The Spam Problem: Moving Beyond RBLs

whirlycott writes "I just published a paper called The Spam Problem: Moving Beyond RBLs on my site. I comprehensively describe RBLs and list eight specific problems with them. I also get into ideas that next generation antispam system creators should read. I hope that this will be useful to anybody who is attending the Spam Conference at MIT on Jan 17th."

Comments

You know, that would suck.

[aetherspoon]

(refering to the intro in the article)
I mean, you can compare it to having your entire town roped off because one person was a fraud... completely destroying said town, but you still live in it.

Wasting an entire netblock by blacklisting it is not good....

Re:You know, that would suck.

[Anonymous Coward]

How about a pizza company refusing to accept orders from a paticular motel because often noone will admit to ordering there? Stay at a different motel.
If you are using an ISP that does not enforce acceptable use policies restricting unsolicited email, you are supporting spaming activity.

In the past, when just systems that were directly associated with spam were blocked, the ISPs would move the spammer to one of the unblocked ips, and move an innocent to the blocked ip. Turns into 'whack-a-mole'.

With most blocklists, the block starts out small, targeting just the spammer. If the ISP gets rid of the spammer, the block goes away. If the ISP ignores complaints, the block grows.

Re:You know, that would suck.

[minas-beede]

What? With most blocklists the blocks are aimed verified spam sources, exclusively. SPEWS alone escalates, and it appears you assume you know how they escalate. Who, other than SPEWS, operates in a manner even remotely resembling what you claim?

If you would limit yourself to dealing with facts then you'd find factual episodes in which SPEWS escalated a listing long after the spammer was removed, escalating apparently because some non-useful, non threatening vestige of the spam operation (like a DNS entry) remained. In such a case there is no spam threat, no need to list, no need for collateral damage. Your glib explanation doesn't apply: it's a screw-up, an over-zealous action taken carelessly. SPEWS apparently started to believe the extravagant claims being made for it. It's often dangerous to start believing your own PR. Apparently it's dangerous even when you don't originate the PR.

There have been episodes of egregious collateral damage. The total of these do not begin to approach a reason to stop using DNSBLs. Even one episode is reason enough to re-examine and revise a listing policy - the enemy is spam, make sure you hit spam and spam only. Fight the enemy. Making excuses for shooting the innocent is not fighting the enemy, nor is making incorrect claims about what is done.

Re:You know, that would suck.

[Anonvmous Coward]

"How about a pizza company refusing to accept orders from a paticular motel because often noone will admit to ordering there? Stay at a different motel."

Um, exactly how much research are you expecting people to do on motels? Call them up and say "Can I order pizza there?"

"If you are using an ISP that does not enforce acceptable use policies restricting unsolicited email, you are supporting spaming activity."

As opposed to what? Exactly how is one supposed to go about finding out about how effective an ISP's attempts to filter spam are? The biggest problem with your argument is that spammers always change how they operate.

Sorry, but your answers struck me as oversimplified and unhelpful. How that was modded up as 'insightful' I'll never know.

Re:You know, that would suck.

[Senior Frac]

I mean, you can compare it to having your entire town roped off because one person was a fraud... completely destroying said town, but you still live in it.

You're right! I think the townspeople should talk to the sheriff and demand the fraud be arrested already, before he destroys the town's reputation even further. Or, better yet, run him out of town. (remember, this is a privately owned town, no one has a right to live here)

Instead, I think beating the tourists for driving past the town is a bit counterproductive. Don't you?

Re:You know, that would suck.

[Anonymous Coward]

It's called collective punishment. The "only democracy in the Middle East" does it all the time in the territories it supposedly "occupies."

Re:You know, that would suck.

[The Turd Report]

All the backbones have spammers on them, so in this guys mind, everyone on the internet indirectly supports spam.

Re:You know, that would suck.

[silentbozo]

It's more like refusing to accept cargo outbound to or inbound from certain countries, like say Cuba, Iraq, or Afghanistan (when the Taliban were in power.) Some countries still trade with them, and you're more than welcome to stay there, but don't expect to do any business with the US if you do.

If you're smart, you'll do some checking up on your ISP before you commit money to an operation that is going to hand you IP addresses that have been blackholed, and are now worthless.

Easiest way to stop spam...

[Anonymous Coward]

Tell EVERYONE you know never to click on any spam links, or buy spamvertised products. People spam because it WORKS. The only real way to stop it is to STOP BUYING SPAMMED PRODUCTS.

Re:Easiest way to stop spam...

[jaysonjc]

If they had that much intelligence, they would be doing something else.

Re:Easiest way to stop spam...

[robbyjo]

Mod parent up.

This way it makes companies realize that spam will produce hate toward their products. But... the problem is that, many spams were of pr0ns -- which has no better place to advertise anyway.

Re:Easiest way to stop spam...

[sfled]

Absolutely. Spread the message to new users. The response to spam is very small, on the order of hundredths of a percent. The spammers get negligible responses because of the sheer numbers of recipients. I can't help but think that it's mainly newbies that respond to spam; x amount of unwary sheep getting sheared the first time they see the opportunity to 'Meet lonely married people' or 'add inches to penis/bust/whatever'.

Re:Easiest way to stop spam...

[Zeinfeld]

Tell EVERYONE you know never to click on any spam links, or buy spamvertised products. People spam because it WORKS. The only real way to stop it is to STOP BUYING SPAMMED PRODUCTS.

The problem is that you are in a global network. It is like the problem of eating whale meat, you can persuade 99.999% of the world population that eating whale meat is a bad idea but the other 0.0001% that is left can eat the endangered species to extinction within a matter of months.

It only takes a vanishingly small number of businesses out there to SPAM and you have a massive problem.

SPAM does not have to even be profitable for people to do it. If I wanted to launder a lot of drug cash I would set up a spam house and bombard people with ads for herbal viagra..

There was a time not so long ago when the majority of the SPAM being sent out was adverts for spam software. SPAM does not have to work as a marketing method for creeps to get rich charging others to spam. The pitch line they use to haul in suckers is 'it must work or why would people do it', well no, it does not have to get one single end customer for it to work for the spammer.

Re:Easiest way to stop spam...

[linuxelf]

And the only way to reduce pollution caused by private vehicle traffic is to not drive SUVs. Tell everyone you know not to do that any more! And the only way to reduce the number of deaths by drunk drivers is to not drive drunk. Tell everyone you know not to do that any more! And . . . .

Re:Easiest way to stop spam...

[Anonymous Coward]

The best way to stop racial segregation is to tell everyone you know not to support it.

Oh wait, that happened.

Re:Easiest way to stop spam...

[Frater 219]

People spam because it WORKS. The only real way to stop it is to STOP BUYING SPAMMED PRODUCTS.

Not exactly. Besides being a theft of end-user and mail-site resources, spamming is also a scam perpetrated upon businesses. If you got spam advertising Joe's Naked Kinky Web Site, that probably isn't because Joe thought up the idea of spamming you all on his own. Most likely, a career spammer (let's call him Alan) convinced Joe that spamming was:

1. effective,
2. legal, and
3. everyone's doing it anyway, so why miss out?

Joe then paid the career spammer to spam for his naked kinky Web site. Since all three of Alan's claims are false, and he knows it, this means that Alan has defrauded Joe. He exploited the fact that Joe is probably neither an Internet expert nor a lawyer, but he does feel competition from other naked kinky Web sites, to convince him to pay for spamming.

(Yes, Alan the spammer told the news media that spamming is effective, too ... and they believed him. He was lying there, as well -- but it got him, and spamming, free advertisement in the news!)

This scam does not rely on spamming actually being effective, so long as vendors still believe it might get them an edge over the competition. Thus, getting people to quit buying spamvertised products cannot (directly) affect it. Only when all vendors on the Internet -- yes, including naked kinky Web sites -- realize that spamming doesn't work, isn't legal, and that they can do just as well without it, will spamming go away.

