Re: RE: ISP port blocking practice

2010-09-13 Thread Joshua William Klubi
[mailto:jfb...@gmail.com] Sent: Friday, September 03, 2010 9:30 PM To: Owen DeLong; Patrick W. Gilmore Cc: NANOG list Subject: Re: ISP port blocking practice On Fri, 03 Sep 2010 08:12:01 -0400, Owen DeLong o...@delong.com wrote: Really? So, since so many ISPs are blocking port 25, there's lots less

RE: ISP port blocking practice

2010-09-12 Thread Brian Johnson
-Original Message- From: Owen DeLong [mailto:o...@delong.com] Sent: Friday, September 03, 2010 1:10 PM To: John Levine Cc: nanog@nanog.org Subject: Re: ISP port blocking practice Sent from my iPad COOL! On Sep 3, 2010, at 10:10 PM, John Levine jo...@iecc.com wrote: Really? So

Re: ISP port blocking practice

2010-09-09 Thread John Levine
That's really the question at hand here -- whether or not there's any benefit to continuing the never ending arms race game. Some people think there is. Others question whether anything is really being accomplished. Certainly we're playing it out like an arms race -- ISPs block something,

Re: ISP port blocking practice

2010-09-09 Thread Robert Beverly
On Thu, Sep 02, 2010 at 04:59:57PM -0500, Zhiyun Qian wrote: One of the high-level findings is that we developed probing techniques to verify that indeed most ISPs are only blocking 1) outgoing traffic of destination port 25 instead of 2) incoming traffic with source port 25, which means that

Re: ISP port blocking practice

2010-09-09 Thread Eric Katanich
On Thu, Sep 02, 2010 at 04:59:57PM -0500, Zhiyun Qian wrote: One of the high-level findings is that we developed probing techniques to verify that indeed most ISPs are only blocking 1) outgoing traffic of destination port 25 instead of 2) incoming traffic with source port 25, which means that

Re: ISP port blocking practice

2010-09-08 Thread Robert E. Seastrom
Owen DeLong o...@delong.com writes: I know people at large ISPs with actual data. Port 25 blocking is quite effective. Does the data show that blocking was effective, as in the host didn't detect the block and proceed around it, or, merely that lots of hosts try the direct approach first?

Re: ISP port blocking practice

2010-09-07 Thread Randy Bush
i keep hearing that, but am having a hard time finding supporting data. Might see the stats from http://cbl.abuseat.org - by AS. Then compare the stats on a non port 25 filtered network (they have stats by AS) to stats on a network that is filtered on port 25 The networks that are

Re: ISP port blocking practice

2010-09-07 Thread Robert Bonomi
From nanog-bounces+bonomi=mail.r-bonomi@nanog.org Tue Sep 7 15:15:13 2010 Date: Mon, 6 Sep 2010 19:55:06 -0500 From: Brett Frankenberger rbf+na...@panix.com To: deles...@gmail.com Subject: Re: ISP port blocking practice Cc: NANOG list nanog@nanog.org On Mon, Sep 06, 2010 at 10:38

Re: ISP port blocking practice

2010-09-06 Thread Jon Auer
With all the different webmail systems, it seems unlikely to me (though I definitely wouldn't say impossible) that bots are spamming through your webmail (unless you work for gmail, hotmail, etc. and are an attractive enough target that it made sense to code a bot to automate utilizing your

Re: ISP port blocking practice

2010-09-06 Thread Brett Frankenberger
On Sun, Sep 05, 2010 at 09:18:54PM -0400, Jon Lewis wrote: Anti-spam is a never ending arms race. That's really the question at hand here -- whether or not there's any benefit to continuing the never ending arms race game. Some people think there is. Others question whether anything is

Re: ISP port blocking practice

2010-09-06 Thread Patrick W. Gilmore
On Sep 6, 2010, at 9:22 AM, Brett Frankenberger wrote: On Sun, Sep 05, 2010 at 09:18:54PM -0400, Jon Lewis wrote: Getting rid of the vast majority of open relays and open proxies didn't solve the spam problem, but there'd be more ways to send spam if those methods were still generally

Re: ISP port blocking practice

2010-09-06 Thread deleskie
: Mon, 6 Sep 2010 17:54:49 To: NANOG listnanog@nanog.org Subject: Re: ISP port blocking practice On Sep 6, 2010, at 9:22 AM, Brett Frankenberger wrote: On Sun, Sep 05, 2010 at 09:18:54PM -0400, Jon Lewis wrote: Getting rid of the vast majority of open relays and open proxies didn't solve

