On 11/12/2015 06:40 PM, wulfman wrote: Why not? -- --- Dave Woyciesjes --- ICQ# 905818 --- CompTIA A+ Certified IT Tech -http://certification.comptia.org/ --- HDI Certified Support Center Analyst -http://www.ThinkHDI.com/ Registered Linux user number 464583 "Computers have lots of memory but no imagination." "The problem with troubleshooting is that trouble shoots back." - from some guy on the internet.

On 11/12/2015 09:11 PM, wulfman wrote: Dude, chill. I figured it was a scam, I was just curious what kind. And please use proper mailing bottom-posting etiquette. Makes the conversation easier to follow. -- --- Dave Woyciesjes --- ICQ# 905818 --- CompTIA A+ Certified IT Tech -http://certification.comptia.org/ --- HDI Certified Support Center Analyst -http://www.ThinkHDI.com/ Registered Linux user number 464583 "Computers have lots of memory but no imagination." "The problem with troubleshooting is that trouble shoots back." - from some guy on the internet.

So few get through that the VERY rare exception is a credit to your diligence and choice of a great filter. And as many of us all too often forget to say: THANK YOU FOR A GREAT SERVICE!!!!!!!!!!!!!!!!!!!!!!!! Jerome Fine

On Thu, 12 Nov 2015 21:25:58 -0600 "Jay West" <jwest at classiccmp.org> wrote: I'm a member of spamcop and submitted all of the spam posts to spamcop (since becoming a member, I've submitted over 15,000 spams to them). At any rate, here's the detail of who posted it - and the ISP who got the spam post: -------------------------------------------- Here are the results of your submission: Processing spam: From: katelists at trouts.org Subject: Fw: new message 0: Received: from huey.classiccmp.org ([199.188.211.196]:24115) by biz170.inmotionhosting.com with esmtp (Exim 4.85) (envelope-from <cctalk-bounces at classiccmp.org>) id 1Zx1HS-002Mnq-NF for lbickley at bickleywest.com; Thu, 12 Nov 2015 15:27:51 -0800 Hostname verified: huey.classiccmp.org inmotionhosting.com received mail from sending system 199.188.211.196 1: Received: from huey.classiccmp.org (localhost [127.0.0.1]) by huey.classiccmp.org (Postfix) with ESMTP id 51C3C2073F99; Thu, 12 Nov 2015 17:27:41 -0600 (CST) Internal handoff or trivial forgery 2: Received: from mx2.ezwind.net (unknown [172.20.1.95]) by huey.classiccmp.org (Postfix) with ESMTP id CB3BD2073F8F; Thu, 12 Nov 2015 17:27:38 -0600 (CST) Internal handoff or trivial forgery 3: Received: from mx2.ezwind.net (localhost [127.0.0.1]) by mx2.ezwind.net (Postfix) with ESMTP id B14D74E6AA; Thu, 12 Nov 2015 17:27:38 -0600 (CST) Internal handoff or trivial forgery 4: Received: from mailout.ish.de (mailout.ish.de [80.69.98.247]) by mx2.ezwind.net (Postfix) with ESMTP id 5855C4E6B4; Thu, 12 Nov 2015 17:27:37 -0600 (CST) Hostname verified: mailout.ish.de warning:Possible forgery. Supposed receiving system not associated with any of your mailhosts Will not trust this Received line. Tracking message source:199.188.211.196: Cached whois for 199.188.211.196 : noc at xiolink.com Using abuse net on noc at xiolink.com abuse net xiolink.com = abuse at xiolink.com Using best contacts abuse at xiolink.com warning:Yum, this spam is fresh! Message is 0 hours old 199.188.211.196 not listed in cbl.abuseat.org 199.188.211.196 not listed in dnsbl.sorbs.net Spam report id 6380971842 sent to: abuse at xiolink.com May be saved for future reference: http://www.spamcop.net/sc?id=z6193526037z09bcbf8ca61934833a230d5cac9df43dz Processing spam: From: katelists at trouts.org Subject: Fw: new message 0: Received: from huey.classiccmp.org ([199.188.211.196]:34299) by biz170.inmotionhosting.com with esmtp (Exim 4.85) (envelope-from <cctalk-bounces at classiccmp.org>) id 1Zx1J4-002O8P-9m for lbickley at bickleywest.com; Thu, 12 Nov 2015 15:29:30 -0800 Hostname verified: huey.classiccmp.org inmotionhosting.com received mail from sending system 199.188.211.196 1: Received: from huey.classiccmp.org (localhost [127.0.0.1]) by huey.classiccmp.org (Postfix) with ESMTP id 6C13E2073F84; Thu, 12 Nov 2015 17:29:29 -0600 (CST) Internal handoff or trivial forgery 2: Received: from mx1.ezwind.net (unknown [172.20.1.26]) by huey.classiccmp.org (Postfix) with ESMTP id E9D542073F6B for <cctalk at classiccmp.org>; Thu, 12 Nov 2015 17:29:27 -0600 (CST) Internal handoff or trivial forgery 3: Received: from mx1.ezwind.net (localhost [127.0.0.1]) by mx1.ezwind.net (Postfix) with ESMTP id 974C34E743 for <cctalk at classiccmp.org>; Thu, 12 Nov 2015 17:29:28 -0600 (CST) Internal handoff or trivial forgery 4: Received: from eu1.nethat.com (eu1.nethat.com [81.223.254.166]) by mx1.ezwind.net (Postfix) with ESMTP id 247FF4E718 for <cctalk at classiccmp.org>; Thu, 12 Nov 2015 17:29:27 -0600 (CST) Hostname verified: eu1.nethat.com warning:Possible forgery. Supposed receiving system not associated with any of your mailhosts Will not trust this Received line. Tracking message source:199.188.211.196: Cached whois for 199.188.211.196 : noc at xiolink.com Using abuse net on noc at xiolink.com abuse net xiolink.com = abuse at xiolink.com Using best contacts abuse at xiolink.com warning:Yum, this spam is fresh! Message is 0 hours old 199.188.211.196 not listed in cbl.abuseat.org 199.188.211.196 not listed in dnsbl.sorbs.net Spam report id 6380971843 sent to: abuse at xiolink.com -------------------------------------- Cheers, Lyle -- 73 AF6WS Bickley Consulting West Inc. http://bickleywest.com "Black holes are where God is dividing by zero"

