Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-20 Thread Sean Donelan
On Mon, 19 Feb 2007, Rich Kulawiec wrote: Pop quiz, bonus round: how much does it cost Comcast to defend its mail servers from Verizon's spam, and vice versa? Heck, how much does it cost Comcast to defend its mail servers from its own spam? How much do they spend on abuse/customer security?

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-20 Thread Rich Kulawiec
On Mon, Feb 19, 2007 at 02:04:13PM +, Simon Waters wrote: I simply don't believe the higher figures bandied about in the discussion for compromised hosts. Certainly Microsoft's malware team report a high level of trojans around, but they include things like the Jar files downloaded onto

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-20 Thread Gadi Evron
On Tue, 20 Feb 2007, Rich Kulawiec wrote: Hi Rich, snip good stuff thanks for your input, Rich. As always, quite interesting. BTW #2: All of this leaves open an important and likely-unanswerable question: how many systems are compromised but not as yet manifesting any external sign of it?

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-20 Thread Fergie
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Gadi Evron [EMAIL PROTECTED] wrote: And this is before we get into the academic off-topic discussion of what a bot actually is, which after almost 11 years of dealing with these I find difficult to define. Is it an IP address? A computer?

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-19 Thread Rich Kulawiec
I really don't want to get into an OS debate here, but this does have major operational impact, so I will anyway but will be as brief as possible. Please see second (whitespace-separated) section for some sample hijacked system statistics which may or may not reflect overall network population.

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-19 Thread michael.dillon
But suppose you put such a firewall in place. You'll need to configure the firewall properly -- paying as much attention to outbound rules as inbound. Sounds like a good thing to document in a best practices document that can be used to certify firewall implementations. When trying to solve

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-19 Thread Simon Waters
On Monday 19 February 2007 13:27, you wrote: people consider this to be a Windows malware problem. I consider it to be an email architecture problem. We all know that you need hierarchy to scale networks and I submit that any email architecture without hierarchy is broken by design and no

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-19 Thread Roland Dobbins
On Feb 19, 2007, at 6:04 AM, Simon Waters wrote: I look forward to your paper on the end to end concept, and why it doesn't apply to email The end-to-end principle has no bearing upon this discussion at all, unless you're referring to firewalls/NATs.

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-19 Thread michael.dillon
I look forward to your paper on the end to end concept, and why it doesn't apply to email ;) Clearly the answer is that it never has applied to email in the pasts. Hosts don't email each other, people do. People have always relied on Internet postmaster services to enable Internet email.

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-19 Thread Roland Dobbins
I look forward to your paper on the end to end concept, and why it doesn't apply to email ;) I think the problem here is that people invoke something they think of as 'the end-to-end principle', but actually isn't. from http://web.mit.edu/Saltzer/www/publications/endtoend/

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-19 Thread Tony Finch
On Mon, 19 Feb 2007, [EMAIL PROTECTED] wrote: Now, even those people have shifted to a hierarchical architecture of instant-messaging servers. In what way is IM hierarchial? The commercial IM systems have a star topology with a tightly controlled core and basically no inter-domain federation,

Re: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-19 Thread J. Oquendo
[EMAIL PROTECTED] wrote: And you'll need to de-install IE and Outlook, This will not happen. Not even remotely. Thus ensuring that Firefox/Thunderbird will be the main target of the malware people. Is this necessarily any better? Note that Windows provides an extensive series of

RE: botnets: web servers, end-systems and Vint Cerf [LONG, sorry]

2007-02-19 Thread michael.dillon
Now, even those people have shifted to a hierarchical architecture of instant-messaging servers. In what way is IM hierarchial? Jabber/XMPP has a mesh-of-stars topology That is hierarchy. One level is a star topology, the next level is a mesh. which is the same as email's modulo