Re:Easiest way to stop spam...

[Anonymous Coward]

This isn't the "easiest" way by far... but the easiest way probably isn't legal. Use your imagination on this one.

Re:Easiest way to stop spam...

[Pig Hogger]

(Yes, Alan the spammer told the news media that spamming is effective, too ... and they believed him. He was lying there, as well -- but it got him, and spamming, free advertisement in the news!)

Those scumbags often get big, (supposedly) reputable companies: I got spammed by none other than Equifax about a month ago!!!

Re:Easiest way to stop spam...

[ciscoguy01]

You said: > Tell EVERYONE you know never to click on any spam links, or buy spamvertised products. People spam because it WORKS. The only real way to stop it is to STOP BUYING SPAMMED PRODUCTS. There is a term for that. The Boulder Pledge "Under no circumstances will I ever purchase anything offered to me as the result of an unsolicited e-mail message. Nor will I forward chain letters, petitions, mass mailings, or virus warnings to large numbers of others. This is my contribution to the survival of the online community." as proposed by Roger Ebert http://www.zdnet.com/yil/content/mag/9612/ebert961 2.html

Re:Easiest way to stop spam...

[Anonymous Coward]

1. effective,
2. legal, and
3. everyone's doing it anyway, so why miss out?

Joe then paid the career spammer to spam for his naked kinky Web site. Since all three of Alan's claims are false, and he knows it, this means that Alan has defrauded Joe.


1.) The effectiveness can be measured by click-through and purchase rates. Companies should be able to see exactly what spam does for them.
2.) As far as I know, there is no law against unsolicited email, so long as it isn't fraudulent. The FTC goes after the spammers for fraud, not spamming.
3.) In some "industry groups" (penis enlargement, mail-order viagra, and porn) many of a company's competitors may be spamming.

So I would conclude that Alan may not be lying at all. I think it would be pretty tough to win a fraud case against him. Of course, I still hate spam in my mailbox, just as much as the next guy.

Bob

Re:Easiest way to stop spam...

[dipipanone]

Since all three of Alan's claims are false, and he knows it, this means that Alan has defrauded Joe.

Not exactly. I'm not trying to defend Alan here, but you're really stretching it to call what he's doing a fraud.

Compare him, for a moment, to a zillion web design houses. They would also market their services on similar grounds, ie setting up a website is effective (in the sense that it will increase their sales and is an effective way to advertise to millions.) And everyone is doing it anyway so why should they miss out on this great business opportunity?

Those claims are equally dubious when it comes to establishing a business website, but nobody would really think for a minute that the seller perpetrated a fraud. Shit, the whole of the dot.com nineties were based upon similarly dubious statements but nobody ever was prosecuted for that.

Jeez, whenever I'm in the USA and watch your informercials, the bulk of the claims made for the products involved seem just as doubtful, but we operate on the principle of caveat emptor -- the buyer has some duty to inform themselves as to the validity and applicability of such claims to their business.

Selling spam services may be antisocial and the people who do it are lower than pimps in my book, but I just can't see how it could reasonably be regarded as fraud.

Re:Easiest way to stop spam...

[Bat_Masterson]

You don't know enough people to make a dent. The costs of SPAM (like bulk mail) are so low that one hit in thousands (or even millions) would probably justify the expense.

Re:Easiest way to stop spam...

[dev11]

Spammers do misrepresent what they are selling, but if there are few or no responses, it will hurt the spammer some. Most spammers get some amount of money for each response or "lead" the spam generates. So, if no one responds, he doesn't make his commission. But the actual fee collected from the client is probably more than enough to make spamming worthwhile financially. If people would stop responding to spam, then hopefully businesses would resist hiring a spammer. But as long as there are gullible, stupid people out there (and it only has to be a very small proportion) responding to it, spam will never disappear.

Re:Easiest way to stop spam...

[Anonymous Coward]

ANd my clicking on a spammers site, you just gave them your Email. Their site is going to look for a cookie appropriately named "email" and now they have your Email address.

In some really early tests of this, I discovered a larger the expected percentage have an "email" cookie on their system.

Have you ever filled out a forms page and seen your Email there? How do you think they got it?

Re:Easiest way to stop spam...

[clue_phone]

MA is considering a law to make spam illegal and enable a private action against spammers. Thw current proposal sets damages at a min of hundreds.

I think a private action is ideal, because then the number of people willing to angry and sue a spammer also has to be a very small percentage to make this a money-losing game.

Of course, if we go through a time where spam can cause a couple of companies to accept large losses from private actions then there will be a stronger incentive for the destruction of anonymous electronic sppech. Because with anonymity you can "frame" a company for spammage. Of course, intelligent relays are a better idea but the prohibition on anonymity will have many more advocates. (I btw am not one, meaning I strongly suport anonymous speech.)

And did he publish a paper

[TerryAtWork]

on getting his site /.'d into a little ball of slag?

Seriously, I'll try and review the paper...

Hey, reminds me of...

[Anonymous Coward]

...some small country in the middle east.

Okay, bad joke.

I fail to see how active denial will ever work. The world is full of lazy people who keep relays open and don't bother. The solution has to be something passive, like RBL. You check it, it's a spammer, don't accept. The spammer relays can keep their configuration, only their mails won't reach anywhere!

Incomplete!

[Murrow]

You'll notice that he listed and then did not address the "Common Arguments and Justifications" for running and/or using a RBL. Just couldn't come up with a reason why privately owned servers have to accept mail from any particular person or group if they don't want to.

Re:Incomplete!

[squiggleslash]

Uh?

Why do you feel he has to come up for a reason why privately owned servers have to accept mail from any particular person or group if they don't want to? What kind of stupid, inane, black and white, world do you live in?

He's pointing out that current blacklisting systems are stupid. He's pointing out that the people who run the blacklisting systems are generally unaccountable (most lists are secret), that they do impose arbitrary blacklist entries against groups they disagree with, well outside of their advertised remits (such as MAPS blocking an ISP that had a handful of customers that sell spamming software), that ordinary bystanders are frequently the victims of over zealous blocking and that, per se, anyone relying on a third-party RBL based solution is making a huge mistake.

This isn't about forcing anyone to do anything. It's about making people aware that if they chose certain solutions, what the consequences of those solutions are, and that there are other methods that are more sensible and affective.

I've been blocked by the stupid effing incompetent and irrelevent DUL (designed so anyone with more than one ISP account can't send email without an enormous amount of hassle every time they log into the other account: they can't use one SMTP server, because open relays are pretty close to non-existant, and can't send email themselves, because of the entirely irrelevent DUL which could be replaced by an obvious redirect of port 25 by the ISPs that publish on those lists anyway) I have to be careful which DSL provider to go with because many block incoming SMTP connections which means I can't do my own spam management with them, but if I look at my Yahoo Mail account - or any account I've actually used that I can't self-manage, the account is so swamped with spam I can barely find the stuff that really is sent to me, regardless of how good the spam filters are that are provided.

The current situation is stupid. I can manage spam myself (which I am fairly successful at, but only if I have an ISP that lets me do so), I can have an ISP do it, in which case legit email is blocked and illegitimate email still swamps my mailbox, or I can subscribe to a service run by unaccountable activists who frequently abuse that position of trust.

Do I need to come up with an argument that people should be forced to receive email, or even suggest I'd agree with such a mandate (I don't), for you to understand my problems with current filtering systems, and my belief, in general, that those responsible for the Internet email infrastructure are a bunch of mindless jerks who'll be second against the wall when the revolution comes?

Re:Incomplete!