Re: ISP port blocking practice

2010-09-06 Thread Brett Frankenberger
On Mon, Sep 06, 2010 at 10:38:15PM +, deles...@gmail.com wrote: Having worked in past @ 3 large ISPs with residential customer pools I can tell you we saw a very direct drop in spam issues when we blocked port 25. No one is disputing that. Or, at least, I'm not disputing that. I'm

Re: ISP port blocking practice

2010-09-06 Thread Randy Bush
The theory behind closing open relays, blocking port 25, etc., seems to be: (a) That will make it harder on spammers, and that will reduce spam -- some of the spammers will find other other ways to inject spam, but some will just stop, OR (b) Eventually, we'll find technical solutions to

Re: ISP port blocking practice

2010-09-06 Thread Suresh Ramasubramanian
No. It'd just increase a LOT, astronomically. Something on the lines of turning a firehose of petrol on a wildfire On Tue, Sep 7, 2010 at 7:00 AM, Randy Bush ra...@psg.com wrote: i suspect that, if we opened smtp relays again, unblocked 25 for consumer chokeband, etc., total spam received

Re: ISP port blocking practice

2010-09-06 Thread Randy Bush
No. It'd just increase a LOT, astronomically. i suspect that, if we opened smtp relays again, unblocked 25 for consumer chokeband, etc., total spam received would likely increase a bit.  but my guess, and i mean guess, is that the limiting parameter could well be how many bots the perps can

Re: ISP port blocking practice

2010-09-06 Thread Suresh Ramasubramanian
On Tue, Sep 7, 2010 at 7:29 AM, Randy Bush ra...@psg.com wrote: i keep hearing that, but am having a hard time finding supporting data. Might see the stats from http://cbl.abuseat.org - by AS. Then compare the stats on a non port 25 filtered network (they have stats by AS) to stats on a network

Re: ISP port blocking practice

2010-09-05 Thread Kevin Oberman
From: Dobbins, Roland rdobb...@arbor.net Date: Fri, 3 Sep 2010 21:07:49 + On Sep 3, 2010, at 8:02 PM, Patrick W. Gilmore wrote: Could you point to more than one instance? I've not yet found one. I've yet to run across this, either, FWIW, except on extremely restrictive

Re: ISP port blocking practice

2010-09-05 Thread Claudio Lapidus
Hello all, On Fri, Sep 3, 2010 at 11:30 PM, Ricky Beam jfb...@gmail.com wrote: If I block port 25 on my network, no spam will originate from it. (probablly) The spammers will move on to a network that doesn't block their crap.  As long as there are such open networks, spam will be rampant.  

Re: ISP port blocking practice

2010-09-05 Thread Patrick W. Gilmore
Composed on a virtual keyboard, please forgive typos. On Sep 6, 2010, at 1:36, Claudio Lapidus clapi...@gmail.com wrote: Hello all, On Fri, Sep 3, 2010 at 11:30 PM, Ricky Beam jfb...@gmail.com wrote: If I block port 25 on my network, no spam will originate from it. (probablly) The

Re: ISP port blocking practice

2010-09-05 Thread Franck Martin
...@ianai.net To: North American Operators' Group nanog@nanog.org Sent: Monday, 6 September, 2010 12:11:16 PM Subject: Re: ISP port blocking practice Composed on a virtual keyboard, please forgive typos. On Sep 6, 2010, at 1:36, Claudio Lapidus clapi...@gmail.com wrote: Hello all, On Fri, Sep 3, 2010

Re: ISP port blocking practice

2010-09-05 Thread Jon Lewis
On Sun, 5 Sep 2010, Claudio Lapidus wrote: If I block port 25 on my network, no spam will originate from it. (probablly) The spammers will move on to a network that doesn't block their crap.  As long as there are such open networks, spam will be rampant.  If, overnight, every network filtered

Re: ISP port blocking practice

2010-09-05 Thread Paul Ferguson
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Sun, Sep 5, 2010 at 6:13 PM, Franck Martin fra...@genius.com wrote: In many countries, the presence of bots consume a non-trivial amount of bandwidth. In developing countries, this is a non trivial amount of $$$

