Spam Blocking Engine for OpenBSD

mkeke writes "In a post over at OpenBSD Journal, Theo states that he has written a spam blocker that works with pf and Spews. It looks darn cool :)"

Comments

Re:Worldcom = Spamhaus

[realdpk]

SPEWS is lame. They do not even follow their own policies (specifically, that they will remove listings after spammers are terminated. 6+ months now, still listed. And they say you can't contact them (and posting to NANAE is _not_ an option).

SPEWS has made themselves completely irrelevant in my eyes.

Re:Worldcom = Spamhaus

[__aanonl8035]

Just want to pipe in and say you
are right on the money. We acquired
our IP block from a telecom only
to find that the IP range was listed
in SPEWS. We have had the IP range
for 3 years now, and it is still
listed in SPEWS.

It is unfortunate though, that many
administrators just sign up their
mail servers to all the blacklists
they can find without considering
the quality of the lists and how they
are maintained.

Re:Worldcom = Spamhaus

[meringuoid]

Just want to pipe in and say you are right on the money. We acquired our IP block from a telecom only to find that the IP range was listed in SPEWS. We have had the IP range for 3 years now, and it is still listed in SPEWS.

Which entry is it? Chances are it's your ISP that's the problem. If a provider continues to support spam (giving spammers several free runs before nuking them, ignoring complaints (or worse, forwarding them to the spammer), helping them listwash, etc) then SPEWS have been known to list the ENTIRE network, not just the spammer or even just the /24.

Re:Worldcom = Spamhaus

[eaolson]

6+ months now, still listed.

At risk of introducing facts to this debate, would you mind giving the listed IP/SPEWS number for the listing you're talking about?

Re:Worldcom = Spamhaus

[crucini]

SPEWS is lame. They do not even follow their own policies (specifically, that they will remove listings after spammers are terminated. 6+ months now, still listed. And they say you can't contact them ...

Why should SPEWS remove a listing immediately upon removal of the spammers? The "policy" you seem to be thinking of is:

...if spam or spam involvement (hosting spammers, selling spamware) from your IP address/range ceases, it will drop out of the list in time.

"In time" does not mean immediately. How many months did you harbor spammers? More to the point, what's the relevant IP address or range? Without specifics, your complaint rings hollow.

(and posting to NANAE is _not_ an option)

Of course. The NANAE regulars have seen every flavor of spammer lying and evasion. You're looking for a naive audience that might give you some sympathy.

SPEWS has made themselves completely irrelevant in my eyes.

SPEWS wasn't made to please spam hosters. It was made to keep your spammy network away from my inbox.

Again, if you think you have a legitimate complaint, post the IP range in question.

Re:Worldcom = Spamhaus

[realdpk]

i'm not going to post the IP range.

"in time" should not mean >6 months. we were in the list for maybe 1 month before booting them. the spammer is *long gone*. IN FACT, the spammer moved before we kicked him off our network, and SPEWS recognizes this, and yet still lists us.

the reason i won't post to NANAE or here w/ the IP range is because it's pointless. SPEWS shows very clearly just how silly the anti-spam movement has become. dealing with anti-spammers is like talking to a brick wall.

Re:Worldcom = Spamhaus

[crucini]

I've seen plenty of claims like yours posted on NANAE. Most of the time the claimant is wrong - there is still an ongoing spam problem from the listed IPs. So without knowing more about your particular situation, the balance of probability is that you are incorrect, and there is good reason to list your IPs. Often enough, however, the claimant is right and SPEWS neglected to unlist them. In those cases, SPEWS reacts quickly, usually moving to a level 2 listing.

Here's my point: I've yet to see a single case where the IP was listed in error and SPEWS didn't immediately fix the problem.

Also, the attitude of anti-spammers on NANAE doesn't really matter. No matter how much venom they hurl at you, if they can't produce objective reasons to keep you listed SPEWS will delist. My observation is that SPEWS is not looking for a "vote" from the community - they are looking only for evidence of spam support. I've seen IP's delisted while the NANAE regulars are still out for blood.

550? 450?

[Habbie]

I assume he means a 450 reply, not a 550? 550 won't make the message stay in the queue, 450 will.

Re:550? 450?

[Anonymous Coward]

yes, in the code there is a gem like so:

char *reply = "450";

i'm guessing the 550 is a typo in the message body.

Re:550? 450?

[edgarde]

450 says there's still a mailbox there. 550 says not found. Here's a list of SMTP codes.

Incidentally, the code actually has a command line option to choose between 450 and 550.

Re:550? 450?

[Matts]

Yes, and the poster you replied to was absolutely correct though. No email MTA keeps the email in the queue for a 5xx error as this is a hard bounce (retrying after a 5xx error would be a violation of the relevant RFCs). Only a soft bounce error (4xx) will keep the message in the queue. So the statement in the original message about using up disk space is totally invalid.

Re:550? 450?

[PacMan]

No email MTA keeps the email in the queue for a 5xx error as this is a hard bounce (retrying after a 5xx error would be a violation of the relevant RFCs)

If only this were true! I have seen several examples of mail servers that would not take 5xx=no for an answer. One or two of them wern't even spammers!

I have also seen some servers (generally Microsoft product) whose idea of "later" (as in, "put the message in the queue and try again later") is on the order of 1 second.

Re:550? 450?

[Habbie]

That is a known bug, it happens only on 4xx tho, not on 5xx responses.

It is documented here.

Note how you need to prove that you actually have this problem to get the patch. Yay Microsoft.

At my previous job, administering the mailservers, this bug caused me a lot of trouble, forcing us to block remote hosts at times.

Re:550? 450?

[TheRealDamion]

Surely a 4* will mean it'll try later keeping it the queue for a while until it gives up and also confirming the address is valid. a 5* response should mean sorry you're wrong to even try this address. Which should make it now go and bounce this back to whoever sent it. This means that a 5* will fill the disks just as well but it'll be spending it's time trying to email back to the Sender.

difference

[sethadam1]

Can anyone explain why you wouldn't just use SpamAssassin?

Re:difference

[Anonymous Coward]

Because that would require every user to install Spamassasin. This solution from Theo is server-side, which means that the users don't have to do anything in particular to get rid of the spam.

Re:difference

[Amarok.Org]

Can anyone explain why you wouldn't just use SpamAssassin?

Why drive a Ford when you've already got a Chevy available? It's a matter of choice, preference, features, etc.

Re:difference

[fruey]

SpamAssassin uses keywords, RBL listings, et al.

This is just a lightweight SMTP server which takes over anyone who is SPEWS listed and rejects them. A decent server like Postfix + amavisd & SpamAssassin will already do this with little overhead.

More reinvention of the wheel, I fear.

Re:difference

[Anonymous Coward]

Spam assasin removes it from your mail box. This prevents it from reaching your mailbox and as the authos says "hopefully starts to cost the spammers some cash and resources"

Re:difference

[bconway]

SpamAssassin is nothing more than an advanced filter. This stops the spam before it gets to you and fills up the offending mail servers disk space with it.

Re:difference

[Zigg]

Err, SpamAssassin isn't exactly what I'd call "low overhead". While it's pretty good at what it does, it still has potential to slow my 32MB mail server to a crawl unless I tell spamd to process only one message at a time.

And that's only filtering my mail.

Re:difference

[fruey]

Horses for courses. RBL checking costs a DNS lookup and little more - so why have a separate daemon do it?

SpamAssassin has to parse the whole message body, so you've already accepted it. I didn't mean to make it look like it was super low overhead with SpamAssassin, I meant that it's low overhead without it, and that with SpamAssassin you can do a lot more.

I oughtta Preview before Send more often. I type too fast and it gets confused

Re:difference

[Tucan]

You can setup SpamAssassin in a site-wide configuration. You could also put it together with MimeDefang and integrate it with Sendmail.

Re:difference

[grub]

Can anyone explain why you wouldn't just use SpamAssassin?

Once the spam is in your system then your bandwidth, disk space and other resources have already been consumed by the spammer. This prevents the spam from ever coming into your network and put the burden of the load back on the spammer's shoulders.

Damn fine work.

Re:difference

[Anonymous Coward]

if you actually read the article on deadly.org - it pretty much explains how it costs the bandwidth, disk space and most importantly time (of the spammer) .. Spam assasin simply tosses the mail aside for you. (big difference when your server is getting hit umpteen thousand times by the same spammer).

Re:difference

[fries]

spamd will take very little load, it doesn't even fork!

spamassasin does regex rules against the data section of messages. Per message, there is a very _large_ difference between the two in terms of overhead.

spamassasin/ifile/bmf/tmda is when a spam gets through, for everything else, there's spamd:spews!

Re:difference

[Anonymous Coward]

If you read the exhaustive thread on the topic. The idea is not to "block spam", but to slow down/cause "harm" to the open relays, in the hopes that the only way these oblivious people who have open relays will realize that they do, is when i.e. your server craps out with "disk full" errors, or the like.

Re:difference

[lyberth]

SpamAssassin is an aplication thatlooks at the content of a mail, and analyses it and grades it depending on certain factors, and stamps a mail as spam if it is.
What this patch does is chekking the package at protocol level. The mail hasn't nessesarily arrived yet. So no application has to take analyse it later (at least not if it spam)

Re:difference

[scooby2]

shit, give me your address and I'll send you $5 to upgrade that thing from 32mb to 64mb.

Re:difference

[DrZaius]

I use SpamAssassin on our Qmail server using Qmail-Scanner. Works great. Out of the box it catches 95% of my spam.

All I need to do is set up a few outlook rules to parse the headers it places. Everyone else in the office seems to enjoy its results as well.

Spews = /m\

[joeszilagyi]

Why even bother with Spews? Why not Spamcop, who doesn't block half the planet?

Re:Spews = /m\

[General_Corto]

Perhaps because SpamCop is overzealous to the point of stupidity?

See, for instance:

• Here;
• Here;
• Here;
• Here;
• Here;
• Here;

Quite frankly, Julian Haight comports himself like a True Asshole. Admittedly, Theo can be rather terse himself, but he generally doesn't cause innocent third parties distress while attempting to achieve his goals.

Re:Spews = /m\

[joeszilagyi]

By their nature, Spews, Spamcop, et al have to "hard core" in their dealings, but Spamcop can at least be worked with (to varying degrees, I suppose, but still). Spews operates anonymously and has virtually no accountability. They're effective, but any body with that much power that operates with no realy oversight is a danger on some level. Ashcroft, Bush, Poindexter, Spews, Microsoft's endless lust for probing PCs, it's all different levels of the same thing--a lack of oversight.

Anyway, blocking entire IP blocks *is* a good tool. It is the responsibility of every ISP to deal with spammers within their network. If something.com is sending out 100,000 spam a day through a certain IP and just changes it, because they have a whole block available, what's wrong with cutting out the knees of the people letting them do this? Yes, it does hurt and inconvenience others, but ISPs have to responsible for and aware of what happens in their own network.

Re:Spews = /m\

[joeszilagyi]

Wow, that was some horrid spelling. Is there a way to edit posts? Oh, and are there email notifications if someone replies?

Re:Spews = /m\

[PacketMaster]

And spews doesn't? Spews randomly blocked a consulting company's netblock I worked for part-time simply because that our block was next to a "known spammer's" block. When they politely asked to be removed and pointed out that according to their own evidence file that their netblock had nothing to with spam, they were met with very hostile responses and told to essentially ditch their teleco provider because they'd never unlist anyone. They admitted that they simply block IPs in a form of "collateral damage" because they feel like it to hurt legitimate businesses so they flee their network provider. Look at antispews.org for more info on their flagrant abuses and why you shouldn't use spews.

... generally doesn't cause innocent third parties distress while attempting to achieve his goals.

Using spews is going to cause third-party distress.

Re:Spews = /m\

[Anonymous Coward]

So don't use Spews or Spamcop. If they cause enough legitimate mail to be denied then people will stop using them until they clean up their act. The few die-hard fanatics that continue to use them regardless of the fact that they block legitimate mail probably don't care anyway. Do I care if I don't get any mail from AOL's netblocks? Not really. Do I care if I block hotmail.com? Nope. Spammers and service providers need to learn that spam is a very real problem and accounts for almost as much wasted bandwidth as P2P traffic. If you're some Korean ISP and have dozens of open SMTP relays, banned. Period! In fact, I would block all Asian IP addresses if I had a definitive list. I don't read Chinese so why would I want to get email from them?

Re:Spews = /m\

[Paul Neubauer]

The block was hardly random.

The ISP was hosting spammers and doing nothing to rectify that. Thus they were supporting spam.

Your company was paying that ISP. Thus it was also supporting spam.

SPEWS acts to not support spam.

There is a very truthful saying, "In the war on spam, there are no innocent bystanders. Only spammers, spam supporters, and their victims."

Trying to claim victim status while supporting spam makes you look foolish.

Oh, and I am not SPEWS. If I was, I'd be terribly drunk with all the drinks folks would want to buy for me.

Re:Spews = /m\

[mackstann]

hehe..

as it says, "you should have hit the preview button". posts are in stone :)

as for emailing for responses...check your message preferences.

Re:Spews = /m\

[Just Some Guy]

Your company was paying that ISP. Thus it was also supporting spam.

I understand the principle involved, and admit a fair bit of sympathy for that point of view. However, for some of us, switching ISPs isn't a luxury we have. I live in a small Midwest town. My options are:

• DSL/wireless via the local dominant ISP
• DSL via MSN
• Cable modem
• Dialup via one of those "unlimited access for only $6.95!!!!" companies

Out of that list, the first option is the only one viable for hosting servers, since the rest either block service ports, have onerous TOS contracts, or just aren't serious connections.

Say that I discover that the local ISP (which has probably a 98% market share here) has some customers with open relays. What do I do? Buy a T1 and contract with Qwest, or get out of online business altogether?

In practicality, I don't have the option to switch, regardless of my ISPs policies.

Fortunately, the provider is run by a great set of people, and employees several real system administrators, so I don't really have to worry about this hypothetical problem. That's a Good Thing, because I'm pretty well stuck where I am.

Re:Spews = /m\

[Anonymous Coward]

"and accounts for almost as much wasted bandwidth as P2P traffic"

And why, pray tell, is P2P traffic `wasted`? In my opinion its bandwidth well spent - certainly more (value for money) than standard web-page/usenet traffic.

"In fact, I would block all Asian IP addresses"

Fucktard.

Re:Spews = /m\

[Senior Frac]

And spews doesn't? Spews randomly blocked a consulting company's netblock I worked for part-time simply because that our block was next to a "known spammer's" block.

I just went to SPEWS' website. It appears that this falls within their listing criteria. I'll take it you don't agree with their listing criteria.

When they politely asked to be removed and pointed out that according to their own evidence file that their netblock had nothing to with spam, they were met with very hostile responses and told to essentially ditch their teleco provider because they'd never unlist anyone.

They talked to SPEWS? It says here SPEWS doesn't talk to anyone. Are you sure? That statement appears highly misleading. Are you certain they didn't talk to news.admin.net-abuse.email?

