Why can't DNS servers perform spam or mal-ware blocking/filtering?

[Ant]

Niet!

Da! Well perhaps not *all* situations/configurations, but those where
we expect the software to be used.

You either test, or you declare the software to be unqualified on
platform X. Easie Peasie. Surrender is not an option.

Sure. But exhaustive testing under all system conditions and software
configurations, even on a single platform, is usually impractical. For
example we assume that X-GUI widget, supplied by Sun, MS, Borland, or
whoever, will behave according to the documentation. Little do we know
that under a particular window arrangement, unusual data set, or some
other circumstance, the thing doesn't perform as expected. We don't
have the source, and are unable to check the code. There are a
potentially infinite number of scenarios in which we can black-box
test this, or any other component.

Of course. But you just don't ship code for platform X, if you haven't
checked that it works on that platform. Why else would I be running an
Oracle database server? Certainly not for fun. Oracle sucks.

I don't understand the Oracle reference.

Point taken. Java isn't what it is sold as.

Ok, but I am also thinking about other languages.

You have to test on every platform; and if you are selling the code to
$BIGCORP, then you also have to test in whatever environment they want
to run it in.

Yes, absolutely. And then later they install service pack N for their
OS, and wonder why it no longer works!

Java is not magic. It's just another programming language.
Threads in particular are dangerous; MP hardware seems to throw up
special difficulties with threading.

If our application is for a modern general purpose OS, it's running
concurrently with other programs in a multi-threaded environment, even
if ours is only a single thread of execution. Hopefully we can test it
together with all the other apps the customer says will be running to
ensure there are no surprises.

 

[Roger Wilco]

...[...] This is true in *any* computer, and it can never be
otherwise because of the very nature of the term "digital". You are
dealing with zeros and ones. Accordingly, everything is done in a
multiple of two. 8, 16. 32. 64... all even.

Digital refers to digits (those appendages on your hands) and
indicates base ten usage for non-mutant humans. You are thinking of
"binary" or base two computations. Digital also refers to
"non-analog" computation but doesn't really indicate only the binary
form of non-analog computation.

So you know of some non-binary digital computer?

There are tri-stating devices - but that is not the point. The word you
should have used is "binary" not "digital" because digital historically
refers to base ten.

My guess is you don't.
Even if you do, it will not be a production device. There is no such
thing as a ten-fingured computer (just as well; I can only really use
four fingures in typing).
Abacus?

Perhaps you and Blossom deserve one another, Mr. Wilco. Are you
acquainted from some other part of usenet? As far as I can see, you are
both visitors in alt.spam.

So what!? Is alt.spam in some parallel universe where words have
different meanings than in the rest of usenet?

Yes, I know many people use the term "digital" when they really mean
"binary" and it may be because they can't imagine a non-analog computer
that isn't using base two. Many people can't imagine a rotary winged
aircraft that isn't a helicopter, but that doesn't mean autogyro's don't
or can't exist.

 

[Roger Wilco]

...[...] This is true in *any* computer, and it can never be
otherwise because of the very nature of the term "digital". You

are
dealing

with zeros and ones. Accordingly, everything is done in a multiple

of
two.

8, 16. 32. 64... all even.

Digital refers to digits (those appendages on your hands) and indicates
base ten usage for non-mutant humans. You are thinking of "binary" or
base two computations. Digital also refers to "non-analog" computation
but doesn't really indicate only the binary form of non-analog
computation.

Digital has not been an indicator of Base-10 for years, decades, except
for those still living out of the past.

True, but it still doesn't mean binary.

 

[Jack]

There are tri-stating devices - but that is not the point. The word
you should have used is "binary" not "digital" because digital
historically refers to base ten.

It's not me that initially made the reference to which you are referring.

Having said that, I think you are mistaken; "digital" is certainly
etymologically concerned with fingers, but base-ten arithmetic is
historically referred to as "decimal", not "digital". The essential
meaning of "digital" in the context of computing machinery is
"discrete", I think (that word being taken in contrast to "continuous").

If "digital" were taken in your sense, then you'd have to accept a sly
drool as a digital device, since it is usually marked-out with a
base-ten numbering-system. I'm sure you didn't mean your reasoning to
have that consequence.

Abacus?

Not bad - a discrete, decimal computing aid, with a "digital
power-supply". I hadn't thought of that. Also, at school in the sixties,
I was taught to use a type of adding machine that involved setting
thumbwheels and turning a crank. With some fancy cranking, you could do
multiplication, and (with some extra difficulty) even long division. I
hated those lessons. You could skin your knuckles doing your maths homework.