Re: ISP port blocking practice

2010-09-05 Thread Owen DeLong
On Sep 5, 2010, at 10:36 AM, Claudio Lapidus wrote: Hello all, On Fri, Sep 3, 2010 at 11:30 PM, Ricky Beam jfb...@gmail.com wrote: If I block port 25 on my network, no spam will originate from it. (probablly) The spammers will move on to a network that doesn't block their crap. As long

Re: ISP port blocking practice

2010-09-05 Thread Owen DeLong
On Sep 5, 2010, at 6:18 PM, Jon Lewis wrote: On Sun, 5 Sep 2010, Claudio Lapidus wrote: If I block port 25 on my network, no spam will originate from it. (probablly) The spammers will move on to a network that doesn't block their crap. As long as there are such open networks, spam will be

Re: ISP port blocking practice

2010-09-05 Thread Franck Martin
- Original Message - From: Owen DeLong o...@delong.com To: Jon Lewis jle...@lewis.org Cc: NANOG list nanog@nanog.org Sent: Monday, 6 September, 2010 3:06:29 PM Subject: Re: ISP port blocking practice On Sep 5, 2010, at 6:18 PM, Jon Lewis wrote: On Sun, 5 Sep 2010, Claudio

Re: ISP port blocking practice

2010-09-03 Thread Owen DeLong
On Sep 2, 2010, at 8:54 PM, Patrick W. Gilmore wrote: On Sep 2, 2010, at 11:48 PM, Owen DeLong wrote: We should be seeking to stop damaging the network for ineffective anti spam measures (blocking outbound 25 for example) rather than to expand this practice to bidirectional brokenness.

Re: ISP port blocking practice

2010-09-03 Thread Owen DeLong
On Sep 2, 2010, at 9:08 PM, Jack Bates wrote: Patrick W. Gilmore wrote: We should be seeking to stop damaging the network for ineffective anti spam measures (blocking outbound 25 for example) rather than to expand this practice to bidirectional brokenness. Since at least part of your

Re: ISP port blocking practice

2010-09-03 Thread John Levine
Really? So, since so many ISPs are blocking port 25, there's lots less spam hitting our networks? It's been extremely effective in blocking spam sent by spambots on large ISPs. It's not a magic anti-spam bullet. (If you know one, please let us know.) workaround. Since, like many of us, I use

Re: ISP port blocking practice

2010-09-03 Thread Owen DeLong
To: NANOG list nanog@nanog.org Sent: Friday, 3 September, 2010 4:08:54 PM Subject: Re: ISP port blocking practice Patrick W. Gilmore wrote: We should be seeking to stop damaging the network for ineffective anti spam measures (blocking outbound 25 for example) rather than to expand

Re: ISP port blocking practice

2010-09-03 Thread Owen DeLong
, 2010 3:48:20 PM Subject: Re: ISP port blocking practice We should be seeking to stop damaging the network for ineffective anti spam measures (blocking outbound 25 for example) rather than to expand this practice to bidirectional brokenness. Owen Sent from my iPad On Sep 3, 2010

Re: ISP port blocking practice

2010-09-03 Thread Patrick W. Gilmore
On Sep 3, 2010, at 8:12 AM, Owen DeLong wrote: On Sep 2, 2010, at 8:54 PM, Patrick W. Gilmore wrote: On Sep 2, 2010, at 11:48 PM, Owen DeLong wrote: We should be seeking to stop damaging the network for ineffective anti spam measures (blocking outbound 25 for example) rather than to expand

Re: ISP port blocking practice

2010-09-03 Thread Patrick W. Gilmore
On Sep 3, 2010, at 8:22 AM, Owen DeLong wrote: On Sep 2, 2010, at 10:41 PM, Franck Martin wrote: Have you heard of the submission port? Yes... Many of the idiots that block outbound 25 also block outbound 587 and sometimes 465. Could you point to more than one instance? I've not yet

Re: ISP port blocking practice

2010-09-03 Thread Jack Bates
Patrick W. Gilmore wrote: Yes... Many of the idiots that block outbound 25 also block outbound 587 and sometimes 465. Could you point to more than one instance? I've not yet found one. And I think I spend at least as much time in hotels 3G airports etc. as you anyone else here. I

Re: ISP port blocking practice

2010-09-03 Thread JC Dill
Patrick W. Gilmore wrote: On Sep 3, 2010, at 8:22 AM, Owen DeLong wrote: On Sep 2, 2010, at 10:41 PM, Franck Martin wrote: Have you heard of the submission port? Yes... Many of the idiots that block outbound 25 also block outbound 587 and sometimes 465. Could you

