move about onto different blocks, _when_ the pain
from all the blockers knowing their current address starts to become a
higher cost than that of moving.

 

[Art]

And I don't think it's a question of "dumbing down" - it's a question of
producing products that work, first-time, without updates or patches.

Just partially. Fancy features are the primary enemy of security. Take
email, for example. You have:

1. html
2. file attackments
3. clickable links

None of the above three are necessary for email. All that's required
is plain ASCII text. Now, malicious code might be embedded in a text
message. A "smart-dumb" email client could detect that and offer
to delete the gibberish message ... also informing the user to not
store such "dangerous looking" junk in his email archives. A extremely
high, if not practically perfect degree of security could be attained
via such "dumbing down" (getting rid of unnecessary features and
capabilities.

Personally, I fault MS far more for peddling endless complex and
dangerous features, and brainwashing the public into "always trust MS"
type of bullshit.

Art

http://home.epix.net/~artnpeg

 

[Leythos]

Although this thread started as a discussion on how a DNS server can
(or should) impliment selective domain blocking based on various
rules, it has changed to a discussion on why ISP's should (or
shouldn't) block port-25 on it's network (or, in other words, to
configure their network such that the only e-mail that leaves their
network comes from their own SMTP servers and not directly from their
customers computers).

it's still about spam blocking, what we still have is RBL's that list
Dynamic Ranges provided to mostly residential customers. This is what
started the SMTP part of the thread. Many companies that have their own
email servers use some form of blocking, RBL's are very common, and you
can use any number of RBL's on your mail server - they have ones that
list the Dynamic IP ranges of ISP's, ones that list each countries known
IP ranges, ones that are Dial-Up accounts, ones that are known spammers,
ones that are known compromised systems.....

For those that are adament that they must have the ability to directly
send e-mail to the internet from their own PC's, consider this and
explain why it won't work for you:

1) we are considering a typical home or residential high-speed
internet service, otherwise known as "broad-band", supplied either
through your phone line (ADSL) or cable TV provider (cable-modem).
You have a conventional "internet" service, your IP is assigned
dynamically, your ISP (let's say your ISP is ACME) has a pop server
(pop.acme.com, IP = 1.2.3.4).

2) you are affiliated with another organization (your place of work, a
school, special interest group, etc). In any case, an important (or
perhaps main) source of e-mail is handled by some other machine.
Let's say you work for Xerox, and the mail server there is
pop.xerox.com (IP = 9.8.7.6).

So ok, you're at home, and you have an e-mail client (outlook, eudora,
communicator, pine, etc). That software has a setting (setting #1)
for your "e-mail address" or your "reply-to address" (or both). It
has a setting (#2) for the identity of your out-bound server. It has
a setting (#3) for your in-bound server.

Let's say Acme puts a block on out-bound port-25 on their network
boundary.

So here's what you do:

Setting #1 is set to "(e-mail address removed)".
Setting #2 is set to "1.2.3.4" or "pop.acme.com".
Setting #3 is set to "9.8.7.6" or "pop.xerox.com".

You work from home. You fire up your e-mail client, and you check for
new mail. Any mail for you sitting on pop.acme.com is transfered to
your home computer.

You have to reply to one of the e-mails. You hit "reply", you
hand-craft a reply, and you hit send. The e-mail is handed off to
"pop.acme.com", where it does all necessary MX-stuff and gets the ID
of the recipient's SMTP server and sends it there. The recipient
looks at his in-box, and sees an e-mail from "(e-mail address removed)". He
doesn't know that it physically came from joe at home.

What on earth in the above scenario is so hard to do or limiting that
it wouldn't act as a sufficient substitute or work-around for acme
blocking port-25?

But there is a requirement that was mentioned that even you missed - he
said that Xerox requires that all outbound email go through their
servers for tracking. I can understand that requirement, we have the
same requirement for almost every client, but, unlike the old bahemouth
of Xerox that invented much of what we USE TO USE, we've implemented a
proper architecture to allow remote workers and partners to access the
email server without having to do outbound SMTP from residential account
addresses.

 

[Leythos]

The fact that there's valid reasons to use third party servers isn't in
question really, it's a debate on of the amount of "damage" that's caused
by blocking *:25, and the viability of implementing alternative access to
those third party servers.

It's more about the reputation and quality of the company that makes
such a requirement and then doesn't have a method to permit proper
connection to the email server for sending.

There is no excuse for not implementing a VPN, leased line, Dial-Up,
etc...