rlsnyder asks:
"I'm the inadvertant co-administrator of e-mail a for company that relies pretty heavily on it for daily business (e.g. sending confirmations of financial transactions). At one point in the not-too-distant past, our server was an open relay. I admit I'm a sinner for letting it happen, and I'm ready to do my pennance. Given the relatively low volume of mail our server moved that did not originate from inside, I doubt I was a major contributor to the world of SPAM. In any event, we've been blacklisted on a number of sites. Some lists have reasonable policies, and we've since been removed. Other places are a little more arbitrary as to removal policies, and although I can prove we're not a relay, we're still listed." While I approve of the basic concept of SPAM Blacklists, there are dozens of SPAM blacklists out there who are real keen on adding open relays to the list, but not so keen on taking rehabilitated hosts out. I would posit that SPAM blacklists that are not properly maintained are a part of the problem, not the solution. What are your thoughts on the subject?
rlsynder continues: "Am I way off base here, or is this self-appointed mail police thing going in the wrong direction? Given that I can't reliably deliver e-mail to a number of places due to being blocked, I've got a big exposure. Is this making spam less of a problem, or are we trading one problem (SPAM) for another (the reliablility of proper maintenance of SPAM Blacklists)?
I could draw a bunch of analogies here, but isn't the bottom line that no one owns the internet e-mail system? I realize no one makes ISP's subscribe to the blacklists, but basically, I'm trying to move data from one point to another, and some machines in the middle are discriminating against my data because a corrected, perfectly legal system configuration error. How is this helping? Has SPAM really decreased universally thanks to these lists?"
Slashdot Mirror
The company I work for had the same problem. As a result, we ended up having trouble getting e-mail to some of our customers. Thankfully, it was easy to get ourselves removed, but I think if people are going to use blacklists, they should also take the responsibility of keeping them maintained, both in additions and removals.
When I used to manage a mail server, I was asked to filer based on orbs. Not did this in no significant way limit the amount of spam entering the system, it became a huge administrative headache. Eventually, we stopped using the lists. I am sure there are likely better lists, but I simply prefer creating my own list, based on investigation into what's coming in.
Hormel Foods has stated they don't mind the use of the word 'spam' to refer to U.C.E., or junk mail, as long as people don't use the term spelled in all-capitals. Hormel owns the trademark on the meat product, SPAM. Given their more-reasonable-than-average position on this, let's respect their request?
[
I like the idea of something like MAPS-RBL, but I think many of them are bad hacks put together by guys who take the spam thing as a holy crusade. I don't really have a problem with that, its a free country, you do what you want.
However I fault ISPs for using them without understanding their policies. Many ISPs use these small-time black-holes because they don't want to use MAPRBL (I assume its a money thing at this point). And if you get listed, how do you know that you're listed? You don't until somebody calls somebody and says "I can't get mail through to you". There needs to be a better way.
And some sites, its not worth getting delisted. "www.joes.antispam.site.com" isn't worth the effort one way or the other.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
Although I am not sure of a solution to the poster's problem, I must take this time to note that your company can lose business if you use certain ISPs.
... basically, even if you're not involved in SPAM, you never know if your IP has been used for mischief in the past, or if your ISP is a moron.
A good example is Rackspace. Yeah, you've seen those ads and think Rackspace is full of good little geeks, but many spamlists block all of Rackspace's IP blocks from sending mail. They host many repeat offenders and do very little to combat spam.
This is just one example, though
-d
In this day and age, there's nothing stopping blacklist coordinators from automating the rehabilitation process: Select your host and click 'Check me now!' Passing verification removes one's host from the list.
"It remains to be seen if the human brain is powerful enough to solve the problems it has created." Dr. Richard Wallace
You wanna live in a crack house? Don't go whining to the cops when you can't get a pizza delivered at midnight.
You wanna get bandwidth with a company that provides services to spammers and relocates spammers to IP addresses to avoid blocking of single IP addresses, don't come whining to /. when the rest of the world wants nothing to do with your ISP.
If someone spams me, I block the IP address. If the ISP relocates the spammer to another IP address in the same netspace, I say "fuck it", and block the /24. Or the /16, if need be.
Don't like living in a crack house? Move.
... but dammit, they just don't seem to be getting my e-mail! I'm going to start having all my friends send them a few mails as well... *sigh*
A feeling of having made the same mistake before: Deja Foobar
major enough to merit listing.
Keep petitioning to be removed -meanwhile-
let this be a warning for the rest of you.
This is a fallacy that continues to be propagated. I own my own mail server. The company I work for owns its mail servers. We can both decide who we want to allow to send mail to our users.
At work, we use two open relay lists; ORDB and ORBZ. Nobody forces us to use them; it's our server cluster, and our choice.
The reason we use those two systems, however, is due to the reasons pointed out in the article. Some blacklists are far too easy to get onto, or hosts are arbitrarily added by humans. The only way to get onto either of those lists is to be an open relay. The only way off is to be automatically retested and found to not be an open relay.
I've only noticed that spam is getting harder to filter because of the blacklists. No longer are they all coming from a dozen or so servers, but instead hundreds.
><));>
I agree that these blacklists can be annoying. I could be wrong, but my alma mater's mail server which I use, byu.edu, seems to be blacklisted by earthlink.com and maybe a few others. But, when I send messages, I never get a response that these are denied. I send an email, and it doesn't get there, no errors or anything. I was doing some ebay business and I had to use a free internet email site with 4 pop-ups per page load, just to communicate with others. Really annoying. Anyone have any insight into the blacklist mess, perhaps how one can test it or find out?
P. S. And how come I never got those pics of Teen Sara27 XXX 18th birthday?
We have had customers find themselves on SPEWS. We just set up a smart host on a colo and have thier mail server direct all outgoing mail thru the colo. This way, the non-spammer does not have to re-locate and SPEWS has to do their own dirty work.
No replies made to AC posts. Please log in.
ordb.org is a great site for this. They are very professional with both addition of servers, and subtraction of them. My mail server was an open relay for a time till I got an email from them saying that I was blacklisted. I quickly fixed the server, and submitted that my site be checked again, the next day I was taken off their lists, very easy. They run about 20 tests connecting to your server and sending e-mails for the most common way of sending spam. Also, as they say in their faq that they reload their lists every hour to get servers off it quickly. Well done!
OK, you've fixed your mail relay(s)..
This is a good thing - and what every blacklist's ultimate goal is.
Speaking as a mail server admin, I'd be interested to know which lists are not removing you - so that I can make sure I'm not using them.
Seriously - letting people know about this is the best way to get what you want. If your site is not a relay, any blacklist maintainer is doing their users a disservice by listing you.
As a mail admin, I'd want to know.
Alternatively, you could do the American thing and threaten a lawsuit - most blacklist operators are immune from libel charges because they're just listing people who operate open relays (truth is defense against libel) - if you're not an open relay, then you've got a good case for libel: they're deliberately publishing false information to hurt your business.
Yep, that's the root of the problem: there are a number of for-free blacklists out there which are professionally managed. Those are the ones that should be used.
And as long as we publicly point out the blacklists that are being poorly run, people will stop using them, and switch to the good ones (like RBL, RSS, DUL, ORDB). The solution is not to ban or otherwise stop using blacklists, the solution is simply to (vocally) promote the ones which stay on top of the problem.
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
I'd just like to give some props for SpamAssassin.
If you haven't heard of it, it's an elegant system that assigns a weight to each email message based on hundreds of different tests, and if the email scores over 5 (configurable), it is marked as spam.
One of the nice things about it that is it uses most of the email blacklists, but they're only worth ~2 points, so being in a blacklist alone isn't enough to kill a message. That's good for those blacklists that throw far too many people in that don't belong (osirusoft). It also uses razor, but that is only worth three points, so if someone is piping bugtraq to razor-report (that happened for a while) you won't lose all that email.
There's a really interesting set of tests (it's fun to read them) each with an obscure set of points including:
HTML with a non-white bgcolor (1.2)
Claims conformance to obscure spam law (1.0)
HTML mail with no text portion (3.33)
Various spam phrases (various points depending on how many "hits" there are)
Subject ends in an exclamation point (0.5)
The points have apparently been calculated using some program to give the best accuracy.
Anyway, SpamAssassin is the best of the spam removal programs I've seen. Give it a shot!
Being added to a blacklist without being informed of it is wrong. I was added to a blacklist due to an oversight in my mail config. We were not generally an open relay but in specific instances we were.
Any time that happens an email should be sent to postmaster@(reverse dns of mail server IP address) to inform them of the action being taken and the specifics of their openness. Just "you are running an open relay" is insufficient.
Also the ability to quickly remove the address from the blacklist when the other mail admin repairs the problem is important.
I don't particularly like blacklists but something must be done to discourage open relays and for now they are the only option.
Coding Blog
Wouldn't it just be a lot simple if the mail servers, when they receive a connection from an smtp server to deliver mail, make another connection back to the smtp server on port 25. If the connection can be made, then it means that it's an open port, and therefore the mail is rejected? Wouldn't this be a sort of "dynamic blacklist"? That way, mail from an open port is never accepted.
And the men who hold high places must be the ones who start
To mold a new reality... closer to the heart
What if it used to be a crack house, but the neighborhood cleaned up and was safe?
Spencer Ogden
since you are "ready to do my pennance.", all you need to do is bring up another host with a different name. as much as you can come up with analogies, so can i. one is: if you're a child molestor you're labeled for life. notin' you can do 'bout it.
When you set up a mail server, never EVER write:
host_accept_relay = localhost:192.168.1.0/2
when what you want is
host_accept_relay = localhost:192.168.1.0/30
It took me ten long hours to figure out that I allowed 1/4 of the whole Earth to use my relay, when I wanted 4 computers on a private network. And it was probably the worst 1/4 of the Earth, every C-class network... It was a long day which I will never forget. In this ten hours I read more about smtp than ever before... So remember kids, don't do this at home!
~shiny
WILL HACK FOR $$$
And since nobody owns it, individual administrators/companies get to handle it the way they want. Without anybody being able to claim he has a God given right to deliver email to their systems (or even route it through them).
It is not the choice of blacklist maintainers to block you. It is the choice of a mail admin who is fed up with spam to try to block open relays. For that, he informs himself at a blacklist maintainer, but he still makes the decision himself. And currently, the credibility of that information apparently is high enough to warrant him blocking your access.
Personally, I wouldn't use a blacklist that doesn't have a good mechanism for administrators to get themselves of that list. But again, that is my choice. Somebody else may chooce to disallow you access to his system, because it is HIS system.
These days if you want to screw up somebody, you just find some open relays and send some junk mails saing to visit his domain. It doesn't take too much to convince its ISP to shut its domain down even if there is no evidence that he was the person that sent the spam.
And that is because the spammers are so agresive these days, people does not distinguish them anymore from inocent guys.
Your problem is twofold. First, while you've cleaned up your open relay, plenty of spammers and spam-friendly hosts make the same claim and lie (Rule #1: Spammers lie). So you may have to be patient.
More importantly, your server ip may now be sitting in hundreds of private blacklists of mail servers whose admins don't like to use the centralized lists, and just reject/blackhole spammers on their own. It is the presence of well-trusted centralized blacklist services that gives you even the hope of ever having decent communication, because without them, you'd get into a thousand tiny blacklists and never get out.
(P.S. Note that if you're checking your status using the rblcheck tool at http://relays.osirusoft.com, it will tell you about a lot of blacklists that are not intended to be publicly used and not part of the usual osirusoft dnsbl, as well...)
Crack house? A bit harsh considering the guy simply had an open relay which he then fixed.
You really think this is a valid analogy? Go spend a night in one, then go back to our cushy world of sysadmin stuff.
Didn't think so.
I'm betting he was asked to install a server - prolly a turnkey type - did so, and watched it chug along for a good long time before someone found out it was open and started using it.
More like finding a crackhead in your garage, eh?
Gee, ya think maybe he missed the giant neon sticker that came with the mailserver manual that said "your box is an open relay by default. fix that. tag - you're it!" Oh, right - that's because there is no such sticker.
If they maintain the lists, they should *maintain* them, not just treat them like a brick wall and simply pile up the addresses and leave it at that. My experience with orbz is that they don't pay attention to the people in the middle - I've been there.
Just takes a little bit of hard work, and this guy's apparently willing to do his part.
Lighten up and tackle the appropriate problem.
--Jake
The real question is did you only close down the open relay because of the black list? If that is the case then the black list did the job.
If it was painless for a site to become an open relay and then they could just stop and say "I'll play nice now, take me off the blacklist" there would be no real penality at all for running an open relay and even more spam than there already is. Sounds to me like the system is working. When you finally get things cleared up you will be more careful and other sites might learn not to run an open realy from your experience, rather than learn there are no real consequences.
My ISP won't subscribe to any lists, nor will they do any blocking of any email. Fortunatly, they don't have a problem with me setting up my own filters with procmail...
Some blacklists, I agree, are just overly sensitive. My ISP got mailed about being listed due to a resolved incident *6 months old* regarding the formail.* exploit. The list's webpage basically said "we might delist you, maybe not, you've already shown yourself to be a poor admin once, why should we give you another chance."
Sites/lists like that tarnish the whole anti-spam movement in my opinion. (and, IMHO, those who would use such a list probably isn't worth talking to anyways...)
I do like lists like SPEWS and MAPS-RBL since they're designed to get people to STOP providing spam services, albeit through negative re-enforcement.
As for the whole idea of shared lists, better to be put onto a list like MAPS or SPEWS, than to end up on 100s (or 1000s) of private lists maintained by admins around the world. Unlike the larger lists, an independent admin isn't likely to remember that he's started blocking an IP range after he stop seeing spam from it.
As it stands, I very much doubt large chunks of Asia will ever be allowed to send email to The West ever again, unless they get new IP#s and change their TLD... For instance, it's going to take an awful lot of convincing before I'll start accepting packets from *.cn again...
I agree that some BL's are not properly managed. The old ORBS system was a perfect example of this. They would add you if you were an open relay, but getting OUT of the database was pretty much impossible if the guy that ran it didn't like you or your attitude toward his "service".
One of my mail servers ended up on ORBZ as well as ORDB because I had made a mistake in the configuration, and I corrected it and was promptly removed after submitting a re-test request.
I now employ the use of RBL on my own servers, but I will only use those services which will remove "fixed" servers using an automated testing system that works properly. ORDB, ORBZ and Osirisoft's RBL's tend to be the best AFAIK. I have found that by using these systems, the level of SPAM that my users and I receive has dropped to a point where it's not entirely annoying or time-consuming to deal with it anymore.
One RBL that I stay away from using is the one operated by SpamCop (bl.spamcop.com). It's a great idea, but it ends up blocking out too much "real" e-mail as well, esp from the larger ISP's like Comcast, etc.
You should be worrying about the private blacklists, like the one I maintain for my host. When I get spam, I drop that host in the blacklist, and they never, ever, ever get out. Multiply my system by thousands.
Spam is destroying the usefulness of email. People are being forced to take extreme measures to fight it. Don't like those measures? Don't spam, and don't run an open relay, and don't help spammers, in the first place.
Disinfect the GNU General Public Virus!
I think as an internet community we must be firm with spam, and therefore I can totally understand the blacklist view. Not even contemporary 'spaminators' stop all spam, and although it's just a little extra email, I think most people would agree it's one of the worst aspects of cyberlife.
"I only speak the truth"
Karma: null(Mostly affected by an unassigned variable)
rlsnyder asks Has SPAM really decreased universally thanks to these lists? Well, it is hard to say. Spam has increased monotonically since its inception, and it continues to grow. It is possible that blacklists have helped lower the rate of growth.
What blacklists really do is get the attention of sysadmins, and get them to take the problem seriously. I, like rlsnyder, was victimized in the same way -- our mail server was an open relay, we forwarded some spam, and got blacklisted. It took me a week or so to get it straightened out, and in the process I learned quite a bit about the UCE problem. rlsnyder similarly has been enriched by the experience, whether he agrees to that at this point or not.
One always has the option of sending mail from one of the many free mail systems. If your mail is blocked while your case is being reviewed, then send it from hotmail or someplace like that. That's what we did. In took about a week for the last of the spam reporting services to delist our site, and while it was inconvenient, it wasn't devastating. It won't be for rlsnyder, either, I trust.
The big problem is that there is nothing to stop the spammers. People who relay mail through unsuspecting companies are already criminals, they will not be dissuaded by laws. The only thing that the anti-spam community can do is to try to put a finger in all 2^32 holes in the dike, and the only way to do that is to educate people. The blacklists are that education program
thad
I love Mondays. On a Monday, anything is possible.
Gee (Mr,Ms) Insightful, I never would have guessed that.
One of the common things that people complain about on my ISP (Demon Internet) is that of the 'smart hosts' (servers that relay the mail to avoid you having to send the messages direct to the recipients) being marked as being open relays due to people having badly configured mail servers that use the smart hosts - or even open proxies that can be used to relay through these smart hosts. Whenever these smart hosts get listed on the blacklists it affects all customers of the ISP, not just the offending customers who have these open relays. Admittedly Demon should take a harder line on these people who have the badly configured mail servers/proxies - and indeed there was a recent announcement by Demon that access to the smart hosts would be cut off if abuse was detected - but even then its usually too late - the hosts have been already marked as open relays. Perhaps there should be some way of preventing these smart hosts from being added to the blacklists.
I ran a simple procmail filter for a while, and I was astounded how much spam I could nuke by filtering based on subject line punctation. Some of my triggers:
more than 2 exclamation marks
more than 2 dollar signs
All caps
etc etc.
Worked pretty well, for its simplicity.
I see it like this:
Think of it as a type of "Megan's Law". If you're a sex offender, then you're put on the list. I don't care if you reformed or not, you're still on the list for everyone to know.
Now here you are. A verified spammer (or cause of my daily headaches, i.e. spam). So now you're blacklisted and partially fscked... And back to being your fault?
You got what you deserve.
Whether or not blacklists are a good idea? Well, that can be questionable because DNS #'s do and will change over time. Blacklists are not completely kept up.... Maybe someone on slashdot has the answer so keep checking...
www.slightlycrewed.com - Because aren't we all?
Exactly who in the world is going to mistake a mystery-meat product like SPAM(tm) with a general concept of unsolicited commercial email? Additionally, even if people do mistake one for the other, how is this going to affect Hormel's financial situation? Seems to me this particular trademark spat is pretty dumb. I for one will continue to use "SPAM" or "spam" or even "SpAm" as I see fit.
I don't want to live in a crackhouse, but I don't want to live in a cave either.
Spammers are relentless in searching for open relays. One misconfiguration and you're blacklisted.
Goodness, we weren't even open for 30 mins, but 3 months later and we are still on several blacklists (after numerous mails begging them to test us and remove us)
This isn't rocket science. Admins need to be as diligent removing blocks as they are at placing them.
hehe why isn't the above comment modded as funny?
At a certain midwest university lets call it Boiler University they use to have an open relay on the university-wide mail server. On the CS mail server for this certain university they obtained and implemented a blacklist for 'SPAM'. As it turns out the main university server was blacklisted and thus the CS server started rejecting all mail from the main university server. Talk about one hell of a troubleshooting task.
We got blacklisted by ORBS. Took over 24 hours to get off the list despite the problem being fixed in 10 minutes.
We're a business that gets email from customers. A blocking list potentially blocks valid email from customers so we have chosen to live with the spam than risk using a blocking list. The blocking lists are probably OK for personal use.
Anyone recall the debate over web filtering software, and that no-one could be certain what sites were being blocked?
I recently discovered that any e-mail I sent with the return address listed here (and elsewhere on the web) will not get through to AOL. There's no notice of this of course, so I just never got responses from people on AOL. This had nothing to do with my mail server (I tested this with multiple mail servers and return addresses), it was completely based on the Reply-To header - changing the reply to address fixed the problem. Based on my experience, I see two main problems with blacklists:
Without notice that your message was rejected, it seems like the message is getting through, but the recipient is unwilling or unable to respond. This is a real pain with eBay, especially with Paypal payments (the sellers apparently never noticed that money had magically appeared in their accounts unless they received an e-mail notice).