[Frater 219]

He's pointing out that current blacklisting systems are stupid. He's pointing out that the people who run the blacklisting systems are generally unaccountable (most lists are secret), that they do impose arbitrary blacklist entries against groups they disagree with, well outside of their advertised remits (such as MAPS blocking an ISP that had a handful of customers that sell spamming software), that ordinary bystanders are frequently the victims of over zealous blocking and that, per se, anyone relying on a third-party RBL based solution is making a huge mistake.

But, you see, those things he's "pointing out" are wrong. They just aren't so. They aren't the way the world works, and they aren't the way DNSBLs work.

• DNSBLs are not secret or unaccountable. They can't be! They are accountable to those who use them (mail server operators), who are respectively accountable to their users. Individual DNSBLs have force solely because sites use them; a DNSBL nobody uses is a no-op. I use certain DNSBLs because I trust them to accurately do what they say they will. If a DNSBL that I use starts going haywire and listing things that it said it would not, then nobody will continue to use it -- and it will therefore be without force in the world. (Incidentally, anonymity or pseudonymity does not equal unaccountability -- but if you don't know that, get the fuck off the Internet, since we fought that one almost a decade ago, and St. Julf of Penet was right.)
• MAPS screwed up, and was held accountable for it. That is why nobody who is serious about spam-fighting takes MAPS seriously any more. They fucked up, they fucked up bad -- and so today they are naught but a minor player. SPEWS, SBL, and ORDB are the big players in the world of DNSBLs, because they do what they say they will do, and they don't fuck around. (Note: That they do what they say they will do doesn't mean they do what you want them to do. You don't get to decide that except for your own mail server.)
• There is no "overzealous blocking" problem. There just isn't. If you are thinking about SPEWS, keep in mind that sites which use SPEWS know what it does and want it to be doing that -- otherwise, they would quit using it. SPEWS doesn't force itself upon unwitting mail servers -- rather, operators have turned to it because it works, it works well, and because they and their users are sick and tired of putting up with ISPs which don't boot off their spammers. It isn't "overzealous" -- it is doing precisely what we want.
• Using DNSBLs isn't a "huge mistake"; it's effective collaboration. Right now, DNSBLs represent the best means for sites to share information with one another about which IP addresses emit spam, or are open proxies, or belong to spam supporters. They are used not only by mail server operators, but also by IRC operators tired of proxy-borne abuse. They are effective -- and if they were not effective nobody would use them. If a better means comes along to do what DNSBLs do, then we will happily use it -- but it ain't here yet.

It is not mail users who want us to consider DNSBLs passe' or something to "move beyond". It is spammers who want us to give up our current most effective tool for collaborating to impede their crimes.

Re:Incomplete!

[squiggleslash]

Uh?

Why do you feel he has to come up for a reason why privately owned servers have to accept mail from any particular person or group if they don't want to? What kind of stupid, inane, black and white, world do you live in?

He's pointing out that current blacklisting systems are stupid. He's pointing out that the people who run the blacklisting systems are generally unaccountable (most lists are secret), that they do impose arbitrary blacklist entries against groups they disagree with, well outside of their advertised remits (such as MAPS blocking an ISP that had a handful of customers that sell spamming software), that ordinary bystanders are frequently the victims of over zealous blocking and that, per se, anyone relying on a third-party RBL based solution is making a huge mistake.

This isn't about forcing anyone to do anything. It's about making people aware that if they chose certain solutions, what the consequences of those solutions are, and that there are other methods that are more sensible and affective.

I've been blocked by the stupid effing incompetent and irrelevent DUL (designed so anyone with more than one ISP account can't send email without an enormous amount of hassle every time they log into the other account: they can't use one SMTP server, because open relays are pretty close to non-existant, and can't send email themselves, because of the entirely irrelevent DUL which could be replaced by an obvious redirect of port 25 by the ISPs that publish on those lists anyway) I have to be careful which DSL provider to go with because many block incoming SMTP connections which means I can't do my own spam management with them, but if I look at my Yahoo Mail account - or any account I've actually used that I can't self-manage, the account is so swamped with spam I can barely find the stuff that really is sent to me, regardless of how good the spam filters are that are provided.

The current situation is stupid. I can manage spam myself (which I am fairly successful at, but only if I have an ISP that lets me do so), I can have an ISP do it, in which case legit email is blocked and illegitimate email still swamps my mailbox, or I can subscribe to a service run by unaccountable activists who frequently abuse that position of trust.

Do I need to come up with an argument that people should be forced to receive email, or even suggest I'd agree with such a mandate (I don't), for you to understand my problems with current filtering systems, and my belief, in general, that those responsible for the Internet email infrastructure are a bunch of mindless jerks who'll be second against the wall when the revolution comes?

Re:Incomplete!

[squiggleslash]

I must admit to having less of a problem with DNSBLs than other types of RBL such as the open relays (which I semi-agree with but wish had taken place simultaneously with pushing standards for authentication) and the DUL - the most dumb idea in the universe since banning people from EFNET for not having IDENTD installed on their home computers.

That said:

DNSBLs are not secret or unaccountable

You semiaddress the issue of accountability but not of secrecy. It's a fact that most services keep their lists secret until affectively revealed by dropped emails. Accountability is tied into list use, yes, after the fact people may drop a clearly abusive operator, but a substantively less abusive operator may get away with blocks for years.

The MAPS case was high profile because MAPS were public about their ban and their reasons for banning. Had they been dishonest, we'd still be arguing the case and MAPS would still be regarded as part of the solution, especially as the usual assumption made by pro-block-list advocates is that any criticism is simply net-kookery or from the spammers themselves. Take a look at some of the stories here and the Usenet groups for prime examples.

As an aside, I have personal experience of spending months trying to get a false entry in the DUL corrected. I had an internet account with an ISP that used a class C block allocated by Bellsouth. Bellsouth flagged the entire /16 block as being dial up. I discovered this trying to email a friend on Netcom.

Who was accountable? Not Bellsouth, they didn't care. Not Netcom/Mindspring/Earthlink (it's one ISP), nobody's going to lose an address they've had for years if they can help it, and indeed my friend prefered to believe it was a fault of my configuration than that it could possibly be Netcom subscribing to an unaccountable blocking list. Not my ISP either, what the hell could they do about it? It took weeks of badgering finally involving phoning Earthlink's 800 number and making a pest of myself before something got done about it.

There is no "overzealous blocking" problem

That rather depends on whether you're a normal user trying to get in touch with people you know or whether you're a BOFH.

Look, let me put it this way: I am not a spammer. I email friends, I email myself (at work, to my Yahoo address, etc), I email family. I don't even operate any mailing lists. And I have problems. I have problems because I have a non-simple config - by that, I mean I don't have ONE internet account with ONE IMAP email address and ONE SMTP server.

Every time I send an email to someone who wanted to receive it, or someone tries to send email to me that I want to receive, and they can't get it, or I can't get it, that's a problem. And I can honestly say that with the exception of the odd occasion where my .dynip.com address has fallen off the net and email hasn't been deliverable to my SMTP server, every problem I've had with undeliverable email in the last few years has been down to over-zealous blocking procedures.

Now, you're saying "Yeah, but it's Yahoo's computers, not yours" (or whatever). That's true, but that doesn't change the fact that legitimate email is not being routed, and it's not being routed because of measures intended to aleviate spam. Yahoo are saying they operate an Internet email system, but when I tried sending stuff to my own account on Yahoo from my static IP Earthlink DSL connection, my computer spent 3 days trying to send it before giving up because the MX host was unreachable. That means that, for these purposes, that service they claimed to be providing didn't exist. And it didn't exist because someone between me and Yahoo - maybe Yahoo, maybe Earthlink - had blocked an email. Oh, but ok, I could have gotten it through if, at that moment, I'd used Earthlink's SMTP relay, but (a) WHY? (b) I have sendmail set up to send email for a reason, I don't particularly want to hunt through my configuration files every time I point at a slightly different but otherwise identical reason. When I'm using my backup non-Earthlink dialup, for instance. Or on the road using a friend's account.

