Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 


Andrew T.

Websites automatically blocking and banning Windows 95 users

Recommended Posts

Thanks for the feedback and investigation work!

The "handle random port DNS" pronouncements read like incoherent gibberish. My first guess was that it had something to do with systems without the Winsock 2 update...but that's been around for almost as long as Windows 95 itself, so no excuses there.

Andrew T. I am guessing that your first link of where it has happened was done by their hosting company, not them. That is assuming that they are not total Penguin addicts and that nothing else is any good, which is not the impression I got from the little I read.

bpalone

I'd like to think that users of Linux and sub-XP Windows have a fair amount in common...namely, an enterprising spirit and a disenchantment with the state and direction of Microsoft's commercial software development. But I digress...

Since they apparently block the IP, he'll have to go take his computer to a different site and/or go through an anonymizer to change his IP in order to try it and see. And if it doesn't work, he'll have succeeded in blocking that IP from that site.

It'd be challenging to do useragent experimentation, that's for sure. It's also difficult to discover where these sites exist without being blocked by them first!

Don't you wish someone would have told you that you can't access the internet on Windows 95 before you did Andrew T.? I'm going to have to get the ol' Win 3.1 system up and running to see if I can access the site.

"There are no windows 95 machines that can access the net anymore" is a total hoot. I almost wish I could browse the SpambotSecurity site for more gems of trivially-rebuttable idiocy...alas, I'm limited to the Google cache for that.

Wondering about the SpamBot Blocking that MSFN uses? Seems Win95 isn't block "just because", correct?

Well, I'm posting here now! :yes:

Share this post


Link to post
Share on other sites

Would some one here elaborate on what the Z Bot instigator means by this statement :"MS never updated the Windows TCP/IP stack to handle random port DNS, thus any machine identifying itself with that string, is actually a bot with a B.S user agent."

Could someone explain the technical aspects of the process he alludes to, and how he (if serious) could misconstrue himself into believing no can still use 95 anymore?

Here's something about this random-port business:

------------

http://marc.info/?l=gauntlet-user&m=98450705427468&w=2

At 11:08 AM 3/13/2001 -0600, Talamantes, Jeremiah R. (TC) wrote:

> Looking for some help and an explanation to these security alerts...

>

> The source connection info ":53" from "10.1.1.55:53" obviously indicates DNS

> activity, but what type of DNS activity would utilize random porting?

DNS queries go out from port 53 (usually) to port 53 on a destination server.

When a query is about to be sent, the local DNS server allocates a random

UDP reply port for the return response; the request effectively says

"here's my question, send the response to this random port". That's why

you're seeing random port DNS activity. The destination port is different

to allow the responses to be associated with an active query.

Why you get security alerts is because the DNS servers are aggressive - a

query will be sent out, and if a response isn't quickly returned, another

query goes out to one of the other nameservers for the domain. As soon as

one of the outstanding queries for a request gets a response, the listener

on the other ports gets dropped. If the response for one of the abandoned

queries finally struggles it's way back, you get a security alert.

-------------------

I just visited that site (www.rpg.net) with FF2 using it's default user-agent string - and the page came up no problem. Obviously in your case it is keying in on win-95.

There was a comment in this thread about how your IP is now banned on that site. I don't know how common it is for an ISP to hand out static IP's (especially for residential customers) but I get a different IP from my isp when I tell my modem to disconnect and reconnect.

Not to start a flame war, but I really don't see the point of running win-95 vs win-98. Yes, that site is stupid for blocking win-95. But if you're going to run win-9x/me, then whats the advantage of 95 over 98? Seems there are more limitations and troubles than advantages.

Share this post


Link to post
Share on other sites

Not to start a flame war, but I really don't see the point of running win-95 vs win-98. Yes, that site is stupid for blocking win-95. But if you're going to run win-9x/me, then whats the advantage of 95 over 98? Seems there are more limitations and troubles than advantages.

I touched on some of those considerations years ago:

http://www.msfn.org/board/topic/104812-why-use-win-98seme/#entry694890

http://www.msfn.org/board/topic/134161-windows-95-or-windows-98-se/#entry858039

Share this post


Link to post
Share on other sites

In between Flash 8, kludgy scripts, and restrictive browser checks, I've experienced quite a few frustrations using Windows 95 on the web over the last few years. Only rarely have I encountered downright hostility, though...but this takes the cake.

Over the last year or two, I've stumbled across sites that run some server-side PHP package called Spambot Security ZB Block. If you access one of these sites from a Windows 95 computer (or any browser with a Win95 useragent), this arrogant and absolutely obnoxious message appears:

-= IMAGE =-

They're not kidding. If I try to access any page on the site from any computer from the same IP afterward (regardless of OS), a plain screen with a "Error 503 : Service Temporarily Unavailable" message is all that results.

Thankfully ZB Block seems to be pretty rare, but I have encountered it here, here, and here. It also afflicts the vendor's own site...including this confrontation thread, ironically enough.

Has anyone else encountered this?

Never seen that! Reminiscent of script kiddies trying to block MSIE from Netscape fanboy sites, and vice versa. Let the arms race begin. Block Windows XP. Block Apple. Block Microsoft Tiles. :lol: Amateurs.

