- Talk - lists.gtalug.org

Re: [GTALUG] Email problem and some observations.
by Alvin Starr 14 Jul '16

14 Jul '16

On 07/14/2016 09:55 AM, ac via talk wrote: > On Thu, 14 Jul 2016 09:28:48 -0400 > Alvin Starr via talk <talk(a)gtalug.org> wrote: >> A bitof history to start off. >> Years ago we started putting spf records in our domains and email >> clients domains and that is mostly where things stuck. >> For the most part is was of little help but generally putting a >> correctlyconfigured SPF statement did not hurt. >> > spf records already help a lot with spam/abuse True enough but hype and initial exuberance did not quite pan out the way some claimed. But it does work and helps. > >> I recentlydiscovered DMARC and decided to implement it on my own >> domain as an experiment. > DMARC has real interesting reporting, but many ISP's do not even > respond to abuse@ so... we are a long way off from a perfect world :) Sadly the usual addresses like postmaster and abuse make for an easy target for spammers so its the kind of address that gets quickly ignored. Postmaster is so bad the its almost all noise now. > > Like your SPF v=spf1 mx a:mail.netvel.net ip4:54.236.96.217/32 -all > many email servers will disregard even the -all (and the entire SPF) I was looking at an email problem yesterday and got a message from a spam filtering service that my client uses. "1) The simplest, and since SPF is only beneficial to large corporate domains, we would suggest that they log into their DNS Providers site and delete their SPF record." With that kind of attitude its not surprising that SPF is used at all. > >> After running for a while and looking at the information that came >> back from the other dmarcians I noticed some interesting trends. >> >> 1) Some days there are lots of spam messages sent to google as >> someone on my domain (likely me). >> 2) There are not a whole lot of people who are honouring dmarc and >> sending status messages. > nope... and there are soo many that do not even respond to direct > complaints.. recently on RIPE anti-abuse, an abuse-c record addition > failed, due to simply too many objections... - If people/society does > not even want to accept responsibility for what they transmit - how will > they to co-op with DMARC... I cannot help all those that will not work within the system but enough people are using DMARC that it is causing problems for mail list operators so its gaining some traction. > >> 3) Something in my network is sending mail to CheatCodes.com >> Here is a snippet from my dmarc log. >> >> Wed, 06 Jul 2016 14:47:25 -0400 CheatCodes.com 12 >> Thu, 07 Jul 2016 19:59:59 -0400 google.com 2 >> Thu, 07 Jul 2016 19:59:59 -0400 Yahoo! Inc. 2 >> Fri, 08 Jul 2016 11:29:47 -0400 CheatCodes.com 10 >> Sun, 10 Jul 2016 17:19:04 -0400 CheatCodes.com 3 >> Mon, 11 Jul 2016 19:59:59 -0400 google.com 2 >> Mon, 11 Jul 2016 14:45:57 -0400 CheatCodes.com 12 >> Tue, 12 Jul 2016 12:00:00 -0400 Microsoft Corp. 1 >> Tue, 12 Jul 2016 19:59:59 -0400 google.com 591 >> Tue, 12 Jul 2016 19:59:59 -0400 Yahoo! Inc. 8 >> Tue, 12 Jul 2016 15:22:56 -0400 CheatCodes.com 13 >> Wed, 13 Jul 2016 19:59:59 -0400 google.com 785 >> Wed, 13 Jul 2016 14:49:03 -0400 CheatCodes.com 3 >> >> So about cheatcodes.com. > hmm, looks like this could be a fake reverse zone for a private ip on > your home pvt network? > If you look at my headers I have a pvt range setup with a inaddr to > cow.co.za :) - my DMARC would report "cow.co.za" on the sec gw > 192.168. - otherwise you could have malware, either way - you should > have fun figuring it out :) DMARC reports the sending IP. and in my case the sending ip is my firewall. That is what got me going. I know it cannot be my laptop because that runs Linux and we all know that is impervious to hacks. OOPS. My android phones also run Linux(of sorts)... Possibly its time to re-evaluate this belief. > > -- Alvin Starr || voice: (905)513-7688 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