The end result of this is that legit email is blocked, spam (very clearly) still gets through (I already know how to enlarge my penis thank you very much), and so it's fair for me to say that the measures sysadmins are taking to block spam are not working, that they're interfering with legitimate use, that they're not actually ever going to be effective anyway, that they interfere with the communication of unconnected third parties.

The only person in the world who seems to have a 100% effective, never interferes with legitimate email, anti-spam system, often seems to be me. That's because I manage my own email. I don't use lists, I just make sure that businesses trying to contact me only have specially created email addresses (on my system) that, if abused, will vanish in as long as it takes to edit my /etc/mail/aliases file. Works too, I get one spam message every few months.

But the blocks that are constantly being proposed are making that approach more and more difficult. BT, in the UK, apparently block all incoming port 25 connections. Why? Because of complaints about open relays. So if/when I go back, I'm not going to be able to do the kind of filtering I do above, thanks to the so-called anti-spammers.

It is not mail users who want us to consider DNSBLs passe' or something to "move beyond". It is spammers who want us to give up our current most effective tool for collaborating to impede their crimes.

It is mail users, it's not mail administrators, and this seems to be a distinction many in the pro-block camp fail to understand. Between me and any person on the Internet, there are many machines. By creating ineffective and incompetant blocking measures with no clear accountability and no obvious way of rectifying errors (for the vast majority), these systems cause headaches and make the whole issue of sending email a chore. As these systems continue to have less and less relation to the task at hand, as pro-list advocates become more and more militant, and as spammers continue obliviously, email will become steadily more and more unusuable.

And if pro-list advocates continue to ignore the cries of users, and continue to protest that only kooks and spammers complain about their methods, that situation will get worse. From my point of view, as long as emails I send from my machine using completely legitimate (RFC mandated, etc) methods without anything being radically awry about the way I'm doing it, get routinely blocked because of incorrect assumptions, email is broken, and it's the advocates of block list's fault that it is.

Re:Incomplete!

[Anonymous Coward]

"If you are thinking about SPEWS, keep in mind that sites which use SPEWS know what it does and want it to be doing that....."

I work for a provider which ended up on the spews list, not because spam originated on the network, but because a domain connected with one promoted by a known spammer was inadvertantly parked on the server. We closed the account as soon as we found out and notified spews that the account had been immediately closed.

Spews has continued to keep our entire block listed because the spammers domain was still delegated to a server. Even though we had nothing further to do with the spammer, spews continued to list us, and all attempts to contact and reason with them has failed.

I think DNSBL can work and work as well as can be, however, The attitude of some RBL/DNSBL is to punish the provider for ever becoming contaminated . That's where the system breaks down. We took immediate action on the issue. The action we took was immediately favourable to everyone except the domain holder and the spammer. The action was not acknowledged by the list administrators, nor was the co-operation we showed reciprocated.

We have since convinced the domain holder to delegate his domain elswehere and effectively decontaminated ourselves fully. We were also able to convince a couple of providers whose mail servers wer using spews DNSBL to reconsider because legitimate email was being blocked for no valid reason.

SPEWS continues to list our server citing the same reasons.

If your mailserver is only accepting mail for yourself, and you don't care that legitimate email gets rejected, then use them all (DNSBL). But if your server is also receiving mail for others, then you need to be careful. DNSBL can work well but only if everybody co-operates.

Re:Incomplete!

[Frater 219]

I must admit to having less of a problem with DNSBLs than other types of RBL such as the open relays

It is not clear to me what you mean by this. "DNSBL" is the generic term for any DNS-based Blackhole List. "RBL" is a trademark of MAPS, Inc., for a particular DNSBL which they operate. Different DNSBLs have different criteria for what they list.

For instance, some list only open relays, e.g. ORDB. Some list only open proxies, e.g. Blitzed OPM. Some list IP addresses which have sent spam to particular detectors. Some list IP addresses which belong to repeat spammers, e.g. SBL. Some list IP addresses allocated to particular countries or ISPs, such as the blackholes.us lists.

There's as great a diversity of DNSBLs as there is of opinions as to how to run a DNSBL.

You semiaddress the issue of accountability but not of secrecy. It's a fact that most services keep their lists secret until affectively revealed by dropped emails.

I'm not sure what you are claiming here. Do you mean that most mail sites do not tell their users which DNSBLs (if any) they are using? Or do you mean that DNSBLs do not disclose what IP addresses they list?

If the former, I agree that this can be a problem, particularly if the mail sites in question are ISPs. ISPs should disclose their mail filtration policies to their users; it's also nice (but by no means ethically necessary) if they give their users choice as to which filters apply to their individual mail. For other mail sites, such as corporations or research institutions (my workplace is one of the latter) it may be unnecessary given the site policies.

If you mean that DNSBLs don't disclose which addresses they list -- well, this is certainly the case for some DNSBLs, and certainly isn't for others. SPEWS, for instance, publishes their entire list in a text file (warning: long!). Many others do likewise. Some permit DNS zone transfers, so your nameserver can automatically download a full copy of the list and you don't have to query them constantly.

Any of the DNSBLs which I would recommend have clearly stated policies as to how addresses get on the list, and how they can get off. It is certainly the case that some mail operators use DNSBLs that I would not recommend. (Nobody, I say nobody, claims that your mail site should use every DNSBL out there, or that you should use them indiscriminately.) That is, I fear, their problem.

As an aside, I have personal experience of spending months trying to get a false entry in the DUL corrected.

Yes, there are badly operated DNSBLs. Yes, it's unfortunate that some sites use badly operated DNSBLs. That is a problem with the badly operated DNSBLs and not with DNSBLs in general. Please do not tar Steve Linford (operator of Spamhaus SBL) with the Paul Vixie brush.

Yahoo are saying they operate an Internet email system, but when I tried sending stuff to my own account on Yahoo from my static IP Earthlink DSL connection, my computer spent 3 days trying to send it before giving up because the MX host was unreachable. That means that, for these purposes, that service they claimed to be providing didn't exist. And it didn't exist because someone between me and Yahoo - maybe Yahoo, maybe Earthlink - had blocked an email.

I'm a little bit confused here. The issue at hand is DNSBLs, but the usual use of DNSBLs cannot yield a "host unreachable" -- it yields an SMTP error message and possibly a bounced mail. It sounds to me more like your own ISP, Earthlink, was filtering outbound port-25 connections from client addresses, to keep its dialup and DSL users from being used as spammable open proxies or relays. A ham-handed policy, indeed, but a policy decision that it's Earthlink's to make -- and nothing to do with DNSBLs or other sites' spam filtering.

Oh, but ok, I could have gotten it through if, at that moment, I'd used Earthlink's SMTP relay, but (a) WHY?

Presumably, if they're filtering port 25, because that is how Earthlink has chosen to run their network. That is undoubtedly cheaper and easier for them, than it would be to chase down every damn user on their system with an open proxy, open relay, backdoor trojan, or other piece of crapware and kick them off.

Sure, they could do that. But your fees would be triple, and they would go out of business -- so you'd have to find a new ISP anyway.

The end result of this is that legit email is blocked, spam (very clearly) still gets through (I already know how to enlarge my penis thank you very much), and so it's fair for me to say that the measures sysadmins are taking to block spam are not working, that they're interfering with legitimate use, that they're not actually ever going to be effective anyway, that they interfere with the communication of unconnected third parties.

It strikes me as foolish to say that DNSBLs as a category don't work, when anyone who runs a professional mail site and uses them can tell that using the right DNSBLs does make a difference in spam load. My site, with ~1000 users, blocks 2000-3000 spam per day using DNSBLs, local IP blocklists, and some content filters for obvious spam signatures (e.g. "S.1618") and viruses. We also get maybe one false positive a month reported by our users, which we whitelist; we also give users the choice of opting-out of spam filtering entirely for their accounts. (The demand for this? A few Chinese researchers whose home institutions operate open relays.)

