Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonymity when domain exists, whois not updated yet)

2005-01-13 Thread Andre Oppermann
Steven Champeon wrote: on Thu, Jan 13, 2005 at 10:25:18AM +0530, Suresh Ramasubramanian wrote: On Wed, 12 Jan 2005 23:19:47 -0500, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: On Wed, 12 Jan 2005 19:19:24 PST, Dave Crocker said: In general, that's what dkeys/iim and csv (and maybe spf) are

Re: Proper authentication model

2005-01-13 Thread Michael . Dillon
My point was that competing, differently-named and organisationally-separate suppliers of network services frequently use common suppliers for metro fibre, long-haul transport, building access, etc. Just because you buy different services from different providers doesn't mean there

Re: Proper authentication model

2005-01-13 Thread Erik Haagsman
On Wed, 2005-01-12 at 20:12, Daniel Golding wrote: The biggest problem I've seen with dial-up OOB is reliability. You really need you really need to have a good series of testing scripts to ensure that all the phone lines are working, modems have reset properly, serial ports are ok, etc.

Re: [eweek article] Window of anonymity when domain exists, whois not updated

2005-01-13 Thread Stephane Bortzmeyer
On Wed, Jan 12, 2005 at 04:11:42PM +, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote a message of 16 lines which said: And if you will trust an ISP to deliver port 25 packets then why wouldn't you trust them to deliver email messages? There are *many* ISP which provide a reasonable job when

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonym

2005-01-13 Thread Stephane Bortzmeyer
On Wed, Jan 12, 2005 at 10:59:43AM -0500, Steven Champeon [EMAIL PROTECTED] wrote a message of 98 lines which said: 0) for the love of God, Montresor, just block port 25 outbound already. If there is no escape / exemption (as proposed by William Leibzon), then, as a consumer, I scream OVER

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonym

2005-01-13 Thread Stephane Bortzmeyer
On Wed, Jan 12, 2005 at 10:59:43AM -0500, Steven Champeon [EMAIL PROTECTED] wrote a message of 98 lines which said: 1) any legitimate mail source MUST have valid, functioning, non-generic rDNS indicating that it is a mail server or source. (Most do, many do not. There is NO reason why

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonym

2005-01-13 Thread Stephane Bortzmeyer
On Wed, Jan 12, 2005 at 10:59:43AM -0500, Steven Champeon [EMAIL PROTECTED] wrote a message of 98 lines which said: 4) all domains with invalid whois data MUST be deactivated (not confiscated, just temporarily removed from the root dbs) immediately and their owners contacted. Because

/24 route propagation, how long is reasonable?

2005-01-13 Thread Michael Airhart
Quick question for the group.. How long should I be patient to wait for some /24s to become fully routable worldwide? None of the addresses are mine, they came from the upstream (only one provider) They are all part of the upstreams IP space, and I had assumed that they would have kept them as

RE: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonymity when domain exists, whois not updated yet)

2005-01-13 Thread Joseph Johnson
Basically a call to operators to adopt a consistent forward and reverse DNS naming pattern for their mailservers, static IP netblocks, dynamic IP netblocks etc. ...and to ISPs to facilitate the process by supporting their users who want to run mail servers, and helping the rest of us use

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonym

2005-01-13 Thread Rich Kulawiec
On Thu, Jan 13, 2005 at 12:26:47PM +0100, Stephane Bortzmeyer wrote: 4) all domains with invalid whois data MUST be deactivated (not confiscated, just temporarily removed from the root dbs) immediately and their owners contacted. Because there is no data protection on many databases

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonym

2005-01-13 Thread Valdis . Kletnieks
On Thu, 13 Jan 2005 12:21:04 +0100, Stephane Bortzmeyer said: American bias but remember the Internet is worldwide. I do not know how it is in the USA but there are many parts of the world where ISP do not have a delegation of in-addr.arpa and therefore cannot pass it to their customers. (It

FW: AlterPoint Mail Security detected prohibited content in a message sent from your address (SYM:42361956180980318002)

2005-01-13 Thread Steven Champeon
Why content filtering is stupid: - Forwarded message from [EMAIL PROTECTED] - X-Delivered-To: [EMAIL PROTECTED] From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Subject: AlterPoint Mail Security detected prohibited content in a message sent from your address

answered: /24 route propagation, how long is reasonable?

2005-01-13 Thread Michael Airhart
Thanks for the private responses I received! Turns out it was a AS append problem... Michael Quick question for the group.. How long should I be patient to wait for some /24s to become fully routable worldwide? None of the addresses are mine, they came from the upstream (only one provider)

Re: [eweek article] Window of anonymity when domain exists, whois not updated yet

2005-01-13 Thread Dave Crocker
On Wed, 12 Jan 2005 17:41:33 -0500, [EMAIL PROTECTED] wrote:   The X.400 concepts of ADMD= and PRMD= really caught on, didn't they? ;)   Peering in a world of 64K ASNs, mostly basically static, is a lot different   than peering in a world of 40 million plus .COMs, many in motion.  Most of   the

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of an

2005-01-13 Thread Stephane Bortzmeyer
On Thu, Jan 13, 2005 at 10:21:20AM -0500, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote a message of 45 lines which said: Requesting rDNS means I don't want to receive email from Africa. Having an rDNS entry for a host doesn't mean you know if it is/isn't in Africa, Of course, I know that.

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonym

2005-01-13 Thread Steven Champeon
on Thu, Jan 13, 2005 at 12:21:04PM +0100, Stephane Bortzmeyer wrote: On Wed, Jan 12, 2005 at 10:59:43AM -0500, Steven Champeon [EMAIL PROTECTED] wrote a message of 98 lines which said: 1) any legitimate mail source MUST have valid, functioning, non-generic rDNS indicating that it is

Re: /24 route propagation, how long is reasonable?

