Visited http://www.orbs.org/ recently?

Visited http://www.orbs.org/ recently?

[Chris Faylor]

If I'm reading the message at the ORBS web site correctly, then it looks
like ORBS has temporarily shutdown its service.  It looks like the recent
confusion where sites were blocked that had no business being blocked may
have been due to a concerted effort to shut ORBS down.

The web site has more details about this.

cgf

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Mon, Jul 17, 2000 at 06:51:23PM -0400, Chris Faylor wrote:
> If I'm reading the message at the ORBS web site correctly, then it looks
> like ORBS has temporarily shutdown its service.  

It doesn't say when this was added.  It seems to be still working.
Here are a couple of recent entries from the rbl log on sourceware:

Jul 14 22:18:40 sourceware 12140: Host 212.155.174.1 is found in ORBS for list cygwin sender l195h9xptjts@aol.com 
Jul 16 15:18:26 sourceware 29181: Host 206.15.26.42 is found in ORBS for list newlib sender bigwater0258@uku.co.uk 

If ORBS does go off-line, the only result would be that
/usr/local/bin/rblcheck on sourceware has to wait for it to time
out before approving mail messages.  It'd still check the MAPS RBL, DUL,
and RSS lists, of course.

J

Re: Visited http://www.orbs.org/ recently?

[Tom Tromey]

>> If I'm reading the message at the ORBS web site correctly, then it
>> looks like ORBS has temporarily shutdown its service.

Let's write the losers who killed ORBS and find out what their story
is.  Disagreeing with ORBS is fine.  A preemptive nuclear strike is
not.

Tom

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Mon, Jul 17, 2000 at 04:26:30PM -0700, Tom Tromey wrote:
> >> If I'm reading the message at the ORBS web site correctly, then it
> >> looks like ORBS has temporarily shutdown its service.
> 
> Let's write the losers who killed ORBS and find out what their story
> is.  Disagreeing with ORBS is fine.  A preemptive nuclear strike is
> not.

Paul Vixie et al, according to the ORBS page.

I don't know...  I don't know Vixie at all, but I've always thought
of him as a non-moron, and the things that the ORBS page allege
seem moronic.  I wouldn't jump to any conclusions without any more
information.  I can't help but think that someone has hacked the
ORBS page and stuck it there as a joke or something.

(If nothing else, the idea that ORBS provides competition to MAPS,
and so Vixie et al are doing this to help their business makes no
sense.  They're two completely different approaches to RBL'ing,
and most businesses would not be interested in the ORBS approach
given the number of false positives it garners.)

J

Re: Visited http://www.orbs.org/ recently?

[Gerald Pfeifer]

On Mon, 17 Jul 2000, Jason Molenda wrote:
> Paul Vixie et al, according to the ORBS page.
> 
> I don't know...  I don't know Vixie at all, but I've always thought
> of him as a non-moron, and the things that the ORBS page allege
> seem moronic.  I wouldn't jump to any conclusions without any more
> information.  I can't help but think that someone has hacked the
> ORBS page and stuck it there as a joke or something.

Nope. And Vixie, well, read yourself: 

  [Abovenet] readvertise the /16 which ORBS's upstream provider advertises
  to Abovenet.  [...] Now, the fact is, Abovenet is pretty good, and so
  the /16 they readvertise is going to be the preferred path for a lot of
  folks to reach ORBS's upstream and therefore ORBS itself.
  And, since Abovenet does not route for ORBS even though they readvertise
  the /16 advertised to them by ORBS's upstream, ORBS loses some amount of
  connectivity due to Abovenet's nonrouting of ORBS.

The last sentence is the crucial one: Abovenet does not provide access to
ORBS (website,...) to its own customers, but it also readvertises routes
to ORBS to its peers/downstreams and then sinks them in its internal
network. 

Unbelievable, but true. 

(You might want to check with your providers and ask them to overrule
this via static routes. I already did so over a month ago; now the 
entire Austrian Academic Network routes around Abovenet to reach ORBS.)

Gerald
-- 
Gerald "Jerry" pfeifer@dbai.tuwien.ac.at http://www.dbai.tuwien.ac.at/~pfeifer/
Have a look at http://petition.eurolinux.org -- it's not about Linux, btw!

Re: Visited http://www.orbs.org/ recently?

