Slashdot Mirror
ORBZ Shuts Down
Tim Jackson writes: "In a depressing development for those wanting to protect themselves against spam, it appears that popular open relay database ORBZ (formerly at www.orbz.org) has shut down effective immediately - see here for the final post from ORBZ admin Ian Gulliver on the ORBZ list explaining the reasons behind the closure.
The 'Lotus Domino' issue he refers to is the issue he discovered in the course of running ORBZ and reported to Buqtraq, which means that certain SMTP envelopes (such as those sent by ORBZ when testing for open relays) cause Lotus Domino servers to go into a loop, effectively creating a DoS situation.
Unfortunately (but understandably), irrelevant of the merits of the case, Ian doesn't want to risk jail for the sake of spam fighting. Of course, if common sense prevailed, it would be the mail server vendor in court for producing insecure mail server software, not a third party for happening to send requests that unintentionally crash poorly-written servers."
They should've mailed everyone to tell them.
"Under the iron bridge, we fist" - The Smiths, Still Ill
im getting around 80 mails per day, ~40% is spam.
i guess it has to be around 1000 spam mails per day for everyone to make something change/happen.
Why not just use another envelope? I'm guessing ORBZ wanted to go away anyway and are using this as an excuse.
If this goes to court, it'll make another good /. story at some point.
A shame though, that he's getting nailed for Lotus's incompetence. Is that looping issue patchable?
If you can't see the value in jet powered ants you should turn in your nerd card. - Dunbal (464142)
The Register has a little more info. It seems that there is a workaround which involves changing the settings in Domino, though persuading everyone in the world who's running Domino to apply the fix might be hard! It seems like orbz.org is down already, and it's probably going to stay that way :(
Is crap for a mailserver, I've always had problems out of it and avoid it like the plague when I can get away with it. For one, it tries to do too much for a mailserver, and its functionality as a mail server seems to be secondary to it's database features. Domino may work well as a workflow engine/document management, but it really isn't a good Mail server implementation. Unfortunately, so many companies use it as an Exchange replacement, even though it is intended to do much more and mail is done in a really clunky way.. Just spend a few days using Notes and you'll agree that mail does not seem to be a central concern in the scheme of domino..
Perosnally, I think postfix or qmail are good mail servers (though postfix doesn't cope at all with accounts that have uppercase in them, and qmail is only marginally better at it...). They are simple, short, and to the point. If you must use domino for mail serving, I would suggest having some sort of minimalistic mail server to act as a go between between domino and the outside world, as domino's is flawed in so many ways...
XML is like violence. If it doesn't solve the problem, use more.
This is in every way wrong. If that damn company can't make mail software it's their problem. They don't have anything to do with us who just try to block spam.
No spam filter... Now what? Guess I have to look for another, hopefully as good as orbz.
I've never liked the open relay test based spam filters. Of course, they have a right to list who they want on their list, and if I run a publicly accessible SMTP server I can expect all kinds of bizarre malformed SMTP headers to arrive. However, when you are a self-appointed policeman of the internet, you should first be a good netizen. One of the things good netizens do not do is repeatedly exploit bugs in other people's software to bring down services. Imagine if netcraft started crashing some obscure OS/2 web server with its queries. We'd expect them to stop querying those servers, at the very least, and at best to fix their query.
--
E_NOSIG
I run a Domino server. In fact I run lots of Domino websites. And this "Denial of Service" issue that is reported is really due to Admins who don't know what they're doing.
Any system can try and forward to 127.0.0.1 if it is set that way. There is so much information available at all the normal locations that it is really the Admins own fault. Why they should take it out on somebody who has done as all a superb service is anybodies guess.
Where to look for info:
Lotus
Notes.net
DominoHive
SecurityTracker for Domino
I remember some Lotus users who kept telling us how Sendmail and Exchange where so horribly insecure. That'll teach them :)
I'm sure I'm missing something here, but why can't ORBZ use a different envelope that doesn't bounce to 127.0.0.1? If they would just use an envelope that bounces back to one of their machines, for example, then they could still test open relays in a non-destructive manner.
Can someone more knowledgeable than myself explain why they would rather go out of business than slightly alter their envelope that they test with?
Your right to not believe: Americans United for Separation of Church and
Guess we should've just waited out ORBZ's demise.
I am currently not obliged to divulge that information as it might compromise the agents in the field
Of course, if common sense prevailed, it would be the mail server vendor in court for producing insecure mail server software.
:)
And that would leave us with how many commercial mail servers? None.
More laws like this will only make things worse. One thing we have seen proven time and time again (SSSCA, DMCA), is that legislation of technology by people who don't understand or are influenced by people who don't understand it is that it does not work.
I'd bet that nine out of ten 'insecure' or 'spamfriendly' open relays are human related errors. Granted, using sendmail is like playing with a loaded gun with the trigger welded down, but it is possible, and other MTAs are pretty damn secure and fast (I like Postfix).
- MAIL FROM:<bounce@[127.0.0.1]>
Why IBM decided to pursue criminal prosecution rather than releasing a simple bugfix is beyond me.RCPT TO:<address@domain.com>
If this is a problem with him sending out packets, why not give that duty to the anti-spam community? He can just post the results.
Does this mean that Domino isn't adhering to SMTP standards? If so, then what is the problem? Domino users can't sue for DoS if their software is being used properly (according to standards).
-- null
"Unfortunately (but understandably), irrelevant of the merits of the case, Ian doesn't want to risk jail for the sake of spam fighting. Of course, if common sense prevailed, it would be the mail server vendor in court for producing insecure mail server software, not a third party for happening to send requests that unintentionally crash poorly-written servers."
So what this is saying is that Ian is willing to stop his client because a specific (and not nearly as widespread as its competitors) mail server has poorly written bugs. If anything, it is Lotus who should patch their servers. This just reeks of poor engineering decisions.
And Jail Time! heh. Give us a break. You can't be put in jail for writing good software. You can be put in jail for writing intentionally destructive software. If their server has a terrible bug, it's not your fault that it just happens to be exposed by a correctly functioning program that performs a useful task.
I can just imagine Lotus/IBM sending a cease and desist letter for the production of software that breaks their mail server... Except that the software is already out, the knowledge that the problem exists is widespread to the hackers (i.e. slashdot readers), and IBM better close those bugs before _we_ do.
ORBZ never came into as widespread use as it perhaps deserved, so a lot of slashdotters might be left wondering what exactly it is (was):
The short story is that it is a replacement to the now-dead ORBS, which stood for "Open Relay Behaviour-modification System", and was basically a system of centrally "policing" open mail relays by occasionally testing them with scripts. Any system that failed the test eventually entered ORBS's "black list", which some mail admin's used to bounce email with a path through them. Well, that project died, so ORBZ was born: the "Open Relay Blackhole Zones".
Now, it too, is dead.
And we can go back to blocking the whole of china, rather than just open relays on it.
shrug.
--
m iso socially aware artistic geek pen-pal, m or f, in '1337 edu. jazz, poetry a must.
Of course, if common sense prevailed, it would be the mail server vendor in court for producing insecure mail server software
I think that should be "in court for refusing to fix insecure mail-server software in a timely manner..."
Has a patch ever been released for Notes?
Tell me Notes servers won't be targeted now in protest!
as absurd as this sounds, the way the legal seems to be working is if he did go to court he would probably end up going to prison, and probably serve a longer sentence than murderers and sex offenders, and I am not even going to into the legal fees that would be involved... if it is not already too late...
When one of the open relay testers decides to test my systems (which have never been open relays), I get at least a dozen unsolicited e-mail systems double-bounced to me. Isn't it strange that a system created out of fury at unsolicited e-mail generates a fair amount of it? The double bounce messages never tell me specifically why they have decided to test my system, and they never tell me how to prevent them in the future. Shouldn't people on a moral crusade be careful about hypocrisy?
It doesn't say anywhere that it's Lotus/IBM suing them, just that they are being sued relating to the Domino issue. I would guess it's someone who was the victim of one of these DoS 'attacks' that is doing the suing.
$ host -t mx ibm.com
ibm.com mail is handled by 0 ns.watson.ibm.com.
$ host -t any ns.watson.ibm.com
ns.watson.ibm.com has address 198.81.209.2
$ telnet 198.81.209.2 smtp
Trying 198.81.209.2...
telnet: connect to address 198.81.209.2: Connection refused
It was never very good for anything but bouncing
legit emails and causing uneeded headaches anyhow.
Automated blacklists are just simply a bad idea. Period.
They were never any better than the spammers
themselves IMHO, employing the same kind of tactics
to try and cram an email through your server, and then
making your life miserable after suceeding.
