Re[2]: [Declude.JunkMail] OT: Poor man's high reliability?
...and to make things a bit more confusing...an NS query to my various servers for different domains always sends the first response in the registrar order and then it randomizes after the first request. So this means that the load should be heavier on the primary name server as registered, but the busier the domain, the more likely it would be cached, and the more likely the load would be closer to 50:50, or at least that's my read on this. The round-robin + response time algorithms should kick off with a call to randomize() the NS list. Seems you're still not considering the complexity of DNS recursor code. There's a lot happening in there; it doesn't just take any old set of responses at face value and hurry the next request out. A surprisingly large amount of sorting and prioritization can occur between one response and the next request. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: Re[2]: [Declude.JunkMail] OT: Poor man's high reliability?
For example, database-backed sites whose database can be open for writing at only one site are a *helluva* lot harder to balance. You're right about that. There is some interactivity on the site, but it all results in emails to the office, so no db sync'ing issues here. -d --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] OT: Poor man's high reliability?
Another option to consider ... www.ultradns.com has a service that does this. I've never priced it, so it may be pricey. Rob --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] OT: Poor man's high reliability?
Side ntoe: UltraDNS has been having some issues the last couple of days due to the blue security ordeal - http://it.slashdot.org/it/06/05/18/2158227.shtml Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Robert Grosshandler writes: Another option to consider ... www.ultradns.com has a service that does this. I've never priced it, so it may be pricey. Rob --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] OT: Poor man's high reliability?
UltraDNS is back in business after the kind of DoS they are supposed to be in business to defend against. Check out Brian Kreb's article here, from May-17-2006: http://blog.washingtonpost.com/securityfix/2006/05/blue_security_surrend ers_but_s.html Specifically this snippet: Well, UltraDNS marketed its DNS Shield as a protection against exactly these same types of amplification attacks. Only in this case it doesn't appear to have worked -- though, to be fair I haven't heard UltraDNS's side of the story since they have yet to return my calls. No doubt they are busy putting out fires. At any rate, score another one for the spammers, I suppose. Update, 7:46 p.m. ET: I heard back from Neustar. Their spokesperson, Elizabeth Penniman, declined to discuss anything about today's attacks, saying only that we have a handle on the situation and continue to work with service providers to ensure the best possible level of service to our customers. Andrew 8) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darrell ([EMAIL PROTECTED]) Sent: Friday, May 19, 2006 8:38 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] OT: Poor man's high reliability? Side ntoe: UltraDNS has been having some issues the last couple of days due to the blue security ordeal - http://it.slashdot.org/it/06/05/18/2158227.shtml Darrell --- Check out http://www.invariantsystems.com for utilities for Declude, Imail, mxGuard, and ORF. IMail/Declude Overflow Queue Monitoring, SURBL/URI integration, MRTG Integration, and Log Parsers. Robert Grosshandler writes: Another option to consider ... www.ultradns.com has a service that does this. I've never priced it, so it may be pricey. Rob --- [This E-mail scanned for viruses by Declude Virus] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
[Declude.JunkMail] Spam
Has anyone else seen an increase of spam since Blue Security wet offline?? We have seen an increase and we did not even use the software/service. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam
I have noticed more stuff has been getting through. I don't know whether that represents a general increase or new spammer techniques. -d - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: JunkMail Declude declude.junkmail@declude.com Sent: Friday, May 19, 2006 1:33 PM Subject: [Declude.JunkMail] Spam Has anyone else seen an increase of spam since Blue Security wet offline?? We have seen an increase and we did not even use the software/service. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam
Same here Rick -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Friday, May 19, 2006 12:01 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Spam I have noticed more stuff has been getting through. I don't know whether that represents a general increase or new spammer techniques. -d - Original Message - From: Kevin Bilbee [EMAIL PROTECTED] To: JunkMail Declude declude.junkmail@declude.com Sent: Friday, May 19, 2006 1:33 PM Subject: [Declude.JunkMail] Spam Has anyone else seen an increase of spam since Blue Security wet offline?? We have seen an increase and we did not even use the software/service. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam
On Friday, May 19, 2006, 1:33:06 PM, Kevin wrote: KB Has anyone else seen an increase of spam since Blue Security wet offline?? KB We have seen an increase and we did not even use the software/service. We've noted a few bursts today but nothing completely out of the ordinary. _M --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Spam
One thing that we noticed a few hours ago was a new image spam that has quite a bit of bandwidth behind it and all new zombies - perhaps that's a piece of it. _M On Friday, May 19, 2006, 3:30:33 PM, Rick wrote: RB Same here RB Rick RB -Original Message- RB From: [EMAIL PROTECTED] RB [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty RB Sent: Friday, May 19, 2006 12:01 PM RB To: Declude.JunkMail@declude.com RB Subject: Re: [Declude.JunkMail] Spam RB I have noticed more stuff has been getting through. I don't know whether RB that represents a general increase or new spammer techniques. RB -d RB - Original Message - RB From: Kevin Bilbee [EMAIL PROTECTED] RB To: JunkMail Declude declude.junkmail@declude.com RB Sent: Friday, May 19, 2006 1:33 PM RB Subject: [Declude.JunkMail] Spam Has anyone else seen an increase of spam since Blue Security wet offline?? We have seen an increase and we did not even use the software/service. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. RB --- RB This E-mail came from the Declude.JunkMail mailing list. To RB unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RB type unsubscribe Declude.JunkMail. The archives can be found RB at http://www.mail-archive.com. RB --- RB This E-mail came from the Declude.JunkMail mailing list. To RB unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RB type unsubscribe Declude.JunkMail. The archives can be found RB at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Spam
