rlsnyder asks:
"I'm the inadvertant co-administrator of e-mail a for company that relies pretty heavily on it for daily business (e.g. sending confirmations of financial transactions). At one point in the not-too-distant past, our server was an open relay. I admit I'm a sinner for letting it happen, and I'm ready to do my pennance. Given the relatively low volume of mail our server moved that did not originate from inside, I doubt I was a major contributor to the world of SPAM. In any event, we've been blacklisted on a number of sites. Some lists have reasonable policies, and we've since been removed. Other places are a little more arbitrary as to removal policies, and although I can prove we're not a relay, we're still listed." While I approve of the basic concept of SPAM Blacklists, there are dozens of SPAM blacklists out there who are real keen on adding open relays to the list, but not so keen on taking rehabilitated hosts out. I would posit that SPAM blacklists that are not properly maintained are a part of the problem, not the solution. What are your thoughts on the subject?
rlsynder continues: "Am I way off base here, or is this self-appointed mail police thing going in the wrong direction? Given that I can't reliably deliver e-mail to a number of places due to being blocked, I've got a big exposure. Is this making spam less of a problem, or are we trading one problem (SPAM) for another (the reliablility of proper maintenance of SPAM Blacklists)?
I could draw a bunch of analogies here, but isn't the bottom line that no one owns the internet e-mail system? I realize no one makes ISP's subscribe to the blacklists, but basically, I'm trying to move data from one point to another, and some machines in the middle are discriminating against my data because a corrected, perfectly legal system configuration error. How is this helping? Has SPAM really decreased universally thanks to these lists?"
Slashdot Mirror
The company I work for had the same problem. As a result, we ended up having trouble getting e-mail to some of our customers. Thankfully, it was easy to get ourselves removed, but I think if people are going to use blacklists, they should also take the responsibility of keeping them maintained, both in additions and removals.
When I used to manage a mail server, I was asked to filer based on orbs. Not did this in no significant way limit the amount of spam entering the system, it became a huge administrative headache. Eventually, we stopped using the lists. I am sure there are likely better lists, but I simply prefer creating my own list, based on investigation into what's coming in.
Hormel Foods has stated they don't mind the use of the word 'spam' to refer to U.C.E., or junk mail, as long as people don't use the term spelled in all-capitals. Hormel owns the trademark on the meat product, SPAM. Given their more-reasonable-than-average position on this, let's respect their request?
[
I like the idea of something like MAPS-RBL, but I think many of them are bad hacks put together by guys who take the spam thing as a holy crusade. I don't really have a problem with that, its a free country, you do what you want.
However I fault ISPs for using them without understanding their policies. Many ISPs use these small-time black-holes because they don't want to use MAPRBL (I assume its a money thing at this point). And if you get listed, how do you know that you're listed? You don't until somebody calls somebody and says "I can't get mail through to you". There needs to be a better way.
And some sites, its not worth getting delisted. "www.joes.antispam.site.com" isn't worth the effort one way or the other.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
In this day and age, there's nothing stopping blacklist coordinators from automating the rehabilitation process: Select your host and click 'Check me now!' Passing verification removes one's host from the list.
"It remains to be seen if the human brain is powerful enough to solve the problems it has created." Dr. Richard Wallace
You wanna live in a crack house? Don't go whining to the cops when you can't get a pizza delivered at midnight.
You wanna get bandwidth with a company that provides services to spammers and relocates spammers to IP addresses to avoid blocking of single IP addresses, don't come whining to /. when the rest of the world wants nothing to do with your ISP.
If someone spams me, I block the IP address. If the ISP relocates the spammer to another IP address in the same netspace, I say "fuck it", and block the /24. Or the /16, if need be.
Don't like living in a crack house? Move.
... but dammit, they just don't seem to be getting my e-mail! I'm going to start having all my friends send them a few mails as well... *sigh*
A feeling of having made the same mistake before: Deja Foobar
This is a fallacy that continues to be propagated. I own my own mail server. The company I work for owns its mail servers. We can both decide who we want to allow to send mail to our users.
At work, we use two open relay lists; ORDB and ORBZ. Nobody forces us to use them; it's our server cluster, and our choice.
The reason we use those two systems, however, is due to the reasons pointed out in the article. Some blacklists are far too easy to get onto, or hosts are arbitrarily added by humans. The only way to get onto either of those lists is to be an open relay. The only way off is to be automatically retested and found to not be an open relay.
I've only noticed that spam is getting harder to filter because of the blacklists. No longer are they all coming from a dozen or so servers, but instead hundreds.
><));>
P. S. And how come I never got those pics of Teen Sara27 XXX 18th birthday?
ordb.org is a great site for this. They are very professional with both addition of servers, and subtraction of them. My mail server was an open relay for a time till I got an email from them saying that I was blacklisted. I quickly fixed the server, and submitted that my site be checked again, the next day I was taken off their lists, very easy. They run about 20 tests connecting to your server and sending e-mails for the most common way of sending spam. Also, as they say in their faq that they reload their lists every hour to get servers off it quickly. Well done!
OK, you've fixed your mail relay(s)..
This is a good thing - and what every blacklist's ultimate goal is.
Speaking as a mail server admin, I'd be interested to know which lists are not removing you - so that I can make sure I'm not using them.
Seriously - letting people know about this is the best way to get what you want. If your site is not a relay, any blacklist maintainer is doing their users a disservice by listing you.
As a mail admin, I'd want to know.
Alternatively, you could do the American thing and threaten a lawsuit - most blacklist operators are immune from libel charges because they're just listing people who operate open relays (truth is defense against libel) - if you're not an open relay, then you've got a good case for libel: they're deliberately publishing false information to hurt your business.
Yep, that's the root of the problem: there are a number of for-free blacklists out there which are professionally managed. Those are the ones that should be used.
And as long as we publicly point out the blacklists that are being poorly run, people will stop using them, and switch to the good ones (like RBL, RSS, DUL, ORDB). The solution is not to ban or otherwise stop using blacklists, the solution is simply to (vocally) promote the ones which stay on top of the problem.
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
I'd just like to give some props for SpamAssassin.
If you haven't heard of it, it's an elegant system that assigns a weight to each email message based on hundreds of different tests, and if the email scores over 5 (configurable), it is marked as spam.
One of the nice things about it that is it uses most of the email blacklists, but they're only worth ~2 points, so being in a blacklist alone isn't enough to kill a message. That's good for those blacklists that throw far too many people in that don't belong (osirusoft). It also uses razor, but that is only worth three points, so if someone is piping bugtraq to razor-report (that happened for a while) you won't lose all that email.
There's a really interesting set of tests (it's fun to read them) each with an obscure set of points including:
HTML with a non-white bgcolor (1.2)
Claims conformance to obscure spam law (1.0)
HTML mail with no text portion (3.33)
Various spam phrases (various points depending on how many "hits" there are)
Subject ends in an exclamation point (0.5)
The points have apparently been calculated using some program to give the best accuracy.
Anyway, SpamAssassin is the best of the spam removal programs I've seen. Give it a shot!
Being added to a blacklist without being informed of it is wrong. I was added to a blacklist due to an oversight in my mail config. We were not generally an open relay but in specific instances we were.
Any time that happens an email should be sent to postmaster@(reverse dns of mail server IP address) to inform them of the action being taken and the specifics of their openness. Just "you are running an open relay" is insufficient.
Also the ability to quickly remove the address from the blacklist when the other mail admin repairs the problem is important.
I don't particularly like blacklists but something must be done to discourage open relays and for now they are the only option.
Coding Blog
Wouldn't it just be a lot simple if the mail servers, when they receive a connection from an smtp server to deliver mail, make another connection back to the smtp server on port 25. If the connection can be made, then it means that it's an open port, and therefore the mail is rejected? Wouldn't this be a sort of "dynamic blacklist"? That way, mail from an open port is never accepted.
And the men who hold high places must be the ones who start
To mold a new reality... closer to the heart
What if it used to be a crack house, but the neighborhood cleaned up and was safe?
Spencer Ogden
When you set up a mail server, never EVER write:
host_accept_relay = localhost:192.168.1.0/2
when what you want is
host_accept_relay = localhost:192.168.1.0/30
It took me ten long hours to figure out that I allowed 1/4 of the whole Earth to use my relay, when I wanted 4 computers on a private network. And it was probably the worst 1/4 of the Earth, every C-class network... It was a long day which I will never forget. In this ten hours I read more about smtp than ever before... So remember kids, don't do this at home!
~shiny
WILL HACK FOR $$$
Your problem is twofold. First, while you've cleaned up your open relay, plenty of spammers and spam-friendly hosts make the same claim and lie (Rule #1: Spammers lie). So you may have to be patient.
More importantly, your server ip may now be sitting in hundreds of private blacklists of mail servers whose admins don't like to use the centralized lists, and just reject/blackhole spammers on their own. It is the presence of well-trusted centralized blacklist services that gives you even the hope of ever having decent communication, because without them, you'd get into a thousand tiny blacklists and never get out.
(P.S. Note that if you're checking your status using the rblcheck tool at http://relays.osirusoft.com, it will tell you about a lot of blacklists that are not intended to be publicly used and not part of the usual osirusoft dnsbl, as well...)
Crack house? A bit harsh considering the guy simply had an open relay which he then fixed.
You really think this is a valid analogy? Go spend a night in one, then go back to our cushy world of sysadmin stuff.
Didn't think so.
I'm betting he was asked to install a server - prolly a turnkey type - did so, and watched it chug along for a good long time before someone found out it was open and started using it.
More like finding a crackhead in your garage, eh?
Gee, ya think maybe he missed the giant neon sticker that came with the mailserver manual that said "your box is an open relay by default. fix that. tag - you're it!" Oh, right - that's because there is no such sticker.
If they maintain the lists, they should *maintain* them, not just treat them like a brick wall and simply pile up the addresses and leave it at that. My experience with orbz is that they don't pay attention to the people in the middle - I've been there.
Just takes a little bit of hard work, and this guy's apparently willing to do his part.
Lighten up and tackle the appropriate problem.