Something like RBL is much better as there is actually
some human thought involved before sinking that sources
emails to
Have you painted a shed today?
Let me get this straight. An organization whose sole purpose is fighting spam, is being shut down and afraid of facing jail time due to a bug in Lotus notes?
Can we find out who the suing party is, so folks can let this company and their state representatives know what they think of this?
Also, could not Lotus notes servers be identified (I would imagine they spit out an ID string like other SMTP servers) and this bug either worked around, or the Lotus servers ignored? It seems that would be more constructive than shutting down.
-me
Love many, trust a few, do harm to none.
We need a "Real time open relay tester black list", so that people can block the queries sent by open relay testers.
I'm not being entirely facetious either; it seems that the volume of relay testing traffic has increased signficantly over the past year.
Tarsnap: Online backups for the truly paranoid
Mail Abuse Prevention System
Tracks open relays, dial up netblocks, etc. Works with sendmail, postfix, etc..
Does require paid subscription, but free for personal/hobbyist usage.
Anybody can access a publicly available SMTP service and produce whatever type of SMTP headers they want. It is a publically available service.
However, you typical hacker does a similiar thing, he sends bytes to publically available service.
If you decide that any univited data being sent to your server is a crime, then sending an email to someone you dont know is a a crime. If you think its not a crime, then what script kidz do is a public service.
I personally hold to the latter, even though I abhor spam and hate malicious crackers. I think that by holding the server owner whos providing publicly available services accountable for his own security, that we would get more secure software out of it, and less coverups. (lawyers trying to do work that can only be done by programmers) SMTP servers should be able to handle munged headers!
I can imagine the PHB thinking now "Well since I cant sue the kiddie whos sending those bad SMTP headers, I guess im going to have to actually fix the bug in my mail server, oh the humanity!"
Of course fraud etc should still be a crime- but why should accessing publicly provided data services be one?
Can a mailman, or the U.S. Postal Service be held liable if I design my mailbox in such a way that stuffing an improperly designed envelope in the mailbox causes my house to burn down? Can the person who designed the envelope be held responsible? What if the envelope contained free samples of gun powder?
It seems to me that the people responsible would be the mailbox designer and the idiot who purchased a mailbox that could potentially burn your house down (even if highly flammable object are placed in it).
The question for the judge in the case if such a metaphor were used is did the envelope more closely resemble an improperly folded envelope, a free sample of gunpowder or a live grenade.
-Chuck
One more point: if he's being sued for something done in the past, whether or not he shuts down Orbz is irrelevant, liability-wise. If he has been given a cease-and-desists (or else face prosecution), would not simply skipping Lotus servers meet that requirement, and prevent any future liability?
Surely he can't be held liable by whoever is suing him, for scanning the 99.9% of non-Lotus SMTP servers out there.
-me
Love many, trust a few, do harm to none.
Why IBM decided to pursue criminal prosecution rather than releasing a simple bugfix is beyond me.
If it is IBM, they deserve to be bitchslapped. Hard.
However, I'd be very curious to know who is actually doing the suing and issuing the legal threats.
I suspect they are incompetent admins, trying to cover their own incompetency by pointing an accusing finger at the innocent, in this case ORBZ.
Incompetents banding together has to be one of the more sinister forces in our society: far more common than intelligent and neferious conspiracies (which probably can be counted on one hand, if that), far more wide reaching, and far more destructive.
OTOH, for the more paranoid: what are the odds that some SPAMMERs themselves have set up Domino servers with the explicit knowledge of this bug, in order to have legal grounds to threaten and sue one of their most effective opponents out of existence? Actually, I was writing the previous sentence as a joke, but as I type it I don't find the scenerio nearly as unlikely as I first thought.
The Future of Human Evolution: Autonomy
... when they tested my mail server for open relay (which it had been, but was fixed). I was setting up qmail for the first time, and in cleaning up removed a file I shouldn't have (namely rcpthosts). In any case, for those of you who don't know, remove this file, and you're an open relay. I was, and sure enough, a spammer found it and started using it. I caught it when a bunch of bad email addresses bounced to my account (that and my maillog grew by about 2000%). I figured out the problem in about an hour, and closed it up. I also reported the spammer to their ISP (pacbell.net) and cleaned out the queue (over 2000 spams ready to be sent). In any case, someone must have reported me, even though I put up apology pages and comments suggestsion. In case whoever reported me is reading this, I bear you no ill-will, I was an open relay and deserved to be reported. In any case, their test showed I wasn't open, so I never got added to their list.
Check out www.spews.org for a list. Personally I use the one published via osirusoft.com; works nicely for me.
[not karma whoring since I'm AC. w00t!]
I emailed ORBZ over the issue, citing three identical spams all of which were from the same physical server (from a typo in the headers) yet from different IPs, all of which were marked as "Verified clean within the last 30 days". ORBZ' response to this was basically "use multiple RBL servers", which I already was. I stopped using them at all the same day and switched to an alternate RBL server that I could submit spam to for automatic inclusion once verified. Since then I've also set up my own local RBL server, which makes things much easier when you have multiple SMTP servers to administer...
UNIX? They're not even circumcised! Savages!
Hmmm, this just doesn't make any sense, so maybe it would best be defended with the Chewbacca Defense.
(Sigh, maybe some day I'll get all my comments in one post. I feel like George Costanza, coming up with the witty comeback long after the fact. "The jerk store just called, and they're all out of you!")
-me
Love many, trust a few, do harm to none.
It's the spammers that should be targeted with HEAVY fines and penalties....not innocent users or admins of closed SMTP servers that are lumped into the guilty category through association (ie on the same damned subnet as a dumbass with an open relay).
Check out some of the anti-spam and anti-telemarketing laws being passed in CA and TX.
... before it gets slashdot'ed ...
Date: Wed, 20 Mar 2002 03:15:49 +0000
From: ORBZ
To: list@orbz.org
Subject: [ORBZ] Shutdown
Here's the email that those of you with forward sight
have been fearing since the inception of ORBZ.
As of this moment, ORBZ is shutting down. DNS zones
are going to stop resolving, the website will disappear
and mail will stop working (so furthur discussion on
this list probably won't work -- use NANAE).
I don't want to disappear in silence like ORBS, so I'll
try for as much description as possible without
compromising my own position.
I received an official court notice this afternoon to
turn over all information relation to ORBZ accounts.
This came from the 10th Judicial District court of the
State of Michigan. It appears that ORBZ may be facing
criminal charges for denial of service relating to the
Lotus Domino issue.
I was happy to try to weather any civil issues that may
have come up, and I was committed to seeing it through.
However, the threat of jail time is too much; I don't
believe in this fight quite that much.
Thank you all for all your support. I sincerely hope
that someone with the goal of carrying on the mission
of ORBZ pops up in another country with a less
foreboding legal system. Anyone who has copies of the
current zones may do with them what they wish.
For those of you stuck without good spam filtering,
please consider ORDB and SpamCop; they both provide
excellent free solutions.
Ian Gulliver
ORBZ
SlashSig Karma: Excellent (mostly affected by moderatio
I for one am happy that ORBZ is gone. I run a mail server on a dial-up modem and have more then once gotten a reply back that ORBZ IS BLOCKING SPAM FROM AN OPEN RELAY IP.. guess what? I'm not running an open relay but I guess someone else was. Well I'm sick of it. I'm glad Ian is gone with his Orbz stuff. As far as blocking.. that's up to the end user.. not some little guy who wants to start a list.
why can't ORBZ use a different envelope that doesn't bounce to 127.0.0.1?
:-)
Mail servers need to be configured to relay mail from the localhost (themselves). Otherwise, things just don't work. What using the 127.0.0.1 does is attempt to fool the mail server into thinking that the mail is coming from itself. Also, it makes sysadmins aware that there's a config problem in their mail servers.
If a server can't relay, it should REJECT the mail ("error: no relay thru here") but Lotus seems to be bouncing it.
A properly configured mail server will be able to look at the mail and say to itself, "I've seen this before, let's trash it."
A mail server should NEVER crash do to malformed messages. The strongest lock is no good if the door is weak.
Give me my freedom, and I'll take care of my own security, thank you.
Surely if they knew the envelopes they were sending out would crash some servers, then that was at best highly irresponsible behaviour. Yes, in an ideal world all software would have no bugs and all sysadmins would be omnipotent, but I don't see that happening any time soon :-). I don't believe that ORBZ has the right to go around DOSing servers that they consider to be inadequately set up - effectively electing themselves judge, jury *and* executioners.
If ORBZ behaved a bit less arrogantly I suspect they would make fewer enemies.
Their lame ass servers were always f'ing up. I ended up taking that crap out of my mailer config a few months ago because I was tired of lookups failing and slowing everything down.
