As the Spam Turns

Anonymous writes "The SBL has added Verio's corporate mail servers to its blocklist which protects nearly 100 million mailboxes, because of the number of spam gangs on the Verio network. Verio also provides connectivity to AS26212, a collection of 9 of the most notorious spammers netblocks. AS26212 - the new spambone? - is also connected to he.net and bbnplanet.net."

Comments

Good

[Anonymous Coward]

This will force Verio to take action. If Verio's customers get upset, Verio will listen.

Re:Good

[uncleFester]

This will force Verio to take action.

Yeah.. legal, probably. After all, it is a down economy. I would not be suprised to see Spamhaus served a cease-and-desist before Verio does the Right Thing and starts punting luser spammers.

The admins & abuse people are the ones at Verio really taking it on the chin. I can only imagine the vitriol pouring in their mailboxes and publicly on forums like nanae.

-fester

Re:Good

[Frater 219]

I would not be suprised to see Spamhaus served a cease-and-desist before Verio does the Right Thing and starts punting luser spammers.

Luckily, the spamfighting community has a great deal of experience with such misbehavior. The slang expression among spamfighters for a sender of baseless legal threats is "cartooney", as in cartoon + attorney. Spammers send these out by the boatloads when their delusions suggest it will get people to stop trying to block their thefts.

Steve Linford, the operator of the SBL and ROKSO (and known in China as Stiff Linefeed) is a long-time anti-spam veteran, and has a great deal of support from others such. If Verio tries to harangue, hassle, or hornswoggle him into falsely removing them from SBL, he will have dozens of clued and supportive people on his side. If Verio files suit, Mr. Linford will have a substantial legal defense fund faster than you can say "Canter & Siegel".

Re:Good

[cdrguru]

Spam blocking makes email unreliable. The way it is implemented is generally broad-brush and affects a lot more than just blocking some spam.

If you are blocked, you aren't getting off in a reasonable time, at least reasonable for the Internet. It might be reasonable for a 1850's pony express route.

The goal of most spam blockers is to eliminate commercial use of the Internet. This is the only way they can succeed. Any commercial use of the Internet is going to involve some level of what these people claim to be "unsolicited" email. And, once you send that you are a spammer.

Oh, and don't forget. If you claim not to be a spammer and put every effort into not spamming anyone the result is simply that you are lying. You can't prove you don't spam and everyone knows spammers lie. If everything you say is a lie, what is the point of discussing anything?

Yeah, I'm bitter. We got unblocked yesterday. We don't spam, but plenty of customers are wondering why we were silent for four days. Some just want their money back now.

Re:Good

[Frater 219]

The goal of most spam blockers is to eliminate commercial use of the Internet.

Actually, most "spam blockers" work for organizations which commercially use the Internet. They are mail administrators for ISPs or other companies, which have directed them to reduce the impact of spam on their businesses -- to cut costs or to improve service to customers.

Spam isn't commercial use. It's criminal use.

Re:Good

[cdrguru]

The legal problems come from one simple thing - there is nobody that is responsible. We were blocked (wrongly) a while back by some cowboy with a list. The problem is the list is compiled by anonymous sources and the "list administrator can be *very* difficult to find.

OK, so you find the list administrator. So what? They did not actively "do" anything at all. They did not block your mail. The ISP using the list did. However, the ISP is just using a list that someone else compiled - they cannot change it and are usually extremely reluctant to override it - that might make them responsible.

So, the legal issue is pretty simple once you understand it. We would *love* to sue the people that have wrongly blocked us - we don't spam and the list people that we have just dealt with understand that. But it took four days to get unlisted.

Suing is pointless and any reasonable attorney will tell you that once they understand the situation. You might find someone to take your money for a while if they are sufficiently clueless. But there isn't anybody, anywhere to sue.

The goal of the blockers is to eliminate commercial use of the Internet. If they can't convince you of that, they will just block enough email to make doing business via email impractical. We lost four days of being able to respond to many customers. What would you do if you bought something and didn't get confirmation for four days? I'll tell you our customers are not happy at all and most think we're cheats. Lots of credit card chargebacks coming.

We have to move away from relying on an unreliable communication media (email) just to stay in any form of business at all.

Bitter? Heck yes!

Re:Good

[cdrguru]

You define commercial use as providing services for not-for-profit indivduals web surfing. Fine.

I define commercial use as trying to sell a product on the Internet and communicate with customers. You send one single email to an unconfirmed email address and you can be blocked for days. Do that enough and you are out of business.

I wish the Internet could be a commerce-free zone sometimes. But it is an incredibly easy way to communicate with people and offer products and services to them. However, the spam blockers want to make sure that email cannot be used to send anything that is considered to be "unsolicited". If it has the word "sale" in it, it must be unsolicited - who would ask for something like that from a friend?

You purchase something and we send a confirmation to the email address supplied. If it happens to be a joker that gave us a "spamtrap" address, we're blocked. Don't bother saying it doesn't work that way - we just got unblocked from that happening.

Re:Good

[Frater 219]

You define commercial use as providing services for not-for-profit indivduals web surfing. Fine.

No, I don't. I define it as the use of the Internet for commerce, which is to say economic activity between consenting traders and investors -- what my left-wing friends would call "capitalism". I don't consider your sending of unsolicited advertisements to "an unconfirmed email address" (how many was it really?) to be commerce. I consider it to be spamming.

I define commercial use as trying to sell a product on the Internet and communicate with customers. You send one single email to an unconfirmed email address and you can be blocked for days. Do that enough and you are out of business.

You admit sending commercial email to an unconfirmed email address (how many addresses?), which turned out to belong to someone who had not solicited your message. By the usual definition of spamming as "unsolicited commercial email", that means that you admit to having spammed.

The techniques for operating confirmed mailing lists are not new. Mailing list software to operate confirmed lists has existed since well before the "e-commerce" boom. Thousands of businesses use such software. They operate confirmed, solicited commercial mailing lists ... and they don't get listed as spammers.

It sounds to me, from your description of the situation, like you failed to do due diligence, failed to take advantage of the information resources available to you -- and as a result, you spammed. In that case, the folks who listed you as a source of spam were telling the truth, weren't they?

Don't bother saying it doesn't work that way - we just got unblocked from that happening.

Hey, I'm just working with what you give me. If you'd like to point to a published record of your exchange with the list operators, please do so. A Google search link into NANAE, if that's where the exchange took place, would be more than adequate.

How many addresses did you spam, again?

Re:Good

[odaiwai]

The goal of the blockers is to eliminate commercial use of the Internet.

This is absolutely untrue. The goal of the blockers is to stop spam and abuse of the network and reclaim it from those who think that merely having and email address is an invitation to get spam.

dave

Re:Good

[Anonymous Coward]

Odd that you don't see these SBL people selling banner space on their web-pages to cover legal costs then, now isn't it? I certainly don't agree with spamming, at all, but how is the SBL any less commercial-use hostile than, say, WebWasher or Junkbuster? I wonder how long television or radio would have lasted if someone sold a product not long after their induction that removed all the advertisments from a broadcast, so that they were 100% wasted efforts?

Re:Good

[Steve B]

You send one single email to an unconfirmed email address and you can be blocked for days.

Yeah, and you take one thing from a store without paying for it and you can get arrested for shoplifting. Life just sucks sometimes.

Re:Good

[Jay L]

You send one single email to an unconfirmed email address

Actually, having just tried a demo of CD-R Diagnostic (an excellent program, btw), I'd like to point out that you send FOUR. Two in quick succession when the demo is downloaded, one three days later, and one five days after that.

The last e-mail says that you delete all evaluation e-mail addresses after 14 days, but the others give no indication of when it will end, there are no remove instructions, there is no explanation of how you got my address, etc. If I got this because someone typed in my e-mail address, I'd probably report you too. You should read up on the Ten Rules for Permission-Based Marketing.

Re:Good

[Steve B]

So, the legal issue is pretty simple once you understand it.

Indeed it is. An ISP is private property. The owner of the ISP has the right to exclude people from that property for pretty much any reason (with a few specific exceptions, such as laws against discrimination based on ethnicity, religion, etc). QED.

We would *love* to sue the people that have wrongly blocked us

Would you also love to pay the defendant's court costs plus punitive damanges for wasting the court's time with a frivolous lawsuit?

The goal of the blockers is to eliminate commercial use of the Internet.

If you don't want to be perceived as a cartooney spam apologists, you really need to avoid the tired old cartooney spam apologist cliches.

Re:Good

[Anonymous Coward]

How conveniently narrow minded of you. What, did you lose your job selling banner ads?

There are other ways to pay for TV including public television and, in places like Great Britain, commercial free television supported by taxes.

Also, there is pay-per-view and subscription premium services over cable and dish that are commercial free.

The Internet is undoubtedly bigger as a result of the believed potential of advertising. But =! better.

There are numerous examples of products, services, musical groups, writers, etc who were better smaller and less popular. Overexposure, over-commercialization, and over-popularity has ruined many things that would have been of higher quality had they remained smaller.

The 'net would have survived without ads; it would just be different. But to say that the net *needs* advertising is nonsense.

Re:Good

[gmuslera]

Spam blocking makes email unreliable. The way it is implemented is generally broad-brush and affects a lot more than just blocking some spam.

Don't forget that what do SBL is not blocking itself, is a way to telling mail administrators and users that that whole provider is very spam friendly, that there are big probabilities that comes spam from there. As an administrator, you can decide to use that info to not accept mail coming from there, or add some amount to an score to see with other criterias if the mail from there is blocked, ignore it, or whatever you want, but is not exactly SBL that do the blocking, is your choice.

If you have a request from your users to stop or minimize all you can, at risk of losing some mails, well, then you can block using SBL, or like others, ban china/korea/etc from the range of accepted sources from mail, or apply some more alternatives to prevent most of the spam coming.

Ok, you can say that it is unfair, but users can change providers if one of them is very spam friendly. And for me would be unfair to declare the net or email PG-17 because all of sexually explicit spam young childrens will get if noone block that kind of things

Re:Good

[Woodrose]

Remember "SPAM" was used since WWII as a euphemism for a metabolic by-product. Remember what they called creamed chipped beef on toast? (hint: "**** on a shingle") The chipped beef was usually Spam. The metaphor is still good.

Re:Good

[_Sprocket_]

Odd that you don't see these SBL people selling banner space on their web-pages to cover legal costs then, now isn't it?

Maybe they don't HAVE to. Maybe they don't want to. It doesn't really mean anything now, does it?

I certainly don't agree with spamming, at all, but how is the SBL any less commercial-use hostile than, say, WebWasher or Junkbuster?

Come now, if you're gonna troll... at least put the effort in to a cute pen name.

By the way - just because you think pop-ups are cutting-edge, doesn't mean the end user is beholden to accepting it. The general population is lazy. They won't go out of their way until they really have to. The fact that apps like WebWasher and Privoxy (the new rendition of Junkbuster - available and easy to install and use on all platforms... windows too) are becoming popular indicates that web advertisers have cut their own throat. Advertisers became too aggressive... too annoying. And the end user does not have to accept it.

Re:Good

[_Sprocket_]

I define commercial use as trying to sell a product on the Internet and communicate with customers. You send one single email to an unconfirmed email address and you can be blocked for days. Do that enough and you are out of business.

And what would it have taken to confirm that address? Perhapse ensure that you weren't opening yourself, and some unwitting third party, to abuse?

Re:Good

[Anonymous Coward]

I say, FUCK YOU. Your definition is == Spam == to telemarketing. Of course, I don't really give a shit anymore. OS X's mail application does an awesome job of removing spam from my email. So I didn't have to read through the EIGHTY different spam / hardcore porn ads that came into my box today. If you email me and I didn't put myself on the emailing list, you won't be blocked for days, YOU WILL BE BLOCKED FOREVER. Go fuck yourself cdrguru.

Re:Good

[Anonymous Coward]

Hey, I'm just working with what you give me. If you'd like to point to a published record of your exchange with the list operators, please do so. A Google search link into NANAE, if that's where the exchange took place, would be more than adequate.

How many addresses did you spam, again?


Self-important posts like yours make me wish for a plonk feature on slashdot.

Re:Good

[good-duckspeak]

We have to move away from relying on an unreliable communication media (email) just to stay in any form of business at all.

So your company wasted four days trying to get unblocked and ignored possible technical solutions.

nice. I say sue someone, sue everyone, you was robbed!

Re:Good

[Isofarro]

Spam blocking makes email unreliable.

No. Email has _never_ been completely reliable. There is nothing in the RFCs that guarantee delivery of every email.

Spam on the other hand, makes email _more_ unreliable because of the unwanted volume of it. Spam blocking is a means of reducing that volume.

The goal of most spam blockers is to eliminate commercial use of the Internet.

No. Consensual commercial email usage is preferred. Unsolicited and unwanted email in volume is what we seek to eliminate.

We got unblocked yesterday.

Funny how you need your services blocked before you actually take responsibility for your mail server. Now had you been a competant and responsible administrator, you probably wouldn't have been on a block list in the first place.

Re:Good

[Anonymous Coward]

there is nobody that is responsible

The spammer is responsible. It sounds like you're more angry at those who don't like spam than you are at the spammer that got you stuck in a block intended for them.

You leave a lot of your story out. What IP range was blocked? Why was it blocked? Were you in the same class C as an active spammer? Were you a downstream customer of a spammer? Were you paying money to or receiving money from a spammer that was blocked? Did you complain to the spammer's ISP that you were being damaged because they were hosting a spammer or was your position that neither the spammer nor their ISP were doing anything wrong, and that all the blame lay with those who would try to block the spammer?

You cannot seriously expect to complain about winding up in an anti-spam block list, make no mention whatsoever of what the entry was blocking and why, and get sympathy from a boatload of geeks, the vast majority of whom have had it up to here with spam and spammers, and many of whom would not rush to the aid of a spammer who was on his 90th second with his nose and mouth duct-taped shut.

Re:Good

[KC7GR]

More than that. Verio could (and, possibly, already has) experience widespread blocking of their IP ranges by individual SysAdmins in privately-run (read: local and site-specific) blocklists, if they're dumb enough to throw cartooneys at Spamhaus.

In fact, they already tried the same stunt on Ron Guilmette of monkeys.com (threatened legal action when Ron expanded their listings on his system). Within (probably) minutes of the word going out on the newsgroup, many SA's, myself included, started asking for lists of Verio's IP ranges, and inserted those lists in their private blocklists.

In short: If they threaten legal action against people who are doing nothing more than expressing an opinion (in the form of publishing lists of IP addresses they think are contributing to the spam problem), and taking steps to protect their private property (by checking incoming mail connections against that same list, and selectively blocking the unwanted stuff), they're only going to dig themselves deeper into their existing hole.

Verio is second only to UUNet (also known as 'SpewSpewNet') for harboring spammers. They need a wake-up call like nobody's business. If Steve's listing doesn't do the trick, I don't think anything else will.

Re:Good

[Spoing]

Self-important posts like yours make me wish for a plonk feature on slashdot.

His comments seemed well reasoned to me.

What's your gripe exactly?

Re:Good

[Anonymous Coward]

Get over it, you whining pussy. You had customers that spammed people, probably did nothing about it, and ended up getting blocked. Serves you right.

Re:Good

[minas-beede]

"Spam blocking makes email unreliable.

"No. Email has _never_ been completely reliable. There is nothing in the RFC [livinginternet.com]s that guarantee delivery of
every email."

OK, spam blocking, as done by SPEWS (mostly) makes email less reliable. You'd be hard pressed to document your claims about unreliability of email - what guide to the internet supports you in this claim, for instance? It isn't 100% reliable. You can't mask the ill effects of intentional blocking of IPs known not to be spam sources by the lack of perfect reliability, just as you can't mask murder by saying everyone is bound to die sooner or later.

"The goal of most spam blockers is to eliminate commercial use of the Internet.

"No. Consensual commercial email usage is preferred. Unsolicited and unwanted email in volume is what we seek to
eliminate."

Right on. The ARPAnet was beautiful - very few if any desire to return to that. Commercial use of the internet can be a marvelous thing but that doens't mean that anyone should have to receive unwanted email. The "eliminate commercial use" claim is a plain and simple lie. Chances are about 99% that anyone making this claim will not admit that most spam (including the spam sent by the one making the claim) is sent using deliberately abusive techniques - exploitation of open proxies and open relays being chief among these.

Re:Good

[Black Copter Control]

I define commercial use far more broadly than just providing web surfing. It includes selling products. In fact, I'm working with a friend who provides does web hosting, and ecommerce (see the tiny add at the bottom of my posting).

We buy adds, run contests, register our site with anybody who's interested in listing us, and I even mention us in my signature...but my postings are (to the best of my ability) intelligent and on-topic). On really good days, I've gotten a good hadfull of posts rated to +5.

Spamming people to sell them garbage, is also a commrecial use. It just happens to also be an action that's not welcome by 99.5 percent of the people on the net (to varying degrees). We have a right to not allow our email boxes used for your commercial purposes.

If it happens to be a joker that gave us a "spamtrap" address, we're blocked.

Spamgrap addresses are, by definition, not given out with permission to send to. If you can prove that someone gave you a spamtrap address, told you that they wanted you to send them email at that address and then complained that you spammed them, then you can sue the person who did that.
Don't bother the person who responded to that information. Sue the person who 'framed' you.

On the other hand, if you're bulk-sending email to addresses that aren't confirmed for sending mail to, then you're just asking to get blocked. Under those circumstances, I'd say you were just asking to get blocked.

Re:Good

[Black Copter Control]

Spam blocking makes email unreliable. The way it is implemented is generally broad-brush and affects a lot more than just blocking some spam.

It's spam which makes mail unreliable. In a couple of cases, while skipping what looks like spam, I've missed a real email. If I didn't have a dozen unwanted spams a day to skip over, I'd have gotten those emails.

Yes. spam blocking sometimes will take out an entire C or even B class block. Usually it's done when there are signs that an ISP is allowing a spammer to relocate an email server once it's first address gets blocked for spamming.If you're running into problems like that, then chances are that you're with a spam-friendly ISP. That bodes ill just for starters.

If you're being careful to make sure that you're not doing anything that looks like it might be spam, then I'd suggest that you move to a provider who's not so spam friendly.

If you're doing borderline spam activities, you're not going to get a whole lot of sympathy here... A lot of people on slashdot have had to waste a lot of time dealing with spam problems. We treat spammers like problems.. not puppies.

Spamford Wallace where are you????

[Anonymous Coward]

We need our royal crusader, Spamford Wallace, to fight spam as he promised to do after being bitch-slapped for his own spamming crimes.

Oh no!

[Yoda2]

Now how will I know the best way to enlarge my penis or get that degree from a fine, unaccredited institution?!

Re:Oh no!

[NotAnotherReboot]

Well, those were once in a lifetime opportunities anyways so I'm sure you'll never get an offer like that ever again.

Re:Oh no!

[dubbreak]

And even if you find a way to elarged penis and a degree on your own how are you going to meet those women that are, "waiting to talk to you right now!"? Your huge cock will just go to waste!

Re:Oh no!

[cosyne]

Now how will I know the best way to enlarge my penis or get that degree from a fine, unaccredited institution?!

Thanks to the majick of Windows Mesenger Serivce, you don't even need email to learn about prestigeous degree opportunities! This information can be (untraceably) delivered straight to your desktop, multiple times per day!

Re:Oh no!

[lendude]

Well, I've tried the penis enlarging (oh thank you benevolent spammers - I'm a horse now!), but what the hell is this (listed in the Spamhaus notice)?

"make-penis-fast"???

Does this give me the body of a horse to go with the dick?

IP filters?

[Anonymous Coward]

Don't most filters go by domain names and not IP ranges?

Re:IP filters?

[Fefe]

No.

Re:Do so, do not

[Anonymous Coward]

Are you high??? They are nothing alike, MODS: pleeeeeeeeese mod down this pathetic attempt at humor.

This is depressing...

[shaitand]

To see the spammers win and block legitimate sites to stop the criminals is well... criminal. Isn't that what all of us who believe in freedom are supposed to be fighting against. I hate spam as much as the next guy, but I'd rather see every spammer run rampant then restrict even one innocent party nobody cares about.

Re:This is depressing...

[PFAK]

This is no different the the occurences that DALnet IRC Network has auto killed *.ipt.aol.com to get the attention of the ISP due to not helping with abuse complaints. It worked, so why wouldnt it work with spam?

Re:This is depressing...

[ThesQuid]

I'll second that. Folks, let's face the facts: there are tons of people out there who have no clue what they signed up for, and then buy automated spam reporting software. Sites where someone legitamately signed up are then painted with a VERY broad brush as spammers by idiots who then assign everything in their e-mail box as spam.

I've had people sign up to get info from a site i run, and upon receiving the first e-mail that they explicitly requested, write back in all caps "HOW DID YOU GET MY ADDRESS??? STOP SENDING ME THIS!!!"

Couple that effect with vigilante spamblock operations (whose haughty tone assumes EVERYONE reported to them is evil) and you have people being slimed who are doing legitimate business on the web.
Yes, I agree people who forge headers or don't properly cull lists are negligent. They are buffoons who should be blocked. But hey, what are you going to do, block yahoo.com?

Re:This is depressing...

[Ilgaz]

That "innocent party" should find a good provider with STRICT anti-spam policies than.

If you do business with people who has no respect to others, you deserve it. Kind of.

Re:This is depressing...

[Ilgaz]

I don't believe a single word of you. Your URL, which is some sort of affilate ID makes me think different stuff than the thing you said.

What is "your site", if its "your site", you are CEO of Reozone.com? If thats true, do you affilate with them?

Let me tell the real story. You had some sort of an innocent mailing list, than you sent that reozone.com URL with your affilate link to them.

Oh blocking Yahoo.com? gmx.de blocks them, Novell Myrealbox blocks their mailing list service because of non-serious abuse policy (even they are a potential huge customer). Also, when a yahoo mail user spams you, I have a record like, 2 hours later his account has been deleted.

SO EVERYONE CLICKS ON YOUR REFERER ID'ED URL ON SLASHDOT GIVES YOU MONEY?

bleh

Re:This is depressing...

[Hank Reardon]

But hey, what are you going to do, block yahoo.com?

Actually, yes. I also blocked aol.com, geocities.com, the entire .info and .biz domains (I used to get a suprising number of spams with too-cute.biz headers), msn.com and a couple of others I don't remember off the top of my head.

The last person I knew on AOL (my father, actually) left several years ago and I've never known anybody on any of the others. I really don't care if somebody who has one of those ISP's can send mail to me or not.

Re:This is depressing...

[ThesQuid]

Actually, I'm the sysadmin for the above mentioned site. (Among others that I won't mention, being that I'm not looking to insert a shameless plug.) The affiliate ID is just for my own kicks, to see how many people go from my sig url to this particular site of ours. Sheesh, man, tone down the paranoia and vitriol a bit! By the way, I don't personally get any money from someone clicking the aforementioned link, in fact, no-one from /. has ever bought our services by going through that link. I'm not marketing to you through my personal url here on Slashdot, so chill, ok?

Re:This is depressing...

[Anonymous Coward]

What you say may be true, but it sure does look like your trying to get affiliate clicks with a url on slashdot. What would you think if you saw a user's url that looked like that?! Common sense.

Actually, I still don't believe you.

Re:This is depressing...

[Anonymous Coward]

Did you explain where the mail was from, and how to stop the mail from coming ever again? As in... the first part of the mail?

Re:This is depressing...

[Anonymous Coward]

I'm not sure from reading your message if you are aware the FROM address on spam is always faked.

Blocking AOL, Yahoo, MSN, etc may be a cheap way to stop a lot of spam, but that is not where the spam is actually coming from.

Re:This is depressing...

[infra-red]

How about facing this fact.

ISP's that don't do something to combat spam are going to have customers leave over it.

There are other ways of maintaining the list. I have heard the arguements many times, but fundamentally, its up to the sender to be certain that the recipients want to receive the email.

First of all, is the sign up process a Double Opt-In process? A pita to implement if it isn't done already, but good luck keeping an accurate list without it. It also helps establish a trust with the people who want the mail. 99% of the spam I still get claims that at some point in time I signed up for this list.

Secondly how active is the list? Someone signing up for a list that doesn't generate any traffic for 6 months is a sure way to have people think your spamming them, even if they did actually ask to be on the list.

As far as the spam lists, I've had to deal with there overzealous behaviour as well. They block mail servers that have an open relay hole in them very fast. The more zealous the site, the less likely I am to use the list. No ISP is doing their customers a service by using lists that are ready to block every IP out there and damn them to hell for ever.

Re:This is depressing...

[cnvogel]

I've had people sign up to get info from a site i run, and upon receiving the first e-mail that they explicitly requested, write back in all caps "HOW DID YOU GET MY ADDRESS??? STOP SENDING ME THIS!!!"
Well obviously you did not manage to make clear to your users that they will receive "Information". I don't think that anyone will list you in a spam-blocking list because you run for example a mailman mailing-list which makes it clear that by entering that password into the form on the webpage (which says that you will join an email-list) you will receive mail from the mailing-list (doh!).

Re:This is depressing...

[Isofarro]

I've had people sign up to get info from a site i run, and upon receiving the first e-mail that they explicitly requested

Send them back the confirmed opt-in email you received from them, plus a confirmation that they indeed want to unsubscribe.

Re:This is depressing...

[CaptainZapp]

Yes, I agree people who forge headers or don't properly cull lists are negligent

The term you are searching for is crooks

But hey, what are you going to do, block yahoo.com?

If they allow spam from their networks? Of course, what else?

No need to thank me...

Re:This is depressing...

[Anonymous Coward]

Send them back the confirmed opt-in email you received from them, plus a confirmation that they indeed want to unsubscribe.

What's the betting they don't send opt-in emails? I had a run in with some idiot who ran a email list for warez. He claimed that I had signed up to his list, except 'signing up' in his book meant accepting any address that anyone cared to type into his web page. He swore blind he wasn't a spammer and that he would send me the log that showed me signing up. Curiously it never arrived.

In my book anyone operating a mailing list that doesn't involve opt-in confirmation emails are either morons or morally equivalent to spammers.

Re:This is depressing...

[brassman]

"Double opt-in" is spammer talk.

Signing someone up properly is no more "double opt-in" than checking the signature on a credit card is "double billing." It's confirmed opt-in.

Re:This is depressing...

[87C751]

99% of the spam I still get claims that at some point in time I signed up for this list.

I second that. I've had two autoresponder addresses out there for years (neither of which autoresponds anymore, as I got tired of deleting the bounces). In the past 5 years, I've seen exactly one legitimate message to one of them. They draw 5-20 spams a day, and almost all of them claim that 'file-request' had signed up with "us or one of our affiliates."

Of course, it's entertaining to see some of the semi-personalized attempts. "More income for file-request's household!" "Hi, file-request! Want to make your penis bigger?"

Yep, used to be disgusted... now I try to stay amused.

Re:This is depressing...

[Eggplant62]

Verio earned this, though. If they harbor this number of spammers, they can become like AGIS: Bankrupt and out of business. They steal from every ISP on the planet. My inbox is not their advertising space.

When spammers pay me for the privelege of advertising in my box, then we'll talk business.

Rich

Re:This is depressing...

[Anonymous Coward]

I DO block yahoo.com. EMail from there is almost never legit. I'm not very interested in getting email from just anyone who cares to send it, like some folks would be.

Re:This is depressing...

[ThesQuid]

That was exactly my point. The addresses are either faked, or generated by one-time account abuse.

Re:This is depressing...

[ThesQuid]

I continually get calls from people who want the information we send out in those e-mails (no, we don't hide our phone number)

At typical phone call: "Uhhh, I'm looking for information about a house I saw on the Internet." What?!? What house? Where is it? What website? And of course they can't answer, so I can't help them. If the telephone & verbal communication is so difficult, what makes you think they have your ability to understand this topic? It's a sad fact, but there are so many people out there on the web who haven't any clue whatsoever.

Re:This is depressing...

[infra-red]

Double Opt-in, Closed Loop Optin, Full Confirmation Opt-in, Confirmed Opt-in. Its all basically the same thing. I've pulled most of these terms from many black list sites.

If your dealing with spammers, you need to use a term that they understand. It wasn't that long ago when there was no problem with running an open relay server, or a "signle opt-in" mailling list. Don't confuse intent with simple out-dated implementations. Double Opt-in is simply an improved version of an old concept.

One of the biggest problems of overzealous anti-spammers is that they believe that every one who has ever created a mailing list of people who they have communicated with should be shot, before considering why they made it. I can assure you that my Grandmother making a list of people who left comments on her guestbook had no bad intention. Is she spamming, yes, is she a spammer, no.

Re:This is depressing...

[Anonymous Coward]

What is needed is to block all the IP addresses from China, Taiwan, Russia, and all of the countries that used to be part of the Soviet block. They don't give a shit about spammers, and do nothing to stop them.

Re:This is depressing...

[Anonymous Coward]

Thanks for fighting to ensure my email will not be disenfranchised.

Re:This is depressing...

[shaitand]

I agree, they are worthless bastards, but this doesn't punish Verio, it punishes Verio's users, spammer or otherwise. Hell I'd like to see every website with the word microsoft in it, that doesn't contain the words evil or anti be blocked, by every isp in the world, including msn ;) Microsoft certainly deserves it, but that wouldn't really help poor susi who has a cheesy generated homepage that says it was made by microsoft frontpage would it? Does microsoft being evil mean susie doesn't have the right to share her crayola heart images with her 12yr old friends? Nope.

Re:This is depressing...

[Anonymous Coward]

I hate spam considerably more than the next guy, and I think you have failed to realize that this is a war. Either the spammers are going to make the Internet useless for personal private communication, or we're going to make the Internet useless for sending out junk mail postage due.

Choose a side.

Re:This is depressing...

[shaitand]

I have chosen a side, I find considering the "casualties" of your war expendable to be wrong. I believe freedom comes before annoyance. And yes spam is damn annoying, but not worth giving up the war for fair use and freedom over).

Great, more censorship

[I Am The Owl]

That's just what the Internet needs. When will ISPs decide, or be forced, to stop playing Big Brother and let the users make their own decisions about what to filter? The technology is out there, in the form of Bayesian filters, and is nearly perfect. So why do we still have to deal with upstream providers knowing what's best for us?

Re:Great, more censorship

[b0r1s]

Bayesian filters are not "nearly perfect." There are some technologies that are closer, such as support vector machines and LVQ., but bayes isn't going to cut it.

Re:Great, more censorship

[Uma Thurman]

Nobody's stopping you from getting spam if you want it. Calling this censorship is completely and utterly misunderstanding what censorship is, and what a blocklist is.

Re:Great, more censorship

[I Am The Owl]

Bayesian filters are not "nearly perfect."

Really? You mean blocking 995 out of 1000 isn't "nearly perfect"? 99.5% seems pretty damn close to perfect to me...

Re:Great, more censorship

[zulux]

When will ISPs decide, or be forced, to stop playing Big Brother and let the users make their own decisions about what to filter?

I specifically choose ISP that follow spam black-out lists. Makes my life a lot easier. It's my choice to choose my ISP.

Kids with their Yahoo! or Hotmail account usually don't care about spam, but I do, because each piece of spam causes me to loose billable time.

Re:Great, more censorship

[gerbache]

This isn't so much censorship as it is removing a source of unwanted, unsolicited mass mailings. In many states, this is illegal, especially when it comes to telephones. I personally really like the fact that this might possibly remove a source of spam from being able to deliver to my email account.

Besides, if they decide to take the initiative and prevent this sort of thing from happening, they can be reinstated. Sounds good to me.

Re:Great, more censorship

[p3d0]

That's only half the picture. It also must let every non-spam email get through. It can't just discard important emails. Otherwise, I could provide you with a simple filter that blocks 100% of spam...

(I'd like to point out that the link you provided claimed "0 false positives" which is exactly what I'm talking about.)

Re:Great, more censorship

[Anonymous Coward]

The technology is out there, in the form of Bayesian filters, and is nearly perfect

Yeah, and so was the treaty of Versailles. Give up karma whoring on Bayesian filtering. I'm sure it'll fall out of the slashdot auto-mod-up favor any moment now, like Indrema.

Re:Great, more censorship

[jenssoderberg]

On a sidenote, alter the spamfilter so that it will send the reason why the email was flagged as spam to the sender. If its a important letter i do think the sender will try to send the email again in a altered shape.

Re:Great, more censorship

[evil_roy]

This ISP is stopping it's customers from getting spam. That is the whole point.

It is censorship.

Re:Great, more censorship

[kgasso]

Exactly. We get users bitching and moaning about spam, and what are we going to do -- ignore them and let them take their business elsewhere? We are taking the route of designing a crap filter the users can configure, and select which BL's to use -- all based around procmail and SpamAssassin. User doesn't want any filtering? Okay, easy enough for them to disable it completely.

I don't want to sound like a callous jerk, but it doesn't sound like the original poster knows what it's like having thousands of users screaming for some sort of server-side spam filtering. For their $18 or whatever a month, the majority of them want their ISP to do something about the viagra/pr0n/MMF spam in their mailbox. ISP's just need to make the right decision in letting the users decide if they want filtering or not. Users can always go elsewhere if the ISP wants to enforce filters the user doesn't like.

My $.02 USD.

Re:Great, more censorship

[Uma Thurman]

The customers have alternate means of getting the spam.

The ISP is private property. The owner of property can say who speaks on that property. An analogy: If you come to my house and stand on my lawn and start talking, it is NOT censorship for me to tell you to get off my lawn if you're going to talk. You're perfectly free to talk somewhere else.

Re:Great, more censorship

[evil_roy]

Well, maybe if ISP's had an opt-in feature for their customers.Maybe they did contact all of their customers and explain this new "feature" and gave them an option - I'm guessing not.

I'd rather have an ICP (connection) than an ISP any day.

Re:Great, more censorship

[colfer]

So far, no Bayesian client software is easy enough to use for most folks, in Windope. Good plugins may be right around the corner, though.

Re:Great, more censorship

[dubious9]

Nope, if you read the article you'd see that just the corporate mail servers were blocked (like other posters have already pointed out) Their ISP mail servers we not touched. Nothing gets a point across to a CEO like suddenly having your email blocked.

Re:Great, more censorship

[Anonymous Coward]

But a huge portion of the spam that gets blocked is from forged addresses. So now you'll be getting mailer-daemon messages in your inbox (and filtering those would be a bad thing, since there are important ones you need to receive sometimes). And anyway, sending a spammer a reply would confirm that your address is valid.

Client-side spam filters should really start by importing the user's address book and whitelisting all those addresses (unless they're stupid mail client has been adding senders of everything, including spam, to their address book ofcourse :)

My ISP (sonic.net) runs spamassasin on their servers, and I rely on apple mail's junk filter for everything else. I get about two to three pieces of spam in the inbox every day, compared with atleast 50 that automatically end up in the Junk folder. I haven't seen a false positive since the first week I was using Apple Mail (it learns from your mail...)

Re:Great, more censorship

[ReTay]

Himm how often do we see the clueless suffering because they don't get it? My entire computer experience has been in ISP's. You want to guess how many times I have heard someone say they wanted more spam? Twice, the thousands of other times it is they want less spam. If you want unfiltered email get it. The people who want spam filters vastly out number you. ISP's will do whatever the majority of their subscribers want or will tolerate.

Re:Great, more censorship

[beebware]

Don't be so sure about that. I once configured a mail system for a company that had very very basic anti-spam measures: subject line filtering. One of the filters was a line of five or more periods (.....) as it had been shown that the majority of the spam email being received by the company fitted that criteria.
I put the filter in place and an automatic message back to the sender saying "Mail rejected: Subject line contains five or more periods - please change subject line to resend".
I don't think we had a single person figure it out - one numbnut tried resending the message (prefixed by Fw: and Re:) with the same subject header over 20 times...
Tech support then was fun - the customers would reach us (via our "sales team" whose mail we were filtering) and say "Our email is being bounced", we responded "What does the message you got say?"... And then trying to explain a basic sentance to them - and yet we were still the "bad guys" for not making it easier to understand...
I did learn one thing though - never underestimate human stupidity.

Re:Great, more censorship

[coolgeek]

Yeah, and then every spammer gets a confirmation that your email address is real.

Re:Great, more censorship

[Anonymous Coward]

Well, maybe if ISP's had an opt-in feature for their customers.Maybe they did contact all of their customers and explain this new "feature" and gave them an option - I'm guessing not.

Thats what sonic.net does. SpamAssasin is both sick and ill. Hella, yo.

Re:Great, more censorship

[L0k11]

On a sidenote, alter the spamfilter so that it will send the reason why the email was flagged as spam to the sender. If its a important letter i do think the sender will try to send the email again in a altered shape.

It's a good idea, but you could just be helping the spammers by providing them with a way to get past the filter you are using.

I also think some people are being a little harsh on businesses that claim that they are being blacklisted for no reason. Perhaps more accountability is need by the people who decide whats spam and what isn't. I ordered DVDs online and now I recieve an email once a month from them, I have the option of opting-out (and it actually works...not just bring more spam). I reguard these emails as solicited advertising and every so often I make a purchase based on the information they contain. However my university network flags them as potential spam. I really hope they dont take the next step and blacklist them... but I believe if they are responsible that wont happen.

Re:Great, more censorship

[Anonymous Coward]

say that you're someone running a mail server. You have an oppurtunity to get rid of at least 1/4 of all the messages that your server has to deal with, and best of all, your mail users won't even notice. In that situation, would you block spam? it's not about the ISP's knowing what's best for thier users; it's about the ISP's knowing what's easiest for them.

Re:Great, more censorship

[darien]

Possibly a stupid and obvious thing to say, and probably not relevant to your circumstance, but... if you sent me an email saying there were too many periods in the subject line I probably wouldn't get your meaning either - because we call them "full stops" on this side of the Atlantic.

Re:Great, more censorship

[jhunsake]

Oh c'mon it should have been "Mail rejected: Subject line contains five or more periods - please reduce the number of periods to four or less"

Never understimate human ability to not communicate effectively.

Re:Great, more censorship

[Skapare]

By the time the Bayesian filters are engaged, it's already too late. The bandwidth has already been wasted, and should some legitimate mail be rejected, your mail server is now obligated to return a bounce message which means tons of spam bounces will sit in the queue. The right time to block spam is when the SMTP connection first arrives, but before any mail is actually sent. I won't be doing it any other way.

Re:Great, more censorship

[_Spirit]

I cannot tell people to stop talking on my lawn. Ofcourse this might be because I don't really have a lawn.

Re:Great, more censorship

[jenssoderberg]

So? this is the place where the spamfilter kicks in.. ;-)

Re:Great, more censorship

[Rik van Riel]

When will ISPs decide, or be forced, to stop playing Big Brother and let the users make their own decisions about what to filter?

That will happen the day hell freezes over. Users don't WANT to receive spam, nor do they want to be bothered with having to teach their own bayesian spam filter. They simply want to receive "good" email and never be bothered with "bad" email, from the day they sign up to their account.

People pay money to their ISP and because of that expect their ISP to do the spam filtering for them.

Besides, the only sure way to stop receiving spam is to have the spammer's ISPs stop the spammers from sending it in the first place.

Re:Great, more censorship

[Rik van Riel]

It also must let every non-spam email get through.

Why ?

If it was important, the open relay problem will get fixed or the spammer will get booted from the network and then the mail can be sent again.

Alternatively, send the email via some webmail service like Outblaze.

I agree that ideally the receivers of email would get all the mails they wanted, but in practice this just isn't possible. Email has been "poisoned" by spammers and in some bad cases the spammers have "poisoned" whole networks so badly that the best cure is to just nullroute them until they've kicked off all their spammers.

Re:Great, more censorship

[Anonymous Coward]

Nothing gets a point across to a CEO like suddenly having your email blocked.

Actually, in Verio's case, one thing could get the point across to the CEO in a stronger way: Blocking his access to the multitude of animal & kiddie pr0n websites his failing-disgrace-to-it's-japanese-masters company hosts.

Word is, he spends most of his day browsing those, the rest is in the men's room snorting Drano... But remember, until we see the footage, these are just rumors.

Re:Great, more censorship

[Anonymous Coward]

i am a user. I left RMI to go to my current ISP because my current ISP did a better job of spam blocking. I'm also supporting clients who get their mail through big hosting companies. They're also leaving companies who are doing an inept job of blocking.

Any user who wants no blocking is free to go to an ISP that doesnt block, if they are willing to pay for the excess spool space. Any user who wants the ISP to implement something globally is free to go to someone using global lists. Guess which ISPs are losing customers to churn?

Re:Great, more censorship

[p3d0]

Are we talking about the same thing here? I'm saying client-side spam filters must not reject legitimate emails. I think that's a very uncontrovercial statement, and that it is also achievable (as demonstrated by the success of the Bayesian filters).

If you are talking about the same thing, then I'm sorry, but I missed the point of your post.

Re:Great, more censorship

[sqlrob]

You are missing the *MAJOR* point of spam.

If it makes it to the client side, even if filtered, the theft of services has already occurred.

Yes, filters help an individual. BUT THEY DON'T SOLVE THE PROBLEM

Re:Great, more censorship

[Rik van Riel]

Are we talking about the same thing here? I'm saying client-side spam filters must not reject legitimate emails. I think that's a very uncontrovercial statement

I think it's a controversial statement. The only way we're ever going to stop spam is by stopping the spammers from sending it in the first place.

If no legitimate mail gets rejected, ISPs will never have any motivation to fix their open relays/proxies or kick off their spammers.

I have no problem with rejecting all email from an ISP like Verio, who has made legal threats to the operators of blocklists and has done more to protect spammers than any other ISP I am aware of.

Re:Great, more censorship

[schon]

if ISP's had an opt-in feature for their customers.Maybe they did contact all of their customers and explain this new "feature" and gave them an option

Ahh, so you're saying that the customer's speech is being blocked?

That's not what's happening - see blocklists protect the ISP's customers from spam - so it's not censorship!

Re:Great, more censorship

[ceejayoz]

This ISP is stopping it's customers from getting spam. That is the whole point.

It is censorship.

Then my not having pornography on my bookshelf is censorship, too.

An ISP can do whatever it wants with its servers, and you can choose any other ISP you want.

Re:Great, more censorship

[ceejayoz]

Mozilla 1.3 will be shipping with a Bayesian filter built in... I'm eagerly awaiting that!

Re:Great, more censorship

[digitalsushi]

I'll stop playing "big brother" with my mail server when the spammers stop DDOSing it! You say censorship, I say protection. Besides, we let our customers opt out of the global filter at the user level.

Re:Great, more censorship

[Uma Thurman]

Maybe my grocery store will have an opt-in feature so that when I stand in front of the ice cream and start yelling "I SCREAM FOR ICE CREAM" for two hours they won't be able to hear me.

Are you saying that a grocery store - private property - has some kind of obligation to let me yell in the frozen foods section?

If they booted me out on my ass would that be censorship?

Re:Great, more censorship

[crucini]

The only way we're ever going to stop spam is by stopping the spammers from sending it in the first place.

First, I don't think we are ever going to stop spam. At least, until email changes radically - to some palladium-infested thing, for instance. But to reduce spam to acceptable proportions, put pressure on all points of the spam food chain:

1. Companies that pay for spam - identify, complain, boycott.
   
2. Spammers themselves - sue, prosecute, notify their new ISPs when they hop.
   
3. ISP's that send spam or host spam web sites - blacklist.
   
4. Open relays and proxies - blacklist. Also, simulate with honeypots.
   
5. Victim MTAs and MUAs - incorporate tighter filtering.
   
6. End users - educate. If 5% of spam recipients complained to the right parties, spam would not be practical.
   

And in fact, all of these things are happening. The multipronged effort is more successful than any one prong could be.

Re:Great, more censorship

[klparrot]

You want to guess how many times I have heard someone say they wanted more spam? Twice

I'd actually be interested to know why even those two people wanted more spam.

Anyone who actually wants spam is probably hoping to get in on one of these great opportunities holding money for someone in Africa, or is really desperate to be better in bed. If that's the case, they should be protected from spam; they're gullible enough to throw their money away.

Re:Do so, do not

[Lemmeoutada Collecti]

Oh, I don't know... Spammer finds way to circumvent which blocker finds way to block which spammer finds way to circumvent which blocker finds way to block...

ad nasuem..

Re:who cares?

[shaitand]

OMG!!! you have done it, you've made me see the light, all of slashdot has been summarized and I can finally get back to work!! hooray! BTW- Spam is bad (gotta stay ontopic)

Spam comes from unlikely places...

[GreyWolf3000]

I got a Nigerian money scam today with a yahoo address in the header.

I replied with a cheap goatse.cx link. It went something like "Sure, I'll do it--but can you please check my [a href="http://goatse.cx"]website[/a] tomorrow--I will post a picture of an open door to indicate that you have been granted the go-ahead. If not, it will mean I need another day for my paperwork to be prepared. I have been having troubles with my bank lately, and they might be looking into me, but fortunately I have the right friends. I think email is much too insecure for this." I guess trolls do provide something useful for the community.

Re:Spam comes from unlikely places...

[Jucius Maximus]

" I got a Nigerian money scam today with a yahoo address in the header. I replied with a cheap goatse.cx link. It went something like "Sure, I'll do it--but can you please check my [a href="http://goatse.cx"]website[/a] tomorrow--I will post a picture of an open door to indicate that you have been granted the go-ahead. If not, it will mean I need another day for my paperwork to be prepared. I have been having troubles with my bank lately, and they might be looking into me, but fortunately I have the right friends. I think email is much too insecure for this." I guess trolls do provide something useful for the community."

Haha, that is good, but I can one-up you on that... I've told this story recently in another slashdot thread but I'll actually post the guy's response this time.

Here is my response to the original spam:

Hello, Mr. Abu, it is wonderful to be doing business with you!
My name is James Kirk with phone#202-406-5850 and fax#202-406-5031. [these are the phone and fax number for the US Secret service electronic crimes bureau]
Company: Utopia Planetia Fleet Yards
Company Address: 33601 Lyon Street, San Francisco CA 94123
I look forward to receiving this money!
-James [yes, the james kirk name was inspired by the haxial.org thing]

The guy e-mailed me back and asked me to phone him on his private line. I looked up the phone exchange and it indeed was in Nigeria.