They admitted that they simply block IPs in a form of "collateral damage" because they feel like it to hurt legitimate businesses so they flee their network provider.

Boy, this is so misleading as to be approaching a lie. They really, really talked to SPEWS, huh? And "spews said"...?

Look at antispews.org [antispews.org] for more info on their flagrant abuses and why you shouldn't use spews.

The fact that you disagree with their listing criteria is all fine and good; that is your right. But there seem to be lots of outright wrong information on that webpage.

My server, SPEWS recommends, my decision whether to trust them, and my decision as to their effectiveness.

Re:Spews = /m\

[zBoD]

Sorry, not related but I don't understand the subject line of this comment... Is /m\ some sort of ascii-art, or something?

Re:Spews = /m\

[astar]

I am a spamcop subscriber. Thus I pay Julian to keep spam out of my inbox. I also pay for the pleasurer of reporting spam that does get there or is in my held mail web box. No doubt if Julian misbehaves sufficiently in supporting these goals of mine, then I will stop paying him. I suppose if people have other goals or he misbehaves sufficiently, then other people will stop paying him and the Julian problem will be solved.

But he meets my goals pretty well, so there is not a Julian problem for me. I have gotten one spam in my inbox in the past week.

Here is an important technical point: IMO, Julian designated spam ends up in a web held box. I look at this periodically and do things with it. If I want it, I can forward it to my real inbox with a couple clicks. I can also whitelist it so in the future it will go to my inbox not my web held mail box.

It seems to me that being on Julian's spam list is not the end of the world, if your recipient's actually want your mail. On the other hand, Julian "sells" his list to third parties and I do not know what they do with it.

There are some important side effects. Many spammers simply do not send spam to a spamcop address. So I am gradually closing down other accounts and publicizing the spamcop address. And my employer mail server was an open relay and I subscribe through spamcop to a bunch of openrelay lists, and so this unfortunate situation became clear quickly and the server was reconfigured.

All in all, for $30US a year and some time, I figure I am keeping my inbox clean, fighting spam, and receiving the email I want.

Re:Spews = /m\

[patter]

I'd rather bother with spews as you put it.

First off, spamcop's too narrow. What happens when spammer is moved to another subdomain on the same network? You get mail again and wait for spamcop to kick in.

With spews it was targetted first, then broadened as the upstreams refused to deal with the problem.

Also, philisophically, all spammers being directly blocked accomplishes is that there aren't enough complaints to justify the big guys paying attention to the anti-spam crowd. When REAL customers are also complaining, then the big guys start listening. Takes time, but some of them have finally woke up and smelled the coffee, and work on a continual basis to kick the spammers off their networks.

If it takes expanding the block to all of Sprint for example, pretty quickly does sprint realise that no matter how much the spammer is paying them, it hurts their business model to not fix their problems.

Re:Spews = /m\

[The Turd Report]

So, which backbone do you use that does not host *any* spammers? The innocent people listed in SPEWS don't support spam. They just pay their bill for their internet connectivity.

Re:Spews = /m\

[Florian Weimer]

Why even bother with Spews? Why not Spamcop, who doesn't block half the planet?

SpamCop's blacklist announces hosts with a bad no-spam/spam ratio. As a result, non-US freemail providers tend to end up in SpamCop's blacklist.

SpamCop is honest and they warn that the blacklist should only be used for tagging, but many people ignore this advice.

Re:Spews = /m\

[Anonymous Coward]

And if you find someplace that doesn't have any spammers, what is the guarantee that they won't have a spammer tomorrow? Or be bought out by an ISP that already has spammers? It is hard enough to find a good provider without having to wonder "what-if".

Re:Spews = /m\

[CaramelCod]

I use spews, along with both DUL and RBL, and pop before smtp. I have had a problem with a couple of netblocks being blocked by spews. I have an easy solution that has worked well for me.

Once each week, a script dumps the latest spews sendmail filters info a file, and diffs the old file for reference. The new file is then tacked onto my sendmail access filters which already allow incoming mail from the 'bad' blocks that affect our clients. Since the access.db is read top down, the message is received before the reject is seen. Spews is blocking 1500-2000 messages each week on 2 linux mailservers.

We were much more 'open' before pop-before-smtp came about. I had to allow relay from a few large netblocks for remote users using us for relay rather than their own ISP. Corporate dictate. Now with p-b-s, all of those holes are plugged.

This doesn't help everyone affected, but it cured my headaches.

Re:Spews = /m\

[Dimensio]

Antispews is run by a known hack.
SPEWS is used because it works. It is NOT the job of my ISP to tell your ISP to kick off their spammers. If your upstream is providing an open haven for criminals, don't be surprised when no one wants traffic from your upstream.

Remember, your consulting company wasn't being blocked. Your consulting company didn't own the ISPs. SPEWS wasn't blocking anything (anyone who claims that SPEWS blocks is either ignorant or lying), SPEWS was merely listing IP addresses owned by the upstream provider. It isn't SPEWS's probem that your upstream is rogue and that no one wants their traffic.

Re:Spews = /m\

[Dimensio]

My recommendation:
Call Qwest and keep bitching up a storm. They'll get sick of you eventually and they'll HAVE to act just to shut you up.

Of course, given that Qwest openly tolerates criminal activity, including DDoS attacks, from their customers, I suspect that their action might just be telling you that they don't want you as a customer since you aren't actually breaking the law.

Re:Spews = /m\

[Paul Neubauer]

It's not that places that happen to have a spammer get SPEWS listed. It's places that have spammer(s) and do nothing about it that get listed.

Believe it or not, places that cleaned out their long standing spammers and now remove any new spammers, have gotten their SPEWS listings removed.

Re:Spews = /m\

[AndroidCat]

How many times are you going to spam Slashdot with the same post?

Re:Spews = /m\

[PatJensen]

You're an idiot, or a troll. I've used Spamcop as my primary IMAP mailstore for almost 2 years. I have only -once- had a single message blocked from a recipient. That is a single message out of over 4,000 messages.

Spamcop does an excellent job at blocking unwanted advertisements and I will renew my subscription once it expires. No other ISP does as good of a job as they do. Not bad for 40 smackers.

-Pat

Re:Spews = /m\

[joeszilagyi]

Nothing for nothing, but I was advocating using Spamcop.net instead of Spews.

Re:Spews = /m\

[Anonymous Coward]

And spews doesn't? Spews randomly blocked a consulting company's netblock I worked for part-time simply because that our block was next to a "known spammer's" block.

SPEWS blocks nothing - it LISTS areas of the net that belong to spammers or ISPs that willingly host spammers.

When they politely asked to be removed and pointed out that according to their own evidence file that their netblock had nothing to with spam, they were met with very hostile responses and told to essentially ditch their teleco provider because they'd never unlist anyone.

Bullsh|it meter pegged on this one. One one has ever shown they "talked to SPEWS", SPEWS don't play that game. They also remove places that boot their spammers all the time.

They admitted that they simply block IPs in a form of "collateral damage" because they feel like it to hurt legitimate businesses so they flee their network provider.

"They" must be the people in the NANAE news group or on the Spam-L list. "They" is not SPEWS. Was it you, or these geniuses a the "consulting company you worked for" who neglected to grab a clue on this? Care to name them, I'd like to add them to my "idiots who should never be hired to consult" list.

Look at antispews.org [antispews.org] for more info on their flagrant abuses and why you shouldn't use spews.

Are you kidding? Antispews.org? This place is run by the fscking "Wangomail" spammer Ajay Gayhole, were you the troll whining on FuckedCompany last week, or a you a new one?

Man, don't stand there pissing on us saying it's rain mofo!

Re:Spews = /m\

[Anonymous Coward]

By their nature, Spews, Spamcop, et al have to "hard core" in their dealings, but Spamcop can at least be worked with (to varying degrees, I suppose, but still). Spews operates anonymously and has virtually no accountability. They're effective, but any body with that much power that operates with no realy oversight is a danger on some level. Ashcroft, Bush, Poindexter, Spews, Microsoft's endless lust for probing PCs, it's all different levels of the same thing--a lack of oversight.

Power? Get real, SPEWS has no power. Why? Because the moment they start listing places that are not spam related, I, and thousands of others would stop using their list. Bye, bye power. They are not a monopoly, plenty of other lists out there, so no M$ type power there. They are not the government, passing unconstitutional laws, and violating constitutional ones, so no power there.

Anyway, blocking entire IP blocks *is* a good tool. It is the responsibility of every ISP to deal with spammers within their network. If something.com is sending out 100,000 spam a day through a certain IP and just changes it, because they have a whole block available, what's wrong with cutting out the knees of the people letting them do this? Yes, it does hurt and inconvenience others, but ISPs have to responsible for and aware of what happens in their own network.

Right on! Problem is, due to greed, dot-bomb desperation and general cluelessness, many ISPs need a "blocklist bitchslap" to realize that the civil part of the 'net no longer wants to talk to them.

Re:Spews = /m\

[Anonymous Coward]

>Perhaps because SpamCop is overzealous to the point >of stupidity?

And SPEWS isn't?

Any spamfighting system that takes control of one's mail away from the recipient is bad news. I neither need nor want an ISP deciding which mail I should or should not receive.

Re:Spews = /m\

[Anonymous Coward]

>How many times are you going to spam Slashdot with the same post?

You mean the posts about "SPEWS is great, spammers are the only ones who don't like it, AntiSPEWS is run by spammers"?

Yeah, those posts are getting old, all right.

Re:Spews = /m\

[Anonymous Coward]

"Are you kidding? Antispews.org? This place is run by the fscking "Wangomail" spammer Ajay Gayhole,"

How very adult of you.

"were you the troll whining on FuckedCompany [fuckedcompany.com] last week, or a you a new one?"

Are you one of the NANAE idiots who is obsessed with spammers "getting their pee-pees whacked," or are you a new troll? What is it with antispam zealots and spammer 'nads, anyway? I think you have all been watching too much Japanese porn.

Re:Spews = /m\

[Anonymous Coward]

>In practicality, I don't have the option to switch, regardless of my ISPs policies

So get a second ISP and forward all e-mail through them (sendmail has a "smarthost option".)

Re:Spews = /m\

[Just Some Guy]

So it's OK to handle my web, NNTP, and FTP services on a broadband connection, but I should route my outgoing mailing list traffic over a dialup modem? That's just not an acceptable setup, in my opinion.

Re:Spews = /m\

[Anonymous Coward]

So it's OK to handle my web, NNTP, and FTP services on a broadband connection, but I should route my outgoing mailing list traffic over a dialup modem? That's just not an acceptable setup, in my opinion.

Not a second PHYSICAL connection. Just forward
outgoing mail to a single machine using your existing ISP.

bandwidth?

[the_Bionic_lemming]

He's going to waste spammers bandwidth? Won't that double the traffic then ?

Re:WHY?

[Anonymous Coward]

yeah, that's what you'll say as you're using OpenSSH. duh.

well

[tps12]

It's cool that it works with pf. But is anyone working on one that doesn't spew?

Why Spews? Spews sucks.

[Anonymous Coward]

Spews is the worst. Why not someone else.

Platform [In]dependence

[GeckoFood]

The author states that it's for OpenBSD. Any clue if he plans to port it to other flavors of Unix, such as Solaris, HP-UX, Linux, IRIX, etc? This sounds like a useful honeypot tool, I would be curious to see how well it works in actual production (translation -- I'd like some stats).

Re:Platform [In]dependence

[evilviper]

Are you not familiar with the concept of open source? Instead of saying "Gimme Gimme Gimme" you could do it yourself, or even contract someone to do it. If you aren't going to contribute, don't start complaining that others should be contributing more.

Re:Platform [In]dependence

[Noryungi]

Porting to other flavours of UNIX should not be too hard: this scheme is based on pf, which is the packet filter for OpenBSD. Port pf to your flavour of UNIX, and the rest should be trivial.

Re:Platform [In]dependence

[Anonymous Coward]

Sheesh.

I mean, it's just a s/strlcpy/strncpy/g[0], commenting out the one line containing sin.sin_len and it builds on Linux. the pf-part uses just port-redirection, which already is perfectly doable with iptables.

0: Or with strncpy(dest, src, size); dest[size-1]=0; if you want to do it perfectly ;)

Re:Platform [In]dependence

[Anonymous Coward]

Yes. Open source is based on the arrogant and hubris-filled concept that everyone should be, at very least, an expert C/C++ hacker.

Re:Platform [In]dependence

[evilviper]

Umm, perhaps you are thinking of Free Softwaretm? That would be rms' special brand of open source.

Open Source has almost no ideals behind it... Just that you are giving others more freedom to do what they please with your software. It's such a broad term that there is nothing more that can be said about it.

Some open source developers may have their own agenda, as may some license, but that's besides the point.

So what is it exactly that you are so upset about?

Good concept - quality of execution pending

[Cujo]

The theory here is that most spam still comes in via open relays, and the only way we are going to convince them to clean up their act is to waste _their_ disk space, their time, and their network bandwidth more than they waste ours.

To me, this seems exactly the right strategy, although how well it works in practice will be interesting to watch.

Re:Good concept - quality of execution pending

[tmark]

the only way we are going to convince them to clean up their act is to waste _their_ disk space, their time, and their network bandwidth more than they waste ours.

To me, this seems exactly the right strategy, although how well it works in practice will be interesting to watch.

To me, this is about as hypocritical a strategy I can imagine. If something is wrong, it's wrong.

Re:Good concept - quality of execution pending

[2names]

So, we have 2 choices: "eye for an eye" them, or "turn the other cheek."

If we take the "eye for an eye" approach, I can see this escalating to the point where the government will want to step in. Nope, don't like that choice...

I think the cheek-turning alternative is the way to go. We have a rare situation here: if everyone ignores this problem, it will go away. I know it sounds a bit ridiculous, but think about it...spammers send spam to make money. If it stops working, they'll stop sending spam. The reason spam keeps on truckin' is because there is a portion of our Internet using population that gives a positive response to the spammer. Stop these people and the flood of spam will recede.

Re:Good concept - quality of execution pending

[Dunark]

I don't see the hypocrisy. If a neighbor of mine allows people to cross his property so they can dump garbage on my property, where do I get the obligation to accept the garbage? What's wrong with me putting up a fence and letting the garbage pile up on his side?

If someone wishes to run an open relay and be a conduit for spam, why should he be granted immunity from consequences?

Re:Good concept - quality of execution pending

[Just Some Guy]

Stop these people and the flood of spam will recede.

So will the demand for Jerry Springer and reality shows. In other words, it ain't gonna happen.

Spews

[Anonymous Coward]

While spews is good (and I use it myself), it allows quite a bit of spam through. These days, I've been forced to use a combination of:

spews.relays.osirusoft.com
relays.ordb.org
bla ckholes.wirehub.net
sbl.spamhaus.org
dump anything from China/Korea

plus a number of header checks under postfix looking for obvious spambait. That has kept the flow of spam down to maybe a half dozen or so instances a day. I hate to use the brute force method against mail from Asia, but it has been 100% spam (at least for me).

Cheers,

AC

SPAM?

