Looping E-mails Beat The Net Down

Staili writes "Singapore-based women's magazine caused problems when it forwarded its mails to a large list of recipients, mainly mailing lists. In addition to security@suse.com, some help and subscribe lists were included; the type of addresses that tend to send out an automatic reply confirming receipt. And the loop was ready." I'm sure anyone who's messed with mail enough has accidentally created a loop or two in their day, but this is really slimey.

Comments

Wouldn't it be funny...

[taliver]

If a "solved" problem like email actually brought the net down... for a while. How do you get patches for a sendmail program without using the internet?

Re:Wouldn't it be funny...

[Anonymous Coward]

/etc/init.d/sendmail stop

apt-get update

apt-get install sendmail

/etc/init.d/sendmail start

Re:Wouldn't it be funny...

[taliver]

/etc/init.d/sendmail stop

apt-get update

apt-get install sendmail

/etc/init.d/sendmail start


Can't do an apt-get if the network is flooded with mail messages, can you?

Asia Problem

[lowtekneq]

Singapore-based women's magazine..

I remember an artical on /. about the blocking of Asian emails (mostly b/c of spam), and this mentions a Singapore-based magazine. Is it really time to consider the firewalling of certain asian email though we have to remember that many western businesses do business w/ eastern companies. If we let some isps through spammers will just route through them.

Re:Asia Problem

[mccalli]

Is it really time to consider the firewalling of certain asian email...

Right, well I've been to Singapore and I have to tell you that its IT and communications are in a very good state. In fact, I'm rather hoping someone actually from Singapore will chip in here

Singapore was the first place I saw ADSL in. It has a row of internet 'phone' booths on its most popular shopping street (Orchard Road). In my hotel, 24 internet access was available for a ridiculously low fee (12 SGD I think). It was cheaper for me to phone the UK from my my hotel than it was for a person in the UK to phone me. Cheaper from a hotel phone.

There seems to be some insidious 'oh, it's those clueless Asians' thread running through so many Slashdot posts recently that I think it's time the balance was addressed. The US's mobile phone system, for example, is an utter shambles compared to the Asian systems. I was reading on a UK's paper site that BT was planning to roll out the world's first internet booths - I was reading it from an internet booth in Singapore.

I can assure everyone that the people I worked with in Singapore were quite bright enough to run systems properly, and every bit as interested as their Western equivalents in doing so.

Cheers,
Ian

Re:Asia Problem

[wackybrit]

And I don't see a significant number of people in the UK or USA with cellphones that have color displays and digital cameras built in. They have some crazy stuff in Japan. You can take a picture of yourself, and send it to a friend via the phone. They might even have cellphones in general circulation that can send live video back and forth too, but I'm not so sure on that one.

As the USA and UK are generally heralded as technological equals to Japan, this is pretty lame.

Re:Asia Problem

[Genie1]

It has a row of internet 'phone' booths on its most popular shopping street (Orchard Road)

I am not a Singaporean but I stay here. These internet 'phone' booths are not working. I believe that the plan is to implement them later on, but not yet. Right now, it is just a couple of information kiosks.

I do agree that the infrastructure in Singapore is really really good. There are a few broadband plans going for about $60-70 Singapore dollars a month. That is about $30 USD. Plus the all the service is linked to a national high speed network.

Plus, corruption in this Asian nation is almost non-existent. Bloody incredible.

Re:Asia Problem

[raju1kabir]

It has a row of internet 'phone' booths on its most popular shopping street (Orchard Road).

Those things? All you can do is look up a few info pages (shopping directory, etc.) and video chat with people in other booths on Orchard Road.

It was cheaper for me to phone the UK from my my hotel than it was for a person in the UK to phone me. Cheaper from a hotel phone.

Singapore has a great policy wherein hotels are not permitted to mark up phone charges. So you are billed at the regular direct dial rate for calls.

I can assure everyone that the people I worked with in Singapore were quite bright enough to run systems properly, and every bit as interested as their Western equivalents in doing so.

Well, they have their share of idiots like anyone else, but at least they speak English, lah, so they can deal intelligently with complaints from the rest of the world, and keep up on security updates.

I was reading on a UK's paper site that BT was planning to roll out the world's first internet booths - I was reading it from an internet booth in Singapore.

I don't know when you were there, but I saw internet phone booths in the Netherlands long before in Singapore, and even in Malaysia there were internet kiosks (half BSOD'd at any given time, granted) before such were spotted in Singapore.

Nevertheless, the general point obtains. They do pay a lot of attention to new technology and tend to be early adopters. Why not - they manufacture the stuff.

Re:Asia Problem

[mccalli]

...but at least they speak English, lah

You very bad lah. So can cannot?

Cheers,
Ian

(More Singlish here.)

Re:Asia Problem

[Turbyne]

Sorry about the bad grammar, I just had lunch and now I'm getting an MSG buzz..

Re:Asia Problem

[wholesomegrits]

Is singapore the same place with the shitty record on human rights? Is this the same, Oh What a Beautiful former Colony with supa Internet you are referring to?

Is the US State Department then a bunch of liars when it says this about the wonderful country:

"The Government has wide powers to limit citizens' rights and to handicap political opposition. "

"The authorities sometimes infringe on citizens' privacy rights. Government intimidation and pressure to conform result in the practice of self-censorship among journalists. Government leaders historically have utilized court proceedings, in particular defamation suits, against political opponents and critics."

"During the year, a prominent opposition figure was convicted for speaking in public without a permit. Despite a continuing discussion of the possibility of an expansion of free speech rights and the Government's role regarding these rights, the Government still did not take significant concrete steps to change the wide array of laws and government practices, or the informal levers of government influence, that lie behind the limitations on civil and political rights. The Government significantly restricts freedom of assembly and association. Jehovah's Witnesses and the Unification Church are banned.

"The Government has moved actively to counter societal discrimination against women and minorities, but some discrimination persists. Foreign workers are vulnerable to mistreatment and abuse."

That's swell. What a wonderfuckingful place. I'm moving my business there so I can take advantage of all the superior technology, and hopefully get persecuted and my female employees harassed and discriminated against.

Don't take my word for it:
http://www.state.gov/www/global/human_rights/ 1999_ hrp_report/singapor.html

I think I'll stick with my backasswords western life, even if I can't look at slashdot from a pay phone.

Re:Asia Problem

[Anonymous Coward]

I'm pretty sure the F-15 does. I've watched one climb perfectly vertical from ground level up to about 50000 feet.

Re:Asia Problem

[Bryan Andersen]

The F-15 was the first. I think the F-16 is also in that class. I stopped following jet figheters so I don't know what the F-18 and latter ones have.

On another note the cars mentioned aren't all that technologically advanced. Maby for an American production car, but not for cars in general. Just because a car company says so dosen't mean it is so.

Please do a bit of independent verification. Don't just be a passive consumer, actively seek out information and verify facts.

Re:Asia Problem

[Anonymous Coward]

IP block mail.savoixmagazine.com
Trying 66.70.220.204 at ARIN
OLM LLC (NETBLK-TRUM-0018) TRUM-0018 66.70.216.0 - 66.70.223.255
3080 Ogden Ave
Milford, CT 06460
US

Re:Asia Problem

[Max von H.]

Back in '97 in Stockholm, Sweden, I remember seeing and using net booths in town from which I could send e-mails. I've seen net booths in a lot of European airports for already quite some time... What else is new?

The deployment of GPRS and later 3G mobile webpads it will perhaps render these booths as obsolete as mobile phones have managed to eliminate most public phone booths in European towns.

/max

Re:Asia Problem

[lostchicken]

I thought the Internet was supposed to be universal.
The Internet is the only place in the world where it doesn't matter who or where you are.

We cannot throw that away, ever. We cannot resort to blocking a region for any reason.

Let's say this does happen, and we try to block China. How do we know this isn't just what the governenment of China wants, to limit the communication abilities of their people.

Administrators can control speech. We cannot abuse our power.

Re:Asia Problem

[kiwipeso]

> Is singapore the same place with the shitty record on human rights? Is this the same, Oh What a Beautiful former Colony with supa Internet you are referring to?
Yes it is, but Indonesia's even worse when it comes to human rights and internet censorship. Plus it's the world's largest muslim nation just north of the world's lowest poulated continent.
> Is the US State Department then a bunch of liars when it says this about the wonderful country: "The Government has wide powers to limit citizens' rights and to handicap political opposition. "
No, the US state department is just repeating what amnesty international has been saying for decades.
>"The authorities sometimes infringe on citizens' privacy rights. Government intimidation and pressure to conform result in the practice of self-censorship among journalists. Government leaders historically have utilized court proceedings, in particular defamation suits, against political opponents and critics."
Find anywhere else in asia (except westernised japan) which doesn't do that too.
>"During the year, a prominent opposition figure was convicted for speaking in public without a permit. Despite a continuing discussion of the possibility of an expansion of free speech rights and the Government's role regarding these rights, the Government still did not take significant concrete steps to change the wide array of laws and government practices, or the informal levers of government influence, that lie behind the limitations on civil and political rights. The Government significantly restricts freedom of assembly and association. Jehovah's Witnesses and the Unification Church are banned."
The only positive ideas I see are the banning of Jehovah's Witnesses and the Moonies. Ban the Hari Krishnas and the Mormons.
I'd call the Singapore government to be spiritally enlightened instead of an orwellian dictatorship if they did that.
>"The Government has moved actively to counter societal discrimination against women and minorities, but some discrimination persists. Foreign workers are vulnerable to mistreatment and abuse."
>That's swell. What a wonderfuckingful place. I'm moving my business there so I can take advantage of all the superior technology, and hopefully get persecuted and my female employees harassed and discriminated against.
Why not join the company of great australian and new zealand multinationals? I'm sure you'll find dozens of Fay Rich White 80s stockmarket refugees in singapore.
Don't take my word for it:
http://www.state.gov/www/global/human_rights/ 1999_ hrp_report/singapor.html
I think I'll stick with my backasswords western life, even if I can't look at slashdot from a pay phone.

