1 INFO-VAX	Sat, 21 May 2005	Volume 2005 : Issue 282       Contents:# Re: AUTOGEN and page and swap files 0 Re: How to filter spam based on message content?0 Re: How to filter spam based on message content?. Re: Networking problem concerning a DEC TS 90L New Cluster Interconnects $ Re: Newbie with command file problem upgrade 7.3-1 --> 7.3-2 ' Re: VAXstation 3100 free to a good home   F ----------------------------------------------------------------------    Date: 21 May 2005 09:32:33 -0700$ From: "AEF" <spamsink2001@yahoo.com>, Subject: Re: AUTOGEN and page and swap filesC Message-ID: <1116693153.219505.236160@g47g2000cwa.googlegroups.com>   / Phillip Helbig---remove CLOTHES to reply wrote: E > In article <1116612579.927749.100220@f14g2000cwb.googlegroups.com>, ( > "AEF" <spamsink2001@yahoo.com> writes: >  [...] F > > > It says there is a conflict with PARAMS.DAT.  However, no number ofG > > > repeats of AUTOGEN will solve the problem.  It seems the only way  toF > > > solve the problem is to edit PARAMS.DAT by hand, although ONE IS NOT ' > > > SUPPOSED TO EVER NEED TO DO THIS.  > > F > > Well, I don't see how multiple passes will help. PARAMS.DAT is theB > > output of the GETDATA phase and input to the next three pages.  " Uh, make that "next three PHASES".   > E > Yes, but normally if one modifies something in MODPARAMS.DAT, which  isE > also in PARAMS.DAT, say, EXPECTED_VOTES, then in future versions of + > PARAMS.DAT only the new value will exist.   E But if you go back to the old version of MODPARAMS.DAT you should get C back the old version of PARAMS.DAT, no? PARAMS.DAT is the output of G GETDATA. Does it not depend only on the inputs? And these inputs do not D include PARAMS.DAT. This reminds me of the effects of the hysteresisE property of ferromagnetic materials. In such effects the value of one E variable depends upon not only the current value of another variable, E but also upon the history of that other variable. I don't think there G are any hysteresis effects in which PARAMS.DAT depends upon the history G of MODPARAMS.DAT. If there are, can someone please explain how? Thanks.    [...]    ------------------------------  % Date: Sat, 21 May 2005 13:20:33 -0400 - From: "John E. Malmberg" <wb8tyw@qsl.network> 9 Subject: Re: How to filter spam based on message content? 1 Message-ID: <CfydndOeVbh-8BLfRVn-3A@adelphia.com>    Lawrence Bleau wrote: 1 > I'm running OpenVMS AXP 7.3-2, TCPIP 5.4 ECO 4.  > @ > I have spam filtering set up for IP addresses we know are bad. > @ > What I want to be able to do is filter based on content of theC > message, rather than just IP address, host name, or subject line. B > I'd like to reject the message while it is still being received,H > rather than letting it get queued and delivered to my users' inbox and6 > having them to deal with the messages one at a time. > * > Does anyone know of a method to do this?  H Please step away from the Dark Side of the spam filtering myths.  While G the holy grail of a working self content filter is desired by many and  & promised by some, none have delivered.  D When I see postings by mail server operators that have successfully F stopped almost all spam to their users, with out rejecting legitimate H e-mail, they are using DNSbls for reliable detection of the bulk if not  all of the spam.  % The baseline that is usually used is:   I Spamhaus.org , one or more open relay lists like ordb.org, dsbl.org, and     a DHCP list.   In more detail:   L sbl-xbl.spamhaus.org - This is a merged list of three DNSbls with one query.  @     sbl.spamhaus.org - This is a listing of known long term spamD                        sources or I.P. addresses known to be totally1                        under control of spammers.   =     xbl.spamhaus.org - Consists of currently three databases: I      cbl.abuseat.org - Spamtrap driven with auto-responders filtered out. H                        Most worms get their I.P addresses listed in the   D                        cbl.abuseat.org with in the first few minutes)                        of their mailings. C      opm.blitzed.org - Tested and proven spammer controlled zombied !                        