I switched to ORDB and that seems to work fine.
I still get buttloads of spam from other places, but I do see a lot of blocked mail.
...as long as individuals and other non-corporate entities run them. Why? Because we've seen how painfully easy it is for corporate or well-heeled individuals to apply pressure (usually monetary) against these individuals.
The solution is to make this process as anonymous as possible, yet maintain some degree of integrity in the process. Here's an idea: Somebody must be willing to step forward and create a script which can be fully automated to check for open relays. Generate the script signature, sign with a private key, and distribute script, signed sig, and public key. Run the script anonymously -- use anonymous relays, bogus envelopes, whatever it takes. Publish the results on Freenet, signed with the same key used to sign the sig of the script used. Obviously, the model needs some work, but I think if a public key is established as "trusted," then the results that are published anonymously on Freenet can be "trusted" with the same degree of trust.
Or something like that...
You are so wrong! Think about what you are saying for a second. You are saying that software vendors should be held liable for producing faulty software. What does this apply to? Only Lotus, Microsoft, and the big guys? What about holding Alan Cox and Linus liable for bugs in the Linux kernel? I hope you don't want to hold security programmers liable for demos of exploits. Software is fundamentally different from a product that can be recalled and judged unsafe. The marginal cost of software is zero, and it is not a physical product - it's just information.
Do you have any idea how it would cripple the software industry if they operated under the constant threat of product liability suits? What about old software? Really old versions of Sendmail were set to open relay by default. Certainly it's not the fault of the programmers that they didn't protect against spam, BEFORE SPAM EXISTED. Now think about a software industry where a pack of lawyers has to review every design document, every line of code in the name of 'product safety.'
This is clearly a case where the free market already solves these problems, and your foolish solution would only serve to artificially disable an industry. If companies are upset with Domino, they will eventually switch to a better software package. If Lotus cared about their customers, they would have patched their software. I can't believe it when people like you say these things without thinking of the consequences.
You did hit on one correct point - intent. It's unfortunate that ORBZ was in danger of being sued. They shouldn't be in danger, due to intent. They have no intent to DOS random Lotus Domino servers.. but it seems like they just can't risk it. If I intentionally exploited the Domino bug to crash servers, well that's another story. It's not Domino's problem, it's mine, and I should be carted to jail for that.
This incident again raises serious questions about the viability of so-called "dnsbl"s. (DNS Block/Black Lists) If a dnsbl receives a notification that a certain IP address has an open mail relay, they either have to test it to verify it's condition or assume it's open based on a copy of apparently (?) relayed email. Does this possible action mean that dnsbls need to locate themselves in jurisdictions that are unlikely to prosecute minor (?) "computer crimes?" Do the operators of DNS servers for dnsbls need to isolate themselves from any apparent relationship to whomever might be doing such open-relay testing? Coupled with SLAPP-style threats from those ending-up on open-relay lists, it almost seems that those wishing to aid in the combating of spam by running dnsbls will have to adopt the behaviour of criminals (like the spammers themselves?) to avoid persecution.
One wonders if the people who initiated this action (the criminal charges) considered the possible fallout resulting from doing so? Any skript kiddie with telnet can execute this 'sploit. The skript kiddiez may have known about this before, but they certainly know about it now. I'd hate to be running a Bloated Goats MTA exposed to the 'net right now. (Or ever, for that matter. But that's another issue.) It also seems to me this company has just painted a big red and white bullseye target on themselves. I mean, how would you like to be an Admin for that place? Not me. I think I'd be lookin' for other employment like right now. I also imagine that, right or wrong, there will be mail admins that will locally block-list these people till the end of time itself for "attacking" a dnsbl. It just doesn't seem to me that this was a very smart move on the part of the aggrieved party.
Lastly, it seems to me that ORBZ could have avoided this problem entirely by finger-printing MTAs it was going to test and avoiding the more esoteric open-relay exploit tests when it was discovered the server under test was Bloated Goats malware. In fact: relayed spam on-hand would indicate a Bloated Goats MTA in the "Received:" headers. (Blotus seems unaccountably proud of their work.) In such a case, if the open-relay nomination was in order (relayed spam on-hand), just list the damn server and be done with it.
So now, regardless of the fact that I'm doing something completely benign, I have to also be careful about "offending" some poorly administered mail server? I won't even get into how stupid it is to set up a mail server with a local loop -- it's the principle of the matter that really pisses me off. Next I won't be allowed to surf the web with an adbuster because it confuses and even crashes some websites...eghads! What the hell is this world coming to?
"It appears"? It is or it isn't. Funnily enough, I'd got the impression that cases were filed before courts ordered documents to be handed over.
Further to that, isn't the case going to be about past behaviour? So isn't taking ORBZ down is response to it a de facto admission of guilt? Is this some sort of preemptive plea bargain attempt?
Ian Gulliver has never struck me as being stupid or cowardly. I can't help but feel that there must be more communication going on here, i.e. an offer to drop the charges if ORBZ just goes away. Frankly, I find that highly distasteful, as it's edging very close to barratry.
I don't blame Ian one bit for shutting down, I just think that he's been shown a carrot as well as a stick so that this never has to reach a court.
If you were blocking sigs, you wouldn't have to read this.
Who is to say what's a bug? Can I be sued because there's a feature a customer wants that I didn't implement? What if I wrote sendmail 10 years ago, and now someone sues me because I wrote an open relay? But there wasn't any spam when I wrote it. There is a grey area between bug, and undesired behavior. Let's say I write a word processor. Do I get sued because my app won't let you print from the print preview screen? Because it doesn't save your default tab stops?
You can't regulate software.. and if customers don't like something, they'll look to another vendor. This is already a self-regulated open market folks, move along..
I seems to me that if Orbz can send certain SMTP envelopes that cause Lotus Domino servers to go into a loop those servers are going to need to be fixed.
:=)
This vulnerability is public knowledge now so how many black hats are going to be doing this just for fun and giggles?
I can't help feeling that when a company gets shutdown rather than a obvious corrective action being taken that there is a hidden agenda lurking about. Just my suspicious nature taking over.
The race isn't always to the swift... but that's the way to bet!
FEATURE(dnsbl,`or.orbl.org', `Mail from $&{client_addr} refused: See http://or.orbl.org/ (ORBL)')
FEATURE(dnsbl,`relays.ordb.org', `Mail from $&{client_addr} refused: relays.ordb.org. See http://www.ordb.org/')
FEATURE(dnsbl,`or.orbl.org', `Mail from $&{client_addr} refused: or.orbl.org. See http://www.orbl.org/')
FEATURE(dnsbl,`spamhaus.relays.orisusoft.com', `Mail from $&{client_addr} refused: spamhaus.relays.osirusoft.org. See http://relays.orirusoft.com/')
FEATURE(dnsbl,`spews.relays.orisusoft.com', `Mail from $&{client_addr} refused: spews.relays.osirusoft.org. See http://www.spews.org/bounce.html')
FEATURE(dnsbl,`rbl-plus.mail-abuse.org',`Mail from $&{client_addr} refused by RBL+. See http://www.mail-abuse.org/')
self-appointed policeman of the internet
I hate that term. Nobody just went and 'appointed' themselves policeman. Everything the blacklists do is completely voluntary - you (or your ISP) do not have to participate if you don't want to. This is in contrast to real police, who keep society in order as part of our social contract. We don't have a choice about that one.
These new advertisements are very well timed...IBM "build a moat" for your e-infrastructure....just as long as it's not Lotus based!!! ;)
John Maynard Keynes: "When the facts change, I change my mind. What do you do?"
I for one am happy to see this happen and I hope the rest of them all shut down or get shut down also.
The sheer volume of mail that we received as "probes" to test for relays which we have NEVER supported, is SPAM in itself, in my opinion.
Worst of all, I sent repeated requests to people like orbs.org asking to be excluded and they replied with very rude e-mails which contained vulgarities, etc. Real professional guys - glad to see another one bite the dust...
Eph. 1:2
Seems to me that the majority of the DoS attacks came from 127.0.0.1.
I suggest the prosecution track down the owner of that IP, and haul him into court instead of orbz.
Why don't "they" just sue the spammers out of existance? "They" would make all of our lives that much easier.
If ORBZ is testing for obsure bugs/holes, you can bet that the spammers are doing it too.
~Sean
I have started using a-s-k to block spam, and have been pretty happy with it.
http://sourceforge.net/projects/a-s-k/
http://www.paganini.net/ask
I certainly don't wish Ian any ill will, but if he had received or does receive criminal penalties for having caused a DoS by sending oddly formed email envelopes then it would have set a precedent for jailing spammers abusing open relays rather than just fining them.
spam busting databases can go to hell. they are a thorn in the side of NORMAL business, not just spam. I almost got a geeky linux dork fired for using one of their services to "protect" his servers. Seems we were on a black list due to a relay getting opened by an inept tech for a couple of days. Linux geek's server blocked us due to list. Linux geeks boss none too happy since he's buddy buddy with out CEO. Dont risk yer job for these wannabe cyber cowboys.