Re:Asia Problem

[Derleth]

I don't think you could spot me a piece of Wrigley's, could ya?

Didn't think so.

Plus, corruption in this Asian nation is almost non-existent. Bloody incredible.

Yeah. Censor the media and corruption goes way down.

There's a lesson here somewhere.

Re:Asia Problem

[bakes]

Blocking all of Asia wouldn't have helped. The article (go and read it) says that the provider/hosting company was based in the US. It's possible, even likely, that the people in Singapore at the magazine didn't have anything to do with setting up the mail server.

Re:Asia Problem

[Anonymous Coward]

.nz -- I'd have no reason to move there if I could get Steinlager in my area. Damn you people and your good beer. What's the one stuff from the south? It's more of a blue collar type of beer, really popular. Kind of like Sam Adams, in the states.

Re:Asia Problem

[Anonymous Coward]

I live in Singapore, and this magazine makes me puke blood.

It's sunday morning 9am as I write this, so there's nothing I can do to pay them a visit until 24 hours later. In parallel, I'm putting ida.gov.sg into the loop (they claim to be an IT police).

Although the server is not hosted by them, I do believe the perpetuators are over here. Typically, 90% of companies seeking "web-presence" go for simple virtual hosting plans in the U.S. of A, and either are :
- clueless about setting a server up in Singapore
- not enough $$$$ to buy bandwidth. FYI, a 64Kbps line costs USD$150, 128Kbps costs USD$300, etc.

Let's see what fun 24 hours later will yield, for they'll only pick up their lines tomorrow 9am. This does no good to the "block-asia movement" *sigh*, or of "Asia baaaaaaaad" ilk.

Re:Asia Problem

[Anonymous Coward]

The US State Department has always been a liar. Is this news to you? Get a clue.

Re:Asia Problem

[Byter]

That would be Speights. (You're probably not talking about Canterbury Draft, although I think the CD commercials are actually becoming more amusing than the Speights commercials).

Re:Asia Problem

[Anonymous Coward]

If the vast majority of Asian mail relays are and will remain vulnerable to unbounded abuse, our choices are to render ourselves unable to receive mail from Asian mail relays or to let spam mushroom until we are unable to receive mail from anywhere.

Re:Asia Problem

[sych]

Telecoms here in Singapore are, in general, very good. Overseas calling is very cheap. Mobile phone rates the same.

Singapore has had Cable and ADSL nationwide at reasonable prices for years now. (on the downside, cable in certain high density areas is starting to get a bit clogged).

GPRS (that's high bandwidth packet-switched data over GSM, for those unfamiliar) has been available on all 3 mobilephone networks since mid last year. And it's so cheap I don't even have to think about using it.

Technologically, Singapore is right up there. But I guess every country/city/region/whatever has its share of clueless people :)

Re:Asia Problem

[Anonymous Coward]

Hmmm. Let's see:
- Article about a Singapore magazine creating email message loops which slows the internet.
- Results in a somewhat unrelated message about blocking East-Asian ISPs because they refuse to crack-down on spammers.
- Results in an unrelated reply about "Singapore is really technologically advanced - I can connect to the internet everywhere" and accusations that the West thinks Asians are clueless. (What does the claim that "you can call from your hotel for cheap" have to do with "Asian-ISPs being apathetic about stopping spam?")

Is it me or are these three messages really missing the point of the other messages?

Why was the header stripped...

[zubernerd]

My question is: Is it normal for a server to strip the headers from e-mails...
FROM THE ARTICLE: ["At savoixmagazine.com the mail headers were cut so it was almost impossible to find out where the mail originated from," said Drahtmuller. The everyday analogy is a letter stripped of its envelope that had the original return address printed on it, repackaged in a new envelope with a different return address, and forwarded on. "Usually mail loops like this are not possible with Unix systems because they always maintain the headers," he added.]
I'm not a e-mail expert, but why where those headers missing? (I did not see any reason given in the article.)

Re:Why was the header stripped...

[Corgha]

Somehow, few people seem to be able to get the autoresponder/autoforwarder thing right, despite the fact that it doesn't seem that hard and has been done correctly before. (Then again, there seems to be a dearth of good systems programmers around these days; I'm becoming increasingly cynical about such things.) Every day, I get auto-replies to MAILER-DAEMON's bounce messages, and every once in a while, some b0rken forwarder creates a mail loop. Unfortunately, when I try to tell the people responsible why what they are doing is a bad idea, they're usually not interested in hearing about the danger of mail loops.

Here are some things I've come up with over the years:
1) Never, ever auto-reply to MAILER-DAEMON or Postmaster (procmail has good regex macros for this -- use them or copy them).

2) Preserve the headers of messages you forward.

3) Set an X-Loop header and check for it (or *any* X-Loop header if you want to be paranoid).

4) Don't autoreply to the same address twice during [definable time period].

Those things just seem like common sense to me. Maybe someone else here knows more about the subject than I do. There has to be a HOWTO somewhere.

Re:Why was the header stripped...

[zmooc]

5) If you're sending spam using a list/alias, always set the Reply-to address correctly so ppl don't end up replying to the list if that is not desired behaviour.

Re:Why was the header stripped...

[einhverfr]

Many administrators strp portions of the headers in order to provide some obscurity for their internal network structure. The (usually closed) SMTP relay in the DMZ accomplishes this task.

My guess is that some administrator decided that the more obscurity, the better... (but at the same time, I laugh at them)

Re:Why was the header stripped...

[Dwonis]

Many administrators strp portions of the headers in order to provide some obscurity for their internal network structure.

... which is in direct violation of SMTP:

As discussed in section 2.4.1, a relay SMTP has no need to inspect or act upon the headers or body of the message data and MUST NOT do so except to add its own "Received:" header (section 4.4) and, optionally, to attempt to detect looping in the mail system (see section 6.2).

Re:Why was the header stripped...

[tswinzig]

1) Never, ever auto-reply to MAILER-DAEMON or Postmaster (procmail has good regex macros for this -- use them or copy them).

Error messages sent by mail servers should have a NULL sender/return-path. Therefore your mail server should easily be able to tell what is an error message from a machine, and not reply to it.

2) Preserve the headers of messages you forward.

I think you're confusing what is going on here. There is the type of forwarding that regular people do with their mail clients. And then there is the forwarding that SMTP servers do with email messages. All proper SMTP servers are required to keep all Received: headers intact, as well as to append a Received: header giving information about how that server received the message. Apparantly one of the mail servers involved here was munging the Recieved: headers, either on accident or on purpose.

3) Set an X-Loop header and check for it (or *any* X-Loop header if you want to be paranoid).

I've never heard of an 'X-Loop' header, but any good mail server will count the number of Received: headers and kill the message if an exorbitant number of Received: headers is found. Of course, you have to rely on all the mail servers in the loop maintaining the Received: headers as they are supposed to, just like you'd have to count on them not removing an X-Loop header if you added one. However, since Received: is covered in the SMTP RFC, it's a better bet.

4) Don't autoreply to the same address twice during [definable time period].

The Received: header counting above is a more maintainable solution to loop prevention for SMTP servers.

Those things just seem like common sense to me. Maybe someone else here knows more about the subject than I do. There has to be a HOWTO somewhere.

I've written an SMTP server in Java for my company. The HOWTO is called the SMTP (and related) RFC's.

Re:Why was the header stripped...

[Corgha]

I think you're missing the point entirely (or you're just trolling, but if so, then I'll humor you). Yes, it is possible to write good forwarders and auto-responders. Yes, any bonehead should be able to do so. My point is that most boneheads don't, and so I gave a list that illuminated areas in which they often go wrong, and then I went further and noted that some are resistant to even considering mail loops in their program design. Saying that it's possible to do it right doesn't address either of those issues or add anything new.

Error messages sent by mail servers should have a NULL sender/return-path. Therefore your mail server should easily be able to tell what is an error message from a machine, and not reply to it.

Yes, they should have a NULL envelope from, and the auto-responders should be able to identify that, but as I said in my previous post, many people screw it up. The results end up in my inbox every day (which should have clued you in to the fact that I don't need a lecture on how email works).

[...aforementioned lecture...] All proper SMTP servers are required to keep all Received: headers intact, as well as to append a Received: header giving information about how that server received the message.

Yes, they should, but, again, my point is that a lot of people don't get that, and try to build a completely new set of headers, which you then go on to admit:

Apparantly one of the mail servers involved here was munging the Recieved: headers, either on accident or on purpose.

... which makes your point even less clear (unless it's some bizarre variation on "no true Scotsman"). Also, you seem to be implying that the MTA is doing the forwarding. However, in many cases, it happens via the MDA.

I've never heard of an 'X-Loop' header

It has long been a standard ingredient in many procmail(1)/formail(1) recipies. A similar variant is 'X-Been-There', which, IIRC, Mailman uses.

any good mail server will count the number of Received: headers and kill the message if an exorbitant number of Received: headers is found.

Whereas an X-Loop header will stop it on the first loop. That's why people use it. They also use it because many auto-responders and forwarders are implemented outside of the MTA, as procmail recipies, perl scripts, and so on. They often act as MUAs that happen to be invoked directly by the MDA, since they are acting on a user's behalf. There's no real reason why an auto-responder or a forwarder should be part of an SMTP implementation, unless you want your MTA to be a "jack of all trades, master of none." Down that path lies madness (and Microsoft). In any case, it would be unwise for the forwarder (and especially the auto-responder) to rely upon the MTA for loop protection, so smart programmers put in a loop-protection header, just in case. Redundant safety features are a Good Thing(tm).

4) Don't autoreply to the same address twice during [definable time period].

The Received: header counting above is a more maintainable solution to loop prevention for SMTP servers.

What does that have to do with what I said? You can count Received headers all you want, but it will still be annoying as hell when an auto-responder gets on a mailing list or starts replying to another auto-responder. Any sort of header-based loop protection against auto-responders is questionable because they tend to generate an entirely new message in reply to the trigger message (though formail(1), for instance, retains the X-Loop header). That's why, for instance, vacation(1) won't reply to the same recipient twice. The newer versions also don't reply to Precedence: (list|bulk), which eliminates even the first "please rob my house" message sent to a list submission address, and further cuts down on loops.

I've written an SMTP server in Java for my company.

Well, I'm sure that will solve the world's loop problems.

Mail chauvinist pigs

[leonbrooks]

I'm guessing that's the magazine's view of us, anyway. (-:

Re:Mail chauvinist pigs

[Jhan]

Pigs... In chain mail... Mmmmmmmm... I don't care if they're chauvinists, I want them, *now*!

Mmmh

[NWT]

Yep, I've seen this before, it happened with two web.de mail accounts which had both set up reply messages that the mail had arrived and guess what happened ... but i think they've done something against it, at least i hope it!

Haven't we all done this?

[Charles Dodgeson]

I don't think that there is an email admin around who hasn't managed to be part of such a loop. It is remarkably hard to put together systems which will interact correctly with all of the other ways that other systems might be broken.

And for anyone who thinks that email is a "solved" problem, should read my rant about broken autoresponders. (which is not about loops, but does cover how "solved" things can be broken).

Normal

[dnoyeb]

This happens at my job all the time, and I assume it happens other places with internal mail servers.

Management sends out a promotion announcement or some such to everyone, those on vacation autoreply...To ALL recepients. And the war is on!

I think enough people slapped management that they finally started using BCC. But sometimes someone new comes and they forget.

Re:Normal

[sydb]

I don't understand. Why don't your lusers just autoreply to sender only? Are they that stupid?

Re:Normal

[desertfool]

You've obviously never worked at tech support for a large company. Many of them are idiots.

Re:Normal

[ozbon]

To be blunt - Yes.

I joined one company (names have been deleted to protect the fuck-witted) about a week after the "I Love You" virus came out. There were about 500 I Love You's a day going to everyone, because they were all too stupid to set a message rule to delete anything with "Iloveyou" in the subject.

This was also a company where 3000+ items in you inbox was a sign you were doing your job right, because you didn't have time to delete/organise them... :|

Re:Normal

[sydb]

Oh but I have, as a mail admin amongst other things, with 2000 users.

I can't remember clearly but perhaps Lotus Notes 'Out of Office Agent' just doesn't allow "autorespond to all recipients". And that's probably sensible.

Broken users or broken MUAs?

Re:Normal

[hendridm]

> because they were all too stupid to set a message rule to delete anything with "Iloveyou" in the subject.

Sounds like the admins job to me. I agree, however, that it's like pulling teeth to get users to watch out for some of the most obvious and simple problems.

The staff/faculty of our campus has been hit a bunch of times with new e-mail viruses that are new and not removed by our Exchange AV program. Even though all of them have been a part of the chaos that has ensued in the past, and ALL of them have been told countless times not to open strange attachments, I've seen some of the most senior faculty persons open some of the most obviously shady attachments you could find. And then they call the Help Desk and curse about virus makers while we are digging through call logs looking for the last time the person was told not to open strange attachments.

Re:Normal

[Lumpy]

we solved that... We wrote a script to lock the user-account and mailbox of anyone that sends more than 5 emails in a minute. Anyone found to have set the stupid (I'm out of the office...blah blah...) is usually reprimanded... Yes the CTO himself was locked, we bounced all his email for a week and the It department head told him that it will happen again if he abuses company resources.

I love management that actually has balls.

Re:Normal

[amunter]

Sometimes it is not the user's vacation program that is doing it. If someone sets the Reply-To field to point to the list instead of them the autoreply will probably go out to the whole list. Since it looks like it comes from a legit user the list forwards it on.

I am on a list right now that sets the Reply-To to the whole list. I am very nervous about that, but so far nothing bad has happened.

Which ring...

[jakestein]

of Dante's inferno would recieving an endless loop of tips on "How to please your man" fall under?

happened at my school once...

[jeffy124]

back when i was a freshman in college someone managed to assemble an email list of all the students/faculty/staff. It was first used by someone outside the school to spam the entire campus, with all the addresses in the To and Cc fields, making the list available to anyone who received it. So someone attempted to sell their Chem Eng books, and you can picture the hell that broke out.

Quickly the list became nothing but people hitting reply-all and saying "knock it off!" and "get me off the list!" Of course, all those emails and addresses in the emails meant trouble for the mail server, causing mail to get delivered multiple times and DOS'ing normal mail.

It got so bad that I had about 100 emails in a five minute span at one point. It took a Dean's sending out an email to an announcements list pointing out school policy on mass mailings to stop it.

Thankfully, everyone from those trying to sell stuff to those saying "quit it!" all had to write a 500-word essay about why what they did was wrong.

Re:happened at my school once...

[Anonymous Coward]

Thankfully, everyone from those trying to sell stuff to those saying "quit it!" all had to write a 500-word essay about why what they did was wrong.

Yeah, nothing prepares young minds for the real world like treating them like 4th graders.

Re:happened at my school once...

[Anonymous Coward]

Ah ha! That's where you got your crapflooding training!

Re:happened at my school once...

[Anonymous Coward]

Thankfully, everyone from those trying to sell stuff to those saying "quit it!" all had to write a 500-word essay about why what they did was wrong.

Obviously, when you said "freshman in college" you meant to say "in junior high school". Did they make them write "I must not send mass email" on the blackboard too? Please tell me what school so I can make sure my kids don't go there.

Re:happened at my school once...

[jeffy124]

actually, at most schools punishment for first offenders is an essay for minor offenses. yes, it's childish, but somehow it works.

Re:happened at my school once...

[raju1kabir]

back when i was a freshman in college someone managed to assemble an email list of all the students/faculty/staff. It was first used by someone outside the school to spam the entire campus, with all the addresses in the To and Cc fields, making the list available to anyone who received it. So someone attempted to sell their Chem Eng books, and you can picture the hell that broke out. Quickly the list became nothing but people hitting reply-all and saying "knock it off!" and "get me off the list!"

I find this story very hard to believe, unless you attended that tiny western college with 12 students.

Say a typical email address is 20 characters. Say that a smallish school has 4000 students and 500 faculty/staff. That's a 90K header. How many MUAs can parse that? Not many. Even fewer in sufficient time that your random punter would hang around waiting for it to happen.

Re:happened at my school once...

[/dev/trash]

what kind of liberal bull shit is this:

Thankfully, everyone from those trying to sell stuff to those saying "quit it!" all had to write a 500-word essay about why what they did was wrong

Re:happened at my school once...

[SimplyCosmic]

It was a pretty common punishment for college students back when I went to Ohio State University, especially for offenses which were handled locally, that is, on the dorm level, such as for alchohol based infractions of the rules.

Re:happened at my school once...

[jeffy124]

the email list had more than 15,000 addresses in it, combined with an email server that (at the time) couldnt handle the load and wound up delivering messages multiple times. When I said that I got 100 messages in a few minutes, it was actually something like 20 unique messages times 5 copies = 100.

Re:happened at my school once...

[jeffy124]

beleive it or not, an essay is something a lot of colleges require of students who violate certain policies. IMO, it's better than getting kicked out or jailtime if it was something illegal.

Looking back at what i wrote, I made it sound like everyone had to write an essay, when the reality was only those who emailed to the list had to write the essay in order to restore their email service.

Re:happened at my school once...

[Anonymous Coward]

Cool, so at this nameless high school... err college you can get out of committing ILLEGAL ACTS by writing a letter saying you're sorry? Where can we sign up?

"Dear Sally, I'm so sorry I raped you. Please forgive me. Thanks, buck".. and OFF THE HOOK.

Re:happened at my school once...

[Anonymous Coward]

Your university had "alchohol based infractions", unless that means beating someone over the head with a beer bottle, that's a pretty lame school.

Re:happened at my school once...

[mickwd]

Now repeat 500 times:

I must not repeatedly send out email messages.
I must not repeatedly send out email messages.
I must not repeatedly send out email messages.
:
:
:

Re:happened at my school once...

[groove10]

I think he's joking with this quote: "Thankfully, everyone from those trying to sell stuff to those saying "quit it!" all had to write a 500-word essay about why what they did was wrong." So don't get your panties into a bunch about it, ok?

I've actually seen this happen here at UC Berkeley a few times where there's a mass mailing and some jackass replies to all asking to be taken off the list. The some other jackass replies to all telling him to shut up and stop sending out crap to everyone. The everyone replies asking to eb taken off, and bamn! The system gets overloaded. Usually the mail admins are quick enough to pull the plug on the list such that it doesn't go on forever. This happened recently with the list of students graduating this May.

Re:happened at my school once...

[Bryan Andersen]

The essay forces them to think about what they did wron and why it was wrong... I actually like the idea.

Re:happened at my school once...

[/dev/trash]

beleive it or not, an essay is something a lot of colleges require of students who violate certain policies. IMO, it's better than getting kicked out or jailtime if it was something illegal.

Like I said liberal bullshit. If they violate the rules, kick em out. Making them write a essay only makes them feel like they won.

Re:happened at my school once...

[gidds]

I did this at uni (email wasn't around when I was at school!), with only the ten or twenty addresses I knew. Hey, I was young and green and didn't know any better, mutter mutter shuffle shuffle... Everyone replied to everyone else, producing amusement followed by amazement as it got out of all proportion, right up to the point I had a (justifiably) nasty mail from the sysadm saying roughly "Little Boys. Play with your toys, but not on my system." I learned my lesson!

Re:happened at my school once...

[jeffy124]

yeah, like that would ever work in the real world. ever hear of "unreasonable punishment?"

Re:happened at my school once...

[stickb0y]

The same thing happened to me a few years ago when I was a freshman at Berkeley.

It went on for a few days, and I finally got fed up. I replied to everyone but took the precaution of moving all the addresses into the BCC field first. I entered "Instructions to get off this mailing list" for the subject, and in the message body, I essentially told everyone that they're idiots and should stop hitting reply-to-all. I even said, "Don't reply to this message", but I got a few replies anyway.

Maybe I was a jackass about it, but it worked.

Re:happened at my school once...

[Anonymous Coward]

You're lucky the msg from the Dean worked.

We had the same thing, but people just kept asking dumb questions about how to change their background wallpaper

Re:happened at my school once...

[/dev/trash]

Perhaps that is why the world is so messed up today: "I didn't think I'd get caught but I did, so um let me just write an essay".

Re:happened at my school once...

[jeffy124]

yeah, i can agree with that. just keep in mind that the essay was for those types of offenses, and that things get more serious for second offenders. however, things like underage alcohol in the dorms (at Drexel anyway) are punished with not being allowed to check in guests, you're not allowed to be guests at the other dorms. cause damage, get fined for cleanup&repairs.

Re:happened at my school once...

[Anonymous Coward]

*cough* you must be a mutt if you call people nigger.

Outlook...

[Anonymous Coward]

Ah, the classic Outlook 'Out of Office' Autoreply springs to mind - great when the recipient is on a mailing list, it replies... posts itself... replies... etc...

This has happened 4 or 5 times to me in teh last few weeks...

Re:Outlook...

[geekpup]

Actually ... Outlook (certainly later versions) only send one "Out of Office" autoreply to any email address. Vikki

This sounds like stupidity more than anything else

[Jin Wicked]

When I decided to create a mailing list, I kept the list of address in a BCC field, in an address book entry on my computer. There's no way for anyone besides me to mail everyone. If mail bounces it just comes back to my address.

Why would anyone make a list that bounces all replies back to the entire list again? It doesn't say if this was the first time they tried using the list or not, but I would figure it if was set up to do that once, it would have done it before. I mean, addresses on my list are constantly falling out of service, and I'd hate for everyone else to get all the "could not deliver" notices and the like. I find it a little hard to believe that someone would set something up like that as an accident.

Babelfish rules!

[tangent3]

Oh man, this is just hilarious:

When Drahtmuller contacted savoixmagazine.com's hosting company in the U.S., the situation slipped into the ridiculous as the hosting company tried to reply in Drahtmuller's native German language. "Even though we contacted them in English, they ran their response through Babelfish (translation software) so we couldn't understand what they were saying," he told ZDNet U.K. "In the end we blocked their servers from our mail exchanges. We did what we could but the problem still existed."

Re:Babelfish rules!

[Linux Freak]

Just guessing, but perhaps the Singapore admin(s) could not understand English and used Babelfish or some other translation software to translate it into Chinese; then wrote a reply in Chinese and translated it into German.

Re:Babelfish rules!

[leviramsey]

Read the article.

SuSE contacted Sa Voix Magazine's hosting company in the US. I would expect a US hosting company to use English.

Also, send emails to enquiries@savoixmagazine.com ... if we slashdot their mail servers, they might just decide to get a clue...

Re:Babelfish rules!

[perlyking]

Why would they translate it into chinese considering the main language of singapore is Malay?

Its funny reading slashdiot, a misconfigured mailing is "more spammers from korea, BLOCK THEM ALL!!".

Re:Babelfish rules!

[Anonymous Coward]

The majority of singaporeans are chineese.
Its a majority, but unofficial language there.

Re:Babelfish rules!

[Anonymous Coward]

Officially Malay is the National Language of Singapore and is one of the country's four official languages. The others are: English, Mandarin and Tamil.

I guess you might be right about the unofficial language - but as someone else points out the hosting company was american anyway so the whole point is moot :-)

Re:Babelfish rules!

[Anonymous Coward]

Well, if they were hosting a singaporean magazine, one is forced to wonder if they are immigrants and wether they have a grasp of the english language. Even if they did, they might do business internaly in Chineese.

Re:Babelfish rules!

[Anonymous Coward]

sorry ? Have you BEEN there ? What makes you think the 'main' language is malay ?

Official languages are Bengali, Mandarin Chinese, Malay, Tamil, English.

( http://www.google.com/search?q=singapore+%22offici al+languages%22 )

Everyone speaks english there... I admit often as a 2nd language, but they do a damn good job of it. Nothing like the "chinglish" that you find in some countries.

Anything offical or important is written in english from road signs to government documents etc etc. In fact the only things I saw over there that weren't in english were the names of some chinese / indian restaurants

Re:Babelfish rules!

[tangent3]

The main language used in Singapore (I'm a citizen here) is English (road signs, application forms, just about everything uses English). The official languages are English, Chinese, Malay and Tamil (if there is space and the requirement for it, e.g. tax return forms and warning signs, all four languages will be provided). The official official language is Malay (national song, military drill commands). Just about everyone here speaks their mother tongue and English fluently.

Re:Babelfish rules!

[mike260]

Or, as the fish put it (via Spanish and Chinese):

The Oh person, this one nearly does not smile: When the Drahtmuller input contact with accepts to the company in E.E.U.U. savoixmagazine.com's, the situation slides in the laughable situation looks like recibimiento experiments the company answers in Drahtmuller. local German language " although we deliver them contact with use English, carries out his answer and Babelfish (software logic translation) we has not so been able to understand its what said, " we think ZDNet Reino unites " we which stops the mail in finally us exchanges its server. What were we us can but still exist this question "

Please....

[Anonymous Coward]

News at elven: configuring mail servers properly.

This is worst slashdot post I've seen in awhile, this isn't important. This is a lesson in stupidity.

Re:Please....

[pacc]

No there's nothing to be learned from this lesson. It's a divine intervetion to make sure that slashdot is extended to a mailing list, so you can sign up and won't miss a single post.

Re:Please....

[Anonymous Coward]

News at Elven? Yeah, those damn Elves and their badly configured mail servers! Don't get me started on Dwarves and NNTP!

Is this a problem with windows?

[Anonymous Coward]

"Usually mail loops like this are not possible with Unix systems because they always maintain the headers," he added.

Too bad TCP/IP programming is easier with Unix systems so it would be -easy- for anyone with a computer science degree to write their own server and configure it to cut out the headers. Thanks to open source anyone could even download the source code to the server and merely modify the part that makes the headers.

Re:Is this a problem with windows?

[Bryan Andersen]

This shows you don't understand the current standard UNIX mail distribution programs. All that I've worked with can be configured to strip headers. No need to program your own mail transport. Most of the list server software is the same way. It is a bad idea to strip the headers or change the message ID. If you do either or both you can break the ability of many automatic loop detection systems to do their job.

I run a few lists and every once in awhile I get a looped message, but you know, it usually only spins about once and never finished the second circuit before being chopped off and dropped into the hands of the postmaster.

List readers' fault

[MagPulse]

So SuSE was relaying large amounts of e-mail from two sources from what I can tell:

1. E-mail from the Singapore magazine
2. Replies from well-intentioned SuSE list readers complaining about it

#1 is easy, just firewall the magazine. #2 is the SuSE list users' fault. You get a bunch of spam, so you spam the list about it? I guess SuSE had no choice then but to shut down the list, but I hope they send out an e-mail before they do advising people on where they should send their complaints next time this happens.

Re:List readers' fault

[spt]

List readers' fault : advising people on where they should send their complaints

Any solution that relies on lots of people doing the right thing is bound to fail.

Another nasty effect of spam...

[mysidia]

caused problems when it forwarded its mails to a large list of recipients, mainly mailing lists.

Clearly it was spam (the UBE sort).. This magazine needs a little netiquette lesson, and a slap on the wrist.

In addition to security@suse.com, some help and subscribe lists were included; the type of addresses that tend to send out an automatic reply confirming receipt. ... but this is really slimey.

Yes, it certainly is slimy.. It's bad that someone would subscribe an address to a mailing list (and then autoforward mail from the address), and it is also bad that list servers don't provide some protection against this [ie: automatically blocking mail they're bombed with]

Re:Another nasty effect of spam...

[SomeoneYouDontKnow]

I think you're right that it was done intentionally. Assuming these mailing lists require new subs to confirm subscriptions, then someone who could receive mail at the magazine's address had to do the confirmation in order to get the loop going. If that's the case, I'd guess that it was an employee there who was pissed off at someone and who decided to do some damage. OTOH, if the mailing lists don't require confirmation, then anyone could have done it. All they'd have had to do was sub the magazine's address to the mailing list and vice versa.

Ahhh, memories of high school...