[AlgUSF]

Spam really sux, but I can usually tell spam from real mail by the subject line, and it only takes me like 2 sec./message to detect it as spam and delete it. I get roughly 20/30 spam messages/day, therefore it takes a WHOLE 1 minute out of my day to delete spam. Spam is annoying, but it isn't that big of a problem that we need Slashdot posts every day about it...

Re:SPAM?

[Anonymous Coward]

It might only take a minute, but I RESENT having my system used/abused in this manner by some opportunistic prick who feels that my resources are fair game in his moneymaking scam de jour. If everyone ignored the problem, as you suggest, it would only get worse. Spammers need to be smacked in the (pick a place) to let them know that what they're doing is wrong and wasteful of everyone's resources.

Re:SPAM?

[grub]

Spam is annoying, but it isn't that big of a problem that we need Slashdot posts every day about it..

Annoying to the end-user, yes. To an ISP or firm with a large mail server it is more than that. Spam fills disks, uses bandwidth, wastes employees' time, etc etc. This is a super idea.

Re:SPAM?

[Anonymous Coward]

Well, I agree. SPAM is annoying, and it takes a whole minute away from me pressing F5 on the ThinkGeek customer fortune page, but it is not a big enough problem for me to waste more than five minutes on it.
That being said, I'll go back and read some more fortunes.

Re:SPAM?

[zentigger]

I work at a small ISP and our mail server REJECTS several hundred thousand emails a day just from open relays.

1) Lots of these emails make heavy use of graphics and formatted text/html. This can take a customer on dial-up 5-10 minutes to download a mailbox full of spam, even if it only takes a WHOLE 1 minute to delete. Never mind if that user has been on vacation for a week!

2) Being a sysadmin I am on many system aliases (webmaster, etc...) I typically end up with a hundred or more spams a day. If I am away for any length of time I write off a whole day just catching up on email, and half of that is filtering through the 1000+ spams to get to anything useful.

3) In this part of the world bandwidth and storage costs money. Although it is not a significant amount of data, spam certainly accumulates to a fairly insignificant amount of data. The transport and storage and backup (yes! we backup ALL of our customer's email EVERY night) costs US very real dollars!

Re:SPAM?

[AlgUSF]

I got Karma to waste, so here it goes!

Flamebait, are you on crack! SPAM is a problem we will have to deal with forever. If the US imposes effective restrictions on it, US marketing firms will start sending their work overseas where the US can't control it. My post was just saying that spam is here to stay, so just deal with it. If you set up descent mail filters that filter out anything with XXX, Viagra, etc.... Or these shitty spoofed e-mail addresses that spammers use, you shouldn't have a problem.

I personally have filters set up to filter potential spam into a potential spam folder, and known spam to be deleted, therefore when I have time I open up my potential spam folder and look through it and delete the spam.

Mod this what ever the hell you want!

Spews is NOT the right way to filter e-mail.

[Sturm]

Spews is EVIL. Plain and simple. They block IPs based soley on the fact your upstream provider hosts or has hosted in the past, someone the SPEWS "admins" (and I use that term losely) believe to be spammers. It is impossible to get off their list and if you are a customer of C&W you probably have IP space being blacklisted by them. Blocking large blocks of class Cs, just because someone happens to share IP space with an alleged spammer is the WRONG way to filter spam.
Please take a look at http://www.antispews.org for more information before using SPEWS.

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

I agree with you in principle. But in practice, this seems to be the ONLY way to get the attention of upstream IP providers. C&W seems to consistently ignore valid/documented spam complaints. Maybe when enough of their customers can't get email delivered they will take some notice?

Re:Spews is NOT the right way to filter e-mail.

[XLawyer]

Some of us think that SPEWS is **wonderful** for exactly those reasons, and this this is the **right** way to filter spam.

Re:Spews is NOT the right way to filter e-mail.

[Tucan]

The theory behind SPEWS approach is at least interesting, but why don't the maintainers validate it? The SPEWS maintainers have the data available from their spam traps. If SPEWS is wonderful (with whatever number of asterixes) then the presence of a particular IP address in the database should have a high positive-predictive value. IOW, for any given IP in the database, what is the probability that it truly represents a source or supporter of spam over time? How about data instead of zeal?

Re:Spews is NOT the right way to filter e-mail.

[jamie]

"Spews is EVIL... Please take a look at http://www.antispews.org"

Thanks for the link. I'll confirm that Spews is not the way to go. Well, it depends on whether your goal is to block spam for your users, or just to piss people off.

If you're a network admin and you want to block spam for your users, try something else.

If you just want to piss people off, Spews is great. My personal mail server (very kindly hosted for me for free on a friend's network) was put on Spews' blacklist. My server has never in its lifetime sent a single spam, of course. But Spews had found four (count 'em) examples of spammer websites (not spam-sending machines) on the IP blocks owned by the people who my friend bought access from, twice removed. Because of these four claimed spam websites, Spews put FOUR CLASS A's on their list.

That's right -- a quarter-million IP numbers were blocked because they didn't like the policies at four IP numbers.

Wait, did I say four? When I checked up on them, two had already moved to other providers, one I couldn't find, and only one was still there. So my server, and a quarter-million others, were being blocked because the Spews people disagreed with one solitary website. Hosted by a company that I have no relationship with.

It goes without saying that attempts to get my server whitelisted failed.

And I do question the value of their blocking my mail server. Like I said, I was being hosted for free just because I have helpful friends... my moving to another network actually saved them money!

Somehow, I think most net administrators, if they knew that Spews' purpose was political and not technological, would be less likely to use it. There are plenty of other blacklists out there. What are the good ones that don't hijack your networks to apply political pressure?

Re:Spews is NOT the right way to filter e-mail.

[t1m0r4n]

Spews is EVIL. Plain and simple. They block IPs based soley on the fact your upstream provider hosts or has hosted in the past

I think too many hosting companies are far too lenient when it comes to booting spammers -- if they do anything at all. Honestly, I think going overboard on blocking will be a great asset in getting these clowns off their behinds.

It is impossible to get off their list

That is lame, if they have cleaned up their act. I'd say make it easy to be taken off once. After that, forget about it. Having little anti-spam programs running on every PC is just silly. Unless serious action is going to be taken, it's just wasted effort.

P.S. Ever notice spew is oops backwards :)

Re:Spews is NOT the right way to filter e-mail.

[PacketMaster]

Spews randomly blocked a consulting company's netblock I worked for part-time simply because that our block was next to a "known spammer's" block. When they politely asked to be removed and pointed out that according to their own evidence file that their netblock had nothing to with spam, they were met with very hostile responses and told to essentially ditch their teleco provider because they'd never unlist anyone. They admitted that they simply block IPs in a form of "collateral damage" because they feel like it to hurt legitimate businesses so they flee their network provider. Someone mentions C&W addresses, same thing if you're getting service from Qwest. Their website makes them come off as the noble crusaders against spam, but in reality what they do is just mean-spirited, unethical and just plain wrong.

Don't use SPEWS!

See the newsgroup news.admin.net-abuse.email to see just how the spews people treat those who politely ask for erroneous entried to be removed and PROVE they have nothing to do with spammers.

Re:Spews is NOT the right way to filter e-mail.

[MrDingusMcGee]

They block IPs based soley on the fact your upstream provider hosts or has hosted in the past, someone the SPEWS "admins" (and I use that term losely) believe to be spammers.

As a sysadmin for an ISP I can assure you that this is absolutely the case. There is no human contact at Spews, the entire system is automated. Which means that when their system is alerted to a "spammer" within a particular class C, that entire class C is quickly blocked by thousands of misinformed SAs who don't understand that they are in the process going to block legitimate emails that the people within their network have every right to receive.

Blocking large blocks of class Cs, just because someone happens to share IP space with an alleged spammer is the WRONG way to filter spam.

A hosting provider should be responsible for the domains they host. But there is rarely anything a provider can do to pre-emptively stop a spammer. Just recently, my company signed up a new company for Co-Location. Within a week, this company sent out a huge spam mailing. The moment we saw spam complaints come in we called the company and demanded proof that their mailing list consisted solely of opt-in addresses. They had no proof and their contract was immediately terminated for violating our Acceptable Use Policy. However, at this point our entire class C (housing our main mail server for hundreds of websites and ten times that many individual email clients) was listed in SPEWS database. Apparently this company had, in the past, under a different name, been blacklisted as a spammer. We were now added to the list of their hosting providers and could not, despite our best effort, contact a single human at SPEWS to explain our situation. As a result, for over 3 weeks, thousands of mail servers were rejecting our clients' mail as coming from a spam-server.

I ask you, how does that make the internet a better place?

Spam is a waste of bandwidth, of time, and it's insanely annoying, as a sysadmin I realize that as much as anybody (except maybe Alan Ralsky). But SPEWS is a horrible "solution" to the problem. Too many misinformed sysadmins use SPEWS at the expense of those who use their network.

Re:Spews is NOT the right way to filter e-mail.

[Quixadhal]

I couldn't agree more.

The company I work for was affected by the infinite wisdom of Spews. Apparently a spammer once sent email from an address that happens to share the same leading 16-bits of address space with us. Because of their escalation procedures, a full 8192 sites have been placed on their "spam" list because of a single incident.

I don't think Spews provides any useful service. They don't resolve problems, they encourage you to bury your head in the sand and pretend problems don't exist. Blocking (and thus ignoring) a whole set of unrelated domains because once upon a time, a single spam event happened in a vaguely similar namespace is like banning everyone in the state of California from visiting Las Vegas, because one guy from LA was caught cheating in a casino 10 years ago.

They are a lawsuit waiting to happen. What if a company sends out stock information, or other time-dependant data by email, and they happen to get added to the Spews blacklist? Now clients who are paying $XXX for these notices don't get them, and thus lose a great deal of money. The sender isn't at fault, as they sent the mail in good faith, and they didn't engage in spamming themselves, but had the misfortune of belonging the same class A or B subnet of a spammer. Who's gonna compensate the victims here? IANAL, but I'd be looking at Spews with $$'s in my eyes.

Re:Spews is NOT the right way to filter e-mail.

[dnoyeb]

Smacks of 'IP profiling' if there were such a thing...

The conviction of innocence is completely unacceptable in America.

Re:Spews is NOT the right way to filter e-mail.

[spacefight]

See the newsgroup news.admin.net-abuse.email [google.com] to see just how the spews people treat those who politely ask for erroneous entried to be removed and PROVE they have nothing to do with spammers.

You didn't get it, did you? There are no SPEWS people posting in nanae. SPEWS does not talk to anyone. You do not prove that you do not have something with spammers, you disconnect them and you get unlisted if they are gone. Gone means, no WWW, no eMail, no DNS. Nothing. Go read the FAQ as it looks to me that you didn't. Your listing was for shure NOT randomly as you stated yourself that you where in the neighbourhood of some spammers. Get a clue.

We use SPEWS. It reduces spam to 5% of before. It rocks.

Re:Spews is NOT the right way to filter e-mail.

[Erik Fish]

You were almost looking credible there until you linked to AntiSpews. You do know that it's run by a well known spammer don't you? The .org is also rather deceptive as they have started to sell mail server hosting.

If your ISP is listed in SPEWS you need to talk to them about it. They need be informed that either the spammers go or you go. Obviously some ISPs value spammers' business more than that of their legitimate customers. Why would you want to do business with a company with ethics like that anyway?

However I guess I can count on Slashdot to throw their fists in the air when reading about Alan Ralsky then turn around and pay their bandwidth bills to ISPs with the same attitudes as his just because it's "convenient".

Re:Spews is NOT the right way to filter e-mail.

[spacefight]

I ask you, how does that make the internet a better place?

It stoppes beeing flooed by fscking spammers like you signed up with one. Good that you disconnected them. The term for SPEWS is: education. If only more ISPs would act as you did, the internet would be a better place for sure. The problem is, that as long no one gets hurt (read: loses money because customer quit their services), loads of ISPs does not enforce their AUP, has bad AUPs or are pro-spamming. Only if they really get a clue what's going on, they act. Read: Education. Prevention.

Re:Spews is NOT the right way to filter e-mail.

[pqdave]

Using SPEWS should be decided both on technical and ethical merits. Blocking the exact spam sources is the technical reason. Putting pressure on ISP's that refuse to cancel spammers is the ethical reason. Unless hosting spammers can affect legitimate customers, there is little incentive for a greedy provider to do the right thing.

Also--SPEWS evidence files are not all-inclusive. They say what got the provider in, but not necessarily what's keeping them in. A few providers are in the habit of moving spammers rather than deleting them, or of deleting spammer accounts slowly enough that the spammer still gets full benefit. In these cases, the newsgroup news.admin.net-abuse.email is a good resource--Someone there will give verifiable facts about what's keeping a SPEWS listing active.

Re:Spews is NOT the right way to filter e-mail.

[Pete]

The company I work for was affected by the infinite wisdom of Spews. Apparently a spammer once sent email from an address that happens to share the same leading 16-bits of address space with us.

So you were paying money (whether directly or indirectly) to the same ISP that was hosting a spammer. And that ISP had ignored abuse reports about that spammer for a significant period of time.

Because of their escalation procedures, a full 8192 sites have been placed on their "spam" list because of a single incident.

Ah yes, the "escalation" procedures... those would be the things they do when a spam-supporting ISP ignores abuse reports and refuses to terminate spamming clients.

Generally SPEWS will list a single IP address first. Then, over a period of time, as long as the spammer stays up at that ISP, they'll gradually increase the range of IPs listed. If in your case they listed a /16 - well, some ISPs can be very hard of hearing. Or perhaps I should say that some ISPs are very reluctant to terminate their lucrative spamming clients, and so will refuse to terminate them until said clients are costing them more than they're making (eg. by having to deal with complaints from non-spammer customers and/or having non-spammer customers leave).

I don't think [...]

Obviously.

[...] Spews provides any useful service.

Gee, this is easy. Don't use them then. *roll of eyes*

I think what you meant to say is "SPEWS accurately listed (part of?) my ISP for spam support. I refuse to accept any responsibility for my part in paying money to keep that rogue ISP in business, and I also refuse to complain to my ISP about their spam support. I, in fact, do not acknowledge any problem other than me (or my company) having some email rejected, and I'm quite happy to blame SPEWS for this problem rather than correctly assign blame a little closer to home."

Substitute "the company I work for" for "I" where appropriate in the above.

They are a lawsuit waiting to happen.

Now I think you might have clued into the reason why they're anonymous and not directly contactable. Idiot spammers all over the USA and the world (and, embarassingly, one in my home city) will (ab)use the law as a tool to harass antispammers. Even though such a lawsuit would have little or no legal merit, they can be used as a very effective harassment tool, taking a disproportionate amount of time and money to defend.

SPEWS avoids this problem entirely by remaining anonymous. They don't need to be identified - the administrators who use SPEWS judge them by the quality of the information they provide.

IANAL, [...]

Obviously.

[...] but I'd be looking at Spews with $$'s in my eyes.

See above re: anonymity. It's a little tricky to file a frivolous (SLAPP) lawsuit when you don't know who you're trying to harass.

Pete.

Re:Spews is NOT the right way to filter e-mail.

[MrDingusMcGee]

Read: Education. Prevention.

Sysadmins need to educate themselves about SPEWS before hastily hopping on board the "I'm preventing spam!" bandwagon. SPEWS doesnt prevent spam, it prevents spam AND legitimate emails.

Often it boils down to "The All ighty ollar". An irresponsible ISP is willing to let a spammer continue to pay for their outrageous use of bandwidth as long as they can. SPEWS does nothing more than allow the spammer to spread the wealth to other ISPs once their current one is blacklisted. And yes, this ISP should be punished, its sysadmins and CEO should be dragged out into the street and beaten. However, until SPEWS starts carrying out vigilante justice, SPEWS is doing more harm than it does good, and is not a viable spam solution.

Police Chief: My Mayor, as you asked we have devised a scheme to catch every criminal in the city before they can comitt a crime.

Mayor: That's amazing! Let's get started

Police Chief: There is a catch. It only catches criminals registered in our "Ex-Con Database" and 10% of the people imprisoned will be random towns-people who have done no wrong.

Mayor: But, it catches criminals right?

Police Chief: Well, yes, but...

Mayor: Then let's do it!

Welcome to Spewsville...Where the world is a better place..for some people.

Re:Spews is NOT the right way to filter e-mail.

[spacefight]

If the sysadmins, the CEO et all know about SPEWS and know how SPEWS works, they'll do what they can to not getting listed (nuke spammers with zero tolerance for example). But if the CEO is letting the spammer sign up and more important: let them stay up; someone needs to PREVENT the users from the next bunch of spammers which will sign up with this pro spam|scum ISP- and most important - and will get an IP (or even a block of IPs) from the blackhat ISP, then the goal of SPEWS has been reached: Prevention. I won't get any mails from additional spammers on their network because SPEWS prevented me to receive them.

And if every customer who has a clue about spam and spam support moves to a white hat ISP (yes, the're plenty of them around), the ISP has to close the sooner the better.

Remember: SPEWS lists pro spam ISPs only. And only whole blocks in order that the PREVENTION comes into effect. Sorry for my poor english - it's not my native language as one can guess.

BTW your comparison to the police is really lame. The police is acting on public ground. The servers where my email passing trough is just not public and I (well in my case my sysadmin) can decide who to put in "jail" or not. And yes, I know that SPEWS blocks legit emails but I do not care about it - I do not want to receive emails from spam supporting folks.

Re:Spews is NOT the right way to filter e-mail.

[Pete]

Sturm originally said:

They block IPs based soley on the fact your upstream provider hosts or has hosted in the past, someone the SPEWS "admins" (and I use that term losely) believe to be spammers.

MrDingusMcGee responded:

As a sysadmin for an ISP I can assure you that this is absolutely the case. There is no human contact at Spews, the entire system is automated.

This is simply false. Of course there are humans behind SPEWS. Do you seriously think that the SPEWS record (S716) your ISP (Netsville) is covered by was written by a bot?

Of course SPEWS are going to automate what processes they can. But they can't automate everything. Most especially not the bit where they read posts to nanae and sometimes act on them.

A hosting provider should be responsible for the domains they host. But there is rarely anything a provider can do to pre-emptively stop a spammer.

There are certainly some things you can do. Ask potential clients about their 'net history before signing them up. Ask some minimally intrusive questions about the nature of their business. Ask why they left their last provider. Do a search for their domain name on news.admin.net-abuse.sightings and/or nana.email. Do a search for their company name - and their company director's names - on ROKSO. Do a search on SPEWS or the Spamhaus Block List or Spamcop for whatever IPs they might previously have used.

Very few spammers will stand up under even minimal investigation like that, which takes only a few minutes. This is basic stuff which any hosting provider should conscientiously do before taking on new clients, in the interests of their current clients!

Just recently, my company signed up a new company for Co-Location.

You signed up hotticker.com.

Another thing I forgot to mention above. You should really have a look at the domain name your client-to-be uses. You can often spot a disreputable business just from the domain name.

Within a week, this company sent out a huge spam mailing. The moment we saw spam complaints come in we called the company and demanded proof that their mailing list consisted solely of opt-in addresses. They had no proof and their contract was immediately terminated for violating our Acceptable Use Policy.

Immediately terminated???

How long exactly did it take from the time the first complaints hit your mailserver for you to realise hotticker was responsible, call and ask them for evidence about their mailing list, wait for their response, deem their response nowhere near good enough and then pull the plug? If it was less than 24 hours then I might agree that having your /24 listed is perhaps a tad harsh. But I suspect it was in fact much longer than that, perhaps as much as a week or more.

I notice on your SPEWS record that your /24 has been downgraded to level 2. Your three webhosting machines (io, colossus and jupiter) are still at level 1, but any mail they want to send can be smarthosted through your level-2'd mailserver.

Apparently this company had, in the past, under a different name, been blacklisted as a spammer. We were now added to the list of their hosting providers and could not, despite our best effort, contact a single human at SPEWS to explain our situation.

Erm... just what would you have said? "Please take us off your damn blocklist, we've terminated the spammer we signed up and we promise to be more careful in future." SPEWS' generic response would be "Once we can tell you're not providing any more services to $SPAMMER - which may take a little time - we'll downgrade you to level 2, where you'll stay for six months or so, then you'll be removed entirely. And yes, you bloody well should be more careful." This is covered in the SPEWS FAQ.

I ask you, how does that make the internet a better place?

Hopefully it teaches ISPs like yours to be more careful about who it signs up as clients. I imagine that in a year or two it will be considered common practise for ISPs to go through a similar process with new clients as landlords do with potential new tenants. A bad client can easily do as much damage to an ISP as a bad tenant can to a landlord.

Pete.

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

Erm... just what would you have said?

Gee, it is hard to tell. Do you think SPEWS knows all the answers before the questions are asked? There must be room for reasonable discussion between civilized people. (Hey, even if you don't acknowledge spammers as being people, let alone civilized, there are innocent people who are being hurt and who have questions.)

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

Just think ... if the upstream providers enforced their Acceptable Use Policy and eliminated their spammers when they received valid complaints, there would be no need for SPEWS ... or SpamCop ... or any of the other tools and filters used to block the junk.

Re:Spews is NOT the right way to filter e-mail.

[Senior Frac]

Let's see...

SPEWS

• Anonymous - no contact info provided
• Voluntary - no one is forced to use it

AntiSPEWS

• Anonymous - cellphone and a P.O. Box
• Voluntary - not forced to support them
• Solicits money... anonymously

Whom do you trust to be more impartial?
Come on folks, it's no contest.

Re:Spews is NOT the right way to filter e-mail.

[MrDingusMcGee]

Immediately terminated???

How long exactly did it take from the time the first complaints hit your mailserver for you to realise hotticker was responsible, call and ask them for evidence about their mailing list, wait for their response, deem their response nowhere near good enough and then pull the plug? If it was less than 24 hours then I might agree that having your /24 listed is perhaps a tad harsh. But I suspect it was in fact much longer than that, perhaps as much as a week or more.

They were called the day complaints came in and terminated at the end of the next day. Our entire class C was simply seen as part of their growing network.
I notice on your SPEWS record [spews.org] that your /24 has been downgraded to level 2. Your three webhosting machines (io, colossus and jupiter) are still at level 1, but any mail they want to send can be smarthosted through your level-2'd mailserver.
Unless the main mail server for clients is one of the 3 level 1 servers (which it is).

Having your servers on as level 1 for months and your class C as a level 2 for 6 months is absolutely absurd for ONE case of ONE mailing of spam. Yes we should have looked into their history, and we now do with new clients.

The issue comes down to more than "Is SPEWS bad?". It is a matter of legitimate emails being blocked by uninformed sysadmins who don't realize they are NOT solving their spam problem, they are reducing their spam problem and causing another problem with rejected mail that should be getting through. How is it fair for the users of their networks, often entire universities (my alma mater uses spews and I could not send email to any addresses within that domain for a month...), to block legitimate mail, and to _not tell_ the users of their network that they are not receiving mail because the Univeristy/Organization/Company wants to help rid the world of spam?

Once we can tell you're not providing any more services to $SPAMMER - which may take a little time - we'll downgrade you to level 2

How about: their web site is inactive, all emails to the domain bounce? And regardless, too many organizations just take SPEWS list, regardless of level, and block those servers.

You would be hard pressed to find a more ethical ISP than mine, and one who believes as firmly in the "ethics of the internet (and business in general)". Mistakes are made, you learn from them, and SPEWS is there to rape you in the ass and allow other admins to punish their users for the mistakes of another ISP.

Re:Spews is NOT the right way to filter e-mail.

[Dimensio]

SPEWS does not block anything. SPEWS LISTS IPs owned by known spam-friendly companies such as Cable and Wireless. Individual ISPs CHOOSE to block because they have decided that if a company like C&W, which openly tolerates abusive criminal activities from their customers, isn't going to clean up their act then there isn't any traffic worth accepting from them.

If everyone starts using SPEWS and you get blocked because no one wants C&W's traffic, that is NOT their problem and it is not the problem of SPEWS. Call C&W, tell them to stop openly tolerating criminal activity (such as theft of service, trespass to chattel and distributing pornographic material to minors), and then if they clean up their act, SPEWS will delist them.

The alternative is to have hundreds, if not thousands, of individual ISPs run their own private lists. That way, when C&W does finally clean up their act, they have to convince hundreds or thousands of individual people to remove them from the filters -- of course, by this time many of the admins who put the IP there might have moved on or forgotten the reason for the block in the first place. As such, C&W would stay in those hundreds or thousands of those individual blocklists and their netspace would be effectively worthless. Such was the fate of AGIS, who died the death of a thousand cuts, walled off from much of the Internet even when they did finally clean up their act.

And SPEWS does not just block blindly. You're either lying or stupid when you claim that it's just based on who they 'believe' to be spammers. SPEWS keeps documentation for their list entries, and it takes multiple spams and multiple ignored reports to the ISP before the list becomes expanded to include collateral damage.

The only people who complain about SPEWS are spammers and people who are too pig-headed to be bothered to learn how and why it is used.

Re:Spews is NOT the right way to filter e-mail.

[Dimensio]

Did you ever ask in news.admin.net-abuse.email why you're still listed? People there are often very good at digging up the information, and it usually turns out that there are still spammers lingering on the network that your ISP has ignored.

Re:Spews is NOT the right way to filter e-mail.

[Sturm]

I usually don't reply to replies of my reply (whoa) but in this case I couldn't resist. I don't think it matters one bit if antispews.org is being run by the Almighty King of Spam himself. The fact is, the information contained on the atispews.org web page correctly conveys the situation that many admins find themselves in when they get blacklisted by SPEWS just because they have IP space that is in the same Class B as Randbad. It sounds to me like alot of the people posting in favor of SPEWS are just too damn lazy or ignorant to implement a GOOD mail filtering solution like MailScanner and SpamAssassin. Sure, you can almost eliminate spam by blocking 210.0.0.0, 211.0.0.0, 212.0.0.0, 213.0.0.0, 64.0.0.0 and 80.0.0.0, but you also block a large number of legitimate e-mails.

Re:Spews is NOT the right way to filter e-mail.

[AndroidCat]

...because they'd never unlist anyone

SPEWS didn't tell you that. Probably it was someone on news.admin.net-abuse.email, which is as about as authoritative as a random reply on Slashdot.

And further more, it isn't true. SPEWS has frequently reacted to spammer-removal within hours (or less).

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

The only people who complain about SPEWS are spammers and people who are too pig-headed to be bothered to learn how and why it is used.

Right, we wouldn't want to allow any other point of view. Zealot.

Re:Spews is NOT the right way to filter e-mail.

[Erik Fish]

A GOOD mail filtering solution doesn't rely on content. Not only is this a slippery slope that can lead to some very nasty places, it also won't be long before the spammers find out how to bypass the filters. Then it's hack and counter-hack until you're rejecting even more legitimate e-mail than you would be if you simply blocked IPs.

Besides, you're only hiding the problem -- not solving it. See the link in my (one and only) journal entry.

Re:Spews is NOT the right way to filter e-mail.

[Dimensio]

Who said that other points of view are not allowed? I wasn't saying that no one else was allowed to speak, I was offering an observation on the nature of SPEWS haters.

Re:Spews is NOT the right way to filter e-mail.

[Pete]

MrDingusMcGee responded (regarding my question "how long did it take you to terminate them?"):

They were called the day complaints came in and terminated at the end of the next day.

Okay, to give you fair credit, that does sound like you responded pretty quickly.

Our entire class C was simply seen as part of their growing network.

Well, you're listed as one of the ISPs that provided support (hosting and email and DNS, in your case). You can see from the listing that Cobra Networks first bounced the spammer through five different IP addresses. Then for some reason hotticker.com moved to Netsville (strange, as the other sites like stockrumors.com and streamingquotes.tv are still up at Cobra) after the SPEWS blocklist was increased to cover part of Cobra's parent ISP, 9NetAve.

Now this is the tricky bit - you see, once a domain name (eg. hotticker.com) is known to be associated with a spammer, it generally becomes list-on-sight. You actually did get rid of them fairly quickly once you realised what they were, but - and I know this may sound cold and uncaring *wry grin* - you should have realised what they were before you signed them up. I suspect you didn't do any research on them before signing them up - I gather from your comments below that you now realise this might be a good idea in future. :-)

If it'd been a case where you signed up a client that was not a known spammer and then that client started spamming, you'd have the situation shown in the earlier part of S716 - complaints sent to your abuse contact and possibly single IPs listed. And with a relatively quick response as you demonstrated in the case of hotticker.com, you probably wouldn't get listed at all.

But the "rules" (such as I understand them) are different for known spammers.

The issue comes down to more than "Is SPEWS bad?". It is a matter of legitimate emails being blocked by uninformed sysadmins who don't realize they are NOT solving their spam problem,

It's interesting that you feel compelled to characterise all sysadmins using the SPEWS list as "uninformed".

I certainly think that every network admin that uses the SPEWS list as a basis for rejecting mail should understand what they're dealing with, and the policy behind SPEWS. There are other blocklists with different policies that may have lower legit-mail lossage.

I think one of the major misunderstandings behind SPEWS is the belief that it's primarily intended to "block" spam email. That's certainly a major goal, but I believe the primary goal is to apply pressure to spam-supporting ISPs. When ISPs stop hosting spammers, everybody benefits (including those that don't use blocklists or filters to defend themselves from spam). Conversely, if an ISP continues to host spammers and all of their non-spammer clients leave, then everyone can happily reject email from them and everybody benefits.

Read up a bit about shunning as a social technique for dealing with troublemakers in a community.... in fact, this article is pretty good.

Having your servers on as level 1 for months and your class C as a level 2 for 6 months is absolutely absurd for ONE case of ONE mailing of spam.

*raised eyebrow* How many millions of messages were sent out in that "one" spam run? How many days in total were you hosting hotticker.com? Note that even if they hadn't made a spam run from your mailserver, you're still considered responsible for hosting the website.

How long have you been listed on SPEWS as level 1? How long ago did you pull the metaphorical plug on hotticker.com and kick them off your netspace? Seriously, if you really have been listed on level 1 for "months" despite booting the spammer within two days of the first abuse report, I think you've got a pretty damn good case to ask SPEWS to at least downgrade and possibly unlist you completely. Post to news.admin.net-abuse.email and ask. Politely, remember - you may disapprove of SPEWS, but being belligerent and rude will get you absolutely nowhere fast. :)

Anyway, SPEWS does not recommend blocking on level 2. If you get mail rejected from a server that's blocking on your level 2 record, contact them and ask them to either change their policy or whitelist you. With regard to your mailserver being in the level1 list, the obvious solution would be to move it to one of your spare level2-listed IP addresses. Or just wait until SPEWS downgrades them to level 2, which shouldn't take all that long (theoretically). A polite message to nanae explaining the situation might speed up the downgrading.

Yes we should have looked into their history, and we now do with new clients.

From the perspective of someone who uses email, I'm glad. You're now part of the solution rather than part of the problem.

Mistakes are made, you learn from them, and SPEWS is there to rape you in the ass and [...]

Sigh. I just wish that if you're going to badmouth SPEWS and/or similar blocklists, try not to grossly misrepresent reality. If you think SPEWS is a poor solution to the "problem", you're certainly free to not use it. But I'd suggest you (along with far too many others) may have subtly misunderstood what problem they're actually trying to solve (see above re: shunning).

Pete.

Re:Spews is NOT the right way to filter e-mail.

[Electrum]

Spews put FOUR CLASS A's on their list. That's right -- a quarter-million IP numbers were blocked because they didn't like the policies at four IP numbers.

Perhaps you meant class B's? Four class A's would have been 67 million. I doubt even SPEWS is that stupid. Wait, this is SPEWS we're talking about.

Re:Spews is NOT the right way to filter e-mail.

[Atzanteol]

We use SPEWS. It reduces spam to 5% of before. It rocks.

If you turn off your mail server you can reduce spam to 0%! But how much *real* mail has been filtered? I think that is the reason many people are annoyed with SPEWS and the like. False positives IMHO are *much* worse than letting a bit more spam through...

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

You again? Stop spamming ./ Or is it "once a spammer, always...?"

Guess what? The company I work for has never been in SPEWS, we host over 5K sites, and have even more dialup users.

Why do I think we've never been in SPEWS? Simple, when a user spams he's gone; toast, nuked, adios-spamboy.

Our network is the same way, low tolerance for spam. SPEWS is not EVIL, it's the idiot, greedy ISPs and networks who take pink-money from spammers and allow them to shit on the rest of use who are EVIL. Too bad you don't mind doing business with the EVIL ones.

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

"Some of us think that SPEWS is **wonderful** for exactly those reasons, and this this is the **right** way to filter spam."

Some of us also think robots are stealing our luggage.

SPEWS evangelists are just as nutty and annoying as any other evangelist. Why don't you go door to door and distribute flyers? "Have you accepted SPEWS into your life? Do you want to be saved from spam and go to Heaven?"

No thank you; I'll filter my own mail. I don't need SPEWS watching over me. If the SPEWS preaching keeps up, I may donate to antispews.org just to piss off the SPEWies.

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

Thanks for the link. I'll confirm that Spews is not the way to go.

Are you the no-life "Jamie" who trolls NANAE with imbicilic posts 24/7?

my server whitelisted

You're an admin?!?!

FOUR CLASS A's on their list. That's right -- a quarter-million IP numbers

You don't know what the fsck a "CLASS A" is?!

Buzz off troll boy.

ps. Please post your IP ranges, I'd like to put them "somewhere."

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

You didn't get it, did you? There are no SPEWS people posting in nanae. SPEWS does not talk to anyone. You do not prove that you do not have something with spammers, you disconnect them and you get unlisted if they are gone. Gone means, no WWW, no eMail, no DNS. Nothing. Go read the FAQ as it looks to me that you didn't. Your listing was for shure NOT randomly as you stated yourself that you where in the neighbourhood of some spammers. Get a clue. We use SPEWS. It reduces spam to 5% of before. It rocks.

I see we have at least one SPEWS evangelist from news.admin.net-abuse.email among the crowd here. You're parroting their party line quite well.

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

"And yes, I know that SPEWS blocks legit emails but I do not care about it - I do not want to receive emails from spam supporting folks."

I care very much. I want to receive legit email. Nobody - not you, not SPEWS, not my ISP, not anyone's ISP - has the right to prevent me from receiving mail I want that is intended for me.

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

I don't think Spews provides any useful service. They don't resolve problems, they encourage you to bury your head in the sand and pretend problems don't exist.

SPEWS supporters make the same claim about client-side spam filtering. What they don't take into account is that some of us don't care whether we whack a spammer; we just don't want to see the spam, and spam not read is spam not replied to, which means NO MONEY for spammers. So, by that means, we are fighting spam, and yet we can still send and receive legit email.

They are a lawsuit waiting to happen.

No, SPEWS is not, because those behind SPEWS hide themselves just as spammers cloak themselves in as much anonymity as possible. You can't sue a blocklist, and finding the people behind the blocklist will be difficult. ISPs using SPEWS are the ones that may be subject to lawsuits.

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

>>The only people who complain about SPEWS are spammers and people who are too pig-headed to be bothered to learn how and why it is used.

Don't you have an abortion clinic to bomb, extremist kook?

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

Who'll be left to notice? They've just laid off thousands more, and there's talk in the UK about investigating their managment for fraud.

s/Cable & Wireless/Clueless & Witless/

It fits so well.

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

find themselves in when they get blacklisted by SPEWS just because they have IP space that is in the same Class B as Randbad.

"Randbad?" They were on CAIS?! Get out! Get out now man!! The people on the Titanic had less chance of wakeing up dead than anyone on this hellhole network.

Any admin would be foolish not to cut this DOS-a-second, spam-a-second, soon to go under network, off at the routers!

Re:Spews is NOT the right way to filter e-mail.

[Alex]

I'd re-read the TOS in your contract with your ISP, I'd be very surprised if you can sue them in any circumstances at all. Otherwise it'd happen a lot more often wouldn't it? I'd imagine the only committment they make to you WRT inbound email is to make a "best effort" to deliver your email.

Alex

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

AC,

You are so lame, I cried when I read your message.

Re:Spews is NOT the right way to filter e-mail.

[spacefight]

I care very much. I want to receive legit email. Nobody - not you, not SPEWS, not my ISP, not anyone's ISP - has the right to prevent me from receiving mail I want that is intended for me.

SPEWS is optional. 'nuff said. We decided to use it. Plain and simple. What are you whining about? Set up your own mailserver if you wanna have all the crapload comming straight from roadrunner accounts but for 'sake, don't whine about spam.

Re:Spews is NOT the right way to filter e-mail.

[ninewands]

***

Mayor: But, it catches criminals right?

Police Chief: Well, yes, but...

Mayor: Then let's do it!

***

Police Chief: Mr. Mayor, you're under arrest.

N.B.: I just HAD to add that one line ... :-)

Re:Spews is NOT the right way to filter e-mail.

[Anonymous Coward]

Spews blocks 0.053% of the IP addresses.
Approximately.

big difference: not just rejecting mail

[agshekeloh]

It doesn't reject messages. It defers them forever, telling the open relay to "try again later."

This tool is a weapon against open relays. The goal is to fill up the open relay's hard drives by deferring the incoming mail, rather than just rejecting the messages.

Yes, you can do this with other blacklists as well, but nobody seems to be actually doing that.

Re:big difference: not just rejecting mail

[fruey]

550 means "reject" not "defer until later"

You won't fill up the open relay's hard drive, if the MTA is worth anything. The queue won't get larger for every reject. You will just keep the email destined for you in its queue until timeout (if it was deferral) but it is a 550 REJECT which means "give it up, I'll never accept this mail" which any MTA like Sendmail or Postfix can do anyway with a RBL rule.

Re:big difference: not just rejecting mail

[dskoll]

My product CanIt can tempfail mail also. However, it can be dangerous, because you tend to get a big increase in SMTP connection attempts. If you can tempfail early (as Theo's scheme does), it's not so bad.

Our stats, however, show that most spam does not come from open relays any more. With the advent of cheap broadband, I'd say a lot of spam comes directly from DSL or cable-modem machines. Some comes from Web servers with broken formail scripts, and some from legitimate non-open relays that are abused by subscribers. Only the minority comes from open relays nowadays.

Re:big difference: not just rejecting mail

[Anonymous Coward]

I also heard recently, from someone who works for a big DSL ISP, that there's a recent trend of breaking in to poorly configured (or buggy) DSL customer equipment, turning on NAT, and then redirecting a port to someone else's mail server ... so that it looks like the spam is coming from that DSL equipment (which will probably look like it's coming from the DSL customer).

Offending Mail servers ?

[nurb432]

What if the headers are totally faked? Does that mean you fill up innocent people's mail servers?

Wouldn't that constitute a DOS attack and be illegal (immoral at the least ) in either case?

I hate spam as much ( more ) then the other guy.. but if you stoop to their level you are no better.

Re:Offending Mail servers ?

[antibryce]

uh...I can't believe this is modded as "Interesting." The mail server sending the spam will get the 450 error and save the message to try again later, not the mail server of the domain faked in the headers.

jeez, learn the basics of how email works. If all I had to do to DoS your mail server was send it tons of messages and 450 errors don't you think this would be a HUGE problem?

Re:Offending Mail servers ?

[Geekboy(Wizard)]

They are not innocent. They are open relays, and deserve the punishment.

It thougt it was spam though

[neurostar]

...doesn't block half the planet?

I thought half the email on the planet was spam though!

:)

SPEWS is necessary & effective at hurting spam

[Charles Dodgeson]

Time and again we see case after case of some provider that

1. Let some customers spam
2. ignored abuse complaints
3. did nothing while when that particular spammer's IP was listed.
4. Only took action against a spammer when the SPEWS listing expanded to include non-spamming customers
5. Whinged that SPEWS was unfair and not the right way to do things

Every day SPEWS proves itself necessary and effective at getting otherwise unwilling providers to remove their spammers. Note that SPEWS uses an escalation process. The provider has to ignore complaints for a while to have the IP range expanded to include non-spammers

If you can suggest something that is half as effective at raising the cost for spammers as SPEWS, please suggest it. SPEWS forces providers to decide whether they want to host exclusively spammers or host exclusively non-spammers.

But if your goal is merely to filter spam (making life easier for the spammers) then you are right. SPEWS is not the way to do that.

I'm Disappointed

[TerryAtWork]

I remember when I applied for a Mead mailing list and got a nasty letter back saying 'your SPAM has been rejected!' just because I sent it from a Rogers.com address, so I know what it's like to be blacklisted like in SPEWS, and it sucks. That's not the way to do it.

Also, this new spam program retaliates and the law is very nasty about vigilantism and retaliation, perhaps because it threatens their monopoly. I don't want to see a spammer WIN in court, do you?

Also, program like popfile doe a great job of removing spam.

My advice is to forget kicking the spammers ass and just make their work vanish down a black hole like it will WHEN BAYESIAN TECHNIQUES ARE USED AT THE ISP END hint hint...

Re:I'm Disappointed

[operagost]

Yeah, but isn't it better when they KNOW their messages aren't making it to the recipient? If not by using a gray-area deception like 450 (which means "recipient unavailable", then by using the proper 550 Rejected.

Eventually, someone's going to notice all the 550s in the SMTP log and start worrying. Then maybe they'll try to find a better way to run a business.

Re:I'm Disappointed

[Diabolical]

Also, this new spam program retaliates and the law is very nasty about vigilantism and retaliation,

The law has nothing to say over this. I'm at total liberty to block access to my site for whoever i want to block. If i block others in the process then that is their problem solely and not that of the lawmakers. Basicly you're stating that just because i have an email address i am not allowed to decide who may and who may not send me email.

The retaliation you're mentioning is just a message that is being sent back to the spammer who as a result has alot of errormessages in his mailbox, if they used a valid email address that is.

WHEN BAYESIAN TECHNIQUES ARE USED AT THE ISP END hint hint...

Now there's a statement i can live with.. ;-)

Re:I'm Disappointed

[wheany]

Bayesian techniques don't work at server level. Bayesian filtering is personal. Just because an email contains (for example) the words "horny slut" doesn't mean it's spam.

Why?

Let's say there are two people: person A and person B. Both have example.com -addresses. A uses his accont only for personal stuff, emailing friends and relatives etc. B uses his account for the same stuff, but additionally subscribes to mailing lists where people send erotic stories.

Now, A starts getting spam "Free herbal viagra", "horny sluts", "get a diploma", and reports these to example.com as being spam. Their bayesian filter learns that words like "horny" and "slut" are very 'spammy', so B's emails from the mailing lists start getting deleted as spam.

If you were B, and your non-spam emails that might look spammy to some, start to disappear, wouldn't you be pissed?

Bayesian filtering is (apparently) very effective in catching spam, but it only works on personal level.

Re:I'm Disappointed

[Beltza]

This is not completely true. Depending how you configure your spam filter, person B might find his rejected mails in a special folder and can mark the 'horny slut' mail as a regular message. This way, the words 'horny' and 'slut' will be moved from the spammy words list to the accepted words list, so person B will receive his e-mail again.

It is true that this makes the spam filter less effective, but it will still work, sinve in the end the filter will learn the difference between the legitimate 'horny' mails and spammy 'horny' mails based on other words.

Re:I'm Disappointed

[Anonymous Coward]

Yeah, but isn't it better when they KNOW their messages aren't making it to the recipient?

These are spammers we're talking about. They're already dealing on the opposite side of pleasant, ethical behavior.

So when an IP range gets banned, they're not going to say "Gee, maybe what we do really IS annoying. We should stop." They'll just move to an unblocked provider and ruin it for the users there as well.

They've already demonstrated that they don't care if they annoy people. Leaving a wake of contaminated ISPs isn't going to bother them.

Re:I'm Disappointed

[gmhowell]

Not entirely true. On the mail server at work, horny slut is always, always, ALWAYS spam. I don't provide email addresses for the employees to get off.

For ISP's... Probably a different situation.

Re:I'm Disappointed

[JoeBuck]

Yes, you are free to block anyone you want at your own site. However, if you operate a service that maintains a list of "known spammers", and people incorrectly listed show you that they are incorrectly listed, and you still won't remove them, you're setting yourself up for libel/slander charges: making statements that are false, with reckless disregard for the truth, that cause financial damage to others.

Now, I'm sure that services with very precise descriptions are safe: for example, a list of open relays with a procedure to get off the list after you show that you no longer have an open relay.

Re:I'm Disappointed

[Senior Frac]

Yes, you are free to block anyone you want at your own site. However, if you operate a service that maintains a list of "known spammers", and people incorrectly listed show you that they are incorrectly listed, and you still won't remove them, you're setting yourself up for libel/slander charges:

However, if you claim that your list contains IP ranges of ISPs that have harbored spammers and that unlisting might not be immediate then that's definitely not libel.

Oh... Wait... that's what SPEWS does! See their webpage.

Let's all click our heels three times and wish that SPEWS' published criteria magically matches whatever we want. Then we can accuse them of libel/slander for not following our fantasy criteria.

Re:I'm Disappointed

[Anonymous Coward]

However, if you operate a service that maintains a list of "known spammers", and people incorrectly listed show you that they are incorrectly listed, and you still won't remove them, you're setting yourself up for libel/slander charges

Perhaps. But SPEWS doesn't operate a "service." SPEWS has no customers; no one pays SPEWS to use its information.

What SPEWS does is "express an opinion," and that is protected in the USA, at least from the government and from most SLAPPs.

Re:I'm Disappointed

[TerryAtWork]

Ok, point taken.

So let's try it THIS way - suppose you're an ISP admin and all - or a large number - of your users all get the sort of same message at sort of the same time.

That's a lot of uncertainty, BUT if Bayesian software can flag that sort of thing, and I think it can, we can build a great tool here.

Re:I'm Disappointed

[SPiKe]

However, if the publishing of your company in the list causes actual harm to the reputation of the company (not to mention monetarily), I believe the court will side with the damaged party.

Re:I'm Disappointed

[wheany]

You don't need bayesian filtering to detect dupes. Some hash of the message is enough.

Re:I'm Disappointed

[Senior Frac]

No. Only if the claim being made is a falsehood.
Causing actual harm to a company is not illegal.
Doing so by lying could be deemed illegal. Subject to a decision by court of law. Both libel and slander have the prerequisite of false claims.

If SPEWS says their list is of spam haboring ISPs, and then it is, then they're not lying.

Re:I'm Disappointed

[Anonymous Coward]

WHEN BAYESIAN TECHNIQUES ARE USED

Well, that's fine and well if you don't pay for ever byte and bit of bandwidth to a state owned monopoly network as I do.

I have to pay for every bit of spam I feed to the Bayesian filters - DNSBL systems bounce it a the SMTP connection, I only pay for a few bytes at the HELO dance.

Got the $, use Bayesian, SpamAssassin, etc. Don't? Or just don't want to use up CPU time on spam? Use DNSBL's like SPEWS, etc.

Re:I'm Disappointed

[Anonymous Coward]

ROGERS.COM is not listed in *ANY* RBL.
See http://relays.osirusoft.com/cgi-bin/rbcheck.cgi

And as for Spews, it only blocks 0.053% of the IP addresses (level 1).

Doesn't this make things worse?

[number6]

If 550 means 'try again later', doesn't this just make things worse for the receiver? Some disc space is wasted on the spammer's end - but so what? Such a small fraction of people are going to be running this, it'll only amount to a few emails.

However, if the spammer retries it repeatedly, then you'll end up receiving more spam. I don't know what the standard retry time is, but if it's minutes or hours, then the mail server is going to get killed a lot quicker than the spammer's is going to fill up with disc space.

Bayesian filtering

[operagost]

I would love to see something like this using Bayesian filtering like POPFile. It would be a lot more versatile. You would have to feed it a few thousand samples first, though. I know that when I started using POPFile, I got lots of false positives (a real show stopper) until I had classified a few hundred messages.

Re:Bayesian filtering

[jasonkohles]

In order to analyze the body you have to accept the message, after you have accepted the message you can't then change your mind and give them a response that says 'mailbox not available', which is how the software works.

If you want to use their 'pretend the mailbox is busy and have them try again later' tactic, you have to do it right up front, which means the only information you have is the ip address it is coming from, and possibly the envelope to/from information, depending on where in the transaction you do the check.

Re:Bayesian filtering

[spongman]

try spambayes. works great.

Use a Teergrube

[Brett Glass]

What Theo should be doing, instead of sending a 5xx response (which, by the way, won't keep the message in the spammer's queue; a 5xx is a final rejection) is to redirect spammers' connections to a Teergrube (a spam "tarpit"). If enough people do this, the spammer will be slowed down greatly.

Re:Use a Teergrube

[langed]

based on your teergrube link, I am to estimate that this is an in-the-works plan; there is a mention of adding "stuttering" to the fake MTA...

SpamAssassin vs Theo's Package

[TPS Report]

On second thought, perhaps "package" isn't the best choice of words.. but anyway -

SpamAssassin uses Perl, which adds a couple megs of overhead to the connection. Most spammers slam a server with a billion connections, so Theo's package would be more efficient - it's very small and has low overhead.

I've heard various horror stories about SPEWS though -- mostly about them being indiscriminate when blacklisting whole subnets.. so although I won't be using this tool myself, I'm sure some people will find it useful.

Re:SpamAssassin vs Theo's Package

[AndroidCat]

www.acky.net = 65.165.235.172 S356

Partial listing:
1, 65.165.237.126, HUFFNAL / underage-girls.net
1, 65.165.238.144, HUFFNAL / home-lolita.net
1, 65.165.235.230, HUFFNAL / mail.webspace4all.net
0, 65.165.239.144, HUFFNAL / dealsonpc.com (listed)
1, 65.165.235.205, HUFFNAL / trust-bill.com
1, 65.165.234.1, HUFFNAL / Spammers Perez/Walls / mortgageleads.tv
1, 65.165.232.0 - 65.165.239.255, HUFFNAL / Todd Spears/Perez/Walls (Sprint)

Looks like a pretty scummy net-neighborhood. If their ISP doesn't want to clean it up, I don't think I'd want any email from them either.

Re:SpamAssassin vs Theo's Package

[realdpk]

don't believe what you read on SPEWS. some of their records are over *6 months* out of date. probably longer. worst. bl. ever.

Re:SpamAssassin vs Theo's Package

[Anonymous Coward]

At least they don't blacklist _recipients_ of spam, like SpamCop has been known to do.

Re:SpamAssassin vs Theo's Package

[jhylkema]

What's wrong with using the (sort of) tried-and-true MAPS RBL+?

Re:SpamAssassin vs Theo's Package

[Pete]

realdpk: I'm sure you'll be happy to provide at least three specific SPEWS records that are more than six months out of date, and explain exactly how you know that they're more than six months out of date.

Because otherwise people might think that you were just pulling unsupportable assertions out of your arse, and I'm sure you wouldn't want that, would you?

Pete.

Re:SpamAssassin vs Theo's Package

[crucini]

Check out this thread. Apparently realdpk harbored spammers for about a month, and then SPEWS took an additional 6 months to delist him. I'll refrain from repeating what I wrote in that thread.

Re:SPEWS is necessary & effective at hurting s

[jamie]

"If you can suggest something that is half as effective at raising the cost for spammers as SPEWS, please suggest it. SPEWS forces providers to decide whether they want to host exclusively spammers or host exclusively non-spammers."

First of all, I don't think most network administrators -- or their bosses -- know what they're getting into when they use Spews to police their network. If you are an admin who signs your company up for it, be prepared to have this conversation:

Boss: Hey, can you check to see if there's some kind of network trouble. I haven't gotten a reply email from a client in three days.

You: (after checking) Ah, that mail server is spam-friendly, we reject their mail.

Boss: (confused) They're not a spammer, they're our best client.

You: No, but they buy bandwidth from someone who buys bandwidth from someone who...

Boss: What?

You: We're using SPEWS, which is the most effective tool at stopping spam around the world! It forces providers to decide whether...

Boss: I don't give a damn, you work for me, not people around the world. Your job is to make the email work, not be a do-gooder. You may have cost this company a contract. Now get the damn mail working and tell me how many times you bounced my client's mail so I can decide whether you still have a job.

And -- you think Spews is effective? After being put on their list I had a grand total of one person unable to receive my mail. I have a dozen other people using my server to send and receive mail to hundreds of people, and according to my logs, among all of us, the sum total of people who couldn't get our email was two. That's the most pitiful boycott I've ever seen.

Back Off

[nurb432]

Hey, it still effects their server resources.

Ok, so dont call it a DoS, ( lack of better words caused me to use that term ) but its still harming another's resource, due to INTENT..

Much as the snail-mail campaign against another spammer recently..

Regardless of what you call it, its no better then the spammer.

And DONT misunderstand, i think they should be taken out back and shot.. but not by stooping to their level.

Re:Back Off

[almeida]

I don't see how it's wrong to send it back to the open relay. They are saying, "Here, have this," and you are just replying, "Not right now, thanks." That's perfectly valid use of SMTP codes. It's not like you launch an attack every time you get email from these relays, you're just telling them you don't want it right now. The idea is just to take the pain of SPAM away from the user and give it to the ones responsible (to some extent) for it. The open relays caused it, they should deal with it.

rblsmtpd + spamassassin

[Gothmolly]

Works great for me, thank you DJB! Here's a summary of the spamhouses I've blocked (with a 553 error code) over the past few hours. These never even touch spamassassin.

64.70.22.99-outbound1.lamailer.com
209.236.32.1 57-
216.19.164.127-127.opti9.com
65.126.119.178- formulatedmail.com
64.201.128.3-netblock-64-201-1 28-3.stanfordintl.co m
66.216.111.187-mail213.rm23.com
63.96.237.154-
216.109.73.35-om40.yourmailsoure.com
211.90.191 .61-
204.73.107.103-
209.189.49.102-
209.123.11 1.22-mail.dmx4.com
216.19.163.204-204.sbase30.com
63.70.105.139-ntls1.digitalriver.com
66.197.162 .15-
209.47.251.15-smtp5.rapid-e.net
209.236.57. 176-mtsbp512.email-deliveries.net
202.103.64.43-
66.216.116.78-mail153.myfunsleuth.com
65.107.195 .162-
209.213.210.18-mailer18.labeldaily.com
200 .206.207.206-200-206-207-206.terra.com.br
66.216. 115.56-mail16.justforyou-mail.com
64.119.213.95-p assionup.com
66.216.107.233-mail233.dealdelivery. com

Re:rblsmtpd + spamassassin

[iggymanz]

For half of those addresses, why not just block EVERYTHING from the domains that are obvious bulk mailers, rather than just from a specific smtp relay node? So based on what you posted, blocked anything from rapid-e.net, email-deliveries.net, etc.

What I'd like to see

[Dr Thrustgood]

A spam filter that lets through practically nothing except for addresses in a file. Every time it decides an email looks shifty, it replies to the sender with a message like:

"Your mail has been declined because of xyz, reply to this mail to send it through again"

and then for it to append a random aphanumeric string to the subject line (and / or email address - all my at my domain goes through to me). This string will be used as a key to allow a mail to go through to my inbox.

Alas, I don't have the time to develop such a product, but I'd sure as hell pay for one!

Re:What I'd like to see

[Anonymous Coward]

man procmail

you should be sending 553

[Cheeze]

550 is a temporary denial. 553 is a permanent failure (rblsmtpd switch is "-b"). spammers usually just move on to another host if they keep getting 553's. 550s tell them to keep on trying, which is bad on the receiving mail server if you're getting a pretty heavy load.

on a side note, i would advise against using the spews.org list. it is almost impossible to get off of that list. they recently decided to put a few /23's and /22's of a network that i run, just because abuse@domain.com did not respond fast enough. The only way to get off of that list is to post to a newsgroup, and just hope they read your posting and take off the ban. That means it is a total manual process on their side to remove you.

in my eyes, using something like sbl.spamhaus.org or/and relays.ordb.org is a much better solution. If you are going to go the DNSBL route, and you should, i would advise you figure out how to run your own DNSBL so you can quickly add and remove hosts that are mailbombing your server.

Re:you should be sending 553

[warpSpeed]

Correct me if I'm wrong, I do not have the RFC handy, but isn't a 5xx error a perminant error, and a 4xx error a transient error? Both 550 and 553 shoud indicate a non-recoverable error and the email should be returned as such to the sender.

Also if you want to tie up resource on the sending server use 4xx errors. The email wil sit on the sending server taking up space, and processing time. Which may or may not give you some pleasure. This will cost you in some tiny amount of bandwidth.....

the code in question

[edgarde]

here's what we're talking about.

sounds like a smtp proxy

[collin.m]

I use something very similar, MessageWall(.org). This is a smtp proxy with excellent filtering. So no need for something new.

Interesting, but here's an extra twist

[wowbagger]

I won't go into the validitiy of using SPEWS as a blocklist - there are good arguments pro and con there.

But here's a twist to the basic idea:

Given the the email sender is in $BLOCKLIST, have the filter daemon give the 450 response

v... e... r... y... ... s... l... o... w... l... y...

Combine a teergrube with the 450 response to fill up both their mail spool AND their socket connection table.

(For those who don't know, a teergrube (tarbaby) is a mail server that response slowly to a spammer, the better to tie up his connections).

Now, not only will the open relay's mail queue fill, but it will run out of (file descriptors|sockets) and choke on that too!

Re:Interesting, but here's an extra twist

[Anonymous Coward]

Actually I worked on (maintained code) a multithreaded program that sent mail for a mailing list system. We didn't write it for spam, it was for things like get a recipe mailed to you once a week.

The thing is when a server didn't respond (for example hotmail.com has many MX recoreds and one server may be down at the point in time.) One of the threads would be tied up waiting for the TCP timeout, about 30-90 seconds. I dropped the retry count from 3 times to 1 but still by the end of a run (about 1000 messages) possibly half of the threads were tied up waiting for a timeout.

So a tool to reply very slowly would be very effective in slowing down the message send rate.

- chuck

Re:Interesting, but here's an extra twist

[Anonymous Coward]

That is beautiful.

Re:SPEWS is necessary & effective at hurting s

[binner1]

At my last job, that is exactly the conversation I had. My boss said: We get too much spam here, do whatever it takes to stop it. I said: Sure, I'll have qmail do some rbl polling before accepting mail. Worked great for about a month...cut roughly 50% of the spam that network received. Then, boss says: Why can't I get email from ebay seller X? I say: Oh he's rbl'd...we don't take mail from there. He says: Ok, turn off the rbl.

After that, I turned on my own bayesian filtering and said F the rest of the network/users.

-Ben

Get rid of half your spam

[Quill_28]

If message has a '!' in the title, delete.

Re:Get rid of half your spam

[Anonymous Coward]

Or excessive spaces in the subject. A lot of spam I get looks a bit like this:

"Need that new mortgage? 938413t"

This should be fairly safe to filter, as a real (sane, semi-normal) person would not write subjects like this.

Let's face it...

[Pinteiro]

There is no real good way for a machine to tell good mail from junk mail , people just do the same thing over and over again : block certain hosts from sending e-mail to them , wich is, by far , not the greatest way to filter e-mail. filtering e-mail by searching for "hot words" like "FREE!!!!" doesn't do much good either. As long as computers don't think we won't stop spam mail. And when they do think , they will not want to spend their intelligence sorting mail :-)

Re:Let's face it...