But neither of these devices can store a program, and neither is a
"general-purpose computer" in the Von Neumann or Turing sense. I don't
know enough about the Babbage Difference Engine to be able to say
whether or not it is a GP computer; I think not. But it is another
example of a discrete, decimal computing aid.

 

[Leythos]

True, but it still doesn't mean binary.

Digital can mean anything with numbers of any base/type. Digital does
not indicate any BASE.

Decimal, Octal, Hex, those indicate a base.

 

[Roger Wilco]

??

Not too long ago nor far away it was suggested that tracking down and
listing sites hosting browser exploits would be worthy of serious
consideration - the argument against that was to fix the vulnerable
software instead. While such an effort and list could be good for
shutting down those sites, it is not a viable solution for the end user.

Rather than tracking the thousands of occurences of a particular malware
on the net and the multiple malwares that might effect my machine, I
would just make myself less susceptible by not extending programming
rights (by design or flaw) to untrusted sites.

Someone somewhere along the way decided that it would be a good idea to
add functionality to a browser so that a visited site could cause your
browserand OS to download and execute full fledged programs. While there
are cases where this could be useful, imo it was a mistake to add this
functionality to such a widespread OS's bundled software and then work
for years trying to make it safe to use (should this really be marked as
"safe for scripting"...etc...).

I was replying to the opinion that much of this should/could be filtered at
the DNS level... specifically by devising a special, but still "public"
server for the purpose.

And I was agreeing with you (I think)

It's *my* contention that broad strokes like this have limited value.
They're fine for hacking off the more obvious and repetitive offenders, and
it could be argued that nuking the entire KR and RU TLD's might be a good
thing. But routine offenders aren't the bulk of the problem, and in
general terms, this type of retaliation creates collateral damage in direct
perportion to the size of the ax.

Specifically, I was agreeing with your assertion that the OP was trying
for a system that allows him to place the responibility of security
elsewhere when it really belongs on his shoulders. If users didn't run
around willy nilly extending programming rights to strangers, then
drive-by sneakyware installation wouldn't be a problem because,
commercially, they wouldn't waste their time on fruitless endeavors.

Ironically enough, I feel local filters and intelligent software choices
(read: a little education) are far more effective and don't negatively
impact anyone but the end user and their minions. That's a win-win
situation in my little mind.

Agreed.

 

[Jack]

Jack (me) wrote:

[Sorry to comment on my own post]

Having said that, I think you are mistaken; "digital" is certainly
etymologically concerned with fingers, but base-ten arithmetic is
historically referred to as "decimal", not "digital". The essential
meaning of "digital" in the context of computing machinery is
"discrete", I think (that word being taken in contrast to
"continuous").

One could also easily conceive of a binary slide-rule. It might not be
much more use than a binary abacus, except for demonstrating that
"digital" and "binary" and "decimal" all mean different things. Ain't it
a crime, wot nerds have done to the English Language?

 

[Roger Wilco]

It's not me that initially made the reference to which you are

referring.

Sorry, but it was you disagreeing with my saying that "digital" does not
mean "binary" but rather may mean "non-analog" wrt computing.

Having said that, I think you are mistaken; "digital" is certainly
etymologically concerned with fingers, but base-ten arithmetic is
historically referred to as "decimal", not "digital".

I'll accept that - however I have read that digital once referred to
base ten because base ten arised from the fact that our counting system
(decimal) was based on our number of digits (not specifically fingers -
includes thumbs). That is beside the point anyway, the point is that
"digital" does not mean "binary".

The essential
meaning of "digital" in the context of computing machinery is
"discrete", I think (that word being taken in contrast to

"continuous").

Yes, analog computing is continuous (except maybe at the quantum level)
whereas digital has discrete steps.

If "digital" were taken in your sense, then you'd have to accept a sly
drool as a digital device, since it is usually marked-out with a
base-ten numbering-system. I'm sure you didn't mean your reasoning to
have that consequence.

No, I only objected to the claim that digital meant computations using
only ones and zeros - there is already a word for that and that word is
binary.

Not bad - a discrete, decimal computing aid, with a "digital
power-supply". I hadn't thought of that. Also, at school in the sixties,
I was taught to use a type of adding machine that involved setting
thumbwheels and turning a crank. With some fancy cranking, you could do
multiplication, and (with some extra difficulty) even long division. I
hated those lessons. You could skin your knuckles doing your maths

homework.

I disassembled one of those using a Phillips #3 disassembler - didn't
learn much from it except some things are best left alone. )

[snip]

 

[Roger Wilco]

Digital can mean anything with numbers of any base/type. Digital does
not indicate any BASE.

Right.

 

[Norman L. DeForest]

In some/many/most(?) scenarios it's entirely possible. I don't even dispute
the fact that it's "better". The problem arises when making the transition
is more problematic than than the original problem.