It is mail users, it's not mail administrators, and this seems to be a distinction many in the pro-block camp fail to understand.

Thing is, from what you've said, you aren't an ordinary mail user, so you don't get to make that call for the entire mail-using public. You're a network hobbyist, who's choosing to operate his own mail site on a network that has chosen not to support that kind of operation -- namely, an end-user ISP. If your ISP doesn't allow port 25 outbound, or tells other sites not to accept mail from its client addresses (which is what a DUL listing indicates), that doesn't mean you have a problem with other sites' spam filtering ... it means you have a problem with your ISP and its choices for how to minimize problems on its own network.

If you, a hobbyist, want business grade connectivity rather than end-user connectivity which is filtered to minimize abuse, then you need to go to an ISP and get a contract for that kind of connectivity. It will cost more. That you assumed that an end-user ISP would support your hobby -- at the expense of being unable to clamp down on abuse of their own systems -- indicates to me that you might need to think your plans through a bit more.

Re:Incomplete!

[squiggleslash]

If you, a hobbyist, want business grade connectivity r...

No, I want to send email and want to be able to do it without changing my configuration every time I use a different ISP. Hobbyist? If, by that, you mean "someone who uses the Internet", then yeah, I'm a hobbyist.

I explained that. I explained it more than once. You have some how come to the conclusion that using more than one ISP is equivalent to "requiring business grade connectivity". That's exactly the kind of idiotic assumption that's causing email to be broken by poorly thought out so-called "anti-spam" systems.

It's perfectly reasonable for a user to expect an email message sent via the normal RFCs to arrive at its destination. Anyone who believes that "ordinary users" shouldn't expect that, that they should use something that originally was intended as a convenience compulsorarily even though their email software does not require it, and that "ordinary users" should find anything other than a one ISP one mailbox configuration a complicated nightmarish chore to use, has ludicrous expectations.

I'm not a spammer. I don't look like a spammer. The DUL doesn't do a damn thing to prevent spamming. It prevents legitimate email only. It, and all the other idiotic spam filtering systems that have nothing to do with spam and everything to do with politics and half-arsed pretenses to make it look like the implementer is doing something about spam, should go.

Re:Incomplete!

[Frater 219]

I'm not a spammer. I don't look like a spammer. The DUL doesn't do a damn thing to prevent spamming. It prevents legitimate email only.

And I didn't defend the DUL as a DNSBL; I think it's one of the less useful ones that exist (partly because it is secretive being commercial). Your ISP's choice to list its dial-ups with the DUL -- or to filter port 25 -- however, is its decision, not the decision of "zealots" or "anti spam fanatics" -- and your problem is with the ISP, not with "spam filtering systems" in general. Whining about generalities never solves problems; addressing specifics does.

FWIW, if you do not understand the history of the DUL then you are probably not going to reason very effectively about it. The DUL was created to combat a particular sort of spammer abuse which was common at the time -- namely, using "throwaway" dial-up accounts to send spam directly to victims' MX hosts. That is no longer a particularly common spammer tactic (partly as a result of the DUL's actions at that time).

Today, however, there's still a common sort of spam abuse which comes from end-user ISP client networks -- namely spam through open proxies on client systems. We have open-proxy lists (such as Blitzed or the Monkeys.com list) which pick up new open-proxy addresses, but they aren't terribly adequate against dynamic addresses.

Preemptive methods

[LunarOne]

Simple, preemptive methods of fighting spam are often the best:

1. Don't let a spammer verify your email address
2. Don't post your email address on the internet
3. Secure your email client
4. Avoid common email traps
5. Fight back

Let me know if these can be improved.

Re:Preemptive methods

[robbyjo]

So... according to the webpage, the all the 5 tips are summarized as follows:

Please try the following:

• Click the Refresh button, or try again later.
• Open the www.thomsonville.com home page, and then look for links to the information you want.

Gee... many thanks Slashdot!

Re:Preemptive methods

[DeadSea]

You have no control of your email address. I only give my address that I use for personal correspondence to my family and closest friends. My father gave me a DVD rental for my Birthday, and on of my friends invited me to a party and used one of those web sites that do invitations. Between the two leaks, my address is now in the hands of spammers and I am getting 2 to 3 a day at that address. Short of beating my friends and family around the head, I don't think I can stop that sort of thing.

Not posting your address is important. If you you post your address on the internet, expect more than 10 spam a day. Similarly if you use it to post on usenet, expect more than that. It seems to be hardly sufficient, however.

I have decided that my only recourse is to change my address every time it starts getting spam. People that email me at an old address get a note saying why the address has been disabled and a url on my website where they can fill out a form to contact me. (btw, if you are interested, you can get the contact form that I use on my website, it is designed to thwart spammers, unlike formmail and other cgi to email gateways.)

Re:Preemptive methods

[robinjo]

Let me know if these can be improved.

Sure. Upgrade from that IIS to a better web server so that we can even read your suggestions.

Re:Preemptive methods

[artemis67]

I can't read your links because of a good slashdotting, but from what I see, your arguments are flawed.

1. Don't let a spammer verify your email address

This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.

Additionally, the extremely low cost of spamming means that bogus addresses are a marginal problem at best. The spammer would rather take a chance that the email account is active and send the spam than not send it.

2. Don't post your email address on the internet

I learned this lesson too late. A Google search pulled up a dozen newsgroup messages with my email address in them. Nine were posted by me, and I asked Google to remove them. Unfortunately, 3 are by other people quoting me, and I have no recourse to remove them. Spammers will therefore have permanent access to my main email address.

Additionally, I have no control over emails that other people send that include my address. I hate "pass along" emails that certain people get and feel the need to send to everyone in their address book, but I can't help that a) my email address is included in a batch of 50 others, and b) it's a very convenient way for spammers to collect verified email addresses.

3. Secure your email client

By this I assume you mean using client-level filtering. I do. Alot. I typically get about 60-80 pieces of spam a day, and have set up 30 or so filters. But that only catches about 2/3's.

Simply put, there is no client-level filtering solution that is going to work 100% of the time.

4. Avoid common email traps

I assume here that you mean things like "posting to newsgroups". You can only avoid traps that you already know about, and most people don't know about them.

Besides, why should we live in fear of the spammers? They are encroaching on our free expression. I certainly think that the structure of email needs to be revisited to put the prohibitions on the spammers, not the recipients.

Re:Preemptive methods

[Anonymous Coward]

Post your stuff on a web server (may I suggest apache or thttpd?) that can take some load, and maybe we could improve on them, not to mention read it.

Posting something to slashdot while running on IIS is to beg for trouble. In more than one way...

Re:Preemptive methods

[Neon Spiral Injector]

I have several domains, which I host myself. When ever a company asks for my e-mail address, it is always "company"@mydomain, if it is being passed through a 3rd party billing company, it is "billing"-"company"@mydomain.

This works well, if someone sells my address, I just kill that alias.

But what happens is some idiot I know in real life will do exactly what you said above. Or just add me to their address book, and get infected with some virus which starts sending stuff out with my address. Or what ever, my address slips out.

So I go and kick them in the head, tell them how stupid they are.

I also run SpamAssassin, which does catch a lot of the stuff, so for the most part my inbox is pretty bareable.

Re:Preemptive methods

[Dammital]

Between the two leaks [...] I am getting 2 to 3 a day

I opened a new account at bellsouth.net as a result of installing DSL at home, and was spammed the next day. Because my userid is four characters long, I presume that the spammers were using a permutation technique to develop addresses.

Sending spam is so cheap, they can afford to send stuff to *all* short email addresses, published or not.

You can guard against leaks in your best paranoid fashion -- but they'll find you.

