RE: Stealth Blocking

Mailman List Mirror (Read Only)
1

From: Steve Sobol [mailto:sjsobol@NorthShoreTechnologies.net]
Sent: Thursday, May 24, 2001 2:51 PM

Shawn McMahon wrote:

> > TCP rate-limiting on outbound traffic to *:25 would also
be extremely
> > effective, particularly on unclassified customer traffic,
and without the
> > heavy-handed nature of denying all dial-up traffic.
Rate-limiting doesn't
> > interfere with low-volume legitimate mail, but it really
cramps spam.
>
> It interferes heavily with transmission of large files via
email, though,
> and this *IS* a valid use of service.

The transmission of large files is not a valid use of email.

Is too... I send large documents regularly, via email. I just sent a 125
page word doc, with about 20 embedded Visio drawings and a bunch of embedded
Excel spreadsheets. It was huge. Most of the recipients are on dialups with
Win98. How else do you expect me to get it to them ... FTP? Most of them are
NOT computer jocks.

2

Email them a URL with a username and password.

3

Is too... I send large documents regularly, via email. I just sent a
125 page word doc, with about 20 embedded Visio drawings and a bunch
of embedded Excel spreadsheets. It was huge.

My condolences.

Most of the recipients are on dialups with Win98. How else do you
expect me to get it to them ... FTP? Most of them are NOT computer
jocks.

https+auth with an interface designed to cater to the technologically
impaired, perhaps?

I can't speak for your clients, but if I were using a substandard
workstation OS with a local mail client, crawling along on dialup, I
certainly would not enjoy downloading large multi-megabyte mail
attachments. More importantly, the high thresholds required on the
recipient's MTA in order to receive such mail do significantly weaken
their defenses against certain forms of abuse.

-adam

4

How about this Roeland:

You send them an email that says:

"
Because email is NOT intended to be a file transfer protocol and beyond
that fact that I know you're on a low-bandwidth dialup account, please
find below a link to the document I said I would send to you. On a 56K
dialup connection, this will most likely take about 10 minutes for you to
download. There are two links. One will retrieve the document via FTP and
one will retrieve the document via HTTP. The HTTP link will most likely
provide a faster download under most circumstances. I provided both to
afford you the opportunity to choose when and how you retrieve the
document.

http://www.mhsc.com/~rmeyer/Document-I-Promised.zip

ftp://ftp.mhsc.com/pub/users/rmeyer/Document-I-Promised.zip
"

Very simple concept. It not only uses the right tool for the job but,
also affords them the opportunity to retrieve the document when it is
CONVENIENT for them. If I were a dialup user and somone sent me some HUGE
attachment like that, I would consider it very rude.

Note to all salesdroids: If you want to be sure that I will NEVER do
business with you, send me an email attachment.

5

If you were a dial-up user, chances are you wouldn't be able to do that.
A few simple reasons come to mind: first, you wouldn't have any or not
enough disk space on your system account (limited by quota) to store the
file. Second, an average user probably wouldn't have the skill. Third, a
.zip file will usually display as funny characters on a web browser -
that's why ftp is needed. Fourth, you probably wouldn't have shell access
and ftp space from your provider with a regular account. Fifth, assuming
you would have all the toys, you would have to spend yourself the time to
first upload the file, so that another may retrieve it. Sixth, if your
file was a sensitive document, others would have public access to it, etc.

So what's a regular user to do? Email it! Hence the legitimate use of
email for transmission of large files. Most ISPs know that if they start
limiting this privilege, users will migrate to someone that allows it.

--Mitch
NetSide

6

So what's a regular user to do? Email it! Hence the legitimate use of
email for transmission of large files. Most ISPs know that if they start
limiting this privilege, users will migrate to someone that allows it.

i regularly configure ISP's with a limit on the size of email messages.
(generally 10meg, although i think 100k is probably better).

when they get a complaint, i then point them to the fact that many of the
large email messages get stuck in the queue because the receiving side
is too slow or doesn't have enough disk, or the users quota is full.

and of course, the sending user hears that it wasn't received, and then
assumes it was lost and resends it.

file transfer by email is evil.

i've been saying that for literally 10 years now:

7

Sorry, can't resist replying here. In my limited (7 years)
experience, 99% of all large file transfers via e-mail consist of dancing
babies, horny snowmen, clumsy reindeer/monkeys/people movie clips. Oh,
did I mention the plethora of cutesy jack-o-lanterns around October
31st? I also find it remarkable that no one seems to protect these
'sensitive' documents with PGP or another encryption method since we all
know that e-mail is in plain text. What were you saying about ftp being
insecure?