--Jake
The real question is did you only close down the open relay because of the black list? If that is the case then the black list did the job.
I agree that some BL's are not properly managed. The old ORBS system was a perfect example of this. They would add you if you were an open relay, but getting OUT of the database was pretty much impossible if the guy that ran it didn't like you or your attitude toward his "service".
One of my mail servers ended up on ORBZ as well as ORDB because I had made a mistake in the configuration, and I corrected it and was promptly removed after submitting a re-test request.
I now employ the use of RBL on my own servers, but I will only use those services which will remove "fixed" servers using an automated testing system that works properly. ORDB, ORBZ and Osirisoft's RBL's tend to be the best AFAIK. I have found that by using these systems, the level of SPAM that my users and I receive has dropped to a point where it's not entirely annoying or time-consuming to deal with it anymore.
One RBL that I stay away from using is the one operated by SpamCop (bl.spamcop.com). It's a great idea, but it ends up blocking out too much "real" e-mail as well, esp from the larger ISP's like Comcast, etc.
rlsnyder asks Has SPAM really decreased universally thanks to these lists? Well, it is hard to say. Spam has increased monotonically since its inception, and it continues to grow. It is possible that blacklists have helped lower the rate of growth.
What blacklists really do is get the attention of sysadmins, and get them to take the problem seriously. I, like rlsnyder, was victimized in the same way -- our mail server was an open relay, we forwarded some spam, and got blacklisted. It took me a week or so to get it straightened out, and in the process I learned quite a bit about the UCE problem. rlsnyder similarly has been enriched by the experience, whether he agrees to that at this point or not.
One always has the option of sending mail from one of the many free mail systems. If your mail is blocked while your case is being reviewed, then send it from hotmail or someplace like that. That's what we did. In took about a week for the last of the spam reporting services to delist our site, and while it was inconvenient, it wasn't devastating. It won't be for rlsnyder, either, I trust.
The big problem is that there is nothing to stop the spammers. People who relay mail through unsuspecting companies are already criminals, they will not be dissuaded by laws. The only thing that the anti-spam community can do is to try to put a finger in all 2^32 holes in the dike, and the only way to do that is to educate people. The blacklists are that education program
thad
I love Mondays. On a Monday, anything is possible.
I ran a simple procmail filter for a while, and I was astounded how much spam I could nuke by filtering based on subject line punctation. Some of my triggers:
more than 2 exclamation marks
more than 2 dollar signs
All caps
etc etc.
Worked pretty well, for its simplicity.
I recently discovered that any e-mail I sent with the return address listed here (and elsewhere on the web) will not get through to AOL. There's no notice of this of course, so I just never got responses from people on AOL. This had nothing to do with my mail server (I tested this with multiple mail servers and return addresses), it was completely based on the Reply-To header - changing the reply to address fixed the problem. Based on my experience, I see two main problems with blacklists:
Without notice that your message was rejected, it seems like the message is getting through, but the recipient is unwilling or unable to respond. This is a real pain with eBay, especially with Paypal payments (the sellers apparently never noticed that money had magically appeared in their accounts unless they received an e-mail notice).
Basing the filter on the Reply-To header is rather stupid, because it can easily be changed or forged. Spammers can simply spam under your address until it gets blacklisted, then move on to another, leaving you screwed. Sure it is simple to just change your return address, but how do you know that you have to if nobody tells you that you're blacklisted?
Big Deal. Diid you know McDonald's owns a trademark on the phrase "Smile" ? (Yeah that's right. It used to be on their cups when they were running some "Smile your at McDonal's campaign or something) Kimberly-Clark owns the trademark on Kleenex, do you think the cops come after me whenever I call my no-name tissue "Kleenex"? The point is, just because they own a trademark doesn't mean you can't use the word in whatever context you like, it means that you can't sell products under that same mark in the same field, or otherwise portray your products to belonging to that mark when they don't.
Try actually reading the question. The complaint is not about blacklists in general, but rather about poorly administered blacklists.
After lurking on news.admin.net-abuse.email for a while, I've seen a lot of mail admins post asking to have their servers un-blacklisted because they've "cleaned up their act" only to have it pointed out to them that they are still hosting spammers.
Perhaps you could tell us where you have been blacklisted and what IPs are listed so we can see for ourselves the veracity of your statement?
Your logic is... fuzzy.
First of all, your crack-house metaphor is absurd. Secondly, your "if you dont like it, move" mentality is so amazingly worthless, I'm surprised i'm even taking the time to point it out.
If you don't like it, try to make it better.
Oh shit! I forgot to click "Post Anonymously"...
That depends entirly on what blacklist we are talking about.
Our mail relay boxen were listed in orbs for a long time. We were never a major spam source, in fact, our relays were open (and stayed open because of political reasons, took us a while to get them shut down... now we have authenticated smtp and life is good)
The fact is, we got on the orbs list not because we were a spam source, but because we could have been. We were open if (and only if) you forged your from address as being from our domain. Yea...it was dumb - but believe it or not, noone spammed through us!
In fact (I said political process right?) we had permission to shut down relaying permanantly if we got abused - we were waiting for it! It never happened. (eventually, we finnally got it shut down without abuse but... it took time)
So no... bein glisted on a blacklist doesn't mean you are a spam source, unless it is one of the better blacklists. SOme blacklists will list you because you could be one. (One of the orbs tests that caught a machine of ours was an obscure uucp test that, yes meant we were open, but again.... no real spammers were actually using)
all in all I liked orbs, I think that active testing and notification was good... it helped us fix some of the stuff we didn't know about... but in the end, it wasn't a very good blacklist to block mail by because it listed alot of places that just wetren't spam sources (like us).
-Steve
"I opened my eyes, and everything went dark again"
A good point. That's why I'd buy SPEWS a beer.
The system appears to be automated -- if the blocked host stops sending spam for a long enough period of time, SPEWS appears to unblock it.
If, on the other hand, the spam continues to issue from the blocked host, SPEWS appears not to unblock it.
From what I've read in news.admin.net-abuse.email, the length of time for which a provider remains in SPEWS appears to be proportional to the length of time the provider ignored abuse complaints.
Contrast this with a privately-run blocklist (e.g. my "fsck it, block the /24".) I can't be bothered to check if the /24 has cleaned up. There are IP address ranges all the way back to the days of Cyberpromo that I haven't been bothered to unblock.
The advantage of SPEWS and its ilk is that 1000 systems can be unblocked. The problem with the blocklist on my own system is that I can rarely be bothered to unblock it.
(In crackhouse terms, SPEWS reads police blotters, and if it stops seeing crime in a certain area, allows pizza delivery. I'm the crusty old Italian guy who says "No, you can't deliver to 48th street, it's a war zone, at least, it was the last time I tried to deliver a pie there sometime in 1996!")
A little while ago a site I worked at was blacklisted.
We fixed the problem that day and when we contacted the SPAM COP he wrote back to say, basically:
All Lotus Notes Mail Servers are insecure so we're leaving you on the list. Get another mail server.
I made achange in the Notes.INI file that made it look like I was using SendMail. And he fixed us.
Ridiculous policy. Notes is pretty secure anyway! I wonder what this guy read...
This
My employer's corporate office email system is an open relay, so that outlying offices (like ours) can send email, and so the company can track what we're doing.
Recently, spammers have discovered our open system and have been relaying at a furious rate (read: thousands of emails a day.) This caused *our* email to get reflected back to us most of the time, and it also got my employer's domain on several spammer blacklists. This is such a problem, that the corporate office recently switched ISPs over it.
Now, with the new ISP, the IT guys have "cracked down on security" by banning relaying...for 1/2 the day. In the mornings we can send all the email we want (and so can the spammers), but after we all get back from lunch, no more email can be sent out. My employer is baffled why we can't get off of the blacklists, even after the move to the new ISP. I just laugh and goof off for the rest of the afternoon.
I'm all for an appeals process of some sort in order to get off of spam blacklists, but some companies do deserve to stay there, as long as their habits and policies don't radically change.
not_anne
My comments here are my own; I do not speak for my employer.
a self maintaining blacklist. if you get blacklisted and then fix it, you go to a webpage that you submit that you're fixed. then the system simply uses a seperate computer that is NOT on the webpages domain and tries to relay email. if the relay happened then the blacklisted site is still blacklisted, otherwise it is automatically removed.
Maybe 100 lines in perl to accomplish this. no real effort required.
Do not look at laser with remaining good eye.
I'm trying to move data from one point to another, and some machines in the middle are discriminating against my data
Just wait a minute there Jethro... "machines in the middle" are not discriminating against your data. It's not like your mail passes through this machine that says, "Hey, you're a bad bad person! Go away."
In fact, the recipients are the servers refusing to deal with you. Sure, it's because they've subscribed to a list, but the list is not the one refusing you, it's the server that reads from it.
That said, it's not very nice to remove you from such a list once you've demonstrated your server is fixed.
-Ryan, with the unoriginal sig
We too were listed on some of these lists. And this was at the beggining of what is now know "mail relaying". Before then, all mail servers were open-relays, and suddently your emails are blocked !
;-)
Therefore I'm against these lists but I would suggest another solution :
1. These list should inform you have been added
2. They should leave you 10-15 days to fix the problem before blocking you
3. They should help you. I was *very* shocked by ORBS attitude "we block you, and we don't care if you cannot correct it"
The problem 3 is quite grave : What can you do if your mail server doesn't support anti-relay ?
Or if you must buy another licence, or it it's opensource, but needs a new version of the OS, or things like that. OK, now all email servers support anti-relay. But this was not the case at this time.
And FIRST OF ALL, I would really like to have a RFC on this subject : I don't accept ORBS having decided what's permitted and what's not ! Some relaying is permitted and some not.
Example : Accept any IP address for relay except ORBS, you won't be blocked but you're an open relay
The Price of Freedom is Eternal Vigilance.
So, the boss realizes that perhaps my friend didn't get the message, and so the boss forwards the message to him, with a note attached, so now it reads "FW: URGENT!!! THIS IS VERY IMPORTANT!!!"