Then I got another e-mail from him an hour later:

Subject: WHY?????

Dear Kirk,

If you were not interested in assisting us, you sholud have kindly told us so
that we can look for another foreign partner who might be interested in
assisting us, instead of agreeing to assist, and giving the number of your
secret service for us to contact.
Why could'nt you be man enough to tell us that you are not interested.

Well, I wish all the best, as we continue our search for a reliable person
that will be genuinely intersted in assisting us.

He actually called it. I got some of the other scammers to fax their documents to the fax number. One guy e-mailed me back and said that the lady on the line didn't know of any James Kirk there. Teehee...

Re:Spam comes from unlikely places...

[GreyWolf3000]

If I were smarter, I would have emailed as if I were really into it, waited for their response, and then sent 'em the link. Then they would have flagged me as a potential victim, and so they might have actually visited the link. As it stands, I concede victory on the basis of getting the thrill of a real response ;)

Re:Spam comes from unlikely places...

[Anonymous Coward]

Ah, that gave me an idea. Next time I get mail from one of these worthless heaps of baboon dung, I'll reply with a link to dms100.org/worksucks (or whatever it was, you know the "I'M LOOKING AT GAY PORNO" thing).

As Sambo sits there in an Internet cafe in Lagos, waiting for moron infidel dog whitey victims to bite... "I'M LOOKING AT GAY PORNO, I'M LOOKING AT GAY PORNO..."
I'm hope the moslem Sharia laws will punish him accordingly. At long last!

Re:Spam comes from unlikely places...

[Anonymous Coward]

Ok, I just created a new yahoo account mnemosyne2601@yahoo.com just so I can submit it to every list out there so that I can give these people what they really need.. namely a nice big asshole in their face or possibly the secret service's number...

Anyone out there know of a site that I can send my e-mail address to and get put on a ton of bulk e-mail lists?

Re:Spam comes from unlikely places...

[loraksus]

passport?
adobe [trialware registration] or buy.com sells your addy to porn spammers. I've never actually gotten a nigerian money scam email, my dad is like "I get them all the time". Of course filtering html email and filtering the word "unsubscribe" in the body to trash tends to work really well for keeping yahoo free of spam.

Re:Spam comes from unlikely places...

[br0ck]

Rich Kyanka, one of the Something Awful gang, pulled a hilarious series of pranks on the Nigerian money launderers. Some of their other pranks on spammers (scroll down to email section) are pretty damn funny as well.

Re:Spam comes from unlikely places...

[beebware]

I'm currently having fun with a Nigerian spammer of my own... I just wonder how long I can keep him at it :)

Re:Spam comes from unlikely places...

[AndroidCat]

Wouldn't Harcourt Fenton Mudd III have been a better match than James Kirk?

Re:Spam comes from unlikely places...

[dk.r*nger]

Hmm.. i seems that the guy really wanted you to have those money or whatever..

Too bad you threw it away :)

Life is bitter.

There are spam gangs?!

[Anonymous Coward]

My gosh... when I was a kid, gangs did fun things like rape, robbery and murder. Heck, even the script kiddies sound cool by comparison.

"Yo, Tony, guess what we did today? We hit all of Hotmail with ads for herbal viagra!" "That sounds deadly!"

Congratulations!

[Anonymous Coward]

As with the UDP, all that ridiculous overreactions like this result in is an increase in those who find the cure nych worse than the sickness.

I used to subscribe to a few filter lists on my mail servers, but the operators are such assholes about things that the lists are now useless, filtering out more valid email than bad (when you consider that a few intelligent local filters can eliminate 90% of spam).

Er...

[Anonymous Coward]

Isn't Verio Paul Vixie's company?

Ironic...

Re:Er...

[proximacnt]

Uh, no. Vixie works as a consultant, and he's never had any direct involvement with Verio that I'm aware of. Certainly not as any kind of major shareholder. http://www.vix.com/

In other news...

[Jucius Maximus]

Every action has an equal and opposite reaction.

Verio had it coming.

Re:In other news...

[azav]

Verio owes me $12,500 dollars for contract work that I will not get.

Granted, you can see they are not high on my list of preferred ISPs.

Re:In other news...

[Dimensio]

Wow. An ISP that tolerates criminal activity from its customers engages in criminal activity. What a surprise :\

Spam to spammers

[razmaspaz]

Do you think the people who send out all this spam get annoyed at all the spam in their mailbox or are they proud of the work they do?

Re:Spam to spammers

[scott1853]

If a Sprint telemarketer gets a call at home from an on-duty Sprint telemarketer, does he tell them to go fuck off? That's another one for the Zen Buddists to think about.

Re:Spam to spammers

[Degrees]

Heck, one of my users replied to a spam, and the as the mail server tried to send the reply message, it kicked back one of the '500 series' errors: mailbox full. "Conflicted" was the description of me that day - didn't know whether to be dismayed or ROTFL.

Re:Spam to spammers

[FilthPig]

Are you kidding? They're all on the do-not-call list!

Re:Spam to spammers

[brassman]

I saw a spammer webforum once -- one of the members started spamming it, and all the rest were royally PO'ed about it. The irony was completely lost on them.

Re:Spam to spammers

[Anonymous Coward]

Well, they *DID* get this spam (LONG before this slashdot post):

Dear Ixxnet
>
> Genuity has received complaints regarding the following Unsolicited
Commercial Email ("UCE") which appears to be sourced from or advertising
your URLs.
>
> UCE enclosed: 1
> NEWcomplaints: 1158
>
>
> We are hereby notifying you that you have violated the terms of Genuity's
Acceptable Use Policy (the "AUP"), which prohibits the sending of UCE. By
violating the AUP you are in material breach of the agreement between
Genuity and you (the "Agreement").
>
> You must take immediate action to discontinue the distribution, sourcing,
or advertising of UCE and ensure compliance with the AUP. If you fail to
comply with the AUP, Genuity may take any and all action against you as
allowed under the terms of the Agreement, including without limitation,
termination of services, suspension of services, or termination of the
Agreement.
>
> Please promptly investigate this complaint and report your resolution by
replying to this email keeping our ticket number in the subject line.
>
> Genuity thanks you for your prompt attention to this matter
>
> Regards,
>
> Genuity Network Abuse Team

this is at least two weeks old

[Anonymous Coward]

I'm in the process of selecting a new hosting provider, and I've been fishing the Verio account team's emails out of my quarantine folder since the first of November. I just love responding to them with the Spam Assassin body modifications right there in-line -- of course, they haven't commented.

Needless to say, the chances of my actually recommending them as a hosting provider are roughly equivalent to the odds of a squadron of flying pink poodles attacking Finland on December 32nd.

Re:who cares?

[one9nine]

Oh come on, what about that story about the giant squid!? Darrrrrrrrrrr it was 60' long, I tells ya, 60' long! And when they cooked it up and ate it, it tasted like Windex! Windex, I tells ya!

I also like seeing the litte piggy, weeeeeeeeeeeeeeeeee! So keep posting those spam stories. :-)

Hrm, isn't that John Gilmore's ISP?

[autopr0n]

IE the founder of the EEF and the guy who refuses to close is open mail relay?

Re:Hrm, isn't that John Gilmore's ISP?

[Anonymous Coward]

EEF? The Email for Everyone Foundation?

Re:Hrm, isn't that John Gilmore's ISP?

[billstewart]

Actually, you've hit a major irony, because Verio refuses to continue selling John Gilmore internet access. John was one of the members of The Little Garden internet access co-op (back before ISPs were common), which was businessified, then bought by Best, which was bought by Verio, which was bought by NTT.

But they will sell to spammers.

Re:Hrm, isn't that John Gilmore's ISP?

[Catbert66]

Actually, you've hit a major irony, because Verio refuses to continue selling John Gilmore internet access.

Gilmore wouldn't stop running his mail server as an open relay. He was warned repeatedly that his actions were in violation of Verio's AUP, and he flat-out refused to change things, even though there were other options to let his friends use his precious host from elsewhere without leaving the door wide open for any spammer to abuse it. As a result, every toad.com host I find goes onto my personal DNSBL forever. I don't have the time or energy needed to deal with machines wilfully configured to be insecure.

Verio already has a full DNSBL zone entry locked and loaded at blackholes.us. If and when they file their cartooneygram, it goes right into my sendmail configuration. So long forever, Verio; you can join Harris and all the others in the Eternal Bit Bucket.

I'll bet I'm not the only one who feels that way.

Just set up your Baysian Spam Filter...

[ksheka]

...That is, if you have Mozilla. :-)

Only the corporate site was blocked

[d2ksla]

but I'd rather see every spammer run rampant then restrict even one innocent party nobody cares about.

In the comment from Spamhaus it is clearly stated that only the Verio corporate mailserver is blocked in order to protect their ISP users.

Re:Only the corporate site was blocked

[Anonymous Coward]

Actually that isn't correct. Verio has two mail systems, one is their webhosting stuff and one is everything else. The "corporate" server where employees get their email is in the "everything else" which is what's blocked. But there's also a lot of customers served by that system, so while they ARE listing the corporate stuff they're listing a whole lot more too, whether they know it or not. (No I dno't know whether they know it or not, but I know for a fact they're blocking customers too, so their claim about blocking only corporate people is just plain inaccurate.)

Basically anybody whose mail isn't part of one of their web-hosting packages is on this blocked mail system. (Which includes me)

Is that why spam in my Hotmail account has dropped

[dustpuppy]

Hmmm ... i don't know if it cooincidence, but the spam in my Hotmail account has significantly dropped off ... from 30 to 100 spam a day down to 10-20 max ...

Viro when did you lose your way?

[red5]

A while ago I worked for a now defunct dot-com that dealt in e-mail marketing through opt-ins. When we moved to hosting through verio. They threatened to cut us off even though our mailings were opt-in, and sent from a different (non-verio) location.

Their anti-spam policies were so draconian that we had to move to exodus. When did they become pro-spam?

Re:Viro when did you lose your way?

[Jucius Maximus]

" A while ago I worked for a now defunct dot-com that dealt in e-mail marketing through opt-ins. When we moved to hosting through verio. They threatened to cut us off even though our mailings were opt-in, and sent from a different (non-verio) location. Their anti-spam policies were so draconian that we had to move to exodus. When did they become pro-spam?"

Maybe now that the dot-coms are defunct and not providing Verio with hordes or revenue, the company needs to find alternate sources of income.

Re:Viro when did you lose your way?

[Servo]

EXACTLY. Verio used to have something like 10+ hosting facilities in the US. They are now down to 2, with one "POP/colo room" connected to their NTT America office in NYC. (Verio is owned by NTT, the Japanese telephone giant, for those not in the know.)

They have 1 center on the west coast, and another on the east in Virginia (in the tech corridor near DC). I've been to the one in Virginia and to the one in NYC, since my employer provides services to them.

About 2/3rds of the Spam I receive at home is from Verio or Exodus. Both are VERY cash strapped, although expect to see Verio doing a little better since they consolidated their hosting faclities. Although 99% of my spam is now cleanly filtered out before I read my Inbox, I know it must be taking a toll on my provider. Twice in the last week the mail server has ran out of disk space and quit accepting mail.

The major problem with these "opt-in" marketing programs is that you might agree to signing up to one list, and then they automatically sell your information to illegal spammers, who pound you with email and won't quit. I think its pretty obvious that tradional advertising doesn't work, but instead of laying off for a while, they either go the illegal route, or pervasive route. (ok, both are pretty pervasive) Advertising works to a degree, but at what point do you stop? Is there no means that a company will not go to market a product? This is obvious fodder for a discussion in ethics in business.

Re:Viro when did you lose your way?

[John Jorsett]

The major problem with these "opt-in" marketing programs is that you might agree to signing up to one list, and then they automatically sell your information to illegal spammers, who pound you with email and won't quit.

Speaking of this, I have an account at Silicon Investor, for which I created an email address known only to them and never revealed on the message boards. I've lately started getting spam sent to that address. Clearly those bastards sold my address. Guess the tech crash has made sellouts of a lot of desperate businesses.

Re:Viro when did you lose your way?

[Servo]

Speaking of this, I have an account at Silicon Investor, for which I created an email address known only to them and never revealed on the message boards. I've lately started getting spam sent to that address. Clearly those bastards sold my address. Guess the tech crash has made sellouts of a lot of desperate businesses.

Personal information has become a cash commodity. Company's are doing whatever they can (legally, illegally, and pseudo-legally) to stay afloat. This just proves how bad capitalism really is if left unrestrained.

Spam for Collectionists

[Lord_Sy]

Dozens of the same e-mail (promoting a "Horny Black Sluts" site) reached my mail server; all with different subjects and remitent addresses, and most of them within a single period of less than 15 minutes.
I guess it was one of the most aggressive spamming campaigns I have ever been victim of.

Now, those who support these spammers will have to suffer the consequences. But, who will have to pay the bandwidth when my E-Mail Backup service provider come to tell me that I've reached the limit?

Re:Is that why spam in my Hotmail account has drop

[BrookHarty]

Mine also, and I asked a couple friends who run ISPs, one in Japan, they also noticed a drop in spam. Could this "Mike and Andrew" health labs really be doing 50% of the spam in the USA?

sounds like my university

[ejaw5]

I work at the help desk at my univeristy (which I will not disclose) and for a while we kept getting spam from email addresses that were from a particular ISP (which I will also not disclose) in the help desk inbox. So the network admins blocked email connectivity to that ISP, but later we got calls from students using the blocked ISP reporting problems receiving mail from the university email accounts. So the admins had to unblock the ISP.

**I dont have the exact details on what was blocked from the ISP.

Re:sounds like my university

[Anonymous Coward]

Wow, that was an informative post.
Basically, "We blocked some unknown things from an unknown ISP, but then we had to unblock them. I'm not sure who we are either".

Re:sounds like my university

[Anonymous Coward]

Sounds like WTAMU and ARN.net....

Re:sounds like my university

[Anonymous Coward]

Spammers forge e-mail addys all the time...

Why content filtering is not enough

[Frater 219]

The technology is out there, in the form of Bayesian filters, and is nearly perfect.

Bayesian filters, SpamAssassin, and other client-side content filters can indeed reduce the amount of spam that you see. As such, they can reduce some major costs of spam for the average Internet user, small site, or business: costs such as annoyance, offense, wasted time, and harm to productivity thereby caused -- that is to say, the end-user costs of spam.

However, they have no effect on the cost of the bandwidth and other resource costs of spam, which are substantial for large ISPs and large businesses -- and for the Internet as a whole. In order to perform content filtration on a piece of mail, you must receive it and store it first, which has its costs. (Consider that large ISPs regularly report that anywhere from one-third to two-thirds of their mail is spam.)

Only forms of spam filtration which do not permit the spammer to send the spam to your mail server can reduce the bandwidth cost of spam. In practicality, that means filters which apply to one or more of the following (in increasing order of cost):

1. The sending host's IP address;
2. The sending host's DNS name or other IP metadata; or
3. The contents of the SMTP envelope, that is, the arguments to the MAIL FROM and RCPT TO commands, or other sender behavior prior to the DATA command.

(Note the SMTP envelope is not the same as the mail headers, which are part of the SMTP DATA. An SMTP server is permitted to reject mail before DATA, but is not allowed to drop the connection in mid-DATA. If you do not understand this, read RFC 2821.)

DNSBLs -- such as SBL, MAPS RBL, and SPEWS -- all apply to the IP address of the sending system. Domain-based rejection lists (which are not commonly published) apply to the DNS name of the sending system. RHSBLs, and relay checking, apply to the SMTP envelope.

Keep also in mind that one function of some (but not all) DNSBLs is not merely to filter out spam, but to discourage it from being attempted in the first place. By rejecting mail from networks which have proven themselves to tolerate spammers, we tell network operators that if they wish to be able to send us mail, they must kick off their spammers. It's their choice which they do; they just have to choose which is worth more to them: being able to send mail to sites that don't like spam, or being able to host network-abusers with impunity.

(Incidentally, you will find precious little sympathy for calling spam filtering "censorship". Censorship, as those who have experienced it understand, happens when some party uses violent force to stop a view or expression from being published by its advocates (at their cost). Spammers aren't trying to publish their views at their own cost and being violently restrained from doing so: they're trying to steal the use of others' equipment to publish their stuff.)

Re:Why content filtering is not enough

[CoolVibe]

Content filtering helps. The more users use content filtering, the less of the spammers' messages gets seen by the users, and it will make mass-mailed advertising scams profitless, and if that's successful, spam dies.

Sure, DNSBLs and other blacklists help. They should be used. The content filtering is just perfect for covering that last mile (if spam passes all the blacklisting mechanism). It _might_ deterr spammers from spamming, but I doubt it. Spammer notices that his last mailing bounced, and he uses another open relay.

If a spammer knows that Bayesian filters and Spamassassin/Razor type content filtering are widely deployed, it will act as a quite effective deterrant for sending spam. Maybe.

What really needs to be done is EDUCATE isps that an open relay can get you in a whole heap of trouble. Of course many have closed their relays, but a lot still have open ones. Especially administrators in the Middle East and Asia need to be LARTed badly, since that's where 90% of my spam is relayed from. Once all open relays are killed, the spammer has only 2 alternatives, either set up his own SMTP, or use the one his ISP allocated to him. Both are easy to track and put an end to. The spammer would have to register for a new account and the more often that happens, the sooner his/her name will be blacklisted. Heck, if anti-spam laws are legislated, the spammer could end up in jail. Jail is the ultimate deterrent. There's nothing like the prospect of being assraped by Bubba to deterr spammers.

With respect to the "filtering spam is censorship" comments, well... Content filtering is my way of plugging my ears with my fingers because I do not want to know what you are trying to sell me/scam me into. The DNSBLs are a LART to teach the admins not to run an open relay.

Re:Why content filtering is not enough

[Frater 219]

What really needs to be done is EDUCATE isps that an open relay can get you in a whole heap of trouble. Of course many have closed their relays, but a lot still have open ones.

"If we close the open relays, spam will go away" is actually what a lot of spamfighters thought five years ago. A common opinion then was that spam was basically a technical problem, like a security hole or smurfing, and that applying the appropriate technical fix to mail servers would prevent it.

Unfortunately, that hasn't worked. First off, open relays are not the only technical problem that makes spamming easier. Open proxies are just as common today -- and worse, since they hide the tracks of spammers. (They're also used by all sorts of other abusers.) Moreover, open proxies are harder to get people to close down, since blocking access from them to mail servers doesn't usually affect their legitimate users -- and thus doesn't draw their attention.

Second, it has been increasingly realized by most spamfighters that spam is a social problem, not merely a technical one. The problem isn't just that there are abusable resources, but that there are people who are willing to abuse them for profit, and other people who are willing to aid and abet those abusers in order to reap a share of that profit.

As a parallel, consider burglary. Sure, it is good to employ technical means such as deadbolt locks and alarms to block or deter burglars -- but nobody thinks that burglaries are solely technical problems, and that we should pursue only better locks rather than the arrest of burglars. Burglary is a social problem; specifically, a problem caused by some people's willingness to violate others' rights. We call those kind of problems "crimes".

Spam is a particularly frustrating crime since anyone who considers the proprieties of the situation can recognize it as lawless, but few legislatures have chosen to formalize its criminality in statute. It's lawless because it defies the property rights of mail server owners, alienating their resources for the spammer's use without permission. That's often covered by statutes regarding theft of service, computer crimes, or various sorts of tort, and there have been a number of cases wherein spamming was recognized by judges and juries as such. However, in many jurisdictions there's no statute to point to that says "spamming is a crime".

Third, there's also an social-technical problem. There's a small number of crooks who can profit themselves greatly by finding means of sending spam. Each of them has a much greater incentive to locate these means than any individual spamfighter does. This is a social problem in a different sense: insofar as spamfighting relies on discovering paths for spam propagation and getting them shut down (e.g. closing open relays) the crooks are always going to be several steps ahead.

By targeting organizations and persons known to be sources of spam, rather than the victims they exploit to send that spam, we can get around that problem. The number of large-scale spammers is actually rather few. Steve Linford's ROKSO (Registry Of Known Spam Operations; same guy as the SBL) lists around 100 organizations which have been thrown off of ISPs three or more times for spamming.

Fundamentally, I agree with you that the problem is one of education. However, it is not merely the education of ISP technical staff that must take place. It's the education of everyone involved -- technical staff, their managers, mail software authors, spammers, the legal system, spam recipients, and businesses that might consider spamming. Everyone needs to wise up about spam.

Re:Why content filtering is not enough

[CoolVibe]

[lots of very good arguments snipped]

Fundamentally, I agree with you that the problem is one of education. However, it is not merely the education of ISP technical staff that must take place. It's the education of everyone involved -- technical staff, their managers, mail software authors, spammers, the legal system, spam recipients, and businesses that might consider spamming. Everyone needs to wise up about spam.

Exactly. I couldn't have said it better. I urge the moderators to mod this posting to +5 insightful.

The law problem is a sticky one due to them being enforced (or not) locally. With locally I mean per country/state. If one state/country outlaws spamming, spammers will just move to a place that doesn't enforce or have spam laws. Maybe what people in high places aren't realizing is that it's a global social problem.

The people that are actively providing devices (DNSBLs, content filtering, etc.) to fight spam are fighting a worthy cause. I benefit from them. My mailboxes would be unusable if it weren't for them. The problem is that _I_ am technically adept enough to set these countermeasures up for myself. The technical have-nots in my direct neighborhood drool at my efficiency of killing spam, but if I explain them how I do it, their eyes glaze over. It must become easier to use the tools out there. I'm all for ISPs taking initiative to e.g. tag spam (like my upstream ISP does). The spam filtering offerings in mainstream software (like Apple Mail, Mozilla, etc.) is a good thing.

On a side note: I wonder when MS will finally put this in their MUAs (hey, a new technology' to embrace and extend), or if such a filter is available for LookOut from a third party.

Re:Why content filtering is not enough

[darien]

On a side note: I wonder ... if such a filter is available for LookOut from a third party.

http://popfile.sourceforge.net - it's a local proxy, so it works with any POP3 mail client. And it is very elegantly conceived, and probably nearly simple enough even for those drooling technical have-nots in your neighbourhood. So go and download it, and be nice to the author.

Re:Why content filtering is not enough

[Grizzlysmit]

That's often covered by statutes regarding theft of service, computer crimes, or various sorts of tort, and there have been a number of cases wherein spamming was recognized by judges and juries as such. However, in many jurisdictions there's no statute to point to that says "spamming is a crime".

That would be a start but we need to go further, we need to fine these dirt bags good and proper, and deal especially hard with repeat offenders, something like a third time and we take everything you've got assets, money, the lot. with further offences ledding to public shaming, Gaol etc.

Re:Why content filtering is not enough

[mrneutron]

> However, they have no effect on the cost of the
> bandwidth and other resource costs of spam

Not true. Many spammers include unique URLs within spam that are tracked when a user clicks (or even previews via Outlook) on a spam. This proves a spam was actually viewed, and these views are tracked closely. An email address that is proven to view spam is worth much more to spammers than one that isn't, and these addresses are bought and sold at a premuim.

Any account that views spam will eventually receive a lot more spam than one that doesn't.

If you stop the views, you slow the spam.