Unfortunately, with so many government entities to deal with we will never have legal protection against spam. The low-lifes will simply move to more agreeable jurisdictions. Any long-term solution to the spam problem is therefore a technical issue. I predict that whitelists will become far more common in the next couple of years.

Re:Preemptive methods

[ryanvm]

You are correct that the methods you list are effective at fighting spam. However, effective does not mean practical.

For example, how does a site's webmaster (for instance - you) seperate legitimate mail from spam. Obviously because it has to be posted on the Internet, it's going to be deluged with spam. Yet it also must be read. So your failsafe rules for eliminating spam fall flat on their face.

The real solution to spam is upgrading SMTP to require authentication before accepting mail. Booting spammers (and later, enforcing anti-spam legislation) would be a lot easier if mail headers couldn't be forged.

Re:Preemptive methods

[Delos]

I agree. It only takes one leak, and then your on a CD with 10,000,000 addresses that all the spammers sell to each other. (And to me!) But I disagree with the spirit of your statement, "short of beating my friends and family around the head." Why shouldn't your family (and you) use your address in any cool, innovative manner that someone can design a web site around. An invitations site may not be revolutionary, but I think it's really cool. Pardon a lame paraphrasing of a tired idea, but if we stop using our email any way we like, the spammers have won. ;-)

Re:Preemptive methods

[fermion]

1. You should be reading email in plain text. Most of the HTML I get is advertisements. I figure if they are not smart enough to make it readable in plain text, they are not smart enough to get my bussiness. Do not enable auto confirmation.

2. I use an alias to post on the internet. I do not reply to emails I do not know as legitimate.

3. I believe he means do not have an open email relay. Must spam is sent through open third party mail servers. The spammers use these to hid.

4. I do not know what the other traps are either.

We should not live in fear of spammers. However, we routinely do things to minimize risks. For instance, many of us have unlisted phone numbers.

Re:Preemptive methods

[LunarOne]

You make good points. One thing, though: I have noticed practically zero spam coming to any of my webmaster email accounts, even thought the one you have mentioned has been in plain sight for years. Anyone else agree? Same goes for sales@xyzco.com, support@xyzco.com and the big no-no for spammers: abuse@xyzco.com

My theory is that spammers want to target individuals, and do not fear their reprisal. However, they have a low risk/return ratio with spamming sales@company.com . Such an email account can be a cashflow vein to a company, and spamming these accounts can bring upon the ire of an entire company.

Re:Preemptive methods

[Pig Hogger]

This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.

This is precisely why HTML e-mail is ***TRIPLE (secret probation) PLUS BAAAAAD***. Disable that HTML e-mail display bug^h^h^hfeature now!!!!!!

Re:Preemptive methods

[ciscoguy01]

Sad that we have come to this, though.
I have to hide my email from spammers, when I really want anyone who has anything to say to me to be able to use it.
Hopefully the blocklists will eventually make it impossible for an ISP to provide any services to spammers and stay in business. That is the real goal.
Then we can post our email addresses freely, and interact freely with each other. Now, we gotta hide out.
Ridiculous.

Re:Preemptive methods

[artemis67]

Switching to plain text is not the issue. Confirmation is a minor point to spammers, because the cost of sending emails to inactive addresses is negligible. So why inconvenience yourself by switching to text-only email? That's a lot of trouble for so little effect. If you hate HTML emails (as most of the respondents seem to), then that's something else entirely different. I don't hate HTML emails and I don't want to sacrifice HTML functionality. To me, that's killing a fly with an elephant gun.

My workaround is much simpler; I always select spam email as a block in my email client (because 99% are easy to spot without opening), and delete them without previewing.

Of course, the other means of verification for the spammer is the absence of a bounce-back message. A little less reliable, but as I say, I don't think the problem is that huge for the spammer.

Regarding the use of aliases on the internet, I concur; I have several email addresses set up for just that purpose. But guess what. Those aliases still receive the spam! So, you haven't really solved the problem, you've just moved it to an account which you check less frequently.

Ultimately, the SMTP server model needs to be rethought from the ground up.

Re:Preemptive methods

[sspenc]

A spammer doesn't need you to be careless with your email address, he/she only needs a database of names and nicknames and a bot to do a dictinary attack on your mail server. While being careful with your email address may help, it certainly will not stop the inflow of spam. No effort is fool-proof, but choosing email addresses that are less dictinary specific does help.

Re:Preemptive methods

[joshypooh]

lol

Re:Preemptive methods

[Phroggy]

This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.

I use Mozilla as my mail client, which is configured not to load images or execute scripts in HTML e-mail. If images are attached, they'll be displayed below the message (not inline), but images will not be loaded from a web server. If I really want to see the images in a particular piece of mail, I could always turn images back on, but I don't think I've had occasion to do this in several months.

Re:Preemptive methods

[orthogonal]

1. Don't let a spammer verify your email address

This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.

Using your firewall, prevent your email client from connecting to any addresses other than your mail servers.

You can still view HTML mail (if you are unfortunate enough to have correspondents who are too clueless to use HTML for mail); but any linked images just won't be downloaded. You'll still be able to click links to lauch your browser if you actualoly feel the need to.

Re:Preemptive methods

[DeadSea]

Pardon a lame paraphrasing of a tired idea, but if we stop using our email any way we like, the spammers have won. ;-)

For me the spammers won a long time ago if this is the standard you are using. I used to:

1. Put my email address on my web page so that people could contact me.
2. Post to news groups using a non-obfuscated address.
3. Think that I would have an email address forever--"You can always contact me at..."
4. Read my email without filtering it.
5. Look forward to the new mail sound.
6. Run an open mail relay.
7. Expect that emails I send would get to the person I sent them to without being filtered.

Re:Preemptive methods

[advid]

By this I assume you mean using client-level filtering. I do. Alot. I typically get about 60-80 pieces of spam a day, and have set up 30 or so filters. But that only catches about 2/3's.

Simply put, there is no client-level filtering solution that is going to work 100% of the time.

I recently started using Mozilla 1.3a, which includes Bayesian filtering for incoming email. So far, having only trained it for a few days, I'd estimate it's flagging around 95% of the spam I recieve. It got a few false positives in the first day or so I was using it - mostly on mailing list messages, but once I told it those weren't spam it's not had any problems since.

This doesn't solve the underlying problem of the spam clogging up the mailserver, but it does mean I don't have to deal with it.

Re:Preemptive methods

[Anonymous Coward]

Of course, the most effective way to avoid spam is to stop using e-mail.

Re:Preemptive methods

[artemis67]

This doesn't solve the underlying problem of the spam clogging up the mailserver, but it does mean I don't have to deal with it.

Do you trust it, though? When it flags incoming messages as spam and moves it to the trash (or the Junk Mail folder), do you feel secure enough that you can routinely trash them without scanning the subject lines?

No matter how good, client-level filtering is not a solution. All it takes is for one Really Important Email to get flagged and deleted to lose confidence in the system.

Re:Preemptive methods

[uncoolcentral]

If you've a domain and unlimited email addresses, you don't need to resort to shifty yet effective third party tactics (e.g. sneakemail) I provide a different email address for every online endeavor (amazon@uncoolcentral.com noodlestore@uncoolcentral.com etc.) and route all addresses to a catchall until they're spam compromised. The compromised addys are then forwarded to dev null. Works like a charm.

Re:Preemptive methods

[Anonymous Coward]

You have no control of your email address.

Ha! This shows how little you know about modern email technology. Here is my simple method for controlling my email address:

1. Select a 62 character domain name, composed of letters, numbers and hyphens.
2. Check that the domain name is available, but don't register it. [This step is crucial]
3. Generate a new mail account name for your domain every 14.3 minutes. The account name should be at least 20 characters long and be randomly generated.
4. Filter all mail through SPEWS, RBL, etc.
5. Filter through spam assassin.
6. Filter through at least two Bayesian filters.
7. Check all incoming mail against a white-list.
8. Discard anything with "hello" or "hi" in the subject line.
9. Require the sender to acknowledge a reply message before the account name changes again.
10. Issue rm /var/spool/mail/* before checking mail

I haven't had a bit of spam yet. Feel free to email me anytime.