This happens two or three times before he finally figured out what was going on.
Moral of the story: quarantine spam, but don't automagically send it to a black hole. Only the addressee can truly differentiate legitimate mail from spam.
"Anything is better than IE, and you can quote me on that." -- Wil Wheaton.
Cool! (Frankly, I can't see how you'd get listed in the first place. I'm speaking primarily to the SPEWS issue, as that seems to be the "blacklist du jour", as opposed to the various open relay blocking services.)
(Yeah, I was exaggerating by implying I block the IP on the first spam. I usually don't block a /24 unless it looks like a dedicated spamming operation being hosted by a known non-responsive ISP. For dialup-through-relay spam, procmail is your friend. For my own mail, I still auto-forward-to-abuse and the FTC everything from certain ISP dialup ranges in Michigan and the Dallas-Ft. Worth area. I watch those recipes pretty quickly, and take the victim/accomplice ISPs as soon as the cockroach-in-question migrates to his next ISP.)
I personally like SpamCop.Net. It has a dynamic black list based on ip. If people report spam from a specific ip address, it will (after a certain threshhold) get added to the black list. Once the spam stops being reported, the ip address becomes open again.
I can understand the problems caused by unmaintained blacklists, or ones that operate on the roach-motel principle. All you can do is communicate directly with the blacklist maintainers, or communicate with the sites blocking you (mail to postmaster shouldn't be blocked) and see if you can convince them the blacklist is unreasonable. If sites start getting lots of reports about a blacklist refusing to delist open relays after they've been fixed, site operators may stop using those blacklists.
On the other hand, you admit to having had an open relay in your network. Back before 1995 or so this might have been excusable. If we're talking in the last 6 years, though, there's no excuse. The problems have been well-known, the solutions equally well-known and easily implemented. If you shoot yourself in the foot, even unintentionally, whose fault is the resulting pain?
If so, they're right in blocking you. You're saying "oh, we're not willing to go through the trouble of cleaning up our server, to hell with anyone who gets spammed." It's exactly those sites that they're supposed to be blocked
That's insane. Once you end up on a spamrelay list, you'll be the conduit for tons of spam within hours of even minutes. 10-15 days is an eternity in that respect.
IMO, the way it should work, to be fair, is to send a warning email to someone from the company. Then, if that email goes unnoticed, put the company in the blacklist. Even better, put something informative in that email letting people know how they can stop their server from being an open relay.
I should know. I've been in this situation, where my email server was way down on my list of priorities. I was blacklisted without warning or explanation. I had to investigate the whole matter myself, fix the problem, find the people who blacklisted me and go through their procedures to get off the blacklist. While I see the need to have blacklists, they certainly could do a better job dealing with buisnesses who have no intention of spamming and who may have just overlooked or not even known about the problem.
No, Thursday's out. How about never - is never good for you?
No, they're not unreasonable.
/. when the rest of the world wants nothing to do with your ISP.
[...]
You wanna get bandwidth with a company that provides services to spammers and relocates spammers to IP addresses to avoid blocking of single IP addresses, don't come whining to
Thank you.
The only way you get blacklisted is if you (or your ISP) is stupid enough to run a promiscuous mail server that allows anyone to use it as a maildrop/forwarder. Fix the problem (either getting a new ISP, closing up your server, or highering competent people to run your service) and you will be de-blacklisted.
If you cannot be bothered to do any of these things you (and your company) don't deserve to be on the internet, and certainly don't diserve to have any contact whatsoever with me.
Since all of these lists are voluntary, if I have chosen to shun you on the basis of one that is my choice. You do not have a right to be able to contact me if I don't wish to allow it, so get over it, learn from your mistakes, and don't make them again. If you can't be bothered to learn, then, well, enjoy being a component particle of the Black Hole.
The Future of Human Evolution: Autonomy
I started running spamassasin a few weeks ago and it works wonderfully. I've got it set up on my box so that users can choose to use it or not by some simple procmail configuration.
The way I use it is have all spam messages get dumped to a common directory. This way I can verify that I didn't lose something important. In the 169 messages it filtered out during my last cleaning, 3 (all from mailing lists I'm on) we filtered improperly, and none of them were that important.
The beauty of this approach is that I can deal with wiping the spam out all at once and not have to be digging through my mail box wondering from subject lines if something is worth reading or if it's spam. I'll just do a "grep Subject: * | less" in the directory I use for storing the filtered messages and check for any mistakes. I add the mistakes into my procmail filter and voila, I get maybe half a dozen spams a week now.
This sig has been temporarily disconnected or is no longer in service
Sysadmin A, whom didn't take the time to check the security of his mail server, is complaining about sysadmin B whom doesn't take the time to maintain his spam list?
Please tell me what company you work for. I'd like to see how well-maintained and secure your systems, apparently employed by some type of financial company, really are.
...or feel free to move your mailserver to another IP or subnet if you can't get it unblocked. Testing it could be a pain in the butt, but isn't the spam that you let through a pain in the butt also?
I/O Error G-17: Aborting Installation
Use EXIM as your mailserver and you can have the best of all worlds.
1) Messages are checked for RBL
2) A X-RBL-Warning header is added to the message
3) Users can choose to filter these messages themselves
Bankrupt a few spammers, show others it is not cheap to spam. Maybe get some charged criminally.
All spammers should be tortured, then executed.
Fight Spammers!
IMHO, Blacklists are just a small band-aid on the gaping wound that is SMTP. SPAM has proliferated to the point where it needs to be dealt with in a more sane manner than just punishing the offenders.
I'm usually all for privacy, but I think we need to be using an email transport protocol that involves some form of authentication. I'm not sure if some such protocol exists already, but it doesn't seem like it would be too hard to create.
Am I way off base here, or wouldn't this cut way down on SPAM?
"Don't blame me, I voted for Kodos!"
Try actually having to deal with spammers. They lie and threaten to sue often if I complain.
If you do the crime, be prepared to do time on the blacklist. Ignorance of spam administration is no excuse.
The rehabilitated system or network should be able to submit there address to a server to be crawled for open relays (much like submitting a URL to a search engine).
The server would connect to each address in the resubmission list and test if the relay was open. If an open relay wasn't detected then the system is put into a probationary state or taken off the list entirely. It's an automated solution that doesn't require any work by spam list administrators.
If necessary, the list of resubmissions could be distributed to volunteered machines (similar to seti) on many different networks. The volunteer machines then double-check the result. This reduces the chance of someone closing the relay exclusively for the spam list server.
A three-strikes and you're out policy could also be put into place.
Jason.
(Someday, I envision a huge "I'm Spartacus!" cascade...)
> My customer goes to the newsgroup to ask to be let out of SPEWS. Group members flame my customer to a crisp because he is supporting spammers when he pays his bill every month.
As for nanae posters flaming your customer to a crisp, well, that's USENET ;-)
Seriously, I do have a problem with that, even though I understand why it happens. The problem is that if you've read nanae long enough, you've seen every spammer lie in the book, and you're very skeptical.
I don't know a solution for that one. It's disturbing - like the cop who busts everyone for minor traffic offenses, because he believes everyone's lying to him. He's heard "I left my wallet at home!" and "Gee, my speedometer must be off!" and "I just noticed the headlight burned out when I left work!" thousands of times over his career, and the thought no longer crosses his mind that once in a while, it'll be the truth.
The nanae problem, in this sense, is that your customer (unlike the poor schmuck who did leave his wallet at home, but who probably realizes he's still toast :-) has no idea how burned-out most nanae denizens have become, and is (IMHO justly) surprised and pissed-off at the rough reception he gets when he tries to make good.
As my initial /. post shows, I'm also part of that problem (too cynical for my own good), which is why I maintain my blocklist on my own box, and only lurk on nanae. But having seen the arguments in nanae so many times, and realizing many /.ers aren't regular nanae readers and haven't read them, I figured I'd throw my two bits in here.
the poster was just asking for common courtesy towards Hormel.
sheeesh, Hormel could of gotten all uppity about it, sent its lawyer out. We all know that cease and desist letters work. If you get a cease and desist letter, and don't, you end up in court. do you have enough money to fight this in court?
Now if I could only get one of those flaming SPAM hats.
The Kruger Dunning explains most post on
Seriously. They need to be canned. NOW.
My employer's corporate office email system is an open relay, so that outlying offices (like ours) can send email, and so the company can track what we're doing.
Your employer's corporate office needs to emply a VPN.
My employer is baffled why we can't get off of the blacklists, even after the move to the new ISP.
Tell him it's because th IT guys are incompetant. Point him to this message if he thinks it's just you. You NEVER need an open relay. Tell him that you need VPNs between sites - that with the email flying around unencrypted, that anyone can view all of your internal memos as they fly between sites.
One item of spam had been sent through our server, I spotted the problem, fixed it, and got told that I'd been blacklisted. I then applied to be retested ("oh please Mr. Self-Appointed Cop, please say that I am good"), and was not removed from the list for a long long time. It should be automatic. Maybe test that server once a day for the next few weeks to make sure that it stays closed, if you feel such an urge. But everybody loses when the lists are not updated promptly - the admins of previously-open relays cannot send email, innocent recipients of email from the previously-open relay don't receive email they were expecting, and the maintainers of systems using the blacklists lose faith in the accuracy of the list, and stop using them (hopefully!).
I really don't know why people bother using these lists - I've not seen anyone claim here that they've benefitted significantly from doing so, and many people are harmed.
Author, Shell Scripting : Expert Re
As other people here have said, blacklists can be bad but most often only need some patience to get off of.
What's far more annoying, in my opinion, is those sites who've configured their mail server to be utterly anal about DNS. Forward mapping, reverse mapping, no underscores, etc. etc. Since many otherwise decent mailservers are stuck with ISP "What's DNS?" level support, this can be a pain in the ass for completely innocent victims.
Don't like living in a crack house? Move.
What about the people living next door to the crack house? Should they not be able to get a pizza as well? How about the good houses that get anonymously accused of being crack houses?
The fact of the matter is, for every legimiate spammer on the list (even the well administrated ones), there is another placed there unfairly.