Re: ISP port blocking practice

2010-09-03 Thread Randy Bush
FWIW, I had it happen at a local library. Used their webform to send a message mentioning that blocking 25 was good, but blocking 587 and 465 was bad. It took several days but they did fix it. that was the condition at narita red carpet a few years back. had to pull a chain at ugs in

Re: ISP port blocking practice

2010-09-03 Thread William Herrin
On Thu, Sep 2, 2010 at 11:04 PM, Daniel Senie d...@senie.com wrote: Ingress filtering is the correct tool for the job. Not really. Ingress filtering only ever protected you from being the source of spooding attacks, not the destination. The point of Zhiyun's results is that it doesn't fully

Re: ISP port blocking practice

2010-09-03 Thread Nick Hilliard
On 03/09/2010 16:16, Randy Bush wrote: that was the condition at narita red carpet a few years back. had to pull a chain at ugs in chicago to find someone who knew what i meant. and people wonder why developers implement * over http/https. Sigh. Nick

Re: ISP port blocking practice

2010-09-03 Thread Owen DeLong
I have had it happen in some metro areas on sprint. I have experienced it in at least a dozen hotels over the last 12 months. I have run into it in various airports with free public wifi. I have run into the problem in several coffee shops. By far, the worst offenders are the most expensive

Re: ISP port blocking practice

2010-09-03 Thread Curtis Maurand
I use SSL only and even then, it requires authentication. --Curtis On 9/3/2010 1:00 PM, Owen DeLong wrote: I have had it happen in some metro areas on sprint. I have experienced it in at least a dozen hotels over the last 12 months. I have run into it in various airports with free public

Re: ISP port blocking practice

2010-09-03 Thread Owen DeLong
Sent from my iPad On Sep 3, 2010, at 10:10 PM, John Levine jo...@iecc.com wrote: Really? So, since so many ISPs are blocking port 25, there's lots less spam hitting our networks? It's been extremely effective in blocking spam sent by spambots on large ISPs. It's not a magic anti-spam

Re: ISP port blocking practice

2010-09-03 Thread Dobbins, Roland
On Sep 3, 2010, at 10:23 PM, William Herrin wrote: Frankly, Zhiyun offers the first truly rational case I've personally seen for packet filtering based on the TCP source port. While the paper is entertaining and novel, and reflects a lot of creativity and hard work on the part of the

Re: ISP port blocking practice

2010-09-03 Thread Dobbins, Roland
On Sep 4, 2010, at 3:11 AM, Dobbins, Roland wrote: I've certainly never run across it, nor do I know anyone else who has done so. I stand corrected - it seems I do in fact know someone who's observed this technique used to send spam, albeit in the past when POTS dial-up pools were the

Re: ISP port blocking practice

2010-09-03 Thread Dobbins, Roland
On Sep 3, 2010, at 8:02 PM, Patrick W. Gilmore wrote: Could you point to more than one instance? I've not yet found one. I've yet to run across this, either, FWIW, except on extremely restrictive special-purpose endpoint networks. Doesn't mean that it doesn't happen, but it doesn't seem

Re: ISP port blocking practice

2010-09-03 Thread John R. Levine
It's been extremely effective in blocking spam sent by spambots on large ISPs. It's not a magic anti-spam bullet. (If you know one, please let us know.) That simply hasn't been my experience. I still get lots of spam from booted hosts in large provider networks, and yes, that includes many

RE: ISP port blocking practice

2010-09-03 Thread Paul Stewart
[mailto:jo...@iecc.com] Sent: Friday, September 03, 2010 3:20 PM To: Owen DeLong Cc: nanog@nanog.org Subject: Re: ISP port blocking practice It's been extremely effective in blocking spam sent by spambots on large ISPs. It's not a magic anti-spam bullet. (If you know one, please let us know

Re: ISP port blocking practice

2010-09-03 Thread Doug Barton
On 9/3/2010 3:19 PM, John R. Levine wrote: I know people at large ISPs with actual data. Port 25 blocking is quite effective. Well no one has said it in this thread yet, so I guess it's my turn. :) When talking about spam it often happens that people make statements along the lines of, Spam

Re: ISP port blocking practice

2010-09-03 Thread Franck Martin
I asked around and got this presentation, but you can search for OP25B too: http://www.anacom.pt/streaming/Honda.pdf?contentId=988141field=ATTACHED_FILE Some non-anecdotal data about the effectiveness of blocking port 25.

