MAPS RBL Challenged In Court Case

An Anonymous Coward sent in "Direct Magazine is carrying the story Yesmail Gets Restraining Order Against MAPS Blacklist (curiously dated July 17). YesMail has apparently obtained a restraining order preventing MAPS from entering it into its Real-time Black-hole List."

Comments

Weird

[Jeffrey Baker]

Company A is suing group B to prevent group B from adding company A to a list. Once you distill it that far, it is an obvious restraint on free speech. MAPS, as long as they are careful to show the reasons, has every right to put Yesmail on a list. Obviously, Yesmail would agree to be on a list of, say, the Red Herring top 100 internet companies, so they also have to be willing to be listed for their questionable practices.

Re:Weird

[reason78]

Its not about MAPS right to put Yesmail on a list... MAPS, aparently, is slandering Yesmail. Slander is illegal.

"so they also have to be willing to be listed for their questionable practices
So I could put you on a list of sex offenders if it wasnt true, and you would have to accept it?
No, you would probably sue me for slander.

Re:Weird

[Jeffrey Baker]

It isn't slander. MAPS provides the rationale for each entry on the RBL. There are five specific acts that will get you on the RBL. They are listed on this web page. All the RBL says is that the people on the list are doing one of these five things. Judgement is then passed by the subscribing ISPs, who choose not to deal with ISPs who are on the list. It's simple, and it isn't slander.

Re:Weird

[Silver A]

Company A is suing group B to prevent group B from adding company A to a list. Once you distill it that far, it is an obvious restraint on free speech.

You're right. But the courts may not see it that way. The First Amendment doesn't apply terribly much these days. The Supreme Court has explicitly ruled that "commercial speech" is afforded a lesser protection than political speech. Even political speech is under attack these days, and the courts are only slowing down "campaign finance reform", not stopping it.

In this particular case, YesMail can claim that MAPS will be committing a fraud upon the public (potential and actual YesMail customers) which will damage YesMail, if MAPS puts YesMail on the RBL. The judge has to grant the TRO if there is any possibility that YesMail can prove MAPS' statements about YesMail to be false and therefore fraudulent. A permanent injunction would require YesMail to actually prove that MAPS' statements are false.

IANAL, but I am smarter than most lawyers.

Re:Weird

[Jeffrey Baker]

Yeah, the TRO is terribly easy to get, let's hope that the MAPS people kill this in the next round. You're right about the Supreme Court, too, and although they are coming around to a slightly more strict constitutional interpretation, the rest of the federal judicial branch continues to erode freedom at a pretty frightening pace.

Your last line is great.

Re:Weird

[Farq Fenderson]

If MAPS simply issued the list as a list of servers that qualified against specific criteria, and made that criteria (and the methods used to gather it) there would be no case whatever for slander, since it's undeniable fact.

If people conclude that only spammers get onto the list, based on the criteria, that's their own perogative, and therefore has nothing to do with MAPS.

It's all semantics, but it can make a massive difference. Functionally, everything would be the same, but no one could legally tell MAPS to shut up, unless there was an entry on the list that did not fit the criteria.

My proof that laws are dumb.

---
script-fu: hash bang slash bin bash

Re:Weird

[TekPolitik]

The Supreme Court has explicitly ruled that "commercial speech" is afforded a lesser protection than political speech.

Are your denying that MAPS is in any sense political? In fact, it is in part an organised protest against practices that the community finds objectionable. Listing sites that use those practices so as to coordinate organised protests is in fact clearly political speech.

Re:Weird

[Super_Frosty]

Hmm.. actually, I think that if a lot of companies band together to shut off another, it is called "restraint of trade," which is actionable.

I have thought of suing these people myself for theft of service - that's what they're doing when they use my mailserver to attempt to relay mail.

Re:Weird

[c@pt4!n_m0rg@n]

"The MAPS is as if someone went into a business, shot the place up, then that business gets blamed for the shooting (instead of the shooter being blamed), and ends up with people physically blocking it's entrances. It's ludicrous. If MAPS were truly against SPAM, it would create mail server software that had no problems limiting relays for illegitimate people. As it is, MAPS relies on spammers to keep it alive and 'in business'." Sometimes I wish slashdotters would do some research or perhaps even think before they post. MAPS is a service -- it lists people who they feel have not been duly dilligent in policy or action in preventing mail abuse. Paul Vixie nonwidthstanding, MAPS does not write mail software. In fact, in my experience, every major and the majority of minor mail server packages now, by default, limit the potential of abuse in a number of ways (not just relaying). In fact, there's been quite a paradigm shift in recent years (remember when Solaris would install with wide open SMI? Wasn't that long ago..). There's certainly alot more to the UBE/UCE issue than simply open relays, and without going on a full discourse, let's examplify only a few of them here: spammers hijack servers, spammers hijack AOL accounts, ISP dialup accounts, spammers abuse "e-greetingcard" services, spammers use dubious opt-in processes. I will add that I believe YesMail to be a legitimate business (mainsleazer, perhaps, but nevertheless legit). I believe that MAPS' inclusion of them into the RBL may cause some collateral damage to that. It is imperative to point out that this is the design and function of MAPS -- to provide an effective deterrant against errant mailing practices and to companies that provide spammer support services. In fact, this lawsuit is neither fatuous nor frivolous as some slashdotters have asserted, but indeed welcomed by Paul Vixie et al. Why don't you go to www.mail-abuse.org and read for yourself what the actual charter, purpose and goals of MAPS are before you make an ass of yourself in public again, guy. -chris

Re:Weird

[dbombarc]

Jeffrey writes: Company A is suing group B to prevent group B from adding company A to a list. Once you distill it that far, it is an obvious restraint on free speech. then Silver A writes: The Supreme Court has explicitly ruled that "commercial speech" is afforded a lesser protection than political speech. The problem with turning this into a free speech debate is in that freedom of speech is supposed to be a right of actual people. The August/September 2000 Adbusters points out that corporate entities only gained access to constitutional protections once they became recognized as 'natural persons' under the Santa Clara County vs. Southern Pacific Railroad supreme court decision. This perverse mutation of buisnesses into people has given dangerous power to both companies like YesMail and MAPS. I am assuming that MAPS is a much less profit motivated group, and I respect their cause entirely, but they still are a buisness or sorts. Any buisness that has the same rights as people can use their power of free speech in combination with large sums of money to put up their words on billboards and tv ads while individuals must resign themselves to being voiceless in comparassion. I believe that MAPS should be supported. They defend people from the corporate word, aka the public word as weapon. It is not MAPS' freedom of speech that one needs to be concerned about. rather, we should be concerned with maintaining the right companies should have to defend individuals' freedom of speech. By undermining advertisment email, even ones that people have intentionaly subscribed to, MAPS is helping protect true freedom of speech, that of people.

Re:Weird

[tundra]

"Company A is suing group B to prevent group B from adding company A to a list. Once you distill it that far, it is an obvious restraint on free speech." The first amendment issue (freedom of speech) does not exist in this case. The amendment applies only to actions of governmental entities.

Re:Weird

[AntiNorm]

Ever notice how MAPS spelled backwards is SPAM? I wonder why... :P

Anyway, if the MAPS blocks out legit emails to prevent spam, then so be it. If an ISP does not care enough about the outside world to want to secure its email system from abuse by spammers, then it deserves what is coming. Specifically, since its customers will not be able to email anybody (unless they use Hotmail/Yahoo/etc.), they will likely notice the reduced quality of service and find themselves a new ISP. Eventually, the ISP will notice their bottom line dropping, and *maybe* they will smarten up then.


=================================

Re:Weird

[softsign]

Didn't AOL sue a bunch of spammers a couple months back for "theft"?

Anybody know what ever happened to that?

--

Re:Weird

[Detritus]

Its not about MAPS right to put Yesmail on a list... MAPS, aparently, is slandering Yesmail. Slander is illegal.

Even if you assume that MAPS is slandering Yesmail, slander is not a crime, it is a tort, or civil wrong.

Re:Weird

[rking]

Whether it was slander depends on whether the allegations they've made are true, which I don't have the first hand knowledge to comment on.

What he said, however, was that slander is illegal. He did not say it is a crime. Committing a tort is illegal i.e. contrary to the law. He was correct in his statement that slander is illegal.

Re:Weird

[rking]

Company A is suing group B to prevent group B from adding company A to a list. Once you distill it that far, it is an obvious restraint on free speech." The first amendment issue (freedom of speech) does not exist in this case. The amendment applies only to actions of governmental entities

The judiciary is one of the branches of government. They are forbidden from restricting free speech just like the other branches. Of course, it's their job to decide whether the action requested of them amounts to a restraint of free speech.

Re:Weird

[Stephen Samuel]

"Ever notice how MAPS spelled backwards is SPAM? I wonder why... :P"
Because SPAM spelled backwards is MAPS. :-|

I believe that MAPS' inclusion of them into the RBL may cause some collateral damage to that. It is imperative to point out that this is the design and function of MAPS -- to provide an effective deterrant against errant mailing practices and to companies that provide spammer support services

I would disagree. At the bottom of http://www.mailabuse.org/rbl/rationale. html, they say:

Our goals in doing this are to stop spam and educate relay operators.

(emphasis theirs).
The primary purpose of the RBL is to stop SPAM. If there were a more precise method of doing so with similar effectiveness and effort, I think that they would do so. Their site includes reference to the problem of throwing out the baby with the bathwater in their cautions to people considering using the list. Collateral damage is, I think, part of the reason why they they waited so long before adding, for example MSN to their list.

Collertal damage does provide some 'carrot and stick' incentive to spammer allies, but it is a double-edged sword. If the RBL were able to provide true 'smart bomb' accuracy, I expect that more people would be willing to use it. Remember: They originally generated it for themselves, and then made it available to others.

Re:Weird

[thogard]

Or...
Company X says Company Y is a spamer and Company Y sues Company X which isn't a real company anyway and has lots of friend that have permission to send route updates to the bigest badest routers on the net so... Compay Z starts routing Company Y's packets to hell and back because "its the most effective route at the time".

Re:Weird

[otmar]

All the RBL says is that the people on the list are doing one of these five things.

That's the key point. IMHO MAPS is on safe grounds as long as they can prove that anybody on the list does in fact do one of the written set of "bad things to do".

If they break this principle, they become IMHO liable, and what's more: they will loose the respect of the network/mailserver-administrators who would then ditch the RBL instantly.

Re:Weird

[tgeller]

Check out this John Marshall Law School project and The Suespammers Project for an (incomplete) list of spam cases.

--Tom, Suespammers.org founder

Re:Weird

[SpacePunk]

Seems the mob rallies around and waves it torches.

Re:Weird

[Cerilus]

Take a look at a recent Supreme Court ruling regarding California's open primary. It states that people have the right of association. That is to say, that groups, in this case political parties, have the right to exclude people from participating in that group's processes if they are not part of the group. Thus open primaries are not legal.

The court, quite clearly, said that the political party had the right of association based on the first amendment.

Another point I'd like to make is that MAPS is a voluntary system. People make the decision to communicate with a third party based on information provided by MAPS. Note that the recieving party refuses the communication, not MAPS. It's the decision of the parties in the attempted communication if to continue that communcation. You can't sue my wife for me hanging up on you, even if she told me what you did last summer. It was my decision, under advisement.

If I decide not to accept communication from someone, that is the right of association, and there's federal case law to support that.

Steve

I am not an lawyer yet; I am a law student.

Re:Weird

[rgokey]

When things get this bad let me know when the next ship leaves this earth. I have heard of silly law suits but this one is the sillies I have ever heard.

Re:Weird

[coolgeek]

If RBL is restraint on trade, then so is "Anonymous Caller Blocking", a service provided by the phone company that enables a phone user to block calls from anyone that has failed to send their number via caller ID.

Re:Weird

[WNight]

That sort of thing is true only if the victim company is specifically targetted. If the companies banded together to stop a certain action, which involved boycotting companies that did that thing, then it would not be actionable. Similarly, if a new product makes an old company's business obsolete, the new products developers aren't at fault.

Buggy whip manufacturers can't sue car companies for restraint of trade.

Similarly, my 'ethical' company can refuse to deal with Microsoft, Shell Oil, etc. It can also publish information that would lead other companies to do the same thing, as long as shell oil (etc) are only targetted because of their actions, and theoretically would be forgiven if they turned around.

This seems ironic...

[demaria]

This seems a bit ironic.

"If you received an offensive message that appears to be from "Nick" or from info@mail-abuse.org, it was a forged attempt to sully the good name of MAPS and its employees. We are investigating the incident; if you wish to provide further evidence or have any questions, please contact abuse@mail-abuse.org.
Thank you for your understanding and patience."

Re:This seems ironic...

[Vassily Overveight]

It's clear that MAPS is engaged in a take-no-prisoners battle with some of its opponents. For instance, here they say, "However, not only has Big Star management adamantly refused to do so, Michael Kofman, Big Star's Director of Marketing and Business Development, stated that he would forge subscriptions to lists operated by his competitors in the name of MAPS staff if Big Star was not removed from the RBL." What's really surprising is someone being dumb enough to announce this upfront. Put this in the "what were they thinking?" category.

All the more Power to them

[NatePWIII]

Hooray for MAPS, maybe if MAPS can win a few more high profile cases and get more media attention it might start making spammers have second thoughts about their clandestine efforts.

I don't think they are abusing their power. I applaud their efforts. Way to go MAPS.


Nathaniel P. Wilkerson
NPS Internet Solutions, LLC
www.npsis.com

MAPS RBL

[jCaT]

I got stuck on this list for having an open relay. At first I was extremely pissed that this rogue group was preventing me from sending mail! Once I found the hole and fixed it, I called the phone number on their site and it was fixed within 15 minutes. The ONLY way you get on this list is if you are "nominated" by someone since they recieved spam that passed through your servers. Sure, it can be a hassle- but there's _no_ reason anyone should have an open relay. As a cursory check, I scan the headers of all the spam I get, and check it against the RBL. Invariably the servers are on the list already- sometimes they've been there for months!

I can see how some people might go as far as to take them to court for it, but that takes a lot longer than 15 minutes!

Re:MAPS RBL

[joeboo]

I am all for the RBL. my mail servers stopped 60 spams yesterday and 30 already today. Who knows how many got through, but that is 60 spams that I didn't get :)

Re:MAPS RBL

[NP]

I *really* don't think that you got stuck on RBL list. They are far more conservative then that. An open relay is not reason alone to get on their list.
<p>
You probably got on the <a href="http://www.orbs.org/">ORBS</a> list, Open Relay Behavior modifaction System.
<p>
Some people think that ORBS is a bunch of assholes, other think that they are doing the only right thing.
<p>

Re:MAPS RBL

[tgeller]

I got stuck on this list for having an open relay

I doubt that. You're probably confusing the MAPS RBL with ORBS. The MAPS RBL usually doesn't list open relays, unless the owner takes the attitude of, "We leave the relay open so people can spam thhrough it." They go to great lengths to contact spam-producing domains before listing, and makes an honest effort to get them to change their ways. It's REALLY HARD to get someone listed on the MAPS RBL: Merely reporting an open relay ain't enough. They require extensive documentation.

ORBS, on the other hand, actively probes networks and lists them without notification if they have an open relay.

--Tom

Re:MAPS RBL

[__aaevmb228]

It's REALLY HARD to get someone listed on the MAPS RBL: Merely reporting an open relay ain't enough. They require extensive documentation.

In my experience, it really isn't that hard to get listed on MAPS. My previous employer decided to harvest Usenet one time to gather addresses of people that might be interested in our service. A couple of months later, MAPS listed us after one person spent some time harassing us to remove his and other's addresses (which we did, promptly, when asked).

When he finally submitted his "evidence," MAPS listed us right away, without even so much as asking us if his take on things was accurate (which it was not in certain key areas). We were notified, but not until after the listing was made. The damage was already done.

In their defense, MAPS did remove us from the list very quickly, once we promised to switch to a confirmed opt-in system for our mailing list, which we did a week or so later. But getting us on the list wasn't very difficult.

For the record, I like MAPS. I don't find it to work particularly well, but I think the idea is good. I still get about the same amount of spam per day as I did before I subscribed, and I rarely see reject messages in my logs based on a MAPS hit. Most of the spam I get is caught by procmail rules that I've crafted over the last couple of years or is rejected by sendmail due to a non-existent sending domain.

Free speech violation, that's what it is.

[Victor Danilchenko]

MAPS is a private entity, and usage of their services is entirely optional. Yes, they wield a lot of influence -- so what? Suing them to prevent inclusion into the RBL database is like suing an influential magazine to prevent them from giving your product a bad review, simply because such bad review may disrupt your business. While we are at it, why not sue a competitor for trying to disrupt your business?.. Fucking corporate maggots...

I hope Yesmail gets slapped with a huge 'frivolous lawsuit' charge, the assholes.

--

Re:Free speech violation, that's what it is.

[znu]

If an online 'White Power' organization were to be established, that posted lists of Websites they objected to, for itemized specific reasons, would that be considered legitimate?

Yes! Freedom of speech does not mean "freedom of speech for people I agree with" or even "freedom of speech for people the majority doesn't find objectionable." As soon as you start letting the government decide who gets to say what, you don't have freedom of speech.

The only exception is damaging speech (e.g. slander, yelling "Fire!" in crowded theaters), and even that usually must be false to be illegal.

--

Re:Free speech violation, that's what it is.

[Darchmare]

---
If an online 'White Power' organization were to be established, that posted lists of Websites they objected to, for itemized specific reasons, would that be considered legitimate?
---

Sure. I may not agree with it, but if they want to rally the rest of their white trash bretheren, then they should be allowed to do so. Free speech is funny that way...

- Jeff A. Campbell
- VelociNews (http://www.velocinews.com)

Re:Free speech violation, that's what it is.

[Stephen Samuel]

If an online 'White Power' organization were to be established, that posted lists of Websites they objected to, for itemized specific reasons, would that be considered legitimate?

If they posted my address so that people knew to avoid me, that's completely legitimate. If they posted my address and told people to burn down my house and lynch me, that would be a different case -- arson and murder are illegal. They would be advocating and aiding the commission of felonies. Similarly, If they put me on a list of people who agreed with, and supported the white-power movement, that would be slander.

Rejecting your email is legal. Giving me a list of people that you're rejecting because I might want to reject their email for the same purposes would also be legal.

These people are not suing RBL because it is improper for them to be on the list. They are suing RBL because they disagree with the criteria for being added to the list. Vixie & Co. don't say "these people are spammers". They say "These people do one or more of these N things that we really disagree with -- mostly because they cause us problems.
============
As to the question of legislative vs technical solutions:
Theft is illegal. There's already legislation against it. A couple of weeks ago I left my window open. Some bastard snuck in through the open window and stole my laptop. Locks are a technical solution to a problem that already has a legislated solution.

Even if CAUCE is successful in getting effective legislation against SPAM, prosecutions and lawsuits are expensive and slow (often taking years). If only for that reason, RBL will remain as at least a stopgap solution.

Re:Free speech violation, that's what it is.

[Xemu]

If an online 'White Power' organization were to be established, that posted lists of Websites they objected to, for itemized specific reasons, would that be considered legitimate?

Sure! In fact, the Scientology UFO-cult has done exactly that. They provide a list of sites their members are not supposed to read for religious reasons. If you're curious, the ban list is here.

What most people don't know about MAPS-RBL is

[bob1000]

that they block sites that run mailing lists that simply don't require a conformation for a mailing list subscription. These people are not spammers going through newsgroups and websites farming e-mails. They are running sites with just a simple "add my e-mail to your mailing list" and even promptly remove people that ask to be removed. The RBL team calls this "spam" because the address isn't explicitly confirmed.

I used to run RBL on a number of my mail servers until I realized who they were blocking.

Re:What most people don't know about MAPS-RBL is

[nmx]

And the problem with this is...?

I dunno about you, but I wouldn't be happy if someone decided to put my email address down for "FREE XXX PIX TEN TIMES DAILY TO YOUR INBOX!!!!" and my box started getting flooded with the stuff. Granted that's an extreme case but any mailing list that doesn't require its users to confirm subscription is sketchy in my opinion - it wastes bandwith and could be potentiallly embarrassing to an unwitting receiver.

Re:What most people don't know about MAPS-RBL is

[LoonXTall]

I would be much happier clicking on "NO" in a confirmation email than on the first spam. I would be even happier if Hotmail wouldn't watch where I went from my Inbox, though... it'd cut down on quite a bit of copy-Ctrl+N-pasting.

--
LoonXTall

Re:What most people don't know about MAPS-RBL is

[maswan]

They do? *checking* Yes!

This is wonderful! With some luck this will in time reduce the ammount of stupid mailinglists I get subscribed to without asking.

I do have a nice domain with easily guessed email adresses, but that shouldn't force me to get lots of spam.

The problem with remove-thingies is that it usually just tags the email as an active and you'll recieve lots of more spam. There is usually no way of telling a decent company making a mistake from a real spammer. So I'm all for blackholing them.

/Mattias Wadenstein

Re:What most people don't know about MAPS-RBL is

[seebs]

Yeah, people like RealNetworks, who proudly *BRAGGED* about having, get this,

FIFTY THREE FUCKING MILLION ADDRESSES ON THEIR LIST.

You can't get on the RBL just for running an unconfirmed list. *YOU HAVE TO GET COMPLAINTS FROM PEOPLE WHO DID NOT ASK TO BE ON IT*.

Re:What most people don't know about MAPS-RBL is

[Anonymous Coward]

I used to run RBL on a number of my mail servers until I realized who they were blocking.

So don't use rbl.

Jesus Mercy, what is the problem here? If I run a mailing list of people I don't like because they live at addresses that are prime numbers and other people choose to use that to block email from them, what $#@!@# business is that of yours??

Did God Almighty come down from high and give you ultimate power to ram email wherever you please or something?

Re:What most people don't know about MAPS-RBL is

[marvinglenn]

When people run listservs that don't require confirmation, they run a process that can be easily used to harass and DOS attack other people. Every heard of a listserv bomb? (i.e. subscribing your enemy to every listserv you can)

Re:What most people don't know about MAPS-RBL is

[Bradley R. Smith]

I think that's exactly what they should be doing. Mailing lists that require no confirmation are a resource for mail-bombers. Requiring confirmation when joining a list is an easy way to prevent abuse. It prevents people from being added to lists they never wanted and also prevents the people on the list from getting "GET ME OFF THIS LIST" posts.

Re:What most people don't know about MAPS-RBL is

[jareds]

I would be much happier clicking on "NO" in a confirmation email than on the first spam.

You shouldn't have to click NO. The whole point of confirmation e-mails is that you can't get on the list unless you specifically respond to the confirmation request.

Open Relays

[NatePWIII]

There is nothing at all wrong with an Open Relay in fact if we had less spammers there would probably be many more available for legitimate use. The problem is with the Spammers, I say go after them not the ISP's and others trying to provide relays for us to use.


Nathaniel P. Wilkerson
NPS Internet Solutions, LLC
www.npsis.com

Re:Open Relays

[Eggplant62]

Nathaniel P. Wilkerson mumbled some stuff about:

"There is nothing at all wrong with an Open Relay in fact if we had less spammers there would probably be many more available for legitimate use. The problem is with the Spammers, I say go after them not the ISP's and others trying to provide relays for us to use."

There's *everything* wrong with an open relay. Which came first, the spammer or the open relay with which the slimy bastard sent out 10,000 messages? Disable the ability of spammers to send 10,000 messages at a time, close open relays and I think the problem would cure itself. I can't see any reason why John Q Public would need to send 10,000 email messages at one time unless he were a snivelling piece of shit spammer. Limit one's traffic to five addresses at a time and no more than five messages per hour and the problem of spam would cure itself. There is no reason to provide an open relay at all. Either send mail directly to your addressee's mail exchanger or don't send it, it's rather simple.

Egg Plant

Re:Open Relays

[tzanger]

There is nothing at all wrong with an Open Relay in fact if we had less spammers there would probably be many more available for legitimate use.

What, praytell, is a legitimate use for an open relay? If you have internet access you have a server or two you should be sending your mail through. MTA software like qmail have "relay-after-pop check" methods which allow roaming users to send email from anywhere after a valid POP3 mail check.

I've spent a few minutes trying to find a single reason to have an open relay. I can't think of one. Your turn.

Re:Open Relays

[KjetilK]

I'm not a programmer, but there was a guy on one of the mailing lists I'm on who had a completely off-topic aggresive rants about what he called "backyard morons, destroying the most important carrier of communication because a bunch of spammers are abusing them". It was very little substance in his post, but what he said was that relays must remain open for emergeny communication. He said that 80% of the spam comes from blatantly misconfigured servers, so that instead of closing relays, one should not accept mail from misconfigured servers. Now, I have no clue, and it seems that the best current practice is to close relays. This guy usually does have a clue, it is just really difficult to tell what the clue is between the flames.

Re:Open Relays

[winnetou]

Which came first, the spammer or the open relay with which the slimy bastard sent out 10,000 messages?

Once upon a time almost every mail server on the Internet was an open relay (for a good reason, e-mail was quite unreliable; giving one's e-mail to a well connected server if one could not connect to the recipient's server was very helpful).

The first spams were (depending on your point of view) chain letters or Usenet spam. Open relays were first mentioned as a problem in March 1997, years later. See Keith Lynch's spam timeline.

Spammers only started to use open relays because other methods of delivering their junk were stopped by means of UDP's (Usenet Death Penalty) and the blocking of spamhausen.

Re:Open Relays

[www]

Well. Five messsages/hour!!! That would really suck. Think about a mailing list with thousands of users? what would they do. I think all spamers should just go to hell, but I guess that won't happen. AOL users need open relays from AOL since otherwise they wouldn't be able to reliably send mail. I agree that there shouldn't be any publicly acceptable open relays though, but we shouldn't limit message quantity. I think our protocols should allow more traceability to the originator.

Re:Open Relays

[ingvar]

Back when (as it were), having an open relay was considered a "community courtesy". And secondary-MXing reliable mailservers was something that was done at an emergency basis without asking and on a permanent basis by asking first.

This was common practise at least as late as 1993, but, then, commercial interest in the Internet increased and suddenly it was not a "community courtesy" but an invitation to be "relay raped".

Whether this is good, bad, inevitable or avoidable, I won't try to judge, but I know how it were and I sometimes long for days long lost.

legal basis

[Submarine]

Silly question, but what is the actual legal basis of this? The actual allegations? Slander? Libel?

Re:legal basis

[3Cats]

Probably none.. Experian, TRW and the other one ( can't recall ) do a similar thing.. collect good and bad credit references into a database, sell the database to companies who choose to use it, who then either grant or deny you credit based on the entry in your file. Not much you can do about it except make sure they keep ACCURATE data. The reporting of poor credit history isn't slander if you have records to prove it. If the judge has a brain stem, he'll toss it out..but that would require relying on a judge having a brain stem..

C.

Could we sue censorware makers, too?

[NMerriam]

I don't see how the heck this can progress -- what restriction does a private company have on using another private company as a filtering list manager for their own private business?

This would also imply that someone listed on a censorware package could sue for exactly the same thing, which is presumably restraint of trade (since they talk about the adverse economic impact?) or possibly defamation (for listing them as "spammers")?

Once more, we've got an interesting techno-legal battle that will have much greater effects than I think we immediately forsee.

But if these guys win against MAPS, I'd suggest a quick suit against censorware makers under the same principles...

I'm an investigator. I followed a trail there.
Q.Tell me what the trail was.

Re:Could we sue censorware makers, too?

[lpontiac]

You probably could, and for slander too.

A few posts have pointed out that MAPS best defense is that they haven't slandered at any point - they've simply pointed out that YesMail conforms to certain criteria, and people are able to use that information as they see fit (eg not allow mail from YesMail to reach their mailboxes).

On the other hand, CyberPatrol has claimed that student homepages and negative reviews of CyberPatrol are pornographic, militant and contain material relating to Satanism and/or cults. I'd say that counts as slander.

Why didn't they reply to the "remove" address?

[icqqm]

Surely, MAPS included a "remove" address at the bottom of its email so that the company could just reply to have its email address removed from the list. And it's not like they have reason to sue, it says it's legal right in the email right under where it says "this is not spam and complies with US spamming regulations"

Time to manually block yesmail

[Izaak]

Looks like I will be manually adding yesmail to my spammers blocking file. Hopefully a good precedent will be set by this case, and the RBL will not be gutted.

Thad

Re:Time to manually block yesmail

[at10u8]

Yup, me too. MAPS is too good a thing to see dismantled. Any legal system that attempts to thwart it is working on the side of evil and not good. In any case, yesmail is history for the domains that matter to me.

Re:Time to manually block yesmail

[mr]

Does anyone have a list of sites to add to the access list besides yesmail and thier ilk?

Re:Time to manually block yesmail

[ir]

You, sir, are a real rebel!

--
Irina Romanov

Re:Time to manually block yesmail

[griffjon]

make sure you write to yesmail and tell them that you are doing this and why. I'm going to do the same, put a filter that searches all headers and auto-trashes it.

email appends?

[Mr. Theorem]

Interesting semi-neutral language by directmag.com in describing an "e-mail append service." What sort of low-life thought of this? Its nearly the same things as randomly trying to guess passwords, except that they randomly try to guess email addresses (first_initial+last_name@host.com) and compile the ones that don't bounce back. Good thing MAPS shut them down. I hadn't heard of this sort of spammer trick but I'm not surprised by it.

When someone gets an email from an e-mail append "service," is there an easy way to generate a semi-bogus returned mail so that the appender thinks your address is invalid?

Re:email appends?

[mr]

Bah, you don't need a 'random' program.

Just kick a IRC kiddie off your box and get over 174,000 fake names added to the e-mail address CDROMS.

Re:email appends?

[HappyHead]

Yeah, there's a nice, easy fix to that though - if you've got virtual mail servers compiled into your sendmail, you can set any non-valid email address to fall into the bit-bucket without bouncing. Of course, that's a bit of a pain for people who make a lot of typos, since they'll never know that their email didn't go through, so I wouldn't recommend it unless you knew someone was trying to use that method to sniff accounts on your system. It may not prevent them from getting the real accounts, but finding them in the 2 or 3 megs of bad ones probably won't be worth their while, and they'll most likely throw out that batch. (Or they'll publish their list, and get sued for fraud by spammers when 99.9999999% of the addresses are fake... :)

I set it to send all of the bad addresses sent to my server to a single account for a few days, and I was amazed at the number of "Nospam(userid)@..." addresses that were getting sent stuff.

Argh. Bastards!

[Booker]

MAPS is just a list. A list that says "We feel that these mail servers may not be secure, and that they may be used to send unsolicited email."

The administrator of a system may choose to use MAPS to block servers in that list, knowing the strengths and weaknesses of the MAPS system.

Those admins are exercising control over their machines - and this is worthy of a restraining order?

---

Re:Argh. Bastards!

[Vassily Overveight]

Temporary (emphasis on the temporary) restraining orders are relatively easy to get, since judges will tend to err toward preventing damage while the issue is sorted out. Getting the permanent one, where MAPS will have its attorneys fighting against it will be the real trick.

People should becarefull

[jjr]

As they said it is a opt-in email list so if perople don't read that they are going to one they should get spammed. People need to becarefull on what they do this the same problem they have with junk mail(The one the post office brings you) You sign your name on a paper for a contest but you also sign up for mailing list people need to be carefull what they it will come back and get them

Re:People should becarefull

[jonnythan]

This is offtopic, but it's something I want to say.

That t-shirt is pretty cool, but I've got to say something, in complete honesty.

In my 6 years of using all flavors of windws - 3.1, 95, 98, nt, 2k - I have never seen a screen like that.

I dual boot into debian on my main box, an athlon I built from scratch, and i do a little programming in C++, so I'm not a computer novice or anything. I have NEVER seen a BSOD on any of the computers I've had..from crappy Compaqs' filled with nasty proprietary hardware, a couple Thinkpads, and my current PIII --> Athlon box.

Do these things actually happen? /.'ers make it sound like their computers BSOD every 20 minutes when they're in windows. What's up?

Re:People should becarefull

[SEE]

Eh, I've had a few, mostly when using an old Cyrix 6x86 that was apparently overheating. The rest were when using either Netscape Navigator or Lotus SmartSuite...
Steven E. Ehrbar

Re:People should becarefull

[MostlyHarmless]

It happens. I've gotten bsods because of conflicts between programs, such as neoplanet and ie. If you have screwed up settings then it can happen a LOT; at a museum where I volunteer, they have one computer that will literally last no longer than 10 minutes max. without BSODing or otherwise crashing. Hardware problems and such can REALLY destabilize your machine because of priveliges given to device drivers that they shouldn't have (when was the last time Linux crashed because of a device driver?)

Re:People should becarefull

[Detritus]

I've been getting lots of blue screens lately, caused by a buggy USB CD-RW device driver. Usually they are uncommon and seem to be related to hardware problems. I've had a few that were caused by bugs in the networking software.

Re:People should becarefull

[odaiwai]

That's an NT BSOD. Happens with monotonous regularity on my Compaq at work, usually if I'm trying to use IE a lot.

You get a different one with Win9x, although the lethal one is a dialog saying 'An illegal error has occurred in IEXPLORE.EXE. Press Close or Retry to continue' after which your are, in technical language fucked. (Although in Australia, you are only fubbed, due to censorship.)

MAPS are only as powerful as their subscribers

[pdw]

MAPS are only as powerful as their subscribers make them. Any administrator signing up to MAPS RBL is saying, on behalf of all of their users, that they are happy to not recieve mail coming from any server listed on the RBL.

MAPS are not forcing this on anyone. People sign up to MAPS because we trust their judgement on what is and isn't mail abuse. If they start turning up too many false positives, people will unsubscribe from them as the number of complaints from users that can't recieve email from people they want to starts to exceed the number of complaints about spam. For example, many people avoid signing up to ORBS because they find their policy too cavalier. It's a self regulating system.

By signing up to the RBL, people are effectively saying "we don't want to recieve mail from you unless you comply with MAPS' policy. Deal with it."

Re:MAPS are only as powerful as their subscribers

[mr]

>many people avoid signing up to ORBS because they find their policy too cavalier

Yes, Orbs is a net.terrorist Go look on the NANOG list and see other sysadmins who agree.

When I got attacked by ORBS, they were unable to provide any reason for the attack, and slapped a 'carttonie threats' to my host. All because they are unable to provide proof to why they attacked my host with probes.

YesMail placed me 'on their opt-in' and I *KNOW* I didn't opt-in. To date, YesMail has provided no proof of my opt-in.

The restraining order

[Jim Tyre]

The article does not specify, but it is likely that the restraining order against MAPS was issued on an ex parte basis, with no appearance by an attorney for MAPS. It is not uncommon, and it is a reasonable inference from the fact that MAPS is in California, the order is from a court in Illinois, issued the same day the Complaint was filed.

The truer test of whether this case has any legs will come when MAPS has lawyers in court to defend it. Since it has an open invitation to be sued, one would presume that MAPS will defend itself.

Sue Happy

[NatePWIII]

It amazes me how companies bring these frivolous lawsuits to the courts over absurd issues. If Yesmail was really legitimate they would contact MAPS and would work out whatever issues or problems they might have. Whenever, companies are forced to bring things to a lawsuit you can usuall y expect that there is some foulplay. Obviously, Yesmail is the culprit here, not MAPS. If there business was legit, MAPS would recognize that and they would come to some sort of amiable agreement. Companies such as Yesmail are a blight and should be shut down in my opinion.


Nathaniel P. Wilkerson
NPS Internet Solutions, LLC
www.npsis.com

Re:Sue Happy

[friedo]

It amazes me how companies bring these frivolous lawsuits to the courts over absurd issues.

This lawsuit is neither frivolus nor absurd. Yesmail has a legitimate slander complaint. If a COURT OF LAW decides that Yesmail has not been slandered, then MAPS wins.

If Yesmail was really legitimate they would contact MAPS and would work out whatever issues or problems they might have.

If you had read the article, you would know the Yesmail and MAPS did negotiate, and were unable to agree on a resolution.

Whenever, companies are forced to bring things to a lawsuit you can usuall y expect that there is some foulplay.

This is the most rediculous statement yet. You're saying that whenever a company tries to protect its copyright, patent, reputation, or financial resources, it is necessarily involved in foul play? Let me clue you in on something: Corporations are not evil. Yesmail has a perfectly legitimate case.

Obviously, Yesmail is the culprit here, not MAPS. If there business was legit, MAPS would recognize that and they would come to some sort of amiable agreement.

See above.

Companies such as Yesmail are a blight and should be shut down in my opinion.

I wonder what we would happen if we shut down every corporation that was trying to stay in business...

Re:Sue Happy

[Eil]

Corporations are not evil.

Yes they are. MAPS is 100% voluntary by the ISPs that use it, and Yesmail is going after MAPS rather than the ISPs because it's an easier target than thousands of ISPs.

The lights are on, but nobody's really home. I'd like to see for once an internet company that really "gets" the true nature of the internet. It's built (practically) on openness and freedom and corporations think they can sue certain internet entities as easily as a newstand magazine.

The only sad thing is, these corporations have the courts in their pocket and therefore *are* shaping the internet to their profiteering needs.

Re:Sue Happy

[gaudior]

Corporations are not evil.
(please continue to repeat this until you understand it.)

Some corporations may be evil, or do evil things.

There is a difference.
--

Did MAPS want this confrontation?

[John Jorsett]

What's interesting is that MAPS has posted a roadmap on how to sue it, apparently wanting to get a court to establish the legitimacy and legality of its tactics. It wouldn't be surprising to find out that they consciously provoked YesMail to get their case before a judge.

Re:I would rather filter my email myself

[BornToCode]

MAPS RBL is totally optional. My IT department gives me the option of opting out of email filtering that checks the RBL. RBL is for those people who have had enough of spam and want filtering. If *you* don't want it ask you IT department about putting you on their opt out list.

Re:Go for it!

[ChadN]

Putting someone's name on a list of child molesters is NOT illegal (according to the First Amendment). If you do so, AND you know it to be false, AND it causes "damages" to be incurred to the wronged party, you may be sued in civil court to repay those "damages". The wrongdoer won't get a misdemeaner or felony offense on their record, or be put in jail, though. (IANAL).

The First Amendment is there to PROTECT the kind of speech that may cause "harm" to others (like saying a certain politician is corrupt, thus harming him if they are not re-elected. Such speech is not illegal (in theory), regardless of its effect). The issue of whether you are justified to "harm" someone, is separate.

Re:Go for it!

[Plasmic]

You said, "why not use intelligent filtering?". Umm.. in the future, please be more vague.

Like it or not, the RBL does a good job of stopping spam. The obvious problem is with how much other traffic it stops. So, "better" is pretty relative. It's a sliding bar -- do you want very very little spam to get through and also block lots of legitimate traffic or do you want some spam to get through and only block a little legitimate traffic, etc.

Anyhow, the discussion is not about whether the RBL is good or bad. I happen to think that it's got some rather fundamental flaws, but that's neither here nor there. The fact of the matter is that the RBL is, in every way, legal.

The Internet providers are the parties that are choosing what action to take based on what addresses are on the list. As long as you agree that the people that run the network own the network (they do), then it's obvious that those same folks have the right to say "no, I don't want my users to receive e-mail from these people."

Now, most of the reactions to this line of thinking are something like, "but the network admins shouldn't be able to control my e-mail, dammit!" -- this merely stems back to my original point: it's not about what you think is good or bad; it's about what is legal. These providers are well within their rights to make that choice. So, it follows that MAPS is doing nothing wrong, merely by publishing a list of potential offenders and letting people do what they will with it.

Dissecting the situation down to, "you are depriving your users of their freedom of choice!" is bordering in ignorance (or maybe just a severe case of over-simplification).

Like it or not, the RBL is legal.

Re:Go for it!

[pdw]

Bottom line: The RBL is evil because it limits my connectivity to the outside world - and it does so in a transparent manner in its typical configuration. I do not want my local net admin/nazi to control *MY* e-mail - maybe I WANT e-mail from cyberpromotions, maybe not. But it is MY choice, not YOURS. And that's where I draw the line on the "free speech" of this system.

This is your choice, so go pay for an account with an ISP that doesn't subscribe to the RBL. People pay good money for ISPs that *do* subscribe, because it saves them from wasting money downloading spam (yes, in some parts of the world people still pay for their time online). If people object to this form of censorship, they can go buy an RBL-free account. Most people are perfectly happy with MAPS' judgement on this.

Re:Go for it!

[nmx]

Your argument makes little sense. No one forces you to use the RBL. If you disagree with their policies don't use RBL on your system. If your ISP implements it on their server, call them up and tell them to opt you out.

If, as you implied, your provider does force you to use the RBL, I don't see what the big deal is anyway. Where is the evidence that MAPS is blocking sites they shouldn't be? If this happens how long does it take them to be unblocked? Show some examples of this and then I'll listen. Until then I don't see how the possible dangers of the RBL outweigh its benefits.

Re:I would rather filter my email myself

[Nathaniel]

"...and this RBL thingie kinda negates my wishes."

I think perhaps you don't know what you're talking about.

The RBL allows system administrators to reduce the complexity of their job, by using a trusted source of information regarding open relays.

This is entirely optional, and not all system administrators use it.

You are free to ask your ISP if they do, and to ask them to send you your email before applying the filter.

This has nothing to do with censorship. The people sending spam still have the opertunity to send you email without using an open relay, just like everyone else does.

The SECOND list.

[Anonymous Coward]

Even if I didn't use RBL, I suare as hell want to nuke anything coming from a place that use legal posturing to force themselves off the RBL rather than clean up thier act.

So MAPS needn't put these bozos on the RBL -- just publish & publicize WHY they are not. The effect may be even more effective. And it will surely be deserved.

DIE EVIL SPAMMERS! DIE! DIE! DIE!

I like their attitude at MAPS

[John Jorsett]

From here: "Finally, don't waste our time with threats. We get all kinds of threats. If you intend to sue us, then get on with it. If you don't, then don't waste our time or yours telling us how actionable our activities are."

Re:I like their attitude at MAPS

[kaphka]

The best part is the title of that page: "How to sue MAPS".

You'd think people would take the hint and not mess with them. But then, you'd think any lawsuit would get laughed out of court, and that apparently hasn't happened yet...

Re:I would rather filter my email myself

[sbeitzel]

Fine. Then don't subscribe to the MAPS RBL. If your upstream provider is doing so, then see if you can find another one who doesn't...and tell your current provider why you're leaving. It works for the Christian Coalition; if there are enough people who "think" like they do to do it, maybe you can find enough kindred souls to make a difference.

Personally, I think that the RBL is a good thing to have around. There are a lot of people who think that they can do whatever they want with electronic communications because it's their computer. Well, MAPS and the Usenet Death Penalty and subscribers all over the world, as well as individual users with their own filtering schemes are here to say that "your freedom to swing your fist stops at my nose". The spammers can do whatever they want...until their crap hits my network. Then I get to have some say about it. And that's a libertarian sentiment, too.

Re:I would rather filter my email myself

[LoonXTall]

But if your email addy is "completely free and availiable," wouldn't that promote spamming?

--
LoonXTall

Re:I would rather filter my email myself

[Darchmare]

---
I dunno. I'm just a stupid libertarian
---

No you're not. You're seriously suggesting that companies shouldn't be able to choose what they can and cannot do to stop their customers from receiving spam. That's not libertarian at all.

Like any industry, you will find some companies use the RBL, and others don't. It's no more censorship than a private corporation not allowing someone to shout obscenities within their building.

A libertarian (which is what I generally consider myself) would laud the RBL for providing a service - a list of confirmed offenders - to the public. The public can choose if they want to use the list or not. It's that simple. If you'd rather receive mail from known spam sources, then you can switch to a competing company.


- Jeff A. Campbell
- VelociNews (http://www.velocinews.com)

Not quite.

[HappyHead]

First, and foremost, anyone who actually winds up on the list is there because they chose to be there. They chose to 'run their mail server as an open relay', they chose to 'run their buisness through spamming', or even they chose to 'run a mailing list that dosen't require a conformation for subscription'. Thing is, they get a whole MONTH warning ahead of time, and free assistance in fixing the problem if there is one. If they then CHOOSE not to fix the problem, then they are on the list, plain and simple.

Second, they don't even go after people unless they have recieved complaints about them, and have investigated those complaints and found them to be valid. If they get an open relay reported to them, the first thing they do is verify it. If they get complaints of spamming, they check to see if there realy is a problem, and once again, they don't immediately drop them into the killfile, they discuss the matter with the person who has been accused, and try fix the problem if possible. And fixing the verification problem with a properly built mailing list program is easy if you're using something like MajorDomo, it's the default setting once you properly install it. The people who don't do things right are typically using spamware, or poorly configured systems, and they can get free help fixing it if they're willing to listen.

Unfortunately, there are some people out there who don't listen, don't care, or want to have something to fight about. After all, court fights make great publicity. I wonder how much yesmail.com's web trafic has gone up since they filed this lawsuit? Do you really think they're not profiting from the increased attention?

Re:Not quite.

[jareds]

Unfortunately there are also ISP's (like freeserve in the UK who assume that anybody running an MTA must be a spammer and have their entire IP address space in MAPS except for their servers. I don't think MAPS should allow this sort of overkill.

MAPS has three separate lists. One of these is a list of dial-up users' IP addresses. They are not on the same list as people who have actually been found sending spam. Not all ISPs block the dial-up list, but some do, as is their right.

Where's the /. reading lawyer?

[sbeitzel]

A few weeks ago I saw a comment from a lawyer who said, if I may paraphrase, "STFU, all you 'IANAL but..' idiots. I am a lawyer and here's the way it really works..."

Okay. I want to see the lawyers talking about this. I don't want bored sysadmins who read a few Nolo Press DIY law books; I want the guys who do this for a living. What do you think? What does this really mean? Is this just smoke-blowing, or should we all start funneling money into the MAPS legal defense fund?

Re:Where's the /. reading lawyer?

[Vassily Overveight]

Okay. I want to see the lawyers talking about this. I don't want bored sysadmins who read a few Nolo Press DIY law books; I want the guys who do this for a living.

"Thank you for contacting Web Legal Opinions. Please deposit $500 for your first hour ..."

Re:Where's the /. reading lawyer?

[rjh]

IANAL, but my father is a judge, my cousin is a DA, another is an ex-cop, another is... well, you get the idea. My experience is practical, not professional, and I am not suggesting that this is in any way a substitute for real legal advice. That being said:

1. YOU CAN BE SUED FOR ANYTHING.

There are laws on the books which are meant to cut down or eliminate frivolous lawsuits, but judges rarely reprimand attorneys for wasting the court's time.

2. LAW REALLY DOESN'T MEAN ALL THAT MUCH.

As soon as the jury is seated, it's an entirely different ballgame. Juries occasionally follow the law with diligence and probity, and occasionally they completely buck the judge's counsel and do whateverthehelltheydamnwellplease.

In this instance, a jury wasn't seated--the reason why I bring it up is because many legal proceedings do involve juries, and most /.ers seem unaware of just how mercurial juries can be.

3. TEMPORARY INJUNCTIONS ARE JUST THAT.

Temporary, and injunctions. Judges are prickly people, as a rule. Most of them are control freaks of such a high order as to dwarf absolutely any other profession out there--including doctors. There are two things which judges universally fear, though: one is being overturned on appeal, and the other is being humiliated.

If someone comes before a judge and says "Your Honor, this bad person over here is doing something which will cause substantial and irreparable harm unless you do something to help me right now", the judge has three choices:

* He can schedule a full hearing, and tell the aggrieved party "well, let's wait two or three months and just handle a full, permanent injunction hearing"

* He can execute summary judgment and declare that no such irreparable harm exists, and refuse to do anything

* He can issue a temporary injunction, and schedule a permanent injunction hearing for later.

... Remember: judges hate to be overturned on appeal and they hate to be humiliated. If the judge chooses the first or second option, that leaves him (a) free to be overturned, and (b) if the judge is wrong and irreparable harm does occur because the judge didn't issue an injunction, the judge will be publically humiliated.

Judges, therefore, overwhelmingly tend to be very lenient with temporary injunctions. Many of them claim that this leniency is in everyone's best interests, and it may well be--but I'm a cynic, and this colors my analysis. :)

4. TEMPORARY INJUNCTIONS ALWAYS EXPIRE.

This one is simple. Temporary injunctions always expire, and permanent injunctions last for as long as the Court (not the parties involved--at least, not necessarily) wants them to. In order to move from a temporary injunction to a permanent injunction, well--let's skip the procedural details, because it's likely not interesting to /. readers. Instead, just remember what I said about judges; they hate being overturned, and they hate being humiliated.

This gives them extremely strong motivation to consider permanent injunctions very carefully. If they misstep on procedural or logical grounds, it's cause for overturn on appeal; and if they make the wrong decision and someone loses their shirt as a result, then the judge gets humiliated.

So judges tend to view permanent injunctions with a much more careful, and skeptical, eye than they do with temporary injunctions.

... But, as I said, I'm not a lawyer and I don't know beans about the legal system. You'd be a fool to think that this is anywhere near competent legal advice. :)

Re:What you don't say is...

[theNAM666]

>that they block sites that run mailing lists that simply don't require a conformation for a mailing list subscription. These people are not spammers ...

You neglect to mention that they don't do this without a complaint involving involuntary subscriptions.

Many universities run very, very large non-confirmed listserv ops. I don't see several on the RBL... presumably because they're not causing a problem.

If you're dumb enough to operate an unsecured maillist program in public view, you're creating a hazard that should be on the RBL.

Re:Go for it!

[seebs]

You're right, it *is* your choice whether or not you want mail from cyberpromotions, or yesmail, or RealNetworks.

You exercise that choice by deciding whether or not to use the RBL.

You see, the RBL will *not* prevent you from getting mail, unless *YOU* decide to use it.

It's that simple.

Intelligent filtering doesn't solve the problem. The problem is not people *getting* junk mail, it's people *sending* it. This is a network abuse problem.

The internet is a cooperative network; if you don't cooperate, we don't network with you.

Re: Bah!

[HappyHead]

Yeah, right. That's the spirit. "Mine! Mine! Mine!". This is exactly how the internet was built in the first place...

Well, yeah, actually, it was a U.S. Military project to protect their network data from loss, and improve communications - if anything qualifies as a "Mine! Mine! Mine!" organization, that would be it. It wasn't until all the philosophically inclined (read: hippie ;) University researchers and students got their hands on it that it became a "Sharing is good!" thing...

The RBL is a scam.,..

[aiken_d]

Everyone hates spam. I hate spam.

But the RBL has gone so far from its charter that I don't support it these days. Today, the RBL is more a tool of vengeance than a way to protect networks from spam.

Did you know that the RBL not only blocks networks that send spam, but also networks that they believe do business with spammers? Many of the entries on the RBL have never, ever been accused of spamming people or allowing spam through their networks, knowingly or unknowingly. But as far as the RBL gods are concerned, they faciilitate spam, or they don't do enough themselves to fight spam. And that gets them on the RBL.

There's also the blocking of email lists which don't comply with the RBL's opinion of how to run an opt-in list. And now this new case.

So I'm happy to see them in court. There is a free speech issue here, but there is also the issue of gross misrepresentation, as the RBL no longer even follows its own charter. The way I see it, the RBL is committing fraud by promising a service that is completely different from what they actually do.

-b

Re:The RBL is a scam.,..

[YoJ]

What examples are you thinking of? I would be very interested to hear of companies on the RBL that have never had spam complaints filed against them, and do not allow spam through their network.

Re:The RBL is a scam.,..

[seebs]

I can't find a single documented case of the RBL blocking someone for more than a day or so without a clear understanding that that entity was willfully supporting spammers.

Consider ibill, who did credit card processing for spammer scams. As long as ibill kept giving the people new credit card service, they could get free web sites, spam them, and collect money. Forever.

As to "the RBL's opinion of how to run an opt-in list", that "opinion" seems to be based on the fundemental truth that, if people are complaining about being added to a list, they must not have opted in. It really is that simple.

The RBL follows its charter excellently. If you'd like to name counterexamples, get specific; name companies, times, dates, and show your evidence that the entity in question did *not* contribute to a significant flow of spam.

Re:The RBL is a scam.,..

[aiken_d]

DISCLOSURE: Like about 50,000 legitimate, non-spamming businesses, one of the projects I work on uses Ibill. Some of my attitude towards the RBL comes from discussions I had with them after the RBL of Ibill cost my company about $6000 in a few days, and the RBL people had the gall to tell me that I should blame Ibill, as it was "their fault." This is analagous the kidnapper blaming the authorities when he shoots a hostage.

The change in the RBL over the past few years has been from actively fighting spam to fighting things that, in your words "contribute to a significant flow of spam." The problem, obviously, is that it's easy to point to almost anything and claim that it somehow contributes to spam, and to use that as a justification for pretty much any aggressive action.

Ibill is an excellent example. Yes, they allowed spammers to profit, and have typically been far too slow cancelling spammers' accounts. And yes, they seem to have some really, really nasty people working there. That Ed Cherry guy is particularly unpleasant.

But I dare say that the current, ongoing battle between Ibill and the RBL has a lot more to do with personal animosity and childish behavior on both sides than it does with stopping spam. And that, my friend, is very counter to the RBL charter.

If the RBL's criteria is "organizations which spammers use," why not go after federal express, and the banks where spammers' accounts are kept? How about ebay? Oops, they're a huge AboveNet client. Can't RBL them.

What about RBLing state legislatures that aren't moving fast enough enacting anti-spam laws? How about the US congress? They could surely do more to fight spam, and they are choosing not to. I say we get 'em! Do you see how ridiculous this is getting?

This "go after spam precursers" attitude is new to RBL in the past few years, and I for one don't like it. It's vigilanteism, and while it's satisfying in the short run, it sets a bad precedent and demonstrates a complete disregard for the rule of law.

(The usual counter-argument here is that spammers disregard the law, and therefore this kind of action is necessary. To which I say: emulating spammers to stop spam shows moral and ethical bankruptcy).

Blocking spam, yes. If the RBL simply blocked networks that were originating spam, I would put it back on the equipment I manage.

But going after third parties who do business with spammers is going too far. And getting into personal battles and acting unprofessionally is certainly right out.

-b

Re:The RBL is a scam.,..

[The Raven]

I was considering adding the RBL to the mail server I administer. Unfortunately, while I like the stated policies of RBL (including that of explicit opt-in lists), I agree that the above choices by the RBL are not conscionable.

Thank you.


And my soul from out that shadow that lies floating on the floor

Re:The RBL is a scam.,..

[KjetilK]

Can't agree with you there. That is, I can to some extent agree with you that it is not effective in day-to-day spam prevention because they are too restrictive. I worked full day on a nomination for two Austrian ISPs that let a religious moron spam me for half a year (the siad the world would end May 5th), but it was not considered for inclusion. Hell, you have to have a really good case to get anything into the RBL!

But, I don't think I can blame them. If fewer big ISPs used the RBL, it wouldn't be as powerful for it's primary purpose, namely pushing the ISPs to get a clue, and that is how spam can ultimately be stopped.

I have never had any spam from yesmail, nor have I found the word yesmail in my megs of spam. This means, however, that they'll be added to my filters, and they are probably not going to be removed any time soon. This is ultimate stupidity from yesmail's side. They will inevitably be added to a lot of private filters, and while MPAS would remove them from the list within 15 minutes if they clean up their act, they will have a really hard time getting removed from all the private filters....

Re:The RBL is a scam.,..

[alecto]

I don't see how that's a problem. If they blackhole networks like Telstra, that happily host web sites advertised by spam (so long as you don't abuse their servers to send it), more power to MAPS for such a policy.

If an ISP isn't against spam, it's for it, and should pay the price.

Re:The RBL is a scam.,..

[seebs]

The fact is, the amount of porn spam I got dropped dramatically when IBill was forced to change their policy.

MAPS isn't about *blocking* spam. It's about *EDUCATION*.

Once, everyone thought it was excessive to add the hosting company for a web site to the RBL, unless the spam came from there. After all, they're not *sending* the spam, right?

Then we found out that, if you don't take down a spammer's page, the spammer will keep spamming. Forever. So, the page *has* to come down. So, now, if you host web pages for spammers, you can be listed.

Ibill was in the same situation. They chose to provide a service that was being abused. They chose to overlook the damage to *everyone else*, because it was a cash flow for them.

The RBL listing caused them to recognize the costs they were inflicting on everyone else.

There is no such thing as a "vigilante" in this context. We *are* the legitimate authorities, we sysadmins.

I am sorry that innocent people were affected by IBill's listing. However, if you want to blame someone, blame the people (Ed Cherry being the most obvious, of course) who decided that they *couldn't* be listed on the RBL, and who felt that millions of dollars a day of distributed damage to other networks wasn't *their* problem, even though they could stop it.

That's what it comes down to. If you can make someone stop spamming, and you don't, you're going to get listed.

Fair enough.

Re:The RBL is a scam.,..

[happystink]

You just learned a valuable lesson of business on the internet: Research who you are doing business with beforehand, and if they are spam-friendly in any way, do not do business with them. I don't say this like "it's a moral decision", I say it as "Their quality level WILL drop because of the fact they are spam-friendly".

It's a shame that you had problems with iBill if you really are legit, but it's your own fault. If your doctor had his license taken away because he killed someone would you get angry at the medical association because now you had to find a bad doctor?

Re:The RBL is a scam.,..

[tietokone-olmi]

Bzzt, wroong, but thank you for playing.

You're thinking about ORBS. ORBS sucks icebergs through a garden hose.

Re:The RBL is a scam.,..

[seebs]

Except that, if I use a confirmed opt-in, when you complain, I go to MAPS and show them the confirmation email from you, and they tell you you're mistaken.

Even if I run a plain opt-in list, *one* person complaining will get nothing done.

The most you can do is force me to start using confirmations - which I should probably do anyway.

It's much harder to get listed than you seem to think. You have to make it clear that:

1. You will do something which results in unsolicited email reaching people.
2. You will not correct this.

If you don't have both elements, you will *not* be listed.

Re:The RBL is a scam.,..

[mindstrm]

I have my own computer that sends it's own mail.
My own mail server.
My own piece of the net.
And I *chose* to accept that, if ibill is doing business with spammers, (which is against the spirit of the net, and totally rude), then I do not wish to have any relations with them.
Do I want to force this on anybody else? Certainly not. But it won't happen on my mail server.
Your rights end where mine begins. YOur legislation of the Internet begins where my equipment starts.

Re:The RBL is a scam.,..

[alleria]

But as many have pointed out, this is an opt-in service only. RBL doesn't force itself on you. So what's the trouble?

I'm allowed to be part of an extremest satanic cult that believes that Satan will come in Jan 14, 2004 to assist Mr. Gates in complete world domination if I want to, and there are no laws broken, as long as I join willfully.

Same idea here.

Re:The RBL is a scam.,..

[winnetou]

Like about 50,000 legitimate, non-spamming businesses, one of the projects I work on uses Ibill.

Would you mind telling us the name of that "legitimate, non-spamming business"? As far as my mailbox is concerned all clients of iBill are pr0n sites that claim their e-mail isn't spam.
You're like someone setting up a 5-star hotel in a slum and then complaining that the tourist office tells people that your hotel is located in a slum.

But going after third parties who do business with spammers is going too far.

I disagree, MAPS isn't going after them, MAPS just tells that they do business with spammers. That may (and does) mean that a lot of people don't want those businesses to use their equipment.

Re:The RBL is a scam.,..

[david duncan scott]

Do you mean to tell me that you work with an ISP who a) has no AUP in place (or at least none that mentions spam), and b) can't be bothered to work something out, if necessary giving the spammer a fixed IP so that the rest of their customers get some relief?

Run, do not walk, to the nearest exit and find a better provider.

Re:The RBL is a scam.,..

[aiken_d]

It's an old topic, and maybe dead, but I couldn't resist responding. You seem a decent, reasonable sort, but please read over your post again.

There is no such thing as a "vigilante" in this context. We *are* the legitimate authorities, we sysadmins.

Right. And that's just what vigilantes have always said: "Nobody else is handling the problem, it's up to us to take it into our hands." Sysadmins, however noble, are not a legal authority. If it were simply a question of an opt-in list, I'd have little complaint. But when you consider how the RBL misrepresents the "service" offered, it's an affront, and it clearly is another piece of the "ends justify the means" philosophy that the RBL has adopted.

That's what it comes down to. If you can make someone stop spamming, and you don't, you're going to get listed.

Well, at least you're honest enough to more or less call coercion by its proper name. But this comes back to my whole argument: in cases like ibill, the RBL is no longer about stopping spam, but instead about using innocent third parties as hostages in the battle against spam.

I got beat up badly by the RBL -- and when I complained, they basically said they would continue harming my business until I fought Ibill on their behalf. Again, it's an "ends justify means" attitude. I don't know about you, but I think that putting a gun to someone's head is not the best way to gain an ally.

And, finally, you haven't addressed the issue of where you draw the line. Doesn't it make sense to RBL the US congress? After all, they could make people stop spamming very effectively. And they haven't done an adequate job of it. And certainly Bank of America, where many spammers keep accounts. Fed Ex? McDonalds?

As someone else on this topic noted: guilt for spam is not, and should not be, transitive. And trying to make it so absolutely does not further the goals of the RBL. Pushing innocent third parties around is probably satisfying, and it definitely demostrates considerable power, but it demonstrates such hypocrisy that I don't know whether to be angry, or sad, or both.

Re:The RBL is a scam.,..

[seebs]

It's not just that no one else is handling the problem.

I own a system. Do you deny that I have the right to restrict traffic to it in *ANY* way I want to?

Do you deny that I have the right to discuss the strategies I use with others?

If not, you can't argue with the legitimacy of something like the RBL.

You say IBill is innocent. Do you think that hosting companies are innocent, if they host the page the spam advertises? How about AOL? If a dialup user with an AOL account spams, is AOL an "innocent third party"?

You are not disagreeing about the fundemental premise here, which is that people enabling spam are part of the problem. You are disagreeing with whether or not one *particular* party - IBill - was enabling spam.

You did not get beaten up by the RBL. You got beaten up by me, and thousands of other sysadmins like me, who concluded that IBill was *not* a part of the cooperative network we call the "internet", because they were continuing to endorse and support spammers.

When IBill's policies changed, a lot of spammers stopped running their scams, because they could no longer make money sending spam.

As to the other examples you suggest, I recommend you consider whether or not they are part of the network. This is about the network.

Now, if you think *you* were an innocent third party, well, I have to agree. I also agree that the 15 million AOL users who *DON'T* spam are innocent third parties, and when people block AOL (and some do!), those users suffer. When Netcom was RBL'd, a friend of mine couldn't email me, until they fixed their problem.

That's how a large distributed network runs. It's regrettable, but there are companies that will never change until they are told to from both sides.

Do I regret that you, personally, suffered? Sure. But, frankly, if it comes down to a choice between you and millions upon millions of other people, I'll pick them, because they outnumber you. The spammers IBill was supporting were causing a lot more damage per *HOUR* than you suffered during the entire affair.

"Perspective". It's a great idea.

Re:The RBL is a scam.,..

[aiken_d]

You're kind of cheating here by misrepresenting my argument, then arguing against the misrepresentation. It makes it easier, yes, but it doesn'r make for the most constructive conversation.

1) Of course you, as a personal sysadmin, have the right to block traffic wherever you want. However, if you are a common carrier (as ISPs clamor to be considered whenever content liability comes up), you absolutely do not have that right.

What would you think if your phone company decided that you shouldn't be able to call certain numbers? If the post office declared that it would not deliver mail to (or from) your neighborhood, because of someone else's abuse?

Once you resell access, you lose some of those rights (in return for protection from liability).

2) I never, ever said Ibill was an innocent third party. I specifically said they shared guilt. However, the RBL action primarily affected people *who do business with Ibill*. Now those people, I think you'll have to agree, are pretty innocent (see postscript). And my complaint is not just that these people (myself included) were affected... what really infuriated me was that RBL denied any responsibility! They flat old told me that my losses were not their fault, and that their nomination process somehow absolved them of any responsibility for colateral damage (if that makes sense to you, please explain).

3) Of course the people enabling spam are part of the problem. You know what? Sendmail is part of the problem. Network Solutions is part of the problem. Heck, electric companies are part of the problem. What I take issue with is the RBL's change of focus as to what part of the problem it addresses.

Perspective is indeed a great idea. And your arguments here are typical of the "my cause can do no wrong, and trumps anybody else's rights and concerns" attitude that zealots are known for.

Your willingness to trade my financial well-being for "millions upon millions of other people"'s freedom from spam is very pragmatic, but I maintain that you do not have the right to make that trade. Yes, you have good intentions. But sometimes ethics goes beyond good intentions.

Like I said originally -- I hate spam. I would absolutely support an RBL that blocked spam effectively. But a group that pulls the classic "we had to kill you to save you" shtick doesn't deserve respect or support.

-b

ps: A common thing to hear is "well, it's your fault for doing business with Ibill." If someone will provide me with the name of an alternative processor who has a good track record (2+ years in business), is financially stable (no late payments, ever, no retroactive chargebacks), and has stronger anti-spam policies, I'll gladly switch. Hint: None of Ibill's three main competitors meet those criteria.

Re:The RBL is a scam.,..

[seebs]

I don't claim to be a common carrier, and I don't think ISP's should pretend to be CC's.

If my telco decided I couldn't call certain numbers, I'd look for another telco, unless I agreed with their judgement. On the other hand, if my telco stopped accepting connections from, say, a specific telco from which most of the telemarketing and junk faxes I get originate, I'd be overjoyed. :)

I have to say, I agree with the RBL's position. How did IBill's listing affect you? It affected you because other sysadmins chose to do something based on it.

You are right, *I* don't have the right to decide whether your rights, or the rights of millions of spam victims, take precedence, except on my network. But I *do* have the right to refuse to do traffic with the people who support spammers, and I will continue to do so.

The RBL is not about blocking spam. It is about education. It works. Nothing else does. IBill has stopped supporting spammers.

I'd much rather see this solved in better ways. Believe me, if you can find a way to stop spammers that *doesn't* involve collateral damage, the MAPS team will leap to put your suggestions into action.

In the mean time, we, the sysadmins that run this network, have made the best decisions we can, based on the information available to us.

Finally, when you talk about your criteria, realize that, as long as you place "in business more than two years" above "good anti-spam policies", you *are* supporting a company which supports spammers. This may be necessary to your goals, but you *are* endorsing them.

When MCI spammed me, I switched long distance services within a day. When FirstUSA spammed me, I cancelled two credit cards, within a day. Yes, it sucked having a sudden drop in available credit. It wasn't totally convenient paying those bills off that very same day. But, the spam issue is important to me.

If a good anti-spam policy is not a crucial quality of a payment processing service for you, you may find that you run afoul of the RBL. You may also find that you will run into other, site-local, blacklists. Some sites may just drop IP traffic from IBill, even now.

The world is not obliged to offer you an ideal solution, or an ideal choice. You pick trade-offs. You picked the trade-off of "slightly sleazy company unwilling to act as a responsible citizen of the network". You got burned, briefly, when that turned out to be a serious liability. Other people maybe dealt with companies that occasionally pay them late, and they got burned too.

This isn't "fair". Life isn't fair. Physics isn't fair. This is the best available way to protect a large network from damage. Better suggestions would be welcome, I assure you.

(BTW, I don't work for the MAPS team, although I respect them a lot, and use their services. My sole work "for" them has been RBL nominations, and a little early advice to radparker about setting up RSS.)

This is starting to drift, if you want to debate this more, feel free to drop me email.

Re:The RBL is a scam.,..

[Felinoid]

>ps: A common thing to hear is "well, it's your fault for doing business with Ibill." If someone will provide me with the name of an alternative processor who has a good track record (2+ years in business), is financially stable (no late payments, ever, no retroactive chargebacks), and has stronger anti-spam policies, I'll gladly switch. Hint: None of Ibill's three main competitors meet those criteria.

In my experence a strong antiSpam policy dosn't prevent you from getting on the RBL...
So...
Is there any way to be sure a busness won't make it on the RBL?
As far as I can tell no one is immune...

Maybe this can work both ways

[AnalogDiehard]

So Yesmail wants to "opt-out" of the RBL, huh?

I can't believe the irony :)

No law

[zaphod.nu]

This is exatcly why we should keep the law weenies locked up in a courtroom instead of letting them out into the real world.

I feel that the Internet should be a 'no-mans-land' regarding law, the Internet is already pretty self regulating. Just as an example, the MAPS RBL didn't pop up for nothing, there was a need and it filled it. I know this can start problems with crackers, script kiddies and the like, but this would also be self regulating. Do you really think that any ISP would let anyone that could possibly harm them use their backbone?

I hope everyone that reads this uses the MAPS RBL on all of their mail servers, I sure do!

.sig

Nothing wrong with open relays???

[Nicolas MONNET]

You've got to be kidding. If there was no spammer ... hell if there was no robbers there would be no need for locks either.

Damn it, this open relay problem has been documented and well-known for years, I've had a mail server completely stuck while I was on vacation (yeah that's usually when that kind of things happen ...) because some fucking spammer was able to send thousands of messages a minute thanks to an open relay, and happened to use a domain I administrate as a fake return address ...

And in that case the RBL (which I use) was of no help since all I got was all the bounces ...

Re:Nothing wrong with open relays???

[Ben Jackson]

I've had a mail server completely stuck while I was on vacation ... because some fucking spammer was able to send thousands of messages a minute thanks to an open relay, and happened to use a domain I administrate as a fake return address ...

And in that case the RBL (which I use) was of no help since all I got was all the bounces ...

Actually the RSS could have helped you in that case. If the open relay connected to a mailserver and it said 550 User unknown then the relay itself would be generating the bounce message and trying to send it to you. If you had been using the RSS to block such open relays, bounces like that would have been rejected.

Re:Nothing wrong with open relays???

[Nicolas MONNET]

Hm hm ... QMail would still generate those bounces as it does'nt check the user at the connection, but generates the bounce afterwards.

Re:Nothing wrong with open relays???

[Otter]

because some fucking spammer was able to send thousands of messages a minute thanks to an open relay,

A little off-topic but I've been wondering this: How do spammers find open relays? Do they scan IP blocks for them or is someone selling open relay lists? I've looked at sites advertising spam mailers but didn't see any information on this issue.

Re:Nothing wrong with open relays???

[Nicolas MONNET]

Yeah they scan and scan and scan. Not just spammers though: script kiddy do so as well. And Usenet spammer do as well. Just set up a bogus news server on port 119 and be amazed at the amount of crap that gets in after some point ...

Re:Go for it!

[rodgerd]

do not want my local net admin/nazi to control *MY* e-mail

Aww, poor little snookums. Here's a suggestion - run up rackspace.com, order a server, and configure it howyou please. Run your open relays, accept your spam, do whatever you damn well please (assuming you're actually capable of running a system). The only freedom you get on someone else's system is the freedom they decide to give you.

That's what will happen ...

[Nicolas MONNET]

I guess that a significant number of sysadmins using the RBL will add those fuckers to their blocking list manually ... and now good luck getting unblocked!

Re:I would rather filter my email myself

[Schnedt McWapt]

Why should there be an active opt-out required?

Why not phrase it the other way, so it isn't censorship?

Re:My spam comes from dialups, not websites

[Star*Dot]

This is why there is a sister to the RBL called the DUL which lists dialup accounts, the idea being that they should use their ISPs SMTP server to send mail which the spammers don't want to do...

Re:What is "Double opt in?"

[atw]

Not opt-in is when you simply get spammed.

Opt-in is when you or someone else can give your email addressed and you will be spammed from now on. Since someone else can "kindly" "opt you in" it can easily be equiv of not opt-in.

Double opt-in is like opt-in but it at first send confirmation email, and if you confirm that you really want this stuff, then you will receive it.

And while we're at it

[mosch]

Yes, and car dealerships should stop bothering with gates and locks on the cars. After all, the problem is with car thieves. If they would just let anybody drive off with a car, it'd make many more cars available for legitimate purposes, like test drives.

I say unlock the cars, leave the keys in the ignition, and go after the car thieves.
----------------------------

Re:What is "Double opt in?"

[Vassily Overveight]

You have to sign up for the list, and then reply to a confirming email to verify that you're you and that you want on the list. Otherwise, your 'sign up' can be a forgery by someone else.

Re:E-commerce

[Ungrounded Lightning]

What gives you (or anybody else for that matter) to decide what mail should or should not be allowed?

You misunderstand, or misrepresent, what is going on.

A lot of people don't want to receive unsolicited commercial eamil. And a lot of ISPs and business sites don't want their resources used to forward it, or their employees distracted from doing work while deleting it.

MAPS publishes a list of sources of unsolicited email. ISPs, businesses, and individual users may chose to use this list to filter out mail they don't want to bother to read or forward.

Use of the list is strictly voluntary.

Having your email forwarded, on the other hand, is not a right. It is a voluntary service of whomever forwards it. If a site does not wish to forward unsolicited commercial email - or any other email - originating from you, that's that site's prerogative.

Hmmm...

[HappyHead]

You know, it's funny, but I was thinking the same thing about Yesmail, but more in terms of doing it for the attention that the inevitable overblown media frenzy on such a trial would produce - they can even lose the lawsuit, and fix their mailing list the way the MAPS people wanted to afterwards, and the increased attention may profit them more than the costs of the lawyers. As long as they maintain a very vocal and loud set of protestations about how they did no wrong, and they're a decent, respectable web buisness (and our address is www.... - go see!) then they can get all of the free big-time media coverage that they want, and can use it for advertizing.

Re:Hmmm...

[John Jorsett]

Excellent point! If Yesmail can drag this thing out and make as much noise as humanly possible, they'll get a tremendous amount of free publicity (not all good, but remember the saying: "As long as they spell your name right ..."). And then if they finally capitulate to satisfy MAPS and get taken off the list, they can use the occasion to paint themselves as the now-conforming good guys whom advertisers should use. I wonder if they're really that Machiavellian?

I agree - spam demands legal solutions

[CaptainSuperBoy]

I agree with you. Spam demands legal, and not technical solutions. I support the RBL, but judging by the number of people who are firmly against it or who have been damaged by it, it's clear that the RBL is not the answer. While it greatly reduces spam sent to sites that subscribe to it, it can also be infuriating to be a customer of a company that is on the RBL and is unwilling to fix its open relays. I used to use an @iname.com email address and I couldn't send to many sites because the mail server was listed on the RBL.

In the RBL's defense, though, they won't add a site until they have made a VERY thorough effort to contact the people responsible for the open relay. This means that your server won't be added unless you are either unresponsive, or dumb.

The real solution, of course, should be strict spam laws. The penalty for spam shouldn't be on the end user, it should be against the spammer.

--

Re:I agree - spam demands legal solutions

[gilroy]

Blockquoth the poster:

While it greatly reduces spam sent to sites that subscribe to it, it can also be infuriating to be a customer of a company that is on the RBL and is unwilling to fix its open relays.

Um, that's the point, isn't it? If your provider is "unwilling" to fix the relays and would rather be blackholed, then you logically should move to another provider -- one who actually gives a darn about customer service. Eventually, if market theory or Darwin is right, the bad providers go out of business...

Re:I agree - spam demands legal solutions

[KjetilK]

Eventually, if market theory or Darwin is right, the bad providers go out of business...

Darwin is probably right, market theory is not. The market is stooopid. For the market to work, purchases must have been made on a well-reasoned, well-informed basis. They aren't. I take that as self-evident, really... :-)

Yesmail....OUTTA HERE!

[Ho-Lee-Cow!]

I never thought that blackholing someone manually could feel so good. Quite freeing, really. More if us should put the Slashdot Effect to good use and give Yesmail a really big headache. :)

Re:I would rather filter my email myself

[sbeitzel]

So sorry, but unfortunately I must inform you that it is, in fact, my network of which I speak. I didn't claim to control the office network. I control my network. I have DSL coming in to my apartment, and I have a network here.

Bzzt. You lose.

Slander?

[abuch]

Not too long ago, there was a discussion here on Slashdot about a person applying for a job, who almost lost it because of an erroneous credit report. I think most people agreed that a credit agency should be reliable for the information they put out, even though the employers/businesses who reject people based on the credit information CHOOSE to do so themselves. And I don't see why information about spammers should be any different. Now, if MAPS have proof that Yesmail is in the spam business, then why shouldn't they be able to tell others? On the other hand, if Yesmail is innocent, I suppose MAPS would be liable of slander?

Re:I would rather filter my email myself

[prolixity]

I belong to the libertarian party and hold certain views concerning my personal liberty. I believe that I should be in control of what information I receive, not a 'big brother' type organization. I was under the impression that RBL was an Opt-out type list, but I have been informed otherwise. In my opinion, a person should not be required to opt out of a service, but rather volunteer him/herself. There is no true definition of a libertarian by the way. The party seems to be a conglomeration of people with different viewpoints who all hold personal liberties (be it governing one's business or one's choice in phone companies) Don't tell me what my political affiliation is or isn't. Maybe we just see one situation differently. A libertarian isn't neccessarily a carbon copy of you. Josh

Double opt-in

[CaptainSuperBoy]

I love the euphemisms that spammers use to further their lies. What we call using confirmation emails, they call "double opt-in", as if there were any acceptable "single opt-in" solution. With their "single opt-in", though, they are free to use their dirty lists as they please because if you complain to them they can just say "oh, sorry, someone else must have signed you up!" or, "You dummy, you must have signed up at one of our 'affiliates' and asked to be put on their mailing list". If you had to confirm all the lists you were on, they know that their dirty practices for putting you on lists would never work.

--

my take on it

[congiman]

A: First off, maps represents 3 types of blocking lists.
1: The RBL, which contains IP addresses of spammers
2: The DUL, which contains IP addresses of machines that should not be able to send mail to your server directly. Ie: a user at earthlink should always send mail to their mail server and then it should be routed to you. If they have a system that connects straight to you, it most likely is spam,
3: the RSS (relay spam stopper) that contains a list of open relays. This is a nice trick of spammers to send mail through someone else's machine and have them do the job of mailing everything out.

B. Getting your address.
Now, my take on the philosophy of MAPS, is that you should only receive what you elect to receive. ie: getting mail-bombed from 100's-1000's of companies just because you once posted to usenet without masquerading your e-mail address just should not happen. (This is not an exaggeration).

So, if you sign up for a newsletter, you receive the newsletter. Also, you should have a clear way on how to be removed from the newsletter. etc.

You also should have a choice in that they should not sell the e-mail addresses on the newsletter.

C: Legality, from the receiver's point of view
As to the legality of maps?
Personally, I like it.
Its 100% opt in, and you choose for yourself what list(s) you want to subscribe to, and away you go.

If you go to an ISP, you can usually find out very quickly if they subscribe to MAPS, and which particular lists.

D: Legality from the sender's point of view.
The basic idea, is that if you do nothing wrong, you have nothing to worry about.

To actually be listed on the RBL is not a slam dunk. You will be contacted more than once and you will have ample opportunity to make changes.

Ok so some of the changes may be considered completely rude by some, lets give examples:
1: the ability to unsubscribe yourself
2: The ability to make sure that only you sign yourself up, and not someone with a bogus e-mail address
3: Not to add users by a "buy 50million users on cdrom for $20" import utility.
4: if you are an ISP, not willing to do anything about people complaining you have spammers.
Usually, you can get by #4 by having a strong AUP against spam, and kicking user accounts that send UBE

E: Legal arguments
1: Restraint of trade?
Not in my opinion.
I consider and trust MAPS to be a meta-introducer. I want them to let me know who I should talk (receive e-mail from) to and who not to.
Its my/my companies/my ISP's choice, as its their machine.

2: Malicious
Not hardly, You will receive every chance not to make the RBL list.
The DUL list is usually contributed by the ISP themselves
the RSS is contributed by vitcims. Usually the Sysadmin of the victim's machine will ask for help to get it fixed, and maps will help do that.
Harly what I would consider malicious, when they help upgrade a victim's sendmail.

F: how to use it,
if you know how to make your own sendmail.mc insert these lines:

FEATURE(rbl)
FEATURE(rbl, `dul.maps.vix.com', `Dialup - see http://www.mail-abuse.org/dul/')d
nl
FEATURE(rbl, `relays.mail-abuse.org', `Open spam relay - see http://www.mail-abu
se.org/rss')dnl

and away you go.

-- C

Re:my take on it

[swb]

Does the per-server RBL selection work with 8.9.3? The docs weren't clear, and FreeBSD isn't on 8.10 yet.

Re:my take on it

[congiman]

Yes, those are taken from my 8.9.3 MC file -- C p.s. in 8.9.10 its not called rbl, but dnsbl.

Re:my take on it

[Bob Uhl]

The DUL is highly annoying. It bounced mail from my Linux box because my sendmail was configured to deliver mail properly, i.e. to the appropriate machine. I had to reconfigure it to be stupid and send all mail to my ISP, which slows thigns down and adds another point of failure to things. Thanks loads.

Mail from dial-up accts has a higher probability of being spam, granted. But with the marked increase in intelligent hosts (i.e. hosts which are properly configured and act as their own mail servers) installed in user's homes increases, this probability will decrease. I call on all right-thinking mail admins to Do the Right Thing and turn off the DUL.

I also call on the US Congress, acting under its authority to regulate inter-state commerce, to ban spam sent across state lines, and on the legislatures of the states to do the same for intra-state spam, and on foreign legislative bodies to do the same. A federal law declaring the sending of spam across our national borders an actionable act would be nice too:-)

The RBL is a good idea, one which I agree with.

Re:I SAY WE SLASHDOT THEM

[Schnedt McWapt]

Ah, I see.

You intend to spam everyone in sight with your opinions about yesmail.

How clever.

This is great!

[AlphaOne]

I personally think this lawsuit is a great thing because I don't think YesMail has a hope in hell of winning.

I'm no lawyer, but I really don't think you can sue someone who simply publishes a list. Think about it... all MAPS does is compile a list of IPs it doesn't like and various ISPs act as subscribers to this information and choose to block them.

If MAPS were to lose, it sets a nasty precident that would allow anybody to sue anyone (such as NetNanny) simply because they are listed as "bad". Think of how far-reaching this could be... you could publish a list of crappy video cards and be sued because sales dropped.
--

Re:This is great!

[Foogle]

What if I published a list of homosexuals? And what if you were on that list? No crime there, but what if you weren't a homosexual? What if, because of that list, your wife left you and took the kids? There'd easily be grounds for a lawsuit then.

Now flashback to MAPS. What if yesmail isn't a spammer. Because of the list, yesmail will lose customers, and a potentially large amount of money. I'm not saying that yesmail isn't a spammer, but if they can convince a jury that they aren't... Well that's grounds for libel.

-----------

"You can't shake the Devil's hand and say you're only kidding."

Re:This is great!

[Frodo]

Don't your evening newspaper already does this? Every time I open those, I read: $ROCK_OR_MOVIE_STAR declared to be homosexual! So if I collect all those papers, I get list of all famous homosexuals (and non-famous aren't interesting - who cares for Joe R. Random anyway?)

Re:This is great!

[Wolfkin]

What if I published a list of homosexuals? And what if you were on that list? No crime there, but what if you weren't a homosexual? What if, because of that list, your wife left you and took the kids? There'd easily be grounds for a lawsuit then.

While that would be true in today's legal environment, I hope we can all agree that it shouldn't be grounds for a lawsuit. Why should I be able to sue you for something my wife did? In any case, lying shouldn't be a crime unless it was fraudulent (in which case, it's really theft, anyway).

Randall.

Re:This is great!

[alleria]

Unless you're sworn in and under oath, you are free to lie. Which is why you have to be sworn in in the first place.

When I'm not sworn in, I'm perfectly allowed to shout 'so-and-so is a satanic pedophiliac of a faggot' in Times Square, and he can do nothing to stop me.

Same principle as if I wished to call Mr. Clinton a 'fucking communist nigger,' -- I'd be doing something perfectly legal, despite the fact that Mr. Clinton hasn't gotten some for a while now, that he isn't really a commie, and that he isn't black, even if he thinks he is.

Re:This is great!

[jareds]

When I'm not sworn in, I'm perfectly allowed to shout 'so-and-so is a satanic pedophiliac of a faggot' in Times Square, and he can do nothing to stop me.

Same principle as if I wished to call Mr. Clinton a 'fucking communist nigger,' -- I'd be doing something perfectly legal, despite the fact that Mr. Clinton hasn't gotten some for a while now, that he isn't really a commie, and that he isn't black, even if he thinks he is.

Actually, those would be slander. If you ruin someone's reputation by falsely accusing them of pedophilia, you can be sued and they will very likely win. You have a little more leeway with Clinton, since he's a public figure, but it would still be slander if it had malicious intent.

Re:This is great!

[alleria]

Wait ... so technically most insults, whether said to someone's face or not, is slander? Can't the above be argued as my personal interpretations of said persons? I mean, I know that at the very least, I'm free to /think/ that so-and-so is such-and-such. But I thought I was also free to say so?

Re:This is great!

[jareds]

Can't the above be argued as my personal interpretations of said persons?

No, because you made factual allegations. Whether or not the person is satanic or a pedophile is not a matter of your personal opinion. There are various defenses to slander. Read this page if you're interested. I read it because it was linked to from eBay's page about feedback removal. IANAL.

"Opt-in" Yesmail itself.

[L. J. Beauregard]

I have half a mind to sign up postmaster@yesmail.com for a couple of Yesmail lists.

Maybe then they'll get the point.
--
Ooh, moderator points! Five more idjits go to Minus One Hell!
Delenda est Windoze

So open your SMTP port...

[Ungrounded Lightning]

God, I don't need internet censors deciding what I can and cannot see.

So open an SMTP port on your machine, publish an MX record pointing to it, and don't filter the mail with the MAPS list.

I don't believe that ISP's should turn to censoring their client's mail.

Isn't that a matter for the ISP and the client to agree on by contract? Isn't it the client's right to switch to a different ISP if he doesn't like the way the service is handled?

Why should ISPs be constrained to filter or non-filter mail according to YOUR preferences, rather than that of their clients?

And if all you're asking for is a signup option, why don't you try asking an ISP for it? If enough people ask for an option to have their mail unfiltered, I'm sure some ISPs will be willing to provide it.

Perhaps at an extra charge, to cover all the extra processing. B-)

But somehow I doubt that there's all that much demand for this "service".

Meanwhile, you can always sign up with an ISP that gives you a fixed IP address and a nameservice, open an unfiltered SMTP port, post an MX record pointing to it, and get all the spam you want.

Post a few netnews articles to get your ID on a few spammer lists, while you're at it. It might change your mind.

"Double opt-ins" don't always work; See Sparklist

[Randseed]

And of course even if a web site requires a confirmation mail, if they keep sending the mails with each request, their site is nothing less than a open-server from which to execute a denial of service attack.

The Cypherpunks mailing list was recently hit by the fuckwits at sparklist.com . They've sent literally hundreds of spam messages to the list. They were called about it when it all started July 10th, and assured people that they would fix the problem and send an apology to the list -- they lied. Now on July 15th, the list is STILL getting crap from Sparklist.

As far as I'm concerned, what Sparklist is going is basically the same as having a "spam this address" button which people can click for a cheap thrill, and they're no different than someone who is running an open relay.

Maybe MAPS will RBL sparklist.com. I hope so.

Re:Go for it!

[Mullen]

Yes, you have right to free speech, but I also have the right to not listen to your speech. I also have the right to use a trusted source of my choice. If your speech costs me money (Time and resources dealing with your speech) then I have the right to block your speech towards me. You can talk to whom ever you want, on whatever topic, but I have the right not to listen.

If a customer, that gets email through my machines and resources, does not like that I block some speech for whatever reason, they are free to find a new ISP. There is plenty of competition in the free market.

Surely the restraining order lists them.

[Russ Nelson]

Surely the restraining order lists the exact entries that MAPS is prohibited from adding. Otherwise, how could they comply?
-russ

The types of SPAM and how MAPS works.

[Jimithing DMB]

There are several ways to send spam, for more information, look at the MAPS website.

One type of SPAM comes directly from a dial-up account to your ISP's mail-server. This type of spam can be prevented if your ISP uses the MAPS DUL (Dialup User List). The idea is that no-one should be using a dynamically assigned IP to send mail, they should forward through their ISP's mail-server. Spammers don't want to do this though, because their ISP's mail-server will keep a very detailed log the messages sent.

Many times spammers will find what is known as an open relay. An open relay is a system which is accepting mail from anywhere and sending mail to anywhere. In the old days (that is, a few years ago) that was common practice. Now that spammers abuse this, any system which is an open relay and has been known to have had spam sent through it and has been reported to MAPS will be placed into the MAPS RSS (Relay Spam Stopper). Again, you must encourage your ISP to use the RSS to filter mail. There is one drawback to the RSS though: it blocks ALL mail from an otherwise legitimate mail-server. However, if the sysadmin of that mail-server gets his act together and stops the open relay, the system will be immediately removed from the MAPS RSS. The sysadmin can even contact MAPS for help, and there are volunteers available to help with server configuration.

The final list is the RBL, which is the one that is being challenged. The RBL is very unlike the other two lists. The RBL exists to stop known spammers. By using the RBL, a sysadmin is really putting his/her trust in MAPS. Personally, I do use the RBL because it does help keep the spam problem down. To get on the RBL, there must be a repeated abuse shown. The reason MAPS wants to add yesmail to the RBL is because they are being bad net citizens by allowing anyone to enter anyones e-mail address to subscribe to one of yesmail's mailing lists. So basically, one of your friends (or enemies) could send them your address and you would start receiving "marketing materials" from them on a regular basis. It is then your responsibility to opt-out of the list that you didn't even opt-in to in the first place!

What MAPS would rather see is for them to send one and only one e-mail to the address that contains further instructions to verify that the e-mail should really be subscribed to the list. If the person who receives the e-mail actually wants to be subscribed, then it is only one extra step for him/her. If the person does not want the e-mail, he/she does not have to do anything because yesmail should never send further correspondence unless requested to again.

Those are the basic facts about what is going on. I am sure several people have submitted yesmail to the RBL. Obviously, there are plenty of MAPS RBL subscribers who want yesmail on the RBL. Note that your ISP must subscribe to the RBL to actually have the e-mail blocked.

Now, for those of you saying that you don't want your ISP to use the services of MAPS, I say, tough shit, take it up with them. Do not forget that it is your ISP's server space and you are merely leasing the rights to use it and have an e-mail account and accesss and so on. If you don't like them filtering by the MAPS lists, then either ask them specifically not to filter your mail (which can be done) or get another ISP. Personally, I think you are crazy if you don't want your mail filtered by the MAPS lists, but to each his own I guess.

Anyway, talk to your ISP about filtering using MAPS and see if they will do it. Mention that it does reduce the load on their server resources because they no longer have to store and transmit mail that you don't want to see anyway!!

Re:The types of SPAM and how MAPS works.

[Frodo]

This is true but also is true:

1. Double opt-in requires much more resource (you should store every email with sign if it was "confirmed" or not, you should remove stale emails that never were confirmed, etc., etc.) This means additional investment, which not everybody likes.

2. Sending marketing materials is not always spam. Try to do a marketing without ever contacting anybody that didn't ask you to contact him. You will get zero sales - nobody will ask you because they have first to know you! Spamming is when you do this en-masse, repeatedly and disregard people's reuqest not to do it. If you just sent one person a mail "won't you be interested to work with me" you are not a spammer. If you do this to million people thousand times - you are.

3. The "don't use RBL" argument is false. First of all, if your ISP uses it, you have zero choice. Also, this is like answering Microsoft antitrust allegations with "nobody is forced to use windows". In fact lots of people are, for various reasons, and also significant number of people may be forced to use RBL by decision of their providers, system administrators, etc. (I even recall reading that government institutions use it - that means, entire department can be put under RBL by decision of single person). Thus, MAPS people should exercise much of care, which should increase as their popularity grows.

Re:The types of SPAM and how MAPS works.

[sqlrob]

1. Double opt-in requires much more resource (you should store every email with sign if it was "confirmed" or not, you should remove stale emails that never were confirmed, etc., etc.) This means additional investment, which not everybody likes.

Which is better, one person group having more resources, or EVERYBODY requiring more resources due to the load on the network?

2. Sending marketing materials is not always spam. Try to do a marketing without ever contacting anybody that didn't ask you to contact him. You will get zero sales - nobody will ask you because they have first to know you! Spamming is when you do this en-masse, repeatedly and disregard people's reuqest not to do it. If you just sent one person a mail "won't you be interested to work with me" you are not a spammer. If you do this to million people thousand times - you are.

There's this lovely thing called ADVERTISING. You hook on other e-mails / web pages. You don't necessarily have to cold sell.

I do somewhat agree with you though. If the e-mail is obviously individually crafted, I probably won't complain other than to them. If it is bulk, or even apparently bulk, their ISP will be getting the complaint.

It's sad, really.

[AugstWest]

MAPS, as well as orbs.org are really doing quite a service for the entire internet community.

After upgrading Exchange to sp6a (yes, 6, and yes, a. Ah, the life of an NT admin...), the server suddenly started relaying mail for outside machines, despite all of the changes I'd made to it pre-sp6a.

If I hadn't gotten the email, I wouldn't have known. MS never would have mentioned it, I had to dig for a day through their "KnowledgeBase" to find out what the problem was.

It's sad to see that companies are trying to stop these services from listing them.

Re:It's sad, really.

[odaiwai]

Well, how about nominating MS for the RBL for 'services to spammers' if merely installing a service pack give you open relays?

dave "cc: billg@microsoft.com"

What's the problem? spammers are theft of service

[ajv]

I've worked in ISP's before. The abuse queue at one of them (a very large one) jumped from an undercurrent of about 1000 outstanding items to over 1200 on the basis of one single spam incident. The ISP costs each abuse incident requiring action at $25 to reply and fix. Thus this one spam incident cost the ISP more than $5000 to manage and resolve, and that doesn't take into account the good will aspects. The bandwidth stolen from the ISP and the customer costs money as well, and to maintain a responsive system, most tier 1 ISP's have excess capacity. Spam is not really a big consumer of bandwidth unless you happen to be the sucker with an open relay, but the management costs are astronomical. In addition, of the twenty or so times I saw the results of abusive "customers" who bought $20 pre-paid internet accounts and injected several million messages per account before having it closed, the account costs this ISP many hundreds of dollars. The headers are all forged (who do you want to be today?), the recipients entirely unwilling. The mail administrators in one of the worst incidents worked until 2 am fixing this problem up. Does the spammer pay for this? I don't think so. If the local mail relays are full of unwanted messages from non-paying (or abusive) customers they cannot service the other 100,000+ customers legitimate traffic in a timely fashion. If they paid *all* the intervening ISPs (as if) for the full cost of their actions, and everyone opted in rather than the other way around, this would not be a major problem. It's not about free speech, but simply this: A is stopped from sending to C,D,E...n by B. A is stealing from C,D,E,..n's ISP and from C,D,E,..n, and from many intervening networks, and thus many managers and administrators do no like this loss, thus signing up for B's service. "A" does not pay for the privilege and they forge their identity. Why does "A" think they have a *right* to steal? UCE is theft of service. End of story.

Overextended contractual relationships?

[John Marshall]

By threatening to [blackhole it] and by publicizing the threat, MAPS would disrupt yesmail's contractual relationships with its advertising business, the complaint states.

So yesmail has entered into contractual agreements with advertisers stating that it is able to send email to third parties more or less reliably? Even without obvious impediments like MAPS, this is of course quite outside its power to guarantee.

Great work, guys!

Re:Go for it!

[eap]

Because the RBL filters at the server level (typically), you are depriving your users of their freedom of choice. Sure, they could go elsewhere. Just like I could "go elsewhere" for my high speed cablemodem. If there was any competition. *cough*

Umm, why don't you just use hotmail, or one of the other *free* mail providers. I'm sure you can find one that doesn't subscribe to the RBL, and then you'll be able to get all the wonderful spam you seem to want, plus some.

How is this any different

[voidptr]

How is this any different from a mass boycott by subscribers of the RBL? Last time I checked, that was still a valid method of protest.

Re: Bah!

[HappyHead]

Heh, just because they were in charge of it before, dosen't mean they've got it now. (damn. It was much less cluttered with crap back then too.)
'Scuse me, I think I'll go have a USEnet-flashback now... (woah... content...)

The main point: MAPS is voluntary

[Cerlyn]

Everyone seems to be skirting around the main point of this: MAPS is a voluntary system. No one says you must use it. ISPs that use MAPS normally tell their customers that they use it (or likely should). If you do not like that your ISP is using the MAPS system, you can ask for your account to be excluded (if they can), or find another ISP to use. Choosing an ISP with MAPS is choosing features, like choosing what areas with an ISP you have local dialups in.

Now IANAL, but you can say all you want. Talk and talk and talk if it makes you feel happy. If I put earmuffs on my own head (or let my ISP do so on my behalf), you have no right to take them off. I chose to have them put them on.

This is like Yesmail saying I can not hang up on a telemarketer because I must listen to what they say, no how matter how little (i.e. the subject line) I pay attention. This is not a good precendent.

Re:The main point: MAPS is voluntary

[PigleT]

Quite so. The precedent is bad, although it might have a favourable outcome for the wrong reasons: the RBL and DUL (in particular) are things your ISP subscribes to in order to censor your email for you - if I send mail to somebody from my dialup box and it bounces because of "administrative prohibition", then it will very rarely be the case that I send it through some smarthost or other, and I'll probably tell the recipient to stop using that ISP.

MAPS, RBL and the DUL should be disbanded for censorship reasons, not legally.

~Tim
--
.|` Clouds cross the black moonlight,

Re:The main point: MAPS is voluntary

[odaiwai]

Complete and utter bollocks.

Your ISP signs up to DUL and RBL to *reduce* the amount of crap they have to deal with. Also to get a heads up on spammers or open relays they need to ignore as bein irresponsible netizens.

It is *not* censorship, as they are all private organisations who are free to do as they widh with *their* networks.

dave

Re:The main point: MAPS is voluntary

[Bob Uhl]

The problem with the DUL is that a well-configured host should act as its own mail server and send mail directly from that host to whatever machines are the appropriate recipients. Instead, we are forced to configure our machines to use an external mail server, which slows things down, takes up bandwidth and in many other ways is a right royal pain in various body parts.

I quite agree with the RBL.

Re:I would rather filter my email myself

[znu]

Spam wastes significant ISP resources, and the vast majority of people are happier with ISP-side filtering (they wouldn't have the first clue how to set things up on their own, or they just don't want to deal with it).

If you really have a problem with it, it's your right to chose an ISP that doesn't do it, or run your own mail server.

--

What a moronic thing to do on Yesmail's part...

[Anonymous Coward]

This is incredibly moronic. The only thing yesmail achieves with an action like this is to land themselves on thousands of private block lists. I have made sure to update my access.db with all of their netblocks. Numerous others have been doing so as well, according to the comments in news.admin.net-abuse.email. It will be much harder, if not impossible for yesmail to get off of these blocks than it would have been to get off of a single list.

If I were yesmail's upstream providers, I would dump them like a hot pototato. Remember what happened when AGIS refused to dump Spamford Wallace? The rest of the Internet decided to route around them. Upstreams don't need entire /16 blocks of their network being effectively routed off of the Internet.

Remember, the average user may believe in the "Just hit delete" crap, but most of the people running networks are vehement anti-spammers.

Re:What a moronic thing to do on Yesmail's part...

[Molina the Bofh]

> I have made sure to update my access.db with all of their netblocks

What are their netblocks ?

via whois I got Netblock: 64.37.192.0 - 64.37.239.255 but I'm afraid this can include other exodus customers.

even catholics have to request confirmation

[SomePoorSchmuck]

Well hooray for them. I'd define spam as "content delivered to a user without desire or request on the part of the user and prior warning/confirmation on the part of the deliverer"

I've had email since '90 (a moment of silence for the late, great BBSes), and though spam wasn't nearly as bad back then as it is now, I still quickly got over my timidity of telling everyone from strangers to close friends, "Don't bother sending me blonde jokes, political action reports, or anything that begins with 'FWD: FWD: RE: RE: Fwd: Re: READ THIS!!!!!!!!!'. I refuse to read such crapola -- I intend to use email as a way of increasing meaningful, first-hand COMMUNICATION between human persons."

Of course, not everyone was happy with this simple directive. Either they got over it, or *I* got over *them*, but it was/is not tolerated.

In any case, some of the people with whom I have casual, unprotected e-mail do not bother to conceal recipients when they send out a mass forward of "top ten reasons dogs are better than men having sex with dogs" or whatever putrid meme-virus is going around that week. One particularly annoying episode last year was due to morons who indiscriminately use the Reply-All button. I ended up getting harvested onto the mailing-list of a political interest group I didn't really like (let's just say if I had been in the military it could have been grounds for a discharge), receiving a long newsletter update about their URGENT ACTION ITEMS!!!!!! almost every day.

So I took some URGENT ACTION!!! of my own:
1)Reply to sender of the message, requesting removal (subject, body, non-script english).
no response, two days later, received newsletter.
2)Go to website look for unsubscribe area.
none there, receive four newsletters over the next week.
3)Send email to designated "Contact Us!" including copies of their newsletter along with my request to be removed from list; also suggest webpage removal form.
no response, receive several newsletters over the next week.
4)Send to abuse@ webmaster@ postmaster@ [domain.org] requesting personal removal, including copies of past requests and newsletters; re-iterate webpage suggestion.
no response, receive newsletters over the next four days.
5)Use DNS lookup to find addresses for the registrant, send request for removal including history (numbers 1-4).
finally, someone removes me from the list. although to be honest, it would have been nice to receive an apology from the bastards, or some indication that "we are adding a new form on our page whereby users may request removal in the future".

THE POINT IS: by having mailback-confirmation of list-adds (providing info on removal) they could have saved:
a)their time and resources
b)MY time and resources
c)my newly-earned, personal opposition to their cause (amusingly, protesting to end violations of civil liberties)

nmx is absolutely right on this.

___
the problem with teens is they're looking for certainties.

Re:E-commerce

[Ungrounded Lightning]

You need to take your troll detector in for a checkup. If the last sentance of his post didn't tip you off, I'm amazed you can operate a keyboard.

One of the forms of hacker humor is to respond literally to a totally outrageous statement or question.

B-)

Bad strategy

[emcdermid]

While in most cases any publicity can be good, Yesmail would be foolish to try this. Why? Because every ISP out there has the capability (and the right) to add Yesmail to their own private blackhole lists (not shared with anyone else; just preventing their own email servers from acception email from Yesmail, which is entirely within their rights). Yesmail will wind up on thousands of individual blacklists. Worse, because of the inertia of such lists, they'll never get back off all of them. It's already happening -- check out news.admin.net-abuse.email (NANAE). Precedent exists for this -- look at the history of AGIS, which was (for a time) a spam-friendly provider. They wound up on so many blacklists that they essentially became just a private network. They cleaned up their act, but could never get off enough private lists, and finally delared bankruptcy a while back. In a sense, MAPS was doing Yesmail a favor -- at least you can get back off the RBL.

Re:I would rather filter my email myself

[Parsec]

Maybe I could volunteer name, address and what time I'm about to rob which bank to the police. Very libertarian?

I'm not really going to rob a bank, this was just illustrating a point.

And harder to get off...

[Ungrounded Lightning]

Even the injunction wouldn't be able to keep MAPS from publishing their address in a way that is NOT automated.

If MAPS had put them in the RBL, they could get things working again within hours after cleaning up their act. If thousands of individual sysadmins start adding them to their sites' individual black hole lists, it's likely they'll NEVER get their domain's mail working right again.

I think that even if the suit succeeds they're dead meat - as is any other domain operator that uses the legal system to block MAPS from black-holeing them.

Re:I would rather filter my email myself

[Darchmare]

It seems to me that you need to read up on what the RBL is, then, before you pass judgement.

This is how it works:

1. People report open relays and the like to the RBL.
2. RBL puts that on a list.
3. Various ISPs receive a copy of that list, and make it so that email from those sources is not received.

Note that step 3 is 100% consensual. As the owner of an ISP, you can choose to receive mail from those on the RBL. You can even ignore the list entirely. Each ISP gets to choose if they want to use the list or not, and by virtue its customers get to choose whether or not to use that ISP. Basically, it's a way for people to ignore known spam sources if they want to.

It's not a 'big brother' type organization as you don't have to use their list of spam sources if you don't want to. They simply provide a service to those who trust them to root out spam sources (and they are very open on their criteria for putting people on the list, as well as providing proof of their actions).

Now, my guess is that you spoke before doing your research - and that you ARE a true libertarian. However, saying that the RBL doesn't have the right to publish a list of spammers (that your ISP can and can not choose as a commercial organization to filter) is antithetical to libertarian thought. Yeah, there are variations on the same theme, but this is basically a free speech issue. They're not forcing anyone to use it, after all.


- Jeff A. Campbell
- VelociNews (http://www.velocinews.com)

I'm torn

[Anonymous Coward]

I worked with YesMail as a consultant a little while back, and have a little insight into this.

When I was working with them, they were very interested in making sure people could get off their lists if they wanted, and that they didn't get on them unless they wanted to be on them. One of their big selling points is that the people on their lists want to hear from them, and they don't want to jeopardize that. If people don't want to hear from YesMail, YesMail doesn't want to bother them.

That said, I'd absolutely hate to see them prevail in this lawsuit. However they got on the RBL, it's a strictly voluntary service for e-mail administrators. If YesMail is on the list, you can pretty well bet that the admin doesn't want YesMail traffic passing through their systems. I'd hate to see a court interfere with that.

Re:I would rather filter my email myself

[Darchmare]

---
First off, 'spam' is a subjective term used to describe a lot of different things.
---

While some people use it incorrectly, the generally accepted definition of spam is 'unsolicited bulk email' - commercial in nature or not.

Regardless, the RBL focuses on open relays - those aren't subjective at all. It's either open or it's not.

---
Companies shouldn't be deciding much of anything for their customers where it comes to filtering the content they receive.
---

Sure they can, as long as they are open about it. That's why an open marketplace is so vital - you as a consumer can choose who you want to work with. If a given ISP filters stuff based on known spam sources and you don't like it, there are a number of competing ISPs that would be more than happy to take your business away from them.

---
They're certainly no longer a 'common carrier' once they've started applying filters....
---

Hrm.

If I block incoming mail from a given ISP due to their listing on the RBL, should that lose me common carrier status? It's not really being 'published' in a public space, and you're not really censoring existing _content_, so it's hard to say.

Where does it stop? If I apply a block to a certain IP range due to a denial of service attack, does that lose me the common carrier status? If so, that needs to change. I consider spam to be the equivelent to an attack of sorts, so I'm not sure why there would be a difference. In either case it's the hijacking of 3rd party computing resources for an insidious purpose.


- Jeff A. Campbell
- VelociNews (http://www.velocinews.com)

Courts won't accept RBL's wide interpretation

[Morgaine]

Alas, this whole area is heading in the direction of law and the courts, and there's nothing they hate more than vigilantism.

Whatever we may think of the arguments ourselves, aiken_d makes a strong case why blame for spam cannot be transitive: if Ibill is RBL'd, then so should the electricity and water boards, supermarkets, McDonalds and everyone else that supplies the spammers with indirect support. It's all a matter of degree, and you can bet your life that the courts will not see Ibill as being in the spamming business any more than those who indirectly support (say) the financial (banks and the US Treasury!) or stationary needs of spammers. It's not transitive.

Re:What is "Double opt in?"

[Chas]

Okay now. Opt-Out: Basically they can send you stuff until you send them a notice or fill out a form stating that you don't want their content. The only problem with this is, there's nothing to prevent you from being put right back on a similar list later on. Also, the act of notification probably gets you chucked onto a couple more lists. Opt-In: Basically it's as simple as "fill out your e-mail address and we'll send you our content". There's no verification that the person submitting the address is actually the person utilizing that address. So, if someone wanted to be a real idiot, they could simply submit your address to the Opt-In for "Fill your mailbox with "SOMETHING". Double-Opt-In (or Verified): Like a properly set up majordomo mailing list. You submit yourself to the list. The listserv sends back an e-mail saying, essentially, "Someone subscribed you to this list. If you really want to be on this list, just reply to this message, or go to this webpage and confirm it". Once you've confirmed it, you're on the list. DOI makes sure you actually WANT the content BEFORE sending any of the content your way. The only problem with some DOI's is that some of them allow your e-mail address to be submitted over and over again. Causing you to receive multiple confirmation requests, and essentially amounting to mailbombing. Some better DOI agents will accept a particular e-mail address once, then won't accept addition submissions for it. At least until confirmation is received.


Chas - The one, the only.
THANK GOD!!!

Re:Go for it!

[Chas]

1. It's your network. You have a right to decide what traffic goes across it. Since you're paying for the bandwidth.
2. The RBL is a SERVICE. They don't impose their filters on recipients who don't want to use the RBL filter. You have to WANT it to have it.
3. Please cite these "numerous cases". They make every effort to help the "offending" sites fix their node. Only after all attempts have failed, and the site appears unwilling to rectify the situation, do they nominate it for the blacklist.
4. Intelligent filtering is all well and good, but the problem is that the server is compromised in some way. And while it'd be nice to allow some of the legitimate users through, if the server's compromised, it's nearly impossible to tell who the legitimate users are.
5. Again, the RBL is VOLUNTARY. Your provider either opts in or they don't. Either way, the offending mail server still functions. It merely cannot relay messages to users on mail servers which utilize the RBL. And since you have the option of changing ISP's, or requesting exclusion from the filtering, you DO have the freedom. Remember, freedom doesn't guarantee you a cablemodem and high speed access. Some choices have consequences.
6. The RBL does NOT limit your connectivity to the outside world. You have the right to opt-out, either through a request for exclusion to your ISP, or by changing ISP's.
7. Connectivity isn't a right. High speed connectivity isn't a right. Utilization of your ISP's bandwidth in a manner contrary to their SOP and user agreement isn't a right.

Chas - The one, the only.
THANK GOD!!!

Legal question...

[SvnLyrBrto]

>MAPS is in California, the order is from a
>court in Illinois,

Okay... this is something that's bugged me in in a number of other stories here on /.

By what streach of the law, imagination, or simple arrogant presumption does an Illinois judge claim jurisdiction over people in California?!?!?!? Or vice versa, for that matter (MPAA's restraining order on 500 john does, many of which most certianly live outside CA comes to mind)?

Is this a *FEDERAL* judge, whose bench just happens to be in Illinois? Or does any old state judge have carte blanche to order around people outside their jurisdictions? Seems like MANY states would STRENOUSLY object to such a violation of what little sovereignity the states have left (Texas and Mass come to mind, for starters) And if the latter *IS* the case, why do we bother with jurisdictions at all?

Of course, it *IS* a common arrogance for our legal system to presume that it has domain outside its jurisdiction (certian OTHER DeCSS-related actions, in Norway, for example, come to mind).

I'm *SURE* that there are at least a FEW bona fide lawyers who read Slashdot. Could one of you PLEASE shed some enlightenment here?

john


Resistance is NOT futile!!!

Haiku:
I am not a drone.
Remove the collective if

Re:Legal question...

[Brian See]

Yes, it's a federal judge. The article says the order was issued from a judge in the Northern District Court of Illinois (Eastern Division). State trial courts in Illinois are called the Circuit Courts (ie, the "Circuit Court of Cook County").

In federal courts, you can bring suit in the district where the defendant resides OR the district in which a substantial part of the events giving rise to the claim occurred. See 28 U.S.C. 1391.

It's generally (although not conclusively) been established that posting stuff on the Internet subjects you to the jurisdiction of courts everywhere, since your communication reaches those jurisdictions. Caveat blacklister...

Re:Legal question...

[DHartung]

SvnLyrBrto asks:
Okay... this is something that's bugged me in in a number of other stories here on /. By what streach of the law, imagination, or simple arrogant presumption does an Illinois judge claim jurisdiction over people in California?!?!?!? Or vice versa, for that matter (MPAA's restraining order on 500 john does, many of which most certianly live outside CA comes to mind)?

Don't take this personally ... but I am sick and tired of people who don't seem to have a junior-high-school level of knowledge of the world posting away on Slashdot. The legal system of this country isn't exactly simple, but it surely shouldn't be beyond the abilities of the self-taught coders who allegedly populate Slashdot. Unfortunately, every time we have a legal story here, it's a self-evident truth that nobody listened in Government class.

I'll try to use short words.

To start, the United States Constitution, Article IV, Section I, states the following:

Full Faith and Credit shall be given in each State to the public Acts, Records, and judicial Proceedings of every other State. And the Congress may by general Laws prescribe the Manner in which such Acts, Records and Proceedings shall be proved, and the Effect thereof.

This is why you can be arrested in California for murdering someone in Maine. It's also why you can be sued in Florida by a customer you have in Montana. Often contracts actually specify which court will be the first choice of the contracting parties.

Beyond that, an injunction is simply an order covering the parties in a lawsuit. As such, it does not have to actually conform to any law -- in fact injunctions can be quite broad (e.g. a gag order, which does not violate the first amendment) to suit the requirements of the case. Injunctions are intended to prevent one party from accomplishing a de facto win while losing a de jure case.

It's pretty irrelevant to this case, though, which is in a Federal court.

Is this a *FEDERAL* judge, whose bench just happens to be in Illinois?

Yes, and Illinois happens to be where Yesmail.com is headquartered, therefore the most likely place for them to choose to sue. They are suing in Federal court because they are seeking injunctive relief under Federal law.

Or does any old state judge have carte blanche to order around people outside their jurisdictions?

When the judge has jurisdiction, YES. Sometimes jurisdiction is indeed a matter of dispute, which is why the other side will enter an appeal. This is normal. (Frankly, it's normal for any target of a court injunction to argue against it.)

Seems like MANY states would STRENOUSLY object to such a violation of what little sovereignity the states have left (Texas and Mass come to mind, for starters)

Uh ... I hate to say this, but they signed the Constitution. Quite some time ago. In other words, they exchanged certain kinds of sovereignty for certain presumed benefits. This is the way that a federal republic works.

And if the latter *IS* the case, why do we bother with jurisdictions at all?

Because normal criminal and civil law is handled by the states. The presumption is that doing business in a state (which can be merely, e.g. selling to someone there) exposes you to its jurisdiction (for the protection of the person you sold to). Anyway, again, this is a FEDERAL lawsuit under FEDERAL law so the assumption is that it applies to all parties in the jurisdiction of the United States.

Of course, it *IS* a common arrogance for our legal system to presume that it has domain outside its jurisdiction (certian OTHER DeCSS-related actions, in Norway, for example, come to mind).

The copyrights of one nation are recognized by another nation under the Berne convention, a treaty which the United States signed in 1985. Again, under the Constitution, treaties have the effect of federal law. Norway, as a signatory to the treaty (much earlier than us!), has to recognize our copyrights just as we promised to recognize theirs.

You may not like the particular application of copyright in this case, but you should be able to understand the legal process.

I'm *SURE* that there are at least a FEW bona fide lawyers who read Slashdot. Could one of you PLEASE shed some enlightenment here?

IANAL. But I do have a college education, and I can pick up a World Almanac and read the Constitution. It is highly suggested that you do the same. This isn't some boring quiz for half-asleep eighth-graders, after all -- this is REAL LIFE, and as we see is not inconsequential.

Besides, this is the real bottom line:
MAPS lists a page on its Web site (http://www.mailabuse.org) titled "how to sue MAPS," hoping a legal case would establish that its tactics were legal. Yesmail is the first company to take up the challenge.

In other words, MAPS has been waiting eagerly for this day in court. They've probably had briefs prepared well in advance, and pro bono legal counsel all lined up.
----

Re:Legal question...

[jareds]

• Of course, it *IS* a common arrogance for our legal system to presume that it has domain outside its jurisdiction (certian OTHER DeCSS-related actions, in Norway, for example, come to mind).

  The copyrights of one nation are recognized by another nation under the Berne convention, a treaty which the United States signed in 1985. Again, under the Constitution, treaties have the effect of federal law. Norway, as a signatory to the treaty (much earlier than us!), has to recognize our copyrights just as we promised to recognize theirs.

There was never any possible claim of copyright infringement in the DeCSS case. In that case, hackers reverse engineered some DVD playback software and created software to decrypt CSS encrypted CDs. The only possible illegality alleged against DeCSS were violations of the provisions of the US Digital Millennium Copyright Act that prohibited most distribution of devices that performed unauthorized decryption of copyrighted works, clearly irrelevant in Norway, and trade secret violations (because the click-through license of the DVD software in question prohibited reverse engineering).

Re:Legal question...

[theNAM666]

>Don't take this personally ... but I am sick and tired of people who don't seem to have a junior-high-school
>the United States Constitution, Article IV, Section I, states the following:

> Full Faith and Credit shall be given in each State to the public Acts[...]

Down boy. Full Faith and Credit does not apply to state issued restraining orders -- for instance, RJR convinced a KY state court to issue a restraining order against Jeff Wiegland when he wanted to testify in Georgia against them. Only KY would enforce the order; no other state, or the Feds, would or could touch it.

Which is to say, this is a bit more complex than High School Gov't.

>It's pretty irrelevant to this case, though, which is in a Federal court.

>>Is this a *FEDERAL* judge, whose bench just happens to be in Illinois?

So federal vs. state is not irrelevant at all here. So don't get snotty about someone not knowing this, &etc. There are three Ph.D.s, including a PolSci-er, here, and we had to look it the fact that a district court was a Federal jurisdiction, in fact; and some of us here have had to file petitions before...

Slashdot is about the exchange of information -- community education. If you wanna get fed up, complain that the poster was too lazy to bring up google and find out himself... or that his concerns about State's rights are ill-defined. And help him on by explaining the situation.

But don't bat him down for asking a question. That's something we should be fed up of...

Re:Legal question...

[parkrrrr]

for instance, RJR convinced a KY state court to issue a restraining order against Jeff Wiegland when he wanted to testify in Georgia against them. Only KY would enforce the order; no other state, or the Feds, would or could touch it.

Better watch the movie again. The company was B&W, he was testifying in Mississippi, and apparently even KY wasn't too keen on enforcing the order, since he came back there after he testified and wasn't arrested. Mississippi had the option of enforcing the order, but a Mississippi judge refused to honor it.

Re:Legal question...

[theNAM666]

>Better watch the movie again. The company was B&W, he was testifying in Mississippi, and apparently even KY wasn't too keen on enforcing the order

The company was Liggett, actually in fact, and testimony was ultimately given in both Mississippi and Florida cases. Don't count on movies for your facts -- _The Insider_ was widely summary in many places.

KY was never in a position to enforce the order per se, as the actions violating the order did not take place outside of KY -- so they could not be "restrained" by KY. Outside of KY, the legal question was much more tangled... and since Attorneys General in both states were bringing the cases, the police weren't going to stop him from going into Court (which very well might have happened in KY). ROs are fairly complext things, as they're easy to get (a lot easier than you might think) -- and I've heard, for example, local police tell people that they simply wouldn't enforce certain ROs (like banning someone from an entire town).

Also, as far as I know, _The Insider's_ stuff about Wiegland worrying about being arresting in KY was also make-believe: no warrant was brought in KY for him having violated the RO (Liggett could have done this easily; it wasn't a matter of KY not being "keen"; but probably they didn't really want further bad press).

Re:I would rather filter my email myself

[Darchmare]

Addendum - I made a mistake. you don't report to the RBL, you report to MAPS. The RBL is a list they keep. There are a number of similar lists that network providers can use to decide who they should and should not accept connections from.

Of course, it's all voluntary. You don't need to use these blacklists if you don't want to...

- Jeff A. Campbell
- VelociNews (http://www.velocinews.com)

Re:Where's the /. reading lawyer? u talking to me?

[geeklawyer]

Which lawyer you talking about? I think there are 2/3 of us. I'm a UK lawyer so I can only give a good view of the position this side of the pond.

What do I think of this injunction? its a crock of shit - interlocutory injunctions arent hard to get in practise as long as you have;

at least an arguable case.

a good trial lawyer

no opponent - an emergency ex-parte application is, therefore, best for the spammer.

My quick view is that just because YEsmail have contracted with X to deliver spam to Luser via ISP there is no legal relationship between YEsmail and ISP. It can however be argued that there may be an implied term in the contract between Luser and ISP to deliver communications by Yesmail or X. And this maybe the case if Luser has requested spam from X or YEsmail. This would not apply if the email address Luser@isp.com had been harvested but it might be so if it had been given voluntarily by Luser in response to an offer or suchlike. And in any event privity of contract would only permit Luser to sue not Yesmail (disregarding arguments about equity)

This is basic contract law and provides no good basis for an action. however things get a little foggier when one considers tortious acts such as nuisance, defamation, interference with contractual relations, etc etc. Defamation could be argued but it depends on the detailed facts so I cant say. Interference with contractual relations is a possibility but the question here is interference between whom? if between Luser and X its quite a good cause of action. If however its interference between X and Yesmail? dont make me laugh! ISP doesnt exist to help Yesmails business or X's, only to link Luser to the Internet. If ISP makes Yesmails life harder, or refuses to make it easier, tough titties: "I am not my brothers keeper".

Additionally MAPS can argue two other things.
1) that Luser can still receive email from non-RBL users. Though that wont be possible if Lusers ISP uses RBL. But if upstream ISPs dont all use I guess routing is still possible allbeit slower and less certain. Id want a technical view on this argument.
2) Public policy. Spam has all but rendered Usenet useless.Makes the uses of email a hassle or the giving out of email addresses undesireable. this all reduces the utility of the Internet which most people politicians and judges think would be a "Bad Thing(TM)"

There are a lot of other legal considerations/angles and I could say a lot more but you aint paying me
maybe my brother US /. lawyers could chip in...

(any chance of decent karma for a change....)

Contact Clients and Partners!

[augustz]

Let them know how you feel!

No biggy

[mrfiddlehead]

As long as a campaign is started to have every ISP that uses MAPS to filter everything from yesmail to /dev/null.

Fuck the lawyers

ISP's should announce their alliegence

[jesterzog]

Firstly let me say that I agree entirely with what MAPS does.

That said, I think it would be ethically right for ISP's that use MAPS to announce to users in an agreement or contract that they might block some incoming email in accordance with the list supplied by MAPS.

As long as they do this, MAPS can strengthen it's case even more because it can argue that the users themselves have agreed with their ISP's that they don't want to receive email that MAPS considers annoying.

===

MAPS could relocate to Sealand

[cabalamat]

If MAPS lose their case against Yesmail, they could always relocate to Sealand.

Re:MAPS could relocate to Sealand

[Shimbo]

Or even a real country in a different jurisdiction. Sealand's a bit of a joke: when the RIP bill is passed, and they're faced with providing interception facilities or a jail sentence how long do you think they are going to hold out?

Re:MAPS could relocate to Sealand

[Vanders]

What? The RIP doesn't apply to Sealand, it's not part of Britian. This is the whole point of Sealand/Haven Co. Sheesh.

Re:MAPS could relocate to Sealand

[Shimbo]

What? The RIP doesn't apply to Sealand, it's not part of Britian. This is the whole point of Sealand/Haven Co. Sheesh.

That's what they claim. I'll be in the public gallery laughing when they try that one in court.

Re:Go for it!

[odaiwai]

>(yes, in some parts of the world people still pay
> for their time online)

In most parts of the world outside the USA, people pay hourly or per minute rates for internet access.

This is why us funny foreigners have very little time for USAn 'free speech' wibble from spammers.

Spammers *cost* *me* *money*! They are a net drain on my pocketbook. I have to *PAY* to find out about illegal moneymaking schemes, cheaper long distance carrier inside the US, etc.

Spammers are thieves. Stop them stealing from everyone.

dave ""

Re:What's the problem? spammers are theft of servi

[odaiwai]

More ISPs should have liability clauses in their AUP.

'You cost us money to clean your shit up, you pay for it.'

dave

Rod Loss

[alexburke]

(I once was "Ungrounded Lightning Rod" but slashdot slashed off my " Rod".

Oh dear God, they slashed off your rod?! Was it found in time to reattach it?

--

Re:Rod Loss

[Ungrounded Lightning]

It was found. But the new twenty character nickname/handle limit was permanent. So they'd have had to cut off something else to have it reattached.

One of the big names (I think it was Cmdr Taco, but I'm not sure, and don't have the old email handy) volunteered to perform the operation. But given that the default credit line comes out:

by Ungrounded Lightning (rod@node.com)

and given that I couldn't figure out a 20-character nickname that worked as well and would still be easily recognizable to people used to the old nick, I decided to decline the surgery.

By the way: The handle is a reference to an incident at a former employer - one noted for promoting open access to computer networks and electronic publishing - and also for being somewhat far out. Netnews had just been installed, and he was asked whether there were any posting limits (besides not disclosing company secrets). He said that as a matter of policy they weren't, but he'd prefer that we avoided jepoardizing the company's already-strained credibility by making far-out posts on unrelated matters as someone recognizably employed by the company. He referred to this as "being a lightning rod".

So I created a "guest account" for myself for participating in certain controversial newsgroups, and from that account never posted about who I actually was or whether I was an employee or a friend-of-the-company. (The company also had a history of handing out guest accounts to controversial figures who were friends of project members or had done something to support the project in its early days.)

Majordomo's confirmation feature

[Mr Whippy]

And fixing the verification problem with a properly built mailing list program is easy if you're using something like MajorDomo, it's the default setting once you properly install it.

In Majordomo 1, the confirmation feature is at best useless, and at worst it provides a false sense of security. Daniel J. Bernstein has this to say about it (under the section ``Subscription cookie prediction'').

I've had a look at the cookie generation code in Majordomo 1.94.5 (the current version 1 release) and it's quite trivial, given a cookie and the email address you used to get that cookie, to make a cookie for any other email address. So if the list actually allows public subscription (e.g., open+confirm), be prepared to subscribe anyone.

This claim is substantiated; there is, for example, a working implementation.

Some people argue that the cookie algorithm can be changed; however this is no longer the ``default setting'' that you were referring to.

In my quick perusal of the Majordomo 2 code, they have got it ``right'', in the sense that you can't just spoof the ``confirmation tokens'' (as they're called in the code), which are randomly generated (using the standard Perl rand()---I don't know how secure or insecure this is).

So Yesmail goes after the RBL...

[Randy Rathbun]

Now that they have, I now know about this outfit. So, MAPS can't list them (for right now), but I sure as the hell can put in a filter.

It is truly amazing to me how folks like Yesmail don't seem to understand that the RBL is not the only group that filters. They have to deal with us, the public - be it some guy with LookOut filters, or sysadmins at large ISPs/companies. Either way the mail is gonna get sent to /dev/null.

Yes, hopefully a good precedent will be set.

[bkosse]

And MAPS will be destroyed. MAPS postures itself as a "voluntary" thing, but if you actually read how it works, you get put on the list for blocking MAPS' looking around.

Gee.... MAPS can't be any more hypocritical there. MAPS' whole reason to be is because they claim spammers are tresspassing on peoples' net connections. Yet, if you ban MAPS, no matter whether you have an open relay *OR NOT*, you are listed as being an open relay.

It's astounding how many otherwise intelligent people think this is a good thing.

Re:Yes, hopefully a good precedent will be set.

[Anomalous Canard]

Gee.... MAPS can't be any more hypocritical there. MAPS' whole reason to be is because they claim spammers are tresspassing on peoples' net connections. Yet, if you ban MAPS, no matter whether you have an open relay *OR NOT*, you are listed as being an open relay.

You seem to be confusing MAPS with ORBS. ORBS does testing for open ralays. MAPS works on the basis of actual SPAM received.
Anomalous: inconsistent with or deviating from what is usual, normal, or expected

Use SpamCop

[Brian Kendig]

A highly useful service available to individuals in the fight against spam is SpamCop (http://spamcop.net/). I'm not affiliated with that service in any way except as a happy customer.. They offer two useful services:

One is free: paste any spam email you receive into a form on their site, and it will analyze the spam's headers to find out who's responsible for that spam getting to you, then it will automatically email a complaint to the relevant postmasters and system administrators, and also pass information about open relay abuse to ORBS. I've been using SpamCop this way for a few months, and I've already received several dozen responses from ISP's that the offending email accounts have been shut down due to terms-of-service violations. It gives me that warm fuzzy feeling that I'm doing some small part to help stop spam.

The other service comes for a paltry fee: you can get a 'spamcop.net' email address which filters out email for you. I believe that it will still let you see spam if you want to, and I think you can customize it to make absolutely sure it doesn't block legitimate email, so this might satisfy the people here who want more control over the way their mail is filtered.

Re:Use SpamCop

[Otter]

I was just submitting some mails to SpamCop and hit the following errors:

Reporting of DUL hosts to ORBS disabled for now
Received line accepted
.
.
Working without abuse.net
Cannot find reporting address without abuse.net.
Bestguess:postmaster@cableol.net


Is this connected to anything going on in this story?

In any case, I agree that SpamCop is a great service. I was recently in Las Vegas, where there was a huge MLM convention at the Mandalay Bay. I was waiting for the tram with a few hundred of conventioneers and started wondering how many of them I'd personally had booted from their ISP.

Some thoughts.

[mindstrm]

I can see how you would be initially pissed that RBL was 'preventing' you from sending mail....
But everyone must remember one other thing:
RBL is not an authority. IT works because ISP's DECIDE that they *WANT* to use RBL to get their block lists. They understand and know how RBL works, and are willing to live with the consequences.
REmember, email is not 'the phone system'. It's not centrally planned, and you have no common 'right' to send email to anyone, anywhere. It works because everyone agrees on common protocols, and to freely accept data from each other under certain terms. Period. Much like the internet itself.

So.. perhaps this company needs to SUE the ISP's that are actually USING the RBL. RBL doesnt' make them, it just publishes a list.

Re:Some thoughts.

[StenD]

So.. perhaps this company needs to SUE the ISP's that are actually USING the RBL. RBL doesnt' make them, it just publishes a list.

That would seem to make sense, but it's quite fashionable these days to sue the providers of a product which is used by third parties to the detriment of the party bringing the suit. Whether it's MAPS, Napster, the gun industry, and so on, it's not seen as appropriate to hold the users of a product responsible for their use of it.

Re:Some thoughts.

[coolgeek]

Agreed, but what is really at stake here is my right to say that I don't have to allow email from address@evilspammer.com to burn up my bandwidth and other resources.

Re:Some thoughts.

[Fist Prost]

" I don't have to allow email from address@evilspammer.com "

Actually, you should make that "anyuser@yesmail.com", then email them stating the reason, and encourage every other mail administrator out there to do the same. Then the folks at MAPS can simply remove them from the list, and inform them that dealing with the individual ISPs is yesmail's problem, and to HAND. And Yesmail thought they had problems before?

Re:I would rather filter my email myself

[mindstrm]

IF you don't want your ISP to use RBL, then find out if they are or not, and don't use that ISP.

Perhaps you are unaware, but a large number of mail servers are *privately owned* by collectives of people, companies, individuals, etc, and I will *NOT* have anyone dicatating to *ME* what *MY* mail server will or will not accept. I am *perfectly* happy with RBL providing me with a list of sites; I understand their method and think they are fair, and I don't care if someone gets wrongly listed from time to time. It's *MY* mail server. And people who have accounts on it can either live with it or go elsewhere.

So.. while you are complaining, does your ISP actually use RBL? Did you ask them?
Hmm. Many ISP's have size limits on outgoing mail (so you don't mail 20GB files). Is that censorship? SOme only allow 20 recipients to a message at a time. Is that censorship? WHo decides what 'email' means. If it's my mail server it means 'incomign message meets certain RFC's, plus my own filters, plus doesn't get a match in RBL'. If it doesn't meet those criteria, it's not a message.

McCarthy

[speaker4thedead]

I hold in my hand a list of the i.p.'s of known communists. Ergh...wait...There's something feeling a bit redundant about all this.

Laughable

[nehril]

Does anyone else see the irony of Yesmail fighting to get off a list they don't want to be on?

If they didn't spend so much effort putting regular people on their damned spam lists they wouldn't have this problem.

Re:My spam comes from dialups, not websites

[mindstrm]

Well.. how it is done is simple.
There is absolutely nothing special, network-wise, about a mail server, other than the fact that it's running mail server software.
If all you want to have the mail server do is send mail out.. you don't need any 'special' privelege. YOu can do it with your own computer.

Special settings in DNS and such are only required to receive mail...

Incorrect spam complaints to MAPS

[Anonymous Coward]

What about people who sign up for a mailing list, receive the mail they signed up for, decide they don't want the mail from the mailing list, and instead of following the instructions for removing themselves from the mailing list, send a complaint to MAPS claiming "I've been spammed!!!" ?

I've seen it happen on more than one occasion. MAPS never checks to see if the complaint is valid, they just take the complaint at face-value, and add the "offending party" to the list.

It's a battle I've fought on numerous occasions. When I first heard of MAPS and ORBS, I respected and supported what they did. Then I got bitten by their over-zealousness. They attempted to punish my company for offering our customers an opt-in mailing list service (a service which is only available to our customers, and only allows communication between our customers!) We have a legitimate business reason for this service, but apparently the chaps at MAPS don't care; we don't fit into their narrow view of "how things are done on Our internet."

If they change their holier-than-thou attitude, their service will prove beneficial. If they keep going like they are now, then I deeply hope that they and ORBS are wiped off the face of the Earth.

Re:Incorrect spam complaints to MAPS

[kgasso]

I've seen it happen on more than one occasion. MAPS never checks to see if the complaint is valid, they just take the complaint at face-value, and add the "offending party" to the list.

You wouldn't believe how many stories I've heard from people saying "Vixie is a fascist pig" and other wonderful comments. Interestingly, they have the same view that you do, that anyone can fake spam and be added. All additions to the RBL are confirmed, attempted contact with the offending parties is made, and only after there is (1) no contact with the originators of the junkmail or (2) the originators of the mail refuse to change their policies will they be added.

ORBS is *much* less stringent about who gets on the list. In fact, I no longer use ORBS because of the number of legitimate emails that were blocked by supposedly "open" relays. But I do trust MAPS' RBL due to the difficulty of getting in the list. It isn't extremely easy to get in the RBL, and that's the point.
--

Another spammer with that "free speech" canard.

[jcr]

This is not a free speech issue, it's a property rights issue.

Your right to say what you want to say doesn't include a right to use my property to do so.

If you're in the RBL, then I don't want to hear from you, because you're probably a spammer. It's my prerogative to ignore what you're trying to tell me. If you don't like it, TFB.

You're not entitled to paint a billboard on my garage door, either.

-jcr

YesMail is definitely lying about opt-in

[nazgul@somewhere.com]

I have mail logs of over 1000 postings from YesMail to email addresses @somewhere.com that never existed. So not only do they accept email addresses without verification, they don't clean their lists of bounces--every one of those messages bounced, yet they keep sending to them.

The real scam though, is that they are charging customers for mail sent to those addresses.

And of course, YesMail never responded to any of my complaints.

Re:YesMail is definitely lying about opt-in

[georgewilliamherbert]

When this all started, I hopped over to YesMail's site looking for info on what their actual business practices were. It stated they were a confirmation-requireing opt in only service. So I created a new test account and signed it up for some stuff I might be interested in. Filled out the web form. Got a response saying they would email me a confirmation. Nada, so far. Either they aren't actually requiring confirmations or their outbound mail is borken at the moment. I haven't gotten any of the stuff I signed up for either, which might indicate the latter, but I can clearly and honestly state they are not successfully doing confirmation emails at the moment.

Re:YesMail is definitely lying about opt-in

[jareds]

Um...you probably didn't get any mail from them because they hadn't yet been taken off the RBL.

Re:YesMail is definitely lying about opt-in

[georgewilliamherbert]

Um...you probably didn't get any mail from them because they hadn't yet been taken off the RBL.
The test account was in no way RBL protected. Come on, man, that's obvious.

YesMail needs to be taught a lesson

[junkmaster]

for bringing this frivolous lawsuit.
I say lets ban all mail to/from YesMail, even if they manage to get out of RBL.
I don't like companies who pull these sorts of tactics.

Try reading a little more

[Fishy]

People don't get onto the RBL by doing nothing, they get on by letting spammers use there service, and not doing enough to stop it.

So yesmail *****ARE***** spammers, theres no question about it.

Now all they need to do is a change to there mail lists, but oh no, they prefer people to recieve spam.

Its as simp-le as that.

F

Re:E-commerce

[StenD]

What gives you (or anybody else for that matter) to decide what mail should or should not be allowed?

Ownership of the system receiving the email. I own the system, I get to decide under what conditions I accept email. Among those conditions is that the sender not appear on the RBL, DUL, or RSS lists.

Re:The RBL is a scam.,..NOT!

[congiman]

3rd party spam:
My take on it was:
1: If you get a $20 generic account and spam hundreds of thousands of people at a different web address your web address will be blackholed.

IE:
1: you log onto earthlink and spam advertising www.myspamsite.com.
2: your earthlink account will get banished, due to earthlink's aup.
3: Your website will be pontentially RBL'ed as you are advertising it through spam... even if that site never sent spam in itself.

Again, there is usually a extensive review that goes into being rbl'ed, so its usually not instantaneous, and you usually have to be an ass about it. ie: "I will sue you" are usually the appropriate words, for a nice listing.

As for the scenario described above, with 3rd party sites being blacklisted for spammers as clients, well I havent seen that.

related:
I had a friend of mine who works at a online payment service actually speak to maps, in advance (as people were trying to spam others to use their service, so the users could get referral bonuses. He was told pretty much the same thing as the web site says:

If people are promoting spam, relating to your site, please discontinue the account, in a prompt fashion. This is my friend's company's standard policy and so everything was fine.

Sounds like Ibill just does not care, but i'm not familiar with it.

-- C

erratum

[SomePoorSchmuck]

er.. did i say "DNS LOOKUP" ???
I meant "whois".

heh, too bad there's no +1, Informative With Error(s)


the problem with teens is they're looking for certainties.

Bad press for YesMail.com

[bradipo]

I just added yesmail.com to my list of bad domains from which not to accept email. Had they not made such a fuss about RBL I guess this would have never happened. We don't need RBL to block spamming addresses and they can't come after me for blocking them (at least not yet).

The want to HURT RBL, let's fight back...

[Frank T. Lofaro Jr.]

From the article:

Yesmail has requested preliminary and permanent injunctions restraining MAPS from listing yesmail on its RBL. It also asks for compensatory and punitive damages and attorneys fees.

It appears they want to not only "protect" themselves, but to exact what they feel is their pound of flesh (compensitory damages) and then take even more (punitive damages). Punitive damages often just amounts to lawyer speak for taking money from someone out of spite. And then ask MAPS/RBL to pay for the attorneys used to inflict all this.

Is that fair? I wonder how many ISPs will put them on their private blackout lists because of this... Both from a need to stop spam (if its not on the public list, they'll need to on their own list) and out of outrage... Someone else said that getting off private lists will be much harder. Due to inertia and outrage at them I agree...

suing people is not the way to make friends...

Re:Use SpamCop, but understand how it works.

[Animats]

Spamcop is a useful service, but the spam filtering option basically works by sending back a message to each new correspondent requiring them to click on a link before the mail is delivered. This filters out spam, but is a pain for new people who want to e-mail you. It's incompatible with most mailing lists, and annoying to people who "cc" you. If you need to receive e-mail from lots of people, Spamcop probably isn't the answer.

I use it on Downside because, as a site that makes negative comments on failing dot-coms, it attracts unwanted, and sometimes hostile, mail. One nice thing about running mail through Spamcop: if a threat makes it through the filters, you have a solid E-mail address for it.

Hidden costs of blocking.

[Convergence]

There are hidden costs with spam. We all know and agree with that. There is the time that people waste downloading and deleting it.

But noone mentions the hidden costs of trying to BLOCK spam. Filters don't work perfectly. Good email gets rejected and blocked. Which is worse? Blocking 10 legitimate emails while blocking 1 spam? Blocking 10 spams while blocking one legitimate email?

Which is worse for the users and which is worse for the ISP?

If an ISP blocks legitimate email, first-time senders will forget it or not try again. Neither you nor they will never know what happened to; you'll probably blame it on the net-gods. But if the ISP doesn't block spammers they get complaints out the wazoo. Which will they choose?

That's what pisses me off about the RBL, they *are* a vigilante group. Would they have condoned DDOS against CyberPromotions? I'd say yes!

If I go with an ISP, I expect my ISP to *not* add my dialup range to the DUL. If I want to connect manually to a destination mail server (use the local sendmail to queue up mail) I'm paying for that service. Similarily, if they block any email destined for me without my consent, I'll change service providers.

I don't like the Spam, and the RBL's targets somewhat justify what they get, but I won't condone how the RBL acts.

They're like the ALF arsonists who would `` `bring to a screeching halt what countless protests and letter-writing campaigns could never stop.' '' by arsoning a slaughterhouse with some homemade napalm.

MAPS is just the coordinator; it's the people who use the list who are at fault and liable for the damages. It's harder to sue the thousands of people who use the RBL than it is to sue the coordinators. The coordinators just make a list.

Re:Hidden costs of blocking.

[egburr]

f an ISP blocks legitimate email, first-time senders will forget it or not try again. Neither you nor they will never know what happened to; you'll probably blame it on the net-gods. But if the ISP doesn't block spammers they get complaints out the wazoo. Which will they choose?

They way my mail server (and probably most ISP's) is configured is to reject the mail, not just drop it. This way, the sender receives a message indicating "550 Mail from x.x.x.x REFUSED as you are on the Realtime BlackHole List. See http://maps.vix.com/rbl/" They know they need to take some action.

Edward Burr

The First Amendment says nothing about this

[DragonHawk]

But the courts may not see it that way. The First Amendment doesn't apply terribly much these days.

Oh, get a grip. To quote: "Congress shall make no law ... abridging the freedom of speech ..."

No where in there does it say "Everyone has the right to say whatever they want, whenever they want, about whatever they want."

People seem to think that the First Amendment to the Constitution of the USA grants protection to all forms of speech. In reality, all it does is keep Congress from passing laws restricting speech. There's a world of difference there.

(Note: I happen to think YesMail's case doesn't have a leg to stand on, but that isn't because of the First Amendment.)

Bad for yesmail

[umask077]

Im use MAPS on all my mail servers. In my opinion its a great service. Unforntunatly for yesmail there suit has forced me to add them to my manual filters for my domains. With MAPS they can answer the complaints of the people an actually be removed. I dont remove anything Ive added. Gone forever is yesmail from the ability to send mail to myself or any of my mail users. If they wont work with maps, I wont accept them. I suggest everyone else just block as well.

But YesMail isn't spam. Its permission based.

[dunster]

This lawsuit isn't about open relays, address-surfing, or other not-nice tactics. If you read the article, its about subscription methods.

If I say "yes, I want this newsletter," and then complain to RBL that I got the newsletter, RBL will blacklist the newsletter. That is just silly. According to the RBL, I have to say "yes" and then later "yes" again.

RBL really ought to change its definition. Double opt-in is too much of a pain in the ass. YesMail is because I said "YES!", not because they bought my address off some porn site.

Re:But YesMail isn't spam. Its permission based.

[Anonymous Coward]

YesMail is because I said "YES!", not because they bought my address off some porn site.

And unless they're doing confirmed opt-in (aka: double opt-in), how do they know it's you that signed up? I can easily go a web site and sign you up. Unless they send the sign-up address a confirmation request, there is no way for them to know that hasn't happened.

The only people who have a problem with confirmed opt-in are spammers, IMO.

The Kid Is Alright. Blind maybe...

[quonsar]

Oh come on, the guy doesn't profess to be a genius or even to be taken seriously:

• Here are raw feelings and thoughts typed in to the beat of loud, raccous music. They are not meant to be taken seriously. If you are in doubt as to what is humor, truth, crap, or absurdity there is always feedback.

Delusions of web design cluefulness aside, the kid is alright.
Besides, didn't his dad play drums for Iron Butterfly?

"I will gladly pay you today, sir, and eat up

Re:The Kid Is Alright. Blind maybe...

[quonsar]

ignore the above post! it is in the wrong discussion. i am either totally spaced, or there is a slash bug.

"I will gladly pay you today, sir, and eat up

Re:E-commerce

[umask077]

> What gives you (or anybody else for that matter) to decide what mail should or should not be allowed? Actually what gives me the right is the fact that A: I pay for all of my own domains B: I own the servers they reside on C: I run my own dns servers and D: Its my fucking mail server. I dont have to accept anything I dont want and Never will have to. If they courts say I have to accept mail from someone Ill allow my server to recieve it but block traffic at the firewall. If they say i have to lift that Ill accept it and deliver it to /dev/null. As long as I am the server admin I will make the determination who can use my machine. Unless there paying for my CPU cycles which there not I dont have to accept it. The minute I am forced to accept it they will get a cpu cycle bill which I will take them to court over. I already sent one fax spammer to collections over an unpayed bill for fax fileing. Ill be happy to do it to mail spammer too if there dumb enough to sue me and provide me with a buisness address.

Re:I would rather filter my email myself

[prolixity]

I love you too.

When 'opt-in' isn't really 'opt-in'.

[Nonesuch]

No, that is not what they are saying.

What MAPS is complaining about is, if anybody anywhere submits your email address to 'yesmail' as having opted-in, they will immediately add you to the mailing list, without first verifying that you really did choose to 'opt-in'.

The verification process is enabled on a subset of the yesmail lists, which is what they call 'double opt-in'.

There have been NUMEROUS cases of spammers submitting the addresses of ardent anti-spam activists as 'opt-in' addresses, it's not an uncommon revenge tactic.

The only solution to this problem is to do 'double opt-in', where an address that has been submitted is sent just one single message, stating 'reply to this message to confirm mailing list subscription', and including a non-trivially-guessable magic cookie to prevent somebody from falsifying the confirmation message as well.

Re:I would rather filter my email myself

[winnetou]

Regardless, the RBL focuses on open relays

That is not completely true, the Realtime Blackhole List doesn't focus on open relays, see their reasons for listing. Perhaps you are confusing them with the Relay Spam Stopper (also operated by the Mail Abuse Prevention System) or ORBS which is far more controversial because it will test mail servers even before they have been used to spam through (OTOH ORBS is more efficient in stopping spam). To complete the set of links, the Dial-up User List lists modem banks (and also machine that get their IP via DHCP).

Re:Go for it!

[winnetou]

is there an alternative way to contact your domain, mr. net.nazi?

Sure, you can use snail-mail or the telephone system.

How about your users -

They have a postal address and a telephone too. You have a right to speak freely, but we are under no obligation to pay for listening to you, in fact we may choose to ignore you any time we wish.

did you give them a say?

Yes, and they like it, in fact I also use MAPS' DUL and ORBS to block even more spam.

Re:I would rather filter my email myself

[jareds]

OK, so some business you buy services from (your ISP), is doing something you don't like (using the RBL). If you want them not to use the RBL, and they still use the RBL, switch to a different ISP. Not all ISPs use the RBL, because no one is forcing them to. You cannot force your ISP to provide you with the exact service you want. Vote with your wallet, get a different ISP.

My mailing list is being harassed this way

[billstewart]

I'm on a large mailing list that will remain nameless. It has a policy of allowing anybody to post to the list, whether they're subscribed or not, because we believe in openness and tolerance of anonymity, and are willing to tolerate a certain level of spam as the cost of open access. Unfortunately, some harasser has recently forged subscriptions to lots of non-confirmation mailing lists, so the list is getting hit with them. Even with confirmation-based lists it's a problem, because the harasser (who's presumably subscribed to the list) can receive the confirmation requests and reply to them, but it does cut down on the harassment, and it makes it easier for other people to do unsubscribes.

Yesmail has just shot themselves in the foot

[bee]

This is likely to be worse for Yesmail in the long run than any simple 'being added to the RBL' could be.

Here's why: even now, many sysadmins that use the RBL are reading this story, and are going in by hand and adding Yesmail to the list of domains they don't accept mail from. Even if Yesmail and MAPS come to an agreement where Yesmail follows MAPS's policy, all those sysadmins that added in Yesmail by hand aren't just going to take them out again overnight. While not as widespread as if they were on the RBL, they will be on many systems' blackhole list permanently.

---

Content-filtering services and libertarianism

[billstewart]

There's a difference between saying "People shouldn't do X" and saying "The government should ban people from doing X". The former is a moral or aesthetic judgement, and libertarians can make any such judgements they like. The latter is an unlibertarian call for government action, which wasn't what prolixity said. Libertarianism can include a wide spectrum of opinions, from "People should/shouldn't watch TV televangelists" to "People should/shouldn't watch porn on TV", as long as you're not calling for the government to ban those options.

In this case, MAPS RBL is a content-rating service, and you might or might not like their ratings. If you like them, you might use an ISP that provides MAPS as a blocking service; if you don't like them, you should pick a different ISP. I use pobox.com's optional spam rating service, with the "mark but don't block spam" option, and it's right about 90% of the time.

Competing Spammer Rating Services

[billstewart]

MAPS is one of several services that rate spammers and spam-supporting ISPs. They're one of the best-known, as is ORBS, who are in my opinion too aggressive and not flexible enough, but that's a matter of taste. But there are other rating services out there. Many email services have anti-spam options - some run their own, some outsource to MAPS, and some don't say. Does anybody know services that do an especially good or bad job?

I use pobox.com as my stable email address, and their anti-spam service has a choice of marking or discarding spam. I use marking, and find it's 90-95% accurate.

And how is what you did any different then spam?

[Byter]

"In my experience, it really isn't that hard to get listed on MAPS. My previous employer decided to harvest Usenet one time to gather addresses of people that might be interested in our service. A couple of months later, MAPS listed us after one person spent some time harassing us to remove his and other's addresses (which we did, promptly, when asked)."

Hmm. "harvest Usenet one time to gather addresses of people who MIGHT be interested
in our services." Translation: You grabbed e-mail addresses from newsgroups and then
sent people at those addresses an UNSOLICTED advertisement. That sounds like SPAM
to me. You may have been one of the few companies that act on good faith and actually
opt-out people who ask for it, but you were still spamming people. These days, maintaining
an
opt-out list (or more accurately, CLAIMING that you maintain an opt-out list) isn't
any excuse
to spam. Most people won't dare to respond and ask to be opted out, because
that marks their e-mail address as ACTIVE and makes it much more likely that they will receive much more spam.

So what really happened here was:
1) You spammed a bunch of people.
2) Someone got really pissed off about it (actually, most of the people probably got pissed
at your company, but didn't respond because they didn't want their e-mail address to
be marked as "active").
3) That person reported you to MAPS and gave them evidence of your spam.
4) MAPS RBL'ed you for being a spammer. (Not just RELAYING spam, but actually being
the source of it.)

"When he finally submitted his "evidence," MAPS listed us right away, without even so much as asking us if his take on things was accurate (which it was not in certain key areas). We were notified, but not until after the listing was made. The damage was already done."

What wasn't accurate about it? They didn't notify you because this wasn't a spammer sending mail through your open relay without your knowledge, this was you KNOWINGLY spamming people!

Once you stopped spamming people (an opt-in list means that your e-mail is no longer unsolicted), MAPS stopped blacklisting you because you stopped spamming people.

Re:Linux / Open Source Bias? What did you expect

[RJ11]

amen.

Re:I would rather filter my email myself

[QuickSilver_999]

---
They're certainly no longer a 'common carrier' once they've started applying filters....
---

My phone company allows me to filter my phone calls by forcing people to disclose their phone number when they call me. I can further inform the phone company that I do not wish to receive phone calls from a certain number. They then filter these calls, and the other side gets a busy signal or other indication that I do not wish to receive calls from them. Is my phone company still a common carrier even though they block some phone calls from some phone numbers?

Federal court jurisdiction

[Brian See]

I really should get back to studying for the bar exam...

The Full Faith & Credit Clause doesn't really have that much to do with Federal court jurisdiction. However, the Supremacy Clause says that federal laws are supreme to anything the individual states can pass (with a lot of exceptions these days).

Generally, Federal courts have exclusive jurisdiction over questions involving federal laws. That's why you'll almost never see a copyright or patent case in a state court -- most IP laws are federal laws.

DHartung, you said, Yesmail is "suing in Federal court because they are seeking injunctive relief under Federal law." This hasn't been established yet. Federal courts, under 28 U.S.C. s1332, have jurisdiction to hear ALL CIVIL ACTIONS in which the amount in controversy is over $75,000 and the parties are citizens of different states.

I've seen nothing in the article or on the MAPS webpage that a federal question is involved. According to the article, yesmail's complaint states that MAPS "would disrupt yesmail's contractual relationships with its advertising business". This type of "tortious interference" isn't covered by any federal law, so we're dealing with diversity jurisdiction.

Anyone up for more civil procedure discussion?

Obviously MAPS is working

[Rewd]

The best thing about this story is that MAPS is obviously working. :)

I hope the publicity generated from this court case causes lots more mail servers to start using MAPS (and ORBS) to block spammers.

Since I switched to using their realtime blocking lists on my server my spam has dwindled to a tenth.

--

Ah, my mistake. MAPS == good. ORBS == bad.

[bkosse]

In *THAT* case, I reverse my stance. MAPS is the good one. It's ORBS that is evil.

How far does ISP accountability go?

[jjoyce]

The only reason I'm still undecided about the RBL is because I'm not sure how this can be used to enforce ISP accountability for things. Vixie wants ISPs to be accountable for spam. Let's say that a court accepts this. How far then, does this accountability go for, say, obscene content? Copyrighted works? Should an ISP just aggressively take down everything that's questionable?

--

Re:Contact MAPS

[nazgul@somewhere.com]

That was exactly what I did after posting my note here. I wish I had some of the content that was sent instead of just the logs. In the future I'm going to start bouncing messages but collecting the headers and some of the body.

How is this different from censorware?

[Megane]

And the makers of internet censorware also only provide a list, which you can choose not to install in your computer.

So if yesmail were to win, wouldn't that mean peacefire.org could sue the makers of censorware?

RBL-style DNS list posted to NANAE

[shadowspar]

For what it's worth, a comprehensive list of IPs belonging to yesmail has been posted. I haven't personally verified it.

Re:And how is what you did any different then spam

[__aaevmb228]

What wasn't accurate about it?

There were factual errors in the report. He talked to certain people at the company and claimed they said things they did not. He claimed to receive messages from us at specific times, when our system logs clearly show that he did not. There were one or two other minor things.

Let's stay on topic, though, shall we? I'm not arguing that what the company did was right (it most certainly was not). The point I was making is that MAPS doesn't check up on an evidence report. They accept it as correct and factual, and list the offender, regardless of the report's accuracy.

I stand by my claim: it isn't hard to get listed in MAPS.

Re:I hope it isn't dial-up....

[mindstrm]

No on all counts.. I have a dedicated line from an ISP. THe type of line is largely irrelevant; it's not dialup.

And as I said, I use MAPS because I *choose* to. Should I choose not to, then I won't.
If ISP's want to get together and form some kwierd kind of anti-spam alliance that blosk all non-registered mail servers, THAT IS PERFECTLY FINE WITH ME! It's their perogative to create their own private mail system by whatever rules they want.

The point is, it's up to me how I want to run *MY* mail server. If I want to incorporate MAPS into it, that's my business.

As for me not being able to send mail.. should that happen, it is up to those servers that are using the service to decide if it is acceptable to them. If it is acceptable to them to not allow me to send them email.. that's their choice.

MAPS is doing *nothing*. IT is up to the ISP's individually to go with maps or not.

YesMail is full of it

[UGNS]

Granted I'm not a lawyer but I have been using MAPS for many years now personally and professionally... If you read the agreements and all pertainant information on MAPS site you will find that YesMail really has no grounds at all as MAPS just provides the list, it's up to the invididuals or companies that find value in the list and make use of it... Therefore if YesMail has any beef to sue someone over they should instead be going against *EVERY SINGLE COMPANY* using the MAPS list not MAPS as MAPS does not force anyone to use the list in the first place...

Re:Free ASSEMBLY violation, that's what it is.

[Thorsett]

I manage my own email system, and together with many other sysadmins I choose to block probable spam. I have a constitutional right to associate with others who share my ideas, interests, and goals. One way that we in the anti-spam community pursue our common interest is by sharing information through the RBL list -- reporting violators to MAPS and using information reported by others. Allowing a company to prevent one sysadmin to block sharing of information with another by censoring the RBL list prevents us from banding together to pursue cooperative action. In the words of Justice Harlan in NAACP v. Alabama: It is beyond debate that freedom to engage in association for the advancement of beliefs and ideas is an inseparable aspect of `liberty' assured by the Due Process Clause of the Fourteenth Amendment, which embraces freedom of speech.

Lawyer: me, too :)

[hawk]

[great, now I get rbl'd for that AOLism . . . :) ]

I am a lawyer, this isn't legal advice. If you need a legal advice, see an attorney licensed in your jurisdiciton.

I'm a US lawyer, and agree with geeklawyer. Our procedure isn's all that different than the brits--where do you think we got it from? [but we don't have to wear wigs :)]

A TRO is *really* easy to get--but *all* it does is protect the status quo; you can't get something ordered *to* be done.

I'd be surprised if the preliminary injunction issues at the hearing in a week or so. I expect the free association issue to utterly blast everything else out of the water. Even without that, this does not seem to be the type of behavior that would be a tortuious interference with contract (It's *really* hard to commit that one), and a libel action would seem difficult, as the yesmail description makes it sound like they commit the behavior described in the list.

As a side note, the protections for speech in this area tend to be stronger (for the speaker) under US law than british law.

Personally, I'm adding yesmail to my own list--just as soon as I figure out where debian keeps it :)

hawk, esq.