Consider the logistics of converting hundreds of thousands of clients spread
across the globe, using thousands of servers scattered likewise. Salt in
the possibility that those clients might be using proprietary software
(good and bad in some respects I suppose). Consider the logistics on even
smaller scales, but magnified by the fact that each small "pocket" of users
is duplicated possibly hundreds of thousands of times.

If one of the largest providers of user accounts on the Internet can do
it, why should smaller systems have problems?

"Postmaster.Info Home AOL Members Guidelines FAQ SPF Information"
http://postmaster.info.aol.com/faq/port25faq.html

Here are just some of the 34,900 pages found with a Google search for
"port 587" "outlook express"
so the problem can't be insurmountable:

"Configuring Outlook Express to use Port 587 to Reduce SPAM"
http://www.iup.edu/techzone/FAQs/port587.pdf

"IS&T Article - Outlook Express 6 for Windows: Setting up for Use at MIT"
http://itinfo.mit.edu/article?id=7876

"InnoTech Customer Support - User Administration - Use Port 587 to Send Mail"
http://www.inno-tech.com/support/user-port587.html

"University of Wisconsin Help Desk"
http://helpdesk.wisc.edu/page.php?cat=1002&id=2786

As I said, this "experiment" is being undertaken as we speak, with less than
perfect results. For exactly the reasons I'm highlighting here. The change
simply isn't worth the benefit in many real world scenarios. It's great
that we can argue the problem from the lofty comfort of the theoretical,
but that nasty thing called every day life just keeps rearing its ugly
head. ;-)

And every day life shows that worms and trojans and zombies are being used
in ever-increasing numbers to spew malware and spam.

 

[Norman L. DeForest]

Norman L. DeForest wrote:

[snippitydo]

Quoting from one report at the Chebucto Community Net Annual General
Meeting:

http://www.chebucto.ns.ca/Chebucto/AGM-2002/policy.shtml

[snip]
: >> AGM 2002 Policy Committee Report
:
: Serving Your Community's Online Needs Since 1994.
[snip]
: There were several cases of users being abused however, when viruses
: and spammers used some innocent third party's email address as the
: forged reply address on their junkmail. In one case, the user received
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: thousands of bounced messages a day for a three week period due to a
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

These are apparently message bounces, not something caused by C/R.

I wasn't commenting on C/R specifically but bounces -- mentioned by you in
the part you snipped:

<paste'n'quote>

: I've only seen these sort of bounces two or three times in my entire life,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: and the numbers were in the single digits. I've seen people asking "what
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: the hell is this" questions about similar levels on a number of occasions.
: I think some of them were probably right here in this group, from people
: thinking they had some flavor of mass mailing worm. But I don't ever recall
^^^^^^^^^^^^^^^^^^^^^^^
: having heard of anything even in the "200" range so my opinion was at least
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
: that skewed by limited experience.
:
: Can't recall the specifics of other examples offhand.
: Not sure how you might Google for examples...

Don't get me wrong, I fully admit there's a problem I hadn't considered, I'm
honestly just trying to get a handle on exactly how bad that problem is in
the real world. Bounces and C/R are similar of course, and it could be
argued that for practical purposes *all* auto-responders should be put
down, but for purely academic reasons I'd like to differentiate between the
two for now.

My most annoying problem at the moment are brain-dead antivirus filters
at ISPs that send rejection notices to the victims of Mytob forgery. One
user-support list I am the nominal list-owner for has been receiving a
regular trickle (but still annoying at that frequency) of "Message
rejected becaiuse it contains a virus." notices because one of the eight
or so role addresses selected by Mytob as the forged sender is an alias
for the mailing list. Usually, if they include full headers from the
rejected message, the true origin turns out to be one of their own users.

Some don't include full headers.

Way too many don't have working postmaster addresses.

 

[Norman L. DeForest]

I suspect that your version is more accurate than mine. And I think you
are right; the product was BASIC, not MSDOS (which Micro$oft didn't
write anyway - they just resold it to IBM).