[gvonk]

I remember back in the day we did this to a certain guy we knew, we set up these "free email forwarding" accounts and had 5 accounts. Each of them was set up so that when it received an email, it would forward to the other four and our mark. It took oh, about an hour for his email box to receive 16,000 emails saying "your hard drive is now full" (he ran his own mail server at the time.) Those were the days.....

an eye for an eye

[Anonymous Coward]

Attack the hosting company, and the saviour site. Eat up as much bandwith and they wasted! They are
1: too stupid to correctly configure there system(punish them.), in which case even a simple attack would confound them for hours if not days.

2: diabolical fuxors who did it intentionally(kill).

Either way....

Anecdote

[eyeball]

Before my bank's introduced their online banking, you could submit your email address on their site if you wanted to be notified of their beta test. Well, one late Friday afternoon I got an email notifying myself and all the others of the beta test progress. Unfortunately the person sending out the email put as many people as they could fit into the To: address. People started reply-ing to all, saying things like "Please unsubscribe" and complaining about getting so many emails, etc.. Of course because this was sent out on a friday, so this went on all weekend. Hundreds of replies went out by monday, when they asked nicely for everyone to stop hitting reply-all.

Epilogue: I wrote the VP of the company and expressed my concern that if they weren't competent enough to use email, how was I going to trust them with my money online. The VP sent me an apology and a $50 traveler check gift!

Re:Anecdote

[glitch!]

Of course because this was sent out on a friday, so this went on all weekend.

I have never been able to figure out why so many people pull this kind of crap. Obviously they were trying something new or different than usual. Otherwise the problem would have come up earlier.

This also happens occasionally with the phone company. For some reason, the retarded assholes will make some circuit change on a Friday evening, break something, and then go home for the day (and weekend). Why not do it on Tursday morning, or some other time that allows the nitwit that made the change to fix it immediately when the customer calls in a trouble ticket? (Because all the skilled telco employees were "downsized", and only the retards are left?)

Actually, this can apply to any situation where someone makes an important change or tries something new that might have a large, unexpected effect. How about replacing a bunch of ecommerce scripts just before going on vacation? (And did you verify that your "vacation" program is working correctly?) Or how about changing your BGP filters just before leaving for the night (any night)? Or how about something more mundane, like going on a long driving trip just after changing something important, like the water pump?

I believe that this really boils down to a single factor. Does the person in question really give a shit about the consequences of his or her actions? One could argue that this person is simply too stupid to realize the potential cost of failure, but I believe that anyone who cares about his or her job will take the time to KNOW, not hope. And this person should be prepared to deal with the unexpected, and have a "worst case" fallback plan.

Re:Anecdote

[ozbon]

And who the hell uses the "reply to all" anyway?

I don't think I've ever used it. Maybe that means I should get out less, or something.

Re:Anecdote

[Knobby]

I know a CS professor who promotes OSS at every turn.. She encourages the use of SourceForge and absolutely loves Linux.. She uses the Reply to All option everytime she responds to a note.. I guess it just proves that Linux is making progress on the clueless desktop user front!

Re:Anecdote

[theCoder]

If I want to respond to a mailing list group, I use reply to all and take out the sender's address (so he/she doesn't get the message twice). If I just hit reply, then only the sender's address is in the To: field, which I have to delete then type the list address. Reply to all is much eaiser in that case (though I would prefer a "reply to group" option).

Just a thought.

Re:Anecdote

[Anonymous Coward]

" Why not do it on Tursday morning, or some other time that allows the nitwit that made the change to fix it immediately when the customer calls in a trouble ticket?"

For the same reason I get barraged with phone calls from panicky testers whining about my development code on Friday afternoon. Because people screw around all week and suddenly realize on Friday that, "oh fuck, I haven't bothered to do any work this week and it has to be done today!!" When every test case for whatever half-assed app that uses my code doesn't work immediately, they start calling and opening severity one problem reports. How dare I have bugs in development code when they need to run their tests!

Re:Anecdote

[samj]

A while ago the Commonwealth Bank of Australia sent an email 'To/Cc' its Quickline (modem based electronic banking software) requesting they reply with their secret 'gateway ID'. There were plenty of embarassing emails sent to the list in reply, and an article in The Australian (IT) that I'll bet they would have rathered was not printed.

Re:Anecdote

[inf0stud]

What if the list setup and maintenance is done pro bono back when I only worked 45 hours a week? The list owner asked for a change. By the time I was up to this message it was 2am Sunday morning. I scanned the manual, made a change and on Monday morning 2000 subscribers had 1000 extra messages. Somehow someone managed to reply with a message containing a virus so that didn't help.

Software: SmartList (over procmail). Don't link accept to dist if you have foreign_submit active. Always document your special setup.

Re:Anecdote

[glitch!]

The list owner asked for a change. By the time I was up to this message it was 2am Sunday morning.

Well, if you have the time to verify correct operation after making the change, sure. Or if you positively know for a fact that the "worst case" is an acceptable risk, that's okay too.

What I object to is someone who makes critical changes and walks away before making sure that everything is in order, or at least hanging around for a while so that anyone adversely affected can get their problems fixed right away.

I believe that one of the traits of a responsible person is to know when NOT to do something.

Re:Anecdote

[allanj]

Actually it's entirely possible that they make these mistakes ALL THE TIME and you only find out because the mistakes get left alone since they've gone home for the weekend. This would give the appearance of far more errors on weekends due to tampering on fridays, when in reality it's just because there's someone around to fix the errors they make on ordinary weekdays.

Re:Anecdote

[glitch!]

Actually it's entirely possible that they make these mistakes ALL THE TIME and you only find out because the mistakes get left alone since they've gone home for the weekend.

Sure, I have no argument with that.

...when in reality it's just because there's someone around to fix the errors they make on ordinary weekdays.

Bingo! My main point was about people who make critical changes without bothering to verify correct operation afterwards. Now, it some cases, that might mean staying around for a few hours, in case an affected customer calls in a problem. In my opinion, too many of these service people simply don't care about the consequences of their actions, and are happy to make the circuit changes and just walk away.

Hardly the first time...

[Anonymous Coward]

"The Haley Enterprise" (http://www.haley.com) did the exact same thing several years ago when they spontaneously created an "ADVantage, Intelligence" (heh) newsletter and automatically subscribed everyone who'd ever contacted them for information on their products-- naturally, attempts to unsubscribe went straight to the main list, with the headers munged, so that within minutes thousands of people were emailing each other trying to figure out why they were getting this crap from complete strangers. I think it took Haley about three days to figure out how to shut it down. Yeah, I trust these guys to write software for MY business...

cf. asynchrony-projects.com, May 2000

[cperciva]

A similar misconfiguration resulted in a mailing loop a couple years ago with asynchrony-projects.com: somehow members-bounce@ was rewritten to members@; the net result was that a single incorrect subscribed email address caused a about a hundred emails to be sent out to 1000+ subscribers to the mailing list.

These problems are easy to fix, but people make mistakes... personally I'm surprised the number of mistakes has been so limited thus far.

E-Mail Database

[yintercept]

I am actually surprised by the number of times people send out email not knowing who will receive it or the number of people in their CC list. Most email clients don't let the end user see how much damage they have done. The goal of a developer is to give the users the power to get their job done, but so often you find people are clueless on what the power is or how to use it.

Personally, I would like to see email merge with databases. With a good relational DB, it is easy to show users what's gone through the pipe and how many emails your company has sent to a client, etc.. You can integrate the email into your CRM, etc. You can also place constraints on the system that can prevent this type of mailing list abuse that generates so much unwanted garbage.

Working with pure email clients (sendmail, exchange, whatever) seems to be like trying to fit a round cat through a square hole.

Re:E-Mail Database

[Anonymous Coward]

Merge mail with databases? Why?
Have you ever heard of log files? And that they can be parsed, analyzed, etc.?

Re:E-Mail Database

[yintercept]

Because it is generally faster, and you can easily define relations between the emails to a customer and the customer. For example, my last billing database would show all correspondences with the customer along with their billing history...it was very convenient to have it all in one place. Queries against an indexed database are generally faster and easier to do than a GREP through a ton of flat files.

Re:E-Mail Database

[GSV NegotiableEthics]

Personally, I would like to see email merge with databases

Just what we all need--worldwide internet mailing systems brought to their knees because some dumb marketing droid types in a cartesian join. <g&gt

Linux developers are clueless

[FarHat]

Its obvious that the women readers of the said magazine have the hots for German Linux developers and they tried to show their interest in them. True it wasn't in the best possible way but they did give a signal which the Suse guys completely misinterpreted. Sad.

Re:Linux developers are clueless

[Anonymous Coward]

Exactly. Those silly german linux developers passed up the opportunity of a lifetime to meet a cute singaporean zookeeper.

Restrict to only Users on List?

[akiy]

Why didn't these mailing lists just restrict who can post onto their lists to those actually on the list?

Re:Restrict to only Users on List?

[bradipo]

Sometime it is nice (if not a requirement) to have an ``unrestricted'' mailing list.

Wasn't this 6 months ago?

[Error27]

The date says the article was written yesterday but I remember being in this loop 6 months ago and getting 600 messages or so one night.

The funny thing was that I'm not on any Suse email list or on savoixmagazine.

Perhaps it happenned again but missed me. I've been out of the loop a lot recently.

Re:Wasn't this 6 months ago?

[llywrch]

> The date says the article was written yesterday but I remember being in this loop 6 months ago and getting 600 messages or
> so one night.

Looking back in the mess that is my mail archives, I see this happened towards the end of the week of Saturday 30 November 2001. When a search thru NANAE did not turn up anything about savoixmagazine, I decided this was just another weirdness of the Innernet, & forgot about it.