In the three weeks preceding the much awaited dumping of ORBS, we started dropping mail from 4 different valid mailing lists and 1 valid business (it was a brick and mortar business - no web presence, just an e-mail server). One of the lists was LKML (and I have no idea why it was on the list), and the other three had the misfortune of being on the same web hosting service as a spammer.
The brick and mortar was on the list because of an open relay (which was a good reason to be listed), however once it was closed, they were not allowed to be removed, though their level of e-mail is about 20 - 30 message a day, and they have never send a spam in their existance.
The problem is that we are all living in close proximity here - legit businesses are only a few digits away from spammers (just like the real world). And the knee jerk reaction that most sysadmins take in dealing with the situation is similar in nature to burning half your mail daily because the postmark is similar to a known junk mailer. And burning is a reasonable analogy, because blocked emails don't get archived or analyzed, they get tossed, lock stock and barrel.
Its so easy for a sysadmin to install a blacklist and never worry about it again (unless of course, *he* starts losing messages).
The price for having a spam free existance is to constantly monitor and evaluate the system, not to light a match and walk away.
Do you have Linux and a DotPal? Click here now!
*nodding* - I'd never recommend anyone other than "me" use my blacklist. (And that's why I don't publish it :)
I'm too lazy to take entries out on a day-by-day basis. I believe public blacklists (in general) are a Good Thing, on the grounds that they're easier (for the admin) to use than private blacklists, easier (for the admin) to maintain, and easier (for legitimate customers if and when the ISP cleans up its act) to get out of.
you must use BSD
Rather than try to 'rehabilitate' those blacklists that are too rigid, count on those who subscribe to the block lists to pick those that are most responsible.
Think about it: If I run a mail server and use the biggest, least lenient blacklist provider out there, my users will start to complain when they're not getting important emails from people.
As in everything there's a middle ground between blocking too much and blocking not enough (or even none). the right answer is tu make sure mailadmins listen to their users, so they can find the right black hole list, striking the balance between spam and legitimate access.
Who knows, we may even get a responsible public organization out of this, recognized for specific rules and procedures for blacklist inclusion and removal. the sooner there's one list, the sooner we have less spam and less illegitimate blocking.
Kevin Fox
>
> If you don't like it, try to make it better.
Moderators - give that guy back a point.
I really should have written "If you don't like it, ask your landlord to evict the dealers. Then think about moving."
Or "If you don't like being listed in SPEWS, and you're not a spammer, ask your ISP to boot the spammers. You, as a customer of the listed ISP, have a hell of a lot more pull with that ISP than the spam recipients do."
You'll just have to be more careful next time. As you discovered, the cost of relaying spam is higher than you may have thought originally. Eventually, those entries will go away. But even consumers have to wait many years before bad credit information goes away.
Email as a communication medium is under attack.
The deluge of spam itself causes some of the damage, causing people to be wary about giving out their email addresses, afraid to post publically on mailing lists, or in some cases changing their email addresses and only giving them out to close family and friends. This retreat into 'email enclaves' destroys one of the best things about email - the ability to communicate with someone on the other side of the world, even if it's just a "Hi from China, I really liked your webpage!".
The other widely used approach to avoid spam is the use of aggressive blocking lists to ghettoize huge sections of the internet, preventing them from communicating with those sections of the internet that use those lists. This, too is causing massive damage to email as a medium for communication.
The third part of the problem is the fear some organizations have of being labelled spammers for behaviour that would have been considered quite reasonable a few years ago. This chilling of communication isn't as big a problem as the previous two, but it's getting worse.
A combination of spammers and ill-conceived responses to spammers is balkanizing email, making it less and less viable as a means of person-to-person communication. And losing email would be a huge, huge loss, as more than anything else it sums up what is good about the growth of the Internet - letting people talk to other people.
What we all need to do is fake open mail relays. Just report "Yeah Mr. Spammer, those 50,000 mails were sent" while not doing a thing. The spammer will think the mail has been sent, we won't get the mails; everyone will be happy!
I don't accept ORBS having decided what's permitted and what's not !
ORBS does not decide what is "permitted" nor do any of these other databases. They have a set of criteria for deciding whether and when your mail server ends up in their database. If their criteria matches mine, then I can choose to use them as part of my mail filtering.
1. These list should inform you have been added
2. They should leave you 10-15 days to fix the problem before blocking you
3. They should help you. I was *very* shocked by ORBS attitude "we block you, and we don't care if you cannot correct it"
I'm sick of the attitude that ORBS owes you something when your mail server is an open relay. If your system is an open relay, your fuck-up will cost them time and effort as they add your system to the database. Now you think that they owe it to you provide you an absurd amount of warning (10-15 days), notification that you were added, and then you want them to provide free consulting services (see item 3). If you don't know how to run a mail server, then stop trying to.
It's like being ticketed for driving your car down the wrong side of the road at 90 miles per hour and then being pissed off that the cop did not provide you with free driving lessons and give you 10-15 days to stop driving like that.
If your system is an open relay, unplug the Ethernet cable immediately and leave it unplugged until the system is fixed. If you don't know how to fix it, then pay professionals to provide your SMTP & POP services. A spammer could spew tens of thousands of messages per hour through an open relay and you owe it to everyone else on the net do whatever it takes, including pulling the plug, to make sure that your system is not an open relay.
I think that ORBS should charge a processing fee for "expedited removal" from their database and, otherwise, just remove systems once a week.
If someone runs an open relay, they deserve to be blacklisted. Those sites who enjoy receiving spam can choose not to use blacklist information. Those who do not like spam can use blacklists.
However, those who repent and fix their open relays should be immediately removed from any open relay blacklist they might be listed with. It's totally irresponsible to run a blacklist without provisions for keeping them up to date in near-realtime.
An example of a great service was ORBS (the Open Relay Blackhole Service), may it rest in peace. It was largely automated, and would add and remove sites simply based on observations made by their relay-checking robot. There were some manual entries (for sites who refused to be probed), and that was cause for a bit of controversy. But by and large it was quite excellent. I can see absolutely no reason whatsoever for anyone to complain about the creation and use of such blacklists, unless they are a spammer. I have never heard a valid reason why an open relay should be considered okay (I do *not* agree with John Gilmore, just about the only slightly credible dissenter I've heard on this topic. He's just too lazy to use one of many available alternatives to what he's trying to accomplish. See this to see what I'm talking about.)
Too bad most of the great blacklist services seem to be going away or becoming (highly overpriced) commercial endeavors.
I wonder if spammers who exploit open relays can be labelled terrorists under the new anti-hacking laws...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I think I've seen this message on more sites that use the slash engine, today ;)
So, I guess you've never wound up the victim of a poorly-administered blacklist, have you?
My experience with open relays is virtually identical to that of the person who inspired this thread. My server was used as an open relay for part of a weekend.
Near as I can tell, the first spam fired its way out of my server on Friday night around midnight. I closed off the relay on Sunday morning around 10:00 am. In that time, literally thousands of spams were sent, so I fully expected to be blacklisted and even warned my bosses and co-workers.
What I didn't expect, however, was to still be trying to get myself off those blacklists SIX MONTHS LATER.
I think blacklists can be a valuable tool for fighting spam, but only if they're sensible. Blacklists that permanently block without ever rechecking blocked IPs are irresponsible. They're adding to the difficulty of using the Internet, not improving it. They're also reducing their value to their subscribers because they're blocking IPs they shouldn't.
In short, I agree with the post that called for an RFC. If there were some sort of standard for relay blacklists, it would be a damn sight easier getting off the lists once you've resolved the problem.
I'm a dialup user, and I run exim from my debian machine to send mail. Of course I'm rbl'd from sf lists which makes a ton of sense. Feh. I can understand wanting to lock things down but there's no point in being a nazi about it. This isnt really related directly to spam but it's under the same umbrella.
My friend is a smart guy, but he is running an open relay, mostly unprotected server(s) on a T1 that is just waiting to get nailed. He doesn't understand what kind of pain he could end up in and how much more difficult his life could become without precautions.
What do I do? Let him learn the hard way or is there some easy way to teach him a lesson without making him hate me for ruining his server. (and no, I'm not posting the URL here)
He likes the open relay part so that he has his own smtp server he can use from anywhere anytime - even though he has a secure server on DSL at home.
to email me: take my
I argee. If you're stupid enough to not know how to lock your mail server, you don't deserve to be a system administrator for a mail server. Not making your server an open relay should be the --FIRST-- thing on your list of things to do when you set one up. Most configurations do that by default anyway.
Most of the open relays out there are because mail adminstrators don't know jack about their job. As such, people get spammed at our expense. Open relays are no trivial matter.
Now, I don't quite argee with the Spamhaus policies. Just because a business was unlucky enough to use a web host that supports spam software sites doesn't mean they should be punished. Punish the spam software sites, and try to punish the web host without killing their own customers who are innocent of the crime.
Zodiac Survey
Cease and Desist Order
To: An Unknown Number of Anti-Spam Activists, regular Internet users, Tech Magazines Writers, and... stuff
(...)
I don't think so...
My system was recently blacklisted on half a dozen lists because another system within my IP block was spamming. The blacklist used xxx.xxx.xxx.* instead of the specific IP address - a range that included my system. The end result for me was that I was unable to communicate with a large number of my customers, and had to move my server to a new IP range.
Requests to remove my old IP addres were, of course, ignored. My system didn't spam, had never spammed, wasn't an open relay, and was still blacklisted.
Personally, I think the spam blacklistings are a good idea in theory. As implemented, I find them annoying and worthless.
Not quite. You're required to take a test and become registered with a central database to become a legal driver. Any idiot with a 486 and a net card can set up a mail system after reading a few how-to's and I've seen plenty of highly underqualified people get sucked into maintaining the corporate email servers.
Then that company can pay the price for not hiring a qualified person to do the job. When their mail starts bouncing, maybe they will get a clue and hire a qualified person.
I'd hate to see more tests, government approvals, etc. associated with the Internet. I think that these databases are doing a good job of whacking clueless people's wee-wees.
Good call. I haven't read the rest of the posts just yet but I found someone who agrees with me.
;> ).
At this point in my career, I am tired of dealing with half-assed admins who can't tie a shoe.
You were hired based on a particular compentance level. You said you knew how to administer a mailserver. If you say you can administer a mailserver, you should know about open relays. If this was your first job administering a mailserver, you shouldn't have gotten the fucking job.
As an admin, YOU and you alone are responsible for what comes out of your network.
Back when codered was flooding the internet (and still is,along with nimda, based on my fucking log files), I had to call this company that was sending out codered scans from no less than 5 different IP addresses. At ONE company! I searched through internic records (I'll be damned if I was going to load the company's website) and finally got in touch with someone who claimed to be the network admin. I explained the situation to him and he proceeded to tell me that he wasn't aware that these servers were even running! How in the fuck can you not know what goes on with your network?
You see, I'm paranoid. I want to know everything that goes on with my network at any given time. I do my damndest to make sure everything is secure as possible (short of pulling the damn cat 5 out of the switch). I've got the switches locked to MAC address so no one can just plug in a machine. I've got a external mail relay that only forwards mail to our firewall that is then passed to our Exchange server ( the one halfway decent product MS makes). Not only is the external mail scanner running some stuff to check for basic attachment viruses, but our exchange server is running Norton for Exchange. The client machines have NAV as well which uses a central server to update definition files daily. The outlook clients are running the Attachment and Zone patch from Microsoft. And to top it off, you can't relay trough our server without authentication which most email clients support nowadays.
Some people call that paranoid but while our clients got slammed by the latest outlook bugs, we happily zoomed along without a single infection (should have seen the NAV logs on the email server though
The point of all this is this. You were hired to do a job. If you aren't compentant to do the job then get the hell out of the way and go work under someone who can.
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
What you might try is to bring this issue up on news.admin.net-abuse.email and see if you can get things straightened out. If you go this route, have all your information in order, including your mail server name and IP, the time period in which it was open, what blacklists you were added to and which ones you're stuck on, and, most importantly, the date you got things fixed.
If you've never been in NANAE before, keep in mind that the people there are, by and large, very nice folks who are genuinely interested in solving the spam problem and not persecuting anyone who doesn't deserve it. Don't jump in there with flamethrowers blasting away. Just state your problem clearly and ask if anyone can help you out. If you're running a clean server now, you'll find all the help you'll need.
That light you see at the end of the tunnel might be from an oncoming train.
Think that's bad?
From my deny file:
210 This mailserver does not accept spam from AsiaPacific netblocks. If this is in error, please send email to dj_tweek@yahoo.com
211 This mailserver does not accept spam from AsiaPacific networks. If this is in error, please contact dj_tweek@yahoo.com
202 This mailserver does not accept spam from AsiaPacific networks. If this is in error please email dj_tweek@yahoo.com
203 This mailserver does not accept spam from AsiaPacific netblocks. If this is in error, please contact dj_tweek@yahoo.com
61 This email server does not accept spam from Asia Pacific networks. If you feel this is in error, contact dj_tweek@yahoo.com
I don't know anybody from there and I give an option for the serious people who want to get in touch with me.
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
There has to be someway of ascertaining the list, without DOS'ing the DB's website (sending 2^32 queries to their server is probably something that is not appreciated by anyone).
Why would you want to know every entry in a blackhole list? You want to know if you're in it, and all the reputable ones make it very easy to figure that out. I can only think of one reason why someone would want a complete list of all open relays on the net, and that's so they could abuse them.
Rackspace is wonderful, and I would encourage anyone who is need of a Managed Host to go there.
Just my 2 Cents worth.
I disable sigs...do you?
Comment removed based on user account deletion
I thank the person for this thread. First off I am a user of DNSRBL's I was using MAPS for a long while until they went subscription. Spam is virtually none for myself and my customers so I thank those who run legitimate RBL's
/18 when in fact this ISP only had a /19. I contacted a maintainer of one of the RBL's that utilizes SPEWS and gave him a heads up that not only is this listing in error but Spews has blocked an additional 32 class C's that belong to another ISP. I informed him of a possible liability for such a mistake. He did not want to hear it and pointed me back to the news groups.
/18 changed to a /19 but my client remains blacklisted to this day.
A client of mine (also an RBL users) has been black listed by SPEWS for months now. This is a legitimate ISP with over 4000 dialups, few hundred DSL lines, and 100 or so collocated servers. They have been in business since 1993.
Someone built a case based on three different incidents over as many years to blacklist this ISP's entire netbock. Perhaps they should apply this same logic to UU.net.
When trying to appeal to them to be removed they were told to post to the mail abuse news groups as this is spews vehicle for removal. Well they did this and all they got was libelled by what sounded like a bunch of kids.
Here is the real bad thing about this. Spews blackholed a
Seems that he was nice enough to contact the guys at spews as the
In reallity it has not been a huge problem for them as I think even the hard core anti-spam advocates have distanced themselves from spews.
Can you not tell your mailserver to consider your ISP's server it's smarthost?
Vintage computer games and RPG books available. Email me if you're interested.
Am I way off base here, or is this self-appointed mail police thing going in the wrong direction?
Yes.
The 'self-appointed mail police' aren't your problem. Your problem is with the sites that are still blocking you, after you have fixed your open relay. They may be using an old blackhole list. In any case, your mail has no god-given right to be accepted by their servers. List maintainers discourage sites from using static lists for this reason, but nobody's forcing the sites to take you out of their list.
Some lists have reasonable policies, and we've since been removed. Other places are a little more arbitrary as to removal policies, and although I can prove we're not a relay, we're still listed
Read news.admin.net-abuse.email. Every day there's a new poster ranting about the spam nazis blocking their mail, you people have no right, I fixed the problem, blah blah blah. If you've truly fixed the problem, they'll be more than happy to take you off the list. Don't expect overnight service - after all, nobody's to blame but your company for running that relay.
I could draw a bunch of analogies here, but isn't the bottom line that no one owns the internet e-mail system?
Please don't - the analogies have been drawn before, they've been heard, and they've been rebutted. Are the lists infringing your right to free speech? No. You have a right to speak, but you have no right to be heard.
You're saying no one owns the e-mail system, so everyone has the right to flood it with crap? Try, no one owns the e-mail system, so it is everyone's responsibility to keep it from being abused.
I'm trying to move data from one point to another, and some machines in the middle are discriminating against my data because a corrected, perfectly legal system configuration error.
Hardly. You're trying to move data, which is being actively refused by the recipient - they've made a choice NOT to receive your e-mail. Their action is a response to your failure to act in correcting your e-mail system. There is no 'machine in the middle.' Also, what does it matter that it's legal to run an open relay? It's legal to let garbage pile up on your lawn.. but it's not nice.
Has SPAM really decreased universally thanks to these lists?
If you didn't get blacklisted, would you have ever fixed your open relay?
Jeepers krikies! I'd be FAR more worried about the basic security holes in a system that old. Remember, Sendmail was THE canonical 'drive a truck through the security holes' daemon. Hell, you used to be able to get root access to the machine by typing one of a few single words!
Vintage computer games and RPG books available. Email me if you're interested.
ooh, scary! I'm sure I'll be cut off from a sizeable subsystem of the .cx domain.
Open relays aren't the problem. Without them, you're stuck with webmail and large ISPs. Some joker with a DSL or Cable modem (his or somebody else's) sends more than any open relay. Most of your spam is your ISP's fault directly -- either through bad security or bad configuration or willfull participation. *cough*AOL*Hotmail*cough
1. These list should inform you have been added
;-)
If you were added to a list without any knowledge that you had a spam problem, you are not qualified to run a mail server. If you were in any danger of being blacklisted, your postmaster@ account must have received hundreds of spam complaints. If you just ignored them, what did you expect to happen?
2. They should leave you 10-15 days to fix the problem before blocking you
Why, so spammers can abuse your servers for 10-15 more days? It was eating up YOUR bandwidth too, you know..
3. They should help you. I was *very* shocked by ORBS attitude "we block you, and we don't care if you cannot correct it"
ORBS WAS the exception, not the rule. ORBS is gone now btw, but they weren't known for their user-friendliness or their accessibility. Nevertheless, it's YOUR responsibility to fix your server, not theirs.
Example : Accept any IP address for relay except ORBS, you won't be blocked but you're an open relay
You didn't come up with this idea you know.. it's been done before. What did we call the people who did that? Oh right, spammers.
Now that's a company I wouldn't feel guilty about working at and goofing off all day..
We (dds, a dutch isp) had a spam problem, and being a free email provider for such a long time did contribute to that. When we went out to solve this problem we did it in three steps:
.procmailrc and made a web interface to create procmail recipes in an "outlook" style.
/. , lurking time is over i guess :-)
- Implement RBL+ on our mailservers (got the load down a bit though)
- Created a global "spam filter" (weight system a la junkfilter) wich was opt-in for our users..
- We installed procmail, gave each user it's own
This recipe maker could then be accessed by each user on their own user pages, or they could just make receipts through their shell access
Our end users didn't really notice much about our use of RBL. And most of them don't know what rbl is annyway.
But giving them the possibility of filtering email on the serverside _themseve_ did make a difference! It gave them a feeling we are fighting spam, and that THEY are also in control !
And last but not least... Giving your users info on how to _avoid_ spam is important!. We did this by writing clear faqs on avoiding spam, and pointing each new user to these faqs
(b.t.w... this was my first post on
-- Hi! I'm a signature virus. Copy me into your sig file and help me spread
I disagree. You are very much responsible. Now, granted, you can't be expected to actually administer those systems. If one of your sub-leased addresses winds up used by a spammer, that doesn't mean right off you've done anything wrong. But... if reasonable efforts are made to address the situation with the sub-leasee, and they aren't willing to deal with the situation, then it does become your responsibility.
If that was actually what happened, and you just said "not our problem" then you were as guilty as the spammers. Moreso really.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Nobody told me the server had an open relay on it . Worse, nobody told me this was permitted to allow one department to relay off of us when they were at a customer site.
Needless to say, it wasn't long before we got listed and I got a quick education about smtp. Once I had a grasp of what was going on I immediately closed the relay and got us delisted.
Then after a sick day I came back to be informed that the relay was open again. The department in question had enough politcal clout to make it happen. Well, we got back on the lists and worse yet we got on Earthlink. I quoted RFCs, gave them alternatives to using our server as a relay (like configuring their e-mail client properly) and, in the end, I created a form letter and started turning other departments against the offender by basically telling it like it was. In a professional matter of course.
Getting off of ORBZ was easy and I'm happy to say I never landed on MAPS. But Earthlink was a chore. They run their own service and what made me unhappy is the technical contact listed in their whois entry is for desktop support. It took me a week of phone tag to find out I should be contacting a department called Corporate Escalates. Once I got to them it took less than an hour to be removed.
And fwiw, all lists are not equal. Strangely enough I did wind up on ORBZ again. It seems they changed the way they did their test and added one for name!domain_to_send_to@server2relay_from. The version of software I was using didn't stop this and I had to upgrade.
Now that I'm done with getting this off my chest (sorry, I had to.), the real issue isn't with admins who don't know anything. It's with admins who don't care enough to learn and do it right.
I don't want knowledge. I want certainty. - Law, David Bowie
If you don't like your ISP's spam policies, change ISP. It's not the list's problem that you're one IP away from a spammer. It's also 'collateral damage' like this that forces a lot of ISPs to deal with their spam.
How many sites could a blacklist site blacklist if a blacklist site could blacklist sites?
How many sites could a blacklist site blacklist site blacklist if a blacklist site blacklist site could blacklist blacklist sites?
Whee!
-If
Run a pencil-and-paper RPG campaign with your far-off friends: Gametable!
Now that I'm done with getting this off my chest (sorry, I had to.), the real issue isn't with admins who don't know anything. It's with admins who don't care enough to learn and do it right.
Now do you see what happens when you don't care about security? I'm sorry about the PHB a-holes you had, but that's the companies fault, not yours. However, if you're using a mail server, you better stick to your postfix/sendmail/etc. books if you want to keep your job.
Zodiac Survey
RFC 2554: SMTP AUTH.
RFC 2487: SMTP over TLS.
The first problem is that people don't use either of these things. The second problem is the don't really address the problem of dealing with spam.
If you only want to receive email from pre-designated people, you can already do that. Hotmail, for instance, provides a filter that says, "Throw everything in the trash unless I specifically tell you otherwise." But generally people don't know in advance who they want to receive email from. This is what spam takes advantage of.
Providing authentication doesn't solve this problem. One idea that has been put forward is to charge people to accept unsolicited email. The idea is that you have to pay me $1 if you aren't on my white-list. Then I can look at the email and refund you that $1 if I decide the email isn't junk. There are problems with this approach but it is an interesting idea.
'nuf said.
I don't want knowledge. I want certainty. - Law, David Bowie
Until the blacklist site of blacklist sites refuses to remove blacklist sites who have changed there ways, then we need a blacklist of blacklist sites of blacklist sites.
Is the room spining for everyone else now?
Go one step further, disable the Windows Scripting Host. It's easy to do, and we do it for all of our users at my shop, with a simple command in the login scripts. Symantec makes a free tool, which you can find here.
.vbs files as harmless as .txt files, very handy for when a hot virus/worm sneaks past Norton before the new definitions are out. Of course, if you block attachments with executable extensions, you're fine, but, you can never be too paranoid. :)
This renders those nasty
When in danger or in doubt, run in circles, scream and shout. --Robert A. Heinlein
Well I recently got an entry-level position in a large corporate enviornment, doing IT related stuff. I was surpized at the sophistication of the mail system in place for both dealing with spam and making sure company contact addresses (since there are thousands of new e-mail contacts established daily) are not blocked along with the adds for penis enlargement.
Our policy is to filter mail based upon client (e.g. employee) preference. If our client requests so, they can ellect to receive all mail, including any SPAM. If they want to, they can get SPAM from known spammers delivered to a specific folder, which is created when they download their folders in Outlook. They can block all mail except for known addresses. Domains they have ever sent mail to get put in the accept table automatically, with exception to a few (most notably hotmail and the like).
Another method we use is filtering bulk mailings. If a sever from X IP is connecting up everyday and spending several hours delivering mail to every address, you can bet that's spam and is thus filtered or at least flagged for human investigation. There are only a few major domains that deliver to a large percentage of our user base, such as humor mailing lists. And because spammers frequently change IPs, any IP delivering to over 20% of the population, which would easily be over 1,000 addresses, is flagged for review.
We have also found that often times spammers are setting up fake networks in areas of IPv4 that aren't even allocated to any network. We have even seen IP's connecting up which are supposed to be in the ameture radio range. This is either done via false route information to a helpless upstream ISP or spoofing in some way. This is increasingly common, and we have found doing a reverse-lookup on the IP address and reported hostname in ARIN works very well in stopping this. If it doesn't match, the mail is sent to the spam folder. This also works for people running dynamic DNS services on their DSL or cable connections, BUT with a registered domain name. So when you do a lookup on their domain, you get their IP address and can't tell it's on a cable or DSL network, unless you do a reverse lookup and compare the results. A true business doing a lot of e-mails will have an entry in ARIN. However, we use this with caution because it tends to flag e-mail from virtural web hosts or sites who aren't big enough to have their own netblock.
I think the solution to spam is to use the black-lists, but only within reason. I agree with many here and I also think the purpose of the lists should be to eliminate spam via open relays, and this should be done via closing those relays, not
'blacking' them out. Most are simple Netscape server-folk who have all kinds of other services open as well, including proxy, web cache, etc. and they need the blacklists to work with them to eliminate these problems.
I find the methods I've described an acceptable compromise. Although it doesn't solve the problem of wasting bandwidth, the risk is too great a valid corporate contact could be filtered due to various reasons, and the business would be lost. In a real corporate environment (read: not your home network of 5 linux boxen), you can't afford to block a complete, half, or even 1/4 of a subnet due to one abuse. There could be a client only one IP away who doesn't get through and decides to go somewhere else...
Anyway, just my 2 cents and 5 weeks experience...
"I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
As to what to tell your boss, tell him to look into getting some software that can do content filtering as the mail comes in. Where I work all incoming mail is virus checked then goes through the content filters before being delivered. We have a spam account where offensive mail can be forwarded and an admin then goes over it and updates the filters. If that isn't enough for people, they can call the helpdesk and get instructions on how to create a rule in Outlook to send the crap into the trash.
Comparing an open relay to child molestation is extreme and even more offensive than your boss' 'barn babes' issue. What is a greater pity is you seem possessed of a great deal of creativity (rhino stampede indeed) but are incapable of channeling it towards finding a solution to the threat of a "possible lawsuit."
I don't want knowledge. I want certainty. - Law, David Bowie
Part of the problem is that there are still new servers coming online all the time. And many of these servers are open relay right from the start. The reason I support being very harsh on sysadmins that did let a server do spam relaying is that I believe this problem won't get solved until it get so harsh that it becomes common public knowledge that you better do the job right from the very first day you get online, or you'll have trouble for a long time. Right now, new sysadmins are putting up open relays before they ever have any idea. That needs to change. Somehow they need to be educated about this before they ever have the root/Administrator password.
now we need to go OSS in diesel cars
[Running an open relay is] like being ticketed for driving your car down the wrong side of the road at 90 miles per hour and then being pissed off that the cop did not provide you with free driving lessons and give you 10-15 days to stop driving like that.
Nice analogy, except that it doesn't work. If you're driving at 90 miles an hour on the wrong side of the road, then (1) your speedometer will tell you that you're driving at 90 miles an hour and (2) looking ahead will show you which side of the street you're on, which you can tell is the wrong side because of what you had to know to pass the test to get your driver's license.
With mail servers, however, there isn't, at least yet, any widespread tool that will tell you if you have an open relay (and given how such tools work, they'll probably be banned as "hacker tools" at the rate things are going these days). In fact, I found out recently that I'd been placed on a blacklist for having an open relay, which took me by surprise because I'd been careful to avoid having anything like that happen; it turned out that I had missed one of the potential avenues of abuse (specifically, using error bounces to spam people).
So until running a (secure!) mail server becomes as simple as driving a car and people need licenses to run servers, your analogy is inappropriate.
Which blacklists are blocking whole ISPs when they could block just the offending server? If you genuinely know this is the case, then surely you know of examples of good blacklists and bad blacklists.
Colo/server hosting is one of the tougher areas to stop spamming. An ordinary dialup/DSL/broadband ISP can block port 25 and force the use of their mail servers, and rate control those servers and be effective. But colocated servers is harder to do because many of those machines have legitimate high mail volumes so the mechanics of controlling spam are much harder.
now we need to go OSS in diesel cars
What good is it to depend on reports of spam stopping after the spamming server gets listed as a basis for delisting it?
now we need to go OSS in diesel cars
apparently the anti-spam fundamentalists don't see this as their problem. Eventually the problem will be solve because there will more ip on these lists then off. I hate spam but I am begining to believe these crusaders are just as bad.
Ever try to get help setting up a complient server? Try sifting through countless messages condeming any and everybody that doesnt fall into their radical camps.
Where are the moderates? http://www.dotcomeon.com/eff_011016.html
zenas
An open relay is not necessary in order to make email function at the outlying offices. You don't even need a VPN. The mail server can be configured with the static IP addresses of each of the offices as valid "local" addresses. Of course a VPN is much better as that also improves your security.
As confirmed by another of your postings, your company management are morons who have apparently hired idiots for the IT department. Obviously you recognize it, and can leave if you feel that is necessary, or can stay as long as you can deal with it, and are not blamed for it. Should they ever offer to promote you into IT, be sure you insist that you be given the authority to fix the problems with no further permission from management to go ahead.
now we need to go OSS in diesel cars
This is (by being dumb and setting up an open relay at first) how you get on 3000 (estimated) private blacklists. You get off mine by asking me to take you off (I do the first 2 times). Part of the problem is that many businesses just have their MCSE kid set it up.
now we need to go OSS in diesel cars
You didn't indicate if this is an on-campus or off-campus problem. Since most other schools have solved the problem, I'm assuming yours could, too, if you applied the correct solution.
First of all, mail coming in from off-campus is the issue with regard to open-relay. If you have students/staff spamming from on-campus, you do have better access to identifying who they are and dealing with it. But for off-campus, it's much harder, so it needs to be denied.
Many schools provide dialup services for staff and students off campus (some free, some for an added fee). This won't be a problem for the open relay issue as long as the dialup access itself is authenticated as usual.
Those off campus using a commercial ISP have a couple of choices. One is to just use the ISP's mail server for outbound, while picking up the mail at the school POP3 server for their dot.edu address. Most ISPs allow "From: anywhere" in the mail (means nothing, really). If a local ISP does not, you could ask them to allow the school's domain through (else you'd have to recommend to the school community not to use that ISP). And of course there is the POP-before-send approach which you can use to let the off-campus community send through the campus mail servers.
So basically, this is easier than you are making it out to be.
now we need to go OSS in diesel cars
What all of this rambling means is that you can filter out a great deal of spam with the right DNS blacklists. I only use DNSbl's that allow zone transfers because I don't want network latency to slow down mail delivery. It really is a worthwhile thing to do.
Finally the best thing that you can do for your users is educate them. Give them very clear examples of how doing simple things like giving your personal email to a credit card company, entering it in a guestbook, using it in USENET, using it on any public discussion board, and many more can increase their spam intake many fold. Explain that to them. Show them the proof. It's not hard to generate spam. Hell create a dummy account and make a few posts in the newsgroups. Never give the address to anyone else and don't use it yourself. Give it a week. Then show the results to your users as proof of USENET address harvesting.
Finally, don't be part of the problem (this is to the parent of the article). Be proactive in fighting spam. Sitting back and bitching about it doesn't help anyone. If you put up a server that's an open relay then you fucked up. It's your responsibility as an administrator to make sure you do your job right. Putting up and open relay isn't doing your job right (are you listening all of you damned Exchange admins?! 90% of the open relays I find and report are running Exchange!!!). When you get spam, report it (called LARTing). Drop a copy to uce@ftc.gov. Reporting stock spam to the SEC. Report bogus drug scams (loose 100lbs tonight while you sleep!) to the FDA. Report Nigerian Monet scams to the Secret Service. Report the spamertised sites to their providers and ask that they investigate (don't accuse in case it's a Joe Job). Parse through the headers and learn to identify relayed spam, BS headers, and other tricks of the trade. Submit open relays for listing in all the open relay blacklists. Report it to the owner of the IP as well. DO YOU PART! If you're not going to do you part to fight spam or ensure that you're servers are properly configured, THEN GET YOU SERVERS AND YOUR ASS OFF THE 'NET BECAUSE YOU DON"T BELONG IN THIS COMMUNITY!! Don't be part of the problem.
It is not ridiculous at all. In fact this is exactly what they are supposed to do. If there is an open relay, and they say there is an open relay, they are telling the truth, and you have absolutely no cause to complain. Blacklists are not saying that such-and-such company has bad standards ... they saying that such-and-such IP address or network has an open relay (or whatever the case may be).
If your customer configured the server wrong, making it an open relay, then it is that customer you should be collecting recovery costs from. In the future, be sure terms that specify this is in your contact that you have each customer sign. Be sure the spam and open relay issues are discussed with them before the service is turned on.
And further, set up a testing facility which will probe all the IP addresses on your own network for open relays. Your own customers should not be relaying for any other of your customers, nor for your own machines, so you can do this entirely in-house. Leave the IP address of this testing machine out of the "local networks" list of your own mail servers and it can test them, too. Have it cycle through the network several times a day sending mail to an outside domain name which gets forwarded from there back to you. The contents of the message would be what the tester is testing, and with that and headers, you can see what server suddenly became an open relay before the spammers find it and cause you all this massive grief. And since it is your network, you have all the legal rights to probe it (but add this to your contact terms just to be on the safer side).
Now your next problem is those nasty form mail scripts that use a hidden field for where to send the mail. There is spamware available to use those to send spam. They simply fabricate the browser submission, with a false hidden address field containing the spam victim's address, and submit it to the web server. Such scripts should not be allowed on any web server in your network, with no exceptions made. Scanning around for them is harder due to the variety of potential pathnames they could be found it. The only form mail scripts that should be used are ones where the destination address is stored in the script itself, or in a database the script uses to lookup using the referer URL.
now we need to go OSS in diesel cars
These operations also get listed in other ways, too. The identity of their network generaly gets discovered and places like spamhaus.org will list them.
now we need to go OSS in diesel cars
I make the decision whether to accept or reject mail before the headers and body are ever received. I don't want to be handling the returns on the rejections because I've accepted delivery, and then have to deal with huge queues of rejections that can't be delivered. I let the sending server do that.
now we need to go OSS in diesel cars
So be it. That means people running open relays get pounced on. Serves 'em right.
now we need to go OSS in diesel cars
I submit that I have a right to not accept e-mail from your open relay for no reason whatsoever (but generally I will do so because it is an open relay). If mail is relayed through your server, then I see that as sufficient proof for my purposes. I'm not asking the government to come take your personal freedom away, or take your driver's license away, or even take your network connection away (though many would want that taken away). IMHO, you have the right to be connected to the internet with an open relay if you want, but you have no right to expect that everyone must accept mail from your server, or even accept any IP packets from you, because of being an open relay.
Liken open relaying to doing bizarre behaviour, or having serious body odor because you don't shower. It's your right to do that. But it's also my right to have nothing to do with you and not even hire you. We just keep apart.
First of all, in reality, it won't happen. As soon as the first spammer discovers your open relay they will spam. And I got hold of one of these spam lists and found that the very first entries are of spamware authors and other spammers. So they are going to be among the first to be spammed by the spammer that found your open relay. Now several spammers have your IP address. It will be like a shark feeding frenzy. Eventually the spamming gets down to the addresses that have will alert the blacklist operators, and you get blacklisted.
I don't want the spam, and I'll accept the collateral damage of loss of legitimate mail from your server in exchange for protection from the spam. And that's my choice and I have the right to make that choice, and base it on information I believe to be factual (e.g. ordb and orbz). You have the freedom to choose which way you want to behave, and all that comes with it (or not).
now we need to go OSS in diesel cars
I don't use SPEWS for a couple of reasons, and that is one of them. You have a Rackspace based mail server? Figure out my email address and send me something and see if it comes through.
now we need to go OSS in diesel cars
I agree with the praise for Spamcop. We implemented a DNS check against bl.spamcop.net a couple of weeks ago. Since then, from four different spot checks of the server logs, these are the stats:
Totals:
Total time Covered: 52 hours 52 minutes
842 emails rejected as spam
1691 emails received
422 emails sent
This is in a small office with about 50 users.
Wordnik, a dictionary project which aims to collect
Which they have all violated on numerous occasions, to the detriment of the innocent bystanders caught up in their incompetence.
And what if it isn't? There have been numerous cases where the various blacklists have included servers
I don't like open relays and spam magnets any more than you do, but I know how easy they are to overlook, and it will happen, even to generally competent people. It is in everyone's best interests to have a quiet word with the sysadmin at an open site first, because 90% of the time, that will solve the problem.
On the other hand, what we now have is a vigilante culture where totally unaccountable people can wipe out your company (quite literally, if you depend heavily on e-mail) on a whim, and there isn't jack you can do about it. As far as I'm concerned, if these people are blocking you inappropriately, they should be liable in the same way as anyone else who damaged your business by making a false claim, and you should be able to sue them to the other side of the galaxy.
No, it's not even slightly like that. Having an open relay is inconvenient but not immediately dangerous. Having an open relay is not illegal. You are not required to pass a test before running a mail server. The internet is not governed by generally well-reasoned laws. A generally competent driver will not accidentally find themselves driving at 90mph on the wrong side of the road because they just bought a new car. All in all, the two cases aren't even remotely the same.
Do you also think that the media should be able to run business-destroying stories based on complete misinformation, and then charge extra to print an apology in the next edition (even though most of the damage is already done and they don't have to pay anything for doing it)?
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Most of the comments people are making seem to be of the opinions that these blacklists and blackholes are a good thing. So what I am about to say will probably not be very popular. In my experience, blacklists punish users more than spammers.
A while back I got a reply to my e-mail that had the word SPAM with a question mark inserted into the subject. After some correspondence I learned that my ISP had been "blacklisted" because they maintain open mail relays. I was snidely told I should complain to my ISP, as if I could somehow force them to fix the problem. Well I did send an e-mail telling them about the problem and asking what they could do. Their position on the subject was quite different. They felt that to close the mail relays would hurt their customers by preventing them from sending mail through the server even when they were not connected locally. Now before you point out that I could simply switch ISPs, keep in mind that I live in an area where there is not a big selection of ISPs. Anyway, their reply sounded like a lack of technical expertise to me, but apparently a few weeks later they changed their mind.
But now I had a new problem. I've got two internet connections, one which is a direct connection from my office, and the other which is a dialup connection from at home. Suddenly I found I was unable to send e-mail from my office account through my ISP account, nor could I send e-mail from my work account from at home, because both mail servers were rejecting mail not from or to their domain. This was an added pain because it meant that I had to keep changing the smtp server in my mail program everytime I switched locations.
I guess the point I am really trying to make is that various administrators will set things up the way they feel is best for the situation. However in this case closing open relaying prevented me from sending legitimate e-mails. I have a feeling that customers care less about preventing spam than they do about the system working for them. Yes, I hate spam too. On one of my accounts I've set up the system to reject e-mails from anyone not on my accept list. I still get the e-mail, only in a low priority directory that I occasionally check. The sender also gets a message telling them how they can bypass the filter. I can do this because I've got shell access on this account.
But it seems to me that blacklisting is wrong because first, it filters mail that could be from legitimate users, and second, it makes no attempt to inform the user that their e-mail was silently deleted. In my case I was lucky that my e-mail was simply flagged as possible spam, and not just deleted. Had I not found out from the recipient what was going on I might never have known.