[Chris Faylor]

On Tue, Jul 18, 2000 at 02:27:39AM +0200, Gerald Pfeifer wrote:
>On Mon, 17 Jul 2000, Jason Molenda wrote:
>> Paul Vixie et al, according to the ORBS page.
>> 
>> I don't know...  I don't know Vixie at all, but I've always thought
>> of him as a non-moron, and the things that the ORBS page allege
>> seem moronic.  I wouldn't jump to any conclusions without any more
>> information.  I can't help but think that someone has hacked the
>> ORBS page and stuck it there as a joke or something.
>
>Nope. And Vixie, well, read yourself: 
>
>  [Abovenet] readvertise the /16 which ORBS's upstream provider advertises
>  to Abovenet.  [...] Now, the fact is, Abovenet is pretty good, and so
>  the /16 they readvertise is going to be the preferred path for a lot of
>  folks to reach ORBS's upstream and therefore ORBS itself.
>  And, since Abovenet does not route for ORBS even though they readvertise
>  the /16 advertised to them by ORBS's upstream, ORBS loses some amount of
>  connectivity due to Abovenet's nonrouting of ORBS.
>
>The last sentence is the crucial one: Abovenet does not provide access to
>ORBS (website,...) to its own customers, but it also readvertises routes
>to ORBS to its peers/downstreams and then sinks them in its internal
>network. 
>
>Unbelievable, but true. 
>
>(You might want to check with your providers and ask them to overrule
>this via static routes. I already did so over a month ago; now the 
>entire Austrian Academic Network routes around Abovenet to reach ORBS.)

Is there a reason for this vendetta beyond the alleged commercial one?

cgf

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Mon, Jul 17, 2000 at 08:29:02PM -0400, Chris Faylor wrote:

> Is there a reason for this vendetta beyond the alleged commercial one?

Maybe Gerald knows something about the specifics of this case, but
in general ORBS gets a lot of heat from indignant sysadmins on the
net.

I was on a mailing list about spam blocking tools and regular little
flamewars would ignite, between ORBS who says "Deny my probes and
you shall be listed" and sysadmins who say "Your probes are
tresspassing on my system, I'm blocking any connections from your
IP #s."   (of course, instead of just blocking the connections and
moving on, they insist on arguging about it at great length)

It seems stupid, but people get really upset over this stuff.  I
wouldn't be surprised if it found its root in something like that.

Jason

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Tue, Jul 18, 2000 at 02:27:39AM +0200, Gerald Pfeifer wrote:

> (You might want to check with your providers and ask them to overrule
> this via static routes. I already did so over a month ago; now the 
> entire Austrian Academic Network routes around Abovenet to reach ORBS.)

It seems that Cygnus/RH is able to get there no problems (and I
can connect to www.orbs.org from Yahoo).  Maybe it's just luck,
but we haven't seen any outages here in the Bay Area as far as I
know.

J

Re: Visited http://www.orbs.org/ recently?

[Chris Faylor]

On Mon, Jul 17, 2000 at 05:39:32PM -0700, Jason Molenda wrote:
>On Tue, Jul 18, 2000 at 02:27:39AM +0200, Gerald Pfeifer wrote:
>> (You might want to check with your providers and ask them to overrule
>> this via static routes. I already did so over a month ago; now the 
>> entire Austrian Academic Network routes around Abovenet to reach ORBS.)
>
>It seems that Cygnus/RH is able to get there no problems (and I
>can connect to www.orbs.org from Yahoo).  Maybe it's just luck,
>but we haven't seen any outages here in the Bay Area as far as I
>know.

We've been getting a flurry of complaints from people who insist that
there is no reason for them to be blocked.  When you check the IP
address they are not blocked and subsequent email from them is
delivered just fine.

I wonder if this is somehow a symptom of ORBS problems with MAPS.

cgf

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Mon, Jul 17, 2000 at 08:42:50PM -0400, Chris Faylor wrote:

> We've been getting a flurry of complaints from people who insist that
> there is no reason for them to be blocked.  When you check the IP
> address they are not blocked and subsequent email from them is
> delivered just fine.
> 
> I wonder if this is somehow a symptom of ORBS problems with MAPS.

Maybe it is.  As far as I know, that _shouldn't_ happen.  For
instance, when another RBL we were using went off the air (IMRSS?
I forget what it was called), there was no affect on the lookup
script.  /usr/local/bin/rblcheckup would try to look the addr up
in the IMRSS DNS domain, time out after 30-60 seconds, and move on
to the next RBL.