Spamassassin is nice in this regard, because you shouldn't need to change any configuration rules. The rule that ORBZ deals with, (RCVD_IN_ORBZ) shouldn't need to be changed, however, I'm going to weight the other rules that check for that kind of information (RCVD_IN_RELAYS_ORDB_ORG, RCVD_IN_OSIRUSOFT_COM, RCVD_IN_VISI, RCVD_IN_RFCI, and RCVD_IN_ORBS) up a few points to make up for the lost service.
I disable sigs...do you?
2002-03-20 08:58:41 ORBZ shut down in response to legal threats (articles,spam) (rejected)
"Be vewy vewy quiet, I'm hunting wuntime ewwors!" - Elmer Fudd
About time, orbs had us on its list forever, all because one of our clients sent a FFA links spam around. We deleted the account and changed our TOS a bit.. but some of these anti spam people don't care if you fixed everything up, they just want you to pay for someone elses stupidity.. So, lets hope orbs doesnt come back up :p now we can finally get mail through!
I mean, why the hell doesn't it just send a header like: MAIL FROM: <orbz-admin@orbz-domain.com> anyway?
This seems like it would have been such a simple technical issue to fix on ORBZ side without putting the burden of fixing the problem on Lotus or people running Domino.
<irony>I'm against theft of resources in the form of spam, but I'm all for theft of resources in the form of forced distributed software debugging</irony>
You can usually figure it out with the 220 greeting message. Most people don't change the message strings, and I pretty sure Domino says Lotus Domino in the 220 message, by default. It's been a long time since I talked to a server running it.
One could also try sending "HELP" which, with sendmail anyway, will give the version in the first response string.
I think that in any case, impact could have been minimized for affected Lotus Domino servers where ID could be determined.
"Alcohol, Tobacco, Firearms, and Explosives" should be a convenience store, not a government agency.
So fix your broken (almost certainly qmail) server.
And FWIW, one of the best things about ORBZ was how professionally it was run. They generally tried to error on the side of caution. For instance, addressing your strawman argument, the ORBZ test messages described exactly what they were, and provided links for more info.
Now I won't have to put up with anymore double-bounces from ORBZ's continual probing of my closed relays. These don't even send our OUR mail. You can't test our outgoing relays, the conversation is in the wrong direction and won't pass our firewall.
Ian, YOU DUMBASS!! I hope you beat the criminal rap, but you got what was coming, what you were asking for. ORBZ's probes were every much a trespass as the spam itself. Why they never understood this is beyond me. Plenty of other DNSBL run a good list without intrusive probing, and are not getting put up on charges either.
Edith Keeler Must Die
I'm pretty sure that even in the US you couldn't sue Ford because your self modified engine block exploded, or because your car skidded off the road when you'd been using the same tyres for 10 years. You sure could sue them if one model consistently toppled over going round corners and Ford did nothing about it.
Negligence - look it up in the dictionary and then tell me why it should apply to every product and service in the western world _except_ software?
Self regulation, like communism, is a utopian dream that can never exist in the real world where too many people are greedy, self serving, amoral, liars, etc.
Which office were you in? (Only 2 really).
I worked in Lotus Tech Support for a few years, and can honestly say [crap, hit button] that I don't remember a single contractor being present. Period.
As well, our mail was up 100% of the time, and extremely reliable. The only issues seemed to crop when IBM's servers crapped out, hardware issue, not a software issue.
Not to call BS on you, but perhaps you were in some strange corner of Big Blue with some true incompetents. However, that certainly isn't the case. Notes is much more reliable than exchange, even if the friendly beep you so want isn't present.
I too was completely surpised when ORBZ started tested our servers. 60+ bounced emails were waiting for me the first time and subsequent checks 30 or so. No warning what so ever.
Was listed as a closed relay in their database.
I wonder if Spammers checked the ORBZ database from time to time. It seems to me that 550 relay errors always increased after ORBZ doing a check.
For this treat, we'll gladly take some potted meat as a side dish.
Insecure Linux server. Hah!
I just think that he's been shown a carrot as well as a stick so that this never has to reach a court.
Carrot. Stick. They are not opposite things, they go together.
When sitting on an obstinate mule, you take the stick and attach the carrot to the end of it to dangle in front of said mule. The mule walks forward to get the carrot, which remains permanently (a la Tantalus) out of reach, and so it eventually hauls you and your load to your destination, at which time you may or may not give it the carrot. Whether or not this actually works, I'll leave to the farmers. But that's the origin -- surely you're familiar with the concept.
"Carrot and stick" refers to the provision of an incentive, real or decoy. It does not refer to beating the hell out of some poor jackass.
-Waldo Jaquith
(Originally appeared here.)
Don't use Lotus Domino!!! Especially if it falls over when trying to process a simple email. I'm surprised spammers haven't crashed Domino servers all over the place. You don't see them going to court very often.
I agree with you wholeheartedly.
;-)
:-)
A company I know was using notes for all their mail. A blackhohle database notified them that they were acting as an open relay (that was the default install of that notes version) and asked them to remedy the situation.
To check things out I telnetted to port 25 and tried to relay some mail manually and just by accidentally entering some malformed input (I think I was trying to use backspace) I crashed the whole notes server!
Frowns all around
Now a smtp gateway protects that notes server from the internet.
And as an internal solution with all its other features it is really great, but to crash due to malformed input? That's worse than bad that's eh,mhh,yeah worse.
I hope newer notes versions do not show that behaviour.
Use notes, but never without protection
Marcus
I've been using ORDB for a few months and it works quite well. Only drawback is they don't re-scan regularly to see if relays are closed. www.ordb.org
Do you have any idea how it would cripple the software industry if they operated under the constant threat of product liability suits?
Oh no! Then we would be under the same, crippling rules as just about every other industry on the planet. Microsoft, IBM, Symantec, et al, would actually need to make a due-diligence effort to fix bugs rather than add new, unnecessary features and eye candy.
Software engineering is not some kind of black magic. It's no different than any other form of complex engineering, be it passenger jets to modern automobiles. To do it right requires care, time, diligence, and testing. If software companies dedicated 1/10 the effort to testing their products that they do to marketing them, 99.99% of problems would be caught before the products ever shipped.
I guess what it comes down to is this: If you are truly a software engineer, then you should embrace time-proven engineering principles and stop hiding behind the "we're just selling a license" cop-out.
Sending double-bounce messages is a feature, not a bug. I would be happy to hear an explanation of what I should do to ``fix'' this with respect to ORB* messages.
And in what way was my argument a strawman? Read it again. I didn't say that the ORBZ messages didn't say what they were. I said they didn't tell me specifically why they were testing my server, and I said that they didn't tell me how to prevent receiving those messages in the future.
I've found that most hypocrits are on a moral crusade of one sort or another. But there are far more people on moral crusades who are not hypocrits. Being on a moral crusade <> hypocrit, but hypocrit == being on a moral crusade.
If all this should have a reason, we would be the last to know.
My company is wrongfully on several Open-Relay/Spam lists from testing we were doing to a hotmail account (that we registered) to test an error reporting function in one of our programs (the spam part), and an open relay specifically for me (that was being exploited by others).
If anyone is using ORBZ's lists, we will never get off of them. You know that ISP's that "subscribed to a list" will not really work on updating their filter lists. They didn't do it when ORBZ existed.
So who is to save all these domains that were already blackholed and currently fixed.
I mean, it isn't the ORBZ owners responsibility, he merely compiled a list, he has no responsibility. He never instructed anyone to block anyones mail, it isn't his fault that anyone implemented any filters based on his list, and he can't be responsible if they never updated their filters, so how do these domains get "Un"-blackholed?
You mean like most other industries?
Out of curiousity, why do you think the software industry should get a free ride?
I understand the problems caused by spam. I understand how to configure a mail server. I don't understand why so many people line up behind this type of solution - it seems to me to be a case of the cure being worse than the disease.
What gives anyone the right to send any mail to my domain for any reason? Regardless of how poor my software may be, and how poorly configured, why should an outfit like ORBZ not be held responsible for what happens when they probe my system without my knowledge or consent?
My mail system is not an open relay. I'm frequently targeted as being an open relay because many of these vigilantes don't use competent and effective testing procedures. As soon as I end up on the list, I have to explain things that shouldn't need explaining, and we suffer an avalanche as the spammers pick up on the "open relay" list and attempt to route their traffic through our server. I eventually get the blacklisters straightened out, but it usually takes at least 7-10 days per occurrence. In the meantime, I'm getting as many as 2000-3000 pieces of spam per hour.