> The funny thing was that I'm not on any Suse email list or on savoixmagazine.

One theory a couple of the folks caught up in it suggested was that somehow somebody at savoixmagazine got ahold of the Linux Counter Project mailing list & added this to the mail list in question.

FWIW, after experiencing this mess, I have a little more sympathy for the bewildered user who sends off an email ``Take me off this list." I inadvertently added to the spew before I saw the email from the folks at SuSe -- which was buried in dozens of emails with the subject lines of ``Urgent", ``You have been subscribed toSuSe-security", ``You have been unsubscribed from SuSe-security". You have to get your fingers burned at least once in order to remember to sit no them before trying to solve a problem.

Geoff

's

[Anonymous Coward]

Before my bank's introduced their...

Before your bank's what introduced their... ???

Nonsense

[FreeUser]

There seems to be some insidious 'oh, it's those clueless Asians' thread running through so many Slashdot posts recently that I think it's time the balance was addressed.

That thread is based on the emperical experience of thousands of mail admins throughout the world (not just the US, as your slashdot bash inaccurately implies). If those whose ISPs (and in some cases, countries) are being blocked wish to demonstrate otherwise, all they have to do is administer their mail servers competently and close down their open relays.

Until then, their inaction will speak louder than your words, be they from Singapore, Korea, or wherever. As one who has travelled to those places I am reluctant to block entire countries, but my boss doesn't want his mailbox filled with SPAM and if blocking half of Asia is how I appease him, then half of Asia will be blocked, period. My personal fondness of Asia (and, for that matter, Africa, and Europe, and other places I have had the privelege of visiting in the last several years) will play absolutely no role in this decision, and no role in my opinion of the (in)competence of ISP mail adminsitrators in those locations. The only metric of any concern is how many open relays there are, and how those responsible act (or, in the case of many notorious Asian providors, particularly in Korea, don't act) when the issue is brought to their attention.

As for the differences in phone systems, you are comparing apples and oranges, and assuming one causation (lack of technical knowhow) when a completely different causation (lack of well defined, enforcable government standards resulting from a lassaiz-faire market mentality in the last several administrations) is responsible, then trying to apply the erroneous conclusion derived from your erroneous assumption back to another issue that is, in any case, completely unrelated.

Internet booths are another example of the logical fallacy you have fallen into in making this argument. In a country in which more than half the homes have their own PCs, and just about every public library is already on the net (along with many schools), internet booths would be a profound waste of money. In other words, you have brought up another completely unrelated topic and misapplied it to your original argument, namely what approaches empower the most people to use the internet under what conditions, with those conditions in Singapore quite different from the United States, which in turn is very different from the UK or the rest of Europe. Clearly that has absolutely nothing whatsoever to do with the competency level of mail administrators in Asia, Africa, America, Antarctica, Mars, Pluto, the NGC-1 Nebula, or anywhere else for that matter.

Re:Nonsense

[mccalli]

That thread is based on the emperical experience of thousands of mail admins throughout the world...all they have to do is administer their mail servers competently and close down their open relays.

Excellent example of the insidious nature I mentioned. This topic isn't even about open relays - it's about a mailing loop. Read the rest of the replies and you find most examples of these have been Western. Yet this simple, newbie slip-up is used as a yet more proof that the whole of Asia should be firewalled.

It's ridiculous.

Cheers,
Ian

Re:Nonsense

[Anonymous Coward]

I dont think the problem is accidental.
Most any distro and sendmail it's self has came with relaying turned off by default for 5 years now. They are intentionally tyrning on the relaying for the spammers.

Re:Nonsense

[Anonymous Coward]

Yet this simple, newbie slip-up is used as a yet more proof that the whole of Asia should be firewalled.

This is more than a newbie slip up; what was that magazine doing sending an email to a SUSE list? Oh wait, IT WAS SPAM!

I'm all for banning Asia from the internet, it sounds like a sensible solution.

Re:Nonsense

[innocent_white_lamb]

Yet this simple, newbie slip-up that is used specifically for the purpose of sending spam is used as a yet more proof that the whole of Asia should be firewalled.

Indeed. It appears to be used as yet more proof simply because it is, in fact, yet more proof.

heh just think if it wasn't people

[Anonymous Coward]

I could see it now, two mailers dueling it out, sending automated responses back and forth.

Subject: RE: RE: RE: Confirmation of your mail

We've recieved your comment and will get back to you.

>comment recieved

>>We've recieved your comment and will get back to you.

>>comment recieved

>>>We've recieved your comment and will get back to you.

>>>>comment recieved

>>>>>We've recieved your comment and will get back to you.

Babelfished!

[GSV NegotiableEthics]

From the article, the German sysadmin says:

Even though we contacted them in English, they ran their response through Babelfish (translation software) so we couldn't understand what they were saying

You've got to laugh. Rebecca Ore once told of her colleague trying to deal with some francophone Canadian sysadmins. "He just babelfished them until they gave up and started using English."

Re:Babelfished!

[Anonymous Coward]

vrai francais...

hmmmm...

Your a real anglophone I s'ppose???

sheesh!... some people...

Re:Babelfished!

[Anonymous Coward]

I guess it takes one to recognize one...

One an would generalize in this way based on maybe one possible bad experience...

Gee...

Re:Babelfished!

[Anonymous Coward]

Oops, something in my message didn't get processed correctly I guess (and there was a typo in my message too...)

I meant to say: Only an "insert word here" would generalize in this way...

oh yeah, i created a loop

[legLess]

I once inherited a smallish network (70 nodes) that was using an NT box as a web gateway and mail server. It was running something called Xtramail, which is a truly bloody horrible piece of software. While I was trying to figure out how to gracefully get rid of this box (a 486 on ISDN), one of the users wanted to create a mailing list.

Ok, no problem. Read the docs, slurp this list, check these buttons, viola. One of the cute little checkboxes was "Only allow owner to send list mail." Duh - I checked it. The guy sent his email (only about 200 list members) and we went home.

I came in the next morning to 20,000 emails just in the queue. That fucker sent our tens of thousands of emails overnight, because the send restrict wasn't working. There were a couple dead addresses on the list, and they of course bounced - and Xtramail politely returned those bounces to the entire list. Wash, rinse, repeat. If that place had had a real server and a real 'net connection, it could have sent millions of emails in that time. As it was, many people on the list were (quite justifiably) pissed.

So I called up whoever owned Xtramail at that time (Artisoft at that time, but a different company now - can you say, "hot potato?") and had a slightly polite shit fit. The guy flat-out refused to acknowledge it was a problem, until I made him go through the same steps on his local copy.

Crickets.

"Uh, looks like that option isn't working. I'll have to file a bug report." Then I spent another 45 minutes trying to get accounting to refund the $200 I'd given them for the support call.

They never did fix the bug, but I gave up my plans to have a graceful transition. I pulled that POS out the same day and installed another little NT mailer, quite a nice one, until I replaced the whole thing with a qmail FreeBSD box.

No moral to the story, really ('cept I should have been more paranoid, and tested the list more). But I bet more than a few readers have had that quick "oh shit" feeling as they saw the queue filling up.

Kinda like Apple...

[jeremiahstanley]

I bet some choice congressmen would find this kind of thing 'Innovative'...

I know, it's bad...

It happened with lawyers in my state...

[Karpe]

about a year ago, the Internet in my state near collapsed. It was all the problem of a very large mailing list managed by one of the major telecom companies of our state, aimed to thousands of lawyers. This mailing list was supposed to be "one way only", that is, the company would send the lawyers daily news about law, but one smart lawyer replied with an unsubscribe message, and all of them got it. They all started complaining, and you know lawyers, they cannot be objective, but wants to show the others how they can write "beautifully". The next step was the threats of suing the others, and this threats, of course, were also "replied to all". In a few hours the traffic was so high that all users (since there were lawyers in most ISPs), could not use the internet. After the mail server was shut down, and the policy of the mailing list changed so that only the moderator could post, the problem started to disappear.

Clueless lawyers.

Re:It happened with lawyers in my state...

[Anonymous Coward]

lawyers are -by definition- some of the stupidest people on the planet. Anyone that has to write a 3 page deposition that any normal person can say in 3 sentences is also solid proof (they must over use big words to sound smart and important) Also, I dare anyone to fine me a honest lawyer. it cant happen, it dont exist. and the fact that all judges come from lawyers shows why our judicial system is corrupt in every corner.

Please, let's kill all the lawyers and the would would be a better place.

This happens too often...

[tcc]

Just read the article, reminds me of when sometimes you apply to participate in a beta testing of something, and 2 weeks later you're putted on a mailing list with no warning other than the message, and there's always some newbies (and total idiots) that put their email addresses everywhere and wonder why "out loud" after.

You start receiving message from people that are asking "WTF" and then people replying to get out of the list and the gazillion "me too" posts and then the bitching following because they aren't putted out and receiving another million of people bitching at the last million emails...then a moderator jumps in, exmplain the situation, then you get another bunch of emails because people didn't read it, and it goes on until the moderator +M the list.

What's the mistake?

1. not taking the people for complete idiots

Not meant in a insulting way, but rather that taking for granted that people will understand X and Y and Z, it's not because they signed up for a beta, or whatever, that they are mature people or good with internet/communicating/netiquette. So if you take for granted that you will operate a bunch of monkeys for a start, you won't get this problem, and the more you see how the list is, the more slack you can cut off.