Similarly, if ORBS wasn't reachable, rblcheck _should_ just waste
half a minute or so waiting for a response.  In fact, you can tell
when this kind of thing is happening if you look at the rbl log on
sourceware - there is an initial "Checking this IP#" log message,
and then when rblcheck has checked all the RBLs, there is a "This
IP is OK" message.  There are timestamps on both.

I could be mistaken - I'm only talking about how it is supposed to
work.  I have trouble imaging a scenario where non-response from
the RBL could be interpreted as a match, though.

(On the other hand, it may be that ORBS' database is buggy or
something.  I'd be pretty willing to believe something like that
was happening.)

J

Re: Visited http://www.orbs.org/ recently?

[Chris Faylor]

On Mon, Jul 17, 2000 at 05:52:25PM -0700, Jason Molenda wrote:
>(On the other hand, it may be that ORBS' database is buggy or
>something.  I'd be pretty willing to believe something like that
>was happening.)

I didn't see this myself, but Jim Kingdon actually experienced the
"ip in the database then it isn't" phenomenon over the weekend.

cgf

Re: Visited http://www.orbs.org/ recently?

[Jim Kingdon]

> If nothing else, the idea that ORBS provides competition to MAPS,
> and so Vixie et al are doing this to help their business makes no
> sense.

Oh that part makes plenty of sense.  Vixie was on
news.admin.net-abuse.email and he made it quite clear that he thought
that anyone besides MAPS who was doing this kind of thing was
confusing the public and damaging the internet and (well, the thread
was a while ago, before deja.com's amnesia, so don't trust my
recollection too much).

Whether Vixie & co would actually go to the lengths alleged to shut
down ORBS, I dunno.  If I had to guess I'd say that both sides
probably got carried away and fed into each other's paranoia.  Nick
Nicholas, who was one of the most sane people at MAPS, has left their
employ, which isn't a good sign.  Sigh.  And of course the ORBS folks
are even harder to get along with (well, if you want justification for
that statement you better go to one of the spam fighting lists and
make your own judgment; there seem to be as many opinions as
anti-spammers).

On the whole I do have a fair bit of respect for Vixie.  But how he's
reacted to ORBS (e.g. RBL'ing them some months/years ago, which Nick
Nicholas put a stop to) has been one of his finest moments.

Visited http://www.orbs.org/ recently?

[Chris Faylor]

If I'm reading the message at the ORBS web site correctly, then it looks
like ORBS has temporarily shutdown its service.  It looks like the recent
confusion where sites were blocked that had no business being blocked may
have been due to a concerted effort to shut ORBS down.

The web site has more details about this.

cgf

Re: Visited http://www.orbs.org/ recently?

[Chris Faylor]

On Mon, Jul 17, 2000 at 05:39:32PM -0700, Jason Molenda wrote:
>On Tue, Jul 18, 2000 at 02:27:39AM +0200, Gerald Pfeifer wrote:
>> (You might want to check with your providers and ask them to overrule
>> this via static routes. I already did so over a month ago; now the 
>> entire Austrian Academic Network routes around Abovenet to reach ORBS.)
>
>It seems that Cygnus/RH is able to get there no problems (and I
>can connect to www.orbs.org from Yahoo).  Maybe it's just luck,
>but we haven't seen any outages here in the Bay Area as far as I
>know.

We've been getting a flurry of complaints from people who insist that
there is no reason for them to be blocked.  When you check the IP
address they are not blocked and subsequent email from them is
delivered just fine.

I wonder if this is somehow a symptom of ORBS problems with MAPS.

cgf

Re: Visited http://www.orbs.org/ recently?

[Chris Faylor]

On Tue, Jul 18, 2000 at 02:27:39AM +0200, Gerald Pfeifer wrote:
>On Mon, 17 Jul 2000, Jason Molenda wrote:
>> Paul Vixie et al, according to the ORBS page.
>> 
>> I don't know...  I don't know Vixie at all, but I've always thought
>> of him as a non-moron, and the things that the ORBS page allege
>> seem moronic.  I wouldn't jump to any conclusions without any more
>> information.  I can't help but think that someone has hacked the
>> ORBS page and stuck it there as a joke or something.
>
>Nope. And Vixie, well, read yourself: 
>
>  [Abovenet] readvertise the /16 which ORBS's upstream provider advertises
>  to Abovenet.  [...] Now, the fact is, Abovenet is pretty good, and so
>  the /16 they readvertise is going to be the preferred path for a lot of
>  folks to reach ORBS's upstream and therefore ORBS itself.
>  And, since Abovenet does not route for ORBS even though they readvertise
>  the /16 advertised to them by ORBS's upstream, ORBS loses some amount of
>  connectivity due to Abovenet's nonrouting of ORBS.
>
>The last sentence is the crucial one: Abovenet does not provide access to
>ORBS (website,...) to its own customers, but it also readvertises routes
>to ORBS to its peers/downstreams and then sinks them in its internal
>network. 
>
>Unbelievable, but true. 
>
>(You might want to check with your providers and ask them to overrule
>this via static routes. I already did so over a month ago; now the 
>entire Austrian Academic Network routes around Abovenet to reach ORBS.)