Re:Preemptive methods

[Lulu of the Lotus-Ea]

> Don't post your email address on the internet

This bad advice has become a real pet peeve of mine. I guess because it is so absurd for me personally... but I share that trait with 90% of people who actually work for a living.

In particular, I am a writer, and publish on "the Internet." For example (in which I discuss the need for email disclosure along with spam filtering techniques):

http://www-106.ibm.com/developerworks/library/l-sp amf.html

In other words, it is my -business- to disclose my email address. Email is not, and should not be, restricted to a little clubby thing with your family and close friends. It is an important and legitimate purpose to allow previously unknown parties to contact you (individually, and relevantly, not as a generic member of a list of 14 million address). People sell things, we work on free software projects, we are interested in discussing topics of interest in our lives, and so on... strangers aren't -per se- spammers, and should not be treated as such automatically.

Re:Preemptive methods

[Miksa]

About the aliases. It's easy to disable an alias if it starts receiving more spam than valid mail.

Re:Preemptive methods

[Anonymous Coward]

My solution is to give out seperate email addresses and filter both on the address and the sender. If the address given does not match the sender, it is rejected. All mail from all accounts is forwarded (internally) to a master account.

Every merchant gets an email address that IDs it. My family gets an email address. My friends get an email address. People I work with get an email address. If I want to post to usenet, I can use a one time address (available for only a few days and then deleted). If I start getting spam in any accounts, I can just change them and notify a *small* number of people/companies. Or stop doing business with them, altogether.

This system is designed to be a permenant solution. I can change any address at will and spammers have no chance to adapt quickly enough. Of course, you need your own domain and a host to run the mailserver. And your email addresses cannot be on the http server, obviously (unless they are in picture format, something I'm playing around with in an email program I'm writing).

So far I have not gotten any spam in my own domain's accounts.

Re:Preemptive methods

[Anonymous Coward]

Give your friends an alias account. And your family. Keep the "root" account confidential and have all mail from all accounts forwarded to it. If you start getting spam from your friend/family account, then delete it, notify the members of the account and create friends2@yourdomain.com. It's pretty easy if you keep the group in a newsletter type list.

Re:Preemptive methods

[Anonymous Coward]

This does not mean that you need a naive way of providing it. An image containing your email address or a complex script which produces your email address will obscure your email address from bots but make it accessable to everyday users.

Re:Preemptive methods

[Anonymous Coward]

That's why god created Hotmail. Perfect to grab a disposable Mailbox. M$ is good for SOMETHING I suppose.

And if spammers are stupid enough to put a forms page on their site, it's a perfect opportunity to really FIGHT BACK...

I'm betting at least 80% of slashers here, know how to read in their forms page, pop it on some other server, substitute their OWN CGI in place of the spammers, add a "SPAM" button to the forms page, and a text field so they can enter 10,000,000, press the "Spam" button and let the CGI do it's dirty deed...

Your CGI could then control what it puts in the forms page, and send it 10,000,000 times to their server.

It "Does" take a little bit of work to get around the forms checkers, but it don't take long to satisfy the CGI.

So, for all you Perl or Pyhon hackers out there, this is a really good project....

Errr!!! I might want to put in a slight delay between submissions, we wouldn't want to DDOS their server, do we?

Re:Preemptive methods

[Anonymous Coward]

Yes, and once you gather this informaion, you now have legal grounds to sue the spammers and have a good chance to win, because they are violating your (and perhaps theirs) Privacy policy.

Just program your system to log all correspondance and try to get as much info from them (spammers) as you can.

Re:Preemptive methods

[Anonymous Coward]

I highly doubt if they resport to that... that tactic would make a lot of "noise" and be noticed, but I'm sure they scoot through PGP Key servers harvesting addresses, so let them.

I suspect having the ability to generate an unlimited number of valid Email addresses would be a really good tool to pollute their mailing lists with "honeypot" addresses.

Just make yourself about 10 - 20 Hotmail addresses. Use them for situations where you want to request things, and not have to give our your Real one.

Keeping track of them, you'll be able to quickly identify the spammers or organizations that "sell" your throw-away mailbox.

Imagine if everyone did that.... Of course that's highly unlikely....

Re:Preemptive methods

[silentbozo]

For me the spammers won when I had to install filters to use my e-mail. I still report the bastards, but it's nothing more than a formality now - the ISPs who care about spam have cracked down, and the ISPs who don't care about spam (and who are based in places like China, safe from effective retribution) just ignore your reports. The declining reliability of e-mail (directly and indirectly caused by spam and worms) is an equally bad, if not worse problem - short of re-engineering the SMTP protocols to let you know if your message has been sent and read, I'm not sure what we can do.

At least some of my reports contribute to weighting for IPs when they add new listings to the RBLs.

SPAM

[Anonymous Coward]

The PriceJester Vol. II Issue 365

Get 4 DVDs for 49 each!
Shipping & Processing ONLY $1.99 per DVD.

Click Here:
http://www.optilc.com/linkc/tue_a/go.php3?6 0

The Columbia House DVD Club is the Best Way to Build Your DVD Collection.
Check Out Today's Best Sellers like Training Day, Sherk, Gladiator
and many more! Join Now and You Can...

More Details:
http://www.optilc.com/linkc/tue_a/go.php 3?60

Cancel your subscription here:
http://sbase30.com/central/unsub.php?uni=YO UR_EMAI L_ADDRESS_HERE

-----------

How do you like reading this spam? If you were us ing the RBL, this would have been blocked.

Re:SPAM

[mschoolbus]

You gotta respect the "unsubscribe" email addresses. Just when you were pissed off enough at the original spam, then you send an unsubscribe email to the provided address and suddenly you have another unread message, "Message undeliverable"...

Re:SPAM

[linuxelf]

Oh, it's far worse than just "Message Undeliverable" What you've done by clicking on the Unsubscribe link is basically tell the spammer "So, the email address you sent that spam to, well it's valid. And not only is there actually a person at that address, but it's the kind of person who would actually read your spam.."

Re:SPAM

[inode_buddha]

Here's the part that really pisses me off:
"You are receiving this email because you opted in to receive special offers from (xyz.com) through one of our marketing partners...."

Exactly. I might have done business with one of your "marketing partners" in the past. That doesn't mean I'm interested in doing it with you, or any of the other "marketing partners". Usually, I can find what I'm looking for without any marketing assistance, thank you.

RBLs in Spamassassin

[reaper20]

My spamassassin-tagged mail usually scores between 1 and 1.5 ( a 5 is needed for a **SPAM** tag) - which in the grand scheme of things seems to be enough of a weigh for the value of an RBL. Don't absolutely trust it's value, but don't ignore it completely either.

I don't really see why anyone would use RBLs just by themselves. Personally, I have spamassassin catching the "big spams", you know the ones with webbugs, html-only, forged headers, etc. etc. I occasionally tag those as junk in my Mozilla Mail, while tagging my normal mail as not-junk. The Bayesian filter takes care of the occasionally sneaky spam. Once trained it's an awesome combination.

Re:RBLs in Spamassassin

[spacefight]

I don't really see why anyone would use RBLs just by themselves.

That is easy. While spamassasin does the work pretty good - you still have to download the whole crapload. RBL enabled MTAs won't accept any email as soon as a blacklisted IP wants to connect. This saves bandwith, disk space, client side filtering (read: cpu time) and so on.