So this helps the bandwidth problem, especially in the long run.

Re:Why content filtering is not enough

[Frater 219]

If you stop the views, you slow the spam.

Good point. The appropriate "client-side filter" to accomplish this, though, is not to use an email client that takes network action at the behest of an email message.

Spam isn't the only sort of malicious mail that should caution us against allowing mail clients to go download stuff off the Net automatically. If someone wanted to DDoS a Web site inconspicuously, they could do pretty well by sending out spam that included an expensive dynamic page at that site in an IFRAME ... or 100 such IFRAMEs per message.

Re:Why content filtering is not enough

[greyguppy]

Here is an entry for ElcomSoft LTD in Russia on ROSKO. Isn't this the same company that employed Skylarov. Were we all defending a mass Spammer? Where would our loyalties lie if a russian spammer was arrested on trumped up DMCA violations?

Re:Why content filtering is not enough

[minas-beede]

"What really needs to be done is EDUCATE isps that an open relay can get you in a whole heap of trouble."

There's a lot to discuss here. An "open relay" can be a superb anti-spam weapon, for one thing. It's dirt simple: accept relay mail, deliver test messages, don't deliver the rest. This can be an IP-nameless box. The only email it sees will be spammer email - whack the spammer when he sends it. It's 100% accurate.

Then there's the rather obvious truth: open relays exist and will continue to exist. Bitching and moaning about them doesn't help (attempts to contact and assist the operator might.) But why wait for all open relays to be secured? If you dilute the pool of apparent open relays with fake ones the spammers are screwed. That's enough. Putting the focus on the open relay operators takes the focus off those who are the real source of the problem: the spammers. Continue doing whatever you do about open relays if you want, if it does any good at all. ADD to that fake open relays (open relay honeypots.) Then you start to fight the spammers at the relay level. When enough fight the spammers at the relay level the spammers lose. Forever.

Same for open proxies.

Re:Why content filtering is not enough

[macdaddy]

"Sure, DNSBLs and other blacklists help. They should be used. The content filtering is just perfect for covering that last mile..."

Correct. I word it differently though. No good defense in comprised of a single layer. Every defense has multiple layers. With regardles to spam filtering, the first layer is DNSBLs at the MTA level. Next would be RFC2822 sanity checking at the MTA level (example, is the MessageID borked). The next layer is server-side scoring with tools like SpamAssassin. As an additional option your LDA can use the scoring to discard, or file certain matches in specific mail spools. Everything else is done at the MUA level with user filters, hopefully using the scoring mechanism's output. That's the way it should work.

Now if your institution can stand little to no false positives then this process should still apply to you, but with a few changes and restrictions. The DNSBLs used at the MTA level for message rejection should be limited to only those DNSBLs that list misconfigured servers (open relays, open proxies, vulnerable formmail.cgi machines, etc...). You could also say that direct-to-MX blacklists could also be used with no expected false positives. The other types of DNSBLs are more subjective and *could* give you false positives. I didn't used to consider Spamhaus to be very non-subjective, assuming they only listed the spammers. However I now have to consider them subjective since they listed Verio and not the spammer (not that I hold that against them. I'll still use the SBL until the day I die. I just have to look at them in a slightly different light). SPEWS is very subjective; I use it heavily though. Country-code DNSBLs, will not subjective, will give you numerous false positives. You should stilled rejected malformed messages with at the MTA level. You should still use Spamassassin. However you should raise your personal filtering rules by 3-4 points if you want practically not FPs. You can also use the DNSBLs that are subjective (or country-coded) in SpamAssassin scores. Set each one's score to .5-2, depending on your taste. At the LDA level you can still automatically organize your incoming mail into spam or not spam. However you should probably not delete incoming mail unless it has a very high score. At you MUA level you should also not auto-delete mail unless the score is very high. Making these changes to your setup will reduce you FP rate. Personally I use the first setup.

Spammers can kiss my spamhole, and you can quote me on that.

Re:Why content filtering is not enough

[macdaddy]

" Open proxies [monkeys.com] are just as common today -- and worse, since they hide the tracks of spammers. (They're also used by all sorts of other abusers.) Moreover, open proxies are harder to get people to close down, since blocking access from them to mail servers doesn't usually affect their legitimate users -- and thus doesn't draw their attention."

Additionally it's also harder to get proxies closed because every 3rd Joe has one and any old Joe can run one on his DSL/cable-connect PC. In other words there isn't a competent admin behind the wheel whereas most production mail server generally have someone responsible for the machine even if they might not be competent.

Another problem that I see is MTAs that are still configured as open relays out of the box even today. Exchange has always been this way to the best of my knowledge. Are the later versions this way too? I'd have to say that all the IPs I relay check and find to be open, 95% of then are Exchange boxes. The other 5 percent oddball mail gateways or really really old Sendmail installations. I asked Joe Jared if he'd consider adding the MTAs HELO string to the message that rbcheck mails him and keeping track and graphing which MTAs are most often an open relay. Exchange would be the hands down winner.

Re:Why content filtering is not enough

[Frater 219]

Isn't this the same company that employed Skylarov. Were we all defending a mass Spammer?

Elcomsoft has indeed sold a number of products which are indefensible spamware, specifically a program IIRC called "Advanced Email Extractor", a Web spider that extracts email addresses from Web pages. Elcomsoft spamware is largely distributed through mailutilities.com which in many ways seems to be a front, and is certainly very circumspect. That site's policy states that they will refuse to provide technical support to those who use their software to spam ... but it is easy to lie.

Are Elcomsoft products used to spam? Doubtless. Are they also used for other things? I don't know.

Does this mean that Dmitri Sklyarov is or was personally an author of spamware? We can't tell. I'm not sure how large Elcomsoft is, but it probably has several programmers, and Sklyarov may not have worked on these particular products. He certainly worked (works?) for a company that profited from spamming, though.

If Sklyarov wrote spamware, does that make him a criminal? Probably so in some jurisdictions; likely not in Russia. Does it make him crooked? By my count, yes: creating tools with the intent that they be used for lawless purpose is crooked behavior.

Does any of that justify his treatment by agents of the United States government? No.

while you may thank verio for spam

[Anonymous Coward]

while you may thank verio for spam, you should also thank it for goatse.cx

OS Server Last changed IP address Netblock Owner
Linux Microsoft-IIS/5.0 9-Oct-2002 198.247.175.96 Verio, Inc.

There ought to be a law...

[cperciva]

We really need a law which requires Internet service providers to publicly disclose their terms of service -- that is, publicly disclose what terms of service they actually enforce.

After all, it's really just a consumer protection issue: Verio claims to have an active abuse department, and is thereby misleading people who assume that spammers on Verio's network will be shut down.

Re:There ought to be a law...

[evilviper]

The US government doesn't even uniformly apply their own laws... How do you expect them to demand companies do?

Re:There ought to be a law...

[cperciva]

The US government doesn't even uniformly apply their own laws... How do you expect them to demand companies do?

I'm not USian, so I may be entirely wrong here... but isn't it possible to prosecute someone privately? Ie, you think they've broken the law, the police don't want to file charges, so you file them yourself (and take the place of public prosecutor)?

It would be perfectly good enough if third parties could take an ISP and a spammer to court and get the court to order the ISP to enforce their abuse policy.

Re:There ought to be a law...

[AntiFreeze]

I just had an interesting idea after reading your comment and this comment.

What would happen if spammers were forced to add a "Precedence = spam" (P=S) (or something other than "bulk") line to the mail headers?

I think there would be two immediately helpful results:

• Users could instantly filter all spam out at their end.
• ISPs (rather, routers in general) could instantly filter out spam passing through their systems.

An ISP could say in its user agreement that one could send spam from their servers as long as it contained a P=S header line. Or there could be a law on the books requiring spam to contain the P=S header line. I feel this is good because it does not make spam illegal (I feel that would be going too far and would probably be too hard to police) but it does make it manageable.

With this in place, ISPs could easily manage their spammers and their spam. Users could easily manage their incoming spam, and miscellaneous routers all across the internet could easily dump spam trying to take up precious routing time.

Of course, this has its shortfallings. It would only apply to spam coming from ISPs with such rules and from jurisdictions under such laws. That said, I bet it would significantly cut down on the amount of spam, and the locations where such spam could originate from.

So, am I making sense or being ridiculous?

Re:There ought to be a law...

[Shadoweb]

Except that you have no legal standing to enforce a contract as a third party. You must be a party to that contract to have any legal standing to demand it be enforced.

It would not be perfectly good enough, it would be outright ludicrous to allow third parties to claim any legal standing in contracts they are not a party to.

Re:There ought to be a law...

[Planesdragon]

I'm not USian, so I may be entirely wrong here... but isn't it possible to prosecute someone privately? Ie, you think they've broken the law, the police don't want to file charges, so you file them yourself (and take the place of public prosecutor)?

IANAL--but I don't think so.

Unless the crime is also a tort against you, I don't think you have standing to sue.

However, if you're harmed by the crime and the DA doesn't prosecute--and they've got ample evidence to convict--you might be able to take the DA to court to force the issue.

'course, that was something I saw on Law & Order, so i have no idea if it's true or not...

It would be perfectly good enough if third parties could take an ISP and a spammer to court and get the court to order the ISP to enforce their abuse policy.

If you get spammed via an ISP's misconduct and suffer damages (lost work, wasted time, etc.) you probably have standing to take the ISP to court to force them to properly secure their system.

Unfortunately, if you've got the kind of money/time to be taking ISPs to court for a nuciance, you probably can just get real spam blocking installed...

Re:There ought to be a law...

[karnal]

You make a good point, but the 2 things you recommend would autmatically happen.

1. Joe Blow, who doesn't want to see anything but the e-mail from his family, will learn to filter out all that spam via that spam precedence.
2. All isp's will halt e-mail at the routers, seeing as it churns up bandwidth better served servicing their customers.

In the end, it would be a crap shoot. Spammers just wouldn't put the proper (whatever) in the headers.... kind of like when people rip a cd, they quietly ignore the copy-protection bit... :)

Re:There ought to be a law...

[benedict]

If the convention were widely enough accepted to
be useful, then some spammers would stop using it.
And some desperate ISP would serve them, and we'd
be right back where we started.

Re:There ought to be a law...

[AntiFreeze]

But yeah, that's exactly my point. One of the most effective parts of my method is that it would corral the spammers to said desperate ISP, and then they'd be easy to block. If you know where the spam is coming from, it's easy to deal with.

My method does not get rid of spam, it just makes it easy to identify at a very basic level.

Re:There ought to be a law...

[AntiFreeze]

Yup, and that's exactly what it's meant to do.

If Joe Blow doesn't want to recieve spam, he can stop it. All of it.

If Random ISP doesn't want spam coming through its servers, done.

For everyone else, the spam can continue to flow.

In other words, if you don't want to see it, or it is costing you money, you can stop it. If it's harmless to you, or you don't care, or you're intrigued by some of the offers you recieve, then perfect, you can get that spam.

My method gives users and ISPs the option of what to do with spam. It doesn't get rid of it and it doesn't make it more rampant. And I think it's what people want, options. If you're just bombarded with it, and there's nothing you can do about it, then it's annoying. If you could turn it off at the snap of a finger, then great! That is what I propose. Nothing more, nothing less. Not a full solution, just a simple way of dealing with the issue which lets people choose what they want.

And I think it would work for the majority of spam. Not all spam, but most of it. And that, to me, is a Good Thing (tm).

Re:There ought to be a law...

[Anonymous Coward]

How exaclty does an ISP "halt e-mail at the routers"?

A router usually only works at a layer 3 level, shifting IP packets. For it to do anything intelligent such as look at the content of those packets requires massive overhead.

I think I understand what you're getting at, but it won't be routers stopping spam (unless you're blocking source IP addresses which block both legit and spam email) it'll be an end point mail server.

Re:There ought to be a law...

[Dimensio]

It is well documented that spammers have no concern for laws or ettiquite. It is also documented that spammers are all liars. Any spammer caught not adding the proper tag would simply lie and claim that the mailserver ate it.

Further, that does not solve the ultimate problem of spam, in that it costs the receiving ISP to accept the messages.

A better solution would be to physically tag all spammers. I'm thinking that it would be best done with a small lead 'tag', injected into the head with a combustion-powered device called a "Glock".

Re:There ought to be a law...

[Merk]

Are you on crack?

The whole thorny issue with spam is that it's hard to stop. If it were as simple as requiring that "spam" have a special identifier it would have been done long ago. There are three major problems with this:

1. Spam is hard to identify, is it spam when you fill in a form to download some software and you get annoying email because you (maybe) forgot to tick the "don't send me email" box?
2. Spammers will ignore a law that hurts their bottom line, and when confronted they will use #1 saying they're not sending spam, they're sending opt-in mailings or something similar.
3. Spam is an annoyance so law-enforcement entities, if they bother investigating it at all, puts it way at the bottom of their list of priorities.

What you're suggesting is equivalent to making a law that any pool-shark warn the people he plays that he's a pool-shark. What would happen? Would pool-sharks actually start telling people "I'm a pool-shark, and I'm required to warn you of that before we play, still want to play?" No! They'd just find a way around the law by becoming "secret pool teachers" or "very lucky players".

Re:There ought to be a law...

[Anonymous Coward]

Some ISPs do just that -- halt *all* traffic from spamblocks at the routers. I'll let you figure out the how part.

Re:There ought to be a law...

[AntiFreeze]

Okay. This is the first valid objection to my idea, so I'll go point by point.

Am I on crack? Not to my knowledge. But is this a crazy idea? Absolutely. Remember the Niehls Bohr quote "We are all agreed that your theory is crazy. The question which divides us is whether it is crazy enough to have a chance of being correct."? Hell, if there's any place to place crazy theories, it's slashdot.

1. Good point. opt-in mailings, opt-out mailings, etc. all sort of get around my method. I have no idea how to deal with this, short of setting a Precedence = opt-in head flag. Problem is, with this flag, the waters are much murkier than with a spam flag (and harder to determine whether or not to filter).
2. Ignoring the law? I'll get back to this in a minute, but I think this problem is solved by how the Precedence = Spam (P=S) rule would be applied.
3. Annoyance to law enforcement? The trick is to make it so that law enforcement doesn't need to deal with it at all (or at least only rarely). I'll get back to this in a minute too.

Eh, I wasn't attempting a Megan's Law type of approach (the law which requires sex offenders to notify those in their neighborhood of their crime, conviction, and where they live). Changing labels is tough to deal with. Here's my approach:

If there were a blanket law, it should be that ISPs must deal with any user which has more than X unique complaints concerning spamming by either cancelling the account, forcing a P=S flag onto all their outgoing email, or making sure the user stops spamming by other means left to the ISP. This really only leaves the ISP with two options, and forces users to either not spam or spam with a P=S flag if they're using one of the ISPs under the jurisdiction of the law.

Now this does two main things. 1) It shoves enforcement to the ISP, after all, it's the ISP's user which is spamming, and what the ISP can do is clearly outlined by the law. Just dump the user if you don't want to deal with their spamming, you are allowed by law. 2) It would set up "rouge" ISPs which don't adhere to the law. If you know which ISPs allow spamming, they're easy to block, so this really isn't a large problem.

But here's my problem with the method: it feels too much like the Scarlet Letter. The circumstances are a bit different, but forcing someone (or something, even email) to have a unique identifier so you can identify it as something you might want to avoid is a very sketchy idea. It's also probably not constitutional (equal protection... even for spammers?).

That said, I think there is something to be said for my idea. It is flawed in certain areas (I still haven't given a good answer about enforcement of the laws/rules). It still lets spam flow freely (which I feel is a good thing) but gives people the ability to quickly filter it out. It still only affects spammers under its jurisdiction. If it worked, I'd be willing to be that somewhere between 70 and 85 percent of spam would be marked as such. And even if those numbers were lower, it would drastically reduce the amount of unwanted spam people got, as well as making it much easier for spam to be dropped at routers all over the internet (thereby alleviating the costs incurred by spam on so many systems).

Hell, it's just a crazy idea.

Re:There ought to be a law...

[evilviper]

There is 'Civil' and 'Criminal' law... If the DA (district attorney) does not bring criminal charges against someone, that's the end of that.

Civil laws, on the other hand, are person-to-person type disagreements. They can be brought by someone who has been harmed, against the one that caused harm.

It's a big difference there worth noting. Neither is in lieu of the other, and civil lawsuits cannot put someone in jail as criminal lawsuits can.

As far as suing an ISP, it is a murkey area. If spam from an ISP has caused significant damages to you, then you can certianly attemt to sue them. The problem is, the courts can't decide if ISPs are common-carriers or not. If they are, then they are not responsible for things that happen on their service (just as the phone company can't be sued just because someone makes illegial use of a telephone). If they are not common carriers, then they do have a responsibilty regarding the use of their service, and can be held responsible.

Now, you can currently sue them (without any additional laws) on that basis, but it's new law, so you can't be sure which way the judge will rule.

Re:There ought to be a law...

[Anonymous Coward]

Yes, from spam BLOCKS. ie blocks of ip addresses.
This has NOTHING to do with looking at the content of the IP packets passing over the router to see if they're spam or not!

Re:There ought to be a law...

[Anonymous Coward]

1. Spammers won't use the header.
2. Spammers use their own server or hijack other peoples, their ISP never touches their mail.

The biggest problem is that you ENABLE bad behavior. You haven't removed the cost-shifting of the advertising to recipient, who will now get degrees more spam (and degrees more cost). Once you've given a green light for the spam, watch the spam turn into megabyte sized flash movies.

Also, your flag is in the DATA stream, not the envelope, so the mail server has to accept and process the entire message before acting on it - again, increasing the costs to the recipient.

Spam filtering is only COST effective at the server level and the data available before the DATA - that leaves you with the IP address, the mail from (forged) and the rcpt to (you). Since (you) want mail, and (forged) is unreliable to filter on, you're left with filtering on the IP. Thus, we have IP and DNS based block lists.

All the posts about content filtering are clueless Slashdot wanks.

Re:There ought to be a law...

[Sylver Dragon]

Actually, we have one of these here in California. It requires that all advertisments have an ADV: at the beginning of the subject line, and that all adult advertiments have an ADLTADV: at the beginning of the subject line. This is for both outgoing mail, and mail that is sent to people here in CA. The problem that we face is enforcement. First, its a criminal law, as such, the suit must be brought by the state, not individuals. Second, it is kinda tough to enforce, the spammers are pretty slippery.
Now if we could get something like this at the federal level, ya it might work better. Also, I would like to see it made into a civil law not just of a criminal one. (i.e. if someone spams me without the appropriate subject header I can sue them in small claims court.)

Re:There ought to be a law...

[mindstrm]

Guess what. Spam in most cases it NOT illegal.
And it's only an abuse of the terms of service if those terms specify that SPAM is not allowed.

Guess waht.. I'm sure Worldcom's peering agreements with it's cousins up there in backbone-land don't say anything about spam.

If I have my own network, and you want to peer with me, it is up to the two of us, and NOBODY ELSE, what the terms of that agreement are going to be.

Some ISPs sell connections to spammers, knowingly and outright.. because they are paying customers, and because they can.

Re:There ought to be a law...

[mindstrm]

And unless you can show real significant damages, and a real misconduct, you will have no case.
Spam is in most cases not illegal.

As much as poeple like to say how it's stealing their time, and how the receiver pays for it.. unless you can show how it really cost you a decent amount of money, you have no case.

If you received, say, hundreds or thousands of spams in one day from one individual, yes, you could argue that was irresponsible and cost you a great deal of time to sort out.

Which misconduct is it? The isp is under no obligation NOT to allow spammers unless they choose to.

Re:There ought to be a law...

[Black Copter Control]

2. All isp's will halt e-mail at the routers,

You can block emails at the server, once youget the precedence:Spam header. On the other hand, once you've gotten enough spam from a given server, you can send a request to your routers to block that IP address. -- and it's not like the sender can't say that they didn't do any spamming because it's right there in the headers.

DNS Question...

[SpaFF]

From the google groups posting about this:

I will conclude by noting that the ixxnet.net autonomous
system was created on 25 july 2002, so it is now in its
third month of life; and that the ixxnet.net DNS seems to
have been put together by the same incompetent that
configured dialnil.com DNS (hint: MX).

What excatly is so incompetent about the DNS configuration? I did a host -t MX ixxnet.net and didn't see anything out of the ordinary?

-Lee

Re:DNS Question...

[Anonymous Coward]

They have IP addresses in their MX records. This is against RFC.

from a dig mx ixxnet.net:

ANSWER SECTION:
ixxnet.net. 1H IN MX 5 mail.ixxnet.net.
ixxnet.net. 1H IN MX 4 66.25.224.10.

And from a dig mx dialnil.com:

ANSWER SECTION:
dialnil.com. 59m51s IN MX 4 216.21.32.14.
dialnil.com. 59m51s IN MX 5 mail.dialnil.com.

RFC 1035 - "Each MX matches a domain name with two pieces of data, a preference value (an unsigned 16-bit integer), and the name of a host."

http://www.isc.org/ml-archives/bind-users/1999/0 8/ msg00150.html

Re:DNS Question...

[next_permutation]

host -t mx ixxnet.net
ixxnet.net. mail is handled by 5 mail.ixxnet.net.
ixxnet.net. mail is handled by 4 66.25.224.10.

MX must be a host name; an IP address is not acceptable. There are other suspect things about their DNS configuration, but that's probably what the Usenet post was hinting at.

Re:DNS Question...

[Anonymous Coward]

I'm guessing you shouldn't use an IP in the MX.

C:\WINNT>nslookup -qt=mx dialnil.com 205.152.0.20
Server: ns.atl.bellsouth.net
Address: 205.152.0.20

dialnil.com MX preference = 4, mail exchanger = 216.21.32.14
dialnil.com MX preference = 5, mail exchanger = mail.dialnil.com

Re:DNS Question...

[Anonymous Coward]

MX records pointing to IP addresses.
Haberli is counting on having his DNS terminated, I guess. He should, anyway.

[DialNIL and IXXnet are both spam operations, run by the professional (uhm) spammer known as Ernesto Haberli]

At your local deli?

[jamesjw]

What about Mr Lucas, the local butcher, prevayor of all things meat?

I bet alot of SPAM originates from him, and your never sure of its source.. it could have come from anywhere..

It could be local or it could be foreign spam..

I say we arrange a protest at his door and block any spam originating from his premesis, and only let valid meat products through..

male oriented spam

[Anonymous Coward]

I've yet to see a single advertisement about reducing a woman vagina. It should have an effect equivalent to enlarging the partner's penis. Why isn't the idea popular?

Re:male oriented spam

[cyril3]

the size of the vagina is related to the expected size of the head coming out not that going in.

Re:male oriented spam

[warpSpeed]

the size of the vagina is related to the expected size of the head coming out not that going in.

and if you have ever seen a head coming out you have new found respect for the female of the species. It is a good thing that women generaly only focus on the happy part (holding the baby) after a birth experience, otherwise humans would not have made it this far.

Now, what does this have to do with SPAM? Every spammer has a mother, somewhere. These mothers must have abused them as children

Spamhaus slashdotted!

[Mark19960]

oh, no! the spam will get thru!
stop this slashdotting immediately!

Screw more laws, just ban IPs via smart networks.