[iggymanz]

Actually, it seems spammers use the same phrases in advertising the same stuff....just by filtering subject lines alone by regular expressions I'm rejecting about 5 spams a day per account, and the rest of the spams are rejected by bouncing e-mails based on source domain of bulk e-mailers (like host4bulk.com, e-mailpromo.net, etc.) I'm now getting 2 spams a week to the 6 accounts in my domain. I may next go to filtering the body of the mail, since there are expressions that keep popping up that none of my friends would ever use

Re:Let's face it...

[AndroidCat]

Filtering out any email that has "This is not spam" would be a good start. :^)

Re:Let's face it...

[iggymanz]

indeed I do: /^Subject: .*this is (no|not) spam/ REJECT 553 that WAS spam

SPEWS Is Not An Open Relays List

[Anonymous Coward]

Between Theo's erroneous statements, implying that SPEWS is a list of open relays, and some of the whiners in here bitching about "don't use SPEWS because they're too aggressive," I thought it would be handy to note a couple of things.

SPEWS is not a list of open mail relays. SPEWS (Spam Prevention Early Warning System) is a list of "spam sources." Some of those spam sources may be open relays. Some of 'em may be open proxies. Some of 'em may be spammers themselves (e.g.: Topica).

Regarding those that have found yourselves SPEWSed, yet are not, themselves, spammers: I'm sorry you've found yourselves in that situation. But, you see, kinder, gentler methods have been tried for years and have not solved the problem. It only continued to grow worse. And whether you like it or not: SPEWS works. I've never, in all the years I've been battling spam, ever seen ISPs boot spammers off their networks like I have since their netblocks started getting SPEWSed. You blame SPEWS for your problems but the truth of the matter is this: you've chosen to use an irresponsible ISP for your connectivity. If your ISP had been responsive to spam complaints, their netspace wouldn't have gotten SPEWSed.

Note: my personal net space was SPEWSed once. For a short while. But my ISP is a good one. They addressed the problem promptly and got their space delisted.

Re:SPEWS Is Not An Open Relays List

[Dunark]

Wrong. Spews maintains multiple listings for various kinds of spam sources and facilitators. See their webpage at http://www.spews.org for more information.

Re:SPEWS Is Not An Open Relays List

[Anonymous Coward]

No, SPEWS does not. Maybe you should read the FAQ at the URL to which you refer.

Re:SPEWS Is Not An Open Relays List

[Dunark]

Perhaps there is some confusion here. You can't use SPEWS directly; it is only available to the public via relays.osirusoft.com, and their servers return information that categorizes the kind of spam source or facilitator.

See http://relays.osirusoft.com/faq.html#_Toc533558164

Re:SPEWS Is Not An Open Relays List

[Frater 219]

Perhaps there is some confusion here. You can't use SPEWS directly; it is only available to the public via relays.osirusoft.com, and their servers return information that categorizes the kind of spam source or facilitator.

That's not quite true. SPEWS publishes a text-based list (warning: 800+ kB) which you can transform with a Perl script into whatever format your mail software needs. What Joe Jared at Osirusoft does is transform this into a DNSBL and make it available at spews.relays.osirusoft.com. This is why technical illiterates often accuse Joe of "being SPEWS" -- he republishes SPEWS' data in its most easily used form, though he doesn't have any editorial control over it.

Re:SPEWS Is Not An Open Relays List

[Anonymous Coward]

Yeah right, and Joe Jared is not directly involved with SPEWS.

It's real cute how you guys all go around saying you're not SPEWS, but I foresee a lot of people getting subpeona'ed once legal action breaks out.

It's hosted in Russia my ass. Only technical semi-illiterates will believe that.

Re:SPEWS Is Not An Open Relays List

[Dunark]

Legal action? On what basis? SPEWS publishes a list of what they *think* are spam sources. Nobody is obliged to take their word for it, and nobody is obliged to consider their list when deciding whether or not to accept email.

I think that any attempt at legal action against SPEWS would founder on the rocks of the first amendment. The first amendment right of free speech is possibly the one most consistently defended by the courts, particularly the supreme court. It's also a cornerstone of the spammers' defense of their own activities. It would be amusing to see the spammers trying to convince the Supremes that the first amendment protects them, but not SPEWS.

Re:SPEWS Is Not An Open Relays List

[SPiKe]

The First Amendment guarantees free speech, with some limitations. Two exceptions off the top of my head are libel and slander.

SPEWS is described as a list composed of network addresses in use by spammers, but we all know that innocents get thrown in the mix. This could be construed as a false publication, and considered damaging to the reputation of a company or person, not to mention the suing for damages due to a lost or missed contract.

Also, if this became a big enough problem to a big enough company, that company could invoke interference to interstate commerce, and I believe the FBI would become interested at this point, though I have a feeling SPEWs would avoid listing someone like that.

Re:SPEWS Is Not An Open Relays List

[Dimensio]

You should address another, common, misconception.

SPEWS does not block mail.
ISPs choose to block mail individually, on their own. Some ISPs choose to use one of SPEWS's lists (they keep two, one more 'aggressive' than the other) as a reference for blocking, but SPEWS itself does NOT prevent your mail from reaching its destination.

Anyone who claims otherwise is either ignorant or lying.

Re:SPEWS Is Not An Open Relays List

[Anonymous Coward]

It's real cute how you guys all go around saying you're not SPEWS, but I foresee a lot of people getting subpeona'ed once legal action breaks out.

So shut up and do it.

Re:SPEWS Is Not An Open Relays List

[Ballsy]

Obviously, your ISP is some sort of mom and pop shop then ? No moderately-sized ISP that I know of would bother trying to keep up with the morons that run SPEWS...it's a hopeless cause, for the most part. I'd venture a guess that SPEWS will survive PERHAPS another 6 months before people who use their service realize how brain-dead they are, and take their business elsewhere. One can only hope...

Re:SPEWS Is Not An Open Relays List

[Anonymous Coward]

and I believe the FBI would become interested at this point, though I have a feeling SPEWs would avoid listing someone like that.

Call the FBI, tell them your story, then report back here 'k?

(pray they don't send over a couple of agents to pistol whip your hide for tying up their phones... then shove a plunger up your ass for tying up two agents... oh, sorry, that was the NYPD... :)

Whitelist blocking is the only thing that works

[codepunk]

While some of the spam detecting algorithim's are cool and innovative they are still prone to circumvention. The best spam blocker I have ever seen used whitelist blocking. If I did not send you a message you cannot send me one unless you go to a web page and entered the reason that I should see your message.

This blocked 100% of the spam period ...

No stooping involved

[LinuxGeek]

This is mainly intended to prevent open ( poorly configured) email servers from being used as relays by spammers. The open server's disk space being gobbled up by causing them to spool the relayed email will certainly get the admins attention. This will shift the problem away from servers that recieve the email and onto the open relay which lets the spammers spam us with no easy way to trace the mail. The problem with tracing the email is that the poorly configured relay server is maintained by someone that usually ignores the emails asking them to close their smtp setup or to please examine their logs and let us know who was using them as a relay.

I think your sympathy is misplaced due to a lack of understanding of what allows the spammers to keep sending us all of those wonderful offers. If they don't have access to open relays, then they either have to keep moving their spamming servers when accounts are terminated or buy bandwidth off the backbones directly from qwest, AT&T, worldcom, etc... Either way, the spammers costs go up.

Do you feel bad for the people you hear about in the news that get charged with maintaining a dwelling for criminal purposes when they leave an empty house to be over run with drug users? Same principle is involved here.

Whitelisting

[Anonymous Coward]

In the above example the admin should be fired because he should whitelist all customers/clients!

Whitelisting works. It is as easy as a phone call. And yes whitelisting + SPEWS works too.

Re:Whitelisting

[tigga]

Yes, whitelisting is working...
But do anybody care to come to admin to say - here is email address, could you check if it needs to be whitelisted?

Speaking of spam

[rosewood]

What tools in Linux would one need to do the following:

Setup a pop3 server / smtp server so that email can be sent and received.

Filter spam / easily add filters to this pop3 / smtp server on the same box.

Also be able to check OTHER accounts on OTHER pop3 servers, download them, and filter out the same spam / things marked as spam.

Noobie proof is a good thing too.

PS - If BSD does it better then linux, post those tools as well. Maybe make it a chalange to see which OS can do said request better. Could win32 win (heh) ?

Re:Speaking of spam

[Anonymous Coward]

sendmail, qpopper, fetchmail, procmail, spamassassain

Re:Speaking of spam

[Malcontent]

postfix + (procmail | spamassasin ) + dbmail

Rewriting the wheel..

[Anonymous Coward]

I can already do this right in the MTA. I use Exim, but I know sendmail and other MTA's can do this as well.

Re:Rewriting the wheel..

[Whyzzi]

The idea here is NOT to launch a full blown resource hoggin' MTA, but fire back the spam in one quick simple blow before it reaches one (full blown resource hoggin' MTA, that is).

Re:SPEWS is necessary & effective at hurting s

[Charles Dodgeson]

First of all, I don't think most network administrators -- or their bosses -- know what they're getting into when they use Spews to police their network.

You are absolutely right. Although I advocate using things like SPEWS, you must make it clear that it will block mail from legitimate users. You either have to persuade people that this is right (as I believe) or not do it that way.

See this policy statement as an example of using such a policy, while making it clear that it will block mail from legitimate users.

Bruce Schneier

[Anonymous Coward]

Bruce Schneier has an excellent article in his newsletter called "Counterattack". He discusses vigilantism and why it is the wrong solution to problems on the internet. SPEWS is the wrong solution, especially because it deliberately blocks mail from innocent sources.

Re:Bruce Schneier

[Anonymous Coward]

Bruce Schneier has an excellent article in his newsletter [counterpane.com] called "Counterattack". He discusses vigilantism and why it is the wrong solution to problems on the internet. SPEWS is the wrong solution, especially because it deliberately blocks mail from innocent sources.

You obviously mis-read Bruce's article or don't understand how SPEWS works.

SPEWS works just as Bruce suggests, no vigilante "counterattack" on the a spamming abusers. It just lists the ISPs who have decided to take money to host spamming abusers.

And for the record, SPEWS blocks nothing. It is my own private mailserver which is blocking mail from SPEWS listed spam havens. No, that is not a "counterattack", it's just a shun, or boycott.

SPEWS shoots itself in the foot

[Random Walk]

Fighting spammers by causing as much collateral damage as possible (like SPEWS) does not work, and it is simple to see why:

1. I am customer of a small ISP. I don't send spam, and my ISP actively fights spam. Nevertheless, my ISP is on SPEWS - bad luck, wrong netblock.

2. I have zero incentive to change my ISP, and thus my ISP has zero incentive to put pressure on their upstream network operator.

3. Why ? Because I am blocked by bad luck, nothing else. I could change the ISP, but any new ISP might have the same bad luck. Changing providers will cost money, and will not secure me from future problems of that sort.

In short: the overzealous blocking by SPEWS removes any incentive to change ISP or exert any pressure on upstream providers. If it's just bad luck to be blocked, it may happen anywhere and anytime, and changing providers does not make any sense.

Re:SPEWS shoots itself in the foot

[Charles Dodgeson]

Because I am blocked by bad luck, nothing else. I could change the ISP, but any new ISP might have the same bad luck

That is simply false. It is true that any ISP can end up with spammer by bad luck. But the SPEWS listing spreads beyond the spammer only if the ISP does nothing about about the spammer.

So a non-spammer can only get caught by a listing if their provider fails to deal with abuse reports. Such an ISP has bad policy, not bad luck.

Re:SPEWS is necessary & effective at hurting s

[Erik Fish]

At my place of employment we have been filtering all incoming e-mail for ourselves and our small ISP through SPEWS and various other lists. Just now I checked and found that since 4:00am when the logs switched over we've blocked just over 2000 messages. About 1600 of them were because of SPEWS. This is a system with 6000 users and we've only had two or three complaints since we started filtering a few years ago.

That seems pretty effective to me.

Oh, and the boss loves it. As soon as we implemented the filters his spam load saw a *huge* decrease. He has even used the filters as a way to persuade a few of our more foolish clients to fix their open relays.

it looks like nobody understands the concept here

[honold]

the point is to punish open relays, not to block spam. the mail has to be retried for days, wasting network bandwidth and space.

if a signifigant number of people were to employ this, open relays would become crushed and filled with their own load.

Internment Camps For ISPs

[joeszilagyi]

If we don't block all foreign IPs from the US, the terrorists have already won.

Re:Internment Camps For ISPs

[Anonymous Coward]

The terrorists already did win. That's why Camp SPEWS was set up. Get into the boxcars, people; there's gold at the end of those railroad tracks.

Antispews is spam; SPEWS is good; others are too.

[Frater 219]

Please take a look at http://www.antispews.org for more information before using SPEWS.

Actually, antispews.org is likely being operated by spammers, as the Osirusoft FAQ suggests. (If nothing else, they are spammers of USENET newsgroups, since they kiboze for references to "SPEWS" and troll in response, much as Serdar Argic once did with "Turkey".) Naturally, spammers are pissed off at SPEWS, because it is simply put the most effective tool presently in the field for denying spammers access to (1) victims, and (2) willing ISPs to host them. Innumerable spammers have been terminated as a result of SPEWS listings.

There is no conceivable informed controversy as to whether or not SPEWS is effective at getting spammers off the Net. Whether or not SPEWS is a good tool for your site to use as a tool for reducing your spam count is quite another question. In my personal experience (as a security and email administrator for my site, which is a research institution) SPEWS is extremely valuable. I read my mail logs and ascertain that SPEWS usage blocks spam, with a remarkably low incidence of false positives.

In the past week, our incoming mail server has blocked 969 messages on account of SPEWS, with zero reports of false positives from our users. (To be honest, we get about one such report a month, and we whitelist the offending IP address. It's usually in China; we have several Chinese researchers.) Our locally maintained blacklist blocks about twice as much spam, and our use of sbl.spamhaus.org blocks about five times as much -- but that is biased by the fact that we consult those lists before SPEWS, and there is a good deal of overlap between them.

I would not recommend that ISPs who offer email service to their users use SPEWS by default, though it would be a valuable optional service. The DNSBLs I would recommend everyone use are:

• sbl.spamhaus.org, which lists only netblocks occupied by known repeat spam offenders
• relays.ordb.org, which lists only open mail relays; and
• proxies.relays.monkeys.com, which lists only open proxies.

These are all low-to-no-false-positives lists which I feel comfortable recommending to every ISP regardless of its stance on SPEWS.

horror story? acky.net looks dodgy

[dark-nl]

Consider this quote from the page you linked to:

We can assure you that no unwanted emails come from these addresses. Any unwanted emails you recieve you always have the option to opt-out of.

Sounds like typical spammer logic to me.

Oh good, with Spews?

[Anonymous Coward]

Then I won't get any mail at all, woo!

I like how Spews just blocks based on Internet politics more than anything. You can get on Spews because the admins don't like you personally.

Re:Oh good, with Spews?

[meringuoid]

I like how Spews just blocks based on Internet politics more than anything. You can get on Spews because the admins don't like you personally.

Please give an example of a SPEWS listing that was created because the admins didn't like someone personally.