That's why toll booth jumping :w00t: has been invented, AFAIK ;):

-= VIDEO =-

Oh crap. You owe me another monitor. :lol:

Share this post


Link to post
Share on other sites

The only thing I can guess that he could be yabbering about is "RST cookies"

DoS Attacks (cont.)

Methods of Prevention

RST Cookies
  • Server sends a false SYNACK back
  • Should receive an RST in reply that something is wrong
  • If this happens, this verifies that host is legitimate
  • Not compatible with Windows 95 or possibly machines behind firewalls

Was there an update that addressed this issue specifically? Not saying this is how he's detecting 95, just likely what he's talking about.

Share this post


Link to post
Share on other sites

I had to laugh when I ran across this:

http://adminextra.com/threads/zb-block.3518/

Note Mikey's thoughts:

So you block this user due to windows 95 being their OS?

And you are blocking ISP's which you deem unreputable, but SOME of those users on those ISP's are legitimate. I would not use this script if you paid me, seems that alot of the decisions are purely judgemental, rather than helping to protect your site from hackers or bruteforce.

Amen, Mikey. Amen. BTW, I should say that no one with half a brain ever implemented "RST cookies" like I mentioned above.

Share this post


Link to post
Share on other sites

I'd say more. When I tried to visit http://www.stopforumspam.com/ from my work computer (Windows 7), I also got this page 403. The reason was "RBN". I don't know what it means, but they seem to block a large number of genuine visitors, not just spammers.

Share this post


Link to post
Share on other sites

OT, but not much, this site:

http://www.windowsbbs.com/

Gets this if accessed from Opera:

Sorry

Because of continued abuse from users with the browser you are currently using, I'm disallowing that browser from WindowsBBS.com.

You can access our site with Internet Explorer or Mozilla FireFox instead.

It's starting to seem more like a "New Highway, no European cars allowed, sorry" or "Due to abuses by taxi drivers no yellow cars allowed to enter the garage"...

jaclaz

Share this post


Link to post
Share on other sites

OT, but not much, this site:

http://www.windowsbbs.com/

Gets this if accessed from Opera:

Sorry

Because of continued abuse from users with the browser you are currently using, I'm disallowing that browser from WindowsBBS.com.

You can access our site with Internet Explorer or Mozilla FireFox instead.

It's starting to seem more like a "New Highway, no European cars allowed, sorry" or "Due to abuses by taxi drivers no yellow cars allowed to enter the garage"...

jaclaz

Hmmm Maybe it's a combination of OS, browser and country of origin? I was able to access that site just fine using both Opera v18.0.1284.68 and Opera Next v19.0.1326.45 on my Win7SP1x64 system from the US without getting any such warning message.

Cheers and Regards

Share this post


Link to post
Share on other sites

It seems this situation is a that of a 3rd party blocking access to that website from his own domain. Two separate cases ...

http://www.windowsbbs.com/

http://www.helpwithwindows.com/WindowsBBS.html

The first one works fine as bphlpt mentioned, while the second results in the following as Jaclaz has mentioned ...

xsBqi1l.png

Note the use of the language "from WindowsBBS.com".

Curiously, since he writes that in the first person I have to infer he is involved with that website somehow. So the question is ... have we in fact now met the dumbest person on the entire Internet? It is very possible. :yes: It is quite a stretch to rationalize banning all Opera users because of some alleged bad behavior by a few. It immediately makes me angry and I think back to things like this ...

whites_only.gif

Just one of countless examples from the past.

WhitesOnlys.jpg

segregation%2Bdrinking%2Bfountain.JPG

whites-only-277x300.jpg

1sign.jpg

34.jpg

What excellent thinking by this Microsoft MVP! ... NOT. :no:

Share this post


Link to post
Share on other sites

I was able to access that site just fine using both Opera v18.0.1284.68 and Opera Next v19.0.1326.45 on my Win7SP1x64 system from the US without getting any such warning message.

Opera is "Opera" until version 12:

http://www.opera.com/docs/history/presto/

Anything after, including Opera Next is what we highly specialized technicians define as "half-@§§ed Chrome" ;):

http://www.opera.com/docs/history/

With Opera v12 accessing the site:

http://www.windowsbbs.com/

redirects me to:

http://www.helpwithwindows.com/WindowsBBS.html

Whether it is by design or by mistake it is anyway stupid, and stupidity must not be hidden.

BOTH sites are owned by FDMA Media LLC:

http://www.fdma-media.com/

which is seemigly a "one man show" by this guy Arie Slob (MS MVP, MCSA, MCDST, MCP, AWN[1]):

http://mvp.microsoft.com/en-us/mvp/Arie%20Slob-9155

jaclaz

[1] AWN=And What Not, a complimentary title I award personally to anyone with at least two MC* titles.

Share this post


Link to post
Share on other sites

It seems this situation is a that of a 3rd party blocking access to that website from his own domain. Two separate cases ...

http://www.windowsbbs.com/

Well, this is what I get when trying to access the site:

OSIE8K8l.png

No matter what browser I use. The site loads when using a proxy.

Same thing here:

ZjqY5MUl.png

The message is displayed regardless of what web browser is used. It seems like some kind of IP blocking.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...