I'm not a journalist, but I play one on slashdot
Your customer shouldn't take it personally. nanae has seen a thousand posters exactly like him, and they'll see a thousand more after he's gone. Someone shows up, never posted on Usenet before, and fills up a page or two ranting about blacklists taking away his business and restricting his free speech. If he read the FAQ before he posted, he'd know that the /24 gets banned since spam-friendly ISPs often shift their blackholed customers to different IPs. He'd know that the people to talk to are his ISP, not nanae. Instead, he's argumentative and pushy to people who have nothing to do with his problem. At best, he's clueless. At worst, he's a spammer himself.
These people come along, argue for a couple days, and vanish. nanae regulars will help you, if you're not a dick about it. But what's the use of being nice to someone who is pointing fingers all over the place, ranting and raving, and you know they'll never post again?
http://www.msg.net/utility/small/chuckmail/
Looks like an open relay, optionally acts like a teergrube.
I do not deploy Linux. Ever.
My users are fully aware of the spam blocking I employ. I've received no complaints, and only investigation requests. Most cases of "I was expecting this mail but never got it" came down to what you might call "collateral damage". In all of those cases it was a misconfigured server at the sender side. One was an actual open relay. Three were missing or invalid reverse DNS. All got fixed when the errant sysadmins were told what to do.
If my users prefer a mail service with less collateral loss, and more spam, they can either ask for it (I could set it up using a separate server), or they can move along to another provider. So far no one has asked for it.
I employ a combination of mechanisms. First is my own list of IP addresses to allow through, bypassing the remaining tests. Then the connecting IP address is queried over reverse DNS. If no name, the mail is rejected. The name received is queried by forward DNS requesting A-records. If the connecting address is not received in an A-record, the mail is rejected. If the DNS test passes, then the domain name is checked against a list of domain names to allow through. Then SBL, ORDB, and ORBZ are checked. Then my list of domains to reject is checked. And finally my list of IP addresses to reject is checked. Anything not yet rejected is allowed through.
Many suggested mechanisms require first accepting the mail, so that one can, for example, examine the headers or the mail body. I might some day add those mechanisms, but I do not want to remove the mechanisms that reject the bulk of spam prior to accepting the mail. This is the key. I don't want my server to become responsible for delivering the rejection message. For most spammers, the mail can't be delivered and either the mail stays in the queue retrying for a while, or my postmaster box gets the rejection of the rejection reply.
I have found that checking for keywords in content is not effective. Much mail gets matched that is not spam. Much spam is now sent as MIME encoded attachments, making it necessary to further run a detach and decode. Some spam even comes in MS Word format (tempting to get their product serial number out of it).
I'll stick with the mechanisms that work before mail is even delivered. It has a very high spam rejection count to collateral damage (67000 to 4 in the past 7 months).
You do not have the freedom to barge into my home at 3 AM just because you want to communicate with me. You have the freedom to try to communicate with me using civil means that do not violate my rights. You do not have any right to be guaranteed this communication. I might simply not answer the door at 3 AM. I might not even answer it at 3 PM. I'm not presuming you to be a criminal just because my server doesn't want your mail, or because I don't answer the knock at the door. And my users know this is happening and are free to use another service.
I have considered the role very carefully over the past 2 years. What I do today is the result of it. Yes, my users do have a right to receive their mail. And they can choose to fully exercise that right any time they wish by any means, such as operating their own mail server, asking me to operate a different class of service for them, or asking another provider for service. Right now they are not paying me to accept mail from absolutely anywhere it happens to come.
They are quite aware of what I am doing. They may not understand all the details (they have little interest, for example, in how SMTP or DNS actually works). They know their spam load is down. And they know they (the ones with their own domain names) can ask me for service via a fully open server (which is easy enough to do by binding a new IP address, changing their MX records, and starting a new instance of Postfix with a different configuration ... I don't even need to invest in new hardware).
My big point is that even though I am providing a service to others, I am not obligated to provide that service in any way other than how I have agreed with my users to provide that service to them. Further, I can also decline to offer service of any type they might ask for, if that is my choice. While I might provide the fully open mail receipt service, if asked, I can tell you I will not provide a service of hosting a spam transmission operation (spamhaus) nor will I host an intentionally open relay. I will decline to offer any kinds of services which could in some way compromise those other services I do offer. And I do have the right to choose the business I will be in, including to choose not to provide any fully open mail reception, should I so choose.
now we need to go OSS in diesel cars
(In crackhouse terms, SPEWS reads police blotters, and if it stops seeing crime in a certain area, allows pizza delivery. I'm the crusty old Italian guy who says "No, you can't deliver to 48th street, it's a war zone, at least, it was the last time I tried to deliver a pie there sometime in 1996!")
I still apply that to reality. If I hit a town with wild traffic traps (like getting a parking ticket at 2 AM while in the car!) I take that as a unwelcome sign and refuse to do business there again ever. Not everyone is ready to fully trust a part of town with a bad reputation right away. I've noticed 15 years later a large number of boarded up and empty retail space where I got the weird ticket. I won't consider returning until it's all plowed under and rebuilt nice shiny and new. People must return as a sign it's no longer a place to be robbed. Most all the reputable businesses moved 5 miles South into the next county. This is how real world slums and internet slums are created.
The truth shall set you free!
I believe SpamCop doesn't use an absolute block. So it's still quite possible for users to file spam reports against spam that's been flagged as spam.
Also, if SpamCop uses external lists, the initial SpamCop listing only needs to last long enough for the spammer to get on a more permanent/human moderated list.
Every sentence of this message is wrong.
See above, below
You didn't read my message, did you? My system is a small one, true. Multiply my system by the thousands of others whose administrators maintain private blacklists - and, I assure you, not all of them are small - and you're talking about a significant chunk of the net.
You didn't read your original message, did you? So there are a thousand end users who use their own mail server that dead ends into their living room from their local ISP. Not much mail gets routed through them. Yes there are ISPs, and some of them large, that use their own (or other) blackhole lists. But that's not what you were talking about.
Wrong. People can send email from their own systems - as I do - or through their ISP's outgoing email server. That is *not* an open relay, since (if it's properly configured) only relays messages from that ISP's customers.
Wrong. You can send email through your own system (as I do) -- you are in a very small minority. And you can only send email piggybacked on the relays of larger networks (like your ISP.) I said, "Open relays are not the problem", in one sense, that is an exagerration, and should be read ,"Open relays are not the biggest problem," but in another sense it is completely accurate the same way saying, "Guns are not the problem, it is the people who misuse them."
Those jokers send their spam through open relays, in an attempt to evade other blacklists. You even note this yourself, though you don't appear to understand it: what, exactly, do you think someone sending mail through someone else's DSL or cable modem is doing if not abusing an open relay?
Yes, they do. Some of them. It's hard to turn down a big chunk of free, anonymous bandwidth. But its easier these days to call up the telco and get your own access on the cheap, and the risk is smaller. Just be sure to use the name "Herbert Spammerton" only once. And try to blackhole all of Verizon, I dare you.
I run my own email server. My ISP has nothing to do with it.
Who are you peered with?
So much talking, so many errors. The fact is that, by eliminating open relays, a significant amount of spam is thrown out. If we didn't have open relays, we'd be much further along in the war on spam.
I was only trying to bring up a counter point, sorry if my original response came across wrong. But you deserve this one.
Open relays are not the problem. Only as much as "bars" are the problem that causes car accidents. It isn't the only problem, maybe not even the largest. While it is a big problem, if you take it away, *the* problem would not go away. I'm not saying you shouldn't treat the symptoms, but you can't ignore the cause.
Relevant to the case at hand, I had to open relaying (only to my local network and work IPs) so that I could use my personal mail server from my home workstation, and from the office. I'm facing the problem of having several friends around the country who would like to use my home mail server -- and I'd like to when I travel. How you you propose doing that without selective open relay? Its already growing into a difficult task to maintain, and it's inconvenient to download putty everytime I travel so I can ssh home. By then, its easier to just read it instead of setting up a temporary mail folder on whoever's computer I'm at. I might as well telnet to port 110 -- which is what I usually end up doing now.
The only difference between the way you would do it and the way I would do it, is you lose all the other mail, too, while I would not.
If you're going to block a range, the only range you need to block is the range the actual spam comes from. If you are capable of blocking a range, then you can succeed at blocking the spammer range. The only time you need to block the whole ISP is if they help the spammer evade your block. But as long as the ISP is simply providing basic IP service in a box, the content should be irrelevant to them (not to you or me, course).
The extreme danger in this is that it sets up the precedent that a hosting company has to judge content. Once they are judging one type of content, then they could be forced to judge another. They might end up having to take down a web site because the corporation it makes fun of, or reports about improprieties by, would be offended and threaten the ISP with a lawsuit. As long as the ISP doesn't give the spammer special treatment by letting them change IP addresses all the time, blocking gets the job done by blocking the spammer and not the ISP.
If you think that by doing this kind of blocking (of the whole ISP) often enough will cause spammers to somehow just disappear, you are delusional. Spammer types have always existed before the internet, and will continue to exist as the internet becomes entirely ubiquitous.
As long as there is perceived to be a target market for spam, there will be spammers, and they will find ways to deliver the garbage. And there is such a target market out there. While you and I pay greater costs, to the spammer it is a success because they very frequently get returns well in excess of expenditures (and the last time I looked, that was the way business worked).
Compare this to the illegal drug market in the US. As long as people want to buy these drugs, someone will find a way to deliver it, no matter how much the US law enforcement does to stop them. As the supply diminishes, the prices go up, and the attraction to enter supply side is greater. So it is with spam. The more we reduce it on everyone, the more successful the spammers who remain will be (because their target is less saturated). If instead of trying to stop all spam, we work on stopping spam from just us, and let it go on to those who don't really care (and whether you believe it or not, there are a large number of people out there who really don't care), then at least we can be spam free. Economics works with spam, too.
now we need to go OSS in diesel cars