          David Leonard
          ShaysNet

8

This requires that you:

1) Have a web site with sufficient space to store the file.

2) Have it accessible, i.e. not firewalled on port 80.

3) Set up the accounts and passwords.

It also requires that they:

1) Run a web browser.

2) Have the username and password available when they attempt to get the
file.

Exactly how is that more efficient than just mailing them the file?

I'd completely agree with you for, say, a mailing list; but we're talking
about person A wants the file, person B has the file. Why should either
one of them jump through hoops? More importantly, why do you give a shit
how they choose to transfer files to each other?

9

i regularly configure ISP's with a limit on the size of email messages.
(generally 10meg, although i think 100k is probably better).

Generally 10MB. Now why is that, I wonder? Do you think people will
be typing 10MB of text?

Or even 100K of text?

Why is it that the limit has to be that large, Jim?

I can tell you from personal experience that accidentally setting it for
1MB instead of 10 will get you paged out of bed to "fix" it.

Why is that, if only Roeland and I send large files in email?

> Yes, BITFTP is currently restricted to users sending requests from
> sites on BITNET/EARN/NetNorth. And, yes, this is the direct result
> of your complaints.

Ah, so you're the one that fucked it up for everybody else, and obsoleted
the instructions in so many O'Reilly books. :slight_smile:

10

If you were a dial-up user, chances are you wouldn't be able to do that.
A few simple reasons come to mind: first, you wouldn't have any or not
enough disk space on your system account (limited by quota) to store the
file. Second, an average user probably wouldn't have the skill. Third, a
.zip file will usually display as funny characters on a web browser -
that's why ftp is needed. Fourth, you probably wouldn't have shell access
and ftp space from your provider with a regular account. Fifth, assuming
you would have all the toys, you would have to spend yourself the time to
first upload the file, so that another may retrieve it. Sixth, if your
file was a sensitive document, others would have public access to it, etc.

Ignorance usually doesn't necessarily give someone the right to abuse
services, regardless if they know they are doing it or not. Large email
attachments are abusive to mail servers. Especially for the people that
feel the need they need to CC it to ten different people. Large email
attachments tax servers and delay other more important email from being
delivered. SMTP is for mail, FTP/HTTP should be used for files. Not to
mention 99% of the time they are very rude to receive. Just imagine, you're
on vacation somewhere dialed in from a hotel that is charging you a buck a
minute. You go to pick up the email that is really important to you, but
you can't because some jerk decided that they would send you the most recent
funny AVI they saw on the web, when they could have just sent you the URL.

There are simple mechanisms to give users options to setup files via HTTP
very easily. (or even FTP ie: ftp://user:pass@members.myisp.com) Browsers
easily allow users to simply type in ONE URL (that can be bookmarked) and
basically drag and drop their files right into a window. Very simple.

So what's a regular user to do? Email it! Hence the legitimate use of
email for transmission of large files. Most ISPs know that if they start
limiting this privilege, users will migrate to someone that allows it.

That doesn't fix anything. Many ISP's already restrict the size of incoming
message. I know several that won't even allow anything larger than 1MB to
be received. Also, most ISP's also offer a generate amount of free web
space that comes with their dial-up account. (usually in the 10-20mb range)

11

[snip]

file. Second, an average user probably wouldn't have the skill. Third, a
.zip file will usually display as funny characters on a web browser -
that's why ftp is needed. Fourth, you probably wouldn't have shell access

[snip]

Web browsers will only display 'funny characters' for .zip files if they
don't have their mime-types sufficently configured.

12

> http://www.mhsc.com/~rmeyer/Document-I-Promised.zip
>
> ftp://ftp.mhsc.com/pub/users/rmeyer/Document-I-Promised.zip
> "
>
>
> Very simple concept. It not only uses the right tool for the job but,
> also affords them the opportunity to retrieve the document when it is
> CONVENIENT for them. If I were a dialup user and somone sent me some HUGE
> attachment like that, I would consider it very rude.
>
> Note to all salesdroids: If you want to be sure that I will NEVER do
> business with you, send me an email attachment.
>
>
> ---
> John Fraizer
> EnterZone, Inc
>

If you were a dial-up user, chances are you wouldn't be able to do that.

REALLY? Lets check this out.

A few simple reasons come to mind: first, you wouldn't have any or not
enough disk space on your system account (limited by quota) to store the
file.