computers. C      njabl.org       - Tested and proven spammer controlled zombied 0                        computers or open relays.7                        (dynablock range seems excluded)   * ordb.org            - Open relay database.  G list.dsbl.org       - Confirmed open relay and open proxy database that F                        are either still open, or can not/will not read@                        e-mail to their required postmaster/abuse                         accounts.  I The above lists combined are reported to stop over 80 to 90% of the spam  6 /virus delivery attempts for the people that use them.  H Adding a DHCP list like dul.sorbs.dnsbl.net will bring that up to close + to 99% of the spam/virus delivery attempts.   G Of the DHCP lists that I am aware of, and there are quite a few that I  F am not aware of, the dul.sorbs.dnsbl.net appears to be the most up to E date, with the dynablock.njabl.org coming in second.  Several others  E have been found to be missing so many DHCP pools for major broadband  * suppliers that they are basically useless.  E There is a small amount of people trying to run mail servers on DHCP  H addresses, but they are obviously not sending e-mail to most commercial  and residential domains.  & DNSbls to be careful of their use are:  B   dnsbl.sorbs.net - which contains a lot of useful zones, but also<                     contains spam.dnsbl.sorbs.net which is a<                     spamtrap zone.  The spam.dnsbl.sorbs.net>                     will typically be listing one or more real=                     mail servers of major residential ISPs at C                     any given time.  The other zones will typically                      be of use.  B   bl.spamcop.net - Can require some whitelisting as there as thereB                    are a few networks that are chronically slow to>                    act on spam reports, and a few times a year?                    someone manages to get their own mail server =                    listed by not paying attention to what the <                    spamcop.net parser is offering to report.  C                    bl.spamcop.net is now also listing worm sources, C                    and worm poop sources.  Worm poop being anything A                    that auto-responds to viruses.  Including mail B                    that send bounce messages instead of using SMTP                    rejects.   @         [Anyone that is generating a bounce for detected spam or?          viruses is being cluelessly abusive to the rest of the           internet]  E   multihop.dsbl.org or other multihop lists.  These list mail servers E                    that are allowing zombied systems to relay through ;                    them in addition to sending real e-mail.   E These and several other DNSbls are usually more suitable for scoring  L unless you want to make a political statement about the sending mail server.  D > This request is motivated by a spam that comes from a different IPC > every time, has a different subject line, but almost always has a E > certain identifying text in the message's body, such as "mort(age".   G In my experience, the DNSbls will more accurately catch this than will   pure content filters.   G I have not yet seen a pure content filter that when applied to a large  G community of users that does not leak more spam than a selected use of  G DNSbls, and at the same time will mis-classify a significant amount of  ; real e-mail as spam.  And that includes Bayesian filtering.   I The subject lines have a lifetime of about 72 hours or less and then the  A spammers change them to get around such filtering.  Such subject  F filtering only seems to work for short term blocking of initial virus 