I'm leaving out technical details here. If anyone cares, I'll be glad to provide them. There are some of these groups that we've never had problems with because their testing methods are better. But the incompetents seem to outnumber them.
http://drteknikal.blogspot.com/
No one is suing him, these are criminal charges. Criminal charges are brought by the state.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
So rather than trying to resolve this situation by getting his busted Domino server fixed, the admin called in the cops. How f**ked up is that?
Anyone local to this Domino admin, please give them a hard time about it.
Ya, I've got a problem with spam. I had subscribed to the PHP mailing lists about 6 months ago, no big deal. Here about 2 weeks ago I no longer had a reason to need them and went to unsubscribe from them. I was told that the server would not take my email because my IP provider was in spews now.
Now mind you, my server (on its own IP address) has NEVER sent out spam (I'm the only one who can send email from it and I've no reason to spam). It seems that some fscking idiot on one of the IPs in CA (my server is in MN) spammed and spews will BH all class C's of the owner no matter where.
So now I get email I don't want and can't get rid of... Should I report the PHP mailing lists to spews as spammers? I'm on a list and I can't contact them to remove me, how is this different from the spammers? Easy to get on, impossiable to get off of...:)
BWP
Well, I guess that came off jerky, and since there's no more ORBZ mailing list archive, I can't point out the extended discussion on the subject, so...I'll let it go and hope you enjoy your double-bounces I guess. :)
solution simple, outlaw lawyers
You mean
/var/qmail/control/badmailfrom
#echo "@orbz.org" >>
As for the second, what about the case where there were actual damages other than the loss of life or personal injury? For instance, a vulnerability or deficiency in your software leaks sensitive user data worth millions to an attacker or the public, resulting in your user going out of business, or losing substantial sums of money?
In that case, I don't see why software developers should be exempt from the same "due care" measure of negligence that *every other person* in *every other situation* in our society is. Does that mean I think that you should be able to sue for negligence if the spell checker in your email program doesn't fix your mistakes and makes you look stupid in your email correspondance? Maybe. But hopefully a judge or jury would realize that in that case no standard of "due" care was violated, and if you're lucky, penalize the plaintiff for filing a nuisance suit.
I think our existing laws about negligence have the right idea, and software developers shouldn't get some "magic" exemption.
Note, in some states and in front of some judges, your EULA might be ruled unenforceable anyway, and existing law will be brought to bear and you'd be out $$$ anyway, sucka.
There is a note to that effect on www.security.nnov.ru.
It's two years since the report, so one might expect a fix in Lotus any time now.
This was a totally cool project. I depended on it. It stopped lots of spam. I will never use another Lotus product. Not that I ever did.
You would think that Ian would have gotten a clue from all the people whom his probes angered. If he only restricted himself to testing systems for which he had spam on record, then he would have a defense. "Yes, your honor, I crashed the system, but I was only defending myself against more relayed spam." As it is, he had to fold because he has no justification for probing those systems.
-russ
Don't piss off The Angry Economist
That doesn't work, just as it doesn't work for most spammers. Your see, like most other spammers, ORBZ lies about its hostname.
-russ
Don't piss off The Angry Economist
Thanks for the .mc snippet,
but can you please explain why do you have
the open relay blockage listed twice?
Won't this result in extra query per each
incoming email?!
FEATURE(dnsbl,`or.orbl.org', `Mail from $&{client_addr} refused: See http://or.orbl.org/ (ORBL)')
FEATURE(dnsbl,`or.orbl.org', `Mail from $&{client_addr} refused: or.orbl.org. See http://www.orbl.org/')
VKh
"Professionally" my ass. Ian lied about the source of the email. He used envelope sender addresses which would not return a bounce message back to him. He used envelope recipient addresses which were not only invalid, but which were specially crafted to break through a server's anti-relay defenses. These are the actions of a professional, yes -- a professional spammer.
-russ
Don't piss off The Angry Economist
jeez, I don't even USE anything but sendmail. If I start a job or do a consulting gig, and let's say the company is using exchange, domino, whatever. EVEN IF THEY USE SENDMAIL.
Whatever the box is, I ALWAYS create a very secure linux box, install sendmail, set up forwards and put the rules together (milter) to block spam and block certain extensions to give whatever downstream mail server some extra breathing room so it doesn't have to use it's own anti-virus software to try to clean every piece of email out there. Usually people complain, but once you remove it, they see the light when the proverbial dog waste hits the fans. If that has happened already, even the suits can tell what a good difference this makes.
I don't trust ANY mail server cept sendmail. ALL others are cheap imitations and limited in value to what I think is required (i.e. good spam filtering capabilities, good plugins, write your own scripts/proggys to go in there, world wide support, etc...)
Nothing ever has been able to come close (other than the clones, etc...)
At the very LEAST, if some admin doesn't want to deal with hard issues like actually learning how to use the pre-processor (HA) or using a simple 3 line pre-processor config file that essentially makes the server secure as could be expected and is HIGHLY visible in their documentation, etc... That person shouldn't BE an admin. I taught some of my junior guys how to set this up. Most of them are microsoft weenies. They took to this like flies on sugar. They ate it up and loved every minute of it. Even they saw the fruitless hope that exchange should ever EVER be externalized as a company mail server.
I think this "middleware" solution that lets a known security-averse enterprise mail software stay within the confines of the firewalls, and lets a real mail software act as it's proxy. I don't see doing it any other way.
Centrinity creates an commercial alternative for mail/web/ftp/Unified Messaging. It runs on Windows as well as Mac servers with Linux server/client coming soon. So there are always other options.
I'd guess that a majority of those bounced messages are probably people wantingto make a list of open relays. Probably most of them are not on a crusade except a crusade to exploit your mail server. Why would someone who wants to illegally use your system resources come up and tell you how to prevent it from happening? Oh thats right they wouldn't.
If the whiney Domino server admin types thought that was bad with ORBZ, now it's more than a little public what the bug is. I expect most Domino mail servers will be DOS'd to death from this in under a week. Stupid script kiddies.
I'm not sure how many of the slashdot crowd know this, but it was orbz policy not to stop testing a server when requested, unless requested in writing. If it was requested in writing, then they would stop testing the server and list them in orbz as an open relay.
So, as an administrator you had the choice between being tested and being blacklisted even if your server had never relayed a single piece of mail. It was also typical of users of orbz to submit every ip address of every mail server they received mail from regardless of it being spam or not. This was encouraged by the orbz administrator. I'm assuming that this policy, in combination with the fact that the testing caused Denial of Service for certain users might be what caused this suit. If you know you are causing a Denial of Service problem and you don't stop especially if you are requested to do so, I'd suspect that is actionable. Ian's inflexibility as to the policy of either testing (and putting up with the DoS if you were a Notes user) or being blacklisted seems like a bad idea if you rephrase it like "Either you let me crash your server or I'll blacklist you", which might be what the people on the other side are thinking.
Again. This is just my guess. I'm really interested in seeing the facts come to light in relation to this. I suspect that the fact that there was a fix available might be a way out for Ian, but I'll be watching with interest.
If common sense prevailed, this man would've been wiped from the face of the net a long time ago.
Sure, I remember back in the day, when the net was akin to a good old Western - the fastest nuke, the fastest flood.. Someone pisses you off, you take them out.
Guess what? That net's been gone for years. Get with the program - messing with someone's box is not acceptable, under any circumstances.
We run Notes here at work but no SMTP stuff. I've not gotten a delivery failure in about 11months. Mail runs smooth and servers almost never go down. We have network outages moreso than we do mail server downtime. I run R6\RNext at home and so far in the months since it came out it's been rock solid. Not exactly handling a ton of mail or WEB access but for beta it seems pretty good.
;-) Here in the office weve got quite a few people so mail gets delivered every few minutes on a busy day - the servers certainly do work hard. Oh, and none of that single object store crap going on either!
I dunno' - not disputing what you've seen but administered properly Notes is a pretty good product IMO. I'll grant that mail chimes aren't "instant" but that's a client issue not a server delivery problem. Hell, if my mail chimed as soon as something dropped in the box I'd have to turn it off or go deaf!
More on topic.. the latest RNext code supports an RBL! Unfortunatly it looks like you've got to actually subscribe to it in order to use it - no thanks. I'm not sure how easy it would be to use another RBL but I'm hoping Lotus makes it an option. Locking down relaying also looks to be a little easier in this incarnation with things spelled out more clearly in the setup etc.