2 1

Email problem and some observations.
by Alvin Starr 14 Jul '16

14 Jul '16

A bitof history to start off. Years ago we started putting spf records in our domains and email clients domains and that is mostly where things stuck. For the most part is was of little help but generally putting a correctlyconfigured SPF statement did not hurt. I recentlydiscovered DMARC and decided to implement it on my own domain as an experiment. After running for a while and looking at the information that came back from the other dmarcians I noticed some interesting trends. 1) Some days there are lots of spam messages sent to google as someone on my domain (likely me). 2) There are not a whole lot of people who are honouring dmarc and sending status messages. 3) Something in my network is sending mail to CheatCodes.com Here is a snippet from my dmarc log. Wed, 06 Jul 2016 14:47:25 -0400 CheatCodes.com 12 Thu, 07 Jul 2016 19:59:59 -0400 google.com 2 Thu, 07 Jul 2016 19:59:59 -0400 Yahoo! Inc. 2 Fri, 08 Jul 2016 11:29:47 -0400 CheatCodes.com 10 Sun, 10 Jul 2016 17:19:04 -0400 CheatCodes.com 3 Mon, 11 Jul 2016 19:59:59 -0400 google.com 2 Mon, 11 Jul 2016 14:45:57 -0400 CheatCodes.com 12 Tue, 12 Jul 2016 12:00:00 -0400 Microsoft Corp. 1 Tue, 12 Jul 2016 19:59:59 -0400 google.com 591 Tue, 12 Jul 2016 19:59:59 -0400 Yahoo! Inc. 8 Tue, 12 Jul 2016 15:22:56 -0400 CheatCodes.com 13 Wed, 13 Jul 2016 19:59:59 -0400 google.com 785 Wed, 13 Jul 2016 14:49:03 -0400 CheatCodes.com 3 So about cheatcodes.com. All the traffic to cheatcodes is comming from the outside address of my firewall either home or cottage. Since I only email via submission to my external mail-server there is nothing inside my domain that should be sending email. So I blocked ports 25,2525 and a few other well known ports for email but still the mail is flowing. Then I blocked the cheatcodes MX address class C... Still flowing. I noticed that the IP source of the messages moved with my changing location. There are only 3 connected things that will move between these locations. My laptop and 2 Android phones. I guess its time to start more serious tracking of traffic from my portable devices. So someone is connected and sending messages through non-regular channels to CheatCodes.com. This disturbs me. I intend to keep working on this. But it makes me ask the question: Who would go so far as to setup a surreptitious email link and then run it through DMARC? I have to admit that I kind of like DMARC. It is letting me get a feel for how much abuse of my domain is going on and it is way more than I thought. Its by no means a spam solution but it can cut down spam generated in my name. -- Alvin Starr || voice: (905)513-7688 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

2 1

Re: [GTALUG] Heads Up
by Kevin Cozens 14 Jul '16

14 Jul '16

On 16-07-13 01:43 AM, ac via talk wrote: > Just started seeing many email attachments with .html active > javascript ransomware in base64 fully loaded anyway this is going > to be the new normal, disabling javascript on email clients as filtering > these will be challenging) > > so, if you are not using mutt or custom email (like moi) I would > strongly suggest not opening any .html attachments without disabling > Javascript I set my email program to treat all my mail/mailinglist messages as text only. I don't need to act like a web browser and show me nicely formatted pages as I have a separate program for that. Viewing messages as simple text means you don't should not have to worry about any attempt to include something other than simple text. -- Cheers! Kevin. http://www.ve3syb.ca/ |"Nerds make the shiny things that distract Owner of Elecraft K2 #2172 | the mouth-breathers, and that's why we're | powerful!" #include <disclaimer/favourite> | --Chris Hardwick

