Re: BOTNET timeouts?

2009-06-11 Thread Bill Landry
>> This issue has been unresolved for way too long. All of this, in my >> mind, this makes the plugin orphaned and unusable if not patched with >> Mark's patch. > > Actually it's a patch by Daniel J McDonald from 2007-06-15. > I just refreshed it for 0.8 and reposted it two months later. > Credits

Re: BOTNET timeouts?

2009-06-11 Thread Mark Martinec
> This issue has been unresolved for way too long. All of this, in my > mind, this makes the plugin orphaned and unusable if not patched with > Mark's patch. Actually it's a patch by Daniel J McDonald from 2007-06-15. I just refreshed it for 0.8 and reposted it two months later. Credits where cre

Re: BOTNET timeouts?

2009-06-11 Thread Bill Landry
>> Well I suppose you could always take the product that you dislike so >> badly back to the store and ask for a refund of your purchase price. >> Sometimes it really amazes me how much, and how severely, some people >> will gripe about free products that exist only because other people >> volunte

Re: Optional Tests in Main Ruleset?

2009-06-11 Thread Karsten Bräckelmann
On Thu, 2009-06-11 at 09:18 -0400, Charles Gregory wrote: > Hallo! > > I've noticed a few rules now that seem to score *very* low. > For example: DYN_RDNS_AND_INLINE_IMAGE=0.001 There are a lot of possible reasons for that, including informative only rules (which are likely to have a description

Re: BOTNET timeouts?

2009-06-11 Thread Res
On Thu, 11 Jun 2009, Kevin Parris wrote: Well I suppose you could always take the product that you dislike so badly back to the store and ask for a refund of your purchase price. Sometimes it really amazes me how much, and how severely, some people will gripe about free products that exist o

Re: BOTNET timeouts?

2009-06-11 Thread Dave Koontz
John Hardin wrote ... (6/11/2009 4:21 PM): > On Thu, 11 Jun 2009, John Rudd wrote: > >> As I've said, I don't really have a plan to incorporate the patch >> into the main dist. > > You probably should. It doesn't prevent you from pursuing your design > changes, and it would fix the problem for thos

Re: BOTNET timeouts?

2009-06-11 Thread John Hardin
On Thu, 11 Jun 2009, John Rudd wrote: As I've said, I don't really have a plan to incorporate the patch into the main dist. You probably should. It doesn't prevent you from pursuing your design changes, and it would fix the problem for those who are experiencing the problem today. Is it tr

Re: BOTNET timeouts?

2009-06-11 Thread Henrik K
On Thu, Jun 11, 2009 at 03:17:12PM -0400, Kevin Parris wrote: > > Well I suppose you could always take the product that you dislike so badly > back to the store and ask for a refund of your purchase price. Sometimes > it really amazes me how much, and how severely, some people will gripe > about f

Re: BOTNET timeouts?

2009-06-11 Thread John Rudd
On Thu, Jun 11, 2009 at 12:45, Charles Gregory wrote: > > With respect, your concerns about >   required testing are at the least, exaggerated. The testing has been >   done by everyone who uses the patch. a) thank you for your well worded thoughts b) my statement about the time it would take is

Re: BOTNET timeouts?

2009-06-11 Thread Charles Gregory
Hello all! If I may weigh in on this botnet/dns issue 1) John I completely respect (indeed advocate) the right of volunteers to do as they wish with their time. In all that I say that follows, I keep that first in mind. I speak of principles, but make NO demands on your time. 2) I d

Re: BOTNET timeouts?

2009-06-11 Thread Kevin Parris
Well I suppose you could always take the product that you dislike so badly back to the store and ask for a refund of your purchase price. Sometimes it really amazes me how much, and how severely, some people will gripe about free products that exist only because other people volunteer their tim

Re: BOTNET timeouts?