On 11/13/2015 7:13 AM, Dave Woyciesjes wrote: Windows new feature ... Auto Click Sigh.

Most browsers can be hijacked via DNS or IP address stealing. Thats how much public access wifi works. Any attempt to access any page diverts to a login page. On Nov 14, 2015 12:05 AM, "Chuck Guzis" <cclist at sydex.com> wrote:

Yes they do buy the new merackie gear idiots On Nov 22, 2015 12:14 AM, "Eric Christopherson" <echristopherson at gmail.com> wrote:

On 2015-11-22 10:05 AM, geneb wrote: +1. It's actually a helpful reminder to change ISP's. --Toby

On Sun, Nov 22, 2015, Jerry Kemp wrote: I'm not sure, but I'm betting https sites just refuse to connect -- which is how my employer's network handles https. -- Eric Christopherson

That was the original theory, as I understand it. But there are way too many "in most browsers by default" CAs that are willing to sell wildcard certs such as can be used for MitM attacks without disturbing cert validity checks. I even recall hearing of some caching proxy (squid maybe?) that, out of the box, could use such a cert to provide caching for HTTPS connections - they're that common. Not surprising, really. The CA hierarchy is both the most central point and quite possibly the most commercialized and thus most venal point, so it's natural that it would be the major point that's come under attack by actors wishing to compromise the security HTTPS could have offered. (Some of them, probably, even have the best of intentions....) Or, of course, file bug reports with the provider in question and, if they're honest enough to admit what they're doing, switch. I know _I_ certainly wouldn't tolerate that sort of messing with my data stream. For those unfortunate enough to have nobody affordable to switch to, all I can suggest is ssh (or operational equivalent, such as a VPN) to a hosted, possibly virtual, machine somewhere not behind such crippling restrictions. (Depending on such factors as the jurisdiction and your dedication to the cause, a lawsuit might also be an option.) /~\ The ASCII Mouse \ / Ribbon Campaign X Against HTML mouse at rodents-montreal.org / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B

For outbound TMG needs a browser plugin. For inbound its usual to terminate the SSL on the TMG firewall and then TMG opens a new SSL session to the backend web server. For this to work TMG needs to have a copy of the certificate including the private key. Wildcard certs are commonly used with TMG but having a FQDN only guarantees the server is under control of the certificate owner. You can have multiple sites on the same server, or have a single site load balanced across multiple servers. SQUID will do the same trick, but I have always run squid on the same box as the web farm, but this isn't required... On Nov 23, 2015 5:48 AM, "Toby Thain" <toby at telegraphics.com.au> wrote:

On Mon, Nov 23, 2015 at 12:16 AM, Adrian Stoness <tdk.knight at gmail.com> wrote: And here's today's installment: Dell has been found to be including an easily cloned root certificate on its laptops, similar to the Lenovo Superfish debacle: http://arstechnica.com/security/2015/11/dell-does-superfish-ships-pcs-with-… -- Eric Christopherson

If you have a Unix box as your firewall, as I do, it's not hard to set up your own DNS server to serve the machines behind it. Then you can just load the current root files and take it from there. paul

No problem. Just make sure that emails from my friend the rich Nigerian prince get through! He's been talking to my banker at the UN. On Thu, Nov 12, 2015 at 7:25 PM, Jay West <jwest at classiccmp.org> wrote: