MAPS vs. ORBS

Well, we held or deleted the first few hundred submissions, because we were hoping the situation would clear up and we could figure out what was going on. But it hasn't cleared up, so we're posting it and hopefully there are some readers out there who know what's going on and can shed some light. It seems that the anti-spammers at MAPS and ORBS have gone from a cold war into a shooting one, with MAPS listing ORBS on their blackhole list. ORBS accuses MAPS of doing it for financial gain, MAPS accuses ORBS of attacking systems, Alan Cox gets peeved about spam, kuro5hin.org has the obligatory "Slashdot is censoring the story!" postings but has at least one seemingly clueful post, and the U.S. House passed an anti-spam bill yesterday - coincidence, or devious conspiracy?

Comments

Totally Unnecessary

[SgtPepper]

kuro5hin.org has the obligatory "Slashdot is censoring the story!", postings but has at least one seemingly clueful post

Why did you mention that? There is no point other then to cast K5 in a bad light, a light which is certainly not true. K5 is NOT a /. haters site, if anything it's a compliment to it. /. and K5 together make for a very powerful source of news and views. And BECAUSE of their different structures you get two different faces. K5 is what it says "Technology and Culture, from the Trenches" whereas Slashdot is "News for Nerds, Stuff that Matters". K5 is SUPPOSE to be a bit rougher and raw, this is what makes it different, and is not a valid reason for beating up on it. I apologize if this comes out wrong, it just gave me the impression of the school bully picking on the new kid. And for the same reason that the bully picks on the new kid, it came across that maybe /. was getting "worried". It smacked of corpratism, and take note that I am NOT a /. "Big Bad Corp. They sold out" person. But how many times do you see the NYT go " and the Washinginton Post's editoral comments were the usual NYT sucks varity" now granted, it's different worlds, and maybe sometimes they do say something along those lines, but it looks very unprofessional and frankly not very friendly. Mentioning K5 is great, but the tone was very "put offing", specially considering how much slashdot is mentioned on K5 in favourable light, and almost NEVER by a article is it mentioned unfavourable.

Sorry for the rant, I'm going back to enjoying Slashdot AND Kuro5hin now.

Re:Additional Background and Perspectives

[FreeUser]

Quoting myself:
If you wish to follow up flat denials with hard evidence, I'd be interested in seeing it, but your flat denial of wrongdoing simply doesn't cut it in light of all the evidence to the contrary.

Allow me to save you the effort. :-)

As another post pointed out here the situation is clarified and apologies are given and accepted all around. Apparently it was an innocent ISP foul up, or else someone is very good at spin control (I tend to believe the former rather than the latter).

I am delighted to have been 100% wrong about this.

YA "here's what seems to be going on" comment

[sethg]

Hmm. It looks like:

1. ORBS has systems that probe hosts all over the Net to test whether or not they are open relays. If a host blocks the ORBS probe, ORBS will note this fact, and some ISPs that subscribe to ORBS will block that host, even if that host is not really an open relay. (By comparison, the MAPS systems will only probe a host after someone has complained about getting spam from it.)
2. Some of MAPS's own mail servers refuse connections from ORBS's probes. Therefore, ironically, ORBS blocks MAPS.
3. Above.net has decided that the probes from ORBS violate the above.net Acceptable Usage Policy. Therefore, the hosts that send out these probes are blocked from the whole above.net network.
4. MAPS uses above.net as an ISP, and Paul Vixie is one of the big wheels at both MAPS and above.net.
5. Manawatu Internet Services (MIS), an ISP that serves other ORBS machines, uses NZ Telecom as an ISP, and NZ Telecom uses above.net as an upstream provider.
6. NZ Telecom set up its routing tables incorrectly; they could and should have set them up so that MIS could access ORBS machines through another upstream ISP.
7. Some folks at ORBS noticed that they were having trouble with their email (as in, it was taking over a week to get from Europe to NZ), and a cursory check suggested that above.net was sabotaging their email traffic.

[pulls string on talking Barbie] "Network administration is hard."
--

FINALLY!

[seebs]

Let me say that this is *not* about "competition". This is about stopping network abuse.

I know a guy whose mail server is buggy. It is *NOT* insecure. You cannot relay mail through it. The bug is this: Certain addresses will crash it. The mail doesn't go through, but the mail server crashes.

ORBS crashes his mail server. Up to seventeen times per run. Over and over. They won't stop.

Some postmasters get email every time a relay attempt is made and fails. They are getting mailbombed by ORBS.

ORBS is doing the same thing spammers are doing: Using the email system, and refusing to stop when asked.

Even if you get on their "static" list, they'll probably still spam you occasionally. But, think about it: Is it fair for a system which claims to block "open relays" to also, if you turn it on withuot knowing about the "static" list, block mail from anyone who dislikes the constant and repeated tests?

Is it fair for them to tell their users that you're a spammer, if you tell them you don't want or appreciate their testing? Remember, we're talking about systems that are *NOT* open relays!

Finally, only ORBS has maintained spite listings. MAPS has never maintained them. I'm sure someone will find a case where MAPS listed a system that was not involved, in any way, in mail abuse. I bet you can't find one where the listing stuck past the first complaint.

ORBS has consistently condoned mass scanning of netblocks. They have encouraged people to scan whole netblocks, and resubmit any hosts they find to ORBS.

ORBS will list systems that cannot be used to relay actual spam. ORBS will list anyone that complains too loudly about them, or plays games with their tests. And they will list such people
out of spite, not out of any desire to eliminate spam.

Some people have put network-wide filters on the address space ORBS probes from. ORBS retaliated by starting to farm out relay probes to external sites. You know, just like what spammers do when you block their unwanted communications.

The only thing I think the RBL did wrong in this picture is let it go so long. ORBS has been abusing the email system for a long time, and has done a lot of stuff out of ego and spite. It's time *someone* reminded them that you can't abuse the email system forever.

Re:FINALLY!

[Weezul]

Well it sounds to me like we don't need ORBS anyway. We should just add a feature to sendmail to test every system from which it recieves mail and kill/bounce the message if the system is an open relay. This test dose not really need much bandwidth.

Shure, it would crash some people's boxes, but who cares. It would only crash their boxes when they sent mail to someone running this modified sendmail. They can fucking figure it out and DL the patch.

Plus, there would be no centralized blacklist. It would just be a modification which every admin has a choice of installing.

Here's the Real Facts

[cananian]

Check USENET: This isn't a MAPS-ORBS shooting match at all: OR BS is not in the RBL. MAPS is not blocking ORBS.

This is a simple ISP fuckup. Telecom New Zealand screwed up.

And here's the start of the apologies. Paul Vixie apologizes, even. They all shake hands. Well, maybe not really, but still:

The story as reported is all lies and misinformation.

Why neither should be used

[Mark F. Komarinski]

If anything, this shows why MAPS and ORBS should not be used. Centralized "blacklists" are a bad idea to begin with, as:

a) The server admin has no control over what sites are blocked
b) They change dynamically and could potentially block sites you were talking to days before.
c) Petty disputes like this one will cause trouble.

If you want to do your own spam filtering on your own site, that's fine. Depending on someone else to tell you who you should block is just asking for trouble.

Sorry to see that Alan has to use draconian filtering. Without it, I'm sure he's going to get a lot of e-mail, mostly spam. As it is, I get 200+ a day, and noone knows me.