Re: ISP port blocking practice

2010-09-03 Thread Ricky Beam
On Fri, 03 Sep 2010 08:12:01 -0400, Owen DeLong o...@delong.com wrote: Really? So, since so many ISPs are blocking port 25, there's lots less spam hitting our networks? Less than there could be. It appears a lot less effective because there are so many ISPs not doing any blocking. Both

Re: ISP port blocking practice

2010-09-03 Thread Patrick W. Gilmore
Composed on a virtual keyboard, please forgive typos. On Sep 3, 2010, at 23:50, Owen DeLong o...@delong.com wrote: I think you overestimate the efficacy of this. First, why [snip] I think I see the problem here. You are using logic though experiments, while others have this thing

Re: ISP port blocking practice

2010-09-03 Thread John R. Levine
Does the data show that blocking was effective, as in the host didn't detect the block and proceed around it, or, merely that lots of hosts try the direct approach first? Yes. R's, John

Re: ISP port blocking practice

2010-09-02 Thread Zhiyun Qian
Sorry for bringing this old topic back. But we have made some academic effort investigating the spamming behaviors using assymetric routing (we named it triangualr spamming). This work appeared in this year's IEEE Security Privacy conference. You can take a look at it if you are interested

Re: ISP port blocking practice

2010-09-02 Thread William Herrin
On Thu, Sep 2, 2010 at 5:59 PM, Zhiyun Qian zhiy...@umich.edu wrote: http://www.eecs.umich.edu/~zhiyunq/pub/oakland10_triangular-spamming.pdf One of the high-level findings is that we developed probing techniques to verify that indeed most ISPs are only blocking 1) outgoing traffic of

Re: ISP port blocking practice

2010-09-02 Thread Zhiyun Qian
You are exactly right. We also talked about stateful firewall that can protect the GoodNet. For NAT box, depends on the type of NAT, it is possible to setup port forwarding on the router (mostly home routers) via uPnP without any authentication (I think many home routers are like this by

Re: ISP port blocking practice

2010-09-02 Thread Suresh Ramasubramanian
Zhiyun, this is by far the most comprehensive paper I've seen on asymmetric routing spam .. a technique that's as old as, for example, Alan Ralsky. So been around for about a decade. Congratulations, great effort. Do you have more results available (in more detail than were published in this

Re: ISP port blocking practice

2010-09-02 Thread Zhiyun Qian
Suresh, thanks for your interest. I see you've had a lot of experience in fighting spam, so you must have known this. Yes, I know this spamming technique has been around for a while. But it's surprising to see that the majority of the ISPs that we studied are still vulnerable to this attack.

Re: ISP port blocking practice

2010-09-02 Thread Suresh Ramasubramanian
BCP38 / RFC2827 were created specifically to address some quite similar problems. And googling either of those two strings on nanog will get you a lot of griping and/or reasons as to why these aren't being more widely adopted :) --srs On Fri, Sep 3, 2010 at 7:47 AM, Zhiyun Qian

Re: ISP port blocking practice

2010-09-02 Thread Zhiyun Qian
Great. Thanks for the information. -Zhiyun On Sep 2, 2010, at 9:20 PM, Suresh Ramasubramanian wrote: BCP38 / RFC2827 were created specifically to address some quite similar problems. And googling either of those two strings on nanog will get you a lot of griping and/or reasons as to why

Re: ISP port blocking practice

2010-09-02 Thread Daniel Senie
Ingress filtering is the correct tool for the job. The whole point here is that packets are coming from somewhere they should not, and they are thus spoofed. The tools have been in place to deal with this for a very long time now. The drafts that became RFC 2267 (precursor of RFC 2827 / BCP38)

Re: ISP port blocking practice

2010-09-02 Thread Owen DeLong
We should be seeking to stop damaging the network for ineffective anti spam measures (blocking outbound 25 for example) rather than to expand this practice to bidirectional brokenness. Owen Sent from my iPad On Sep 3, 2010, at 12:25 PM, Zhiyun Qian zhiy...@umich.edu wrote: I skimmed through

Re: ISP port blocking practice

2010-09-02 Thread Patrick W. Gilmore
On Sep 2, 2010, at 11:48 PM, Owen DeLong wrote: We should be seeking to stop damaging the network for ineffective anti spam measures (blocking outbound 25 for example) rather than to expand this practice to bidirectional brokenness. Since at least part of your premise ('ineffective