Basing the filter on the Reply-To header is rather stupid, because it can easily be changed or forged. Spammers can simply spam under your address until it gets blacklisted, then move on to another, leaving you screwed. Sure it is simple to just change your return address, but how do you know that you have to if nobody tells you that you're blacklisted?
Big Deal. Diid you know McDonald's owns a trademark on the phrase "Smile" ? (Yeah that's right. It used to be on their cups when they were running some "Smile your at McDonal's campaign or something) Kimberly-Clark owns the trademark on Kleenex, do you think the cops come after me whenever I call my no-name tissue "Kleenex"? The point is, just because they own a trademark doesn't mean you can't use the word in whatever context you like, it means that you can't sell products under that same mark in the same field, or otherwise portray your products to belonging to that mark when they don't.
Try actually reading the question. The complaint is not about blacklists in general, but rather about poorly administered blacklists.
Meat product? I thought we were talking about SPAM?
*rimshot*
Thank you very much, folks. I'll be here all week. Remember to tip your waitress!
After lurking on news.admin.net-abuse.email for a while, I've seen a lot of mail admins post asking to have their servers un-blacklisted because they've "cleaned up their act" only to have it pointed out to them that they are still hosting spammers.
Perhaps you could tell us where you have been blacklisted and what IPs are listed so we can see for ourselves the veracity of your statement?
Are they a bad idea? From who's point of view?
As an administrator, I think it's a bad idea for ME to use a spam blacklist. Why? For the reasons you specified.
Do I think it's bad for people to use blacklists? No. IT's their choice.. and you cannot force them to accept your mail.
Just as I can block your mail for whatever reason I like.
You were a moron. Accept it, fix your mailer, and contact the anti-spam registries. Nobody ever claimed they were perfect. Nobody ever claimed there isn't a period of time during which previously ignorant admins' mail servers' users are punished. People use them because spam has become unbearable and the advantages outweigh the disadvantages.
Yeah, but what happens when it's a stupid customer who gets your mail server on a blackhole list, because they stupidly installed Exchange Server, which relays mail through YOUR server. They are on your IP, so your mail server lets them through.
Before you know it, you're on a blackhole list. You call the customer, get it fixed, and then find getting off of those lists is impossible... Seems the whole "slap on the hand" principle falls apart here, cause you weren't the one w/ the open relay..
Customers are a necessary evil of being an ISP.
Your logic is... fuzzy.
First of all, your crack-house metaphor is absurd. Secondly, your "if you dont like it, move" mentality is so amazingly worthless, I'm surprised i'm even taking the time to point it out.
If you don't like it, try to make it better.
Oh shit! I forgot to click "Post Anonymously"...
Why are you guys getting on these lists in the first place? It is a disgrace in this day and age to expose an open relay to the internet. This happens in a 'financial insitution'? Problems with blacklists aside, the real problem lies with everybody thinking they are fit to be admins and the managers not being able to pick the right people for these jobs. If e-mail connectivity is _that_ critical you can certainly mopve the server to a different IP in your block or arrange for an upstream smart relay that isn't black listed. Oh I forgot, that requires actually understanding what you are doing and we cannot have that -- reading slashdot religiously is the only qualification necessary for admining.
Understanding? Does that require GNOME?
IMHO, at some point there will be legal liability affixed on poorly managed blackhole lists. Negligence will be real hard to prove against a well run list, and of course no ISP is required to use any particular blackhole list, but just creating such a list and then NOT MAINTAINING it is bad karma at the least and potential libel.
"Everyone is entitled to their own opinion, but not their own facts."
if its no long er on their cups then its not in use anymore and thus they no longer own it. And I don't beleive they owned a trademark on the word smile, just the stylized(sp) way it was on their cups, I beleive it had a little smiley mouth under it which was part of the TM.
--
WHO ATE MY BREAKFAST PANTS?
I inherited an open relay when I came to work for a small company. I never got blacklisted, though once upon a time I got a warning message from ORBL that I was an open relay...I fixed that right away.
/dev/null incoming hotmail.com and yahoo.com because they're fed up with the spam. There are people who will blacklist you if you don't have an abuse@yourdomain.com account set up. It is ultimately up to the mail admin at the receiving side, and you're gonna have to deal with that on a case by case basis.
I suggest you read through the spamtools mailing list archive at abuse.net, or better yet join the mailing list. I'm sure that you will have more success getting de-blacklisted if you communicate with some of the blacklisters who are on that mailing list.
Realize that there is a huge variety of opinion regarding spam, SPAM, UCE, UBE, and so on. Some people like to
But, if you've fixed your relay (and maybe your formmail.pl vulnerability too) then you shouldn't have too much of a problem convincing a *reasonable* person to take you off his list. (Unless you are actually a spammer...) Be warned that there are *UNreasonable* people as well, spam Nazis who'd make you wear a yellow "known spammer" armband if they could. Good luck deailng with them. Those guys are proof positive that noone owns the Internet, and you DAMN well better play by THEIR RULES if you want to use THEIR SERVERS!!
A good point. That's why I'd buy SPEWS a beer.
The system appears to be automated -- if the blocked host stops sending spam for a long enough period of time, SPEWS appears to unblock it.
If, on the other hand, the spam continues to issue from the blocked host, SPEWS appears not to unblock it.
From what I've read in news.admin.net-abuse.email, the length of time for which a provider remains in SPEWS appears to be proportional to the length of time the provider ignored abuse complaints.
Contrast this with a privately-run blocklist (e.g. my "fsck it, block the /24".) I can't be bothered to check if the /24 has cleaned up. There are IP address ranges all the way back to the days of Cyberpromo that I haven't been bothered to unblock.
The advantage of SPEWS and its ilk is that 1000 systems can be unblocked. The problem with the blocklist on my own system is that I can rarely be bothered to unblock it.
(In crackhouse terms, SPEWS reads police blotters, and if it stops seeing crime in a certain area, allows pizza delivery. I'm the crusty old Italian guy who says "No, you can't deliver to 48th street, it's a war zone, at least, it was the last time I tried to deliver a pie there sometime in 1996!")
First a disclaimer: I don't like blacklists.
;)
Until very recently I worked for an ISP in North East Georgia called WhiteLion.Net. I'll admit, our revenues were getting low, and we had the opportunity to colocate servers for a company that did bulk emailing. They paid us a lot of cash for this. The company is now out of business due to unrelated things. However, during our spam stint, we got placed on a number of blacklists, including one called SPEWS. We removed the servers about 3 months ago when UUnet threatened to cut our lines. *NO* spam has originated from our network since then, but, even though I have notified SPEWS of this, they either don't care, don't believe me, or something. Any way, they STILL have WhiteLion.Net's IP blocks banned, as well as some IP blocks that didn't even belong to it. I posted a remove request on the newsgroup that the SPEWS faq said to post on and got a whole slew of really hateful replies. My point is this: these blacklists are not a way to prevent spam so much as a way to punish ISPs for spamming or open-relays. If they were really about stopping spam, then the block should be removed when the spam stops. Instead they leave them up. I'll admit, there are probably people out there who say they don't do such things any more and are lying their ass off, but instead of taking each case individually and dealing with the offenders one at a time, they all get lumped together regardless of the level of offense, or the level of repentance. If you want to read some REAL crap, just go on to google groups and search for 'Chad Singer'.
[Is Greek the Professional Language of Lawn Mowers?]
Is slashdot ever going to remove those stupid -1 posts from the archives?
I use several blackhole lists.
... so I had to turn them off.
... nobody uses cuz they block too much legitimate mail.
In the real world, the users want this, but the ones that cause more trouble their worth don't get used much.
I had a couple favorites that blocked all spam. All of it. But they also started blocking things like hotmail and yahoo!
And that's the thing. The blackhole lists really do work. But the stupid ones
Imagine if you weren't allowed to use roads because a bus company complained about your driving 3 times. --skunkpussy
spam is a serious waste of energy. We're filtering roughly 3000 messages per week. It's unfortunate that you've ended up on those lists. It seems any successful hosting company will end up being fingered as a spammer at some point. In the case of the companies I've worked for, we've been innocent. One, a mainstream hosting company, was stuck on a blackhole list, which we never managed to get removed from. One customers ISP used that blackhole list, and he was very upset that he couldn't have his domains Email forwarded from us.
:)
There are better solutions than using the "blackhole" lists to block someone, like yourself. Recently, we've stared using MailScanner, which uses SpamAssassin for spam identification by pattern recognition, blackhole lists, and Razor for spam identification through cataloging. MailScanner and SpamAssassin are very nice in that they don't just "black hole" you, they simply tag the message as possible spam. That's what any responsible ISP should do, rather than blocking all transactions based on a 3rd parties list. We get the occasional Email sent through a mail server which would have been black holed, and it is a legitimate Email which should be delivered.
Running a mail server, it's not my job to block mail based on where it came from. I can provide the service to my users by adding flags for potential unsolicited bulk messages, but it's up to them to decide if they did or didn't want it. You never know, they might have been interested in going to a hardcord teenage beastality site. Who am I to say that's wrong.
Serious? Seriousness is well above my pay grade.
A little while ago a site I worked at was blacklisted.
We fixed the problem that day and when we contacted the SPAM COP he wrote back to say, basically:
All Lotus Notes Mail Servers are insecure so we're leaving you on the list. Get another mail server.
I made achange in the Notes.INI file that made it look like I was using SendMail. And he fixed us.
Ridiculous policy. Notes is pretty secure anyway! I wonder what this guy read...
This
My employer's corporate office email system is an open relay, so that outlying offices (like ours) can send email, and so the company can track what we're doing.
Recently, spammers have discovered our open system and have been relaying at a furious rate (read: thousands of emails a day.) This caused *our* email to get reflected back to us most of the time, and it also got my employer's domain on several spammer blacklists. This is such a problem, that the corporate office recently switched ISPs over it.
Now, with the new ISP, the IT guys have "cracked down on security" by banning relaying...for 1/2 the day. In the mornings we can send all the email we want (and so can the spammers), but after we all get back from lunch, no more email can be sent out. My employer is baffled why we can't get off of the blacklists, even after the move to the new ISP. I just laugh and goof off for the rest of the afternoon.
I'm all for an appeals process of some sort in order to get off of spam blacklists, but some companies do deserve to stay there, as long as their habits and policies don't radically change.
not_anne
My comments here are my own; I do not speak for my employer.
a self maintaining blacklist. if you get blacklisted and then fix it, you go to a webpage that you submit that you're fixed. then the system simply uses a seperate computer that is NOT on the webpages domain and tries to relay email. if the relay happened then the blacklisted site is still blacklisted, otherwise it is automatically removed.
Maybe 100 lines in perl to accomplish this. no real effort required.
Do not look at laser with remaining good eye.
Spam can be defined as any peice of email that your really don't want to get.
E-mail is the easiest way to develop push program, and I generally let end users track different events on the their accounts with email. Such systems generate a ton of email. They generally let the end user control which events get reported. Regardless, I find heavily used systems generating 10,000+ auto generated emails a day.
It is very easy to mix this push programming up with marketing spam. It only takes one admin to confuse the end user controlled push program with marketing spam to mess up an entire block of end users.
We are never going to be able to completely protect our users from spam, it is much better to develop clients that help the end user cope with vasts amounts of email.
Your right to email stops at my machines. I can choose to accept it, redirect it, or reject based upon any criteria I like. Could be I use a blacklist, could be I reject anyone with an aol.com address, could be your name is Fred and I don't like that name.
The point is, all of these reasons are valid because they're *my machines*. Only I get to say what goes and what doesn't on them. My users might get disgruntled and go someplace else but they don't have any say in how my machines are run - and neither do you. I might decide to respond to my users for fear of losing their patronage but I don't *have* to.
If the blacklists really do such a lousy job then the people using them will get annoyed, then pissed, then stop using them altogether. It's a great system for weeding out the incompetents and the fanatics, since in the end only incompetents and fanatics are left using the badly-managed list. Works for me.
If the blacklists are doing okay then people will continue to use them instead of migrating away. From what I've seen the 'big' blacklists have a growing clientele, not a shrinking one, which is somewhat credible testimony that most of the time they do an okay job.
You can complain that it isn't fair if you can't get your name off a list, but you don't have any rights (legal, moral, or otherwise) to petition for a redress of a non-existent grievance. They can keep you on their list on a whim, if they like, just like I block all aol.com addresses universally and have for years.
Max
My god carries a hammer. Your god died nailed to a tree. Any questions?
Next thing my site which DOESN'T relay is being hammered by spam-fuckers who use the ORBS list to find relays to abuse. Sure nothing gets through, but my server still has to deny a billion and a half requests.
My experience with orbz is that they don't pay attention to the people in the middle - I've been there.
people in the middle?
orbz is 100% automated and once you fix your server, you can be off of the blacklist in under an hour. (just ask for a re-test from the mail server in question) i'm not sure what you mean by orbz not paying attention to people in the middle, but it's fairly easy to get out of the DB if you close your relay.
I'm trying to move data from one point to another, and some machines in the middle are discriminating against my data
Just wait a minute there Jethro... "machines in the middle" are not discriminating against your data. It's not like your mail passes through this machine that says, "Hey, you're a bad bad person! Go away."
In fact, the recipients are the servers refusing to deal with you. Sure, it's because they've subscribed to a list, but the list is not the one refusing you, it's the server that reads from it.
That said, it's not very nice to remove you from such a list once you've demonstrated your server is fixed.
-Ryan, with the unoriginal sig
We too were listed on some of these lists. And this was at the beggining of what is now know "mail relaying". Before then, all mail servers were open-relays, and suddently your emails are blocked !
;-)
Therefore I'm against these lists but I would suggest another solution :
1. These list should inform you have been added
2. They should leave you 10-15 days to fix the problem before blocking you
3. They should help you. I was *very* shocked by ORBS attitude "we block you, and we don't care if you cannot correct it"
The problem 3 is quite grave : What can you do if your mail server doesn't support anti-relay ?
Or if you must buy another licence, or it it's opensource, but needs a new version of the OS, or things like that. OK, now all email servers support anti-relay. But this was not the case at this time.
And FIRST OF ALL, I would really like to have a RFC on this subject : I don't accept ORBS having decided what's permitted and what's not ! Some relaying is permitted and some not.
Example : Accept any IP address for relay except ORBS, you won't be blocked but you're an open relay
The Price of Freedom is Eternal Vigilance.
no later than this afternoon, I was trying to email some guy at @blank.org, and my mail was bouncing because it was claimed my ISP was an open relay.
I checked it using an external box, and it wasn't.
I emailed the ISP and the destination domain (using another relay) and the ISP was ammadant they had never been open relay in the past, because that's the first thing they checked when installing their server. I know the techies there, they aren't bad, I trust them.
Of course, the blacklist site failed to reply to any email I send.
I don't see why they try to do that, openrelays are mostly home machines that will be shut down before there is a chance for the blacklist to work (and with DHCP...)
Maybe they should target and start blacklisting yahoo.com, home.com, hotmail.com, aol.com and the few other domain from where 90% of the spam I receive originate, instead.
So, the boss realizes that perhaps my friend didn't get the message, and so the boss forwards the message to him, with a note attached, so now it reads "FW: URGENT!!! THIS IS VERY IMPORTANT!!!"
This happens two or three times before he finally figured out what was going on.
Moral of the story: quarantine spam, but don't automagically send it to a black hole. Only the addressee can truly differentiate legitimate mail from spam.
"Anything is better than IE, and you can quote me on that." -- Wil Wheaton.
I personally like SpamCop.Net. It has a dynamic black list based on ip. If people report spam from a specific ip address, it will (after a certain threshhold) get added to the black list. Once the spam stops being reported, the ip address becomes open again.
I can understand the problems caused by unmaintained blacklists, or ones that operate on the roach-motel principle. All you can do is communicate directly with the blacklist maintainers, or communicate with the sites blocking you (mail to postmaster shouldn't be blocked) and see if you can convince them the blacklist is unreasonable. If sites start getting lots of reports about a blacklist refusing to delist open relays after they've been fixed, site operators may stop using those blacklists.
On the other hand, you admit to having had an open relay in your network. Back before 1995 or so this might have been excusable. If we're talking in the last 6 years, though, there's no excuse. The problems have been well-known, the solutions equally well-known and easily implemented. If you shoot yourself in the foot, even unintentionally, whose fault is the resulting pain?
Wouldn't that be great? Someone (me?) should start a blacklist-blacklist to keep track of all the poorly maintained blacklists. "Well, that's a great idea, but what if..." That's exactly what i thought you'd ask. Of course, we could do this forever. Sometime circa 2055 we will live in a world with several "blacklist-blacklist-blacklist-blacklist-blacklist -blacklist-blacklist-blacklist-blacklist-blacklist -blacklists". When will it ever end? I'll tell you when: WHEN WE WISE UP AND FIX THE PROBLEM. Blacklists are pointless and worthless. Spammers are in the business of spamming. Block their IP, and it will be their FIRST PRIORITY to either have the IP removed from the blacklist, or to get a new IP address.
:)
Want a public, anonymous, free, decentralized communication system? Accept certain truths about it. There will always be spam, there will always be chain letters, there will always be suckers who fall for them or otherwise propagate them. Is the system imperfect? Of course. Are spammers the problem? Of course not.
When Microsoft adds a "feature" to Outlook that spawns an entire legion of worms and viruses, do we slashdotters attack the virus writers? No (at least, not usually). We attack Microsoft for releasing such a vulnerable product, and we attack the users who execute every single attachment they recieve regardless of the sender or the context. By this SAME LOGIC, we should not be condemming the spammers -- they are the equivelant of the virus writers -- we should be condemming the e-mail infrastructure (which is as productive as condemming Microsoft -- see them listening? i dont) and we should be condemming these same users who support spammers by sending them money.
Some of you may want to tell me "stop complaining unless you can fix it" or perhaps you'd prefer the old "what else is there?" But this only dodges the issue. The issue here is not spam, it is not blacklists, it is not the e-mail infrastructure. The issue here is the users who give spammers money, and who propagate chain letters, and who run virus-ridden e-mail attachments. We need to be attacking these people who have no business using computers in the first place.
Elitist for life.
Oh shit! I forgot to click "Post Anonymously"...
If so, they're right in blocking you. You're saying "oh, we're not willing to go through the trouble of cleaning up our server, to hell with anyone who gets spammed." It's exactly those sites that they're supposed to be blocked
That's insane. Once you end up on a spamrelay list, you'll be the conduit for tons of spam within hours of even minutes. 10-15 days is an eternity in that respect.
Get a lawyer to write a threatening letter, stating that they're unfairly interfering with your business. They're costing you revenue and creating problems with your communications channels. You've complied with thier stated policies already and have taken "good faith" action to resolve the issue. Bottom line. If it's harming you and money is involved you can at least threaten to make them liable for that money. You'll probably loose if you push it, but just the letter ought to be enough to force the issue.
I'm not a lawyer, but I used to sleep with one... how's that for reversing the system?
IMO, the way it should work, to be fair, is to send a warning email to someone from the company. Then, if that email goes unnoticed, put the company in the blacklist. Even better, put something informative in that email letting people know how they can stop their server from being an open relay.
I should know. I've been in this situation, where my email server was way down on my list of priorities. I was blacklisted without warning or explanation. I had to investigate the whole matter myself, fix the problem, find the people who blacklisted me and go through their procedures to get off the blacklist. While I see the need to have blacklists, they certainly could do a better job dealing with buisnesses who have no intention of spamming and who may have just overlooked or not even known about the problem.
No, Thursday's out. How about never - is never good for you?
Time to face the fact that grandpa's hacked text email protocol does not cut it anymore. Time for a modern binary based protocol designed to optimize the handling of binary encoded messages.
Messages need to be encrypted by default. We need public and anonymous digital signatures to automatically seperate and filter email. Everything needs to be trashed unless it's properly authenticated. Much of which should be performed at the mail server level with features such as receipts that can verify that a message was at least recieved by a user or trashed outright as unauthenticated.
Authentication codes must accompany all email addresses. Authentication codes which can be revoked. That email gets through should be viewed as an intimate privilage. Spam will then and only then be eliminated. And web sites that extort email addresses will become a thing of the past.
Good luck :)
, brigid@cohogroup.com
Electrical Engineering Jobs
Over 770 E-mail Addresses
EE Times - December of 1997
JOB 1
stg.jobs@attws.com, pa@ansara.com, resumes@qualcomm.com, hr1@arris-i.com, pmurphy725@aol.com, boulder-jobs@qualcomm.com
San Jose Mercury News 10/12/97 paper
JOB 2
jobsedg@msm.mea.com, hr@asante.com, hr@cel.com, jobs@redcreek.com, jobs@vnet.ibm.com, manager@resumix.nsc.com
EE Times - 1/12/98
JOB 3
teclou@aol.com, TELECOM@NSASEARCH.COM, jobs@intel.com, aztech@amug.org, jobs@vitesse.com, resumes@wtc.sel.sony.com, rafey@tiac.net, hr_resume@ims.com, jobs@whiteoaksemi.com, jobline@littongcs.com
San Jose Mercury News - 8/24/98
JOB 4
jobs@fcsi.fujitsu.com, careers@stellexms.com, jobs@c-cube.com, kelly.ulmen@plexus.com, employment@splashtech.com,tchiang@techwellinc.com
Westech High Technology Careers - Part I (August 1998)
JOB 5
confreg@dci.com, resumes@ireadyco.com, baynetworks@isearch.com, resume@rayjobs.com, opportunity@sandcraft.com, itjobs@montgomery.com, adresp@cadence.com, jobs@wdl.lmco.com, staffing@ca.slr.com, jobs@lsil.com, jobs@level1.com, hr@littonatd.com, resume@livingston.com, jobs@ssi.samsung.com, employment@crossworlds.com, careers@fmi.fujitsu.com, jobs@sunrisetelecom.com, jobs@us.ibm.com, staffing@aspect.com, hr@cel.com
Westech High Technology Careers - Part II (August 1998)
JOB 6
deseri@zoran.com, jobs@divatv.com, resume@pmcg.philips.com, recruiting@sharplabs.com, job.opps@quester.com, tutresumes@tutsys.com, recruit@candescent.com, staffing@tab.com, hr@altera.com, jobs@corp.adaptec.com, chuck@pmcflash.com, jobs@quantum.com, career@smartm.com, staffing@electroglas.com, recruiter@wyse.com, hr@isd.com, candidate@verilink.com, jfrench@masca.com, resume@itron.com, resume@netscape.com, hr@rise.com, jobs@auspex.com, jobs@edg.mea.com, sj_jobs@mail.sel.sony.com
San Jose Mercury News - August 31, 1998
JOB 7
resumes_ca@alliedtelesyn.com, ace@hallkinion.com, hr@oaktech.com, hr@interrainc.com, jobs@amd.com, hr@connectix.com, jobs@larscom.com, Adecsystem@aol.com, hr@sierraimaging.com, jobs@avanticorp.com, hr@gasonics.com, ssthr@ssti.com, jobs@alza.com, ben@virtual-silicon.com, hr@flextronics.com, employment@ocv.com, jobs@qntm.com, hrdept@pixera.com, staffing@actel.com
San Jose Mercury News - Part I (September 13, 1998)
JOB 8
recruit@micrel.com, hrd@ata-sd.com, staffing@genmagic.com, hr@oaktech.com, jobs@opti.com, resumes@delfin.com, tpc@integration.com, jobs@sunup.com, resumes.rfpower_mh@ericsson.com, people@newfocus.com, jobs@episupport.com, hr@synplicity.com, jobs@mdyn.com, career@smartm.com, hr@nanogen.com, hrdept@curtisca.com, resume@ceoi.com, recruiter@wyse.com, peggi.stamm@hti.htch.com
San Jose Mercury News - Part II (September 13, 1998)
JOB 9
jobs@cardiac.com, jobs@gravitytech.com, jobs@synthesysresearch.com, employment@aristotech.com, recruiting@omnicell.com, jobs@pluris.com, career@galgon.com, irene@ancore.com, ari_jobs@affymax.com, tchiang@techwellinc.com, resumes@com21.com, hr@oblix.com, reneev@sncorp.com, employment@splashtech.com, service@systron.com, jobs@jpmsj.com, jobs@coppermountain.com, hr@powerint.com, info@xemod.com, info@photon- inc.com, jobs@divio.com, hr@harmonic-lightwaves.com, hr@fci.com
Westech High Technology Careers (September 1998)
JOB 10
ddickins@pixtran.com, hr@isd.com, hr@plx.com, jobs@sentientnet.com, jobs@symantec.com, michellen@8x8.com, HR@broadvision.com, careers@aol.com, hr@intarsiacorp.com, jobs@cerf.net, staffing@atp.com, info@xemod.com, hr@feico.com, recruiter@tcisolutions.com, staffing@cis.canon.com, austin@atr1.com, resume@atr1.com, jobs@concentric.com
San Jose Mercury News - August 29, 1999
JOB 11
resume@hp.com, jobs@lumnet.com, staffing@corsair.com, resumes@thru-put.com, hr@inkjet-tech.com, jobs@dpix.com, jobs@lexra.com, hr@roassoc.com, hr@unisil.com, hrecosys@atmi.com, resume@calimetrics.com, HR@plxtech.com, jobs@splasers.com, lanne@rudolphtech.com, jobs@new-techinc.com, info@crossroads.com, employment@sicon.com, human_resources@edgesemi.com, jobs@mindmaker.com, inquiry@uniqa.com, bonesteel@value.net, fordd@hrsss.com, jobs@ubmusa.com, HiringPT@pebio.com, resume@nms.fnc.fujitsu.com, marie.tremblay@medtronic.com, jobs@mediaplex.com, jobs@hotrail.com, erinwc@erineng.com, hr@camstar.com, jobs@alidian.com, hr@cetr.com, eddyh@hiwinmikro.com, jobs@corp.phone.com, hr@calmicro.com, careers@kbscorp.com, jobs@elantec.com, hr@adicomwireless.com, cleanad@metasound.com, laura@aspec.com, jobs6@yahoo.com, jobs@comtier.com, jobs@clarify.com, jburns@ciena.com, jobs@aerogen.com, hr@invision.iip.com, glin@digicomsys.com, jobs@cohera.com, resume@atmel.com, resumes@sageinst.com, staffing@ca.slr.com, jobopps@supertex.com, jobs@vishay.com, staffing@wj.com, employment@sti.com, jobs@larscom.com, resume@pinnaclesys.com
Dallas Morning News - August 29, 1999
JOB 12
errecruiter@na.marconicomms.com, recruitment@spang.com, hr@pvi.com, tpiDFW@aol.com, hrresume@cacd.rockwell.com, personnl@friedrich.com
Jobtrak - April 5, 2000
JOB 13
rcambareri@pacbellwireless.com, career@dknowledge.com, raffi.codilian@wdc.com, resumes@rsc.rockwell.com, hr@cputech.com, irdinc@earthlink.net, mortons@lincom.com, jobs@qthink.com, resumes@cbm.canon.com, rick.melvin@analog.com, marilyn.condran@baesystems.com, resume@conexant.com, staffing@sv.sc.philips.com
Silicon Valley Tech Week - November 13, 2000
JOB 14
jobopps@tce.com, kpitjobs@kp.org, jobs@elantec.com, te_ca@jabil.com, careers@zflinux.com, jobs@jasminenetworks.com, jobs@nsc.com, colo@inreach.com, siliconvalleyjobs@foliage.com, careers@commerceone.com, jobs@zarak.com, cag.hr@cohr.com, jobs@redswitch.com, Job.responses@hsa.hitachi.com, careers@qstech.com, hr@cosinecom.com
San Jose Mercury News - May 13, 2001
JOB 15
resumes@microchip.com, omeissner@maxios.com, careers@phodyn.com, jobs@os.varian.com, jobinfo@cachevision.com, career@lightwaves2020.com, hr@nvidia.com, eis.jobs@us.abb.com, jobs@actuate.com, jobs@openwave.com, santaclarahr@atitech.com, careers@synopsys.com, hr@teja.com, cooljobs@s3graphics.com, jobs@ictv.com, jobs@redback.com, jobs@ci.santa-rosa.ca.us, jobs@quinstreet.com, jlien@pericom.com, jobs@lightsand.com, agkayler@micron.com, hr@gtweed.com, jobs@atoga.com, kelvyn@hibandsemi.com, al.pham@gluonnetworks.com, hr.sj@ricoh-usa.com, admin@teamscape.com, hr@fse-power.com, hr@admtek.com, jobs@excelsior-mfg.com, jobs@siimage.com, richardgu@aoctech.com, vickie@ipunity.com, recruiting@ctscorp.com, hr@rapid5.com, karen.vu@evoice.com, hr@controlnet.com, info@ecosnow.com, bhadinger@calair.com, hr@nlc.com, resumes_wa@alliedtelesyn.com, amygmt@worldnet.att.net, jobs@informativepeople.com, hr@prediwave.com, hr@optiwork.com, laura@sonnetusa.com, careers@irislogic.com, hrm@powertv.com, jobs@trendmicro.com, resumes@fisherinc.com, marieh@wintecind.com, careers@tahoenetworks.com, teamwork@xirlink.com, humanresources@nextec-rf.com, jobs@enreach.com, tt@pacecocorp.com, jobs@quartetns.com, careers-sanjose@siliconaccess.com, youngshim@aqs-inc.com, jobs@pixo.com, hr@johnstech.com, hr@road-com.com, jobs1@tsunamioptics.com, joanna.reyes@mindspeed.com, kf@administaff.com
High Technology Careers by Brassring - Feb/Mar 2001 Vol. 18 No.1
JOB 16
jobopps@tce.com, careers@mondes.com, kbasl@intevac.com, jobs@trimble.com, jobs@andanetworks.com, jgarci03@harris.com, careers@impac.com, resumes@tibcofinance.com, jobs1@csd.com, jobs@infineon.com, jobs@veritas.com, hr@starvox.com, optics@rt6.com, hr@tegal.com, jobs@sunrisetelecom.com, talent@catc.com, jjolly@celerity.L-3com.com, manzanares@earthlink.net, jobs@resilience.com, cooljobs@xicor.com, hr@camstar.com, jobs@mobilinktel.com, hightech@incyte.com, hitec@jazo.org.il, jobs@centerpoint.com, sj.jobs@am.sony.com, resumes@tumbleweed.com, resumes@condorsys.com, HR@acmrc.com, hr@garudanetworks.com, jobs@zembu.com, sanjresume@bd.com, hr@littonatd.com, jobs@nazomi.com, recruit@candescent.com, resumes@kla-tencor.com, resume@borland.com, hr.mio@sbs.com, dalia.liron@innowavebb.com, Dballagh@3dsp.com, jm.sheldon@gemfire.com, rrojas@pria.com, mvrecruiting@teledyne.com, jobs@epeople.com, careers-us@charteredsemi.com, employment@ejasent.com, jobs.htc@compaq.com, newgrad@altera.com, jobs@legato.com, jheinrich@com21.com, hr@marvell.com, jobs@pixim.com, hr@acta.com, ddalal@gobosh.com, resume@appsig.com, careers@godigital.com, sjjobs@sj.symbol.com, careers@ampro.com, jobs@commandaudio.com, careers@CRTechnology.com, employment@entigen.com
EE Times - March 26, 2001, March 5, 2001
JOB 17
bayareajobs@vitesse.com, recruiting@artisan.com, fitz@sssnet.com, jobs@foundrynet.com, frank.humphrey@adtran.com, IPCJOBS@earthlink.net, careers@mahinetworks.com, careers@cfires.com, eet@nesnet.com, vtb-10@voyetra.com, jobs@nurlogic.com, careers@mltc.com, todd@jobjungle.com, careers@thunderRiver.com, rtpjobs@ericsson.com, hanmi@hanmico.com, ldavis@ditechcom.com, 471798.6@jobfrenzy.com, recruiter2@adaptec.com, matt@jivaroinc.com
San Jose Mercury News - June 3, 2001
JOB18
Lucy@rudolphtech.com, hr@fodus.com, dactron@msn.com, mailbox@mctengr.com, sspiller@arcadiadesign.com, apply_sanjose@celestica.com, hr@solidone.com, careers4@logicon.com, hr@turnstone.com, edaadmin@edainc.com, hr@agorics.com, careers@spiketech.com, hr@sequencedesign.com, jobs@silicon-packets.com, getajob@mips.com, jobs@zilog.com, dmorris@zmda.com, gloria@zeta-idt.com, recruit@dcswins.com, hrstaffing@symyx.com, employment.sanjose@pemstar.com, team@accesslan.com, jobs@digisle.com, BATCRecruiter@ball.com, resume@hoyaoptics.com, KTCAPET@quadrant.com, hr@pmcflash.com, jobs@ebay.com, hr@via-cyrix.com, hr@implant-center.com, techjobs@entercept.com, employment@brecis.com, Acro.pasadena@acrocorp.com, mtr@mtrinc.com, Obyron@spgca.com, jobs@azanda.com, vpapa@xoftmicrotube.com, hr@robsci.com, jobs@clarent.com, hr@dcmindustries.com, jobs@verisign.com, lilyh@maxxan.com, careers@packetdesign.com, resumes@www.wdc.com, jobs@simplex.com, jobs@saratogasystems.com, pmi@vigilance.com, recruiting@artisan.com, edgar@denham.net, lake@lightlogic.com, hr@inkjet-tech.com, greatcareers@visx.com, careers@platys.com, jobs@rti.com, jobs@razafoundries.com, jobs@kcti.com, jobs@vina-tech.com, hr@trompeter.com, emanning@packeteer.com, jobs@synthesysresearch.com
San Jose Mercury News - June 10, 2001
JOB19
hr@themis.com, hr-us@arm.com, jobs@novacrystals.com, hr@apichip.com, recruiter@iphotonics.com, Perlegen_HR@perlegen.com, mary_calon@holz.com, jobs@cidcocom.com, genesis@rpc.webhire.com, jobs@vicom.com, dflottman@atiae.com, recruit@infobahnsw.com, employment@arkivio.com, maricela@linkupsys.com, resume@vivacenetworks.com, jobs@tavanza.com, jobs@cplane.com, djansen@coen.com, engineerg@hosmer.com, scjobs@us.ul.com, staffing@nayna.com, jobs@simagic.com, hr@aitfl.com, bobl@lathropengineering.com, staffing@virtual-silicon.com, jobs@caresoft.com, staffing.SVLCA@trw.com, jobs@adobe.com, staffing@wellex.com, hr@mmctechnology.com, HR-Emeryville@affymetrix.com, HR@finisar.com, necel@rpc.webhire.com, careers@verticom.com, HR@aemf.org, hr@entrego.com, hr@ateonix.com, jobs@mosel-vitelic.com, burt@oriolinc.com, jobs@luxxon.com, jobs@silvaco.com, resumes@mapleoptical.com, HR@Sparqtron.com, jobs@netigy.com, meblasi@home.com, hr@rcorp.com, bisterjj@nv.doe.gov, hr@tmantennas.com, hr@opticnet-inc.com, Ga400Career@sea.siemens.com, jobs@agile-automation.com, jobs@numeritech.com, jobs@enreach.com, jobs@wavesplitter.com, careers@triscend.com, jobs@opsol.com, dnazarenus@medsourcetech.com, hr@parallax-medical.com, jobs@sisilk.com
San Jose Mercury News - June 17, 2001
JOB20
jobs@oni.com, resumes@rambus.com, staffing@tridmicr.com, jobs@siperian.com, sanjosejobs@netiq.com, hr@compsensor.com, hr@sensarray.com,
troberts@netledger.com, personnel@telewisecomm.com, info@quadrep.com, jobs@barcelonadesign.com, jobs@synaptics.com, jobs@timogen.com, joblogic@pdf.com, careers@bose.com, hr@networkphysics.com, resume@guzik.com, natalia.murray@astecsemi.com, hr@phoenix.com, recruit4@coherentinc.com, info@aristanetworks.com, jobs@centillium.com, recruiter@alvesta.com, egainjobs@egain.com, laurieg@checkpointtechnologies.com, jobs@headway.com, jobs@etouch.com, coriojobs@hiresystems.com, kchen@excelics.com, jobs@nishansystems.com
San Jose Mercury News - November 19, 2000
JOB21
personnel@gmicolor.com, craig_chidlow@fast-chip.com, SanJose.JOBS@teradyne.com, enghr@efi.com, jobs@zambeel.com, Raschell.Floodman@ind.alcatel.com, hr@opthos.com, jobs@dataphysics.com, hr@fireclick.com, jobs@des-ae.com, hr_it@Chartone.com, jobs@genemachines.com, jobs@dialpad.com, jobs@nixxotech.com, jsmith@apw-enclosures.com, FremontJobs@bsci.com, hr@jenningstech.com, Theresa.Sweet@readrite.com, employment@ocv.com, jobs@zip2.com, jobs@teraoptics.com, jobs@ils-tech.com, hr@svpa.com, jobs@sat.com, jobs@ingine.com, HR@altigen.com, jobs@o2micro.com, Alltemps@Abreau.com, resume@ti.com, webmaster@ghz.com, jobs@ecode.com, Hrwest@techspan.com, linc@intrinsix.com, jobs@ingenuus.com, resumes@quintus.com, hr@imedica.com, hr@marketfirst.com, employment@broadbase.com, jobs@intensys.com, rem.sw@remingtonjobs.com, jobs@cyras.com, staffing@as-e.com, hr@mosys.com, HR@raytek.com, jobs@SAAMA.com, jobs@appro.com, hr@agilitycom.com, hr@wireless-link.com, jobs@angelengineers.com, adventures@watchertech.com, hr@oratec.com, jobs@netscaler.com, hr@insilicon.com, jobs@windriver.com, hr@eiccorp.com, p09.personnel@SCI.com, engineer@inspx.com, globalstar@rpc.webhire.com, jobs@accuray.com, dannyl@atpusa.com, hiring@volterra.com, Russell@atcor.com, recruiting@dtius.com, kduda@metrolineindustries.com
San Jose Mercury News - June 24, 2001
JOB22
sanjosejobs@earthtech.com, jobs@selabs.com, hr@esstech.com, jobs@bitmath.com, careers@onetta.com, hr@iridex.com, sanfrancisco@thk.com, resumes@arie.com, HR@ambicom.com, jobs@bayspec.com, bkmc@mindspring.com, HR@mdcvacuum.com, hr@optonics.com, hr@volterra.com, hr@impaxlabs.com, hr@inviscidnetworks.com, HRStaffing@halodata.com, resumes_adv@innominds.com, rrcstaffing@readrite.com, rchrenowski@hns.com, jobs@tavant.com, jobs@pointbase.com, yangcai@mediostream.com, jobs-sjmn@speedtrak.com, jaya@softsolresources.com, us- staffing@businessobjects.com, jobs@rackable.com, john.lawson@qlogic.com, IPE@nihachi.com, Amanda_E_Cullen@md.northgrum.com, jobs@ibusinesshub.com, sdjobs@fairchildsemi.com, jobs@k2optronics.com, resume@surromed.com, careers@sandisk.com, lamjobs@lamrc.com, jobs@transparentnetworks.com, jwang@pinephotonics.com, jobs@arthrocare.com, staffing@ambernetworks.com, susan@ect.com, resumes@ps2tech.com, hr@apluscorp.com
San Jose Mercury News - July 1, 2001
JOB23
wendy@360degreeweb.com, jobs@bigbearnetworks.com, resume@ovt.com, HR@stradient.com, Hr@quippex.com, jobs@ipverse.com, Jobs@merc-int.com, jobs@coreon.com, jobs@crosslayer.com, resume@intervideo.com, jobs@sonicblue.com, jobs@prismedia.com, suncrest_hr@yahoo.com, jobs@neomagic.com, careers@imperito.com, actuate@hiresystems.com, jobs.mdyn@am.apbiotech.com, jobs@centricsoftware.com, resumes@terayon.com, jobs@ecrio.com, hr@ipitek.com, shomo@fortemedia.com, jobs@cognigine.com, jobs@lnxw.com, anorton@hothire.com, jobs@innotone.com, jobs- web@sensys-inst.com, careers@laranetworks.com, jobs@endwave.com
San Jose Mercury News - July 8, 2001
JOB24
karenq@vxitech.com, jobs@elance.com, jobs@innova-usa.com, recruiting@cygn.com, careers@novellus.com, jobs@zettacom.com, bsstreeter@msn.com, patty@cme4job.com, jobs@mindstech.com, Shelly@atomic29.com
High Technology Careers - June/July 2001 Vol. 18 No. 3
JOB25
jobs@lanterncom.com, jobs@sapphirecommunications.com, employment@net.com, jobs@terraspring.com, llievonen@BrassRing.com, staffing_ca@maxtor.com
San Jose Mercury News - July 29, 2001
JOB26
sgonia@lightwavemicro.com, staffing@ms2.com, jobs@pumpkinnet.com, careers.us@southamptonphotonics.com, hr@flashelec.com, employment@pge.com, career@symmetrycomm.com, jobs@beckman.com, jobs@katsinaoptics.com, uscareers@metrophotonics.com, hr@na.teleatlas.com, career@exar.com, hr@presenter.com, liubo.hong@digilens.com, empowertel@rpc.webhire.com, davidv@ciena.com, resumes@iready.com, hiring@frogdesign.com, jobs@bytemobile.com, vishay@rpc.webhire.com, ads@internec.com, jobs@esurance.com, HR@atce.com, hr@sdocorp.com, angela.martin@hcd21.com, college@newport.com, emcresumes@EMC.com, jobs@saic.com, ResumesBR@vetronix.com, lydia_pine@udlp.com, cwright@equipetech.com
San Jose Mercury News - August 5, 2001
JOB27
opportunities@gecareers.com, careers@pacwest.com, jobs@dejima.com, hr@themis.com, careers@noveraoptics.com, jobs@avnisoft.com, jobs@coronanetworks.com, careers@altoweb.com, jobs@nthorbit.com, electrical@laeng.com, kayeb@polarvision.com, knoxcorp@excite.com, employment@starfish.com, ENGresumes@mobilesys.com, hr@afop.com, jobs@abeona.com, careers@bcone.com, bogara@hyperion.com, Mcantwell@compeq.com, jobs@hba.com, jobs@comdev.cc, employment@lbl.gov, Rowena.Tolentino@corp.palm.com, tfrtec@aol.com, hr@caeultrasonics.com, abukhari@catalyticaEnergy.com, jobs@fortuna.com, hrd@metabyte.com, hr@activeoptical.com, sharonberman@rpse.com, jobs@purpleyogi.com, employ@teacengineers.com, jobs@realtip.com, cchang5@acer.com
Santa Clara Convention Center - August 7, 2001
JOB28
Jobs@hds.com, adept@rpc.webhire.com, Careers@EnsembleCom.com, lzhang@broadstorm.com, careers@cloudshield.com, hr@dmscorp.com, jobs@9oclock.com, jobs@digitalarchway.com, resumes@lsscorp.com, jobfair@mmcnet.com, jobs@3ware.com, jobs@netlogicmicro.com, michelle@etak.com, jobs@accordionnet.com
HOME
TABLE OF CONTENTS
No, they're not unreasonable.