Of course, there are plenty of people in news.admin.net-abuse.email who add to their private blocklists anyone who threatens to sue people over a SPEWS listing, but that's another matter entirely...

Re:Oh good, with Spews?

[Anonymous Coward]

He can't. You know he's full of it, I know he's full of it, heck I bet he knows he's full of it himself.

Or maybe he's just a bit of a retard and confused SPEWS with SpamBags where they DO list "based on Internet politics" and if the "admin don't like you personally".

You go Mr. Sam!

Ignorance

[Anonymous Coward]

The ignorance of this parent poster, who would dare question Theo's knowledge -- espcially a wanna be /.'er

Just burn down the house..

[nurb432]

So with that analogy:

The person is at fault for *not* knowing what is going on, and you should go ahead and burn the house down to 'get his attention'. So what if its illegal, you are just showing him, and making the crack dealers go elsewhere.. so its ok.. right?

Misuse of resources is wrong, regardless of how 'good' your intention is. ( and i dont buy the excuse that its a 'good intention', its intended to be punishment for being incompetent.. )

Re:Just burn down the house..

[LinuxGeek]

Yes, the person is at fault for not knowing what is going on with an open relay. That is the job of an admin of a system exposed to the internet. This method is only preventing them from handing the email to you. They already accepted the email, that dosen't obligate me to take it from them if I know it is spam, now does it?

They are the ones that are allowing their resources to be misused, I just wouldn't them to pass along the misuse. Are you just dense or are you a spammer trying to defend the undefendable position?

\m/ and /m\

[joeszilagyi]

It's the 'rawk' sign of the goat, i.e. this image.

/m\ is the thumbs-down equivalent. I picked it up on a couple of boards I used to be on...

Website is hosted by a a spamer Hurricane Electric

[dananderson]

I think what Theo did was great and I can't wait until it gets out into the mainstream.

However, I find it funny (hypercritical) that the weblog is hosted by a ISP that tolerates spam, Hurricane Electric. Specifically:

• Hurricane Electric's customers include major spammers, such as Bulk ISP Corp.
• Hurricane Electric's customers often show up in my spam trap, usually harvesting email addresses.
• Hurricane Electric's mail servers have open relays, which allows spammers to spam using their servers. Yes, I know it makes it easier for HE's customers to read email anywhere, but it allows spammers to flood others with spam also.

I'm sure others can add more, but I have other things to do . . .

Just Justification of Criminal activities..

[nurb432]

No, i just dont justify committing illegal acts.

If its wrong to begin with, its wrong to do it back.

So anyone that makes a honest mistake should be treated like a criminal, and more acts of crime committed against them.. in your thinking.

Re:Just Justification of Criminal activities..

[AndroidCat]

What illegal act? You're just not accepting the email that they're trying to dump on you.

Re:Just Justification of Criminal activities..

[Helter]

In what way is this illegal? Do you even understand what's being talked about?

Nobody is attacking the persons server, they're simply refusing to accept email from them.
Try to understand at least the basic concepts before you argue a point.

ultimate solution; bayesian client/server filter

[ubiquitin]

Having 550 messages sent based on a bayesian filter such as bogofilter is the best/most adaptive way to handle the problem. Open relay lists have a greater statistical probability of blocking legit email. The challenge this represents is that, unlike with Spews, you have to have clients which convey back to the server which emails get marked as spam.

Re:SPEWS is necessary & effective at hurting s

[Anonymous Coward]

If you are an admin who signs your company up for it, be prepared to have this conversation:


Funny how no one - not one person, ever - has reported a conversations like that, not even third or fourth hand.

Funny also how it's always SENDERS and not RECIPIENTS of mail who complain about SPEWS.

Re:it looks like nobody understands the concept he

[Anonymous Coward]

Why bother doing this with just spam. Why not actually send open relays mail for own domain, large emails and then refuse to accept them.

Spews is worse than the spammers

[jeske]

Spammers are frustrating because they disturb you, there is no way to track them down, and you can't get them to stop.

Spews is exactly the same.

1. They disturb legitimate users: I run a business hosting an email customer support application (Neotonic.com). It is very important for us to get email support replies thorough to customers. Numerous times our IP addresses have ended up on the Spews blocklist because of some unsolicited mail sender in the same 256 address subnet. At most colocation facilities, ten or more companies share the same subnet, and it is not easy to change your IP addresses.
2. There is no way to track them down: Organizations like MAPS are judicious about how they block IP addresses. They do NOT block entire subnets unless there is cause, and they have an organized appeals process to take care of their oversights. Spews has no such facilities. In fact, the only centralized item in spews is the spews.org website.
3. You can't get them to stop: They block entire ISPs, and their FAQ says that I'm a victim of "rare inadvertant blocking". The trouble is, we followed their advice, we moved to a new colocation, with an entirely new bandwidth provider, and our new IPs are also spews blocked. There is no organization to appeal to, there is no way to get this fixed.

Legitimate users like us can't keep changing IP addresses because SPEWS is too aggressive and has no organized process. If you want to use a spam advisory system, use MAPS RBL.

Spews is worse than the spammers, because at least I can ignore the spammers.

Re:Spews is worse than the spammers

[Tackhead]

> Legitimate users like us can't keep changing IP addresses because SPEWS is too aggressive and has no organized process. If you want to use a spam advisory system, use MAPS RBL [mail-abuse.org].
>
> Spews is worse than the spammers, because at least I can ignore the spammers.

If you want an effective spam advisory system that actually lists spamhausen, use SPEWS.

SPEWS is better than MAPS, because the spammers discovered they could ignore MAPS.

Re:Spews is worse than the spammers

[Anonymous Coward]

Spews is worse than the spammers, because at least I can ignore the spammers.

Or are you just saying this because you are one?

Re:ultimate solution; bayesian client/server filte

[AndroidCat]

That won't work. A 550 error has to be given before the body of the email is sent. A filter can drop the email into /dev/null once the body has been received, but you've already accepted the email from the sender.

Qmail + rblsmtpd has this

[Gothmolly]

here Works for me(TM).

Someone denser than a black hole

[LinuxGeek]

This is about as illegal as you not answering your phone when it rings. More correctly, it is like you listen to the first 3 seconds and hear a recorded 'offer' and hang up without listening to the entire telemarketing speach. Get a freaking clue.

*sigh* You all need to read and THINK

[nurb432]

IF you people would read closer, and THINK, much of the criminal activities i was talking about were an *analogy*.. I was trying to relate this to something that was concrete and not subject to interpretation ( i.e., the house burning ) as Spam is.

But that said, the last i heard, unauthorized use of computer resources IS a crime, here in the states at least.. And as far as I'm concerned what Theo is proposing constitutes unauthorized use of the so called 'offenders' systems, therefore criminal. ( this is NOT a slam on Theo btw, as i do have respect for the other things he has done )

But the main point i was trying to make was obviously lost many posts ago.. so i give up. Go ahead and justify your activities however you feel you need too.

Re:*sigh* You all need to read and THINK

[meringuoid]

But that said, the last i heard, unauthorized use of computer resources IS a crime, here in the states at least.. And as far as I'm concerned what Theo is proposing constitutes unauthorized use of the so called 'offenders' systems, therefore criminal. ( this is NOT a slam on Theo btw, as i do have respect for the other things he has done )

The unauthorised use of the system has already happened by the time this system comes into play - it was done by the spammer. An 'undeliverable' response is quite acceptable in an SMTP session, it's hardly unauthorised. If this means that the sending server keeps the spam on its own disk, too bad - but the spammer put it there, not me.

Re:*sigh* You all need to read and THINK

[LinuxGeek]

The point you are missing is that by refusing to accept relayed email, I would in no way be making unauthorized use of the senders system. I would be doing nothing illegal, immoral, perverse, snotty or devious.

By leaving a mail system open for relaying, the admins are leaving themselves open to abuse by spammers. If that abuse is compounded by my choosing not to accept their extension of abuse, then they are the ones with the complete control over correcting the situation.

Actually I am fascinated at how your mind must work to twist a refusal to accept email into some illegal act on my part. I know that in the US that citizens have a right to freedom of speech; do you also consider yourself to be harmed if I don't want to listen?

Re:*sigh* You all need to read and THINK

[Helter]

The person rejecting the email isn't "using" the open relays' resources at all. Am I "using" the resources of UPS by rejecting a C.O.D. package that I never requested? How about by just not answering the door so they come back every day for three days?

Am I responsible for the open relays "customer" sending me email that I didn't want?
Further, if you understand SMTP error codes, this is sending the PROPER code. Most spam blockers accept the mail then delete it, or return a 550 error (mailbox does not exist), both of which are dishonest. This error code acknowledges that the mailbox exists, but rejects the email. What the server does with it after that is the server admins business.

In no way is the intended recipient using the servers resources though.

Re:*sigh* You all need to read and THINK

[Anonymous Coward]

I think the point he was trying to make is that there is a potential for abuse of the 450 code. I run windows and Spam Killer, and bounce everything with a 550 code. When a clueless user with KLEZ or something sends it, unfortunately the person who was "framed" by the KLEZ receives the bounce. Unfortunately it will be too easy for the spammer to twist this or even use it in a DOS against an innocent party.

Re:*sigh* You all need to read and THINK

[Helter]

I think that you are mistaking what happens here. When you bounce an email with a 550 code, the code goes to the server which attempted to send the email to you, the server then sends the "bounce message" to the address in the sender field.

No matter what, the error message goes to the server that is relaying the email though. There is no potential for abuse here. The only server that is affected at all is the server relaying the email.
What's more, when an email is bounced with a 450 it isn't a terminal error. The server could attempt to resend the message for a number of days afterwards, making it even less likely that a spoofed sender value will adversely affect the third party.

Huh?

[Anonymous Coward]

"Darn cool"?

Open Relay Lists Don't Even Work

[mudimba]

A year and a half ago somebody with an open relay had the IP address that is now assigned to me. Possibly their account was shut down due to spews action, or maybe they just switched providers on their own accord. All I know is that now I have to go around finding all the dozen some odd open relay databases asking that they recheck my IP address to verify that its kosher.

Many people on this list are suggesting using open relay databases in place of spews - does anybody know of one that periodically rechecks the blacklisted addresses?

SPEWES bites

[houseofmore]

I'll take regular e-mails about penis enlargements and horny Japanese school girls any day over SPEWES.

People can go on and on about irresponsible providers, direct or upstream, but the fact of the matter is, with spews a quarter of e-mail from friends and family doesn't make it to me. I'm not going tell my dad to sod off and get a new provider because some twat at spews has stashed and burned half of the usable ip blocks on the net.

Hey I know: '/etc/rc.d/init.d/sendmail stop'

Works like a charm.

Re:SPEWES bites

[Anonymous Coward]

You don't have to tell your dad to Sod Off, you can ask him politely "Please change your fucking email provider." That way, the aggression is directed at the email provider, not your father.

Also, WTF is '/etc/rc.d/init.d/sendmail stop' Can I have that in English please? Maybe we are not all Unix Wizards and giving a solution that can be implemented by 0.0002% of the population is certain not to stop spam in your lifetime.

Re:SPEWS is necessary & effective at hurting s

[Anonymous Coward]

That pitiful thing that caused me no harm at all - yet I must continue to rant, rave, and troll about SPEWS, giving it more publicity than it ever could get by itself.
</translation>

Jamie, every time I think I've seen the most idiotic /. post, you come along to show me how wrong I am.

Decentrilization and multiple tactics.

[FusionDogg]

The main issue with Spam right now is that RBL's just don't work. They are way to centrilized. We need someone to setup a peer to peer tool for collecting spammer data. A Spamster if you will. IF you make it effective and invisible to the user you could have data on spammers that was current and widespread. Build in algorithms to switch from individual IP's to blocks based on what percentage of a class C has been run through. The system could send mass requests for action, an ISP may not respond when they recieve one email from Spews but I'd like to see them ignore 100,000 emails from everyone they have ever helped send spam to. And if someone stops sending spam they'd eventually fall off the list automatically as they network recognized that no more spam was being sent from them. So we wouldn't have the problems that exist with central RBL's. The tool could still respond with 550's or 450's and autoresponders or those could be 3rd party tools that use the list but I really think that a peer to peer solution is the only way to really stop spam. Or at least curb it back. Otherwise we are all going to have to start individual whitelists.

You know...

[Anonymous Coward]

I wonder how many spammers austroturf slashdot and post to articles like this where they think they have the chance to win our support.

Seriously, how many of these people complaining about spews are spammers themselfs?

Why sould I trust a site spammers setup?

[Anonymous Coward]

Rule #1 spammers lie! I sure don't belive you.

This must be working on discuraging and preventing spam if you spamming morons have to result to this dirty tactic.

The third party distress part was a dead give away.

Antispews?

[Anonymous Coward]

Yeah, right spammers.

Two steps

[Anonymous Coward]

1) Change SMTP so that mail has to be authenticated (i.e. the mail is cc'd back to the sender & if it is rejected, the whole mail is dropped).

2) Enact laws to penalize the BENEFICIARY of the spam marketing - i.e. if a company, say Berrytrim benefits from the spamming activities of its "affiliates," then it has to pay the costs of its rogue marketing program or terminate it.
This way, it does not matter where the spammer is. Most spam will die off because all the idiots in Tennessee and Louisana with their $59 "internet businesses" will fear spam laws.

Spam volume is increasing LOGARITHMICALLY. If something is not done soon, email will disappear in the blizzard of shit that has already consumed USENET.

*BSD is dying

[Anonymous Coward]

It is official; Netcraft now confirms: *BSD is dying

One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.

You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.

FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.

Let's keep to the facts and look at the numbers.

OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.

Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.

All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.

Fact: *BSD is dying

Re:SPEWES bites - but SPEWS rocks!

[Anonymous Coward]

He's trying to be "funny" and telling you to shut off your email server. No, he won't be taking this act on the road.

He can't spell, and enjoys getting pr0n spam, ie. loser living @ home in mom's basement, using one hand to type; gross tonnage: ~480lbs

Dad left mom & basement-boy, only communication is via email.

What an ass

[Anonymous Coward]

Wow, theo really is as much of an ass as I've heard. Click a couple messages further in the thread, and see him write stuff like No. You're wrong. It is PRECISELY what you want to do. and Wow. OK, I'm going to stop talking now. Apparently you've not looked
very much at spam. Funny guy.

This is a neat tool though.

It might be more appropriate, given

[Anonymous Coward]

current spammer tactics of portscanning machines, to take spare IP addresses and make some of them fake relays that do nothing but report any messages to the "user" accounts straight into DCC. What i mean is mail servers that do not even have a MX record anywhere or route mail anywhere (but to dcc) ...

I will comment that i see LOADS of smtp port scans bouncing off my firewall.. A class B is continiously scanned and rescanned.... I should probably also put up labrea to boot...

Open Relays are Passe

[nutznboltz]

Seems that one day I checked and our ORDB filter was letting more and more stuff through over time. Traced it down to the fact that ORDB only blocks open relays not open proxies.

Now I read about Theo's gloating over how his s/w is going to send 550's back. Well guess what? You can't 550 an open proxy.