Whoever it is that's suing shouldn't have a leg to stand on since this is a bug in the server code - fixed by Lotus in later revisions. You would think that these folks would want to have a secure server, perhaps if their identity could be found out some SPAMMING SCUM could utlize their services? Might that teach them a lesson? (sigh) A shame one of the good guys is being forced out over this, I think identifying them for all to see and SHUN would be a very good idea...
P.S. Agree on what IBM has done to Lotus. Lots of firings and general disruption. Glad I never went to work for them! Friends did though and are now much poorer for it...
Build it, Drive it, Improve it! Hybridz.org
Umm, of course Ian would use spammer tactics to try and get around a server's anti-relay defenses because, wait for it...wait for it...THE SPAMMERS ARE ALREADY USING THOSE TRICKS!
You'd have a larger dose of credibility with your objections if you didn't publicize the fact on your site that you are active in other anti-spam projects. It leads one (me, anyway) to think that you have some ulterior motive for attacking like you are.
[I'm AC because I don't care and you should'nt either!]
As a tech support rep for a not-so-small ISP, I can't help but think that the shutdown of an anti-spam blacklisting service would be a good thing.
One reason is that it often feels like they're overbearing - all too eager to put an ISP on the list (regardless of the relative quantity of spam) but not so eager to take them off. I can't help but think of the blacklisting of Hollywood stars in the '50s for communist beliefs; real or just perceived, you became a scapegoat for the real source of the problem (in this case, the actual spammers).
The other and personally more important reason is that it creates unrealistic expectations of ISP response. I once had a customer who expected us (the ISP) to change the mail server over to closed-relay (I don't even know if it WAS open-relay then) simply because he - one person - could not get Bigfoot's mail forwarding to work, as they used a blacklist site that happened to include our mail servers. To someone in tech support, that's about the same as asking "can you give my modem more bandwidth?" It sounds selfish and shows the relative ignorance of the customer.
Basically, these blacklists convince people that their ISP is some sort of monster (I don't think most ISPs say "let's go open-relay so companies we don't profit from can spam people!"), and worse in that they convince users that they can get support for things the ISP doesn't operate, just because they asked about it. How many of these blacklist sites warn you that most ISPs can't support the services of other companies? Almost none (if any). How many ask you to contact your ISP if their servers are on the blacklist, regardless of where the conflict is? Probably most (if not all) of them. As a result we get customers like the one I had, who are told by the site to contact us and expect us to change a major aspect of the service just because a single person (and we've had very few people in total) said so.
Besides, how much of this actually works? I believe most of our servers are now closed-relay (that customer wasn't the impetus, of course) but customers still get all kinds of spam, and they still think it's their ISP's fault (I've had customers tell me that WE were the spammers, that we sold their e-mail addresses, and so on). On top of this we get customers who actively complain that they can't send mail from accounts with us when they're away, when they could before.
It's not absolutely dire, but really... just like McCarthy, spam blacklists can frequently pass beyond genuine concern into unhealthy paranoia.
Will be testing my Notes server ASAP! Appreciate the info and the link. I've been wondering how best to test it for relaying... ;-)
Build it, Drive it, Improve it! Hybridz.org
configure their server software to respond like a Domino server in that case? It cuts both ways - the server has to be tested regardless of what it claims to be...
Build it, Drive it, Improve it! Hybridz.org
Dear Spammer,
Your recent letter "Make Money Fast!!!!!" crashed my mail server, which is allergic to sequences containing a prime number of exclamation points.
This constitutes a denial of service attack on my mail server. We can settle for $10,000, or I can sue you for damaging my mail server. Your choice.
P.S. Does anyone know where I can get a mail server that crashes on the phrase "This is a one-time mailing" ?
Geez, I can't believe this. This "DoS" is just a stupid programming bug. Let Lotus be ashamed of themselves, and NOT let perfectly good anti-spam sites pay for their own stupidity...
If this continues, I fear we'd really have a problem. Suppose Microsoft DoS #1749 pops up, which happends to be triggered when someone appends a / to a file request... would then all search engines be sued because their spiders come up with faulty links in pages?
C'mon Lotus, you should kick your programmers and *NOT* ORBZ!
As a Notes developer/admin with 7+ years exp., let me inform anyone here who doesn't know, that the Timothy's (both the poster and apparently the editor?) have written a gross exageration and obviously biased opinion.
Check theReg for a more balanced and truthful approach, and be sure to note the update at the bottom of the story.
Lotus has always been highly responsive to the very, very few issues that they have had to issue updates for. Suggesting they should be "in court" is only demonstrates the bias and a lack of simple fact checking.
From theReg:
p.s. For you slashdot posters who apparently didn't RTFA, Lotus and IBM aren't suing anyone, some idiot admin is going after ORBZ and ORBZ is using this as an excuse to close up shop... seen that one before !!!
Thanks - Domino Dave
"Whoever would overthrow the liberty of a nation must begin by subduing the freeness of speech."--Benjamin Franklin
SMTP servers usually announce their name and version, right? These probes are relay probes checking for all of the various ways spammers can relay spam through a mail server, right? Why can't the probes simply skip this particular test, or use a slightly different relay test when it comes across an SMTP server carrying the Lotus signature? Sure, it means ORBZ is slightly less effective at identifying a potential SMTP relay, but it also doesn't DoS a buggy/misconfigured mail server and risk legal action.
It seems like this would be a better solution to the problem than simply throwing in the towel.
There is NO VALID CONFIGURATION which should result in an infinite loop on the bounceback. If there are ways to configure to avoid it, great. But there shouldn't be a way to actually configure it to do this, and it most certainly should NEVER be the default setup.
When mail is sent to a bad name, and it attempts to bounce back to the apparent sender, it should first recognize that it is connecting to itself. Failing that, the sender of the bounce message should either be a valid box to collect failed bounces for the postmaster to clean out, or it should be a null address which gets discarded. A bounce should never trigger another bounce, either on its delivery, its failure to deliver, or its return. In this, Lotus Notes/Domino is a defective software product and needs to be fixed. I recommend that Ian Gulliver ask his attorney about filing a motion of interpleader to bring IBM into the case as a defendant, if the plaintiff continues to pursue it. If IBM (which just stuck a big ad in my face here on /. spouting off about their security) can't fix this, then they are the ones who should be paying up.
now we need to go OSS in diesel cars
That return address is a perfectly valid one for which bounceback loops make no sense in compliance with email standards. Some defective mail servers check the sender address to determine if the mail should be sent to the recipient address, and if that sender address is "local" it allows it to go on. The test ORBZ was doing was a perfectly valid test that should never be forwarded on (but some mail servers see it as a local sender), and wouldn't bounce infinitely in a properly designed mail server.
now we need to go OSS in diesel cars
Perhaps he thinks Ian is a creep, and that Ian makes it harder for people who aren't as weasely as he is to fight spam.
That's incorrect.
ORBZ is(was) a DNS-based system, which is about as close to real time as you can get. No DNS server, no lookup, no blacklisting.
ORBZ and ORDB are examples of how open relay lists SHOULD be run; fully automated, with no human 'opinions' causing the sort of grief that MAPS and ORBS generated.
Ian, your service will be greatly missed.
Step on too many people's toes, and someone will kill/hurt you whenever they can, for whatever they can.
Perhaps there is something to be learnt from this.
However, I DO think that good, semi-automated, responsible services like Spamcop will prevail. The owner has no bad attitude and is friendly, the system works very well, and the RBL rarely rarely blocks legitimate email, unlike other lists that block most/all of Asia and Europe.
if an IP was verified clean then it could not be resubmitted within 30 days
Not only that, but if an IP address couldn't be tested (because it was down, or there were network problems, for example) then it was marked "clean" - and wouldn't be retested within 30 days.
If you want double bounce messages, that's your business. If you don't want them, you do know how to turn that off. Using local sender address is a way to fool many mail servers into relaying spam, so it is a valid test. If your mail server deals with this poorly, that's your problem. You can also filter your double bounces from your mailbox based on the headers. Do what you need to do.
now we need to go OSS in diesel cars
Ian was mimicking a spammer to carry out the test. So of course it can look like a spammer to those who fail to check the original of the connection. Most of my servers have been tested, and I've never had a problem with it. If course the tests must be specially crafted to break through the anti-relay defenses when the server is programmed or configured in a way that allows anyone to break through, as spammers can, and probably do. Calling Ian a spammer is absurd. He has not sent bulk mail.
now we need to go OSS in diesel cars
It seems to me that a spam e-mailer would make similar arguments. ``You get e-mail you don't want? That's your problem.''
What's the difference?
Is the difference just that ORBZ e-mail testing is good? What if I disagree? I'm sure some spammers think that their e-mail is good. Is their spam OK? Why is ORBZ right and the spammers wrong? Either way I get unsolicited e-mail in my mailbox.