/. when the rest of the world wants nothing to do with your ISP.
[...]
You wanna get bandwidth with a company that provides services to spammers and relocates spammers to IP addresses to avoid blocking of single IP addresses, don't come whining to
Thank you.
The only way you get blacklisted is if you (or your ISP) is stupid enough to run a promiscuous mail server that allows anyone to use it as a maildrop/forwarder. Fix the problem (either getting a new ISP, closing up your server, or highering competent people to run your service) and you will be de-blacklisted.
If you cannot be bothered to do any of these things you (and your company) don't deserve to be on the internet, and certainly don't diserve to have any contact whatsoever with me.
Since all of these lists are voluntary, if I have chosen to shun you on the basis of one that is my choice. You do not have a right to be able to contact me if I don't wish to allow it, so get over it, learn from your mistakes, and don't make them again. If you can't be bothered to learn, then, well, enjoy being a component particle of the Black Hole.
The Future of Human Evolution: Autonomy
Ok, you misunderstood me. I agree with you about today's situation. You can do an apt-get upgrade under debian and your maybe old mailserver is immediately corrected. But I am speaking about Linux/Internet in 1997, for example...
;-)
But most importantly : I am speaking about systems that didn't get SPAM, that were just reported as being open, not as being generating and providing spam.
Don't forget that the first victim or relaying SPAM is the open mailserver itself
And most importantly these lists are not based on any RFC or any standard
The Price of Freedom is Eternal Vigilance.
That reminds me. Another great thing about SpamAssassin is that any email address that sends you three non-spam messages gets automagically added to a whitelist so none of their emails will ever be counted as spam again.
You livin that name son: when you gonna run out of spaces to kill brotha?
I started running spamassasin a few weeks ago and it works wonderfully. I've got it set up on my box so that users can choose to use it or not by some simple procmail configuration.
The way I use it is have all spam messages get dumped to a common directory. This way I can verify that I didn't lose something important. In the 169 messages it filtered out during my last cleaning, 3 (all from mailing lists I'm on) we filtered improperly, and none of them were that important.
The beauty of this approach is that I can deal with wiping the spam out all at once and not have to be digging through my mail box wondering from subject lines if something is worth reading or if it's spam. I'll just do a "grep Subject: * | less" in the directory I use for storing the filtered messages and check for any mistakes. I add the mistakes into my procmail filter and voila, I get maybe half a dozen spams a week now.
This sig has been temporarily disconnected or is no longer in service
Sysadmin A, whom didn't take the time to check the security of his mail server, is complaining about sysadmin B whom doesn't take the time to maintain his spam list?
Please tell me what company you work for. I'd like to see how well-maintained and secure your systems, apparently employed by some type of financial company, really are.
...or feel free to move your mailserver to another IP or subnet if you can't get it unblocked. Testing it could be a pain in the butt, but isn't the spam that you let through a pain in the butt also?
I/O Error G-17: Aborting Installation
Use EXIM as your mailserver and you can have the best of all worlds.
1) Messages are checked for RBL
2) A X-RBL-Warning header is added to the message
3) Users can choose to filter these messages themselves
Bankrupt a few spammers, show others it is not cheap to spam. Maybe get some charged criminally.
All spammers should be tortured, then executed.
Fight Spammers!
IMHO, Blacklists are just a small band-aid on the gaping wound that is SMTP. SPAM has proliferated to the point where it needs to be dealt with in a more sane manner than just punishing the offenders.
I'm usually all for privacy, but I think we need to be using an email transport protocol that involves some form of authentication. I'm not sure if some such protocol exists already, but it doesn't seem like it would be too hard to create.
Am I way off base here, or wouldn't this cut way down on SPAM?
"Don't blame me, I voted for Kodos!"
In my experience, the most efficient way to decrease spam is to educate the users on how to use filtering. Simple mail filtering comes in most popular email clients these days, and after adding a few notorious spam domains as well as some of the most common phrases included in spam, it quickly drops to a point where it's hardly even annoying.
Personally, I've made it a habit to immediately add a specific persons email address, as well as the topic of their mail to my spam filter. At the present, I get 1, perhaps 2 spam mails per month, using only my internal spam filters to get rid of it.
I realize that this will not decrease the amount of bandwidth the spam mails consume, as the filtering is done on my machine, but I find it a relatively small price to pay in exchange for a minimal risk of non-spam mail not reaching me.
-----------------------
I pushed the red button
Try actually having to deal with spammers. They lie and threaten to sue often if I complain.
If you do the crime, be prepared to do time on the blacklist. Ignorance of spam administration is no excuse.
The rehabilitated system or network should be able to submit there address to a server to be crawled for open relays (much like submitting a URL to a search engine).
The server would connect to each address in the resubmission list and test if the relay was open. If an open relay wasn't detected then the system is put into a probationary state or taken off the list entirely. It's an automated solution that doesn't require any work by spam list administrators.
If necessary, the list of resubmissions could be distributed to volunteered machines (similar to seti) on many different networks. The volunteer machines then double-check the result. This reduces the chance of someone closing the relay exclusively for the spam list server.
A three-strikes and you're out policy could also be put into place.
Jason.
the poster was just asking for common courtesy towards Hormel.
sheeesh, Hormel could of gotten all uppity about it, sent its lawyer out. We all know that cease and desist letters work. If you get a cease and desist letter, and don't, you end up in court. do you have enough money to fight this in court?
Now if I could only get one of those flaming SPAM hats.
The Kruger Dunning explains most post on
Seriously. They need to be canned. NOW.
My employer's corporate office email system is an open relay, so that outlying offices (like ours) can send email, and so the company can track what we're doing.
Your employer's corporate office needs to emply a VPN.
My employer is baffled why we can't get off of the blacklists, even after the move to the new ISP.
Tell him it's because th IT guys are incompetant. Point him to this message if he thinks it's just you. You NEVER need an open relay. Tell him that you need VPNs between sites - that with the email flying around unencrypted, that anyone can view all of your internal memos as they fly between sites.
One item of spam had been sent through our server, I spotted the problem, fixed it, and got told that I'd been blacklisted. I then applied to be retested ("oh please Mr. Self-Appointed Cop, please say that I am good"), and was not removed from the list for a long long time. It should be automatic. Maybe test that server once a day for the next few weeks to make sure that it stays closed, if you feel such an urge. But everybody loses when the lists are not updated promptly - the admins of previously-open relays cannot send email, innocent recipients of email from the previously-open relay don't receive email they were expecting, and the maintainers of systems using the blacklists lose faith in the accuracy of the list, and stop using them (hopefully!).
I really don't know why people bother using these lists - I've not seen anyone claim here that they've benefitted significantly from doing so, and many people are harmed.
Author, Shell Scripting : Expert Re
As other people here have said, blacklists can be bad but most often only need some patience to get off of.
What's far more annoying, in my opinion, is those sites who've configured their mail server to be utterly anal about DNS. Forward mapping, reverse mapping, no underscores, etc. etc. Since many otherwise decent mailservers are stuck with ISP "What's DNS?" level support, this can be a pain in the ass for completely innocent victims.
Don't like living in a crack house? Move.
What about the people living next door to the crack house? Should they not be able to get a pizza as well? How about the good houses that get anonymously accused of being crack houses?
The fact of the matter is, for every legimiate spammer on the list (even the well administrated ones), there is another placed there unfairly.
In the three weeks preceding the much awaited dumping of ORBS, we started dropping mail from 4 different valid mailing lists and 1 valid business (it was a brick and mortar business - no web presence, just an e-mail server). One of the lists was LKML (and I have no idea why it was on the list), and the other three had the misfortune of being on the same web hosting service as a spammer.
The brick and mortar was on the list because of an open relay (which was a good reason to be listed), however once it was closed, they were not allowed to be removed, though their level of e-mail is about 20 - 30 message a day, and they have never send a spam in their existance.
The problem is that we are all living in close proximity here - legit businesses are only a few digits away from spammers (just like the real world). And the knee jerk reaction that most sysadmins take in dealing with the situation is similar in nature to burning half your mail daily because the postmark is similar to a known junk mailer. And burning is a reasonable analogy, because blocked emails don't get archived or analyzed, they get tossed, lock stock and barrel.
Its so easy for a sysadmin to install a blacklist and never worry about it again (unless of course, *he* starts losing messages).
The price for having a spam free existance is to constantly monitor and evaluate the system, not to light a match and walk away.
Do you have Linux and a DotPal? Click here now!
It wasn't until I checked the fine details of our server log that I found out we'd been blocked by the RBL, and they made it clear how to remedy the situation of us being an open relay. Even if it turned out to be a serious pain (which it didn't) to remove ourselves from the list; it's still a heck of a lot better than what was going on before: namely that people were getting unsolicited porn promos, ostensibly from our investment bank.
As far as the part-of-the-problem/part-of-the-solution matter goes, there's no question in my mind the spam blacklists are part of the solution. ISP's can subscribe to any list they choose. If a list starts getting careless, ISP's stop using it. As far as "innocent" companies like yours and mine getting stuck on these lists for longer than we'd like - hey, we deserve it for behaving irresponsibly in the first place. It would be like if we were inadvertantly supporting some reprehensible regime with our regular business. Sure, we didn't mean to - but we did it and don't deserve to be instantly trusted again the second we stop. The strong reactions of anti-spam groups should make people like us, would rather not deal with the issue if we don't have to - realize that WE HAVE TO. And to the groups which do this intentionally, the lists hold force their ISPs to decide between enforcing their own AUPs, or lose all their decent customers. And we get all this without having to rely on the impartiality of a Bush/Ashcroft/Enron solution. What more could ya ask for?
*nodding* - I'd never recommend anyone other than "me" use my blacklist. (And that's why I don't publish it :)
I'm too lazy to take entries out on a day-by-day basis. I believe public blacklists (in general) are a Good Thing, on the grounds that they're easier (for the admin) to use than private blacklists, easier (for the admin) to maintain, and easier (for legitimate customers if and when the ISP cleans up its act) to get out of.
you must use BSD
Rather than try to 'rehabilitate' those blacklists that are too rigid, count on those who subscribe to the block lists to pick those that are most responsible.
Think about it: If I run a mail server and use the biggest, least lenient blacklist provider out there, my users will start to complain when they're not getting important emails from people.
As in everything there's a middle ground between blocking too much and blocking not enough (or even none). the right answer is tu make sure mailadmins listen to their users, so they can find the right black hole list, striking the balance between spam and legitimate access.
Who knows, we may even get a responsible public organization out of this, recognized for specific rules and procedures for blacklist inclusion and removal. the sooner there's one list, the sooner we have less spam and less illegitimate blocking.
Kevin Fox
>
> If you don't like it, try to make it better.
Moderators - give that guy back a point.
I really should have written "If you don't like it, ask your landlord to evict the dealers. Then think about moving."
Or "If you don't like being listed in SPEWS, and you're not a spammer, ask your ISP to boot the spammers. You, as a customer of the listed ISP, have a hell of a lot more pull with that ISP than the spam recipients do."
eventually get allowed back into polite society. You were blacklisted for a reason, whatever that may be, the ability for your email to tranverse my systems is not a right but a privilegive you must work to maintain.
we found a solution that eliminated almost all of our spam. We turned on full checks in postfix on the RCPT info, the HELO/EHLO information, etc...ie, if you claim you're coming from ducttape.hampster.net, your IP dang well better reverse to that etc etc. I think we did some checks involving the FROM stuff too(ie, it had to be a real domain as well; hampster.net doesn't exist? Bubye.)
Almost -ALL- of the spam stopped immediately, because spammers fake so much...the email stands out like a sore thumb.
We had to turn it off. Want to guess why?
Every 2 days, a member of one of our mailing lists(we have 1,500 members), someone would email us(I have an off-site address) saying "hey, i got this host not found error."
In EVERY single case, it was because the ISP was being run by numbnuts who hadn't put in forward OR reverse entries for the DNS servers. Usually it was because they had a cluster of mail servers for outgoing mail(pointless if you run a good MTA etc) and hadn't bothered to set up proper DNS for each member of the cluster. mail023.dumbisp.net would not have any DNS set up for it, so postfix would say "sorry, I dunno who the hell you are, go away."
It wasn't small ISPs, either. BellSouth was one; a major Florida ISP was another. All involved(save one annoying ISP which did nothing but argue with me that the problem was their user was trying to send email through a mail server on HIS machine, despite the obvious headers etc that showed otherwise) had the problem fixed usually within about an hour of being told of the problem...most of the case, it was "you're kidding? Oh shoot, ok, we'll have it fixed in a jiffy."
The solution is very simple. Slashdotters, look at hte postfix website to see how to get your copy of postfix to do checks; just don't implement anything that's marked as "unsafe" etc. http://www.postfix.org/uce.html#header_checks
Now, be polite when you get questions. I simply wrote a very polite form letter that explained what the problem was that I could paste into emails. Set your mail server to be strict. ISPs will get complaints from users and realize their mistakes.
Now, here's the really cool thing. Spammers, if they try to fake hostnames etc, will get shut down...their email will get rejected! So they'll have to use mail servers with valid hostnames etc...
...which means they become MUCH easier to track down!
It really does work great...we didn't have any falses caused by people with weird virtual domains and stuff...just people whose ISPs had outgoing mail servers that lacked dns entries!
You'll just have to be more careful next time. As you discovered, the cost of relaying spam is higher than you may have thought originally. Eventually, those entries will go away. But even consumers have to wait many years before bad credit information goes away.
Email as a communication medium is under attack.
The deluge of spam itself causes some of the damage, causing people to be wary about giving out their email addresses, afraid to post publically on mailing lists, or in some cases changing their email addresses and only giving them out to close family and friends. This retreat into 'email enclaves' destroys one of the best things about email - the ability to communicate with someone on the other side of the world, even if it's just a "Hi from China, I really liked your webpage!".
The other widely used approach to avoid spam is the use of aggressive blocking lists to ghettoize huge sections of the internet, preventing them from communicating with those sections of the internet that use those lists. This, too is causing massive damage to email as a medium for communication.
The third part of the problem is the fear some organizations have of being labelled spammers for behaviour that would have been considered quite reasonable a few years ago. This chilling of communication isn't as big a problem as the previous two, but it's getting worse.
A combination of spammers and ill-conceived responses to spammers is balkanizing email, making it less and less viable as a means of person-to-person communication. And losing email would be a huge, huge loss, as more than anything else it sums up what is good about the growth of the Internet - letting people talk to other people.
There seems to be the beleif that blackholes are purely about open relays and that closing them gets you off the list. This is just not correct.
/24 or virtual hosting ip can do when the initial responsibility relies with the client.
Any company performing virtual hosting or dedicated hosting can tell you the damage a blackhole listing for a
A lot of these cowboy's operating RBL's ban a providers network without even so much as a notification to the administrator. Rather than help providers take action against a spammer they take action against the provider themselves.
How can providers be proactive in removing spammers and supportive of RBL lists when they are damaging their business by not notifying them of their inclusion.
Most hosting providers will remove spammers once they are identified.
UCE and Open relays are not allways related to each other, the problem of removing spamers goes beyond the configuration of a mail server and puts the onus of proof on ISP's, and beleive me, this can be legally dubious and taxing on a business.
As far as I can determine, Rackspace is just a fucking spam haven. I am getting very close to completely blackholing all traffic to/from Rackspace.
What we all need to do is fake open mail relays. Just report "Yeah Mr. Spammer, those 50,000 mails were sent" while not doing a thing. The spammer will think the mail has been sent, we won't get the mails; everyone will be happy!
solves that problem. My procmail filter sends a message to the sender saying that his mail was filtered out. If it is a legit message, then please send it again, with a specific subject, which will allow it through. This works, since spam houses never read their incoming mail, so they won't use the backdoor.
I don't accept ORBS having decided what's permitted and what's not !
ORBS does not decide what is "permitted" nor do any of these other databases. They have a set of criteria for deciding whether and when your mail server ends up in their database. If their criteria matches mine, then I can choose to use them as part of my mail filtering.
1. These list should inform you have been added
2. They should leave you 10-15 days to fix the problem before blocking you
3. They should help you. I was *very* shocked by ORBS attitude "we block you, and we don't care if you cannot correct it"
I'm sick of the attitude that ORBS owes you something when your mail server is an open relay. If your system is an open relay, your fuck-up will cost them time and effort as they add your system to the database. Now you think that they owe it to you provide you an absurd amount of warning (10-15 days), notification that you were added, and then you want them to provide free consulting services (see item 3). If you don't know how to run a mail server, then stop trying to.
It's like being ticketed for driving your car down the wrong side of the road at 90 miles per hour and then being pissed off that the cop did not provide you with free driving lessons and give you 10-15 days to stop driving like that.
If your system is an open relay, unplug the Ethernet cable immediately and leave it unplugged until the system is fixed. If you don't know how to fix it, then pay professionals to provide your SMTP & POP services. A spammer could spew tens of thousands of messages per hour through an open relay and you owe it to everyone else on the net do whatever it takes, including pulling the plug, to make sure that your system is not an open relay.
I think that ORBS should charge a processing fee for "expedited removal" from their database and, otherwise, just remove systems once a week.
first off, don't email the admins of Open Relay databases, they don't have time for your lame brain questions. Read the FAQ! your question has probably already been answered. Don't think you have listed unfairly! the testing systems provide PROOF, in the form of relayed email in their per-IP webpage reports. If you wish to have your system removed, configure it to not be an OPEN RELAY and submit it to be retested. Most of these sites, Orbz and Ordb, maintain automated testers, use them!
If someone runs an open relay, they deserve to be blacklisted. Those sites who enjoy receiving spam can choose not to use blacklist information. Those who do not like spam can use blacklists.
However, those who repent and fix their open relays should be immediately removed from any open relay blacklist they might be listed with. It's totally irresponsible to run a blacklist without provisions for keeping them up to date in near-realtime.
An example of a great service was ORBS (the Open Relay Blackhole Service), may it rest in peace. It was largely automated, and would add and remove sites simply based on observations made by their relay-checking robot. There were some manual entries (for sites who refused to be probed), and that was cause for a bit of controversy. But by and large it was quite excellent. I can see absolutely no reason whatsoever for anyone to complain about the creation and use of such blacklists, unless they are a spammer. I have never heard a valid reason why an open relay should be considered okay (I do *not* agree with John Gilmore, just about the only slightly credible dissenter I've heard on this topic. He's just too lazy to use one of many available alternatives to what he's trying to accomplish. See this to see what I'm talking about.)
Too bad most of the great blacklist services seem to be going away or becoming (highly overpriced) commercial endeavors.
I wonder if spammers who exploit open relays can be labelled terrorists under the new anti-hacking laws...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I think I've seen this message on more sites that use the slash engine, today ;)
I have inherited a sendmail server that I know is a open relay unfortunately while I know Solaris sendmail has been a pain to administer. It is version 1.15 on a old Sparc 20 running SunOS 4.1.4. I have tried several times to use Sendmail 8.10 however I have kept running into stability issues (user error) that have so far prevented me from bringing this version to a live server.
I know the current version that I am using is a open relay from the tests that I have ran and so far there is no way that I have been able to secure it so far from the information that I have been able to pick up at this time.
Its not that bad having open relay, you would be surprised about how many email boxes are open...Qwest was running open relay servers until 3 weeks ago (but of course that defeats my point about it being a sin =/)
forget it.
So, I guess you've never wound up the victim of a poorly-administered blacklist, have you?
My experience with open relays is virtually identical to that of the person who inspired this thread. My server was used as an open relay for part of a weekend.
Near as I can tell, the first spam fired its way out of my server on Friday night around midnight. I closed off the relay on Sunday morning around 10:00 am. In that time, literally thousands of spams were sent, so I fully expected to be blacklisted and even warned my bosses and co-workers.
What I didn't expect, however, was to still be trying to get myself off those blacklists SIX MONTHS LATER.
I think blacklists can be a valuable tool for fighting spam, but only if they're sensible. Blacklists that permanently block without ever rechecking blocked IPs are irresponsible. They're adding to the difficulty of using the Internet, not improving it. They're also reducing their value to their subscribers because they're blocking IPs they shouldn't.
In short, I agree with the post that called for an RFC. If there were some sort of standard for relay blacklists, it would be a damn sight easier getting off the lists once you've resolved the problem.
Yeah, but the problem is that you move to a new town, ask around about the apartment, and move in. THEN the bad-guys start selling crack in the apartment building. In response, the cops arrest everyone in the apartment complex, and give every resident exactly the same sentence. With no trial. Sounds fair to me.
I'm a dialup user, and I run exim from my debian machine to send mail. Of course I'm rbl'd from sf lists which makes a ton of sense. Feh. I can understand wanting to lock things down but there's no point in being a nazi about it. This isnt really related directly to spam but it's under the same umbrella.
Could have fooled me. If there is one, it sure doesn't seem to work. I continue to get increasing levels of spam on accounts that I haven't even used...
...but on the other hand, I've got this really cool diploma from a prestigious non-accredited university!
http://www.dotcomeon.com/
not only an entertaining read, but informative. give the history of the MPAS RSS project, with some interesting behind the scenes details.
"Don't forget that the first victim or relaying SPAM is the open mailserver itself
No, the first victim is whoever receives the first piece of spam as a result of your misconfigured server. Ignorance is no excuse.
Open relays are just as much a part of the problem as the people sending the spam.
Regards,
Twilight1
My friend is a smart guy, but he is running an open relay, mostly unprotected server(s) on a T1 that is just waiting to get nailed. He doesn't understand what kind of pain he could end up in and how much more difficult his life could become without precautions.
What do I do? Let him learn the hard way or is there some easy way to teach him a lesson without making him hate me for ruining his server. (and no, I'm not posting the URL here)
He likes the open relay part so that he has his own smtp server he can use from anywhere anytime - even though he has a secure server on DSL at home.
to email me: take my
Why?
I argee. If you're stupid enough to not know how to lock your mail server, you don't deserve to be a system administrator for a mail server. Not making your server an open relay should be the --FIRST-- thing on your list of things to do when you set one up. Most configurations do that by default anyway.
Most of the open relays out there are because mail adminstrators don't know jack about their job. As such, people get spammed at our expense. Open relays are no trivial matter.
Now, I don't quite argee with the Spamhaus policies. Just because a business was unlucky enough to use a web host that supports spam software sites doesn't mean they should be punished. Punish the spam software sites, and try to punish the web host without killing their own customers who are innocent of the crime.
Zodiac Survey
That's because the Earthlink mail admins are assholes.
Earthlink (a) doesn't let you connect to any mail server other than their own, and (b) when you try to send something that it doesn't like through the server, it silently drops it after accepting the letter and not giving a warning.
*AOL's* email policies are better than Earthlink's.
When I set up my mailserver, I was a total newbie, but evey piece of documentation I read warned of the evils of open relays, and that all my friends would hate me if I had one.
This was only for my home cable network, so worst case scenario I can expire my DHCP lease and change my dynamic domain name, but I still never had an open relay.
Unless you are on these blacklist because of something you did before spam was a problem (what, 10 years ago???), I think you deserve it, especially if this is a business network you are administering. If it is someone else's fault, feel free to forward my comment to them.
Karma: Incomprehensible (Mostly affected by posting at +5, reading at -1, and metamoderating everything unfair.)
Well, at least you imply that you bother to check who the spammer actually is. I guess that means you don't block many people who accidentally leave an open relay. Of course, you'd never find out whether they fixed their open relay, because you've blocked their attempts to tell you. Looks good to you...why should you care?
I suppose you'd throw out all the paper mail originating in your crackhead's zip code, too.
Are you sure?
Maybe you should try reading the post, moron. He _DID_ fix the problem as soon as he discovered it. He _CANNOT_ get delisted from the lists "maintained" by lazy bastards who don't care about rehabilitated systems.
Get a clue and learn to read.
heres a little story, about how a popular open relay database decided to add a tier 1 isp's entire ARIN/RIPE listed address space to their list. after being told repetitively that a tier 1 isp isn't responsible for the thousands of mail servers it's downstreams have (and therefor the associated open relays) , they refused to understand what they were doing was downright moronic.
The result? shrugs, they call it selective routing i guess. they blacklist our mail, we send all traffic to and from them to null0 . you wouldn't believe how quickly they became cooperative to get our null0 route removed.
This package is an installation pain.
Cease and Desist Order
To: An Unknown Number of Anti-Spam Activists, regular Internet users, Tech Magazines Writers, and... stuff
(...)
I don't think so...
The shithead hosting providers know they are signing up spammers when they take the money. duh. fuck 'em all.
If you feel that you have been unfairly blacklisted, or some open-relay list doesn't remove you from their list fast enough, get somebody else to relay your mail. If somebody else is willing to vouch for you, then the problem is solved. Your upstream ISP. A business partner.
My system was recently blacklisted on half a dozen lists because another system within my IP block was spamming. The blacklist used xxx.xxx.xxx.* instead of the specific IP address - a range that included my system. The end result for me was that I was unable to communicate with a large number of my customers, and had to move my server to a new IP range.
Requests to remove my old IP addres were, of course, ignored. My system didn't spam, had never spammed, wasn't an open relay, and was still blacklisted.
Personally, I think the spam blacklistings are a good idea in theory. As implemented, I find them annoying and worthless.
on you.
So lets get this straight. First you say you screwed up and are willing to pay your penance, but then you say that spam is completely legal and you should have every right to send it.
Please let me know what service you work for so I can NEVER use it.
You ran an open relay, perhaps if you spend some time trying to get taken off the lists, then perhaps you will be more careful next time.
Or, perhaps your employer will figure out that if they simply hire an administrator who knows what he is doing, they won't have these problems.
I just love this crap of spammers blaming everyone else.
Just three more hours seapeople and you can finally take me away from this crappy God Damned planet full of hippies
http://groups.google.com/groups?rnum=10&selm=eKvj1 NJQBHA.1228%40tkmsftngp04
Not quite. You're required to take a test and become registered with a central database to become a legal driver. Any idiot with a 486 and a net card can set up a mail system after reading a few how-to's and I've seen plenty of highly underqualified people get sucked into maintaining the corporate email servers.
Then that company can pay the price for not hiring a qualified person to do the job. When their mail starts bouncing, maybe they will get a clue and hire a qualified person.
I'd hate to see more tests, government approvals, etc. associated with the Internet. I think that these databases are doing a good job of whacking clueless people's wee-wees.
What you might try is to bring this issue up on news.admin.net-abuse.email and see if you can get things straightened out. If you go this route, have all your information in order, including your mail server name and IP, the time period in which it was open, what blacklists you were added to and which ones you're stuck on, and, most importantly, the date you got things fixed.
If you've never been in NANAE before, keep in mind that the people there are, by and large, very nice folks who are genuinely interested in solving the spam problem and not persecuting anyone who doesn't deserve it. Don't jump in there with flamethrowers blasting away. Just state your problem clearly and ask if anyone can help you out. If you're running a clean server now, you'll find all the help you'll need.
That light you see at the end of the tunnel might be from an oncoming train.
I like to run my own SMTP mail server on my local machine. It's behind my firewall, so no one can connect to it from outside. I trust it much more than I trust that my ISPs mail server to deliver my mail. The problem is, I'm finding more and more companies/people that I deal with are automatically blocking my mail sent this way, because it originates on a dial-up IP block.
Now I know that plenty of spammers use throw-away dial-up accounts, but maybe ISPs should have some sort of blacklist that they share, such that they don't keep selling accounts to known spammers. Maybe they should have harsh fines in their user agreements for spammers. Who knows... I just hate having legitimate email returned because it didn't come from an ISP's mail server.
I maintain a server at rackspace.com -- Which, as it turns out, is blacklisted on some blacklist or another that's widely used enough to generate half a dozen bounce messages a day from us. (I don't remember the blacklist name right now -- It's not one I'd heard of until this).
.. what can I do? I'm basically getting screwed by this blacklist, but short of leaving rackspace (which I'd rather not do), the best I can do is post to a newsgroup and whine about it a bit and hope that I mysteriously dissapear from the list, but the attitude they take on their website just doesn't seem to make me think that's real likely.
Why are we blacklisted? Not because we spam. Not because we've ever spammed. Not because we've had an open relay, for even a minute. We're blacklisted because someone that controls the list doesn't like rackspace (presumably because they're slow taking care of spammers or somesuch) and blocked off big chunks of their network.
.. and the best part is, there's no way to contact the people running the list! They basically say "If you have objections, post to x.x.x newsgroup and maybe you'll get lucky, but don't count on it"
So
Sigh.
I work for a large ISP and we've had entire mail servers blocked because spam happened to be routing through them at some point but the lists refused to remove the server
so basically thousands of innocent people were unable to recieve or send e-mail properly without a workaround because these blacklist servers were blocking network traffic to our hosts
In other words, you were too lazy to Do The Right Thing until you got blacklisted, and now you have a problem because not everyone is jumping right up and forgiving you. Forgive me if I don't shed a tear for you.
Just remember e-mail is neither secure nor reliable...
Thats the question.
To me, blacklists are a way to solve a problem.
They do this by listing open relays.
So there is no reason for keeping a host
on the list, after the malconfiguration
has been fixed.
Every attempt to keep hosts on the list for having
been open relays once is meant to punish or brandmark somebody.
This is nobodys business and people should have
come over it since they finished puberty.
We are not the usenet-military-court.
And of course every list who keeps fixed
hosts on not by purpose is maintained by
irresponsible people.
It reminds me of people who are blocking the
lane on purpose because _they_ think that I'm
driving too fast.
regards,
k2r
Comment removed based on user account deletion
You obviously read the documentation without ever having actually tried it. I've been on their list. "an hour"? Try over 24 hours. Never believe the marketing.
Yup. I'm on SPEWS. I hate this piece of shit blaclist. They realize that their methods will get them sued successfully, so they don't have any contact points. You have to use a newsgroup and then you get 15 replies from random people all advising you of what THEY want you to do to get unblacklisted. It seems plain stupid.
Now, I'm not an open relay. I keep my configs current and everything is run as a tight ship. But, that isnt why I'm on SPEWS. You see, I signed a multiyear contract with Level3 a while back and that is why I'm on SPEWS. All of Level3 is blocked as a spamhaven. I'm one little link on Level3 and I have 3 years left on my contract. What can I do? Nothing. Everyone on the newsgroup told me to move, but I can't exactly do that. I'm not even sure Level3 at large is a spam haven, I don't exactly get much spam from there.
It affects me in one spot only. I can't email the ISP in my little home town. So, I have problems talking to my parents, my grandmother, and my sister. The little ISP ignores my emails because they're SURE I'm a spammer. How else could I be on their SPEWS blacklist, right? Even if they did try, I doubt the spews system allows for easy "let this mail through" features.
What has all of this taught me really? Spam blacklists are no good. It is a technical solution to a social problem. I am acceptable "collateral damage" to the SPEWS system. And that pisses me off. I'll never support an antispam technical solution again. If these people would spend time developing awareness projects and getting others to contact lawmakers we'd be seeing some real spam solutions, and not some piece of shit technical solutions.
I thank the person for this thread. First off I am a user of DNSRBL's I was using MAPS for a long while until they went subscription. Spam is virtually none for myself and my customers so I thank those who run legitimate RBL's
/18 when in fact this ISP only had a /19. I contacted a maintainer of one of the RBL's that utilizes SPEWS and gave him a heads up that not only is this listing in error but Spews has blocked an additional 32 class C's that belong to another ISP. I informed him of a possible liability for such a mistake. He did not want to hear it and pointed me back to the news groups.
/18 changed to a /19 but my client remains blacklisted to this day.
A client of mine (also an RBL users) has been black listed by SPEWS for months now. This is a legitimate ISP with over 4000 dialups, few hundred DSL lines, and 100 or so collocated servers. They have been in business since 1993.
Someone built a case based on three different incidents over as many years to blacklist this ISP's entire netbock. Perhaps they should apply this same logic to UU.net.
When trying to appeal to them to be removed they were told to post to the mail abuse news groups as this is spews vehicle for removal. Well they did this and all they got was libelled by what sounded like a bunch of kids.
Here is the real bad thing about this. Spews blackholed a
Seems that he was nice enough to contact the guys at spews as the
In reallity it has not been a huge problem for them as I think even the hard core anti-spam advocates have distanced themselves from spews.
>Seriously - letting people know about this is the best way to get what you want. If your site is not a relay, any blacklist maintainer is doing their users a disservice by listing you.
>As a mail admin, I'd want to know.
Let's create a blacklist of blacklist sites and not allow blacklists from the blacklisted blacklist sites!
If you live next door, there is a good chance you can physicaly find them. If their business ethics cause you to lose business then there are things you can do. You can complain to your ISP. You can find a better ISP. You can complain to your local Better Business Bureau. You could even sue them in court depening on your location. You could get your good buddy Guido have a talk to them about their kneecaps. You have options.
Am I way off base here, or is this self-appointed mail police thing going in the wrong direction?
Yes.
The 'self-appointed mail police' aren't your problem. Your problem is with the sites that are still blocking you, after you have fixed your open relay. They may be using an old blackhole list. In any case, your mail has no god-given right to be accepted by their servers. List maintainers discourage sites from using static lists for this reason, but nobody's forcing the sites to take you out of their list.
Some lists have reasonable policies, and we've since been removed. Other places are a little more arbitrary as to removal policies, and although I can prove we're not a relay, we're still listed
Read news.admin.net-abuse.email. Every day there's a new poster ranting about the spam nazis blocking their mail, you people have no right, I fixed the problem, blah blah blah. If you've truly fixed the problem, they'll be more than happy to take you off the list. Don't expect overnight service - after all, nobody's to blame but your company for running that relay.
I could draw a bunch of analogies here, but isn't the bottom line that no one owns the internet e-mail system?
Please don't - the analogies have been drawn before, they've been heard, and they've been rebutted. Are the lists infringing your right to free speech? No. You have a right to speak, but you have no right to be heard.
You're saying no one owns the e-mail system, so everyone has the right to flood it with crap? Try, no one owns the e-mail system, so it is everyone's responsibility to keep it from being abused.
I'm trying to move data from one point to another, and some machines in the middle are discriminating against my data because a corrected, perfectly legal system configuration error.
Hardly. You're trying to move data, which is being actively refused by the recipient - they've made a choice NOT to receive your e-mail. Their action is a response to your failure to act in correcting your e-mail system. There is no 'machine in the middle.' Also, what does it matter that it's legal to run an open relay? It's legal to let garbage pile up on your lawn.. but it's not nice.
Has SPAM really decreased universally thanks to these lists?
If you didn't get blacklisted, would you have ever fixed your open relay?
Jeepers krikies! I'd be FAR more worried about the basic security holes in a system that old. Remember, Sendmail was THE canonical 'drive a truck through the security holes' daemon. Hell, you used to be able to get root access to the machine by typing one of a few single words!
Vintage computer games and RPG books available. Email me if you're interested.
So, tell me again who the smart ones are?
Geek used to be a four letter word. Now it's a six-figure one.
A blacklist is intended to do what again? Stop mail from domains of known spammers.
So you left your server open, and people exploited it to send spam. Now you're blacklisted. Looks like the blacklists are working just fine.
Fact of the matter is that YOUR SITE was used to spam people. You've fixed the hole since then? Big deal. You screwed up, and the price you pay for this accident is being blacklisted.
Here's a revolutionary idea: accept some responsibility for your mistake, and deal with the consequences. Can't get off the blacklist? Change your domain and don't screw up again.
There's far too many admins that aren't accountable and don't take the time to (a) learn about the services they're providing, and (b) check to make sure their systems are secure. If you don't know how to run a service, you have no business running it. Don't go crying when you get called on it.
1. These list should inform you have been added
;-)
If you were added to a list without any knowledge that you had a spam problem, you are not qualified to run a mail server. If you were in any danger of being blacklisted, your postmaster@ account must have received hundreds of spam complaints. If you just ignored them, what did you expect to happen?
2. They should leave you 10-15 days to fix the problem before blocking you
Why, so spammers can abuse your servers for 10-15 more days? It was eating up YOUR bandwidth too, you know..
3. They should help you. I was *very* shocked by ORBS attitude "we block you, and we don't care if you cannot correct it"
ORBS WAS the exception, not the rule. ORBS is gone now btw, but they weren't known for their user-friendliness or their accessibility. Nevertheless, it's YOUR responsibility to fix your server, not theirs.
Example : Accept any IP address for relay except ORBS, you won't be blocked but you're an open relay
You didn't come up with this idea you know.. it's been done before. What did we call the people who did that? Oh right, spammers.
The sad fact is that a lot of admins would not take action if they were not faced with the consequence of being blacklisted. Given that fact, while this solution isn't perfect, or even great, I'm not sure that there's a better one out there. In fact, it sounds like you guys may not have even been aware of the problem of running an open relay, had you not been blocked in the first place.
;-)
...isn't the bottom line that no one owns the internet e-mail system?
You've taken steps to fix the problem, which is great! I'd imagine that most of the major blacklists will begin to remove you. Some, yes, will be slower that others, but hey, consider that your penance.
Some other points:
Is this making spam less of a problem, or are we trading one problem (SPAM) for another (the reliablility of proper maintenance of SPAM Blacklists)?
Absolutely not. In fact, I don't even see any trade at all. Instead, what it is doing is moving punishment from the victims (those spending time, money, cpu cycles, etc. dealing with spam) to the offenders on the shoulders of those having done wrong (flat out spammers to lesser offenses, such as yours, running an open relay).
I'm sorry if in your particular case, you're having trouble getting off lists, but I still think that's more fair than me dealing with even more spam.
The fact that your relay was never used is meaningless too, BTW. It would have happened sooner or latter, as there certainly ARE *MANY* folks out there scanning the network looking for open relays. All they have to do is wait until most folks have gone home for the day and pound the heck out of it. You come in the next morning, hopefully notice something and stop it then, but in the mean time, damage done to the rest of us.
Expecting us to wait until you're used for spam is unacceptable.
And lastly:
No. Whoever told you that is just wrong. Internet email is not the absence of a owner, but an accumulation of shared owners. Each person who owns a SMTP server on the Internet has a small piece of ownership of Internet email. Each person is free to do what they will with their hard, and want to block others because they are causing massive problems, that's their right to do so. You can chose to ignore them, if you think they're being unreasonable, or you can chose to cooperate if you think they're not. Likewise, you could decide to block every domain with a the letter 'Q' in it if you so desire. You action may not have as much strength as you might not be able to garner much support from you fellow owners, but just because of that, you can't get mad at those who do have a good argument and *do* garner support.
My two cents,
-Bill
SlashSig Karma: Excellent (mostly affected by moderatio
You got what you earned.
Now that's a company I wouldn't feel guilty about working at and goofing off all day..
We (dds, a dutch isp) had a spam problem, and being a free email provider for such a long time did contribute to that. When we went out to solve this problem we did it in three steps:
.procmailrc and made a web interface to create procmail recipes in an "outlook" style.
/. , lurking time is over i guess :-)
- Implement RBL+ on our mailservers (got the load down a bit though)
- Created a global "spam filter" (weight system a la junkfilter) wich was opt-in for our users..
- We installed procmail, gave each user it's own
This recipe maker could then be accessed by each user on their own user pages, or they could just make receipts through their shell access
Our end users didn't really notice much about our use of RBL. And most of them don't know what rbl is annyway.
But giving them the possibility of filtering email on the serverside _themseve_ did make a difference! It gave them a feeling we are fighting spam, and that THEY are also in control !
And last but not least... Giving your users info on how to _avoid_ spam is important!. We did this by writing clear faqs on avoiding spam, and pointing each new user to these faqs
(b.t.w... this was my first post on
-- Hi! I'm a signature virus. Copy me into your sig file and help me spread
A sysadmin that doesn't think to check to see whether a newly installed SMTP relay is wide open or not is like a mechanic that forgets to put motor oil back in the engine or doesn't add brake fluid after changing the master cylinder. Not very professional. The reasonable person is leery about allowing either of them another chance to abuse their machinery in the near future.
If rlsnyder was competant, he'd have fixed the open relay, identified the blacklists that list his SMTP relay's IP address (http://www.ordb.org/lookup/rbls/) and submitted retest requests. He'd have been out of the most widely used open relay blacklists (which is all that matters) in under 24 hours.
I don't maintain any blacklists, but I do make use of them, and I have every right to continue to make use of whatever blacklists I see fit. If the blacklist nomination or removal criteria doesn't fit my needs, then I won't use them.
People that have a problem with this have realized that there's nothing whatsoever they can do about my (or any other sysadmin's) decision whether or not to use distributed blacklists to filter email. So, they try to go after the blacklists themselves. That will never ever work, because the root cause of the existance of blacklists - a desire by reasonable people to protect their systems against spammers and incompetent or inadvertant sysadmins - will still be there.
How about an automated removal process? When someone (who has fixed their open relay) requests to be removed from the spam blacklist, the blacklist's site could attempt to connect to and relay test-spam through the supposedly fixed relay. If the mail gets delivered (to e-mail addresses monitored by the spam blacklist site), then the relay hasn't been closed properly and thus won't be removed from the list.
Nobody told me the server had an open relay on it . Worse, nobody told me this was permitted to allow one department to relay off of us when they were at a customer site.
Needless to say, it wasn't long before we got listed and I got a quick education about smtp. Once I had a grasp of what was going on I immediately closed the relay and got us delisted.
Then after a sick day I came back to be informed that the relay was open again. The department in question had enough politcal clout to make it happen. Well, we got back on the lists and worse yet we got on Earthlink. I quoted RFCs, gave them alternatives to using our server as a relay (like configuring their e-mail client properly) and, in the end, I created a form letter and started turning other departments against the offender by basically telling it like it was. In a professional matter of course.
Getting off of ORBZ was easy and I'm happy to say I never landed on MAPS. But Earthlink was a chore. They run their own service and what made me unhappy is the technical contact listed in their whois entry is for desktop support. It took me a week of phone tag to find out I should be contacting a department called Corporate Escalates. Once I got to them it took less than an hour to be removed.
And fwiw, all lists are not equal. Strangely enough I did wind up on ORBZ again. It seems they changed the way they did their test and added one for name!domain_to_send_to@server2relay_from. The version of software I was using didn't stop this and I had to upgrade.
Now that I'm done with getting this off my chest (sorry, I had to.), the real issue isn't with admins who don't know anything. It's with admins who don't care enough to learn and do it right.
I don't want knowledge. I want certainty. - Law, David Bowie
I just realized... that pig image is made of spam!!!!!!!
If you're really serious about getting your email back onto the Internet, you need to make some network changes. Changing the IP address isn't enough. You'll need to change the subnet the mail server is on as well as the domain name. If you're interested in backward compatibility, as I'm sure you are, you can set up a host on the old address to forward packets on to the new host.
I discovered SpamAssassin a couple months ago and I must say I am very pleased.
It has successfully stopped around 84% of incoming spams and no false-positives (marking non-spam as spam) thus far.
You can hook it into blacklists, but I never used that feature. I doubt it'd really help much, anyways and would probably end up doing more harm than good.
Yes, 16% of spam still gets through, but that's not nearly as annoying as having mailboxes fill up with spam and eat away the spool partition at an alarming rate. Not to mention I could probably stop 90%+ of spam, but that increases the change of incorrectly tagging non-spam as spam.
Best of all, I control the rules and the scoreboard... I don't rely on a third party to deem who sends spam.
If you don't like your ISP's spam policies, change ISP. It's not the list's problem that you're one IP away from a spammer. It's also 'collateral damage' like this that forces a lot of ISPs to deal with their spam.
SPEWS
And his FAQ
And no, im not in for the karma, is just that i wanted a link, meaby others too.
http://securityportal.com.ar
Thanks anyway but I'm completely satisfied with the size of my penis.
Of course the boss who sends you email with all block caps and exclamation marks is long overdue for some luser attitude readjustment, and if you're any good he'll know it. You alone should have a final say over what email you accept, and if you want to delegate that to a script, that's up to you. If your boss needs to contact you infallibly, arrange a system.
their mail is being filtered. This is a major problem - we send mail to a customer and they never get it. Later, we find out their isp uses some stinking blacklist. Joe Customer has no idea his mail is being filtered. And no, we can't just "fix the problem" being we're using PacBell servers and PBI winds up blacklisted once or twice/year. For incoming mail we use our web hosts server and those bastards (who have been top notch in every other respect) implemented a blacklist without notifying it's customers. All of a sudden we're losing 5-10% of our legitimate mail from customers.
The bullshit associated with these lists is well documented. It's also not a matter of "running my own GD server how I like" because it's affecting a lot of users who never opted into the system and don't even no they can't reliably receive email.
I have run a mailing list for a number of years on my local ISP. Twice, my ISP has invoked the services of a SPAM blacklister. First Orbis and now SpamCop. Both times, it has shut out subscribers to my list as they were on blacklisted isps. I hate spam as much as anyone, but using the shotgun approach to punish all when only a few are guilty, is fundamentally wrong.
The Internet is getting curiouser and curiouser.
Three months ago, I was flying on my standard route complete with not only my own normal load, but (unknown to me) a cluster of portapotties in my cargo bay. Unfortunately the bay door was left unlatched and I scattered the contents of these uncleaned portapotties all over three neighborhoods. Now, it wasn't a BAD spill. Only a few thousand (or was it 10s of thousands) of people bothered. For some reason, the residents don't want me to fly on that route any more, and I don't think it's fair. It was a simple mistake, and it only affected a few people - but they told others, and now there are other places that don't want even my normal cargo flights, let alone ones with unexpected dumpage. It's just not fair and I'm gonna hold my breath until these unfair people notice that I turn blue! Why should I be humble about my mistakes. It only cost those people a few hours of cleanup, each. IT'S NOT FAIR!!!!! Why should I be penalized for someone ELSE putting those portapotties on my plane? I gotta be able to fly my route to keep my [ job | business ]. Why should I be penalized for something that happened MONTHS ago, and was small a the time. Trust me - I check the latch every time this time, and compare my cargo against what's supposed to be there. Puleeezzzz let me fly over your houses and businesses now - - puleezzzz! It's my constitutional rights! You gotta let me! You gotta be fair! It didn't really take me long to clean up the plane - why would it have taken you long enough to clean up. You shouldn't hold a grudge. You should trust me. Really!!!</SATIRE>
On the subject of open relays, how does one tell sendmail to authenticate users (using login/passwd) coming from outside?
My personal DSL mail server was used to send about 4,000 spam messages about a month ago.
;)
I instantly showed up on about 5 of these spam blocking lists, including ORBZ, the MAPS RBL, etc. I fixed the open relay issue in an hour, submitted my IP and was off all of the lists in about a day. No problem. *shrug*
P.S. Anyone know a good way to delete messages on a regexp from the Qmail queue?
Justin
"Why would God give us a waist if we wasn't supposed to rest our pants on it?" - Rev. Roy McDaniels
Now that I'm done with getting this off my chest (sorry, I had to.), the real issue isn't with admins who don't know anything. It's with admins who don't care enough to learn and do it right.
Now do you see what happens when you don't care about security? I'm sorry about the PHB a-holes you had, but that's the companies fault, not yours. However, if you're using a mail server, you better stick to your postfix/sendmail/etc. books if you want to keep your job.
Zodiac Survey
That's not to say that the place sending it wasn't a spamhaus and shouldn't have been filtered. They're able to deliver ONLY to my users that have asked for it. And now (it appears) not to them either. If the bounces continue, I'll zap the listings that allowed them thru to those users.
Yeah. That scales. Brilliant.
3. They should help you.
I see, because you're too ignorant to properly run a mail server, anyone who wants to put you on their list of open relays owes you free technical support?
Tell you what, if I ever bounce an email from you, I'll give you all the help you want, at my standard hourly contracting rates.
Y'know, I might just put that in my bounce messages...
I don't accept ORBS having decided what's permitted and what's not ! Some relaying is permitted and some not.
ORBS didn't decide anything. The owner of the mailserver using ORBS decided what is permitted, and chose to use the ORBS list to help in that goal. You don't have a right to send mail through my server, I choose to allow you to send mail through my server.
I use blacklists. I'm very careful to choose lists that are automated or actively maintained. Yes, I've had legitimate mail to one of my users get bounced because her company was running an open relay. I told them how to secure their server, they told me they had to run it that way because of remote users. To my knowledge, they're still being blocked, no apologies.
Umm, well, if you don't want the responsibility of
running your own mail server, there's plenty of
companies out there who will handle your company's email for you.
You want to put a mail server onto the wide Internet, you need to be responsible. It's not fair for us to eat your exhaust fumes out there because of your irrasponsibility/lack of training/"me me me" attitude.
#define TRUSTEDMASK 0x00FFFFFF
#define TRUSTEDNET 0x00010203
#define TRUSTED1 0x03040506
#define TRUSTED2 0x06070809
oh fer rice cakes.... well, I'd post the code, but I encounter the lameness filter. Anyway, it's pretty easy to do. Just mask RealHostAddr.sin.sin_addr.s_addr and compare it against your network and return EX_OK if you match or if you match any of the specific hosts. If you fall through without matching, call usrerr and pass a string like "550 Source IP address unacceptable for mail relaying", then set q_status and return EX_UNAVAILABLE.
Good luck.
Curious... this message board seems to allow me to include a little bit more code if I preface it with a wordy rant about not being able to post code. Must be a percentage thing. Posts must include at least a 2:1 ratio of rant to code I guess.
if (RealHostAddr.sa.sa_family == AF_INET) {
if ((RealHostAddr.sin.sin_addr.s_addr & TRUSTEDMASK) == TRUSTEDNET ||
RealHostAddr.sin.sin_addr.s_addr == TRUSTED1 ||
RealHostAddr.sin.sin_addr.s_addr == TRUSTED2) {
return (EX_OK);
}
}
Cheers
RFC 2554: SMTP AUTH.
RFC 2487: SMTP over TLS.
The first problem is that people don't use either of these things. The second problem is the don't really address the problem of dealing with spam.
If you only want to receive email from pre-designated people, you can already do that. Hotmail, for instance, provides a filter that says, "Throw everything in the trash unless I specifically tell you otherwise." But generally people don't know in advance who they want to receive email from. This is what spam takes advantage of.
Providing authentication doesn't solve this problem. One idea that has been put forward is to charge people to accept unsolicited email. The idea is that you have to pay me $1 if you aren't on my white-list. Then I can look at the email and refund you that $1 if I decide the email isn't junk. There are problems with this approach but it is an interesting idea.
why not?
'nuf said.
I don't want knowledge. I want certainty. - Law, David Bowie
We all hate spam, right? I also think it's safe to say that the vast majority of the Slashdot's readers value freedom tremendously. The merits of the GPL are well accepted here, because it lets a programmer do whatever he damn well pleases, as long as he keeps his work free. Long live democracy!
Anyway, each link in the ordb chain is the result of someone exercising their freedom to either gather and maintain information, or refuse to transport e-mail messages based on the freely gathered data. Hard to find fault with that.
I also agree that there is little reason to run an open relay, other than convenience, and that most open relays are the result of either carelessness or inexperience. However, convenience is nice. An open relay is HANDY, even for legitimate, personal purposes. Regardless of whetehr there is a good reason, shouldn't a person have the RIGHT to run an open relay? There is nothing criminal in that. It is also possible to run said open relay in such a way that the administrator gets alerted as soon as a spammer tries to abuse it, A little Perl, and voila...
I submit that I have every right to have an open relay, and not risk having my e-mail blocked based solely on that basis. I liken it to assigning guilt without proof of a crime. Imagine losing your driver's license because you MIGHT someday run a red light, though you never have. Driving, like e-mail, is a privelege after all.
I know this is controversial, but I think the ordb mentality simply does not offer the kind of dexterity to be fair and just. Countless valid communication is lost every day, because of this. It is not up to some guy in Denmark or anywhere else to tell me how I should behave or run my server. Kinda like it isn't up to Microsoft to rule how we conduct business on our desktop.
I wonder, how would Slashdotters feel if Microsoft decided to block all non-Microsoft browsers from accessing any site running IIS, and left the check box in the server's options box for such a 'feature' enabled by default. It would be their right to do this, since an admin could just turn it off, but I can guarantee that the same people that support ordb would scream bloody murder because it would be another example of Redmond trying to take their freedom away.
Think about it. There is nothing wrong with running an open relay, if you manage it right and the volume is low enough that it is reasonable to do so. Shouldn't it be your right, without fear of someone else trying to modify your behavior?
One thing that I haven't seen pointed out is that spammers seem to use the RBL's to find open relays. They no longer have to look for them, they look on the lists, or look for rejects in their own logfiles.
Get listed in Osirusoft, and watch your mail volume skyrocket within hours.
But I am speaking about Linux/Internet in 1997, for example...
Quit living in the past. It's been five years -- do you want to go back to 14.4 modems, too?
And most importantly these lists are not based on any RFC or any standard
BFD -- if mother doesn't say I can do it, I'm fornbidden? What childish crap.
And in case you hadn't noticed, spam contravenes any RFC dealing with how the Internet is intended to be used. The spammers' reply to those RFCs runs along the lines of, "RFC this, MF -- what I'm doing is not illegal, so stuff your RFCs."
DCC, or Distributed Checksum Clearinghouse is a method where when the internet gets slammed with spam, this system adds a header to each of your e-mails. With this header, you can strip out e-mails which are most likely spam. Here's an example header:
/dev/null and voila! It's gone.
X-DCC-wanadoo-be-Metrics: thermonuclear.org 1016; From=0 Message-ID=0
Received=0 Body=many Fuz1=many Fuz2=many
Basically every e-mail you get, you pipe through a program. The program takes all the headers and the body, generates a checksum on them, and stores it in a database. As you can see from above, you have From, Message-ID, Received, Body, Fuz1 and Fuz2. If everyone on the net gets 10,000 e-mails from the same From: line, it would show "many" instead of 0 (zero). Here the Body of the spam, as well as two Fuzzy methods (lossy?:-) identify this e-mail as something that has gone to tons of people, and is marked as such. Then I just have procmail spit it into
There are hooks for sendmail and qmail if you want to do it enterprise wide. I've been real happy with it. Only on a few occasions do I lose mail, but mostly because I haven't set up my "white list" or approved senders.
More info on Rhyolite's site.
Peter
TossableDigits.com: Temporary Phone Numb
What people seem to be missing is the fact that someone running a mail server for spam can claim to have fixed their configuration, get it automatically tested, and get off the blacklist. They can then change their configuration back again, and continue spamming. Any automatic testing service should keep a record of the number of times that the mail server has failed the test.
Cease and Desist Order
To: An Unknown Number of Anti-Spam Activists, regular Internet users, Tech Magazines Writers, and... stuff
(...)
I don't think so...
There's no way of knowing that the blacklists help. They sure don't hurt anyone but this yoyo who brought problem on himself. Anything that eliminates one piece of spam out of the millions/billions sent daily is worth it. Why should the admins who pay attention to business tolerate fools lightly?
It's very interesting that I stumbled upon this post, as this happened to our company today. We have a $50/month dedicated server client who ended up on a SPAM list, as an immediate result of an open relay. Now, we're spending loads of our time as a result, and only receiving $50/month in return.
/.'ers don't appreciate spending their time and resources cleaning up a mess that should've never been created in the first place, especially one that is out of the host administrator's control.
Anywho, I think SPAM Blacklists are a good idea, in concept, but many blacklist owners/moderators need to step up and take action to keep good, clean hosts off of their lists. If they can make an exception for reformed hosts, how can a host that was never deformed in the first place end up a permanent part of their list(s)?
The dirty thing to do would be to threaten a lawsuit on the owners/mods sighting that they are publishing false information about your company. It seems a bit ridiculous that they can leave listings in their databases that misrepresent other company's standards, simply because an open SMTP relay was left active inside the host's network.
Not to mention, I'm sure most people, and just about all
Fixing an open relay may be simple if you are a single user with your own domain, but its an entire different problem when you run a large network. The university I go to and work for (in a computing helpdesk position) is in the process of switching to authenticated smtp and its caused an unbelievable amount of headaches for us. The main problem is that a number of popular email clients do not support authenticated smtp very well (mainly on Macintosh) and yet we have users with all sorts of programs who won't switch over easily. We announced our plans a full three months before the scheduled switch-over and since the original email the helpdesk has received call after call from users who are either scared and confused or who are irate that they now have to give up using Eudora for Mac and switch to Netscape 4.78. No we can't recommend Mozilla or Netscape 6.2 because they are still basically beta - and Outlook poses a whole other range of problems.
Basically we've put off fixing our server thus far because of the headaches it would cause. Now we've got a ton of angry customers and alot of confused ones all because we got on the orbs list. And yet we've never received a complaint from our users about email being blocked -- just a bunch of threats from the orbs people. So now we're doing our part to prevent spam -- even if our customers don't understand why -- and man does it ever seem worth our while.
No brain, no pain!
I've been using spambouncer for a while and it works pretty well but I'd be interested to know if there are significant differences between the two.
Well I recently got an entry-level position in a large corporate enviornment, doing IT related stuff. I was surpized at the sophistication of the mail system in place for both dealing with spam and making sure company contact addresses (since there are thousands of new e-mail contacts established daily) are not blocked along with the adds for penis enlargement.
Our policy is to filter mail based upon client (e.g. employee) preference. If our client requests so, they can ellect to receive all mail, including any SPAM. If they want to, they can get SPAM from known spammers delivered to a specific folder, which is created when they download their folders in Outlook. They can block all mail except for known addresses. Domains they have ever sent mail to get put in the accept table automatically, with exception to a few (most notably hotmail and the like).
Another method we use is filtering bulk mailings. If a sever from X IP is connecting up everyday and spending several hours delivering mail to every address, you can bet that's spam and is thus filtered or at least flagged for human investigation. There are only a few major domains that deliver to a large percentage of our user base, such as humor mailing lists. And because spammers frequently change IPs, any IP delivering to over 20% of the population, which would easily be over 1,000 addresses, is flagged for review.
We have also found that often times spammers are setting up fake networks in areas of IPv4 that aren't even allocated to any network. We have even seen IP's connecting up which are supposed to be in the ameture radio range. This is either done via false route information to a helpless upstream ISP or spoofing in some way. This is increasingly common, and we have found doing a reverse-lookup on the IP address and reported hostname in ARIN works very well in stopping this. If it doesn't match, the mail is sent to the spam folder. This also works for people running dynamic DNS services on their DSL or cable connections, BUT with a registered domain name. So when you do a lookup on their domain, you get their IP address and can't tell it's on a cable or DSL network, unless you do a reverse lookup and compare the results. A true business doing a lot of e-mails will have an entry in ARIN. However, we use this with caution because it tends to flag e-mail from virtural web hosts or sites who aren't big enough to have their own netblock.
I think the solution to spam is to use the black-lists, but only within reason. I agree with many here and I also think the purpose of the lists should be to eliminate spam via open relays, and this should be done via closing those relays, not
'blacking' them out. Most are simple Netscape server-folk who have all kinds of other services open as well, including proxy, web cache, etc. and they need the blacklists to work with them to eliminate these problems.
I find the methods I've described an acceptable compromise. Although it doesn't solve the problem of wasting bandwidth, the risk is too great a valid corporate contact could be filtered due to various reasons, and the business would be lost. In a real corporate environment (read: not your home network of 5 linux boxen), you can't afford to block a complete, half, or even 1/4 of a subnet due to one abuse. There could be a client only one IP away who doesn't get through and decides to go somewhere else...
Anyway, just my 2 cents and 5 weeks experience...
"I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
In short, I agree with the post that called for an RFC. If there were some sort of standard for relay blacklists, it would be a damn sight easier getting off the lists once you've resolved the problem.
It would be a damn, damn sight easier if you read the RFC(s) advising against allowing open relays and stayed the hell out of trouble in the first place. Businesses who think thay can flop their lazy asses on the internet and suck up bux without understanding the environment should re-read the chapters in their MBA manuals about due diligence.
A lot of this would be moot with a restructuring of email in general.
Food for thought from the man behind qmail: IM2000
Anything is possible given time and money.
when the hosts that the blacklisters use are a couple hops from a mail server
if one person spams and gets the server blacklisted...not a single user will be able to send email out or recieve it. It's happened before, and no the blacklister would not remove the server from the blacklist. Eventually the mail server was forced to be taken down and users were forced to use different mail servers because there was no way to use that server with a blacklister so close on the hops. The idea is good, but the implementation is too broad. Banning an entire domain causes way too many painful routing issues sometimes.
Here is the real bad thing about this. Spews blackholed a /18 when in fact this ISP only had a /19. I contacted a maintainer of one of the RBL's that utilizes SPEWS and gave him a heads up that not only is this listing in error but Spews has blocked an additional 32 class C's that belong to another ISP.
/18 or /19 that contained thousands of legit, not spamming users would have been and still would be big news. I haven't seen anything.
/18 changed to a /19 but my client remains blacklisted to this day.
WARNING - BS METER: 75%
As a usenet spam newsgroup reader and a Spam-l list memeber, I think their listing of a
I informed him of a possible liability for such a mistake. He did not want to hear it and pointed me back to the news groups.
WARNING - BS METER: 85%
Why yes, he probably decided that taking legal advice from you about "liability" and who's email packets he was required to carry was total foolishness.
Seems that he was nice enough to contact the guys at spews as the
WARNING - BS METER: 95%
Everyone knows there is no way to contact spews. Known for months in the newsgroups, posted on their site.
In reallity it has not been a huge problem for them as I think even the hard core anti-spam advocates have distanced themselves from spews.
WARNING - BS METER: 100% }}} TROLL ALERT!!!!!!!!!
Hah, hello troll. The hard core anti-spam advocates who make up Spam-l, the "news.admin.net-abuse.email" newsgroup, etc., have come to love spews and the effectivness of these lists in general.
Methinks this troll could also be a spammer.
Thanks for that offtopic, flamebait, troll, redundant, insightful, interesting, and informative post. Too bad it wasn't funny as well.
There is no excuse for 'accidently' setting up an open relaying mail server in on a corporate network. Dumb moves result in bad things comming your way usually. You should make sure that you know what you are doing before you do it.
Our host, Verio has several large blocks of IP addresses, and they allocate a few within that range to each customer. Say we are on 111.222.111.222 and a spammer decides to start sending spam from 111.222.111.1 , then in several cases I have seen the whole IP block 111.222.111.* being added to a blocking list. This practice is ridiculous. We get no notification, and because we send out a lot of automated emails (receipts, password requests), we never get to see the bounce until we investigate manually.
:)
We have never been an open relay, never will be and yet we still get listed, and on lists that it is practically impossible to get off. This has provided us with several very annoyed customers, telling us that they have purchased, but that they have not received notification or login details.
</rant>
So I don't like spam blacklists
John
"Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients. " (http://www.dotcomeon.com/eff_011016.html).
Blacklists seem like a good idea on the surface but any system that prevents me from receiving or sending legitimate email becomes just as much a nusiance as the spam itself. Balance is the key.
Can someone tell me what resources are available for those that do want to set up compliant servers BEFORE they get blacklisted. A simple search for "open relay blacklist" did not come up with anything useful, only more retoric from anti-spam fundamentalists.
thanks,
zenas
Part of the problem is that there are still new servers coming online all the time. And many of these servers are open relay right from the start. The reason I support being very harsh on sysadmins that did let a server do spam relaying is that I believe this problem won't get solved until it get so harsh that it becomes common public knowledge that you better do the job right from the very first day you get online, or you'll have trouble for a long time. Right now, new sysadmins are putting up open relays before they ever have any idea. That needs to change. Somehow they need to be educated about this before they ever have the root/Administrator password.
now we need to go OSS in diesel cars
[Running an open relay is] like being ticketed for driving your car down the wrong side of the road at 90 miles per hour and then being pissed off that the cop did not provide you with free driving lessons and give you 10-15 days to stop driving like that.
Nice analogy, except that it doesn't work. If you're driving at 90 miles an hour on the wrong side of the road, then (1) your speedometer will tell you that you're driving at 90 miles an hour and (2) looking ahead will show you which side of the street you're on, which you can tell is the wrong side because of what you had to know to pass the test to get your driver's license.
With mail servers, however, there isn't, at least yet, any widespread tool that will tell you if you have an open relay (and given how such tools work, they'll probably be banned as "hacker tools" at the rate things are going these days). In fact, I found out recently that I'd been placed on a blacklist for having an open relay, which took me by surprise because I'd been careful to avoid having anything like that happen; it turned out that I had missed one of the potential avenues of abuse (specifically, using error bounces to spam people).
So until running a (secure!) mail server becomes as simple as driving a car and people need licenses to run servers, your analogy is inappropriate.
It is their volunteer job, and if they failed for a moment the rest of the web would get as tainted as usenet was during the peak pink floods-unusenetable.
These are warriors, these are cops and investigators, and they fight for good. But all cops are told to never make mistakes, and if 99 of 100 times you are right, it becomes quite hard to admit that 1 time you were wrong. You've got an expert system supplying your gut reaction- if you're getting a bad feeling about a person, he must have done something wrong, and the very fact he is arguing, rather than immediately accepting your expertise, well, that's exactly what all spammers do- argue. That innocent people also argue is only of interest theoretically- if we've caught them, they are spammers.
I have seen the dangers with police and FBI investigations, where when an acually innocent person is released from jail, based on strong evidence, the procecuters cannot say "we were wrong." Because we as a society don't give them enough room to do so. The procecutor only says "well, procedurally we no longer have enough to hold him..."
In some antispam groups, there also is little room to be wrong. The people who disagree with the current anti spam methods, who worry about collateral damage to 'innocents' or 'ammendments', are nothing but appologists for the spammers themselves, even if they hate spam. The cause is so just there cannot be innocents and collateral damage is irrelevant.
What we need now is a black list of bad blacklists so that people picking a technology hopefully chose to go with one of the better projects...
And if that doesn't work, we simply have a black list of blacklist blacklists, and so on!
-- Mike
What good is it to depend on reports of spam stopping after the spamming server gets listed as a basis for delisting it?
now we need to go OSS in diesel cars
If the blacklists were maintained, how about a period of probabtion for previously 'open-relay' servers? If its not maintained and monitored during this time, they go back on the blacklist for an undetermined about of time? Sounds fair to me.
There's a thread over at www.macintouch.com that talks about a problem I used to have with Apple's "AppleShare IP" server software.
Sure, you can configure it not to be an open relay, but it only checks the "From:" line in your hostname. So any spammer can just say "yes, I'm johndoe@mydomain.com" and get a relay going. No way round it.
I soon switched to using sendmail on FreeBSD...
- Oliver
The right to bear arms is only slightly less stupid than the right to arm bears...
Sorry but, copyright does not apply when you are discussing personal experience.
Typical spammer - I only sent out a "low volume" of messages and now I'm being unfairly punished WWWWWWAAAAAAAAAHHHHH!
Well, too bad for you. *ONE* piece of spam is too much, and you have only yourself or your predecessors to blame.
If you're truly not an open relay anymore, and have taken appropriate steps to close the hole, then why not consider getting someone like TrustE or an auditor like Price Waterhouse in there to audit the email box. Then find out who's blocking you and send them a letter stating that things have been cleaned up, and include the statement from the auditor. Make sure everything is on company letterhead. Give the list maintainer that you're sending the letter to an 800# to call you back with. Enclose a SASE for them to use to send you a letter. Send a tub of popcorn with the letter (go to the Popcorn Factory www.popcornfactory.com I think)
In essence - MAKE IT FREE AND EASY FOR THEM TO DEAL WITH YOU. Put your hat in your hand and APOLOGIZE profusely. You'll be surprised at the results.
We Geeks are a forgiving lot, but piss us off and you're done...
While the principle of a spam blacklist seems sound, from my own experience the hardest blows have been to the average user (and the ISP tech support that has to deal with them when they complain).
Working that tech support, I've had to deal with a few people who complained that they couldn't use a mail forwarding service, or otherwise couldn't get mail going, simply because the mail server had been put on some arbitrary blacklist with no regard for legitimate users (and given the ISP, this isn't exactly small). And yet the spam still manages to get through, somehow!
Admittedly, it isn't an overwhelming problem, but that only perpetuates it for the people who do experience it: a few reports (at best) per month, out of thousands of more pressing mail issues, are not likely to have ISPs changing their mail systems. It doesn't help that many of the people who do worry are using a 3rd-party mail service (which the ISP can't support), and that this can cause headaches for the people who want to use their ISP's mail from work (but can't get the SMTP server address for the office).
Given that the deluge of spam hasn't really been stopped, I suspect that blacklists are like plugging dam leaks with your fingers... it won't help much, and will probably cause you and others more trouble than it's worth.
easy...
how bout a few blacklists of bad spam blacklists?
and a few blacklists of bad blacklists of bad spam bla...
erm, nevermind, scratch that.
As far as I can tell, Rackspace are a pro-spam organization. There is so many spam leeches hosted at Rackspace that they must know what kind of scum they are selling to.
For months now I have been receiving an unsolicited (ie SPAM) "Children Labour News Service" email. The message contains no unsubscribe information, and the return address (childlabournews@vsnl.net) always gives a message saying that the mailbox is full.
I've tried for months sending polite messages to any possible addresses on this host, and even the listed address in the whois database, always to no avail.
Short of a pre-emptive nuclear strike, I can only see some form of blacklist as the only possible solutions to stop these messages coming to me!
Does anyone else have a better idea?
No they couldn't have. /. were calling some other reconstituted meat product SPAM then yes, a cease and desist letter could have been sent. However trademarks are context specific. Hormel have a trademark on meat called SPAM. This means I can call other things spam if I want to, so long as it's not meat. Apple computers can't sue Apples the greengrocer in the high street, as the context is different.
If
An open relay is not necessary in order to make email function at the outlying offices. You don't even need a VPN. The mail server can be configured with the static IP addresses of each of the offices as valid "local" addresses. Of course a VPN is much better as that also improves your security.
As confirmed by another of your postings, your company management are morons who have apparently hired idiots for the IT department. Obviously you recognize it, and can leave if you feel that is necessary, or can stay as long as you can deal with it, and are not blamed for it. Should they ever offer to promote you into IT, be sure you insist that you be given the authority to fix the problems with no further permission from management to go ahead.
now we need to go OSS in diesel cars
What? You're telling me this stuff actually contains meat???
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
Recently, these facts demonstrated us massive blacklists may be innacurate or under abuse. During a few weeks, a lot of Spanish free software projects, such as GNOME-DB, were blacklisted in MAPS because "they are dial-ups connections". Altough we told to MAPS administrators that we have fixed IPs in DSL connections, it was neccesary a message from Telefonica, the main spanish telephony and Internet provider.
I had an interesting discussion with Sourceforge administrators about the accuracy of MAPS lists (SF is using MAPS lists so we had blocked all emails with SF users during a few weeks).
Now, I recommend not supporting MAPS lists. I think they are abusing on them.
Actually, I sign all outgoing messages with this:
Note.- This message may or may not arrive to you. This is because a lot of non-spammer's Static IP addresses are being listed in MAPS antispam blacklists. So, please, do not use MAPS blacklists or a lot of mail for you would be lost.
All I can say is, I'm glad you're listed. Even if you've never been a relay, the potential is there for it to happen one day. I'm sure a few SPAMs could get through before you noticed and closed the hole. Perhaps that is the case with most SPAM?
I don't think you should be removed. If more admins knew this was the case, perhaps less would risk leaving an open mail relay in the first place. Any negative impact on the amount of SPAM moving around is good in my opinion.
/..sig file not found - permission denied.
Our company uses a host which uses an ordb, and we've had some people not be able to email us. It takes a few days to a week for them to get off of the list. But, I don't think I've ever seen any spam on someones account, so I say it's worth it.
I agree that it's too difficult to get un-listed. The sites should attempt to email someone useful if a server gets listed. And, there should be a single address that admins can email which will request a retest by all of the ordb servers. But, the ordbs are in no way responsible for providing tech support on fixing the problem.
Same problem as you, we were an open relay (my bad) but we have since closed the holes many months ago, but are still blacklisted on many servers.. I understand, and I write them and get removed from their list, but there is another problem I have seen arise from the use of blacklists..
That is that our server is being blacklisted by some servers because OTHER **UNAFFILIATED** servers in the same CO-LO facility are spammers.. We have absolutely no affiliation with these businesses, yet we are still being blacklisted because we are on the same network..
Good example of blacklists getting carried away and the potential problems than can arise.. This has hindered us because we host web sites and many customers are complaining because some of their emails are being bounced.. this does not reflect well on us, they don't care if it's our fault or not, just that they can't do what they were told they could do..
Has this happened to anyone else?
-FireStorm69-
What all of this rambling means is that you can filter out a great deal of spam with the right DNS blacklists. I only use DNSbl's that allow zone transfers because I don't want network latency to slow down mail delivery. It really is a worthwhile thing to do.
Finally the best thing that you can do for your users is educate them. Give them very clear examples of how doing simple things like giving your personal email to a credit card company, entering it in a guestbook, using it in USENET, using it on any public discussion board, and many more can increase their spam intake many fold. Explain that to them. Show them the proof. It's not hard to generate spam. Hell create a dummy account and make a few posts in the newsgroups. Never give the address to anyone else and don't use it yourself. Give it a week. Then show the results to your users as proof of USENET address harvesting.
Finally, don't be part of the problem (this is to the parent of the article). Be proactive in fighting spam. Sitting back and bitching about it doesn't help anyone. If you put up a server that's an open relay then you fucked up. It's your responsibility as an administrator to make sure you do your job right. Putting up and open relay isn't doing your job right (are you listening all of you damned Exchange admins?! 90% of the open relays I find and report are running Exchange!!!). When you get spam, report it (called LARTing). Drop a copy to uce@ftc.gov. Reporting stock spam to the SEC. Report bogus drug scams (loose 100lbs tonight while you sleep!) to the FDA. Report Nigerian Monet scams to the Secret Service. Report the spamertised sites to their providers and ask that they investigate (don't accuse in case it's a Joe Job). Parse through the headers and learn to identify relayed spam, BS headers, and other tricks of the trade. Submit open relays for listing in all the open relay blacklists. Report it to the owner of the IP as well. DO YOU PART! If you're not going to do you part to fight spam or ensure that you're servers are properly configured, THEN GET YOU SERVERS AND YOUR ASS OFF THE 'NET BECAUSE YOU DON"T BELONG IN THIS COMMUNITY!! Don't be part of the problem.
Meat product? I thought we were talking about SPAM?
SPAM® luncheon meat is a meat product. From SPAM Facts:"Pork shoulder meat" has the same characteristics as ham meat.
Will I retire or break 10K?
Yes. For details, see my other comment.
Will I retire or break 10K?
Hi Chad!
Here is what I have so far:
63.165.130.0/24
63.165.176.0/24
208.192.202.0/24
63.67.24.0/24
Did I miss any? I want to make sure I've blocked SMTP for all of them. If you'd like to keep being a cunt I'll be happy to just blackhole everything.
Oh, and don't bother calling or writing from yahoo or hotmail after your users complain. The group that handles 1st level support won't know what you're talking about, and if they escalate the issue I'll ignore it.
Your's Truly,
Cock
I agree with the praise for Spamcop. We implemented a DNS check against bl.spamcop.net a couple of weeks ago. Since then, from four different spot checks of the server logs, these are the stats:
Totals:
Total time Covered: 52 hours 52 minutes
842 emails rejected as spam
1691 emails received
422 emails sent
This is in a small office with about 50 users.
Wordnik, a dictionary project which aims to collect
and that's to not follow it's stated policy.
If the blocklist that's listed you has a policy of delisting within a certain period and hasn't, then tell us which blocklist and which IP and let us verify this. I, for one, will never use that list.
If it isn't breaking any stated policy, then there's no problem with the blocklist. You can try and persuade whoever is bouncing your emails that they should stop using it but, when it comes down to it, that's their decision to make.
To me the whole system of blocklists seems to be completely self-regulating. If a blocklist has harsh policies, only a few servers will use it. If it has too lax policies it won't be effective. Somewhere in between are the useful ones.
Which they have all violated on numerous occasions, to the detriment of the innocent bystanders caught up in their incompetence.
And what if it isn't? There have been numerous cases where the various blacklists have included servers
I don't like open relays and spam magnets any more than you do, but I know how easy they are to overlook, and it will happen, even to generally competent people. It is in everyone's best interests to have a quiet word with the sysadmin at an open site first, because 90% of the time, that will solve the problem.
On the other hand, what we now have is a vigilante culture where totally unaccountable people can wipe out your company (quite literally, if you depend heavily on e-mail) on a whim, and there isn't jack you can do about it. As far as I'm concerned, if these people are blocking you inappropriately, they should be liable in the same way as anyone else who damaged your business by making a false claim, and you should be able to sue them to the other side of the galaxy.
No, it's not even slightly like that. Having an open relay is inconvenient but not immediately dangerous. Having an open relay is not illegal. You are not required to pass a test before running a mail server. The internet is not governed by generally well-reasoned laws. A generally competent driver will not accidentally find themselves driving at 90mph on the wrong side of the road because they just bought a new car. All in all, the two cases aren't even remotely the same.
Do you also think that the media should be able to run business-destroying stories based on complete misinformation, and then charge extra to print an apology in the next edition (even though most of the damage is already done and they don't have to pay anything for doing it)?
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
4) Users can continue to pay for the delivery of their spam.
You think it's that people don't want to see spam? No. It's that they don't want to receive it. Procmail fixes nothing.
Most of the comments people are making seem to be of the opinions that these blacklists and blackholes are a good thing. So what I am about to say will probably not be very popular. In my experience, blacklists punish users more than spammers.