Yes, that looks to be what I have been seeing get through. John T eServices For You Seek, and ye shall find! -Original Message- From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- [EMAIL PROTECTED] On Behalf Of Pete McNeil Sent: Friday, May 19, 2006 12:41 PM To: Rick Baranowski Subject: Re[2]: [Declude.JunkMail] Spam One thing that we noticed a few hours ago was a new image spam that has quite a bit of bandwidth behind it and all new zombies - perhaps that's a piece of it. _M On Friday, May 19, 2006, 3:30:33 PM, Rick wrote: RB Same here RB Rick RB -Original Message- RB From: [EMAIL PROTECTED] RB [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty RB Sent: Friday, May 19, 2006 12:01 PM RB To: Declude.JunkMail@declude.com RB Subject: Re: [Declude.JunkMail] Spam RB I have noticed more stuff has been getting through. I don't know whether RB that represents a general increase or new spammer techniques. RB -d RB - Original Message - RB From: Kevin Bilbee [EMAIL PROTECTED] RB To: JunkMail Declude declude.junkmail@declude.com RB Sent: Friday, May 19, 2006 1:33 PM RB Subject: [Declude.JunkMail] Spam Has anyone else seen an increase of spam since Blue Security wet offline?? We have seen an increase and we did not even use the software/service. Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 Changing the way industry works. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. RB --- RB This E-mail came from the Declude.JunkMail mailing list. To RB unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RB type unsubscribe Declude.JunkMail. The archives can be found RB at http://www.mail-archive.com. RB --- RB This E-mail came from the Declude.JunkMail mailing list. To RB unsubscribe, just send an E-mail to [EMAIL PROTECTED], and RB type unsubscribe Declude.JunkMail. The archives can be found RB at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Spam
Dave, You might want to look at the NOCRTEST. See: http://www.mail-archive.com/declude.junkmail@declude.com/msg28884.html The problem is that the messages have no carriage returns. I am guessing here and that guess is based on a lot of circumstantial evidence that Declude was written in Visual Basic and uses standard line handling, which likes normal CrLf pairs. If you examine those messages in Notepad, you see that the only lines with CRs are the lines prepended by the mail server or appended by Declude. So basically, Declude sees one line and does not see anything to parse. It cannot even see the headers. However, if NoCr detects a message of that type and you give the NoCr test enough points to delete the message, Declude will delete the message. Those messages are definitely outside of the RFC, which specifies CRLF pairs at least in the headers, but I believe everywhere. I haven't seen one of those messages in a long long time. Michael Thomas Mathbox 978-683-6718 1-877-MATHBOX (Toll Free) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty Sent: Friday, May 19, 2006 9:47 PM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Spam I've been seeing a lot more of that headers-at-the-bottom stuff lately where the message gets scanned but no action occurs. A lot of it doesn't have broken GIFs, just text. -d --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Spam
You might want to look at the NOCRTEST. Thanks! I'll try it out. -d --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re[2]: [Declude.JunkMail] Spam
...a lot of circumstantial evidence that Declude was written in Visual Basic... Er, what evidence was that? Declude.exe was *not* written in VB, as a quick Dependency Walker check would tell you. It's clearly always been a Win32 C/C++ app. As far as the CRLF issue goes, it's clearly buggy code, but has nothing to do with language choice. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/download/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2aliases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2aliases/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: Re[2]: [Declude.JunkMail] Spam
Sandy, Shrug. Never felt the desire to run dependency walker on it. I said it was a guess. I said it was circumstantial. Maybe in the end, I was hoping it was some silly language limitation that they didn't know how to get around rather than think it was a bug or even a bad assumption on the part of the company, whose tool scans my email. Don't know which would be worse. I do not know if anyone else has, but I did report the issue to Declude. I thought their response was interesting: Snip - The fact that this email contains only linefeeds and no carriage returns shows that it is a seriously broken email. The Subject: line was added by Declude because the action called for SPAM-WARN to be added, and Declude could not locate the actual subject line. Declude is not alone in having serious problems with these emails. IMail itself put headers at the end of the message because it could not figure out where the real headers ended. At some point we will have to rewrite incoming messages to make sure that lone linefeeds do not exist; however, that will incur a lot of overhead. It would have made much more sense for IMail to have done this as the message was arriving, prior to writing it to disk in the first place. - Snip Do not know why they would want to rewrite the message. They should add a test name for the condition and say it failed the test. Michael Thomas Mathbox 978-683-6718 1-877-MATHBOX (Toll Free) -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanford Whiteman Sent: Friday, May 19, 2006 11:57 PM To: Michael Thomas - Mathbox Subject: Re[2]: [Declude.JunkMail] Spam ...a lot of circumstantial evidence that Declude was written in Visual Basic... Er, what evidence was that? Declude.exe was *not* written in VB, as a quick Dependency Walker check would tell you. It's clearly always been a Win32 C/C++ app. As far as the CRLF issue goes, it's clearly buggy code, but has nothing to do with language choice. --Sandy Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.imprimia.com/products/software/freeutils/SPAMC32/do wnload/release/ Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail Aliases! http://www.imprimia.com/products/software/freeutils/exchange2a liases/download/release/ http://www.imprimia.com/products/software/freeutils/ldap2alias es/download/release/ --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