This has been tried before. I was the original creator of ORBS, and operated it for less than a year. In that time I had the RCMP contact me once because some idiot accused me of criminal acts in association with testing open relays.
I don't recall exactly, but I believe it was due to something very similar on some pos Mac mail server. Although I think it was the notices I was sending them (to postmaster@[ipaddress]) that caused the problem.
Fortunately, after I explained exactly what I was doing and why, the officer was nice enough to blow off the investigation. I guess the cops down south aren't as smart.
Having said that, in this case, given that the test in question is fairly useless in most cases (of all open relays, I'd guess 99.9% can be identified with a single simple test), I personally would have just stopped sending that particular test to Domino servers.
It's too bad. ORBZ was by far the most effective open relay list out there. I hope ORDB and Osirusoft can make up for the loss.
My biggest question on this matter is this - what does Ian hope to accomplish by closing? If he's already been accused of committing a criminal act, does he think it will go away if he just stops doing it? I really don't think that's how these things work. I certainly do hope things work out well for him, though.
The mechanism Ian was using was OPEN RELAYING. Open relaying was quite common before commercialization came to the internet, and it wasn't considered to be spam, then. Why should it be considered to be spam now? The definition of SPAM involves the bulk transmission of email. This bulk aspect is what causes the problem we fight against. Open relays are one of the mechanisms spammers have abused (remember, at one time, open relaying was a good thing when the internet was benevolent). When Ian sent a probe, as long as he didn't send bulk mail to many different addresses, it was NOT SPAM!
That said, he DID make a mistake in failing to stop sending to that server when the administrator complained. What he should have done was list the server as "will not test" and let us block mail coming from there under the principle that I cannot trust whether it is, or is not an open relay (I prefer not to accept mail delivery at the SMTP protocol layer from an server believed or suspected to be an open relay because it defeats my efforts to block sources of spam). This presumes that the administrator of that broken Notes server (double bounces as in qmail might be an annoying feature, but infinite bounces as in Notes is a blatant defect) did notify him. If not, then I place no blame on Ian whatsoever.
now we need to go OSS in diesel cars
Of course it's my problem. I take care of my problem by not accepting mail from places I believe may send spam. Then it's up to them to decide whether they want to continue their ways, or change their ways. ORBZ email testing did not disrupt my servers. I see no basis to believe those probes would disrupt any properly designed and properly configured servers. ORBZ provided useful information for me to further my aims to prevent incoming mail from misconfigured and broken mail servers. As long as ORBZ was not sending their probes in bulk, I don't see it as spam.
now we need to go OSS in diesel cars
To me, spam is unsolicited e-mail. I don't know what sending in bulk has to do with anything. I just care about what winds up in my mailbox.
You're right in that I should have just refused to accept mail from ORBZ. Unfortunately, doing so would have caused me to be listed in ORBZ, and thus caused others to not receive my e-mail. Catch-22: refusing to accept spam would have caused me to be labelled as a spam generator.
My main point, from the post which started this thread, is simply that I believe that ORBZ was acting in a hypocritical fashion, which is a risky position from which to take a moral stand.
So contact the damned morons in the Michigan justice department, contact the govenor, contact the local media there. What a shower of incompetent asinine fools. They're supposed to be defending the public interest not assaulting it. They have removed a valuable public service to the world under the guise of doing the opposite. This kind of inexcusable stupidity by Michigan authorities makes me furious. Why don't those incompetent morons go catch some real DoS criminals. Oh wait, that would require some real investigative work on the part of some some damndably stupid people there. It's too much to hope that these idiots will be held accountable for their wanton vandalism here.
So if you post online, and your email address is available, and someone replies by email directly, instead of doing an online followup, you consider that spam? I don't.
Take a look at the history of the term "spam". It came from a skit on Monty Python's Flying Circus where the term "Spam", in reference to a processed pork meat product, was repeated extensively in the skit. Later, this skit was repeated in online MUD games, and morphed into repeats of many other words. But the term "spamming" developed there as a result of the pointless repeating. It then was used in reference to repeated online postings to multiple newsgroups in Usenet, and from there to email.
The bulk postings on Usenet don't have any particular "solicited" attribute. Spam is unacceptable because it cannot scale. It's not something that is practical for "everyone to do it" due to the lower sender cost and high receiver cost.
The term "unsolicited" was added later to distinguish the most hated forms of spam which are sent to harvested email lists gathered from various sources unrelated to preferences in receiving commercial announcements. The terms "spam" and "unsolicitted" do intersect, but are not the same set.
If you don't want to make it possible for specific parties to determine whether your mail server can or cannot be exploited by others who have bad intents, then I don't blame them for then listing your mail server as one that the safety of which cannot be determined. I would then not want to allow my mail server to accept any mail from your mail server due to the risk that such mail may in fact be the spam that has exploited your server.
All you need to do is to refuse to RELAY the mail in the probe. Then discard the bounce-back when it has the string "sender.orbz.org" in the headers. They are NOT depending on the bounceback coming back; just depending on the delivery not being completed in the orignal probe. Don't reject the probe ... just reject the forwarding/relaying of the probe.
IMHO, ORBZ was doing a fine job, and doing it reasonably well. I don't see their probe as being "spam" (yes, it is technically "unsolicited", but that's not the issue I concern myself with), and I see their database as useful in rejecting delivery attempts from risky servers. I will miss them. I've already gotten 5 spams today, well exceeding my recent average of about 1 per day (with about 50 rejected per day to just my own email addresses). I hope they find a way to get back online, and I hope you find a way to make your mail server operate smoothly even with these probes. The only problem I'd see is if hundreds of people started up their own system of probes.
now we need to go OSS in diesel cars
One of the big automakers has 130,000 Notes seats, and this was filed in michigan. Also, EDS is a major contractor for same.
And where did he lie about the source? Below is an example orbz email. I see orbz.org all over it. (I've removed everything that could identify me or my mail servers and replaced that with x's. I've also removed the greater-than and less-than symbols around the email addresses so /. would display them)
d unique identifier)
Return-Path: bounce-xxxxxxx@localhost
Delivered-To: xxxxx-xxx@xxxx.com
Received: (qmail xxxx invoked by uid xxx); xx xxx xxxx xx:xx:xx -0000
Delivered-To: xxxx-xxxx@xxxx.com
Received: (qmail xxxx invoked by xxx); xx xxx xxxx xx:xx:xx -0000
Delivered-To: relay%orbz.org@localhost
Received: (qmail xxxx invoked by uid xxx); xx xxx xxxx xx:xx:xx -0000
Received: from bounce-xxxxxxx@localhost by xxxx.com
by uid 527 with qmail-scanner-1.10 (avp. Clear:0. Processed in x.xxxxx secs); xx xxx xxxx xx:xx:xx -0000
Received: from sender.orbz.org (HELO orbz.org) (sender@205.231.149.53)
by xx.xx.xx.xx with SMTP; xx xxx xxxx xx:xx:xx -0000
Message-ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.1.4@orbz.org
Date: xxx, xx xxx xxxx xx:xx:xx +0000
From: bounce@orbz.org
Errors-To: bounce@orbz.org
To: relay@orbz.org
Subject: ORBZ TestThis is a test message from the ORBZ service. We are checking your
mail server for open relay capabilities. The receipt of this email in
no way indicates that you are running an open relay.
If you are interested in the results of this test, see:
http://orbz.org/?xx.xx.xx.xx
If it turns out your server fails the test and is an open relay,
spammers might be stealing your bandwidth. In fact, ORBZ tests are
often triggered by forwarded spam. In this case, you can find
information on how to secure your mail server at:
http://mail-abuse.org/tsi/
MAIL FROM:bounce-xxxxxxx@localhost
RCPT TO:relay%orbz.org@localhost
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx(remove
What is pirate software? Software for inventory of stolen treasure?
Most open source software is written by students, hobbists, and professionals in their spare time. They don't have the resources to extensively test their product. Nor is most of this software intended for companies to be dependant on its reliability, and if that company is dependant on the reliability of that software, it is implied that the company is responsible for verifying integrity for use in the company's systems.
However, for a commercial product that was written, tested and sold for the specific purpose of a company operating their business with that software, then the vendor saying 'NO WARRANTIES', too bad if our massive amount of bugs ruin your operations, well IANAL, but it seems to me that this is a contradiction. In fact, I thought that people selling products could not legally warranty away certain types of liability.
It would be absurd to sue a video game manufacturer for millions just because the game crashes every once in a while. Just like it would be absurd to sue someone who gave you a piece of software for free and it had some bug--any bug. Warranties were created so that buyers could have reasonable expectations of a product that is sold on the market. In free software there is no buyer, seller, or market--the product is given away.