2005-01-13 Thread bmanning
Quick question for the group.. How long should I be patient to wait for some /24s to become fully routable worldwide? forever. - or until you clarify your terms. all addresses, regardless of origin, are inherently fully routable worldwide ... but to instansiate

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonymity when domain exists, whois not updated yet)

2005-01-13 Thread Steven Champeon
on Wed, Jan 12, 2005 at 04:51:34PM -0800, william(at)elan.net wrote: ...a very long and useful and informative message, for which I thank him. Off to go decipher the madness that is RFC3982, Steve -- hesketh.com/inc. v: +1(919)834-2552 f: +1(919)834-2554 w: http://hesketh.com join us!

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of an

2005-01-13 Thread Eric Brunner-Williams in Portland Maine
Of course, I know that. I just mentioned Africa because, in many countries in Africa, it is simply impossible to get a PTR record. That's a fact, there are many reasons behind. Howdy Stephane, It is also an area where many cctld operators maintain their registration data using spreadsheets,

Cisco 7513 Bandwidth Points

2005-01-13 Thread Claydon, Tom
Hello, We are moving from a Cisco 7206 to a 7513, and I was wondering if we will be limited by bandwidth points on the 7513 (as we are with the 7206). From the sparse documentation I've found so far, it doesn't appear that this limitation exists in the 7513, correct? Off-list replies are

Re: Cisco 7513 Bandwidth Points

2005-01-13 Thread Jon Lewis
On Thu, 13 Jan 2005, Claydon, Tom wrote: We are moving from a Cisco 7206 to a 7513, and I was wondering if we will be limited by bandwidth points on the 7513 (as we are with the 7206). From the sparse documentation I've found so far, it doesn't appear that this limitation exists in the 7513,

Re: Proper authentication model

2005-01-13 Thread Owen DeLong
That's great if you want to trust one carrier to provide all your seperacy, but, when you want to make sure carrier A isn't running your ring in common with carrier B, you need GIS data. Owen --On Thursday, January 13, 2005 10:36 AM + [EMAIL PROTECTED] wrote: My point was that competing,

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonym

2005-01-13 Thread Owen DeLong
Requesting rDNS means I don't want to receive email from Africa. Having an rDNS entry for a host doesn't mean you know if it is/isn't in Africa, to any higher degree of certainty than when you just had the IP address. What he was pointing out her is that a majority of African ISPs do not even have

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of anonym

2005-01-13 Thread Valdis . Kletnieks
On Thu, 13 Jan 2005 11:35:23 PST, Owen DeLong said: Requesting rDNS means I don't want to receive email from Africa. Having an rDNS entry for a host doesn't mean you know if it is/isn't in Africa, to any higher degree of certainty than when you just had the IP address. What he was

Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-13 Thread John Levine
What is wrong with MTAMARK? MTAMARK tags the reverse entries of IP addresses where SMTP servers are. Fixes this problem very fast, efficient and with little effort (script magic to regenerate the reverse DNS entries). In priciple, nothing. In practice, the rDNS is a mess and I don't know

North American MPLS

2005-01-13 Thread Vogel, Doug
Does anyone have an MPLS network up and running in North America? Can you share your experiences with the carriers. How did installations go and how has support been? I am particularly interested in BT and ATT.

Re: fixing insecure email infrastructure (was: Re: [eweek article]

2005-01-13 Thread Mark Andrews
What is wrong with MTAMARK? As currently described it doesn't fit well with RFC 2317 style delegations. They would need to be converted to use DNAME instead of CNAME which requires all the delegating servers to be upgraded to support DNAME. There are

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of an

2005-01-13 Thread Barry Shein
On January 13, 2005 at 17:41 [EMAIL PROTECTED] (Stephane Bortzmeyer) wrote: Of course, I know that. I just mentioned Africa because, in many countries in Africa, it is simply impossible to get a PTR record. That's a fact, there are many reasons behind. That's because one of their leader's

Re: Cisco 7513 Bandwidth Points

2005-01-13 Thread Noel Montales
On-List replies perhaps may be usefull.. Or could you post a summary of your findings? Regards, Noel Montales Claydon, Tom said: Hello, We are moving from a Cisco 7206 to a 7513, and I was wondering if we will be limited by bandwidth points on the 7513 (as we are with the 7206). From the

Re: fixing insecure email infrastructure (was: Re: [eweek article]

2005-01-13 Thread Owen DeLong
That's bad sincd DNAME is deprecated and has been removed from BIND. Owen --On Friday, January 14, 2005 10:05 +1100 Mark Andrews [EMAIL PROTECTED] wrote: What is wrong with MTAMARK? As currently described it doesn't fit well with RFC 2317 style delegations. They would need to be

Re: fixing insecure email infrastructure (was: Re: [eweek article]

2005-01-13 Thread william(at)elan.net
On Thu, 13 Jan 2005, Owen DeLong wrote: That's bad sincd DNAME is deprecated and has been removed from BIND. Owen No, its A6 that is to be depreciated (and too bad because its superior to ), but last I heard DNAME stays as standard RR. -- William Leibzon Elan Networks [EMAIL

Re: fixing insecure email infrastructure (was: Re: [eweek article]

2005-01-13 Thread Suresh Ramasubramanian
On Thu, 13 Jan 2005 22:43:24 -0800 (PST), william(at)elan.net [EMAIL PROTECTED] wrote: On Thu, 13 Jan 2005, Owen DeLong wrote: That's bad sincd DNAME is deprecated and has been removed from BIND. No, its A6 that is to be depreciated (and too bad because its superior to ), but last I