Is there a reason for this vendetta beyond the alleged commercial one?

cgf

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Mon, Jul 17, 2000 at 06:51:23PM -0400, Chris Faylor wrote:
> If I'm reading the message at the ORBS web site correctly, then it looks
> like ORBS has temporarily shutdown its service.  

It doesn't say when this was added.  It seems to be still working.
Here are a couple of recent entries from the rbl log on sourceware:

Jul 14 22:18:40 sourceware 12140: Host 212.155.174.1 is found in ORBS for list cygwin sender l195h9xptjts@aol.com 
Jul 16 15:18:26 sourceware 29181: Host 206.15.26.42 is found in ORBS for list newlib sender bigwater0258@uku.co.uk 

If ORBS does go off-line, the only result would be that
/usr/local/bin/rblcheck on sourceware has to wait for it to time
out before approving mail messages.  It'd still check the MAPS RBL, DUL,
and RSS lists, of course.

J

Re: Visited http://www.orbs.org/ recently?

[Jim Kingdon]

> If nothing else, the idea that ORBS provides competition to MAPS,
> and so Vixie et al are doing this to help their business makes no
> sense.

Oh that part makes plenty of sense.  Vixie was on
news.admin.net-abuse.email and he made it quite clear that he thought
that anyone besides MAPS who was doing this kind of thing was
confusing the public and damaging the internet and (well, the thread
was a while ago, before deja.com's amnesia, so don't trust my
recollection too much).

Whether Vixie & co would actually go to the lengths alleged to shut
down ORBS, I dunno.  If I had to guess I'd say that both sides
probably got carried away and fed into each other's paranoia.  Nick
Nicholas, who was one of the most sane people at MAPS, has left their
employ, which isn't a good sign.  Sigh.  And of course the ORBS folks
are even harder to get along with (well, if you want justification for
that statement you better go to one of the spam fighting lists and
make your own judgment; there seem to be as many opinions as
anti-spammers).

On the whole I do have a fair bit of respect for Vixie.  But how he's
reacted to ORBS (e.g. RBL'ing them some months/years ago, which Nick
Nicholas put a stop to) has been one of his finest moments.

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Mon, Jul 17, 2000 at 08:42:50PM -0400, Chris Faylor wrote:

> We've been getting a flurry of complaints from people who insist that
> there is no reason for them to be blocked.  When you check the IP
> address they are not blocked and subsequent email from them is
> delivered just fine.
> 
> I wonder if this is somehow a symptom of ORBS problems with MAPS.

Maybe it is.  As far as I know, that _shouldn't_ happen.  For
instance, when another RBL we were using went off the air (IMRSS?
I forget what it was called), there was no affect on the lookup
script.  /usr/local/bin/rblcheckup would try to look the addr up
in the IMRSS DNS domain, time out after 30-60 seconds, and move on
to the next RBL.

Similarly, if ORBS wasn't reachable, rblcheck _should_ just waste
half a minute or so waiting for a response.  In fact, you can tell
when this kind of thing is happening if you look at the rbl log on
sourceware - there is an initial "Checking this IP#" log message,
and then when rblcheck has checked all the RBLs, there is a "This
IP is OK" message.  There are timestamps on both.

I could be mistaken - I'm only talking about how it is supposed to
work.  I have trouble imaging a scenario where non-response from
the RBL could be interpreted as a match, though.

(On the other hand, it may be that ORBS' database is buggy or
something.  I'd be pretty willing to believe something like that
was happening.)

J

Re: Visited http://www.orbs.org/ recently?

[Chris Faylor]

On Mon, Jul 17, 2000 at 05:52:25PM -0700, Jason Molenda wrote:
>(On the other hand, it may be that ORBS' database is buggy or
>something.  I'd be pretty willing to believe something like that
>was happening.)