Re: ISP port blocking practice

2010-09-02 Thread Franck Martin
...@umich.edu Cc: NANOG list nanog@nanog.org Sent: Friday, 3 September, 2010 3:48:20 PM Subject: Re: ISP port blocking practice We should be seeking to stop damaging the network for ineffective anti spam measures (blocking outbound 25 for example) rather than to expand this practice

Re: ISP port blocking practice

2010-09-02 Thread Jack Bates
Patrick W. Gilmore wrote: We should be seeking to stop damaging the network for ineffective anti spam measures (blocking outbound 25 for example) rather than to expand this practice to bidirectional brokenness. Since at least part of your premise ('ineffective anti-spam measures') has been

Re: ISP port blocking practice

2010-09-02 Thread Franck Martin
Have you heard of the submission port? Why Clients of an hotel would run a MTA anyhow? - Original Message - From: Jack Bates jba...@brightok.net To: NANOG list nanog@nanog.org Sent: Friday, 3 September, 2010 4:08:54 PM Subject: Re: ISP port blocking practice Patrick W. Gilmore wrote

Re: ISP port blocking practice

2009-11-03 Thread mark [at] edgewire
Hi all, Just out of curiosity for those whom may manage Hotel Wifi networks (I know I know, not really ISP level but since we're on the topic of port blocking). Does anyone actually make an effort to be blocking port 443? I've had that experience at a few Hotels in Philippines and I

Re: ISP port blocking practice

2009-11-03 Thread Jared Mauch
On Nov 3, 2009, at 8:51 PM, mark [at] edgewire wrote: Hi all, Just out of curiosity for those whom may manage Hotel Wifi networks (I know I know, not really ISP level but since we're on the topic of port blocking). Does anyone actually make an effort to be blocking port 443? I've had

Re: ISP port blocking practice

2009-11-03 Thread Ron Bonica
Folks, I would love to see the IETF OPSEC WG publish a Best Common Practices document on ISP Port filtering. The document would capture information similar to that offered by Justin. Would anybody on this list be willing to author an Internet Draft? Ron

Re: ISP port blocking practice/Free Speech

2009-10-26 Thread Richard Bennett
The U. S. Congress is on the spot already, proposing strict scrutiny tests for filtering and forwarding decisions of all kinds. RB Randy Bush wrote: should we now look forward to deep technical opinons from law clerks -- Richard Bennett Research Fellow Information Technology and

Re: ISP port blocking practice

2009-10-26 Thread Joe Provo
[tangent of interst for the archives] On Sat, Oct 24, 2009 at 02:07:42PM -0500, Joe Greco wrote: [snip] If I'm assigned 24.1.2.3 by Comcast, and Comcast filters my ingress to prevent me from emitting other addresses, you claim that's fine because it's BCP38. There's a problem: I can

RE: ISP port blocking practice/Free Speech

2009-10-25 Thread Richard E. Brown
Free speech doesn't include the freedom to shout fire in a crowded theatre. It most certainly does! There is absolutely nothing to prevent one from shouting FIRE in a crowded theatre. Actually, it doesn't. When I was on-staff at the computer center at Dartmouth, our provost also

RE: ISP port blocking practice/Free Speech

2009-10-25 Thread Keith Medcalf
- From: Richard E. Brown [mailto:richard.e.br...@dartware.com] Sent: Sunday, 25 October, 2009 10:05 To: nanog@nanog.org Subject: RE: ISP port blocking practice/Free Speech Free speech doesn't include the freedom to shout fire in a crowded theatre. It most certainly does

Re: ISP port blocking practice/Free Speech

2009-10-25 Thread John Levine
Your scholar is wrong -- or he is giving the simplified explanation for children and others incapable of rational though and understanding, and you are believing the summary because it is simpler for you than understanding the underlying rational. Ah, the classic nerd legal misconception. Laws

Re: ISP port blocking practice

2009-10-25 Thread Joe Provo
On Fri, Oct 23, 2009 at 04:19:23PM -0500, Lee Riemer wrote: Isn't blocking any port against the idea of Net Neutrality? Which demonstrates just how relevant to reality such things are. -- RSUC / GweepNet / Spunk / FnB / Usenix / SAGE

Re: ISP port blocking practice/Free Speech

2009-10-25 Thread Randy Bush
should we now look forward to deep technical opinons from law clerks