2 1

Heads Up
by ac 13 Jul '16

13 Jul '16

Just started seeing many email attachments with .html active javascript ransomware in base64 fully loaded anyway this is going to be the new normal, disabling javascript on email clients as filtering these will be challenging) so, if you are not using mutt or custom email (like moi) I would strongly suggest not opening any .html attachments without disabling Javascript I also operate http://ascams.com and currently public dnsbl's here: block.ascams.com and superblock.ascams.com - unfortunately these are quite strict as most of facebook and twitter is blocked (for abuse - both those do not react to spam/abuse/phish and other issues - whereas Google and Microsoft generally do... - go figure) - anyway, ymmv, but use for scoring and not for hard bounce (at my present employer we use for hard bounce, but we have multiple neural net abuse nodes, so without that you may have too many fp's) I also track bots, (anything from ZeUS, XOR, 0access etc as well as the controllers :) payload ip's etc (which go to superblock.ascams.com ) the bots I am listing here at the moment http://spamid.net (yes, I also operate spamid.net - but I am thinking about merging spamid.net with ascams.com - as my focus is becoming more and more cybercrime, data and tracking bad bots I am presently writing an edi for abuse nodes, as it is neural it is challenging to stick to the kiss principle, and I will publish this somewhere shortly.. Andre

1 0

Re: [GTALUG] [GTALUG-Announce] GTALUG Meeting Tomorrow at 7:30pm
by Sammy Lao 12 Jul '16