 outbreaks.    F If you want to accurately classify the remaining 1% that gets through D the content filters, then I estimate the following metrics based on ? postings my mail server operators and by observed spam samples.   F The RFCs require that all servers on the Internet have a working rDNS.  H If a message has no rDNS at all, there is an over 99% percent chance it 6 is spam.  Many servers will outright reject such mail.  F If the rDNS is present but incorrect, then there is only about an 80% D chance that the message is spam.  It should be 100% as those 20% of F messages are coming from improperly set up domains, and continuing to H accept e-mail from those domains is preventing the use of a simple spam < fighting tool that is already built in to most mail servers.  F But for scoring purposes, bad RDNS should be considered almost all of 0 the points needed to classify a message as spam.  F The next metric would be the aggressive DNSbls such as bl.spamcop.net  and a few others listed above.  G The presence of bad rDNS and a bl.spamcop.net listing is probably high    enough of an indication of spam.    H The problem with content checks is that it is very hard to find content G that will only show up in spam and not in real messages, and there are  I cases where people will be sending spam samples to help determine how to   more efficiently filter them.   H So personally except for a virus scan, I would not do any content check H on a message unless it has a bad rDNS or is coming from an I.P. address  listed in an aggressive DNSbl.  H Now there is one type of content that will be in spam but not in a real I message unless it is discussing a spam sample.  That is the URL that the   spammer wants to advertise.   G If the URL does not resolve and the other metrics are present, then it  & is either spam or someone made a typo.  6 If the URL resolves to an I.P. address that is in the H sbl-xbl.spamhaus.org, then with the other metrics, you have confirmed a 
 spam item.  I As far as I know, SpamAssasin 3.0 is the only spam filter that knows how  G to do this check.  Even though it's accuracy has been known for over a  I year now.  I have heard of someone working on a port of SpamAsssasin for  7 OpenVMS.  I am not aware of the current status of that.   H At which point, the message can be rejected and the source I.P. address H put on a local suspect blocking list and be diverted for inspection and ; submitted to the traditional DNSbls and until it is listed.   F A local feedback e-mail address can be set up for people to feed what 4 little spam gets through so that it can be analyzed.  C > I'm not sure it can even be done at all without totally replacing . > TCPIP$SMTP_RECEIVER.EXE .  Thanks for ideas.  I I am not aware of any product on OpenVMS that will SMTP reject after the  C initial acceptance of the start of the SMTP transaction.  But then  F again, since my ISP prohibits me from operating a mail server, I have A not researched the issue, and I would only have been looking for  # products that I could get for free.   H It likely will require replacing the basic TCPIP$SMTP_RECEIVER.EXE with  a full featured mail server.  G There appear to be many such mail servers available in the open source  @ world.  I do not know how hard they would be to port to OpenVMS.  H If someone knows of a mail server with the ability to do custom content A checks before the SMTP transaction is over that is available for  H OpenVMS, either commercial or ported OpenSource, it would be useful for  them to post that information.   -John  wb8tyw@qsl.network Personal Opinion Only    ------------------------------  % Date: Sat, 21 May 2005 13:36:47 -0400 - From: "John E. Malmberg" <wb8tyw@qsl.network> 9 Subject: Re: How to filter spam based on message content? 1 Message-ID: <NtKdnUwNmvgs7BLfRVn-uQ@adelphia.com>    Steven M. Schweda wrote:/ > From: JF Mezei <jfmezei.spamnot@teksavvy.com>  > H >>>   _If_ it's the long list of "Bad-Clients:" causing the problem, I'dK >>>still assume that it's not reading the file every time, but just using a # >>>bad algorithm to do the search.   >>F >>You might consider using your own DNS server to supply a private RBLP >>service at which point, there is no longer any limit on the number of entries. > I >    I'd need one with capabilities I've not seen, as I usually punch out G > a whole block of addresses at a time.  