Have you thought about that before sending a large file via email to
someone? Many provides include your email spool in your quota. Beyond
that, there are TONS of free hosting providers out there so your arguement
there is moot.

Second, an average user probably wouldn't have the skill.

Huh? You're joking, right? Believe it or not Mitch, the rest of the
internet population isn't just sitting around sucking up oxygen from
brain-children like you. If they're competent enough to create a large
presentation, they're competent enough to upload it somewhere. They can
drag and drop with any number of FTP applications. Moot arguement.

Third, a .zip file will usually display as funny characters on a web
browser - that's why ftp is needed.

Only if they're running REALLY, REALLY old browsers or the server itself
is sending an incorrect mime-type for the .zip extension. Beyond that,
they can right-click on the link and do a "save-as" so, this one is moot
as well.

Fourth, you probably wouldn't have shell access and ftp space from
your provider with a regular account.

Please see "free hosting providers" above. MOOT.

Fifth, assuming you would have all the toys, you would have to spend
yourself the time to first upload the file, so that another may
retrieve it.

OK. How is that any different that the time it takes you to send the file
to the SMTP server? MOOT!

Sixth, if your file was a sensitive document, others
would have public access to it, etc.

Ever hear of .htaccess? It's REALLY neat. If you think your file is safe
from prying eyes in email, you've got more problems than not understanding
basic authentication on a webserver though. You should stop argueing your
invalid, moot points and spend that precious time reevaluating your
security policy.

So what's a regular user to do? Email it!

No. That's what the uneducated newbie does. The regular user uploads it
to their http/ftp server and sends a link to the file via email.

Hence the legitimate use of email for transmission of large files.

Please don't breed.

Most ISPs know that if they start limiting this privilege, users will
migrate to someone that allows it.

If you educate your users, you have no problems.

13

Oh my virgin eyes! GET HIM SUE! GET HIM BEFORE HE ESCAPES!

14

[cc: list removed]

If you were a dial-up user, chances are you wouldn't be able to do that.

If you were a dial-up user, FTP would be far more efficient. Ever thought
of the 8 to 7 bit conversion? The man page for uuencode says an expansion
of 37% is quite normal. I would prefer to wait 10 minutes instead of
almost 14 minutes for the same file.

Suppose a clueless user takes about 15 minutes to find out how it works;
if you use email regularly to transmit files, you will save time very
fast.

A few simple reasons come to mind: first, you wouldn't have any or not
enough disk space on your system account (limited by quota) to store the
file.

I think most ISP's prefer a onetime use of webspace instead of a 10 time
use in pop boxes.

Second, an average user probably wouldn't have the skill.

Then he/she should learn. I don't buy a car if I can't drive. I'm sorry
for comparing internetworking with driving a car but I feel that FTP'ing
is a basic skill if you want to use the internet in a professional way
(and since most documents are being distributed for professional reasons,
they should know).

Third, a .zip file will usually display as funny characters on a web
browser - that's why ftp is needed.

Most browsers can handle .zip files and ask the user what to do with them.

Fourth, you probably wouldn't have shell access and ftp space from
your provider with a regular account.

Then change ISP's.

Fifth, assuming you would have all the toys, you would have to spend
yourself the time to first upload the file, so that another may
retrieve it.

C:\windows\ftp.exe

ftp://www.bit.nl/~sabri/suexec.patch.gz

Sixth, if your file was a sensitive document, others
would have public access to it, etc.

http://foo:bar@www.bit.nl/~sabri/suexec.patch.gz

So what's a regular user to do? Email it! Hence the legitimate use of
email for transmission of large files. Most ISPs know that if they start
limiting this privilege, users will migrate to someone that allows it.

Allowing != promoting...

And like more people on this list; I consider it very rude to receive
large attachments, especially from clueless salesdroids sending .doc
files. That's the way to get me not buying anything.

imho of course.

15

Sabri Berisha wrote:

Then he/she should learn. I don't buy a car if I can't drive. I'm sorry
for comparing internetworking with driving a car but I feel that FTP'ing
is a basic skill if you want to use the internet in a professional way
(and since most documents are being distributed for professional reasons,
they should know).

Another option is to pay someone to drive you around. If you look into it,
you can see that an established market for electronic document exchange
services already exists.

The most established company doing this is probably UPS.
See the UPS Document Exchange at <http://exchange.ups.com/&gt;

(Disclaimer: I have no affiliation whatsoever with UPS)

16

Have you thought about that before sending a large file via email to
someone?