12 Jul '16

Myles, Please send an unencrypted version. Thanks! Sent from my mobile > On Jul 11, 2016, at 1:27 PM, Myles Braithwaite via talk <talk(a)gtalug.org> wrote: > > PGh0dHA6Ly9ndGFsdWcub3JnL21lZXRpbmcvMjAxNi0wNy8+CgojIFRoZSBEb2N1bWVudCBGb3Vu > ZGF0aW9uIHdpdGggR2lvdmFubmkgQ2FsaWdhcmlzCgpBbiBpbnRyb2R1Y3Rpb24gb2Ygd2hhdCAq > KkxpYnJlT2ZmaWNlKiogaXMsIHdoYXQgaXMgKipUaGUgRG9jdW1lbnQKRm91bmRhdGlvbioqLCBo > b3cgdGhleSB3b3JrIGFuZCB3aGF0IHRoZXkgZG8uIFRoZSBiZW5lZml0cyBvZgpjb250cmlidXRp > bmcgdG8gTGlicmVPZmZpY2UgYW5kIGhvdyBjYW4geW91IGltcHJvdmUgeW91ciBza2lsbHMuCgoj > IyBMb2NhdGlvbgoKR2VvcmdlIFZhcmkgRW5naW5lZXJpbmcgYW5kIENvbXB1dGluZyBDZW50cmUK > MjQ1IENodXJjaCBTdHJlZXQsIFJvb20gMjAzClJ5ZXJzb24gVW5pdmVyc2l0eQoKPGh0dHA6Ly9n > b28uZ2wvbWFwcy8xNm9KMj4KCjxodHRwOi8vd3d3Lm9wZW5zdHJlZXRtYXAub3JnL3dheS8yMzQ0 > NzUyNT4KCiMjIFNjaGVkdWxlCgoqIDY6MDAgcG0gLSBQbGVhc2UgZGlzY3VzcyBvbiB0aGUgZ2Vu > ZXJhbCBtYWlsaW5nIGxpc3QgKGkuZS4KPHRhbGtAZ3RhbHVnLm9yZz4pIHdoZXJlIHlvdSB3YW50 > IHRvIGdvIGZvciBkaW5uZXIuCiogNzozMCBwbSAtIE1lZXRpbmcgYW5kIHByZXNlbnRhdGlvbi4K > KiA5OjAwIHBtIC0gQWZ0ZXIgZWFjaCBtZWV0aW5nIGEgZ3JvdXAgb2YgR1RBTFVHZXJzIG1vdmUg > dG8gdGhlIFRoZQpJbXBlcmlhbCBQdWIgKDU0IER1bmRhcyBTdCBFYXN0KSBmb3IgcmVmcmVzaG1l > bnRzIGFuZCBtb3JlCnNvY2lhbGl6aW5nLgoKIyBDb2RlIG9mIENvbmR1Y3QKCldlIHdhbnQgYSBw > cm9kdWN0aXZlIGhhcHB5IGNvbW11bml0eSB0aGF0IGNhbiB3ZWxjb21lIG5ldyBpZGVhcywKaW1w > cm92ZSBldmVyeSBwcm9jZXNzIGV2ZXJ5IHllYXIsIGFuZCBmb3N0ZXIgY29sbGFib3JhdGlvbiBi > ZXR3ZWVuCmluZGl2aWR1YWxzIHdpdGggZGlmZmVyaW5nIG5lZWRzLCBpbnRlcmVzdHMgYW5kIHNr > aWxscy4KCldlIGdhaW4gc3RyZW5ndGggZnJvbSBkaXZlcnNpdHksIGFuZCBhY3RpdmVseSBzZWVr > IHBhcnRpY2lwYXRpb24gZnJvbQp0aG9zZSB3aG8gZW5oYW5jZSBpdC4gVGhpcyBjb2RlIG9mIGNv > bmR1Y3QgZXhpc3RzIHRvIGVuc3VyZSB0aGF0CmRpdmVyc2UgZ3JvdXBzIGNvbGxhYm9yYXRlIHRv > IG11dHVhbCBhZHZhbnRhZ2UgYW5kIGVuam95bWVudC4gV2Ugd2lsbApjaGFsbGVuZ2UgcHJlanVk > aWNlIHRoYXQgY291bGQgamVvcGFyZGl6ZSB0aGUgcGFydGljaXBhdGlvbiBvZiBhbnkKcGVyc29u > IGluIHRoZSBjb21tdW5pdHkuCgpUaGUgQ29kZSBvZiBDb25kdWN0IGdvdmVybnMgaG93IHdlIGJl > aGF2ZSBpbiBwdWJsaWMgb3IgaW4gcHJpdmF0ZQp3aGVuZXZlciB0aGUgTGludXggY29tbXVuaXR5 > IHdpbGwgYmUganVkZ2VkIGJ5IG91ciBhY3Rpb25zLiBXZSBleHBlY3QKaXQgdG8gYmUgaG9ub3Jl > ZCBieSBldmVyeW9uZSB3aG8gcmVwcmVzZW50cyB0aGUgY29tbXVuaXR5IG9mZmljaWFsbHkKb3Ig > aW5mb3JtYWxseSwgY2xhaW1zIGFmZmlsaWF0aW9uLCBvciBwYXJ0aWNpcGF0ZXMgZGlyZWN0bHku > IEl0CmFwcGxpZXMgdG8gYWN0aXZpdGllcyBvbmxpbmUgb3Igb2ZmbGluZS4KCldlIGludml0ZSBh > bnlib2R5IHRvIHBhcnRpY2lwYXRlLiBPdXIgY29tbXVuaXR5IGlzIG9wZW4uCgpQbGVhc2UgcmVh > ZCBtb3JlIGFib3V0IHRoZSBHVEFMVUcgQ29kZSBvZiBDb25kdWN0IGhlcmU6CjxodHRwOi8vZ3Rh > bHVnLm9yZy9hYm91dC9jb2RlLW9mLWNvbmR1Y3QvPi4KCklmIHlvdSBoYXZlIGFueSBxdWVzdGlv > bnMsIGNvbW1lbnRzLCBvciBjb25jZXJucyBhYm91dCB0aGUgR1RBTFVHIENvZGUKb2YgQ29uZHVj > dCBwbGVhc2UgY29udGFjdCB0aGUgR1RBTFVHIEJvYXJkIEAgPGJvYXJkQGd0YWx1Zy5vcmc+Lgot > LS0KR1RBTFVHIEFubm91bmNlIG1haWxpbmcgbGlzdAphbm5vdW5jZUBndGFsdWcub3JnCmh0dHBz > Oi8vZ3RhbHVnLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Fubm91bmNlCi0tLQpUYWxrIE1haWxpbmcg > TGlzdAp0YWxrQGd0YWx1Zy5vcmcKaHR0cHM6Ly9ndGFsdWcub3JnL21haWxtYW4vbGlzdGluZm8v > dGFsawo=