Re: ISP port blocking practice

2009-10-24 Thread a . harrowell
-original message- Subject: Re: ISP port blocking practice From: Owen DeLong o...@delong.com Date: 24/10/2009 4:00 am Yes. Owen On Oct 23, 2009, at 2:19 PM, Lee Riemer wrote: Isn't blocking any port against the idea of Net Neutrality? Only if you take a legalistic view of it. Too much

Re: ISP port blocking practice

2009-10-24 Thread Joe Greco
Isn't blocking any port against the idea of Net Neutrality? Yes. Owen No. The idea of net neutrality, in this context, is for service providers to avoid making arbitrary decisions about the services that a customer will be allowed. Blocking 25, or 137-139, etc., are common steps taken to

Re: ISP port blocking practice

2009-10-24 Thread Patrick W. Gilmore
On Oct 23, 2009, at 10:54 PM, Owen DeLong wrote: On Oct 23, 2009, at 3:43 PM, Justin Shore wrote: Dan White wrote: On 23/10/09 17:58 -0400, James R. Cutler wrote: Blocking the well known port 25 does not block sending of mail. Or the message content. It does block incoming SMTP traffic on

Re: ISP port blocking practice

2009-10-24 Thread JC Dill
Chris Boyd wrote: Once it's set up correctly we've found customers really like it since their email just works in most places. Earlier this week I had an experience at a San Jose[1] Public Library, where they blocked ports 995, 587, 465, and 119. None of my mail services (or usenet

Re: ISP port blocking practice

2009-10-24 Thread Owen DeLong
On Oct 24, 2009, at 3:17 AM, Joe Greco wrote: Isn't blocking any port against the idea of Net Neutrality? Yes. Owen No. The idea of net neutrality, in this context, is for service providers to avoid making arbitrary decisions about the services that a customer will be allowed. Right.

Re: ISP port blocking practice

2009-10-24 Thread Joe Greco
On Oct 24, 2009, at 3:17 AM, Joe Greco wrote: Isn't blocking any port against the idea of Net Neutrality? Yes. Owen No. The idea of net neutrality, in this context, is for service providers to avoid making arbitrary decisions about the services that a customer will be

RE: ISP port blocking practice

2009-10-24 Thread Keith Medcalf
Free speech doesn't include the freedom to shout fire in a crowded theatre. It most certainly does! There is absolutely nothing to prevent one from shouting FIRE in a crowded theatre. In fact, any attempt to legislate a prohibition against such behaviour would, in all civilized countries

Re: ISP port blocking practice

2009-10-24 Thread Clue Store
Blocking port 25 is not, IMHO, a violation of Network Neutrality. I explained why in a very long, probably boring, post. Your definition of Network neutrality may differ. Which is fine, but doesn't make mine wrong. -- TTFN, patrick I agree with this. I would think that from an

Re: ISP port blocking practice

2009-10-23 Thread Jon Kibler
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Steve Bertrand wrote: Jon Kibler wrote: To answer that question, I would start with ingress and egress filtering by IP address, protocol, etc.: 1) Never allow traffic to egress any subnet unless its source IP address is within that subnet

Re: ISP port blocking practice

2009-10-23 Thread Steve Bertrand
Jon Kibler wrote: Steve Bertrand wrote: Jon Kibler wrote: To answer that question, I would start with ingress and egress filtering by IP address, protocol, etc.: 1) Never allow traffic to egress any subnet unless its source IP address is within that subnet range. Sorry to nit, but

Re: ISP port blocking practice

2009-10-23 Thread Justin Shore
Owen DeLong wrote: Blocking ports that the end user has not asked for is bad. I was going to ask for a clarification to make sure I read your statement correctly but then again it's short enough I really don't see any room to misinterpret it. Do you seriously think that a typical

Re: ISP port blocking practice

2009-10-23 Thread Chris Boyd
On Oct 22, 2009, at 6:14 PM, Lyndon Nerenberg (VE6BBM/VE7TFX) wrote: My experience is that port 587 isn't used because ISPs block it out-of-hand. Or in the case of Rogers in (at least) Vancouver, hijack it with a proxy that filters out the AUTH parts of the EHLO response, making the whole

Re: ISP port blocking practice

2009-10-23 Thread Jack Bates
Chris Boyd wrote: Once it's set up correctly we've found customers really like it since their email just works in most places. We get the same response. The largest 587 usage we have currently, though, is cell/PDA. Jack