John, you seem to be assuming that the transfer of files via email is
done on a whim to randomly-selected individuals around the net.

While that may be the case for a large number of people, nobody involved
in this discussion is that clueless. Hint: they'd probably have an aol.com
or msn.com email address, and no clue what NANOG is.

OK. How is that any different that the time it takes you to send the file
to the SMTP server? MOOT!

John, here's the steps involved in sending the file to the SMTP server:

Click "attach".

Select the appropriate directory.

Click on the file.

Or are you assuming that the folks in this discussion don't have LANs, and
are using uuencode and piping through /bin/mail? I think your information
is about 15 years out of date.

No. That's what the uneducated newbie does. The regular user uploads it
to their http/ftp server and sends a link to the file via email.

And yet, I continue to exchange files with other system administrators
of Fortune 500 companies. Guess we're all "uneducated newbies".

Please don't breed.

When you reach the point where every paragraph contains an ad-hominem,
we can only conclude you don't have a technical argument, and are instead
engaged in knee-jerk reaction.

If you educate your users, you have no problems.

"Don't use this feature that SMTP was specifically designed to allow, and
that sendmail is default configured to facilitate. Instead, jump through
a bunch of extra hoops, so that John Frazier will not call you a clueless
newbie. Trust me, you'll be happier. <click> Hello? Hello?"

17

uh, when is the last time that you worked the front line of an ISP?
most people have never even heard of FTP. i almost spewed my orange
juice all over my desk when i read that paragraph. :slight_smile:

unfortunately, i have accepted the fact that there is no stopping
customers from emailing 10MB (and larger!) files, they can just go to
our competition if we prevent it.

i bitch, moan, and insist that the front line kids give the "email !=
FTP speech," but we continue to permit it. *sigh*

unless we go back in time and re-do the protocols, and re-educate
newbies before setting them lose on the 'net, i don't think that we
are going to stop people from emailing what should be FTP'd.

deeann m.m. mikula
director of operations

telerama public access internet
http://www.telerama.com
1.877.688.3200

18

While that may be the case for a large number of people, nobody involved
in this discussion is that clueless. Hint: they'd probably have
an aol.com
or msn.com email address, and no clue what NANOG is.

As I stated in a previous posting, ignorance doesn't always get people off
the hook as a reason not to do things correctly. It's very easy to explain
to someone how to use HTTP vs sending messages by email.

John, here's the steps involved in sending the file to the SMTP server:

Click "attach".

Select the appropriate directory.

Click on the file.

Or are you assuming that the folks in this discussion don't have LANs, and
are using uuencode and piping through /bin/mail? I think your information
is about 15 years out of date.

It's just as easy to make a shortcut to something like:

ftp://user:pass@users.mywebspace.com/

Drag and drop file into browser.

Simply type hyperlink into email. ie: http://users.mywebspace.com/user/

And yet, I continue to exchange files with other system administrators
of Fortune 500 companies. Guess we're all "uneducated newbies".

Files via email is not completely evil, it has it's uses, however, more
people abuse it than just simply use it on occasion to send a small
attachment. The point I believe of this argument are the morons that attach
multi-megabyte files which waste system resources on servers, waste
bandwidth and generally stalls other emails from being delivered.

19

"Marko Karppinen" <marko.karppinen@magentasites.com>

Sabri Berisha wrote:
> Then he/she should learn. I don't buy a car if I can't drive. I'm sorry
> for comparing internetworking with driving a car but I feel that FTP'ing
> is a basic skill if you want to use the internet in a professional way
> (and since most documents are being distributed for professional

reasons,

> they should know).
Another option is to pay someone to drive you around. If you look into it,
you can see that an established market for electronic document exchange
services already exists.

Hmm. The problem with this analogy is the extension "I know you can drive a
car; however, you really should learn to drive a truck as it is much more
efficient for large loads" which is of course true.......

20

  Sorry, can't resist replying here. In my limited (7 years)
experience, 99% of all large file transfers via e-mail consist of dancing
babies, horny snowmen, clumsy reindeer/monkeys/people movie clips. Oh,
did I mention the plethora of cutesy jack-o-lanterns around October
31st? I also find it remarkable that no one seems to protect these
'sensitive' documents with PGP or another encryption method since we all
know that e-mail is in plain text. What were you saying about ftp being
insecure?

Right, but let's not leave out the attchment honorable mentions, things like
ILOVEYOU, Snowwhite, etc. :wink: Perfect example of how email attachments can
start a wildfire.