That is, when I get junk from,  > for example, 64.163.155.184 = 7 > adsl-64-163-155-184.dsl.snfc21.pacbell.net, I consult D > "http://ws.arin.net/cgi-bin/whois.pl", and assume that everyone in@ > 64.163.155.176/28 (or, if I'm feeling particularly ungenerous,B > 64.160.0.0/12) is comparably lame, and use that whole block in a > "Bad-Clients:" entry.  > G >    If there's an easy way to do that using a (conveniently available) J > DNS server, then I'm open to a good exposition.  If I'd need to write my& > own, I think that I'd prefer not to.  E I think that you can do that with bind configuration files in recent  F versions of TCPIP where you can set a range of domain names to return  the same I.P. addresses.  G Unfortunately I have not learned the how to configure bind to give you   more precise information.   F Also you will find that there are pre-existing DNSbls that attempt to " list some ISPs and some countries.  C DNSbl entries are in reverse numeric order.  So if your domain was  F example.com and you set up a local dnsbl named dnsbl, it's address to , your mail server would be dnsbl.example.com.  C A typical entry in it would be 2.0.0.127.dnsbl.example.com for the  & standard DNSbl test address 127.0.0.2.  1 EAGLE> tcpip show host 2.0.0.127.dnsbl.xile.realm          LOCAL database   Host address    Host name   * 127.0.0.2       2.0.0.127.DNSBL.XILE.REALM  1 EAGLE> tcpip show host 2.0.0.127.sbl.spamhaus.org          BIND database   + Server:   192.168.0.2      eagle.xile.realm    Host address    Host name   * 127.0.0.2       2.0.0.127.SBL.SPAMHAUS.ORG     -John  wb8tyw@qsl.network Personal Opinion Only    ------------------------------  # Date: Sat, 21 May 2005 06:16:45 GMT 1 From: drwho8__NOTME__@att.net (The Eighth Doctor) 7 Subject: Re: Networking problem concerning a DEC TS 90L H Message-ID: <hnAje.234954$cg1.229492@bgtnsc04-news.ops.worldnet.att.net>  F In article <428EA2B7.FF27F7C3@comcast.net>, djesys.nospam@comcast.net  says...  >  >The Eighth Doctor wrote:  >>   >> Hello from the Eighth Doctor F >> Basically I need to connect a DEC TS 90L who has a COAX port, to a 
 customer'sN >> UTP based network. It seems they seem need that gizmo for some work they doP >> based at the other end of their network. I did explain that there is a whole 	 backplane O >> for doing just that, but they refuse to spend the extra money to obtain the  
 backplane. >>  R >> I just finished using a Google based search engines for the DELNI. I would have* >> better luck wiring something of a sort. >>  Q >> Does anyone on the NG have just such an item roosting in their equipment room, P >> that they obviously do not need, and would be willing to part with, I'll pay  shippingW >> charges? And if your located in the tri-state area, (NY, NJ, CT), I'll take anything Q >> medium sized that's not needed as well, physically. Please e-mail for physical  >> address.  >  >DELNI doesn't sound right.  > D >You're looking for a 10BaseT <-> 10Base2 transceiver of some sort.  > B >Push comes to shove, look for a DESPR (10Base5 to 10Base2, sinpleH >10Base2 port) or a DEMPR (multiple 10Base2 ports), and a DESTA (10Base5G >to 10BaseT), at least I think those are the models. Not sure about the  >-xx suffix for each, though.  > G >...though there's likely a smaller single-unit device that will do the % >same thing. Have you tried BlackBox?  >  >--  >David J Dachtera  >dba DJE Systems >http://www.djesys.com/  > * >Unofficial OpenVMS Hobbyist Support Page:# >http://www.djesys.com/vms/support/  > ) >Unofficial Affordable OpenVMS Home Page:   >http://www.djesys.com/vms/soho/ > # >Unofficial OpenVMS-IA32 Home Page:   >http://www.djesys.com/vms/ia32/ > 