3 2

OwnCloud vs Nextcloud?
by D. Hugh Redelmeier 12 Jul '16

12 Jul '16

Nextcloud forked OwnCloud last month and made its first release this month. <http://www.zdnet.com/article/nextcloud-adds-enterprise-support-and-ios-appl…> Includes links to "Related Stories". Does anyone have any insight into which would be worth adopting? Or something else? - it looks as if more devs went with Nextcloud - both are trying to make a commercial go of it. I fear that this doesn't match my desire for open source from an open project. - I cringe at PHP. Especially since I'd like to expose my installation to the internet.

5 8

KWLUG Keysigning on 8 August 2016
by Bob Jonkman 11 Jul '16

11 Jul '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Everybody! I'll be the Keymaster at a Formal Keysigning at the "Short Presentations and Activities" KWLUG meeting on 8 August 2016. A formal keysigning is where we read out our public GnuPG/PGP key fingerprints, have others vouch for our identities, then (afterwards) we sign each others' keys. We're extending the Web of Trust based on our actual knowledge of each other -- no government ID is required! For a formal keysigning I'll need copies of your GnuPG/PGP Public Key, then after the keysigning event I'll ensure that everyone gets a copy of all the signed keys. If you want to participate, here are the instructions: 1) E-mail your public GnuPG/PGP key to bjonkman(a)sobac.com 2) I publish your public key in an ownCloud shared folder, and add it to a Keysigning Keyring; you can download it to verify that your key is correct (I'll send the link when I receive your public key). 3) Come to the KWLUG meeting on Monday, 8 August 2016, and bring a copy of your public key so you can read out your fingerprint independently from the list that I'll be providing. 4) After the meeting, you carefully verify that the key fingerprints you have in your keyring match the fingerprints you verified at the meeting, then you sign the keys of those people that you verified. 5) E-mail me the signed keys (or upload to the ownCloud shared folder). 6) I'll import all the signed keys into the Keysigning Keyring, I'll sign all the keys with the Keysigning Key, and I'll e-mail all the signed keys from everyone back to you. 7) You import the all the keys into your own keyring again, so that you have all the signatures on everyone's keys. 8) If you want, you can upload your own signed public key to the keyservers. Remember, don't upload other people's public keys to the keyservers without their permission. Not everyone wants their GnuPG/PGP key (which usually has an e-mail address) to be easily harvestable by the spammers. Maybe we can have an Informal Keysigning too! Bring fingerprint strips, just in case! These "simple" instructions are available at http://sobac.com/wiki/index.php/KWLUG_Keysigning_2016-08-08 Pass it around! There are also full instructions for both participants and Keymaster at http://sobac.com/wiki/index.php/Formal_Keysigning but the instructions in this e-mail are much simpler for both participants and for me! See you on 8 August! - --Bob. - -- Bob Jonkman <bjonkman(a)sobac.com> Phone: +1-519-635-9413 SOBAC Microcomputer Services http://sobac.com/sobac/ Software --- Office & Business Automation --- Consulting GnuPG Fngrprnt:04F7 742B 8F54 C40A E115 26C2 B912 89B0 D2CC E5EA -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Ensure confidentiality, authenticity, non-repudiability iEYEARECAAYFAleDCx8ACgkQuRKJsNLM5eo8bgCeIwibd3zT7ZEguRHYMnYBfEqI 0BcAn0wlKEw0u4zOSU2d3upEJoqGy3qV =TSmm -----END PGP SIGNATURE-----