[Anonymous Coward]

More legislation? More bullcrap solutions like Spamcop.net? Hell no. We need to go the way of the Distributed Checksum Clearhouse and Brightmail. The moment we (as a network of companies and admins running SMTPs and MTAs) detect spam being received, we report the full headers and decide if we wish to actively block, filter, tag, etc.

And, as ISPs, we simply have to monitor our resources more carefully. If we detect a lot of broadcast activity (i.e. outbound SMTP traffic) we're notified and we investigate. We collaborate.

Real technology can block spam. Laws and crap like Spamcop just make more red tape and are half ass solutions.

A temporary fix

[Gary Franczyk]

Stopping email from the Verio domains is going to cause more pain than it will help. It is only a matter of time until the spammers find some other vendor to help them send their ads. Money talks, and in an open market, someone will provide the goods.

I honestly believe that the only way to free ourselves from spam is intellegent filtering. Making it illegal will only cause the spammers to move overseas, if they even notice the law at all. The internet is far too large an entity to make a difference by blocking the IP addresses of spam-friendly domains. It won't put a dent in the real problem.

Re:A temporary fix

[Anonymous Coward]

Which is why you make it painful. They may make money serving a spammer, so you make them lose money for doing it, too. If the costs outweight the benefits, they won't do it. (Or if they do it, they'll go out of business eventually.)

Re:A temporary fix

[LostCluster]

What this is designed to do is to make an example out of Verio. If an ISP hurting to make reveune targets agrees to look the other way towards spammers, that ISP will find itself in the black hole, and end up losing legit customers (whether they walk away in protest after hearing of the RBL, or simply because they think Verio's too clueless to get their e-mail to work) which negates the spammer income and then some.

Yeah, it's cat-and-mouse, but eventually the mouse will run out of places to hide. There are a finite number of backbone providers in this world.

Re:A temporary fix

[Halo1]

Note: all mail from verio isn't stopped, only the mail sent through their corporate mailservers (ie. those used by upper management). Even the spammers won't notice the block (except when, hopefully, their lines are cut).

Re:A temporary fix

[MS]

No!

The only way to stop the spam-problem is by decent laws. But until the US-Government doesn't understand that it's role should be to protect consumers not the spammers pockets, the only way we can make spammers and ISPs understand we do not toplerate their behaviour is by blocking their IP-addresses.

In the European Union we have effective anti-spam directives, and many countries have already put them into law. If you get any spam coming from Italy, you may successfully report the spammer to the Italian "Garante", and get a compensation of 250 Euros for damages. Spam from Italian firms has nearly come to a halt! And italian people getting spammed by italian firms have successfully earned 250 Euro for *each* received spam.

Hopefully the US-Government too will become serious soon!

ms

Re:A temporary fix

[neillewis]

Intelligent filtering is going to be a temporary fix too. We're going to end up in an arms race where there'll be (contradiction in terms...) Intelligent Spamming(tm).

I use SpamAssassain, and it's great, but I just know if it were more widely used spammers would soon learn not to put multiple exclamation marks at the end of theiir Subject: lines.

Re:A temporary fix

[Phroggy]

Stopping email from the Verio domains is going to cause more pain than it will help. It is only a matter of time until the spammers find some other vendor to help them send their ads.

Good! If the spammers find some other vendor, this means Verio will stop getting their money. This means Verio does not profit by disregarding their own AUP. This means Verio will (hopefully) be less likely to knowingly provide service to spammers in the future. That would mean that the next time the spammers need to find some other vendor, they'll have one less other vendor to choose from. Lather, rinse, repeat.

Re:A temporary fix

[mindstrm]

Yes, money talks.
And nobody owns the internet.

Blocking verio helps because, when verio customers get angry, and leave, verio loses money. Hence, verio has a financial incentive to fix things.

You can apply financial pressure to people by taking away their money, as well as spending your own.

Yes, the spammers can go elsehwere, and eventually, the number of places that will deal with them will be small enough that they can simply be barred. Nobody will want to peer with them with their policies.

Microsoft's fault

[Anonymous Coward]

I think Microsoft is using its monopoly to support these spammers. Microsoft deserves a phunishment for that too.

Heh

[Ziviyr]

I knew Verio was trouble when they absorbed my local ISP and turned it into poop.

Spammers

[Ninja Master Gara]

I've had to shut down two mail accounts because of the enormous volume of spam they get. Enough to make even using spam filters a bandwidth problem on my dial up. They were unfortunate enough to be linked with mailto: on a medium traffic site before the harvesting craze began and within a couple weeks were effectively unusable.

ISPs need to realise that if they're not going to do anything about it, they'll be blocked. This happened to us years ago when the ORDB started, and we fixed the problem immediately. We didn't think they were being nasty to us, we realised we had a problem, and we set about fixing it. When ISPs get globally klined from IRC networks, their customers want to know why, and put pressure on the ISP. They listen and respond.

This is no different. If yer gonna be a spammy host, prepare to be blacklisted. Reponsible, rigid, no nonsense, targetted policies are the only thing that will have ANY effect, and even they won't STOP all spam. But it sure helps.

Spammer's secret

[Anonymous Coward]

They all have addresses @spam.com and no one ever spams those (since, it's their own email!). Brilliant.

Breaking things is not fixing the problem.

[hardaker]

Spam blocking has been around for ages. Blocking broken mail servers has been around for ages. Apparently, it's not working as my mail box still contains a lot of spam.

We need a new solution folks, and blocking large portions of the net will not fix the problem. If you want to make *all* spam to go away, you need a different form of a solution because you can't block everyone who might want to legitimately talk to you. This decision will certainly block a whole slew of legitimate users from speaking with each other.

I'm thinking SMTP needs to be entirely rethought. Unfortunately, this isn't practical either as it'll have the same effect as deliberate breakage during the transition. (hence the reason we don't have ipv6 yet either).

Re:Breaking things is not fixing the problem.

[xean]

• Spam blocking has been around for ages. Blocking broken mail servers has been around for ages. Apparently, it's not working as my mail box still contains a lot of spam.

I dont know what your doing, but i've been using the relays.osirusoft.com RBL for a while, along with SpamAssassin to grab the few that get past - and I haven't seen a single SPAM in around 3 months. I haven't noticed any legit email going missing either.

While RBL's do seem a little harsh, if a majority of mail servers do start using them, then ISP's and SysAdm's would be making a huge effort not to get themselves listed, and therefore not supporting spammers.

I dont believe spam will be around for ever, as more and more people get sick of it and more ISP's start blacklisting and filtering it will become increasingly more difficult to effectivly spam.

Re:Breaking things is not fixing the problem.

[Skapare]

What if the someone that wants to talk to you just wants to sell your something? Or what if they want to convice you to change your opinion about something. Or what if they want to just reply to your Slashdot posting privately? How are you going to tell these apart?

The problem with spam isn't really the message. If I were to get in my mail box precisely and exactly the information I was interested in, I wouldn't have any problem with it. Maybe I would be interested in visiting just the right kind of porn site. Maybe I really would like to enlarge my penis. Maybe my printer really has run out of ink. Maybe. Maybe NOT.

But this is a hard thing to work out when you are dealing with content. For example, I often post on mailing lists or USENET and for many, I do get private replies (and spam, too). It's reasonable to assume that if you post, you've invited a reply (unless you say otherwise). But a "reply" to a posting about what I think should be in the next version of some standard should not be asking me if I need more golf balls. That's just plain off topic. Still, I have gotten replies that are completely ON topic, yet are sent by someone that is a total moron and not worth reading and a total waste of my time.

The real problem with spam isn't the content at all. The real problem is the way it is delivered, and the way it is determined to whom it is delivered.

TV commercials, radio spots, newspaper ads, and web banners, are what I call gatewayed advertising. What that means is that someone (the TV station sales department, the newspaper advertising department, or CmdrTaco while trying to get more revenues for Slashdot to keep it alive and pay for the kind of bandwidth that would create a Slashdot Effect on most web servers) is the "gateway" into the media where the advertising is presented. You don't get to put a TV commercial on without paying the TV station for the time. As much as I dislike most commercials (some I do enjoy the first time around), I also know they pay for, or in some cases at least help pay for, what I am receiving. But the whole point is, it's not going to get out of control because there is someone acting as the gateway. TV stations know they will lose viewers if there is 50 minutes of commercials every hour. CmdrTaco knows it would ruin Slashdot if every page were plastered with dozens of banner and box ads totally obscuring the content. And even if they did do the wrong thing and ruin it, I can change the channel or go to another site. There isn't a scaling issue here for these media.

But with spam, you can't change the channel. You can't choose to visit another site. And worst of all, it's not paying for a damned thing you receive.

We can make a comparison of spam with telemarketing and fax ads. Neither of these really pay for anything you receive. While it may be argued that telemarketers keep the cost of phone service down by providing more revenue for the phone company, this isn't really true. Most telemarketing actually takes place at the peak times that phone networks are busy, so the phone companies just have to scale up to that level of business. They aren't getting new revenues, and you can be damned sure that telemarketers are not paying an extra premium to the phone companies to help lower your phone bill (there are plenty of scumbags in that industry that would find ways around that).

Another comparison is with ads you get in snail mail. It doesn't really pay for anything you receive (they get huge discounts from the Postal Service for bulk packaging them so the delivery guy doesn't even have to check the addresses). But while these are annoying and a bit of a problem, it's not something that's going to grow exponentially from here because there is a "gateway" of cost. Those leaflets you get on your windshield are much the same. It's a pain to have to reach over and grab it and throw it away, and again, it hasn't paid for anything you receive. But like bulk snail mail, there is cost and someone has to roam around sticking them on.

The problem with spam isn't the content, it's that so much can be delivered so fast and to so many people that there is in effect NO GATEWAY to this. And as bandwidth gets cheaper and cheaper, and servers get faster and faster, you and your delete key will have to just work harder and harder to keep up. No wonder people are working on automating things to delete spam. And it just escalates.

So yeah, we do need to be able to continue to communicate, and this also needs to include advertising where appropriate. But there needs to be some kind of "gateway" to control it, to make sure it doesn't get out of hand, and to make sure the decisions about how much to send and to whom to send are decided on properly. And this also includes making sure it is sent to the proper email address for those of us with many (if you own a domain and have set it up so that any name on the left of the at sign works, raise your hand).

There will always be those who think it is their right to communicate with everyone. But, yet again, the issue is not about the message, but instead is about the methodology. Email is not a broadcast medium and should not be treated as such. It is a one to one communication medium. And I translate that to being a person to person communication medium. So if you want to communicate with me, you need to at least be a person, and not a machine running some spamware. Maybe SMTP needs a rethought. Or maybe not. I've thought about it and don't really have any answers (yet). But I do think the ultimate solution is going to end up having to be something that proves that it is a person who communicates with me, and gives me as much of their time in sending me the message as it takes from me to read it or listen to it. We need to find some way to communicate that does not allow the sender to automate it without that message being tagged as automated. That is the real problem with spam ... it's so impersonal ... it's all automated.

Re:Breaking things is not fixing the problem.

[Anonymous Coward]

"I wouldn't mind if I were spammed with things I wanted..."

If the spammers knew what you wanted, they would just ruin the functionality of your mailbox with your preferred variety of spam. you do realize most people are getting so much spam, they are having difficulty using email to communicate with other people.

Your argument would have merit if email had been designed as a conduit for mass mailing advertisements. But in this world, email was designed for human beings to interact with each other.
Using that service for mass mailings degrades the service.

If people wanted a service which delivered advertisements(personalized or not), there would be demand for such a service. Do you know anyone besides yourself and those in the marketing industry, who would express an interest in paying for a service that delivered nothing but advertisements? The most annoying thing about marketers is they presume to know what people really want, and then go at great lengths that what is desierd are piles and piles of steaming shit. Not me, bucko.

Re:Breaking things is not fixing the problem.

[Anonymous Coward]

If you want to make *all* spam to go away, you need a different form of a solution because you can't block everyone who might want to legitimately talk to you.

Sure I can. Just like I can decide not to answer my phone when it's ringing.

Re:Breaking things is not fixing the problem.

[flonker]

How would you redesign SMTP? It's incredibly difficult to come up with a system that will allow one message through, that won't allow one message through that was also sent to five hundred other people on other servers without some sort of authority (be it a p2p authority, or a centralized authority).

Re:Breaking things is not fixing the problem.

[Phroggy]

Sure, blacklists aren't THE solution. They're one partial solution, that can help to reduce spam, and increase costs for spammers. Not enough to stop spam, but it does help.

Combine that with other solutions, and the combination will be enough to make a difference.

Re:Breaking things is not fixing the problem.

[TonyGreene]

What if the someone that wants to talk to you just wants to sell your something? Or what if they want to convice you to change your opinion about something. Or what if they want to just reply to your Slashdot posting privately? How are you going to tell these apart?

I have spam filters that send a confirmation back to strangers, asking that they simply Reply to the confirmation. That reply serves to move the message from a holding area into my Inbox. Spammers generally either use invalid email addresses or don't read/respond to replies.

Re:Breaking things is not fixing the problem.

[Skapare]

That is a method that is at least on track to deal with what the problem is. It's not the ideal solution, but for now it looks like it is the best solution, at least for senders who are reaching your mailbox for the first time. Your regular peers can be whitelisted automatically.

The thing to do is to do this at the server level. Sending back a clear message will be the hard part. The SMTP daemon will need to connect back to the sender's SMTP server while the original transaction is in progress, to avoid queueing the message (because the bulk of this will be undeliverable). And this won't necessarily be the same IP address, so that means doing all the usual MX lookup, too. If the sender's server cannot be contacted, the mail needs to be refused, at least with a soft error (but a hard error in obvious cases, such as no such domain from an authoritative DNS server, or a hard error from the sender's apparent mail server). This can make for some more complex servers.

This idea has been suggested, and even implemented. Some people object to it, and some have some good reasons, too. But it may ultimately be that we just have to get used to it. Having an open society isn't cheap; we do have to buy locks, guns, etc. The internet isn't any different.

Well

[sulli]

That's stupid, as I use Verio and hope to continue to send email.

Re:Well

[Anonymous Coward]

I use Verio and hope to continue to send email.

Then you better tell Verio.

Re:Well

[Anonymous Coward]

You will be able to receive mail just fine. However, people such as myself, who use the SBL will never receive any of your email.

Re:Well

[Anonymous Coward]

Actually I should have RTFA'd as it doesn't cover customer emails, just the verio corporate server.

Way to make the internet more useful

[Moonwick]

Blackhole operators like this are just as bad as the spammers themselves; both groups take great pride in having their head firmly shoved up their ass.

Come on. Blocking all of _Verio_? Thanks for doing your part along with the spammers to make e-mail that much less useful.

Re:Way to make the internet more useful

[Anonymous Coward]

It's up to you as a consumer to decide who you are going to enter a business relationship.

You know Verio is spam friendly, and you know 99% of people FUCKING HATE SPAM.

So you do business with them anyway, and now have "email problems" because your provider has been blackholed for abuse.

This would be your fault, not the blackhole operators.

Re:Way to make the internet more useful

[Anonymous Coward]

first off, they're just blocking the corporate mailservers, not individual's mail accounts.
second, this is the kind of thing that has to be done to make an ISP say "holy shit, we have to fix this NOW".. if the ISP wants to keep their customers and not get sued by shareholders, the open relay problem will be quickly fixed, and Spamhaus will lift the ban.

Re:Way to make the internet more useful

[Moonwick]

Great, if only the world were that simple. But it's not, and no matter what these people think, blackholing a major chunk of the internet isn't going to make anyone think twice about who they'll buy transit from. But it will inconvenience a great deal of people who have absolutely no say in these matters.

Personally, I'd avoid entering into a business relationship with anyone who would intentionally block me from receiving mail from significant parts of the internet. But then, that's the logical thing to do, and logic seems to escape most people around here.

Re:Way to make the internet more useful

[Pete]

Blackhole operators like this are just as bad as the spammers themselves; both groups take great pride in having their head firmly shoved up their ass.

I was about to just moderate you down as flamebait, but then noticed your low userid# and thought "nah, buggerit, I'll just respond."

I'd suggest you read up about the Spamhaus Block List and perhaps after that, have a look at some of the many posts by Steve on news.admin.net-abuse.email.

If you still think he "takes great pride in having his head firmly shoved up his ass", then, well, the value of your opinion should be pretty clear.

Blocking all of _Verio_? Thanks for doing your part along with the spammers to make e-mail that much less useful.

It's not making email as a communications medium even slightly less useful to you, unless:

(a) your mailserver uses the SBL (or one of the many other blocklists that list all or part of Verio) - in which case you are perfectly free to move to another one that doesn't, or

(b) your mailserver is in a range listed by the SBL. In which case you are also perfectly free to use another mailserver that isn't.

If it's not affecting you directly, then it's really none of your business. Except that if Verio either goes out of business OR gets rid of all its spammers (note: first option much more likely), then the load of spam that you are currently receiving will decrease.

Pete.

PS. Seriously, this has been coming for a loooong time. Verio is, and has been for a while, one of the worst (if not the worst) spam supporting ISPs on the Internet (and if you were completely unaware of this, then your opionion is worth even less than I thought it was). Their management are knowingly hosting spammers, and deliberately refusing to disconnect said spammers. They will never stop doing this as long as they profit by it. And they do profit by it, and will continue to do so until most (if not all) of their non-spammer customers leave.

Being shunned by the wider Internet is the only effective punishment. And it is effective. Don't fool yourself. Verio are not a responsible Internet citizen, and they will continue to be punished for it until they either mend their ways or die.

Personally I'd prefer the latter.

Re:Way to make the internet more useful

[Moonwick]

But the point that I take issue with is this; you say I'm 'perfectly free' to move to another ISP if mine's blocked or subscribes to a block list.

Do you realize that in practice it's not usually that simple?

On the other hand, installing a package like Spamassassin rids me of far more spam than a blacklist ever could, without making me look like some elitist snob everytime my mother gets a "message undeliverable" bounce from my MTA just because she doesn't want to change her e-mail address.

How many mailservers do you operate? How many users rely on you not to make decisions that will impact their ability to receive e-mail? Before you write off my opinion merely because I don't agree with you, answer that.

Re:Way to make the internet more useful

[Dimensio]

Here is the deal. Verio tolerates criminal activity. This criminal activity negatively affects other ISPs. These ISPs have decided that they are going to take measures to prevent the unpleasant effects of Verio's crime tolerance. These measures involve completely filtering every packet that comes from Verio. They no longer have to deal with the crap from Verio.

This is Verio's fault. The ISPs who filter are perfectly free to do so, especially if nothing legitimate is coming from the filtered source (and in Verio's case, nothing legitimate comes from there). If Verio wants to actually have their traffic go anywhere, they should consider dealing with their spammers. Until then, they only have themselves to blame if their customers are unable to make any use of their services.

Re:Way to make the internet more useful

[Moonwick]

The ISPs who filter are perfectly free to do so, especially if nothing legitimate is coming from the filtered source (and in Verio's case, nothing legitimate comes from there).

This statement by itself sums up quite nicely the sheer irrationality that goes into the decision to blacklist an entire backbone provider.

I suppose that since I operate a mailserver on Qwest, which is blacklisted on at least one list, that 'nothing legitimate' comes from my users or myself?

Wait, perhaps that's not the right question to ask here. But you get the idea.

Re:Way to make the internet more useful

[Pete]

But the point that I take issue with is this; you say I'm 'perfectly free' to move to another ISP if mine's blocked or subscribes to a block list.

Do you realize that in practice it's not usually that simple?

Of course I recognise that it's not necessarily a simple, nor a cheap, exercise. It's almost certainly going to cost something, both in cold hard cash and time (and of course time spent generally translates directly to cold hard cash). And in many cases (though certainly not in all) it's going to cost you more to buy service from a non-spam-supporting ISP, because (while you may not have realised it) your fees at the spam-supporting ISP were effectively subsidised by the extra fees spammer clients paid.

I also recognise that it's generally the not-always-entirely-innocent people caught in a blocklist who grossly overestimate the costs of them changing ISPs. Sometimes they really overdramatise it and make out like they have no choice - when of course they do. You always have a choice, even when you don't want to take it (for whatever reason).

The main thing I object to is those not-always-entirely-innocent people blaming the operator of whatever blocklist they're on, rather than blaming their ISP (ie. confusing the symptoms with the cause). Or perhaps taking some tiny degree of responsibility for their own actions and apportioning at least a little bit of the blame to themselves.

"Why, what did they do wrong?" you might ask. Well, in some cases, they might not have made a reasonable effort to research an ISP before signing up. In some cases, they might have thought "Hey! These guys are really cheap!" without making any effort to work out why. In some cases, they may have known that said ISP was a spam-supporter and simply didn't care. In far too many cases, they may have not made a reasonable effort to understand the situation when they first discovered they were on a blocklist.

And finally (regardless of whether they understand the situation or not), if they continue to use and fund a spam-supporting ISP even after they've had every opportunity to work out why this is morally wrong, then they qualify as spam-supporters themselves and are no longer even remotely innocent. You make your choices and you live with the results.

On the other hand, installing a package like Spamassassin rids me of far more spam than a blacklist ever could,

Good for you. You keep on using it then. But always remember that you're still paying (albeit probably a trivially small amount (I mean, how much spam do you personally receive? I'm guessing something tiny and inconsequential like a hundred messages a day?)) for the bandwidth, storage space and CPU processing time incurred by that email. Just because you're not seeing it doesn't mean it never existed and never cost you anything.

And most importantly, just because you're not seeing it doesn't mean that others aren't - nor does it mean that others aren't paying the recipient cost of spam, whether they are or aren't seeing it.

Spam has to be stopped at the source, not (haphazardly and unreliably) at the destination. The best way to achieve this is for all ISPs to act responsibly and simply forbid/prevent spamming. But since we're dealing with imperfect human beings here, there will always be some incompetent (eg. Verio), amoral (eg. Verio) or simply greedy (eg. Verio) ISPs that will not take their responsibilities seriously.

Blocking such rogue providers is a last resort, and it has one of three effects, all good:

1. Legitimate users complain to the rogue provider and it changes its ways,
2. Legitimate users leave the rogue provider, usually leading back to 1. or straight on to 3.,
3. The rogue provider goes out of business,
4. If the rogue provider somehow stays in business by only hosting spammers, everyone else in the world blocklists them and they are effectively no longer part of the Internet.

How many mailservers do you operate? How many users rely on you not to make decisions that will impact their ability to receive e-mail?

One, and one. I'm not a professional sysadmin now (though I have masqueraded as one in the past). Look at my CV (linked from my website) if you're really interested about my background, though most of it is not directly relevant to my views on spam and spamfighting.

You, and any other people who read this post, can take that into consideration when evaluating my post(s) if you wish.

Before you write off my opinion merely because I don't agree with you, answer that.

If I wrote off people's opinion merely because they didn't agree with mine, I'd be writing off a hell of a lot of opinions :-). The only references I made to the value of your opinion(s) were:

1. If you still think Steve Linford has his head up his ass, even after reading up about him and his background, then I think your opinion on him is worthless.
2. If you were completely unaware of the history and reputation of Verio as a spam-friendly provider, then I think your background knowledge of spam is severely lacking, and thus any opinion you might have about spam in general is not worth much.