 >Coming soon: ' >Unofficial OpenVMS Marketing Home Page  Hello from the Eighth DoctorP Yes. What they have is too expensive, and poorly suited to my needs. I've got a O four port AUI hub that Inmac made about twenty years ago, plus a good count of  Q DESTA units, and an equal number of AUIs that are UTP output. I figured I'd wire  < my own adapter, if I could not scare up a BNC<-->UTP device.  J Problem is the first place that Google showed me that might have had them P for sale, had discontinued them three years ago. And the first sales 'droid who Q answered my e-mail, has reached the limits of his programming. I might visit the  T CDW website, or just keep digging. What I really need is one of the backplanes that  the TS plugs into. ---  Gregg drwho8 atsign att dot net    ------------------------------  + Date: Sat, 21 May 2005 13:50:25 +0000 (UTC) 3 From: "Richard Maher" <maher_rj@hotspamnotmail.com> " Subject: New Cluster Interconnects? Message-ID: <d6neb1$rds$1@nwrdmz02.dmz.ncs.ea.ibs-infra.bt.com>    Hi,   J I was flicking through the OpenVMS Roadmap presentation yesterday and cameJ across a couple of very interesting  (at least to me) milestones regardingJ Cluster Interconnects. Now, I'm pretty useless with hardware, "the laws ofJ physics capt'n", and not much better as a System Manager so I hope someoneK can offer me a lay-man's view of what these developments could mean for VMS : Cluster performance. (In particular the VMS Lock Manager.)  I 1) I saw 10 Gigabit NIC support scheduled for VMS 8.3 (Depending on which J slide you look at it says "Integrity Servers Only"). Now 10x what a lot ofG people are using for a cluster-interconnect at the moment sounds pretty E shit-hot to me! Especially if you're moving big lock-trees around the L cluster. Given that this functionality is less than a year away, surely someI performance figures or at least anecdotal evidence should be available? I I mean, if I was an Rdb engineer that had used piss-poor DLM performance as L the rationale for sticking all of my R&D eggs in the stand-alone single-nodeI basket, then I'd be interested in what's happening with this. Right? "But K it's not the bandwidth, it's the latency that gets ya." Well that brings me  to the next slide. . .  H 2) Next Generation Low-Latency Interconnects Post 8.3 (Integrity Servers Only)   ? Am I the only person getting their jollies out of this or what?   K I forget when Oracle10g was scheduled to arrive but I'd dearly love to hear 6 from anyone using Cache Fusion and is looking at this!  K Will there be a special limit on the distances between nodes for this stuff K to work? (Like memory channel) Can you have a Disaster Tolerant Low Latency  Cluster?  6 Regards Richard (Just off to have a cold shower) Maher   ------------------------------    Date: 21 May 2005 06:24:34 -0700 From: brucedodds@comcast.net- Subject: Re: Newbie with command file problem C Message-ID: <1116681874.178386.318850@g14g2000cwa.googlegroups.com>   F Yes, I've seen the VMS help command.   I do  use it, but it might haveD been kind of tough to get an answer to the question I posed here via HELP.    ------------------------------  + Date: Sat, 21 May 2005 14:53:56 +0000 (UTC) P From: helbig@astro.multiCLOTHESvax.de (Phillip Helbig---remove CLOTHES to reply)  Subject: upgrade 7.3-1 --> 7.3-2$ Message-ID: <d6ni24$vhv$1@online.de>  ; I have a few questions regarding a 7.3-1 --> 7.3-2 upgrade.   G First, though, I'm happy to say that it went well, and I now have a DEC C 3000/300LX with 48 MB RAM (yes, I know that the official minimum is F more) running 7.3-2 (I did the upgrade on a 3000/600 with 192 MB RAM, E though) and apparently all is OK.  (I also have TCPIP 5.4 ECO 4 now.)   C I've done fresh installs with 7.1 (ALPHA), 7.2 (VAX), 7.3 (VAX) and B upgrades 7.1 --> 7.2-1 (ALPHA), 7.2 --> 7.3 (VAX), 7.2-1 --> 7.3-1H (ALPHA) and now 7.3-1 --> 7.3-2 (ALPHA).  Only in this most recent case F did I see these problems; previously, everything went without a hitch.  D First, I got this during the VMS upgrade (I simultaneously upgraded 6 DECnet, TCPIP, DECwindows and all the required stuff):  E    %PCSI-E-PARUDF, file [SYSLIB]SYS$STARLET_C.TLB was not previously  B    installed or is present but out of scope; module update skippedH    Terminating is strongly recommended.  Do you want to terminate? [YES]  G First, I terminated as suggested.  I was then informed that the target  F disk had been changed.  I had a backup with 7.3-1, of course, but now I that the target disk was already changed, I saw no harm in trying again,  H since at worst it wouldn't work and I would have to revert to 7.3-1.  I 3 then tried it again except that I didn't terminate.   > I then saw some "DCL-W-skipdat" warnings, apparently from the I installation procedure, but no errors and, as I say, everything seems to   be OK.  H The file in question exists on the 7.3-1 disk, on the 7.3-2 source disk B and the 7.3-2 target disk, so I really don't understand where the  message is coming from.   - Directory DISK$ALPHASYS_3:[VMS$COMMON.SYSLIB]    SYS$STARLET_C.TLB;1 P                   6070/6075      4-NOV-2004 20:41:46.97  15-MAR-2005 10:56:01.88    E What does the message above actually mean?  How could I test whether  H something is indeed wrong with this file?  (From the dates, however, it B looks like the version I currently have came from a patch.  I did G verify, though, that it was on the 7.3-2 source disk and on the target  G disk (with an earlier date) after the upgrade, and of course it was on   the 7.3-1 disk.)  F Some related questions:  After the upgrade, I immediately applied all G patches (the latest UPDATE and all patches not in that).  (It would be  A nice if PRODUCT INSTALL were supported within the restricted DCL  C environment!)  I first applied the PCSI patch, and it said I could  C either log out and log back in or do a "SET COMMAND".  I chose the  ? latter.  The next installation complained about "BLOCK_SIZE".   H Apparently the installation went OK though.  To me, this looks like the 6 SET COMMAND didn't take effect.  Has anyone seen this?  H Since I was installing from a different account than the one I normally H use for installation, the installation of the UPDATE kit crashed due to H too low quota.  I then modified the account, logged out and logged back H in, and repeated the installation.  It apparently went through OK (here C and in the above case if PRODUCT tells me it has been successfully  D installed, I'm hoping that that is in fact the case), but gave some D strange "kitnotsame" messages, though of course it was the same kit.  D I also noticed in the ACRTL patch it sometimes says in the text fileD that it is for 8.2 rather than 7.3-2, but in other cases talks aboutD 7.3-2, which is apparently correct.  Probably a cut-and-paste error.  B I'm also confused about the PCSI messages regarding the saving of E recovery data.  Normally, I apply a few patches one after the other,  G then reboot once when I am done (then usually again after an AUTOGEN a  B day or two later).  One is advised to save recovery data, but the F messages make it sound like one can undo only the last patch applied, I though based on other messages this is not completely clear.  Can anyone  F explain this in detail?  If one can only undo the last patch, I don't E see much benefit from this, but I also don't see any reason for this  ( restriction.  Or am I missing something?  F Due to lack of time and wide-SCSI expansion boxes, as a backup I just F have the other member of the original system disk.  As soon as I feel E happy with 7.3-2, I'll add it back to the system-disk shadow set and  @ will have no 7.3-1 system disk anymore.  Thus, I'm particularly H interested in what the strange errors above actually mean and whether I F can safely move permanently to 7.3-2 (i.e. overwrite the 7.3-1 system  disk with a shadow copy).    ------------------------------    Date: 21 May 2005 08:50:29 -0700 From: tomarsin2015@comcast.net0 Subject: Re: VAXstation 3100 free to a good homeC Message-ID: <1116690629.554651.199670@g43g2000cwa.googlegroups.com>   G The system is in Albuquerque, New Mexico, but I thought comcast.net was D country wide??  I have access to lawyers that would go after anybodyB that would be dumb eough to sign such a contract!!  (ha ha!!) That) includes if you go to Mars, Pluto or M31. F Yes there is such a thing as a VAXstation 3100 Model 10. I also have aB VAXserver 3100 Model 10 acting as a Pathworks Server which is also? connected to a HSZ70. The AlphaStation  is going to the f*&k%&& ' manager, but I would love to trash it!! B I also have a few 3100-90 with the optional 2 scsi controller, but- those will not be going down for a few years.    ------------------------------   End of INFO-VAX 2005.282 ************************