a bit of history on the relatonal model

Thanks to Software Memories we learn about David Childs and his work on Extended Set Theory. I quote from the blog post:

“Way back in 1968, Childs wrote a paper outlining how set theory, relations, and tuples could be applied to data management.

And that’s where I did a double-take, because 1968 < 1970. Sure enough, Footnote #1 in Codd’s seminal paper is to Childs’ 1968 work. Indeed, Childs’ paper is the only predecessor Codd acknowledges as having significant portions of his idea.”

It seems that there was life before God Codd after all.

sendmail load configuration

This post is about a neat trick that I have not seen many times discussed. According to the configuration README the default values for controlling load averages are:

  • confQUEUE_LA (QueueLA) Load average at which queue-only function kicks in. Default values is (8 * numproc) where numproc is the number of processors online (if that can be determined).
  • confREFUSE_LA (RefuseLA) Load average at which incoming SMTP connections are refused. Default values is (12 * numproc) where numproc is the number of processors online (if that can be determined).

However in “Sendmail Theory and Practice” (I am a proud owner of both editions) Paul Vixie and Fred Avolio propose a different approach:

“Astute readers will note that the value shown for Ox (QueueLA) is larger than the value shown for OX (RefuseLA), and that this is opposite from the configuration files you may have seen elsewhere. Setting them as shown here gives Sendmail a range of load average in which it is capable of delivering messages from its queue but incapable of receiving new messages. This is intentional. If you set Ox to be less than OX, Sendemail has instead a range of load average in which it can receive new mail (thus adding to the queue) but cannot deliver any queued mail. We believe that mail queues should become smaller or stay the same size when the load average is high. After watching our large mail gateway computers melt down many times over the years, we have learned that it is better to let other hosts’ mail stay where it was -on other hosts- when our load average is high, than to accept it even though we don’t plan to do anything with it until load average becomes low again.”

In other words although the defaults suggest otherwise, it may be wiser to have QueueLA > RefuseLA. This piece of advice is on both the 1995 (1st) and 2002 (2nd) editions of the book. A pearl that comes from 1995 that is still relevant.

AthCon begins

“A beginning is the time for taking the most delicate care that the balances are correct” –Frank Herbert’s Dune.

AthCon begins today. Since it is the first AthCon it really begins today. It is a non-product, non-vendor-biased conference aiming to present the best research and cutting edge exploitation techniques from the field’s leading experts. I feel extremely privileged that I was invited to participate in the (first) PC of such an effort. However due to the 24-hour strike of the public transportation workers and the law of unexpeted consequences that always finds opportunity to emerge I will not be able to attend the event. I was really looking forward to watch:

  • “OWASP Top 10 – 2010: Towards a secure Software Development Lifecycle” by Konstantinos Papapanagiotou
  • “Context-Keyed Payload Encoding: Fighting the Next Generation of IDS” by Dimitrios Glynos and
  • “BNF (Backus-Naur Form) based blackbox fuzzing” by Chariton Karamitas

Maybe these kind souls will email me their presentations.

Good luck AthCon and be a nice journey. See you next year and every year!

unix mailbox format

In his latest post, dds is working with the traditional unix mailbox format in order to extract some analytics on his email usage. With all its deficiencies, for 30+ years mbox remains the most portable email format in use. While other formats like mbx, maildir, etc have been invented, and although its use has changed over the years, it refuses obsolescence and for some 5 years now, it is also described in an RFC.

Simplicity at its best.

€1.60

Μου μεταφέρθηκε από αναγνώστη του blog: Έχει δύο μπουκαλάκια με νερό στο χέρι και πάει να πληρώσει:

– Ουάν-σίξτυ
– Πως είπατε;
– Έλληνας είσαι φιλαράκι; Ένα και είκοσι.

Default και πάλι default!

Q: ITU botnet mitigation toolkit?

This was sitting in my drafts folder for quite some time. It seems that ITU has (had?) and effort to create a botnet mitigation toolkit. As the web page says:

The first draft of the background material for the project was made available in December 2007 with pilot tests planned in a number of ITU Member States in 2008 and 2009.

It is 2010 now, so does anyone have any more information on the toolkit’s progress?

The Dataverse Network Project

Μια και αρκετοί πια μιλάνε (και γράφουν) για ανοιχτά δεδομένα και κυβερνήσεις, διεθνείς οργανισμοί κ.ο.κ. ανοίγουν την πρόσβαση προς τα δεδομένα που παράγουν, μια ματιά στο Dataverse project είναι χρήσιμη.

[via]

“v=spf1 mx -all”

It seems that a lot of web hosting providers are now using SPF in an effort to minimize spam that may seem to originate from their clients. Unfortunately many of them seem to use a default setup of “v=spf1 mx -all”. This configuration is interpreted as follows:

  • v=spf1 This identifies the TXT record as an SPF string.
  • mx The MX servers for the domain are allowed to send email that originates from the domain.
  • -all No other servers are allowed to send mail originating from the domain.

To the uninformed user this setup creates delivery problems, unless he is provided with a port 587/tcp submitting email option by his webhosting / email provider. For when the user tries to send email using his ISP’s outgoing SMTP server, anyone honoring SPF records drops the email. And yes the hosting provider never hears about that because the user calls the first level support of the ISP who clearly cannot help him.

-all is a good idea only when you provide your customer with a port 587/tcp sending email option.

Note: This post was triggered by my frustration because of a similar case and the timely request of a reader of this blog to write something about SPF. To be honest, I do not consider SPF as an antispam solution since a spammer can have (and in fact many do) perfectly legal SPF records for domains that they own.