Pete.

Re:Way to make the internet more useful

[Isofarro]

But it will inconvenience a great deal of people who have absolutely no say in these matters.

Customers have a say on these matters. They pay money to receive a service. If the ISP won't provide that service, then the customer has bought tainted goods. There are remedies and processes in place to deal with this, as stipulated in the contract you would have agreed on upon sign-up.

Re:Way to make the internet more useful

[Dimensio]

I suppose that since I operate a mailserver on Qwest, which is blacklisted on at least one list, that 'nothing legitimate' comes from my users or myself?

As far as I am concerned? No. Qwest has demonstrated to me that they are willing to openly tolerate criminal activity by their customers, even deliberate and malicious Denial of Service attacks, and as such I don't care what comes from them: it goes into tbe bit bucket.

Your ISP is the problem. Not the filters. The filters are there to provide incentive for ISPs to do something about their spammers. Don't like it? Complain to your ISP and tell them that you don't like being associated with various crooks and thieves and that you don't appreciate their inaction causing you undue harm.

FYI

[Anonymous Coward]

% whois -h whois.arin.net 26212

OrgName: ixxnet
OrgID: IXXNET

ASNumber: 26212
ASName: IXXNET
ASHandle: AS26212
Comment:
RegDate: 2002-07-25
Updated: 2002-07-25

TechHandle: MS2815-ARIN
TechName: STEFEN, MARKUS
TechPhone: +1-866-949-9638
TechEmail: m.stefen@ixxnet.net

OrgAbuseHandle: MS2815-ARIN
OrgAbuseName: STEFEN, MARKUS
OrgAbusePhone: +1-866-949-9638
OrgAbuseEmail: m.stefen@ixxnet.net

OrgTechHandle: MS2815-ARIN
OrgTechName: STEFEN, MARKUS
OrgTechPhone: +1-866-949-9638
OrgTechEmail: m.stefen@ixxnet.net

# ARIN Whois database, last updated 2002-11-17 19:05
# Enter ? for additional hints on searching ARIN's Whois database.

Spammy spam spam

[dethl]

Ummmm...couldn't the spammers go to a different ISP to distribute their spam? Great...now I see a nomadic tribe of spammers that go from ISP to ISP spamming...thank god for Mail.app on Mac OS X!

Re:Spammy spam spam

[cranos]

A nomadic spam tribe? Bloody vikings, and no I will NOT sing the song, I can't remember the words

Re:Spammy spam spam

[zaren]

They have been... that's why they're all at Verio now. Other ISPs have finally had the balls actually ENFORCE their AUPs and ToSes and kick them out, but Verio is one of the last to choose spammer money over legitimate customer money.

I hope they enjoy their intranet.

Thats why I like it!

[Anonymous Coward]

i love spam, I love it!!!

see my picture here

Spam source

[confusion]

I'm confused. The netblock that verio's mail servers are on have been blacklisted. The message states that they're being places on the BL because of knowningly hosting spammers, and in one case selling hundreds of high speed connections to a known spammer (presumably with the intent of fliiling them up withoutbound spam).

How likely is it that the spammers get gobs of bandwidth and turn around and relay off of verio's mail servers? Isn't it *much* more likely that the spam is being sent directly from the IP addresses assigned to or owned by the spammers?

Unless I'm way off base, I think this is more a punative measure against verio than a real reduction in spam.

And yes, I do support blacklisting.

Re:Spam source

[buss_error]

How likely is it that the spammers get gobs of bandwidth and turn around and relay off of verio's mail servers?

Not likely at all. The message being sent here is when a Verio exec tries to e-mail his mother, and gets his e-mail bounced. This shows the exec that being on a block list is, perhaps, not the best idea in the whole wide world. Then, if legitimate users are using Verio's corporate relays, their mail gets blocked.

Yes, I am currently blocking all VERIO netblocks. Every last one of 'em. On over 22,000 mail boxes. Those that really need to contact us can use a Yahoo account. At least until Yahoo decides they really don't want to provide e-mail services to Verio's customer base. Nudge. Nudge.

Making fun of spammers

[Anonymous Coward]

http://www.quatloos.com/brad-c/directory01.htm

Sign of bad government

[use_compress]

If spammers were prosecuted more aggressively for the fraudulent content of their messages, their failure to honor unsubscribe requests, etc., there would be no need for SBL to black list Verio's Corporate Mail servers. At least SBL is attempting to pick up the slack of a lazy government.

Surprise

[cranos]

What has surprised me has been the vitriol that has been directed not at the spammers and Verio but at the spam blockers. I mean some of the comments have come close to being as bad as an Emacs v Vi debate. I have only this to say, services such as spam hause (i think thats it) and other similar services, are not compulsory, you don't like it, you stop using it. There is also a massive difference between legitimate marketing via email to a list of opt-in users and the profligate assault that is the "Penis Enlargement" message. I mean come on how many slashot readers are actually going to need that one??? Why the silence? hello is this thing on?

And They're off!

[Anonymous Coward]

Its lawsuit time here at the track and,, ,, in first place is 'hinderance of interstate trade' followed closely behind by 'defamation of character'. Coming up fast is 'Lost revenue!' This is gonna be a photo finish folks and the loser is *you*. Spammers with big buck convince clueless courts that its ok to send fraud to millions everyday and you eventually have to set up 4700 filter blocks on your own. Thing is, who is gonna help grammy from being taken in by pre-teen-sex?

Re:And They're off!

[zaren]

in first place is 'hinderance of interstate trade' followed closely behind by 'defamation of character'. Coming up fast is 'Lost revenue!' This is gonna be a photo finish folks...

"It looks like this could be a photo finish, or an oil painting..." Spike Jones, "A Day At The Races"

The problem is, everything on the track right now is a dead horse. Worse still, these horses are being beaten by jockeys with really big... bank accounts, so they'll somehow manage to win the race every time, leaving the long-standing dark horses "customer service" and "viable communications option" in the dust.

100 million mailboxes protected?

[realdpk]

I find that figure *very* hard to believe. How do they figure it's 100M?

Here's hoping this group is more responsible than SPEWS. With that (likely bogus) figure being announced, I doubt that they are.

Re:100 million mailboxes protected?

[Anonymous Coward]

I think the 100 million mailboxes are the rest of the world, protected now that spammers hosted by Verio can't spam anymore.

Re:100 million mailboxes protected?

[Anonymous Coward]

"Responsible?" Who do they, SPEWS, or any blocklist have to be responsible to other than their users? Why should they really care about the places they list? If these places are sources of spam, the responsible thing to do is to blocklist them!

As for the 100M, my free mail.com account uses it, mail.com is run by Outblaze, their page used to say 30-million mailboxes serviced. That's just one company...

You sound like a classic whiner "realdpk"... what's the hidden agenda?

Re:100 million mailboxes protected?

[SirFozzie]

Maybe they took the claims of the ISP's that subscribe to the list as to membership?

I see you're in the "SPEWS is Evil" camp, while you have the Constitutional Right to be wrong, I wonder as to your motives.

Subscribing to SPEWS, SBL, or any block list is done at the ISP level, and is part of their terms of service. Don't like it? Go elsewhere. The problem with public block lists is that it opens up the owner to a lifetime of harassment by these spammers.

For example, in the last month and a half, SpamCop has been joe-jobeed (ie, somebody sent lots and lots of email purporting to promote services at SpamCop in an attempt to get their account kicked off their ISP) 8 or 9 seperate times, and now is being DoS'd. Others have to face barrages of legal threats with no substance, designed to eat up their day.

SPEWS doesn't face any of that. They do not accept mail, they don't promote any service.. they just say.. "Here's a list of ISP's we consider untrustworthy, because they refuse to kick off their spammers".

Sure it can block folks from the same ISP (or the same /8, /16, etc etc), but if SPEWS blocked just the spammer, then there would be no incentive for the ISP to kick their spamming vermin off, (and in fact, would be more of a reason to KEEP them, because they get to send all the spam they want, and you don't have to worry about abuse, because they're blocked.

However, you can whitelist on the individual w/SPEWS letting individual emailers or even whole ISP's out of the blocks.

The thing is, it can be described two ways.

1) A surgeon cutting off the limb (the ISP w/the spamming vermin), to save the patient (E-Mail as a whole).

2) If you know "Crazy Willie" is really a front for stolen property, you won't do business with him, will you? Well.. by condoning (ie, ignoring abuse reports) the spammers, they are condoning the spammers illegal use of unsecured and open proxies worldwide, jacking up prices (for bandwidth and abuse staff) at the ISP's who actually give a damn.

Sure, we can filter it at the client side.. but by then, it's too late for the bandwidth (all the transit) and storage. Here's a stat for you. Last year, spam (in its various stages) was 8% of email.

This year it's 36%.

All SPEWS, SBL and other blocklists are trying to do is keep Email viable and not the latest way for advertisers to reach you, at your expense.

Re:100 million mailboxes protected?

[realdpk]

I am _well_ aware of Spamcop's DoS attacks - very, very well aware.

"Here's a list of ISP's we consider untrustworthy, because they refuse to kick off their spammers".

you forgot

"There might be ISP's on here who have kicked off the spammers 6 months ago. We don't really care. Yee haw, at least everyone trusts our opinions!!"

You seem to think I'm pro spam because I'm anti-SPEWS. You couldn't be more wrong.

My motives are simple. SPEWS says they'll do one thing, and they do another. They say they'll remove listings after the spammers are gone. They don't. Even 6 months later.

The only reason I even care is because I handle support requests, and every once in a while we get someone who can't send e-mail out to certain people. We have to tell him that the remote ISP is using faulty blocking software (because well, they are) and there's nothing we can do (because, well, we've done everything they've said we can do.)

SPEWS can rot.

Re:Is that why spam in my Hotmail account has drop

[MillionthMonkey]

Same here. The spam noise level on Hotmail is so intense that instead of checking individual items to delete, it's easier to set your hotmail preferences to display only 25 emails at a time, and then when checking mail just always click on the "check all" box to tag EVERYTHING for deletion. Then quickly scan down the list and maybe uncheck the one piece of email that is worth reading. I've saved my index finger from carpal tunnel this way.

Anyway, I used to plow through at LEAST three screenfuls of garbage at a time this way on Hotmail, but in the past few days, I've been doing only one screenload and getting all of it. So maybe something has happened.

Of course, it's going to come back very soon, so don't get too used to this. It's strange how we've sort of come full circle from being an agricultural economy and shoveling horseshit all day, to having an industrial revolution, and then computers, and worldwide computer networks, and after all this we end up still having to shovel mountains of horseshit around on a daily basis.

As someone who pays for his bandwidth...

[Mustang Matt]

I don't want to filter, I want to block.

Speaking of spam, I wonder how much bandwidth all the spamcop reporting uses up.

Basically every piece of spam creates at least five times the bandwidth usage...
1. Send the full headers back to spamcop
2. receive a report link
3. visit the link
4. send reports out to X number of abuse addresses.

Obligatory pitch

[pongo000]

TMDA offers those who want it the ability to filter e-mail through a confirmation process (or, you can generate "keyword" or "dated" addresses for temporary use in newsgroups and other high-harvester areas). My spam went from several tens of spam messages a day to zero after spending a couple of hours with TMDA.

This solution doesn't do anything about bandwidth (since you will still get the same amount of spam traffic at your mail port), but it's a fuzzy-warm feeling to be in control of your own mailbox for once.

Re:Obligatory pitch

[wotevah]

That system will also block the failed-delivery messages from MTAs so you will never know when that happens.

OT: spammer's human rights

[mi]

There's nothing like the prospect of being assraped by Bubba to deterr spammers.

This is at least the second time I see a celebration of the in-jail sexual abuse on Slashdot. I don't know, how wide-spread such rapes really are in US prisons/jail, but I'm quite confident, they are not going to disappear entirely as long as some jerks continue to consider them a good addition to incarceration. "Cruel and unusual" your ass (pun intended) -- or is the 1st ammendment the only one you care about?

Re:OT: spammer's human rights

[IndependentVik]

Question: How do human rights apply to spammers?

Re:OT: spammer's human rights

[CoolVibe]

Geez, get a sense of humor already. I of course ment that sentence in jest. That prisons and penetentiaries have such a reputation isn't my fault. I just used that commonly over-used urban legend (which also gets used by law-enforcers when they do the good-cop, bad-cop routine) to add a little humor to my posting.

Sure, if spammers believe that they get sexually assaulted when they go to prison and if it will actually stop them from abusing the network, then great! Less spammers. Goody.

If a spammer was sent to prison, they _might_ get sexually assaulted. The probability of this happening is probably a little bit higher than getting sexually violated or mugged at night if you strolled into some $dark_alley in $some_big_city.

My point: I don't condone or celebrate in-jail sexual abuse. Presenting someone with the prospect of being sexually assaulted in-jail is just as an effective scare tactic as telling kids there is a monster under their beds that will devour them at night while they sleep. But still, I couldn't resist adding that to add a lighter note to my posting.

In short: heck, it's just my twisted sense of humor. Get over it.

NB: if you are going to post something off topic, please have the courtesy to post _WITHOUT_ your +1 posting bonus. Thank you.

Re:OT: spammer's human rights

[Anonymous Coward]

> Question: How do human rights apply to spammers?

It's not about human rights, it's about rectal rights!

(Of course, the lawyer from the Asshole Anti-Defamation League has just reminded me that just because an asshole dumps loads of shit, doesn't make it a server on Verio's network. I have to agree he's got a point there. The shit that comes out of most assholes lands in the toilet, which is more than I can say for Verio's network.)

Re:OT: spammer's human rights

[Anonymous Coward]

Aparently, you didn't get the memo. Here in America we have a fear-of-anal-rape based justice system.

Re:OT: spammer's human rights

[Catnapster]

In all honesty, I've never heard of an actual person who got raped in jail - at all.

Besides, even if there really are that many prison ass-rapers out there, do you think they'd stop ass-raping just because nobody laughed at them for it? Personally, if I do something that I take seriously, and people crack jokes about it, I either get pissed off or stop doing it (depending on the muscle mass of the people cracking jokes).

And, finally, if you don't like what someone has to say, don't fucking listen.

And it's not like I really wanted good karma anyway.

Re:OT: spammer's human rights

[Anonymous Coward]

Actually rape in prison is a lot more common than you would think. What you have to realize is that when someone gets released, they don't go around bragging about getting raped. The same mentality of civilian rapes applies (which is highly under-reported).

Re:OT: spammer's human rights

[timerider]

not at all

Re:OT: spammer's human rights

[mi]

My post was not directed at you directly, but rather at the whole /. audience. As you can see from other follow-ups to my post, there is a not so rare opinion, that spammer's don't have human rights. Thieves, murderers, rapists do, but spammers don't...

That was my point. How off-topic was it? Oh, well, I definetly don't have the "posting bonus" any more -- because of this post... :-)

Not My Bandwidth

[Glendale2x]

I block spam using DNS blacklists on my mail server. I'm probably not the only one.

"But," you say to me, "local filters are much better because you might not lose legit email!" I ask you: why should my mail server accept their stupid junk and waste my bandwidth just to filter it out later?

I don't want to my server to accept it. I want it bounced outright with a nice little bounce message. In a happy shiny world, I'm hoping these SMTP rejects will send a message to someone out there. It probably doesn't make a difference, but I can dream.

Yes; some legit email has been blocked. In both cases I'm aware of, the person contacted me through a hotmail account and brought it to my attention. I altered my blocking policy at that point.

I'm open to any options out there for filtering/blocking that does not require me to download it and then filter it. If I wanted to just filter my mail, I can do that using my amazing human brain (better than any spam filter out there, I assure you) and click "delete" on the spams. But I want it rejected outright from known sources.

So until a better option comes along, that's the way it is.

~Seth

Re:Not My Bandwidth

[Anonymous Coward]

Instead don't reject. Return a "450: I'm too busy..." so they can waste resources from their end, retrying while it stays on their spool.

May they die of constipation....

Re:Not My Bandwidth

[Zoolander]

On wasting resources: Here is an IMHO quite clever idea: http://www.monkeys.com/wpoison/ It generates a page with randomly assembled email addresses, and with links to another page of random addresses. Hopefully, if enough people put this on their sites, it will render the spam databases useless, as the spambots collect an endless amount of bogus addresses. If this is old news, then I'm sorry... :-) But it seems like a great idea to me!

Re:Screw more laws, just ban IPs via smart network

[Kirth Gersen]

I'm not in general in favor of laws, but here's a proposal for one: all commercial email, not just unsolicited (due to problems of definition), has to be marked in the header.

So if you like you can easily delete all (legal) spam; if you do want email from certain sites (like Tigerdirect) you can easily enable it in your spamblocker without enabling all the email from the spammers that those twerps sell your email addr to; and spammers that don't mark email can easily be prosecuted.

This doesn't directly address the issue of wasted bandwidth before the emails get rejected, but I think it would have the result that many fewer spams would be sent anyway.

OT: Slashdot using Flash ads!!!

[acoustix]

They promised us that they would NOT use them!

Re:OT: Slashdot using Flash ads!!!

[Anonymous Coward]

Slashdot has ads?

Re:OT: Slashdot using Flash ads!!!

[_Sprocket_]

Check out the FAQ. Specifically talking about selling Slashdot and the PT Cruiser. Slashdot has not controled the ads for years. No wonder we get Doubleclick, Microsoft, and Flash showing up from time to time. But hey - that's what a nicely tuned Privoxy config is for.

Re:OT: Slashdot using Flash ads!!!

[Anonymous Coward]

what the fuck are you talking about? there haven't been any ads on slashdot - or any other web sites - for about three years.

oh, heh... i forget i'm running atguard

Spammers for the National Interest, War on Terror

[nounderscores]

Spammers Fought the Evil Rogue States and spammed Saddam Hussein! You kids should be grateful...

Excellent

[coene]

Sometimes the only way to force something is indirectly. Verio will have to choose if they want to support 99% of their "good" customer base, or the 1% of spammers.

I'm suprised at HE.net, I thought they had their act together.

Re:Excellent

[jmeyer]

Hurricane Electric has terminated service to as26212.

Re:Is that why spam in my Hotmail account has drop

[Anonymous Coward]

rock on, that's exactly what i do too. i have to transfer my "to be saved" emails to folders to make it easier. and i too have noticed a decrease in the amount of spam i get in hotmail. used to be ~50 a day, now less than 10.

Posse

[itwerx]

I have wondered if these guys would ever push a stressed out sysadmin over the edge and wind up with a wild-eyed Hagrid-lookalike on their doorstop wielding a .45 and the will to use it!
I'm sure he'd get off on an insanity plea. Heck, I'd probably contribute to the defense fund. :)

spam ????

[tq_at_sju]

whats spam...email me at spamidiot@yahoo.com to let me know, don't send me any penis enlargement pills though!

Unless the government runs the ISP

[shepd]

It ain't true censorship, in the freedom sense.

Private property and private, open ended, signed contracts mean that your option is simple: Phone up another ISP and ask them if they will let you receive all the spam you can eat.

You can then transfer your account. No doubt your old ISP will be satisfied that they don't need to pay a developer to add a disable feature (that won't be used by anyone except yourself and one or two other users) rather than get the measly amount most home users pay for internet (about $1-$2 margin per user per month). And your new ISP will be out of business within a year or two as the rest of the ISPs in the world implement filtering and the ones that don't lose users.

But wait! You still have the freedom to get the spam! Just buy a $700/month T1 for your house and again, you have all the spam you can eat.

I'll stick with $20/month internet and run SpamAssassin until my ISP implements filtering for me, because I've never had a false positive from SpamAssassin, ever, except for morons who send HTML-only mail, and I often can't read their crap anyways, and so I summarialy ignore/request ASCII anyways.

Now, if you're in an area with only one ISP, or a government controlled ISP, then I feel for you. But, IMHO, this isn't very common in most free countries (or at least in my corner of the world).

I prefer a more drastic solution

[Indy1]

My mail server uses the spews dns blacklist. Once i get a spam attempt from some lamer on the spews list, i add the entire class C to my firewall and drop all their packets. My attitude is let the dweebs waste time bouncing off my firewall. As a side bonus, it keeps the smtp logs MUCH cleaner : )

Re:I prefer a more drastic solution

[Anonymous Coward]

I have great success with using bind views.
I find the nameservers of the spammers and create a special view for them which is the exact content of the zone with the exception of the MX record is 127.0.0.1

Then they don't even connect.

gangs?

[machine of god]

...because of the number of spam gangs on the Verio network

As in: we trade in guns, drugs, and oh yeah, we also do a little spamming on the side. ?

About theft of service

[coolgeek]

I'll probably get tagged as a troll for this one, but...

I support and believe the position that spammers or other unauthorized users of a system that I own are stealing services from me. I further believe it is OK to block their traffic from crossing my equipment.

Now, let's look at this from the telemarketing perspective...My phone at home is one of those models that has a wall wart. I believe when the phone rings, or is in use, it draws more current. So, when a telemarketer makes an unsolicited (and unauthorized) call to my phone, does that mean they're stealing my electricity? What about my most valuable resource, my time? Are they stealing my time?

I hate spam just as much as the next guy. And I don't believe ignoring people who cause a nuisance infringes their right to free speech. I do however believe the "telemarketing" lens will be used by the Judicial System when examining these issues. Sooner or later, these spammers will mount a constitutional challenge to anti-spam legislation. Well, if they are making that much money, anyway. They may not even need the money for such a battle, it seems the EFF just might take up their cause.

Re:About theft of service

[wotevah]

As a matter of fact, all telemarketing and opt-out systems should be reviewed as a whole from the legal standpoint, as they are very broken. Not only do companies have the right to pass on your phone numbers to others, there is no way to undo that except after each call, by asking to specifically have your number removed. There are ways out there to register your phone on a "do-not-call" list but they just plainly don't work.

A few years ago I bought this nice $100 answering machine that right now is collecting dust somewhere, because I disconnected it after I found I was getting 6-7 messages A DAY, wasting tape and my time to listen to each one of them.

This goes for my home line too - I pay for it only because I need a "home phone" but the phone is always off and I use the cell exclusively for my incoming calls.

This situation is ridiculous.

loosen the floodgates

[akb]

'member when Usenet admins stopped filtering spam to get some attention to the problem? That sure as shooting got people to pay attention, what with all the servers that went up in flames from the load. Maybe that's what we need with email, it feels like we're building to that kind of standoff.

Bet we'd see some real legislation and enforcement then, eh?

popfile

[zonker]

popfile makes me happy. =)

I agree with that.

[dxkelly]

I think if a site is supporting or constantly sending out spam it makes sense to be put on a block list but it seems like people put you on a blocklist at the drop of a hat. I use a system with many users that fights hard to stop spam and will kick anyone who sends spam. Now and then someone spams and is stopped but of course by that time we're blocked. Hasn't happened in a long time but just the other day a user sent out a few hundred emails and bam we're blacklisted. Now hundreds of people are paying for that guys mistake.

One solution for spam in your inbox

[PhantomHarlock]

Ok, here's one way to eliminate spam in your inbox. No, this doesn't eliminate the cause, only the symptom, but it will stop the bandwidth at your server if you so have the power.

This works best if you own your own domain name and can create multiple pop boxes. It's still doable using regular email accounts, however.