However if that same video game is so buggy it's unusable, then you should be able to take it back and be refunded the price you paid for it. Just like you can return free software and get nothing back--as the the developers did when they gave it to you.
Oh, and I don't think all "Open Sourcers" want everyone to only use free/open source software--I think that's mostly just the GNU mongers....
See the part where it says Return-Path: bounce-xxxxxxx@localhost? That's the part where Ian is lying about his email address. His email address is not and has never been anything @localhost.
-russ
Don't piss off The Angry Economist
I had no opinion about Ian before he spammed me. Clearly that was not a good first impression for him to make on me! My opinion is that Ian is a teenager who has a sense of idealism -- that he should be able to create something wonderful, something perfect. His creation is a list of each and every open relay on the Internet. I have no problem with that. It is a worthy goal. Unfortunately, his methods involve sending fraudulently-addressed email to innocent SMTP servers. He and I disagree on whether he should use this method to discover open relays. He doesn't see anything wrong with this. I agree with him that testing for an open relay requires that he send such email. That would be perfectly fine if he was defending *his* SMTP server against attacks by someone running an SMTP client. It's perfectly reasonable to see if that host is also running an SMTP server which is an open relay. Self-defense is a perfectly fine reason for doing this. Ian went far, far beyond this, and tested (dare I say "abused"?) servers with no history of abuse. This is why he is now in the position of having to defend himself against charges of abuse.
-russ
Don't piss off The Angry Economist
By all means, explain what those ulterior motives might be. I am paid by nobody for my anti-spam efforts, so I have no pecuniary interest.
My motives are exactly as I laid out on the orbz mailing list: I don't want to be attacked by open relay probes, and I don't want other innocent hosts to be similarly attacked. I have no problem with testing a host which has sent you spam. I have no problem with testing a host on behalf of someone who was sent spam. But unless you have a copy of the spam in hand, testing the host is completely irresponsible.
-russ
Don't piss off The Angry Economist
We contacted them and tried to clear it up, but it was like trying to get a pitbull to let go of another dog's throat. Once they thought they had a spammer they would never let go. It took months to get through to ORBZ that we had nothing to do with the spam. Even though the very samples of the spam ORBZ sent us with headers intact clearly showed it did not come from us. And the content of the spam clearly had nothing to do with us. Months! that's not reasonable. Within two days of getting on the list we had given them solid proof that we were not the spammers nor were we profitting in any way from it. But it took months to get them to just stop and listen.
I know that Ian and his cohorts meant well. It was a great idea, and I really think it could work. But it's clear to me it went straight to their heads. From the way they dealt with us I got the clear image of a megalomaniac who stands in front of the mirror at night practicing his Lawn Mower Man speech, 'I am a God in here!'
Yeah, I know, 'If you don't like the list, don't subscribe'. I don't. Reguardless, if they are going to tell the world 'here's a list of spammers' then they bloody well have an obligation to make sure they're right. It seems to me they failed to do so. And a lot of people subscribed and for the most part blocked spammers (congratulations), but they also blocked legitimate domains with legitimate emails because ORBZ's policy was shoot first, ask questions later - much, much later.
l8r
Me again. Elsewhere it has been noted that IBM has in fact fixed this a while back. In this case, (someone at) IBM should be called as an expert witness to testify that the bug is fixed and that the administrator of the defective system is negligent in having failed to apply the fix. Failure to apply fixes is a major cause of security and spam problems on the net, certainly costing at least hundreds of millions of dollars a year to clean up, and lost time and bandwidth dealing with the effects. Someone who fails to apply fixes in a timely manner (30 days tops) should be slapped very very hard.
And we want to know who the hell it is that brought this complaint.
now we need to go OSS in diesel cars
Quick, give us the bastards' domain name, so we can show them that they picked the wrong target. They will have to sue the entire Internet to thwart abuse of their server!
He was trying a known exploits to find out if a mail server sends spam and should be black listed. He never lied about the intentions of the email and so what if the Return-Path is forged, the point is if a mail is not returned to him it is not spam. My mail server can handle bounces no problem. If Lotus Domino can't then to bad for them and the idiots that use the swiss army knife type software.
What is pirate software? Software for inventory of stolen treasure?
Mail servers need to be configured to relay mail from the localhost (themselves). Otherwise, things just don't work. What using the 127.0.0.1 does is attempt to fool the mail server into thinking that the mail is coming from itself.
Actually it dosn't, Since most mail software uses some other form of IPC for local deliveries.
The rest of the message makes it more than a little plain that it was an ORBZ test doesn't it? Does context mean nothing to you? He did the same thing any bulk mailer would've done.
I had my server tested by a different service last night, a Domino server in fact. It was found to relay (doh!) but I was able to fix it with a little reading and reconfiguring. I believe that some of the test messages I received also had faked fields just like the one above. In fact looking at some of the bounces it looks like the test even tried to spoof my upstream provider! My server survived just fine, I didn't receive tons of crap in my mailboxes, and in the end I've got a better server for it. If they HADN'T used the same sorts of tricks that a SPAMMER would've done then what good would the test have been?
Build it, Drive it, Improve it! Hybridz.org
Any sysadmin who refuse to patch a program and instead goes for filing criminal charges deserves to have his system taken down hard...
Anyone know the IP of this server in question?
It would be really fun if millions all over the world sends these 'malformed' emails to that server, effectively taking it down for a long time with new mails coming in from all over the world, repeatedly causing crashes until the thing is fixed, teaching that moron what a real DoS attack feels like. All these mails should contain the repeated phrase "I will patch my server and not file charges against people doing good work for all of us." which when repeated a gazillion times should penetrate the thick sculls of that sysadmin and his superiors... Hopefully anyway.
I just thought I'd report how my mail server handled the shutdown.
When I heard ORBZ was shutting down, I stared to look for another service. After some research I decided to use relays.osirusoft.com and spew.relays.osirusoft.com. I've been running the server for over a day now with those filters, and I haven't recieved any spam (neither has any of the other users). Good mail has come through though =)
I recommend the two services I mentioned here, they seem to work really well!
for those who might want to add them to their local firewall (after all if they are blocking relay testers, they could be wide open to relay spam through their server)...
City of Battle Creek (NETBLK-TRLC-168-32-01)
190 East Michigan Avenue
Battle Creek, MI 49017
US
Netname: TRLC-168-32-01
Netblock: 216.120.168.32 - 216.120.168.63
Coordinator:
Netops, Netops (NN603-ARIN) netops@trivalent.net
(616) 222-9200 (FAX) (616) 222-9300
Record last updated on 24-May-2001.
Database last updated on 20-Mar-2002 19:58:52 EDT.
Open Relay Database
People are leaving messages on thier Guestbook explaining how upset they are! I urge you to do the same.
My servers were tested monthly by ORBS and then ORBZ, because I routinely submitted nominations to them. As such, I agreed to have MY servers tested just as often as spam relays are. Each and every test/probe generates a policy violation message to me on my servers, so I know within 5 minutes of such a test starting...
ORBS, ORBZ, ORDB, MAPS, etc., do not test unsolicited. They don't go sweeping through an IP block and test every SMTP server they find, like spammers do. They only test servers that have sent spam to SOMEONE, often a spam trap. I have over a dozen such traps, hit daily... and anyone that does gets black listed, at least on MY servers.
I'm not sure, but you might check into http://www.ordb.org and see what kinds of subscriptions they offer. Something tells me you might like the terms.
Yup. Patch has been available for some time now... I believe it was fixed in 5.0.9, which has been out for at least several months. Sean
That would be unimaginably silly. The suit was filed by the city of Battle Creek, MI, which was running an unpatched version of Domino, and now wants to blame its troubles on ORBZ. Sean
It does by default identify itself as a Domino server in the greeting. Of course, you can turn this off if you want, but an admin who knew enough to turn off that feature would probably a) be smart enough to turn off mail relaying and b) be smart enough to keep up to date with his Domino patches! Sean
Thanks for the clarification - you'd think I would research this myself, but I figured that getting the answer directly might get the most accurate response (honest!).
Personally I agree about being careful about the SMTP servers; I'm just not that enthused with customers who contact me and are convinced that an ISP with tens of thousands of users in their area alone can just flick a switch and change the mail servers because they said so. It's much like the customers we get who ask for "more bandwidth" not because it's slow, but because they think they can get special treatment (and of course, they don't even think that they might have to pay for it if it's available).
Now, if a group (unofficial or not) asks a concern of theirs to be looked into by the ISP, that's one thing... but I think far too many users basically think that they own the ISP because they pay X amount of dollars per month.