The funniest error in GW-BASIC (for DOS 2.x and higher versions) that had
me giggling for weeks (';' indicates comments added to the DEBUG dump):

This code in GW-BASIC is supposed to prevent later versions from being run
on DOS 1.x systems which don't support the new features. If you try
running such a later version on a DOS 1.x machine, you have problems:

-
-U FC78 FC94
1A6A:FC78 B430 MOV AH,30 ; function, get DOS version
1A6A:FC7A FC CLD
1A6A:FC7B CD21 INT 21 ; get the version
1A6A:FC7D 3C02 CMP AL,02 ; DOS 2.0 or higher?
1A6A:FC7F 7311 JNB FC92 ; if yes, continue at FC92
; the system has been identified as running DOS 1.x at this point
1A6A:FC81 BAE3FB MOV DX,FBE3 ; point
1A6A:FC84 0E PUSH CS ; DSX to
1A6A:FC85 1F POP DS ; error message
1A6A:FC86 B409 MOV AH,09 ; function, print ASCII$ string
1A6A:FC88 FC CLD
1A6A:FC89 CD21 INT 21 ; print the error message
1A6A:FC8B 32C0 XOR AL,AL ; set return code to zero
1A6A:FC8D B44C MOV AH,4C ; advanced terminate command
1A6A:FC8F FC CLD
1A6A:FC90 CD21 INT 21 ; try to terminate *with the
; advanced terminate command*
; which was introduced in DOS 2.0
; and not available in DOS 1.x
1A6A:FC92 E81300 CALL FCA8 ; Oooops, we didn't terminate,
; we can't terminate, and
; Ctrl-Alt-Del is the only way to
; get out of GW-BASIC
-
-D 1A6A:FBE3 L1A
1A6A:FBE0 0D 0A 49 6E 63-6F 72 72 65 63 74 20 44 ..Incorrect D
1A6A:FBF0 4F 53 20 76 65 72 73 69-6F 6E 0D 0A 24 8E 06 8D OS version..$
-

That's "quality control"? "This DOS version doesn't support DOS 2
function calls so let's terminate with a DOS 2 function call."


Or, for another one, it's strange how the position of a semicolon can be
significant (*one* line below will generate an error):

1000 GO = 5
1005 UB = 6
1010 PRINT GO; UB
1010 PRINT GO ; UB
1010 PRINT GO ; UB
1010 PRINT GO ;UB

That's "quality control"? (They used a workaround to fix another bug
instead of fixing the actual cause of the bug and it introduced a new
error -- which was to be expected because of the stupid workaround
they used.)


And then there's the way that the VAL function can trash some totally
unrelated string if the one being evaluated has an error in it. That's
only one of two bugs in the VAL function in GW-BASIC but that one is
also found in Applesoft BASIC (from Microsoft) and the Commodore PET
and C-64 and VIC-20 (BASIC from Microsoft) and the Radio Shack Color
Computer (BASIC from Microsoft) and all versions of GW-BASIC up to at
least DOS 3.1. (DOS 3.3 had the bug fixed (several DOS versions after I
reported the bug) and I have never had access to DOS 3.2 to test it).
Owners of early IBM PCs have that bug embedded permanently in ROM.
I found the bug originally on a TRS-80, Model I with Level II BASIC
(from Microsoft).

That's "quality control"?

I'm sorry the guy wasn't sacked, though; it makes the story better.

I have mixed feelings about that.

 

[Jeffrey F. Bloss]

I wasn't commenting on C/R specifically but bounces -- mentioned by you in
the part you snipped:

<paste'n'quote>

: I've only seen these sort of bounces two or three times in my entire
: life,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Yes, these *sort* of bounces. As in... the *sort* caused by C/R responding
to spam.

The topic of discussion was C/R and *that* was what I was commenting on, not
bounced messages in general.

--
Hand crafted on October 19, 2005 at 09:13:37 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Jeffrey F. Bloss]

If one of the largest providers of user accounts on the Internet can do
it, why should smaller systems have problems?

I never said they couldn't. I said it was anal retentive. I said it was
wrong, that it broke things, that it caused more problems, that it didn't
totally *solve* the original problem, and that in at least one case where
such things were tried it cause so many problems it had to be neutered and
possibly worse.

Why have you tried to rewrite my statements twice now, Norman?

--
Hand crafted on October 19, 2005 at 09:22:56 -0400

Outside of a dog, a book is a man's best friend.
Inside of a dog, it's too dark to read.
-Groucho Marx

 

[Norman L. DeForest]

Yes, these *sort* of bounces. As in... the *sort* caused by C/R responding
to spam.

The topic of discussion was C/R and *that* was what I was commenting on, not
bounced messages in general.

Oh, I misunderstoood what you meant then. I think of C/R responses as
"challenges" and not as "bounces".

 

[Norman L. DeForest]

I never said they couldn't. I said it was anal retentive. I said it was
wrong, that it broke things, that it caused more problems, that it didn't
totally *solve* the original problem, and that in at least one case where
such things were tried it cause so many problems it had to be neutered and
possibly worse.

Why have you tried to rewrite my statements twice now, Norman?

What have I rewritten? The text I quoted is what you wrote.

RFC2476 was written almost seven years ago (December 1998). There should
be off-the-shelf software to implement it for virtually every operating
system by now, a lot of it free.