Step 1: Change your email address to a previously unused address at your domain. Test it for a day, verify no spam is coming in to that address.

Step 2: Email all your trusted friends, relatives and business contacts your new email address.

Step 3: Remove your old email address links from your website and replace them with a feedback form that emails an unrevealed throwaway secondary address using your favorite web -> email gateway scripts.

Step 4: Create a bounce message at your old address, with a link to the feedback form, for all the people you forgot to email about your new address, and for people who want to contact you through your old address as they have found it on google searches or other archived postings, or your old business cards, etc.

Step 5: Receive both the new email address and the feedback form submissions on to your local mail reader. Filter them in to seperate directories. Give out your real, private address to feedback form users once they've verified themselves as being legit. If not, have a throwaway identity you can talk to them through. (the email account that the feedback form mails to) If you start getting spam at that address, simply change it.

Step 6: When you make public postings, post the feedback form URL instead of your email address. When you have to give your address away to commercial websites to sign up or download things, give them the throwaway address, or create a third address for legitimate online companies and filter that into a third folder for "commercial website email" If that get compromised by an unscrupulous business, change it. Still doesn't affect your primary private address.

You can receive the two or three addresses all at once with any modern mail reader, and filter them into folders. I personally use Eudora.

This is a really easy thing to do if you can stand changing your email address. I've had the same address since 1995, so I get about 150 spams per day. I have a filter that gets rid of most of those, but that's local and I still take the bandwidth hit, and about 20% of them get to my inbox still. Rather than try to over-filter and get a false positive, I think the above solution is a worry free and clean way to make a break from spam.

---Mike

Re:One solution for spam in your inbox

[AntiNorm]

There's an even easier way to do this. If you have a domain, set up the email on it so that mail sent to undefined aliases forwards to your main account (which you do *not* give out). Then, when someone wants your email address and you suspect any chance of them using it for spam, give them theirname@yourdomain.com. For example, if you sign up for Kazaa, give them kazaa@yourdomain.com.

With this method:
* Any legitimate business will be able to easily contact you
* No extra effort at all is required for each new address needed
* If you start receiving spam at an address, you can shut it down

You will also, in most cases, be able to determine who sold your email address to what spammers. I have caught quite a few places selling email addresses this way, including Kazaa (obvious), Morpheus (obvious), and Dialpad to name a few. Makes for easy justification when you tell them you're cancelling your account because they sold your email address to spammers.

Re:One solution for spam in your inbox

[Pete]

Just briefly, anyone intrigued with AntiNorm's suggestion but lacking their own domain (or unable to try it for some other reason), SpamGourmet offers a very similar service for free.

You sign up as, for example, fred, supply SpamGourmet with your real email address, then whenever you need to give out an email address to anyone you don't trust, give them something like: kazaa.10.fred@spamgourmet.com . SpamGourmet will relay 10 (and only 10) messages sent to that address though to your real address... any more will just get chomped. Maximum of 20 relays.

Very, very cool service. The fact that the basic model is free just rocks. I have no relation to them other than as a happy user.

Pete.

Re:One solution for spam in your inbox

[flonker]

Be careful of the spammers who try sending mail to common users at a given domain. ie. info@domain.com sales@domain.com and so on.

It's not only spam...

[yalla]

I personally heard first-hand that people are using their big networks (/20 and bigger) for falsifying online-polls and get paid for it... That person even told me that he wrote a handful of small scripts to change the reverse-lookup of the IPs constantly to hide the manipulation. Whatever that is good for.

Mostly the online polls are somehow connected to a company ("vote for your favorite petshop in your area") who are willing to pay for it. But... What are online polls worth after after that?

Alex.

I am a Verio customer

[pjrc]

... and here's the message I just sent to every person I've ever had contact with at Verio.

By now, you have probably heard the news that Verio has been accused by SPAMHAUS of supporting major spam operators and Verio is being added to their anti-spam blacklist that serves 98 million email users worldwide. If you have not yet heard of this, please read:

http://www.spamhaus.org/sbl/sbl.lasso?query=SBL526 3

Like most other Verio customers, reliable legitimate (non-spam) email communication with my own customers is critically important, and I will be forced to relocate my site to another provider if these blacklists interfere with my business. At this point, it appears the ranges of blocked IP numbers do not include my own dedicated server ([snip, verio server ID number]).

Over the last 2 years, I have experienced a small number of blacklist related problems, where my email messages were not delivered. Luckily, few of the major blacklists have targeted large netblocks at Verio, and relatively few users make use of the smaller, over-agressive blacklists.

Blacklists are especially disruptive when our customer places an order via the website, and our two confirmation email (the second with their UPS tracking number) are not delivered. To our customer, it appears as if we have poor service. They are unaware that their ISP or anti-spam software blocked our confirmation messages.

To date, these problems have been rare, but very troublesome when they occur. If they become frequent, we will have no choice but to seek a different provider to host our site.

Paul

Re:I am a Verio customer

[Anonymous Coward]

Verio are sick puppies. You should tell them to stuff their company anyway. I've had spams through promoting child and animal porn sites on Verio which are STILL live 10 days after my first report. The spams still come in to my employees and kids. Verio are knowingly profiting from this. I can't wait till they go belly up and the execs are picking up the soap in the prison showers with the WCOM guys.

If your site is on Verio, don't wait until you get totally blocked by SPEWS and the SBL (it is only days/weeks away). Get out while you still have a business. Leave Verio for the porno spammers.

If you want to complain about Verio send them to these folks who do read the email (Verio abuse will just bin it):

aad@verio.net, aandreoli@verio.net, abuse@ntt.com, abuse@OCN.AD.JP, accounts@verio.co.uk, acquisitions@verio.net, asteinback@verio.net, barbg@verio.net, billing@verio.net, cdonelson@verio.net, CEO@verio.net, channel@verio.co.uk, Chemicalarc@ntt.com, chris@verio.net, competition@verio.co.uk, consulting@verio.net, copyright@verio.net, crobbins@verio.net, cwk@verio.net, dedicated_support@verio.co.uk, delliott@verio.net, detected.spam@ketchum.com, dns-billing@VERIO.NET, DomainAdmin@verio.net, domreguk@verio.co.uk, drowlands@verio.net, dschneider@verio.net, dschunk@verio.net, eduda@verio.net, emergencyresponseteam@verio.net, enterprise@verio.co.uk, enterprise_support@verio.co.uk, eps@ntt.com, evivacqua@ctcomm.com, gdenison@verio.net, gkelly@verio.net, grisha@verio.net, hostmaster@NTT.COM, hostmaster@verio.net, iehringer@verio.net, info@ntt.net, info@verio.co.uk, info@verio-advanced.co.uk, jadams@verio.net, jamodio@verio.net, jay@ntt.net, jhamrick@verio.net, jheasley@verio.net, jnessen@sac.verio.net jobs@verio.net, johnson.liu@ntt.com, jtreuting@verio.net, k.hayamizu@NTT.COM, klsmith@verio.net, legal@verio.net, legal4@verio.net, lgeorge@verio.net, lisa.ko@ntt.com, lphipps@VERIO.NET, lyric@verio.net, marketing@verio.co.uk, mbulder@verio.net, mcstewart@verio.net, mpeloquin@verio.net, next@verio.net, oop@verio.net, peering6@nttverio.net pfritzinger@verio.net, postmaster@ntt.com, postmaster@OCN.AD.JP, rbush@verio.net, reseller@verio.net, sales@verio-hosting.com, sbrophy@verio.net, service-manager@viaverio.com, shared_support@verio.co.uk, snawabi@verio.net, sob@verio.net, sthomas@noc.verio.net,
support@verio.net, user-info@ntt.com, VerioIdeas@verio.net, vipar@verio.net, vps_support@verio.co.uk, vsilva@verio.net, warpinfo@verio.net, webbox@ntt.com, www-admin@www.ntt.com, ymasatani@verio.net

Re:I am a Verio customer

[Anonymous Coward]

10 days may not be enough.. .. it takes at least 7 days to go through the appropriate internal channels, and that is if it is given normal/higher than normal riority. This is why I give them 14 working days before reporting them to EVEY blocklist I know of.... {my "notification" message tells them clearly that it will happen]

Lower-level solution: A new protocal

[Lord Bitman]

not that any of this will happen, but I see a lot of posts mentioning ideas like adding a new standard, a "SPAM" flag to the standard SMTP headers. What about something even lower than that? tcp/ip has plenty of bits left for "future expansion", why not an "Advert" bit? how about a couple different ones- "Main", "Advert", "Stream", just as bits? You know, things that can be knocked out with very little proccessing by routers?
That could speed things up a lot.

And now a future timeline:
-Terrorist groups note that many routers are dropping "advert" spam before they reach the mail servers, start sending messages with the "advert" bit set, thus avoiding detection by bugs in mail servers
-Government catches on, starts paying close attention to posts with the "advert" bit set
-Advertising is outlawed after Bush calls the advert bit "evil"

Re:Is that why spam in my Hotmail account has drop

[Matts]

Hotmail just started using Brightmail, hence the drop in spam. It's nothing to do with blocklists or Verio.

The Uncommon Carrier

[Anonymous Coward]

I think that this does a real disservice to us all. The problem here is that as soon as ISPs capitulate to this one request they are therefore obligated to capitulate to all further requests.

Is it okay for the Chrurch of Jesus Christ of Latter Day Saints ought to be able to ask for google.com to be removed?

According to all the positive feedback here, it is. So why the complaints when ISPs censor?

Check out Cisco IPJ's The Uncommon Carrier for some further reflections.

Not funny!

[4ntifa]

Actually, that just happened last year. Damn poodles, they ate my poor ol' grandma!

One wonders about SPEWS

[spacefight]

100M users protected by SBL, how much users are blocked by SPEWS? Hands up! Me!

Re:One wonders about SPEWS

[Anonymous Coward]

how much users are blocked by SPEWS? Hands up! Me!

Well, put that hand down, pull the other one off of your Johnson, and stop spamming - or at least move to a host that doesn't harbor spammers.

Those situations seem to be the only ones that get people into these lists.

BTW, SPEWS isn't blocking you, the people you tried to email are. They don't want crap from your neck of the woods - got the hint yet?

Some corrections and arguments.

[fmaxwell]

We were blocked (wrongly) a while back by some cowboy with a list.

No you were not. As you yourself later point out, people who compile lists don't block anyone.

Practically everyone listed claims that they were "wrongly" listed (and maybe you were). And you will find an astonishing number of "innocent" people in jail if you do a survey of the incarcerated. I have heard proclamations of innocence from multiple people running open relays and from those who claim to have purchased "opt-in" lists of e-mail addresses. In many other cases, these "wrongful" accusations are because some firm had a registration form with some tiny checkbox hidden below the bottom of the screen that, by default, gave them and/or their "business partners" permission to spam. Frankly, if a company tries to deceive its customers that way, then they deserve to be blocked.

The goal of the blockers is to eliminate commercial use of the Internet.

Spoken like a true spammer*. The goal of the blockers is to eliminate theft of bandwidth, storage, and time via spam. They want to make spam unprofitable both for those who send it and those who enable them. In short, they want to stop people from being bombarded with unwanted bulk e-mail delivered at the recipient's expense. What you said is analogous to saying that the goal of store security is to eliminate commercial transactions in stores.

I have a domain on which I employ aggressive anti-spam filtering, based on IP addresses, addressee, content, and header criteria. In the last couple of weeks, I have received commercial e-mail directly related to purchases from Gateway, TigerDirect, MCM Electronics, HP, and Directron. I do a lot of business on the net and rely on e-mail for everything from order confirmations to customer service inquiries. So please don't tell me that my goal is "to eliminate commercial use of the Internet."

We have to move away from relying on an unreliable communication media (email) just to stay in any form of business at all.

All of the firms that I mentioned above rely on e-mail. Dell never seems to get blacklisted. Neither does HP, Directron, Amazon.com, ebay, General Motors, etc. Just what was your firm doing with e-mail? Were you using it to send advertising? If so, how did you compile the list of recipients? Was it from a link that said 'click here to get our advertisements' or was it via some registration form that purported to be for some other purpose (e.g., order placement, tracking, customer survey, contest, etc.)? I just have trouble believing that some blacklist maintainer blocked you because you sent an order confirmation to someone.

* Note that I said "like" -- I'm not accusing you of anything

Re:Some corrections and arguments.

[zebs]

Practically everyone listed claims that they were "wrongly" listed (and maybe you were).

We weren't.

After having problems with our firewall blocking incoming emails we got it reconfigured (i.e. someone outside the company). Except once reconfigured it left port 25 wide open, so anyone could connect to our Exchange 5.5 (not my choice) server. Great.

Of course no ones configured the server to not accept relays. Why would they? Its blocked by the firewall....

So one day I'm bored at work and start entering some of our public IP addresses into samspade, and whoa! our server was listed.

El-prompto action commenced as the firewall was quickly secured, followed by some retesting, and de-listed within a week.

My only beef is we didn't get informed that we were being listed. Was only by sheer chance that I found out. Grrrr

Re:Some corrections and arguments.

[sqlrob]

My only beef is we didn't get informed that we were being listed. Was only by sheer chance that I found out. Grrrr

Sheer chance? A good admin would check the blocklists, at least weekly. Hell, script it and test daily or hourly. Common sense.

Re:Some corrections and arguments.

[fmaxwell]

After having problems with our firewall blocking incoming emails we got it reconfigured (i.e. someone outside the company). Except once reconfigured it left port 25 wide open, so anyone could connect to our Exchange 5.5 (not my choice) server. Great.

I'm confused. If port 25 was closed, of course it blocked e-mails. That's the port used for SMTP (the protocol used between mail servers). You could not receive normal Internet e-mail if that port was blocked.

Of course no ones configured the server to not accept relays. Why would they? Its blocked by the firewall....

Actualy, almost everyone configures their mail server to not be an open relay. If you block port 25 at the firewall, you get no e-mail (see above). For example, my mail server requires a password on SMTP if the destination address is not local.

My only beef is we didn't get informed that we were being listed. Was only by sheer chance that I found out. Grrrr

Look at the number of systems in those lists. There is simply no feasible way to track down and notify everyone that gets listed. Besides, probably better than half of those listed don't even speak English. Every try to tell someone who only speaks Chinese that their mail server needs reconfiguration? I have and it's not easy.

Re:Some corrections and arguments.

[Anonymous Coward]

While Dell may not spam, I block *.dellhost.com as I got nothing but spam that resolved back to that.

Re:Some corrections and arguments.

[zebs]

A good admin would check the blocklists, at least weekly

Nah, most spammers would only find us by sheer chance (no website, small company etc). Checked monthly.

While that might sound arrogant and downright dangerous its the only practical solution given the resources made available to me. Having just checked, we are only listed on ORBZ... but thats only because they now list the whole 'net :)

The chances of getting any additional hardware (we're talking Windows platforms here, so don't expect any useful things like task schedulers capable of querying a website... how long would that take on a linux box? Some simple Perl and an email report?). The boss simply wouldn't understand why any extra investment would be needed, as a non technical person theres only a problem if it doesn't work for him.

Actually I suppose that raises a larger question, something I had to deal with recently. How to convince your boss to spend some money! I've had to give a talk about why we should upgrade our current 10+ year old phone system. Yes it works, and theres not been any problems with it. But, we don't have voice mail, direct dial, least cost routing is via a separate wall box. Hell there aren't even enough phones for everyone, and will they part with the money? Who knows! After giving them all the reasons to upgrade (including saving money...) they still don't appear to interested. We shall see.

*sigh*

Re:Some corrections and arguments.

[Anonymous Coward]

No you were not. As you yourself later point out, people who compile lists don't block anyone

WRONG!!! Alan Brown aka ORBS blocked commerical competition or ISPs that just pissed him off. But then again, I believe it was in his nature to do just that...

Re:Some corrections and arguments.

[sqlrob]

Nah, most spammers would only find us by sheer chance (no website, small company etc). Checked monthly.

While that might sound arrogant and downright dangerous its the only practical solution given the resources made available to me. Having just checked, we are only listed on ORBZ... but thats only because they now list the whole 'net :)

Yes, very dangeous. There was a company here that thought the same. They made a news article about spam, being relay raped 6 times in 2 months, sending millions of messages. They didn't allocate the resources for the mail system, and have completely shut it off.

Re:Some corrections and arguments.

[Anonymous Coward]

Easy for a DBA to say.

Re:Some corrections and arguments.

[schon]

everyone listed claims that they were "wrongly" listed (and maybe you were).

We weren't.

Yes, you WERE.

our firewall blocking incoming emails we got it reconfigured (i.e. someone outside the company). Except once reconfigured it left port 25 wide open

no ones configured the server to not accept relays.

So, due to your own incompetance, you were running an open relay, and someone running list of open relays lists you.

You most certainly WERE listed correctly.

we didn't get informed that we were being listed.

Does your abuse@ and/or postmaster@ email addresses work? Does someone check them?

Who is the RP for your netblock? Is it listed somewhere, or is your ISP's NOC listed as contact? If so, did they recieve notification, and neglect to inform you?

Re:Some corrections and arguments.

[zebs]

As I said, we weren't wrongly listed... or... we were correctly listed.

Does your abuse@ and/or postmaster@ email addresses work? Does someone check them?

All day, everyday.

Re:Some corrections and arguments.

[Frater 219]

WRONG!!! Alan Brown aka ORBS blocked commerical competition or ISPs that just pissed him off.

Aside from your "blocking"/"listing" mistake, which has already been pointed out, I'm not sure you're presenting the matter equitably. Yes, ORBS did list sites that did not spam. No, they didn't do so to "block competition".

As I understand it, ORBS showed up as a more effective rival to MAPS RBL at a point when MAPS was starting to go commercial. ORBS's techniques were also more controversial than MAPS's, in that they involved automatic testing of open relays -- a technique a small subset of spamfighters consider abusive. A number of MAPS proponents, including MAPS principal Paul Vixie and his ISP above.net, took offense at these tests and blocked them. ORBS responded by listing mail sites that blocked relay tests -- after all, it could not verify whether they were open relays or not, and like many security oriented systems it erred on the side of paranoia or caution.

It was above.net, and not ORBS, who took the step more regard as abusive and anticompetitive: it advertised a BGP null route for ORBS's IP space. That is to say, above.net's routers falsely claimed to be able to route traffic to ORBS -- and when they got such traffic, they dumped it in the bit bucket. This meant that sites which trusted above.net's routing announcements, notably above.net clients and peers, could not reach ORBS -- not for mail, not for DNS, not for anything.

Above.net, of course, claimed this was done to block ORBS' "abusive" relay tests.

Again, this was shortly before MAPS became a subscription-only service. While above.net and MAPS are officially distinct entities, they certainly had personnel with interests in common.

I don't know how that looks to you, but I am revolted by the idea that any ISP would destroy part of the Internet (which is what falsely advertising null routes does) in order to get at a rival.

Re:Some corrections and arguments.

[sqlrob]

Well, excuse me for assuming that mail admins are familar with such l33t t00lz as whois, bash, perl, wscript and cmd.

I will stop assuming there are such things as competent admins who understand their jobs.

Re:Some corrections and arguments.

[Anonymous Coward]

Dumb fucking asshat. Learn how to read, you piece of shit neanderthal. He said "we weren't," as in "we weren't wrongly listed." Dumb fuck. You just agreed with him. Go drink a bottle of Draino and do us all a favor.

Re:Some corrections and arguments.

[Black Copter Control]

Look at the number of systems in those lists. There is simply no feasible way to track down and notify everyone that gets listed.

Not so true. I have a script that I use to automagically find someone to notice. It first looks for a reverse DNS for the site. If that fails, then it does a traceroute and uses the last reverse DNS in that chain.

Then it reduces the DNS address it got to something 'reasonable' and uses that for a message through abuse.net.

It seems to work reasonably well... Unless you're faking (or refusing to set) your reverse DNS and your ISP is doing the same thing, chances are that somebody will get the notification who can at least pass it on to the proper person.

With over 1500 auto-generated reports, the program seemed to have a reasonably high success rate. It was part of a program that I called nimhunt (I used it to track and report nimda-type virus attacks). I've also modified it for auto-reporting other attacks as well.

Re:Some corrections and arguments.

[Black Copter Control]

It looks like he is familliar with things like whois, bash perl, etc... Unfortunately, his boss seems unwilling to part with money for a linux/bsd box... (although a reasonable linux box could be built with about $200 worth of hardware from (your state).forsale.

A decent Linux server for those kinds of light duty purposes doesn't need much... an 8 bit video card, 64M of ram and a 4Gig hard disk should do you just fine.

Re:Some corrections and arguments.

[sqlrob]

Umm, did you notice the last two commands, neither of which (AFAIK), exist on *nix?

Hell, you can just make the check part of the admin's domain logon script. Nothing says it has to run on a server, nor on *nix. You can do regex and name lookups in VBS/JScript, just as you can in Perl. And Perl is available for Windows too. Worst case, automate IE to the osirusoft rblcheck page and dump it to file that's e-mailed to the admin.

Re:Some corrections and arguments.

[fmaxwell]

Let me start off by saying that you have one very nice piece of software. Kudos.

Then it reduces the DNS address it got to something 'reasonable' and uses that for a message through abuse.net.

While your efforts are admirable, abuse.net is less than universally used -- especially by many foreign domains through which spam is relayed. Many of their postmasters have such a rudimentary command of English that they would probably not even understand a messages that tried to explain something as complicated as their servers being listed on a DNS-based blacklist for spam blocking.

That said, you really should really consider creating a version that:

1. Parses e-mail headers (of spam) to find the correct party to whom complaints should be sent.
2. Sends the complaint.
3. Runs under Windows.

Number 3 is the critical one. What will make companies crack down on spammers is when the complaint rate gets high enough. If one in 10,000 people complain, it's hardly a problem. But if one in 50 complain, then the complaints have to be addressed. Like it or not, Windows is practically universal and that's what would get the complaint rate up.

Re:Some corrections and arguments.

[Black Copter Control]

If you don't mind installing perl, I've got one that does 1 and 2. It needs to be fed emails in standard unix mailbox format. it's called peelhead. I put it in the nimhunt directory It also needs to be configured with the dns names/ip addresses of hosts which handle your email for you.

If you're willing to marry the two pieces (shouldn't be that hard), you could...

Spamassassin and Blackholes.us

[Anonymous Coward]

Sorry in advance if this is redundant. I know
it's a bit lame filtering spam with spamassassin
after having downloaded it, but if you don't
have any other valid option, this would be
good as well.

Verio is listed on blackholes.us, which make it us easier to set it up on
spamassassin

For instructions click here:

http://www.blackholes.us/docs/usage.html

I already use it with china.blackholes.us, nigeria.blackholes.us and korea.blackholes.us, and
I must say I'm very happy of this setup, even if
idiots like "merrynhappy" still are out from
the filters. Notice that I don't filter all the
foreign encodings, since I want to allow my .jp friends as well.

Ciao.

Properly cull LISTS!!!?!!! How could you?!? Spam.

[Anonymous Coward]

Quite simply, there is only ONE list culling method that I would find acceptable: the same one used by the Debian/KDE listservers.