I didn't see this myself, but Jim Kingdon actually experienced the
"ip in the database then it isn't" phenomenon over the weekend.

cgf

Re: Visited http://www.orbs.org/ recently?

[Tom Tromey]

>> If I'm reading the message at the ORBS web site correctly, then it
>> looks like ORBS has temporarily shutdown its service.

Let's write the losers who killed ORBS and find out what their story
is.  Disagreeing with ORBS is fine.  A preemptive nuclear strike is
not.

Tom

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Tue, Jul 18, 2000 at 02:27:39AM +0200, Gerald Pfeifer wrote:

> (You might want to check with your providers and ask them to overrule
> this via static routes. I already did so over a month ago; now the 
> entire Austrian Academic Network routes around Abovenet to reach ORBS.)

It seems that Cygnus/RH is able to get there no problems (and I
can connect to www.orbs.org from Yahoo).  Maybe it's just luck,
but we haven't seen any outages here in the Bay Area as far as I
know.

J

Re: Visited http://www.orbs.org/ recently?

[Gerald Pfeifer]

On Mon, 17 Jul 2000, Jason Molenda wrote:
> Paul Vixie et al, according to the ORBS page.
> 
> I don't know...  I don't know Vixie at all, but I've always thought
> of him as a non-moron, and the things that the ORBS page allege
> seem moronic.  I wouldn't jump to any conclusions without any more
> information.  I can't help but think that someone has hacked the
> ORBS page and stuck it there as a joke or something.

Nope. And Vixie, well, read yourself: 

  [Abovenet] readvertise the /16 which ORBS's upstream provider advertises
  to Abovenet.  [...] Now, the fact is, Abovenet is pretty good, and so
  the /16 they readvertise is going to be the preferred path for a lot of
  folks to reach ORBS's upstream and therefore ORBS itself.
  And, since Abovenet does not route for ORBS even though they readvertise
  the /16 advertised to them by ORBS's upstream, ORBS loses some amount of
  connectivity due to Abovenet's nonrouting of ORBS.

The last sentence is the crucial one: Abovenet does not provide access to
ORBS (website,...) to its own customers, but it also readvertises routes
to ORBS to its peers/downstreams and then sinks them in its internal
network. 

Unbelievable, but true. 

(You might want to check with your providers and ask them to overrule
this via static routes. I already did so over a month ago; now the 
entire Austrian Academic Network routes around Abovenet to reach ORBS.)

Gerald
-- 
Gerald "Jerry" pfeifer@dbai.tuwien.ac.at http://www.dbai.tuwien.ac.at/~pfeifer/
Have a look at http://petition.eurolinux.org -- it's not about Linux, btw!

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Mon, Jul 17, 2000 at 08:29:02PM -0400, Chris Faylor wrote:

> Is there a reason for this vendetta beyond the alleged commercial one?

Maybe Gerald knows something about the specifics of this case, but
in general ORBS gets a lot of heat from indignant sysadmins on the
net.

I was on a mailing list about spam blocking tools and regular little
flamewars would ignite, between ORBS who says "Deny my probes and
you shall be listed" and sysadmins who say "Your probes are
tresspassing on my system, I'm blocking any connections from your
IP #s."   (of course, instead of just blocking the connections and
moving on, they insist on arguging about it at great length)

It seems stupid, but people get really upset over this stuff.  I
wouldn't be surprised if it found its root in something like that.

Jason

Re: Visited http://www.orbs.org/ recently?

[Jason Molenda]

On Mon, Jul 17, 2000 at 04:26:30PM -0700, Tom Tromey wrote:
> >> If I'm reading the message at the ORBS web site correctly, then it
> >> looks like ORBS has temporarily shutdown its service.
> 
> Let's write the losers who killed ORBS and find out what their story
> is.  Disagreeing with ORBS is fine.  A preemptive nuclear strike is
> not.

Paul Vixie et al, according to the ORBS page.

I don't know...  I don't know Vixie at all, but I've always thought
of him as a non-moron, and the things that the ORBS page allege
seem moronic.  I wouldn't jump to any conclusions without any more
information.  I can't help but think that someone has hacked the
ORBS page and stuck it there as a joke or something.

(If nothing else, the idea that ORBS provides competition to MAPS,
and so Vixie et al are doing this to help their business makes no
sense.  They're two completely different approaches to RBL'ing,
and most businesses would not be interested in the ORBS approach
given the number of false positives it garners.)

J