2009-06-11 Thread Henrik K
On Thu, Jun 11, 2009 at 10:21:18AM -0700, John Rudd wrote: > > As said elsewhere, the primary issue is how DNS is being set up, both > by the sender and the recipient. But that's outside of the scope of > Botnet. Within Botnet, the actual thing to be solved is moving toward > SA's internal DNS r

Re: BOTNET timeouts?

2009-06-11 Thread John Rudd
On Thu, Jun 11, 2009 at 06:46, Bill Landry wrote: > McDonald, Dan wrote: >> On Wed, 2009-06-10 at 21:40 -0700, John Rudd wrote: >>> On Wed, Jun 10, 2009 at 21:11, Bill Landry wrote: Jake Maul wrote: > Interesting that I'm just now running into this... I've been using > Botnet on this s

Re: BOTNET timeouts?

2009-06-11 Thread Henrik K
On Thu, Jun 11, 2009 at 10:04:42AM -0400, Rob McEwen wrote: > Bill Landry wrote: > > This issue has been unresolved for way too long. All of this, in my > > mind, this makes the plugin orphaned and unusable if not patched with > > Mark's patch. > > No matter how hard you try to improve botnet: N

Re: BOTNET timeouts?

2009-06-11 Thread Bill Landry
> I've had no trouble with Botnet timeouts, but just now patched anyway, > to avoid any potential trouble. I, and many others appreciate how > responsive you've been with your sanesecurity work, but not everyone has > the same resources. > Whenever I install GNU free software, I have to remember th

Re: BOTNET timeouts?

2009-06-11 Thread Ken A
I've had no trouble with Botnet timeouts, but just now patched anyway, to avoid any potential trouble. I, and many others appreciate how responsive you've been with your sanesecurity work, but not everyone has the same resources. Whenever I install GNU free software, I have to remember this. If

Re: backscatter from dnswl

2009-06-11 Thread Charles Gregory
On Thu, 11 Jun 2009, Arvid Picciani wrote: the amount of backscatter is getting out of control. I fear our MRA might soon explode. I don't think this is "noise" anymore. How many accounts are we talking about here? If it is just one or two addresses, and the user(s) being 'spoofed' have distin

Re: BOTNET timeouts?

2009-06-11 Thread Rob McEwen
Bill Landry wrote: > This issue has been unresolved for way too long. All of this, in my > mind, this makes the plugin orphaned and unusable if not patched with > Mark's patch. No matter how hard you try to improve botnet: (A) botnet is still dependent on third party dns servers, many of which a

Re: BOTNET timeouts?

2009-06-11 Thread Bill Landry
McDonald, Dan wrote: > On Wed, 2009-06-10 at 21:40 -0700, John Rudd wrote: >> On Wed, Jun 10, 2009 at 21:11, Bill Landry wrote: >>> Jake Maul wrote: Interesting that I'm just now running into this... I've been using Botnet on this server for several months without issue. Thanks

Optional Tests in Main Ruleset?

2009-06-11 Thread Charles Gregory
Hallo! I've noticed a few rules now that seem to score *very* low. For example: DYN_RDNS_AND_INLINE_IMAGE=0.001 Are these rules 'in development' and therefore not being assigned a significant score as of yet? Or, more interestingly, do they represent an 'optional' set of rules that can be 'act

Re: backscatter from dnswl

2009-06-11 Thread Arvid Picciani
On Mon, 2009-06-08 at 15:41 +0200, Arvid Picciani wrote: Hi, i'm getting _massive_ amounts of backscatter and some of the offenders are listed in dnswl.org Has your domain got an SPF record? yes, and its valid the amount of backscatter is getting out of control. I fear our MRA might s

Re: BOTNET timeouts?

2009-06-11 Thread McDonald, Dan
On Wed, 2009-06-10 at 21:40 -0700, John Rudd wrote: > On Wed, Jun 10, 2009 at 21:11, Bill Landry wrote: > > Jake Maul wrote: > >> Interesting that I'm just now running into this... I've been using > >> Botnet on this server for several months without issue. > >> > >> Thanks for the link, shorter ti