Re: ISP port blocking practice

2009-10-23 Thread Steve Bertrand
Chris Boyd wrote: On Oct 22, 2009, at 6:14 PM, Lyndon Nerenberg (VE6BBM/VE7TFX) wrote: My experience is that port 587 isn't used because ISPs block it out-of-hand. Or in the case of Rogers in (at least) Vancouver, hijack it with a proxy that filters out the AUTH parts of the EHLO

Re: ISP port blocking practice

2009-10-23 Thread Michael Peddemors
On October 23, 2009, Steve Bertrand wrote: http://eagle.ca/update/mail/Outlook_Express/index.html ...yes, believe it or not, even with the pictures, they will sometimes still get it wrong ;) Years in planning and implementation, but a good, large-scale learning exercise and the

Re: ISP port blocking practice

2009-10-23 Thread Steve Bertrand
Michael Peddemors wrote: On October 23, 2009, Steve Bertrand wrote: http://eagle.ca/update/mail/Outlook_Express/index.html ...yes, believe it or not, even with the pictures, they will sometimes still get it wrong ;) Years in planning and implementation, but a good, large-scale learning

Re: ISP port blocking practice

2009-10-23 Thread Lyndon Nerenberg (VE6BBM/VE7TFX)
Rogers says they don't do that, and lots of other people seem to be able to use port 587 on Rogers (and other ISPs) without problems. I'm in Calgary right now so I can't check the current behaviour, but as of June 1st it was still broken. Broken in the sense that any connection to port 587

Re: ISP port blocking practice

2009-10-23 Thread Chris Boyd
On Oct 23, 2009, at 12:15 PM, Lyndon Nerenberg (VE6BBM/VE7TFX) wrote: As for outright blockage of port 587, I get this complaint from many of my clients while they are on the road. It seems hotels love to block it. I travel a bit (used to a lot) and only found one place that proxied it.

Re: ISP port blocking practice

2009-10-23 Thread Lee Riemer
Isn't blocking any port against the idea of Net Neutrality? Justin Shore wrote: Owen DeLong wrote: Blocking ports that the end user has not asked for is bad. I was going to ask for a clarification to make sure I read your statement correctly but then again it's short enough I really don't

Re: ISP port blocking practice

2009-10-23 Thread James R. Cutler
Blocking the well known port 25 does not block sending of mail. Or the message content. Blocking various well know M$ protocol ports does not block remote file access. Or control the type of files that can be accessed. I think the relevant neutrality principle is that traffic is not

Re: ISP port blocking practice

2009-10-23 Thread Justin Shore
Dan White wrote: On 23/10/09 17:58 -0400, James R. Cutler wrote: Blocking the well known port 25 does not block sending of mail. Or the message content. It does block incoming SMTP traffic on that well known port. Then the customer should have bought a class of service that permits

Re: ISP port blocking practice

2009-10-23 Thread James R. Cutler
No, blocking a port does not restrict a customers use of the network any more than one way streets restrict access to downtown stores. It just forces certain traffic directions in a bicycle/motorcycle/car/van/ truck neutral manner. Carry anything you want. Others laws restrict incendiary

Re: ISP port blocking practice

2009-10-23 Thread Patrick W. Gilmore
The original intent of Net Neutrality laws had nothing to do with blocking or not on random ports. It had to do with giving an unfair advantage to the provider in question to sell competing services. Much like anti-trust legislation doesn't stop a company from cornering a market, just

Re: ISP port blocking practice

2009-10-23 Thread Dan White
On 23/10/09 17:43 -0500, Justin Shore wrote: It does block incoming SMTP traffic on that well known port. Then the customer should have bought a class of service that permits servers. That justification is a slippery slope. At what point do you draw the line on what constitutes business

Re: ISP port blocking practice

2009-10-23 Thread Owen DeLong
On Oct 23, 2009, at 3:43 PM, Justin Shore wrote: Dan White wrote: On 23/10/09 17:58 -0400, James R. Cutler wrote: Blocking the well known port 25 does not block sending of mail. Or the message content. It does block incoming SMTP traffic on that well known port. Then the customer should

Re: ISP port blocking practice

2009-10-23 Thread Owen DeLong
Yes. Owen On Oct 23, 2009, at 2:19 PM, Lee Riemer wrote: Isn't blocking any port against the idea of Net Neutrality? Justin Shore wrote: Owen DeLong wrote: Blocking ports that the end user has not asked for is bad. I was going to ask for a clarification to make sure I read your

  1   2   >