You buy a list of people you think might be interested, you send them ONE email saying "We'd like to send these offers to you, they will be related to ONLY these sales topics. But we won't even send the first one unless you reply to this with "SUBSCRIBE" in the subject line."

You do that, and then immediately DELETE all addresses, only reassigning people to your list when they reply, and it isn't spam, and no culling is possible.

Aside from that, those people who "cull" lists are SPAMMERS. They are stealing time and service, and should be blocked.

Some things

[Sycraft-fu]

First, your phone doesn't draw any more power to ring, or at least it shouldn't. The power necessary to ring is sent down the line. Have you never seen a phone that plugs only to the line? I have one sitting right next to me.

As to your time, well, all sorts of things "steal" your time and and thus far that's not something that you have any recourse for. Besides, you waste plenty of people's time too, it's just how things go.

The big difference between telemarketing and spam is who pays the cost. When a telemarketer calls me, I don't pay a thing, even if I do choose to answer the phone. They pay all associated long distance charges, my line costs me the same amount no matter how many calls I recieve. With SPAM, it is other peopel that foot the bill. The spammers order mail servers to send out thousands of messages, which uses tons of bandwidth on their ISP, and all the recieving ISPs. I work at a university and the amount of bandwidth used to SPAM is not trivial.

This is why telemarketing is not allowed to a cellphone (in the US), you have to pay for all calls including those you didn't initate, so people aren't allowed to make sales calls that would cost you money.

Also telemarketers tend to be much less persistant and much less fraudlent than spammers. Every time I've asked to be placed on a do not call list, the telemarketers have complied (because I can sue them if they don't). Also, all the sales calls I get are really offering me a legit service. When Sprint calls me selling long distance, they will make good on the offer if I want. At least 40% of the SPAM I recieve is totally fraudlent, and spammers don't know when to quit. I have recieved over 10 SPAMs per day for the same thing, form the same company. The only telemarketer I know that tried that receantly is the Miss Cleo service, and they got shut down and fined millions for it.

Re:Some things

[coolgeek]

I get the point about spammers costing the recipient money. I think some people don't see how telemarketers do the same. I also agree telemarketing has more legitimacy than spam, although some spam is generated by legitimate businesses offering legitimate products. And, it works (according to an anecdotal shared with me by a confessed "legitimate" spammer).

Perhaps I did not clearly explain my telephone. It's one of those integrated digital answering wireless types, and uses an external power supply. I seriously doubt the designers of this device went through all the trouble of stepping down and rectifying the 90VAC ring signal to grab the current and trigger the speaker with it. That would be about $.50 of parts when there needs to be about $.02.

Another way telemarketing costs me money: I have my home line setup with busy and delayed call forwarding to my cell phone. If my house line is busy, or after three rings, a forwarding call is placed. Since my cell phone is a Zone 2 call from my house, I have to pay about a nickle for the forwarding plus per minute charges, I also have to pay a minute for answering my cell phone.

One may argue that it is my choice to have this fancy setup. I have to say I agree, however, I would argue too if you have a connection to the Internet, it is a choice to setup a computer listening on port 25.

Re:Some things

[mindstrm]

What you are missing in your ideal world..
is that you have made a conscious decision to use devices with no access control. If your friend calls you, but you don't want to talk, has he stolen from you? Whta if someone calls you every 20 minutes while you aren't home, have they stolen from you as well?

By forwarding your calls to your cellular phone, YOU are accepting that any call will be transferred; there are rules about telemarketing to cellular phones, but it is unrealistic to expect a telemarketer, who CALLED A LANDLINE, IN ACCORDANCE WITH REGULATIONS, to know that your cellular phone is on the other end.

HE.net included? Surprised!

[markwelch]

I was also surprised to see he.net included in a blocklist. I hosted with them for a year (until moving my server home to my DSL connection due to budget constraints) because they have consistently had one of the strongest anti-spam responses, dating back to the "Joes.com/Yuri Rutman/thinning hair/el cheepo" forged-spam attack.

I do know that one of their employees handling spam complaints did give me a reason to pause once -- she initially accepted a spammer's response, but that action was reversed as soon as I challenged it, and the customer was terminated, and I was sent an apology making clear that this was a mistake, not a new spam-tolerant policy at the company. Later complaints were promptly and properly handled.

I believe that at least three he.net customers were terminated in the past year due to complaints I submitted. (And I was a lowly $200-per-month colo customer, and at least one of the terminated customers was much bigger.)

If he.net is leaving the door open to spam-cartels, despite warnings, then of course they should be blacklisted. I just find that harder to believe. In contrast, my experience has been than Verio is extremely spam-tolerant, even balking at terminating Spamford Wallace (they finally relented and cut him off, which resulted in his filing a frivolous lawsuit against me, costing me $5,000 to get the suit dismissed). All my more recent spam complaints to Verio have gone unanswered, and I know I have several Verio IP blocks already on my filter list, though I haven't blocked all their IP addresses.

Re:HE.net included? Surprised!

[Anonymous Coward]

I'm suprised at HE.net, I thought they had their act together.

Not anymore. Mike Leber needed cash, so he sold out whatever morals he may have had to the multitudes of pr0n spammers he now hosts and provides bandwidth to.

Worry not, if you've got the bucks, HE.Net will allow you to spam 24/7 - just make sure the check's on time!

Re:HE.net included? Surprised!

[jmeyer]

This is wrong because Hurricane Electric has terminated service to as26212.

HE.net has in the past disconnected numerous multi thousand dollar per month customers for spamming.

I have been a member of this site for as long as it was possible to be a member and an employee of Hurricane Electric for the past five years.

Re:HE.net included? Surprised!

[Skapare]

Can't you counter sue Spamford Wallace to recover costs due to his frivolous lawsuit against you?

Re:HE.net included? Surprised!

[Skapare]

If there are any remaining SPEWS or other listings directed at any HE.NET address space, then you know how to check them and you know where to post to point out what spammers have been removed. Don't forget, spammers are like cockroaches when they get in. They hide everywhere. Sometimes you just have to spray the place. And maybe when the stench finally fades, more legitimate businesses will come your way.

Re:HE.net included? Surprised!

[markwelch]

No, not really, it is not economically feasible, and his whole goal in suing me was to get publicity, which would just continue if I sued him back. There are also some complex jurisdiction issues involved in the case - I might have to sue him in Pennsylvania or New Jersey, and then he'd just sue me again to try to extend the publicity. (This was all in 1999 so it's moot now anyway.)

Re:HE.net included? Surprised!

[klparrot]

All my more recent spam complaints to Verio have gone unanswered, and I know I have several Verio IP blocks already on my filter list

Hmm, you haven't blocked their reply to you, have you? ;)

Criminal activity

[Anonymous Coward]

Isn't Verio an ISP located in the U.S.?
Isn't spamming a crime in the U.S.?

If so, isn't Verio (or at least its upper management) aiding in a criminal offence?

Isn't spamming in the U.S. punnishable by a HUGE fine? ($50 or so per unsollicited email. say: 200.000 x $50 = $10,000,000 (ouch!))

It can't be!

[Anonymous Coward]

AS26212 - the new spambone

SPAM doesn't have bones! Or at least if it does, they are ground up really well...

one day....

[TheShadow]

One day we won't be able to send anyone email because everyone will be blocked because of spam. Maybe that's why MS, AOL, etc are scrambling to gain marketshare in IM services.

Re:one day....

[Anonymous Coward]

spam instant messages already happen

Re:one day....

[Anonymous Coward]

Let me guess, you've never gotten spam via ICQ? I have.

block the DNS

[terrox]

yay, blocking the ISPs kicks arse! - I love it.

One problem with that approach

[smcv]

I was wondering whether to get a second domain (hey, .uk domains are cheap :-) to do this sort of thing with. However:

- Do you trust your friends and family not to give your e-mail address to other less trusted friends?

- Do you trust your friends and family not to put you in the To: or Cc: list of a mail going to several less trusted people?

- Do you trust your friends and family not to forward mails you sent them, or multi-recipient mails others sent them that also went to you, with your address still visible?

- Do you trust your friends and family not to get Klez and pass your address on to just about anyone?

For me, until I convince more people that they're doing things wrong, the answers to all these are "no".

Having said that, I'm pretty much doing this already; I get a small amount of spam to my main address, but I don't think it gets harvested often, since I've managed to remove it from most web pages (at least the ones Google finds).

Re:One problem with that approach

[Phroggy]

Exactly! That's why his idea doesn't work. It works for awhile, but then your address gets out, and then you're screwed. If you have multiple addresses for different purposes, you can manage them.

The e-mail address I used for eBay finally got added to a spam list, so I changed it, and now all that spam bounces. I don't have to worry about losing legitimate mail, because that address is only used by eBay and those involved in auctions I'm participating in (none currently).

However, the address I normally give out to people (I don't post it online anywhere, but I do use it as my return address when I send mail) gets several pieces of spam per day, presumably for the reasons you listed.

Re:This is excellent...

[Rik van Riel]

To see the spammers win and block legitimate sites to stop the criminals is well... criminal. Isn't that what all of us who believe in freedom are supposed to be fighting against.

Are you saying spammers have the right to free speech on my server ? I don't think so. Sending email to me uses my resources, so I have the right to decide from whom I do (or do not) want to decide email.

Sure, advertisers have a right to free speech. Let them setup a website to promote their product, everybody who wants to see their commercials can go to their website and see it.

Suggesting that spammers have a right to free speech on the public property of others is like saying that I have the right to start digging around in your garden.

Your sig

[Anonymous Coward]

Is the answer Jon Postel?

Client-side filtering is NOT the solution

[Andy Dodd]

While you may have broadband, not everyone does. Probably 50% or more of Internet users are still on dialup.

While you may only check your mail from one machine, not everyone does. And most people don't have the luxury of setting up an IMAP server so they can access their post-filtered mail remotely. (I do, but a cable modem connection isn't the most reliable, so I often find myself having to read raw unfiltered spam-laden mail.)

Also, wireless access to email from cell phones (either "dumb" WAP browsers or "smart" integrated PDA/phone solutions) is becoming more common. Have you tried downloading 100 messages over a 14.4 connection, only 5 of which weren't spam? Have you tried sifting through 100 subject lines on a cell phone screen. (It's painful even on a Palm PDA screen like my Kyocera 6035's). Thanks to the proliferation of spam in my inbox, I cannot even THINK about using my wonderful phone for email, something which it would normally be excellent for.

It doesn't matter how good client-side filtering is (mine is a manually maintained blocklist, plus a few rules to detect malformed HTML that is always spam and fake Yahoo/Hotmail/Netscape addresses not coming from their servers.), the client still must pay for bandwidth, and in the case of wireless users, per-minute download time at 14.4 (Or in 2.5G systems like Sprint Vision and Verizon Express Network, per-kilobyte.)

Simply put, it costs the user money to receive spam, therefore something needs to be done about it before it reaches them. Server-side blocking reduces user costs in:

a) Download time/bandwidth for the mail
b) Storage costs on the ISP server that are passed on to the user in the form of higher fees.

These are both costs that cannot be negated with client-side filtering.

Bogofilter Q

[LinuxHam]

OT, but hey. I started testing Bogofilter this weekend. I preloaded 594 good and 253 bad emails. Had 0 false positives and 2 of 24 false negatives in 24 hours. I had to create a new mail folder called "IsSpam" that I could dump false negatives into. I occasionally have to run "bogofilter -S ~/Mail/IsSpam" to force bogofilter to re-evaluate those emails as spam. My question:

Can I setup a fifo or something such that when I move an email into that file, my system will actually execute "bogofilter -S" with the email as STDIN before sending it to the bit-bucket? TIA

Verio

[SayBee]

I believe that Verio hosts both Iraq's UN page and the Saddam Hussein page link off of it.

Verio.net allows spam

[Anonymous Coward]

About 20% of my spam actually comes from Verio.net. Yes, I know how to decoded the headers, but I let spamcop do it for me. Verio refuse spam reports from spamcop. I hope they see the light once people start refusing them service.

If you really want spam...

[fizbin]

Posting to usenet seems to work well, especially if it's in one of the groups that are constantly full of flames.

Just pick a few flamewars in alt.scientology, or comp.lang.basic.visual (or whatever the vb group is), and join in with something that's basically a repeat of what someone else just said, only with worse grammar and spelling.

Even if you somehow miss the regular spam email harvesters, if you piss off enough people, they'll sign you up to all the spam lists they can find. Let them do your work for you.

I've Been Debating With Myself...

[Anonymous Coward]

...over What To Do About Verio. Following Stiff Linfeed's action, I've decided to add the blackholes.us verio.blackholes.us zone to the DNSbl list on my mail server at home.

Where I work we used to be a Verio corporate customer. When I saw the direction they were apparently headed wrt letting spammers live in their space, I got us moved out of there. Glad I am that I did so!

Re:Is that why spam in my Hotmail account has drop

[tacokill]

Mine too. I've noticed a SIGNIFICANT drop in my hotmail spam.

Now, realize I ONLY use the hotmail account for "commercial" communications - receipts, etc from online purchases so the volume of SPAM is normally huge -- like 40-70 per day before whatever change took place. Now its more like 10.

If Verio takes unfounded legal actions...

[macdaddy]

...the sound they will here will be a resounded *PLONK* as they are entered into a thousands of mail admins' personal blacklists everywhere including my own. When Exactis sued MAPS, all they managed to do was to get permanent REJECT entries in Sendmail ACLs everywhere. Verio should expect no less.

Agreed

[macdaddy]

In fact I said it in a later posting. If Verion lawyers up and cartooneys, the sound that they'll hear is resounding *PLONK* from admins like ourselves as they earn themselves their own entry in our personal DNS blacklists. I don't mind one bit blacklisting them to hell and gone if they pull a legal stunt. They can rot in my spambin.

WRONG!!!

[fmaxwell]

WRONG!!! Alan Brown aka ORBS blocked commerical competition or ISPs that just pissed him off.

WRONG!!! Alan Brown did not block anything. He simply maintained a list. If your ISP used ORBS, then your ISP was blocking the e-mail because it came from a server listed in ORBS. That was the point.

Know your platform.

[Anonymous Coward]

The chances of getting any additional hardware (we're talking Windows platforms here, so don't expect any useful things like task schedulers

E:\>ver
Microsoft Windows 2000 [Version 5.00.2195]


E:\>help at
The AT command schedules commands and programs to run on a computer at a specified time and date. The Schedule service must be running to use the AT command.



S:\>ver
Microsoft Windows XP [Version 5.1.2600]


S:\>schtasks /?
SCHTASKS /parameter [arguments]

Description:
Enables an administrator to create, delete, query, change, run and end scheduled tasks on a local or remote system. Replaces AT.exe.

Re:Way to make the internet more useful ???

[Anonymous Coward]

you forgot something :

1. Legitimate users complain to the rogue provider and it changes its ways,
2. Legitimate users leave the rogue provider, usually leading back to 1. or straight on to 3.,
3. The rogue provider goes out of business,
4. If the rogue provider somehow stays in business by only hosting spammers, everyone else in the world blocklists them and they are effectively no longer part of the Internet.
5. Legitimate user is in an area where there are only one provider ( a common situation in many coutries ) - Legitimate user can not get usable broadband.
6. Legitimate user is bound by contract to pay 100$/month for the next 6 months plus pay consultant to adapt setup to new provider - net cost $1000 ? - Legitimate user goes out of business / can't afford the change.
7. Legitimate user has to spend weeks trying to figure out how to get of blocklist, negotiating not so obvious systems set of by careless list owners
8. Blocking provider subnets affects both spammers and Legitimate users, however the last category only represent 99.9% - so what the heck .... no big deal.

Trollback winner, fourth place!

[Anonymous Coward]

Congratulations, I Am The Owl! A winner is you!

Right.

[mindstrm]

But the organisation, as a whole, needs to change it's policies. Blocking just the end user address space would prevent spam, but not have a great effect on verio.

Blocking all of verios customers, so that they take action, is another.

Re:Right.

[confusion]

I think its clear that verio needs to change their ways, but is using a system designed to weed out spam as a punitive punishment against an organization that we don't feel is "doing the right thing" appropriate?

Should we blacklist companies that discrimate? Should BL repressive governments? Should we BL abortion rights groups, aethist groups, porn sites?

Maybe I'm naive and idealistic, but I think blacklists should be used to block spam sources [open relays, open proxies, known spam sources].

Re:Right.

[mindstrm]

That is the whole point of the system, though.. to effect change through punitive measures.. not simply to block spam.

Their network permits spamming, so we block their network. Pretty straightforward.

Shoudl we blacklist comapnies that discriminate? Hey, if someone wants to start a list of networks who host discriminatory materials, and others want to use that list to block those sites from view, yes, absolutely.

Remember, people use this list because they percieve that it gets results... the list doesn't block anyone, other people use the list to block people.

Time For Legal Remedies

[Lew Payne]

Hopefully, Verio will file an action sounding in tort, and this abuse by spamhaus and others will come to an end... in much the same way as MAPS received its legal slap in the face. Geeks have to learn that there are legal ramifications for their actions. A mass protest on slashdot, or in the media, will not change the fact that they will be held accountable in a court of law.

Geeks seem to make a lot of noise (mostly online) regarding the law, but have little of substantive value to contribute to the laws themselves. I see so much rhetoric, assumption and lack of understanding of these matters by the geek community that it's obvious why they're not taken seriously in the legal world. So be it... just as man cannot live in a vacuum for very long, geeks cannot survive in the legal world.

Re:Time For Legal Remedies

[Anonymous Coward]

What part of the law forces someone connecting to the Internet to accept every packet sent on any port by any IP, Perry Mason? What would be the basis for the tort? Has some legislative body or court already decided that every mail server must operate under this obligation? Does it extend to the user, requiring them to read the crap, too? Are ISPs required to absorb DDoS attacks, or can those packets be dropped?

Go back to the old law library & see if the contract (and AUP) doesn't govern in this case. Verio is violating its own AUP - it'll be hard for them to make the case that they're being hurt by Spamhaus when their own AUP says what they're doing is wrong.

Maybe the "geeks" just have some crazy idea that they can control their own machines.

Their own medicine

[Anonymous Coward]

Just "report" spammers as easy paths for al qaeda to send messages and order attacks.
Theyll be running from predators in no time. >:>

Best Spam filter

[conana]

Does any one know of spam filter that really works? Thanks, The Natural

Is Verio spamming?

[mr17hz]

I'm reading an awful lot of comments here debating whether or not anti SPAM lists should exist, but what does this have to do with Verio being blacklisted?

My understanding of this whole situation is this: Verio allows their costumers to participate in SPAM related activities, and so a very large blacklist has banned them completely. Verio does not fund these organizations, they simply provide access to a very popular TCP/IP network ("the internet").

Now, I'm all for blocking spammers. But seriously - Verio is a service provider, I don't see how it is their responsibility to tell their clients what data can and can't be transfered through thier infrastructure. Infact, it comes very close to what I consider the invation of privacy.

If I use my ameritech phone to call Billy the hitman, and ask him to kill my cheating wife suzy - is that ameritech's fault?

Spamming is a problem, I agree. Something needs to be done, I agree. But leave the service providers out of this --- I believe in free speach, i'm not going to blacklist anybody for not sensoring material that they didn't write. Quote it word for word. I want to hear it from the source. and if I don't like what I hear, I'll take it up with the source.

Don't shoot the messenger.

Re:Is Verio spamming?

[Anonymous Coward]

Verio's AUP already prohibits spam-related activities, doesn't it? They choose not to enforce it so that they can get their grubby mitts on the $$. Your phone analogy is way off. No one is blocking Verio because it was used to send a message about an illegal activity (murder for hire).

Here's a better one: Use your Ameritech phone to make repeated phone calls to people who don't want them. If you'll look in the front of your phone book, you'll see that's the way to get the phone yanked.

Go to a dictionary & look up "censorship". No one is preventing Verio from sending email - many people have just decided they don't want to receive it.

How do they email a complaint?

[ticklemeozmo]

My question is, how does Verio email a complaint if their corporate servers are blacklisted?

Just one little question...

[Vortran]

Don't spammers hate getting spam?

Re:This is excellent...

[shaitand]

no, I'm not saying spammers have a right to free speech. It's illegal to spam. As for YOUR resources, they aren't yours anymore than my apartment is my landlords. He can't walk in the door without my permission, and he certainly can't decide what guests I do or don't invite. He can kick me out (though only with proper legal notice) but until he does I can get phone calls from whoever I want, I can have charlie manson over for dinner, he not only has no right to a say in who I invite over. He has no buisness KNOWING what MY decisions were on the matter. I'm straying from my original point though. The reason those who believe in freedom should fight this, isn't an issue of free speech. It parallels the issue of fair use in copyrights. It's the same philosophy that makes it wrong to implement copy protection mechanisms in cd's, books, etc. I have the right to copy it for personal use, the right to print the book out and use the pages for wallpaper, or quote brief passages. Anything that prevents users from printing or copying these materials may or may not stop the criminals, but it also stops ME from doing what I paid for the right to do. If for every 10 spammers you block, you block one legimate user (buisness, home, scientific, it really doesn't matter) then your blanketing that user over just like copy protection schemes blanket legitimate fair use of copyrighted materials and that is wrong.

Re:This is excellent...

[shaitand]

another note, if this is your personal server, and mail being sent to you, YOU have the right to block anybody sending anything to YOU. It's when your making this decision for others that it becomes wrong.

Re:The Art of Cunniligus

[CableModemSniper]

Cmon, this is informative! How come it hasn't been modded up yet :)

Re: abuse.net Re:Some corrections and arguments.

[Black Copter Control]

While your efforts are admirable, abuse.net is less than universally used

Abuse.net doesn't rely on the admin of the domain. They just keep a list of abuse addresses explicitly known for various domains. Where a domain doesn't have a known address, it defaults to abuse@the.domain. Anybody can submit an update for a domain if they have information (obviously, authoritative sources are preferred).

For sites with non-english reading admins, there's not a whole lot more you can do (unless you know their language). If they're lucky, they may be able to have someone (babelfish?) translate your letter for them. I wouldn't mind learning mandarin, but I'm not going to learn it just so that I can do multilingual spam warnings.

Thank you!

[fmaxwell]

Thank you so much for that! I've downloaded everything and it looks like it's time for me to start learning perl. Your good commenting practice will make it a lot easier. Perl seems both very powerful and somewhat cryptic at the same time. ;-)

Re:Thank you!

[Black Copter Control]

The nastiest part of prel is the regular expressions.

If you've got access to a unix/linux system, man perlre will give you a reasonable introduction to perl regular expressions.

You might also want to download the perl reference manual.. It's designed to be printed double sided, then folded and stapled like a pocketbook. I find it a very usable summary of perl overall. I use it on a regular basis. (or just grab the pdf file and print it

In terms of books, I'd suggest the O'Reilly books (no shock there)

Last Post!

[alpg]

The startling truth finally became apparent, and it was this: Numbers
written on restaurant checks within the confines of restaurants do not
follow the same mathematical laws as numbers written on any other pieces
of paper in any other parts of the Universe. This single statement took
the scientific world by storm. So many mathematical conferences got held
in such good restaurants that many of the finest minds of a generation
died of obesity and heart failure, and the science of mathematics was put
back by years.
-- Douglas Adams

- this post brought to you by the Automated Last Post Generator...