From: David Ross Date: 2004-10-26T11:56:32+09:00 Subject: Re: [SOLUTION] RubyGarden Spam - One step to Solution trans. (T. Onoma) wrote: >On Monday 25 October 2004 08:50 pm, David Ross wrote: >| Chad Fowler wrote: >| >On Tue, 26 Oct 2004 04:56:53 +0900, David Ross wrote: >| >>You *can* integrate this into wiki's. Its very easy. Okay thanks, 80% >| >>spamming solved. >| >>Most, if not ALL the ips listed in >| >>http://www.istori.com/cgi-bin/wiki?WikiBlackList *ARE* in the RBLs >| > >| >We have been. For months. >| > >| >>Thanks, have a nice day. Problem solved >| > >| >Unfortunately not. >| >| First Rubygarden Spam email >| ----------------------------------------- >| The rubygarden wiki has been over-run with spam links. >| >| 220.163.37.233 is one of the offending source IP addresss. >| >| I fixed the home page, and then saw the extent of the crap. Looks like >| many personal pages have been altered. >| >| Those with user pages may want to go check their own page to assist with >| the clean up. >| >| James >| >| ----------------------------------------- >| >| ------------------------------------- >| >| I've got a list, but it has become obvious that maintaining a list >| manually isn't going to work. I'm tempted to require registration and >| authentication at this point as much as I hate the thought. >| >| Chad >| >| >| ------------------------------------- >| >| http://rbls.org/?q=220.163.37.233 >| >| You're not reading the email.. >| >| Thanks for lying, its listed since June 2003 >| >| No, problem is 80% solved. There are some actual unlogged IPs. Please >| educate yourself in security, you obviously aren't qualified. > >Umm... why not try to educate rather then accuse. I for one would certainly >like to know that in the hell you're talking about, but you're not explaining >yourself very well. > >T. > > > > > :) Well as you notied in the past I have a habit of writing really short replies that make my emails sound inappropriate. /me breaths, "Ok lets start" An RBL is Realtime Blackhole List. These lists are held on servers which can be accessed by anyone. All you do is send a query to the server and it replies with a special response in the format of "127.0.0." One big RBL project is SORBS, located at http://www.dnsbl.sorbs.net/. The project has a nice selection of servers to pick from which are lists for different reasons. I use so many in my servers because each one has different IPs and strengths. These RBLs are not just for mail servers, they list different types of abusers. These RBLs are be used in any type of network application for the use of blocking who abuse the internet. The internet is a very insecure place where anyone could abuse it very much if they have the knowledge. I'm blessed to have been on computers for over 20 years :) Commodore++ Okay now to explain the reponses you get from the RBL servers 127.0.0.2 - Open Relay 127.0.0.3 - Open Proxy 127.0.0.4 - Spam Source 127.0.0.5 - Provisional Spam Source Listing block (will be removed if spam stops) 127.0.0.6 - Formmail Spam 127.0.0.7 - Spam Supporter 127.0.0.8 - Spam Supporter (indirect) 127.0.0.9 - End User (non mail system) 127.0.0.10 - Shoot On Sight 127.0.0.11 - Non-RFC Compliant (missing postmaster or abuse) 127.0.0.12 - Does not properly handle 5xx errors 127.0.0.13 - Other Non-RFC Compliant 127.0.0.14 - Compromised System - DDoS 127.0.0.15 - Compromised System - Relay 127.0.0.16 - Compromised System - Autorooter/Scanner 127.0.0.17 - Compromised System - Worm or mass mailing virus 127.0.0.18 - Compromised System - Other virus 127.0.0.127 - Other These reponse names differ on RBL servers, but mean the exact same. You can get more reponse information on different servers from http://www.aspnetmime.com/dnsbl.aspx Heres another type of list and a "howitworks" http://dsbl.org/howitworks People can send in form data to specify if the target is bad. I don't use the /unconfirmed.dsbl.org/. I use the list.dsbl.org and /multihop.dsbl.org. The target can be tested by very trustful users, list.dsbl.org and multihop. These are very reliable servers to check. These are recognized as good blacklists to use / The IP that did in fact spam RubyGarden @ http://dsbl.org/listing?220.163.37.233 Okay, the evidence where Chad went wrong. The link above is the the IP that spammed RubyGarden, the IP is listed in the singlehop(list.) server . Chad rather didn't read the email, or he lied. Could be because I thought about it first on the mailing list. Others have used RBLs for network services elsewhere. If those specific BLs were implemented it would eliminate over 80% or more of the spam problem. By the way, Thanks T. for asking. I keep getting ahead of myself thinking everyone has the same knoweldge. *My fault* Thanks for being curious, and have a nice day. I might continue this email if I think of any other important information that might help more understand how to use RBL lists. David Ross -- Hazzle free packages for Ruby? RPA is available from http://www.rubyarchive.org/