Basically it's like a server, if you open all access to everything, and cut after, it's hell with the users. If you start strick and cut some slack, it's always better (best example being the quota, people flood your drives, and blam!. the other way around is people manage their space, and welcome the added storage). This is a stretched example but the concept can apply to a mailing list when all the posts needs to be moderated (pain in the ass and you don't get instant feedback) versus when they go freely in the list, to people that KNOW they will receive the email and will react correctly.

2. The lack of experience at managing mailing list.

Just go to egroups and looks at all the flame/crap going around in some mailing lists... sometimes it goes out of control and gets ugly, a good moderator knows when to jump in and how to so nobody gets offended and people drop it willingly instead of being forced to.

3. Lack of technical expertise and lack of communication

Something lame, but if you setup a mailing list for your customers for example, and you don't know what the "digest versus individual email" mode does, and you don't even bother to check, (well this is a lame example again but you get the idea) well if you have an average 20 emails a day for lets say, update on a product or different security patches for different modules and some will concern everyone some won't but you send them anyways, maybe you should be sure of every switch you'll turn on on the mailing list software, and be sure to ask the customers over the phone if they'd like an email for every fixes or a batch in 1 email every day for example (or better, give them the option and explain it clearly).

And also, never forget that you are dealing with human being, this might sound stupid, but everyone here that ever ran a BBS, or a mailing list, knows what this means and the implications (flame, mistakes, etc).

Sometimes Mailing list are a good thing, most time, people tend to forget that FORUMS can do as much and even better (search, no need to give out email addresses, etc). A counter-example would be to issue security alerts, for this, email rules. You have to weight the for and against for the project you are working on, and if you are to be moderator, be sure you know exactly what you are dealing with, both the software and the target people, and setup with these previous raw guidelines in mind, and unless you make a big mistake, it should go fine.

My $0.02 :)

Re:Foolish Women's Magazines

[Anonymous Coward]

Go with In Style. Hotter chicks.

Re:This sounds like stupidity more than anything e

[ozbon]

Because - negative as it may sound - humans and spanners are fuckwits.

Republican

[hendridm]

> I bet you're a Democrat since the idea of being required to do some work is offensive to you.

It's not about the work - it's about the poor customer service that is plaguing universities nationwide. The customers (students) may have been in the wrong, but that doesn't mean you should ridicule them. You need to decide if their actions warrant losing their business. The universities know they can treat you like shit and people will keep giving them money because there is no alternative (since they are all the same). Then again, perhaps being continuously fucked in the ass is real world preparation after all...

(speaking as a person who is sick of being treated like a piece of dog shit by the university he shelled out some significant coin to)

m$ did not invent that crap

[Anonymous Coward]

Vacation by any other name ...

Re:This sounds like stupidity more than anything e

[smartfart]

Um, what we are talking about is not the same thing as what you set up. A mailing list proper uses a program, such as majordomo, listserv, mailman, etc. that allows anyone to subscribe to the list and receive mail. Everyone gets a copy of the email that is sent, and usually everyone can in turn send mail to the list.

I manage such lists with majordomo, and the program works fairly well.

Yahoo Groups does this (which used to be OneList, which used to be...) as a service, as does several other portals. In addition, software packages often keep mailing lists for the users of said software, as a way of tracking bugs, asking newbie questions, etc.

In the case we are discussing, the security email list for the SuSE linux distribution was one of the ones hit by the email storm, due to a misconfiguration by the Singapore women's magazine list.

Sharks

[Skapare]

Even sharks are not that bad. They do sometimes bite each other in a feeding frenzy, but this is much less often than lawyers threatening to sue each other. I love this story. I'm going to send it to all the lawyer mailing lists I know of.

BBS!

[Anonymous Coward]

To get your sendmail patches, dial in to your friendly neighborhood BBS!

Re:BBS!

[Derleth]

To get your sendmail patches, dial in to your friendly neighborhood BBS!

Can you still find modems with a standard WarDialer?

I don't want to be thought of as out of date, after all.

Offtopic: mod_rewrite - was Re:Babelfish rules!

[fanatic]

rewrite /MSADC http://www.microsoft.com
</IfModule>

This is a cool idea, but, if you do this, doesn't it make your machine the source of the request to www.microsoft.com?

Just curious.

Re:Offtopic: mod_rewrite - was Re:Babelfish rules!

[leviramsey]

This is a cool idea, but, if you do this, doesn't it make your machine the source of the request to www.microsoft.com?

No, it sends an HTTP 302 redirection to www.microsoft.com. The question is whether Code Red and/or Nimda actually follow the redirect. If they did, and I adjusted it to try and Code Red Microsoft's servers, that might actually solve the problem, as Microsoft could have a list of affected boxen.

In truth, this is probably pointless, but it gets some steam off...

Cyber Terrorism?

[martyb]

about a year ago, the Internet in my state near collapsed. It was all the problem of a very large mailing list managed by one of the major telecom companies of our state, aimed to thousands of lawyers.

If the internet in your state nearly collapsed, what's to keep this from being applied, maliciously, on a wider scale across a nation or the world?

Idea #1: Several e-mail worms exploited sending mail to all addresses in users' address books. The impact was rather dramatic. What if the e-mails were ALSO sent to mailing lists instead of just individual e-mail accounts?

Idea #2:Could a malicious user subscribe to a number of mailing lists, using different e-mail accounts, and then auto-forward all the accounts to each other? Maybe with a few auto-responders in the bunch? (Not sure of the specifics, here, but the idea is to get an e-mail that comes in, to automatically go back out to at least one, if not several, other accounts and/or mailing lists.)

Up until the time that the accounts are cross-forwarded, everything looks normal. Could even sign up these accounts with known spammers to get a good-sized stream of e-mail flowing.

At some point, just cross-forward / auto-respond / etc. the accounts and wait for the first e-mail to a mailing list to get the ball rolling. If enough lists are signed up, and accounts cross-forwarded... well, by the time it's figured out, there'd be so many people replying to the messages that the impact could be pretty massive.

Idea #3:Opt-in many large mailing lists to many known spammers.

These seem like obvious ideas to me, so I'm wondering if I'm missing something obvious? What's to kep these from happening?

Heh, a user at a customer site ...

[michajoe]

so this user goes on vacation and creates a little agent to send a copy of all incoming mail to his private mail account.

Nothing wrong with that.

Until she fails to religiously pick up her private mail every day and her mail box fills up.
So her providers mail server sends the forwarded mail back to her business address.

Where the agent runs and forwards it to her personal address.

When I got into work on Monday, it was quite a pain to get this mess out of the system, a total of over 80.000 mails had to be killed on 3 servers.

Big fun.

Imagine...

[Economist]

... a beowulf cluster of those loops... :-)

Lusopeople?

[Robotech_Master]

Over the last few days, I got a torrent of messages into my inbox. Though they didn't seem to come from suse or savoix; they came from someplace called lusopeople.com. I wonder if this has anything to do with them or not? The majority of them are all just foreign garbled messages.

At any rate, the torrent seems to have abated; perhaps it's over now.

Why not set the list to "reply to sender"?

[Hettinga]

I've fixed this by setting all my lists "reply to sender" instead of "reply to list". Most list managers I know of have the ability to configure this.

I've gotten yelled at by a few list-protocol nazis out there, well, one in particular, but their reasoning never made sense to me, so I just ignored them. If you make replying to the list a deliberate act by an actual human being, then there' no infinite ping-pong, as far as I've ever been able to see.

Oh so slimey.

[Anonymous Coward]

A (former?) bug in the congress mail server caused 50 replies per email if you cc (or maybe bcc'd) mail to the senators (not sure about congressmen).

I know of a forged email 'from' the wite house that exploited this.

'-)

I do remember the clipper chip.

Why do they screw things up on Friday?

[The Monster]

Of course because this was sent out on a friday, so this went on all weekend.

I have never been able to figure out why so many people pull this kind of crap. Obviously they were trying something new or different than usual. Otherwise the problem would have come up earlier.

Time-Warner Cable did this to me just last night. They 'sent out an upgrade' to the cable modems, and some of them didn't take. So the built-in DHCP server gave me a 192.168 address and I knew I was screwed. Tech support had me reboot everything, and it stayed screwed, at which point I was told I needed a new modem.

Of the handful of retail locations open today, the one I had a chance to get to before they closed didn't have any replacements (Hmmm. I wonder why they ran out? Could it be they had a few other people bring theirs in, too?) - at least that were working. Since tech support (including the guy who told me to go to that store) works upstairs from that particular retail location, I pointed out this fact and asked if there were any spares up there.

After much discussion via AIM between Customer Service and Technical Support, a friendly soul emerged from upstairs with 'their test modem', which I gladly accepted, knowing that it would therefore be in good order, which is how I found out about this 'update' thing.

Since only half of their retail outlets are even open on Saturday (with abbreviated hours) and none on Sunday, it seems to me like Friday night is exactly the worst time to send out an 'update' with the potential of breaking something.

down boy, down!

[Erris]

Why not do it on Tursday morning, or some other time that allows the nitwit that made the change to fix it immediately when the customer calls in a trouble ticket? (Because all the skilled telco employees were "downsized", and only the retards are left?)

Downsizing can make anyone look retarded. When there are not enough people to do the work, the work does not get done.

Downsizing is only half the problem anyway. There are whole industries where the average age of engineers and craftsmen is around 50. Those companies have not hired waves of new people for 20 years or so, and fired many of those that were lucky enough to get on. Think that 60 year old overworked survivor really cares about training sucessors? Nope, they are looking for a package and will give the job to you the way they got it, learn as you burn. Many great mistakes will be repeated. I believe that this really boils down to a single factor. Does the person in question really give a shit about the consequences of his or her actions?

You are entitled to your opinion. Most normal people quit jobs where things are starting to fail. The lucky ones find good alternatives. The loyal ones get stuck with a job that much more difficult. How many years of your life are you willing to give up to hopeless causes? Everyone knows the general rules. Some are lucky enough to put the big changes off as good practice, sometimes the law, demands.

I feel awful for people who do real work at the telcos. Change sucks, and they are getting plenty of it. Imagine starting your career there before deregulation. Off you whent to serve the regulated monopoly and the public. You accepted low salaries in exchange for stability and pride of serving one of the best and cheapest telco services in the world. You also put up with the more inane political nonsense and tried to just do your job.

OK I'm from Singapore... Re:Asia Problem

[Build6]

... and I'll say that I've never heard of that magazine.

Just as not *all* Americans are SUV-driving, shotgun-wielding, cowboy-hat-and-flannel-shirt wearing beer drinkers, not all Asian sysadmins touch the DontBlameSendmail config option. We have our share of not-even-halfway-to-halfway-competent fellows trying to set up web servers that subsequently get hijacked, we have our share of management PHBs printing out emails in order to read them, we've got crackers making use of school terminals trying to break into sites with rootkits (check out the Project Honeynet incidents) etc. etc. We've also got capable sysadmins, IETF members(e.g. look at RFC 2822) etc. etc. .

I'll say now that (a) Singapore did not "sit out" the whole .com bubble (although obviously not quite as caught up in it as the US), and (b) "savoixmagazine" doesn't seem entirely what you could call a "big player" in the local market (though who knows in the future, what with the infamy they're accruing from this incident? :-). Correspondingly, perhaps their admin side isn't so clued in as to be able to properly guard against incidents like this occurring.

Some people are thinking of/already blocking off "all Asian mail". Well, I think if you step back and look at it, it's just another part of the fallout from the whole dotcom bubble. For the past few years, just as much as in the US (perhaps more?), you've got endless news reports, profiles, etc. etc. of all the "dotcom billions" being made and waiting to be made... people who make less in a year than an average American makes in a month aren't going to be able to resist. They may not have the chutzpah to imagine they'll become the next Bill Gates, but hey, you don't really need ALL of 50 billion do you? I'm continually stunned by the willingness of people who really don't know anything trying to set up technology businesses. Is it any wonder if you've got penetrated/crap servers everywhere?

Anyways this looks to me like an "error" as opposed to an open-relay-allowing-for-spam issue; plenty of people make mistakes although in this case the "price" in terms of wasted bandwith/time/etc. is high. It won't be the last time, either.

Re:OK I'm from Singapore... Re:Asia Problem

[Anonymous Coward]

Just as not *all* Americans are SUV-driving, shotgun-wielding, cowboy-hat-and-flannel-shirt wearing beer drinkers,

Is it a faux pas to drive an SUV? Is it bad to wield shotguns (presumably for hunting or self-defense)? Do cowboy hats cause corruption? Are flannel-shirts the root of all evil? Beer drinkers... well, what country doesn't have beer drinkers? Besides, there was a time when the US Constitution outlawed the consumption of alcohol (18th Amendment).

Re:OK I'm from Singapore... Re:Asia Problem

[Anonymous Coward]

You call this lil pink thingie you're driving a SUV? At once go to nearest dealer and upgrade your puny little penis, otherwise OPEC will starve and oh no what a pity that would be.

Re:Anecdote - Another One

[ashitaka]

There is a certain secure email company asking the lawyers of BC to re-register for service this year as the free evaluation/pilot period was expiring.

You guessed it. They sent this to hundreds of personal "Only-use-this-only-for-important-matters" addresses. All in the To: line.

I don't think anyone is going to sign up.

People and their innapropriate use of TO and CC:

[nettdata]

Not much pisses me off more than people that put their entire list of "SPAM" (good or bad) email recipients in the CC or TO field instead of putting them in the BCC field.

Recently, my cousin was one of these abusers, and, being family, was totally fair game for some retribution. He was about 6 weeks away from leaving his job to go back to school, so he emailed his hotmail account a message, and CC'd that message to EVERYONE in his contact list at work, all so it was easier for him to import their addresses into Hotmail. There were over 350 people in this list. If this wasn't bad enough, he mis-spelled his hotmail address on the first message he sent out so he sent a SECOND message.

Well, that was the final straw.

Now, little known to Steve, me, being somewhat of a techie, had acquired his SteveLastname.com domain name as an upcoming birthday present. I proceded to send out an email to EVERYONE on his CC list, pointing out the totally innapropriate way in which Steve had used his email, and made a general call for embarrassing pics, stories, etc., that we could use to shame him.

Well, within 2 minutes, his dad sent in a Christmas pic of Steve when he was 7, his brother sent in his 1st date pic, and friends from work sent in pics and stories from the bar, etc. Each time something new came in, it was put up on his site and the email list was notified. It's interesting to note that the opt-out was included in the first response, and at the end of the day, only 2 guys had done so.

Now, let me fill you in a little bit on the scope of this little prank. You see, Steve was working at the largest investment bank in Canada, and probably 80% of the people on the list were his fellow workers. Well, word spread. Within an hour of the first notification, the site had been hit almost 1,000 times. At the end of a fun, 4 day run, the site had been hit almost 60,000 times (page views). To top it off, the top execs at the company (CEO, CTO, CIO, etc.) all made a field trip at the end of one of their exec meetings to come down and say good-bye to Steve in person. Now, Steve was a little terrified over this attention from the execs, but it was nicely relieved when they proceded to hand him a letter of reccommendation signed by all of them and they all had a good laugh about it.

All in all, it was pretty fun, and Steve was a good sport, but at the end of the day, email abusers still piss me off!

offtopic, NZ beer.

[kiwipeso]

Sheep shaggers drink speights, it only tastes good if you've been riding down a dusty rural road for an hour to drink it.
Really desperate farmers drink tasman draft, it's almost bad enough to be adopted by australia as a true blue beer.

I wouldn't have a clue what american beer is like, I once tried Budweiser beer and I had to piss in it to make it stronger.
What americans call beer, we call watered down urine. If you want NZ beer you can handle, try Mako, Lion ICE or Flame.

The best NZ beers are Steinlager, Tui and Flame. The only good things from the South Island are the mineral water, electricity and the raincoats.

I live in the centre of New Zealand, wellington. We can see the south island from the hills and southern beaches of the suburbs.
Wellington by far is the best place in New Zealand, we have the people, the culture, the government and no traffic jams.
We don't care what drink you try, unlike those snobs in Auckland.

Mail order pigs?

[leonbrooks]

Pigs... In chain mail... [...] I want them, *now*!

Ah, another Hogfather fan... (-:

If you then practiced, er, discipline with them, could they then be mail order pigs without being Catholic? The Catholics seem to have a monopoly on male-order pigs...

Re:Anecdote - Yet another one

[Scorchio]

One of the programmers here was taking a few days off work. He had a few bits and bobs on his work machine that he wanted to transfer to his home PC. Instead of searching around for floppy disks, he bundled the stuff up in a zip file and emailed it to his home account as an attachment that was a few megabytes in size. In case anything important came up while he was away, he set up his work email program to automatically forward mail to his home account. Maybe you've already guessed what happened. Moments after he left, the zip file he sent made its way to his home account, where it was bounced by his isp because his mailbox was already too full. The mail was returned to his work email inbox, attachments and all, and the auto-forward promptly kicked it straight back out. This cycle continued for some time until our network admin guy had to come in and investigate why the mail server was having a fit. He removed several gigabytes of duplicated mail while breaking the cycle. All too easy a problem, it seems.

Invitaion for Spam.

[Ian_Bailey]

I'm surprised that this didn't happen to anyone else...

I was on a mailing list where this happened, and it ended up not being so bad, until a few bad apples came along...

I found it personally funny, but I knew there were a lot of people that were surprised and shocked to find various emails that started like this...

"Thank you for joining our opt-in marketing scheme!"...."Thank you for joining the free sexy school girl pictures mailing list"... etc etc....

Since the confirmation obviously was sent to everyone, some people got the bright idea to subscribe and confirm the subscribtion, and the spam really started flowing then!

Needless to say, many were very angry, and I don't think they ever figured out who did it. Just my story.

Easy fix - hold incomming email for duplicates

[Anonymous Coward]

One company I know routinely holds all emails with attachments for two or three hours to see if the company is getting spammed with the same attachment sent to dozens/hundreds of people...

More nonsense

[FreeUser]

Excellent example of the insidious nature I mentioned. This topic isn't even about open relays - it's about a mailing loop.

The two are related, as any rudimentary understanding of how mail systems work will make clear. Without the open relays the SPAM could not be sent to the mailing lists with their header information forged and hiding the sender's online identity. The offending messages resulting in these mail loops are originating from open relays, most of which are in Asia.

But be that as it may, you miss the point entirely (perhaps willfully?).

It's ridiculous.

No, its the only option the Asian providors are leaving us. Making a "newbie" mistake, as you misleadingly put it, is one thing. Willfully refusing to fix the problem when it is brought to your attention is something else again. Those "western" sites you refer to either fix their open relays (the most common response) or get blocked themselves.

What is more, for the last half decade almost all mail servers come with open relaying shut off by default, which means these "clueless newbies" almost certainly had to turn open relaying on, deliberately.

It is not unreasonable to infer from two deliberate actions, namely turning on open relaying in the first place, then refusing to fix the problem when it is abused and people complain, that the administrators of these sites are either appallingly incompetent or obscenely complacent. In either event we can be certain of one thing: if we want to stop receiving SPAM from these sites, we have to filter them. Period.