A while back I got a reply to my e-mail that had the word SPAM with a question mark inserted into the subject. After some correspondence I learned that my ISP had been "blacklisted" because they maintain open mail relays. I was snidely told I should complain to my ISP, as if I could somehow force them to fix the problem. Well I did send an e-mail telling them about the problem and asking what they could do. Their position on the subject was quite different. They felt that to close the mail relays would hurt their customers by preventing them from sending mail through the server even when they were not connected locally. Now before you point out that I could simply switch ISPs, keep in mind that I live in an area where there is not a big selection of ISPs. Anyway, their reply sounded like a lack of technical expertise to me, but apparently a few weeks later they changed their mind.
But now I had a new problem. I've got two internet connections, one which is a direct connection from my office, and the other which is a dialup connection from at home. Suddenly I found I was unable to send e-mail from my office account through my ISP account, nor could I send e-mail from my work account from at home, because both mail servers were rejecting mail not from or to their domain. This was an added pain because it meant that I had to keep changing the smtp server in my mail program everytime I switched locations.
I guess the point I am really trying to make is that various administrators will set things up the way they feel is best for the situation. However in this case closing open relaying prevented me from sending legitimate e-mails. I have a feeling that customers care less about preventing spam than they do about the system working for them. Yes, I hate spam too. On one of my accounts I've set up the system to reject e-mails from anyone not on my accept list. I still get the e-mail, only in a low priority directory that I occasionally check. The sender also gets a message telling them how they can bypass the filter. I can do this because I've got shell access on this account.
But it seems to me that blacklisting is wrong because first, it filters mail that could be from legitimate users, and second, it makes no attempt to inform the user that their e-mail was silently deleted. In my case I was lucky that my e-mail was simply flagged as possible spam, and not just deleted. Had I not found out from the recipient what was going on I might never have known.
I'm not a journalist, but I play one on slashdot
Perhaps not, but your class of server is. There are hundreds of thousands of MS Exchange boxes that are dropped onto networks by “inadvertant co-administrators” without proper configuration. Each only needs to relay a couple of spam runs to provide enough capacity to handle all the worlds spam.
Yes, you only make up 0.001% of the problem. Now why should we treat you any differently from the other 99.99%?
This merely addresses the very political nature of RBL lists in our environment. I'd love to turn it on and just let people fend for themselves but they just keep complaining that X can't send me email anymore.
And procmail isn't the only filter. Netscape and Outlook both support filtering, as do most mail clients. Yes you still get the spam, and yes with thousands of domains and hundreds of thousands of users this adds up to a lot of money quickly but it removes the political angle.
Of course the other option with EXIM is use the warning on all domains and then to give the domain owners a choice to opt-in to the system for just plain blocking once they learn about how the system works and/or are being driven crazy by spam.
Easy - go through your mail log and collect a representitative sample of IP addresses that connect to it, then write a perl script to check these against the list. Net::DNS::Resolver is your friend.
This is exactly what we did when we were deciding which DNSBLs to use. In the end we went with ORBZ inputs and SPEWS. There were some discrepencies in the relays.osirusoft.com zone, however, which prompted us not to use it.
Reply-To: blacklisting is a BAD idea, given how trivial it is to forge it.
I'm guessing the previous poster thinks the spammer would use their own Reply-To because one must respond to the advertisement in order for it be be effective. Not true.
Someone sending out spam with Reply-To: pointing to a real person other than the spammer isn't so unusual. I personally know of two examples.
1. A relative's AOL account was hacked (imagine that), and used by a spammer. To AOL's credit, they shut down outgoing mail from the account within minutes, but it was still a few hundred msgs. They were a pr0n purveyor of some sort, with an embedded link to the web site they were hawking. The mail was sent with my parents' normal From: and Reply-To: headers. Thus, anyone who wanted some goat pr0n could click on the url, but anyone who wanted to fire off an angry email sent it to my parents, not the spammer.
2. More recently, someone on AOL was sending out a Windows virus using my work email address in the Reply-To: address. Since the intent is malicious rather than commerical, the sender presumably wants nothing pointing back to them. Given that my address could have been harvested from various institutional directories or web pages over which I don't have control -- or from lots of individuals' contact lists -- I don't think there's much I could do to have kept my email address from becoming known, short of being unemployed and living in a cave.
In either case, blocking Reply-To: would really be overkill.
This last week three different people's email to me bounced back to them. I only found out by them telling me later. They came from three different systems, one was yahoo.com. I found out that my ISP was responsible, they said they had a filter of some sort that automatically popped up when they detected they were under a "spam attack".
I am only a little familiar with the technology of spam defenses, but I feel the bottom line is this: whenever a legitimate email is rejected, it represents a failure of the mail system. The penultimate goal, I feel, of any mail system is that legitimate mail gets through! This means that spam rejection is a secondary goal, and must be subservient to legitimate mail.
I am quite aware that the current state of non-neuron-based decision systems is inadequate to differentiate between spam and legitimate mail, and in the limit even neuron-based systems, e.g. humans, cannot guarantee 100% correct decisions everytime. However, this is not the issue.
The issue is the structure of the defenses. Why is my ISP making decisions for me, without my (real) consent, about what mail I receive? Isn't this like the local post office pawing through my snail mail and throwing away stuff that looks like junkmail? Of course it is. There are very strict laws against this in the US. That is why snail mail is now more reliable than the email I get via my ISP. What's up with that? (As well hopefully someday email will enjoy the same kinds of protections snail mail does in the US).
I am not for spam, I am against spam. I want tools to fight spam, and they don't have to be free. But more than that I want my legitimate email. When you throw the baby out with the bath water, as in the current situation, you have a broken system, no two ways about it.
Tom
If an ISP doesn't fulfil your specific needs, or has policies you disagree with, then there is nothing preventing you from using a different one.
If your ISP is the only one that serves your geographical area, then switching to a different ISP can cost upwards of six figures.
Will I retire or break 10K?
I realize no one makes ISP's subscribe to the blacklists...
That's not entirely true. For example I used to work at an ISP that was frequently blacklisted because the owner firmly felt that anyone who paid for an account was perfectly free to do anything legal with it, including send spam (which wasn't illegal at the time). So when I moved,the first thing when looking for a new ISP to get service from was to ask if they subscribed to the RBL. If they did, I knew chances were I wouldn't be able to get emails at my old email address reliably.
I called a local ISP, asked and when they said that they weren't subscribed, I signed up. Well, shortly thereafter I found I couldn't check my mail. I couldn't even bring up my old ISPs web page. A phone call confirmed that the old ISP was up. A traceroute showed that the traffic wasn't stopping at my ISP, but at their upstream, Above.net.
Ok, Here's the kicker. It turns out that not only does above.net use the RBL, their CTO is on the board of the RBL orgainization! Beyond that, they didn't just block email, they were blocking ALL traffic to and from my old ISP. To anyone that didn't already know about them, they simply would not exist on the net.
So my new ISP was telling the truth, they didn't subscribe to the RBL, but their upstream did. I mean, this is an upstream! It services THOUSANDS of users and they are willing to presume to filter our traffic? And when they block all traffic, not just email, it's no longer anti-spam, it's flat-out intimmidation.
Does anyone agree with me that there is simply no excuse for this, and that the one-and-only responsible way to implement these lists is to offer them on a user-level opt-in basis?
before making ridiculous assumptions that we would ACTUALLY manipulate bgp path selection for any AS other than ours, please think about what you are saying. we filtered IN OUR CORE all traffic destined for the said destination. there are still plenty of alternative path's, as we didn't advertise those routes to our peers. (please see http://www.cisco.com/warp/public/105/21.html for a tutorial on how route selection takes place with cisco routers. )
/8 at my disposal. one of my downstream's is a smaller ISP, who's been alocated a /16 from my /8 for their needs. that downstream, ISP_B , has 4 downstreams, all small dialup mom and pop ISP's, each alocated a /23
now look at it from this perspective. i have say, a
now put that problem exponentially, and frankly as nested as it gets, as a carrier, it is NOT our resposability to police the internet. our downstream must follow our AUP. sure enough that DOES include an anti-spam clause in there. so far so good right?
the owner of the said open relay might have been contacted, at least thats what the said blacklist claimed. their upstream might also have been contacted. when neither of those options proved of any help to fix the said open relay, our entire address range was blacklisted. I'm not quite sure you realise how many people were then UNJUSTIFIABLY placed in the same blacklist my consequence. as a business, our first responsability is to our customers, and frankly, one open relay, a customer of our customer, affecting mail services for our other thousands of customers worlwide is not justifiable.
when those people refused to remove us from the list, NOT WANTING TO COMPREHEND that there was a better way to deal with this miserable open relay, we showed them just how much they were affecting us.
maybe this helped clarify it for you "NeurfBallz"
While you're at it, explain how you can "fraudulently" insert a bgp null0 route. I don't recall seeing any contracts between us and the said "open relay blacklist" to carry their traffic. It seems quite within our legal rights to use policy routing and route filtering to decide what to route, and how we want to route it.
Notice hoewever, that we did not advertise that route to our peers at the various IX's.
When they contacted us on the phoen to get that route removed, and the situation was talked over, they acknoledged the fact that we had been wrongfully added (that's the part where they admit they were WRONG) . We helped them track the right server and IP range, which they THEN listed AFTER contacting the apropriate parties, and the whole situation was smoothed over.
until ANTI-SPAM measures are regulated by a governing body, they are not MUST BE's on the internet.
http://www.msg.net/utility/small/chuckmail/
Looks like an open relay, optionally acts like a teergrube.
I do not deploy Linux. Ever.
(Any address that has sent three non-spams and no spams is added to a whitelist)
Yeah. That scales. Brilliant.Because Slashdot strips the sarcasm tag, I have to ass-u-me that you're using a sarcastic tone. Fact is that searching an index built as a balanced search tree (such as a red-black tree or B+ tree) is O(log n), which means that to double the time it takes to look up a name in a whitelist, you'd have to square the number of entries in the whitelist. A hash table makes it even faster by letting the program skip the first 10 or so iterations of binary search. A good database such as PostgreSQL should take care of this for you. Could you explain how you think dietz's solution doesn't scale?
Or perhaps you aren't using sarcasm and are just agreeing.
Will I retire or break 10K?
[Autoresponding messages that don't use a subject keyword] works, since spam houses never read their incoming mail, so they won't use the backdoor.
Yes they do. Replying to spam confirms that your account exists, which lets spammers think that they can use even more of your bandwidth.
Will I retire or break 10K?
Additionally, this would be a good time to sensibly implement some things that have been kludged onto SMTP (mandate PGP, intelligent attachment capability, html formatting etc)
My problem with PGP: how do I get into the web of trust if I don't know anybody who uses PGP?
Will I retire or break 10K?
Why not require everyone that sends mail to you to use pgp?
So how do I get my public key into the web of trust if I don't personally know anybody else who uses PGP?
Will I retire or break 10K?
why you can't change to competent ISP
Most of the time, the answer will be that changing ISPs while keeping the same level of service costs six figures because the user's current ISP holds a geographic monopoly in the area. "Don't like our cable modem service? Tough s***. We're the only broadband provider in town."
what your static IP address is
Sometimes, a static IP costs six figures because the user's current ISP doesn't provide one to any non-corporate customer.
Will I retire or break 10K?
Blacklist hotmail.com and aol.com. Wouldn't that solve most of the spam problem?
How can you use my intestines as a gift? -Actual Hong Kong subtitle.
(In crackhouse terms, SPEWS reads police blotters, and if it stops seeing crime in a certain area, allows pizza delivery. I'm the crusty old Italian guy who says "No, you can't deliver to 48th street, it's a war zone, at least, it was the last time I tried to deliver a pie there sometime in 1996!")
I still apply that to reality. If I hit a town with wild traffic traps (like getting a parking ticket at 2 AM while in the car!) I take that as a unwelcome sign and refuse to do business there again ever. Not everyone is ready to fully trust a part of town with a bad reputation right away. I've noticed 15 years later a large number of boarded up and empty retail space where I got the weird ticket. I won't consider returning until it's all plowed under and rebuilt nice shiny and new. People must return as a sign it's no longer a place to be robbed. Most all the reputable businesses moved 5 miles South into the next county. This is how real world slums and internet slums are created.
The truth shall set you free!
My company had their port open, which was eventually found by the Spammers, who were routing just a ton of shit through it. I was too dumb to know how to close in spite of being the ad hoc Exchange Server Admin (I can tell you postfix wouldn't let that crap happen by default, but Exchange.. hell if I know...)
So of course eventually we were reported to the Blacklisters, and rightfully so. I wouldn't want the spam in my inbox (though I noticed 99% of the spam's destination was hotmail.com, so maybe they deserve it?), and it forced me to get off my last ass and fix it. Blacklists worked.
Of course the week, two week waiting period until we were unlisted... well that sucked ass big time... but.. we did the crime so we had to do the time.
www.jackasscritics.com
> We have fixed IPs
Good. Do you have non-anonymizing rDNS so that other people can tell that that's the truth?
Many spammers make false claims about their setups -- in fact -- half or more of the spam has unmatched MAIL FROM: envelope addresses, as compared to the point they're being relayed. Most of that is "relay rape" (abuse of servers that do uncontrolled relaying -- often misnamed "open" relaying). I'm not saying that you should be branded as a spammer. What I am saying is that your legitimate usages need to be obvious in the infrastructure.
The closest equivalent is asyncronous routing via multiple gateways. This can be very valid, especially where the underlying technology is assymetrical. But it's also a tool being used by spammers and other DDoS attackers to the point that some people are advocating the ending of all "source routing" by blocking according to known feed paths.
> Good. Do you have non-anonymizing rDNS so that other people can tell that that's the truth?
It this 'x-y-z-y.uc.nombres.ttd.es' sufficient? Ok, we cannot request to TTD to change the rDNS, however the domain, ttd.es, tell yo to write to abuse@ttd.es and/or postmaster@ttd.es if you detect spam practices.
I did it recently, and I received an ACK from them.
> Most of that is "relay rape" (abuse of servers that do uncontrolled relaying -- often misnamed "open" relaying).
Ok, for this there are the open relay blacklists, no? So, I cannot understand why we was blacklisted in DULs (dial-up, since our addresses are not dial-up connections).
I think that, the solution: closing all potential open relay by closing all domestic connections to SMTP is the first step to closing freedom (or closing Internet).
The solution for avoiding the spam is to filter messages by header and/or body. I'm using procmail since three years and I block automatically 90% spam. By configuring this in MTAs you can avoid 90% spam to your users. Of course, this configuration must be optional because the filters are not perfect.
In theory, in a world where all ISP's are run by knowledgable and competent people, only the best few blacklist operators will survive. However, the best product doesn't always have the highest sales (another consideration - do ISP's have to subscribe to the blacklists as a service? Small ISP's are more likely to go with a cheaper list). This "Natural Selection" approach will only leave us with the blacklists with the best marketing force. Think about it - is AOL the best ISP?
Also, there is more that a blacklist can do wrong than not follow its own policy. It can create policies that are illegal for one reason or another.
I really hate signatures, but go to my website.
While most system administrators are aware of the need to make sure that servers under their control do not relay to third parties, few are aware of all of the vunerabilites through which their mailserver can be used to relay mail, and which aren't exposed by the most basic form of relay tests.
:). Make sure abuse@ and postmaster@ works and is read regularly. Block port 25 inbound to hosts which aren't authorized to run mailservers so you don't have problems with unauthorized mailservers you don't know about. Block port 25 inbound AND outbound for your dialup hosts, cable modems, dsl , and other "consumer" links, which shouldn't be running mailservers, and should be using only YOUR mailservers to send email. This will stop direct-to-MX spammers from operating from your network, as well as prevent spammers from using your dialups to abuse open relays.
I've seen many administrators insist that they were not an open relay, only to be shown that they had been used as a relay, and that some very simple method was used to trick the mailserver into relaying the mail.
One example, the relay_local_from option in sendmail (which you SHOULD NOT ever use!).
With this option, the mailserver will relay
any message supposedly originating from a local
email address. So any mail supposedly from postmaster@that.server.com would be blindly relayed. There are at least 15 or so vuenerabilities that I've heard of, which can be used to trick what at first glance appeared
to be a secure mail server into relaying spam.
At one point, these were commonly overlooked by both spammers and sysadmins. These days, the spammers are testing for even the most obscure relaying vunerabilities, as wide open
relays are getting harder to find, they are finding huge numbers of servers that were only secured against the most basic methods of unauthorized mail relay, and therefore, aren't
secure at all. Theres a pretty comprehensive tester on MAPS web site, as well as several standalone testers availible under various licenses. And yes, there are commercial mailservers that *CAN'T* be secured. If you are running one of them, its your responsibility to secure it by denying unauthorized users connectivity to it, either by physically disconnecting it, or by use of firewalls or other technical means to insure that only authorized users can connect to the SMTP port on the mailserver. Even if its not practical to replace one of these mailservers, it *is* practical, and perfectly reasonable to place them behind a firewall, and put a properly secured smarthost outside the firewall
to provide the means for authorized mail to
enter and leave the network. Any of several secure-by-default mailservers can be installed and configured by any competent administrator in less than a day, providing an instant replacement to (or gateway for) an insecure mailserver. As for those administrators that haven't yet found out that their relay is insecure:
Test regularly, especially after any configuration change. Adopt a policy requiring customer mailservers to be tested for relaying periodicly, and deny connectivity to those servers which are found to be open relays until they are fixed. Fully investigate any claim that your mailserver is relaying spam.
Deal with spammers on your network as soon as you learn about them. Consider checking the antispam newsgroups occasionally for evidence of major problems (hint: google makes it very easy to search news.admin.net-abuse.*
I have two mail servers that still are blacklisted on many services because of their configuration, not their ability to relay spam. I am an avid MS user (no comments from the cheap seats) and we run Exchange. I have installed some custom addons that run in Exchange to stop spam. I won't go into to much detail, but the gist of it is, it allows relays to send the spam to my server, then it moves it to an account I have to review it and either release it or kill it. Now, organizations like ORDB continue to let me know I am an 'open relay' but in reality I am killing more spam in a week than some people even get (about 180 or so a day, mostly from one or two sources overseas all destined for US addresses).
However, I can't send mail to friends from account on those boxes because they have been deemed relays by the ORDB. Emails to ORDB come back with automated replies, and there is no number I can call.
I have contacted an attorney on this and they are looking into some case law for me. The bottom line is I am being accused of something I am not doing, and being punished for it, because the software I run is different. I am wondering where simple mistakes end and liability begins.
-Sternn
I believe SpamCop doesn't use an absolute block. So it's still quite possible for users to file spam reports against spam that's been flagged as spam.
Also, if SpamCop uses external lists, the initial SpamCop listing only needs to last long enough for the spammer to get on a more permanent/human moderated list.
If you've read your history then you know that all attempts at democracy fail, and so will this one.
Thankfully I live in a democratic republic!
. Quit playing Monopoly with Bill. Switch to one of many non-Microsoft products today.
From Merriam Webster's Collegiate Dictionary:
penultimate adj: next to the last (the penultimate chapter of a book)
The second issue is the right of a person to publish his opinions. In the US the First Amendment protects such publication; some, but not all, countries of equivalent protections
Now, as a practical matter, if the operator of a blacklist fails to remove entries when the original problems have been resolved for an adequate period, providers will be reluctant to use that list. But sites listed have no standing in that decision.
It is intersting to note that the oldest of the well known black lists, the MAPS RBL, has been criticized for being to slow in adding offendors and too quick to remove them.
One factor to keep in mind is that if there were no public blacklist, operators would maintain private deny lists that might be impossible to get out of. With the public lists, you clean up your operation, possibly follow some administrative procedures, and after a reasonable delay your listing is removed for as long as you remain clean.
Do you have functioning abuse and postmaster role accounts? Is a human being reading your spam complaints? If the answer to either of these questions is no, then you have no reason to believe that you weren't notified. I've had lots of complaints addressed to abuse or postmaster bounce.
So tell me, if I want to run for office may I paint a sign on the side of your house? Then why should the owner of a server allow me to approriate his network and do my advertising at his expense? If I've ripped him off once, why is he obligated to give me another crack at his network?
... And guess what? You're already doing your "pennance"!
Rickster/
radsoft.net