2 2

[GTALUG-Announce] GTALUG Meeting Tomorrow at 7:30pm
by Myles Braithwaite 11 Jul '16

11 Jul '16

<http://gtalug.org/meeting/2016-07/> # The Document Foundation with Giovanni Caligaris An introduction of what **LibreOffice** is, what is **The Document Foundation**, how they work and what they do. The benefits of contributing to LibreOffice and how can you improve your skills. ## Location George Vari Engineering and Computing Centre 245 Church Street, Room 203 Ryerson University <http://goo.gl/maps/16oJ2> <http://www.openstreetmap.org/way/23447525> ## Schedule * 6:00 pm - Please discuss on the general mailing list (i.e. <talk(a)gtalug.org>) where you want to go for dinner. * 7:30 pm - Meeting and presentation. * 9:00 pm - After each meeting a group of GTALUGers move to the The Imperial Pub (54 Dundas St East) for refreshments and more socializing. # Code of Conduct We want a productive happy community that can welcome new ideas, improve every process every year, and foster collaboration between individuals with differing needs, interests and skills. We gain strength from diversity, and actively seek participation from those who enhance it. This code of conduct exists to ensure that diverse groups collaborate to mutual advantage and enjoyment. We will challenge prejudice that could jeopardize the participation of any person in the community. The Code of Conduct governs how we behave in public or in private whenever the Linux community will be judged by our actions. We expect it to be honored by everyone who represents the community officially or informally, claims affiliation, or participates directly. It applies to activities online or offline. We invite anybody to participate. Our community is open. Please read more about the GTALUG Code of Conduct here: <http://gtalug.org/about/code-of-conduct/>. If you have any questions, comments, or concerns about the GTALUG Code of Conduct please contact the GTALUG Board @ <board(a)gtalug.org>. --- GTALUG Announce mailing list announce(a)gtalug.org https://gtalug.org/mailman/listinfo/announce

1 0

We (indirectly) made the cloudflare blog.
by Scott Sullivan 11 Jul '16

11 Jul '16

https://blog.cloudflare.com/why-we-use-the-linux-kernels-tcp-stack/ Some of the folks on this list my recognize themselves in the photo used in the above post. It was taken at one of the early Linux in the Park events, back in the Linuxcafe days. (If memory serves.) -- Scott Sullivan

1 0

Re: [GTALUG] Are you on the watch list?
by Alvin Starr 11 Jul '16

11 Jul '16

On 07/11/2016 12:52 AM, ac via talk wrote: > On Sun, 10 Jul 2016 23:05:30 -0400 > Bob Jonkman via talk <talk(a)gtalug.org> wrote: >> On 2016-07-10 05:28 PM, James Knott via talk wrote: >>> On 07/10/2016 05:18 PM, Alvin Starr via talk wrote: >>>> Some people on this list are likely to be considered subversive. >>> I guess we'd better start talking about encryption, address >>> spoofing etc., to give the five eyes something to do! ;-) >> Oh boy, I'll bet I'm in trouble now! >> - --Bob. >> > Bob, you're in Kitchener, so you are exempt from surveillance :) > > Andre > --- > Talk Mailing List > talk(a)gtalug.org > https://gtalug.org/mailman/listinfo/talk I am not sure Kitchener is far enough away. Besides its close to the hotbed of Linux development at Waterloo. And you know how dangerous young idealistic students can be. I can see the U.S. Senate hearings now. "Please answer the question sir. Are you now or have you ever been a Linux user?". "Your name appears on the mailing list for Linux Journal". "Are you prepared to give the names of other Linux users you have met in the past?" -- Alvin Starr || voice: (905)513-7688 Netvel Inc. || Cell: (416)806-0133 alvin(a)netvel.net ||

2 1