[lkml]   [2000]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [Semi-OT,important] ORBS globally blocks users of these lists
On Mon, 17 Jan 2000, Khimenko Victor wrote:
> They cannot find exact border. It's easy to find out that some of
>'s servers are blocked and what adresses are assigned to
> It's not easy (or perhaps even impossible for outsiders) to
> find out what exactly is blocked. So the whole net is marked as "bloking
> one".

It certainly is easy to find an exact border. You have three types of
servers. Open relays, blocked/untestable servers and compliant servers. It
takes more work to dig up the net blocks than it does to automatically

Being that all the servers I touch fit 100% into the compliant group as is
reported by ORBS itself with a couple of clicks, I'd say it's pretty darn
easy to tally it correctly.

> B> Read again what I wrote. In specific, has been probed by
> B> ORBS and is listed as compliant. The ORBS probe HAS checked it and it IS
> B> anti-spam but it is STILL blacklisted because another section of
> B> is blocking ORBS.
> This is strange :-( If they are in ORBS static list them why ORBS tried
> to probe them ? Hmm. Anyway I can not find ( in
> ORBS right now. Neither as "Open Relay" ( nor
> as "Non Open Relay" ( If you are using different
> IP address as source for outgoing traffic then you can just tune you system
> slightly, that's all.

Go to the verify page and type in the IP, it'll come back in a moment with
an 'OK' status.

The IP fits into an netblock which is in their hallofshame.html

> I can not see how is affected :-(

Look at, 1/2 down the page. Netblock
216.200/16 neatly surrounds

> B> If you are a US citizen, you have the right to vote and affect legislation.
> B> It's not a problem until it's your problem?
> If it'll become my problem I know how to fix it :-) I can not change ISP
> (it's school and we had no choice) but I have quite a few friends who can
> work as mail relay for me if our ISP will be stupid enough to try to block
> ORBS. BTW my first discovery of ORBS was when it sent me mail where I was
> notified about possibility to use our system as open-relay.

When your school becomes blocked, you goto your friends, when your friends
become blocked, you go where? How many times are you going to pack up and
move your email before enough is enough?

> Not nazi police but more like phone company master :-) And yes, phone company
> master CAN ask me to show him what's connected to my phone line. And it WILL
> shut up phone line if I'll refuse to do this. It's perfectly legal here (though
> usually phone master is to lazy to go to my home :-)

Yes, -your- fone line. Not your neighbors or anyone else you call. Only
-your- fone line.

> And which address is affected ? is not there.

Yes it is. Look at the above URL. Also look at and

> They are added there. As "open relay piked up by automated system".
> -- cut --
> [khim@dell khim]$ host
> has address
> mail is handled (pri=5) by
> [khim@dell khim]$ host
> has address
> [khim@dell khim]$ host -t TXT
> descriptive text "Open relay - see"
> -- cut --

Now look at
-- cut --
# host has address
# host -t TXT descriptive text " has multiple
open relays and has blocked the ORBS tester."
-- cut --

> Exactly. There are NO WAY to automatically find out which servers are bloking
> ORBS and which are not. So they are all marked as "netblock entry":
> -- cut --
> [khim@dell khim]$ host
> has address
> -- cut --

Yes, there certainly is. Think about it. How do you test the entire
internet address space for open relays? Do you start by blacklisting the
entire thing because "there is no way to tell" which ones are good and bad?

No. You list the servers that return 400/500 responses to relay injection,
you list servers that are unknown status (blocked) and you list servers that
grant 200 responses.

> It's up to admin to allow or refuse "netblock entries". Hmm. Perhaps I should
> add check for before check for ...

# host -t TXT is a nickname for descriptive text "This server has been tested by
ORBS and appears to be secure against relaying"

Funny how it's a compliant server by ORBS but ORBS feels it's fine and dandy
to levy the blacklist, eh?

> There are NO automatic procedure to find blocking. Thus all automatisation
> works ONLY till bloking attempts are detected.

You have three types: Compliant, Unknown, and Non-compliant. Systems that
fit in Unknown could be broken, down, bad routing, and they could be
firewalling ORBS.

It doesn't matter. Compliant servers should NOT be blocked.

This entire discussion about blocking is not relevant to the rest of the
address space served by, is blocking a segment, we exist
in a different segment.


To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:55    [W:0.068 / U:2.956 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site