Re:RBLs in Spamassassin

[tyagiUK]

Absolutely. I have a GNU/Linux (Debian) system at home which uses Fetchmail to pop emails off my ISP account. Fetchmail delivers to Postfix for local delivery. Postfix calls Procmail as part of its configuration. Procmail first pipes incoming mails through Spamassassin. If Spamassassin decides that the mail is suspect, it is placed in to a "caughtspam" mbox for later examination/deletion.

The postfix config is a basic:
mailbox_command = procmail -a "$EXTENSION"

The procmail config is as simple as:
:0fw
| spamassassin

:0:
* ^X-Spam-Status: Yes
caughtspam

This has cut down my personal time spent on processing emails by many many times. OK, so it's not exactly the most computationally cheap method of filtering spam, but the box isn't doing anything else particularly important and CPU cycles are cheap.

All I now need to do is go through the "caughtspam" mbox every now and again (nicely managed using Mutt) and double-check whether anything has slipped through. Only one email has been badly marked by Spamassassin and that was due to the sender incorporating lots of spam phrases in the email.

Evil stuff

[KingDaveRa]

I do really hope something can be done about the most persistant of spammers - how many penis extensions have I been offered now? The stuff that comes through the letter box annoys me much less, but its essentially the same thing. Maybe public floggings by all those affected by Spam should be inflicted on those who send this stuff out. God I hate this stuff.

Re:Evil stuff

[jazir1979]

I dunno .. a doctorate of theology from some non-accredited university could always come in handy. Perhaps then you would be at peace, with or without the penis extension(s) :) mmm spam.

what he missed...

[erc]

Quite a bit, actually. This reads like a topical treatment by someone who really doesn't know the subject. For example he mentions whitelisting, but in the solutions section, completely ignoring the fact that there are already solutions, both commercial and open source, that use whitelisting, blacklisting, and greylisting. In fact, I wrote one about 6 months ago for a client, and they are quite happy about it, it affords them complete spam protection.

Re:what he missed...

[Russ Nelson]

I agree with you that Phil Whirlycott doesn't understand DNSBLs very well.

But shouldn't your URL be http://www.escarpade.org ? :-)
-russ

Published?

[Flamesplash]

Is this "published" just because he put it up on his website and told people about it, or will it actually be published in a journal somewhere?

Re:Published?

[Anonymous Coward]

It is published (note the lack of quotes), since he put it on the web.

Information you see on the web is published work.

It hasn't gone thhrougha rigorous peer review process, but then again, we thought we had element 118 for two years also.

Journals are just as suspect as the web.

Re:Published?

[Flamesplash]

Journals are just as suspect as the web.

I realy have to disagree with this. I could "publish" the statement 'poop is healthy to eat because after eating some I got over a sickness' but that would never get published in a medical journal of any type without substantial medical inquiry to back it up.

No one can prevent you from making false scientific claims on your website, and while they may pop up from time to time in journals they are fairly rare.

-shane

Re:Published?

[F452]

Is this "published" just because he put it up on his website and told people about it, or will it actually be published in a journal somewhere?

Yes, putting something on the web constitutes publication.

Now whether it is of value is another matter altogether, and something you have to evaluate for any published material, whether on the web, in a journal, or elsewhere.

Whiner...

[DaGoodBoy]

My company was collateral damage on SPEWS last month and I kicked the *^&^#$* out of our ISP for hosting Global Travel on our netblock. They got booted and we got cleaned off the list. Bada-bing bada boom.

RBL's are like a fever. They tell you when something it wrong and only a dork blames the fever when the problem is the disease. Get your ISP to whack the spammer or change ISP's.

http://groups.google.com/groups?threadm=Fc6K9.2625 2%24Db4.726975%40twister.tampabay.rr.com

Re:Whiner...

[catman]

Great :-)

Your excellent analogy reminds me of the observation that anti-spammers are parts of the immune system of Internet e-mail.

RBLs would not be necessary if ISPs read and handled spam complaints. Those relatively few ISPs that do not handle the spam problem responsibly must be given a fever to make them realize that they have an infection. Or is that infestation :-)

Re:Whiner...

[minas-beede]

In your case it worked out. If you had simply been asked to persuade your ISP to boot the spammer would you have ignored the request? Are you actually so dense that it takes blocking your email to get you to act?

Note that I'm not trying to claim you are dense or prove it - my point is that you could have been reached in a way that led to the same result but that DID NOT block your valid email. Is there any reason why the brutal method should be the one chosen first? Uh, any good reason - surely there are thugs who enjoy using their power to abuse others.

Not to mention that there's been more than one case in NANAE where the collateral damage was suffered by someone related to an ISP that had long ago booted the spammer but had not removed all traces. No spam flowed because of the omission, the listing was long after the spammer was removed, no risk to anyone existed. Still, the IP of an innocent party was wrongly listed, wrongly blocked, much time and energy was spent discussing it in NANAE, a person and organization that could perhaps have become spam opponents were given reason to hate the guts of spam fighters. No win of any kind I can see in that.

And, of course, the brutal blocking actions haven't ended spam, other than the occasional anecdotal victory. I ran an open relay honeypot, I saw how modern bulk spammers operate. The DNSBLs are a weak tool to deal with that. Don't take my word for it: run your own open relay honeypot. You'll quickly learn a lot about how spammers operate. All the while you'll be stopping their spam, too. Open proxy honeypot? Bless you - you'll also do wonders.

(Any of you sendmail experts able to figure out my pseudonym?)

Re:Whiner...

[melonman]

RBL's are like a fever. They tell you when something it wrong and only a dork blames the fever when the problem is the disease.

It's not like any fever I've come across. For the analogy to hold, when I'm ill my entire village would get a fever, and some of the population might die, in the hope that the sound of the ambulances and funerals might alert me to the fact that I have a problem.

I'm glad you are so happy about having your reputation threatened when you have done nothing wrong. Our business is hosting websites on our own machines in a server park. Server parks are always going to be a good place for spammers to rent cheap machines, and if our clients start getting their mails bounced, they don't write to the server park owners, they cancel their contracts with us. And, no, we can't just take our servers elsewhere at 3 minutes' notice, so the RBL puts zero economic pressure on our server park (which seems to act fairly promptly on abuse compaints anyway).

RBLs punish the innocent to get at the guilty. This is wrong. The next time my business is hit by SPEWS or any other such system, I'm going to start writing pithy articles for the general press, with the aim of scaring customers away from ISPs that use RBLs, eg "Do you want your ISP to tell you what email you can read?. And I shall certainly take legal advice on whether I can sue companies who bounce my mail with any rejection message containing the word 'spam' for libel or something similar.

Re:Whiner...

[Steve B]

And I shall certainly take legal advice on whether I can sue companies who bounce my mail with any rejection message containing the word 'spam' for libel or something similar.

Are you also taking legal advice on whether you can sue the /. posters who post a reply containing the word 'idiot' for libel or something similar?

Re:Whiner...

[Tadghe]

"And I shall certainly take legal advice on whether I can sue companies who bounce my mail with any rejection message..."

Ok hotshot, I've just added cyberporte.co.uk to our local RBL list and taken the liberty of posting a link (with a C&C warning) to your post on NANAE. Would you like the address of our attorney now....

This tactic has been tried several times before. There is no right to deliver (or even connect to) our or anyone else's systems. we can (and will :) reject you with any message, or none at all, at our choosing.

If you decide to read abit more you'll find that most RBL rejection messages refer to you a page, or site that is usually pretty explict in telling you why your netblock or address range has been rejected.

oh, and for the record, we make sure our users are aware that we use RBL's. Currently we have (including yours) 549 netblocks listed in our local RBL list, that's not including the 12519 that we have SPEWS blocking at the firewall... I'm not counting the 6 country wide netblocks that are banned.

The argument "Do you want your ISP to tell you what email you can read?" is sure to carry a hell of a lot of weight with joe internet user who's tired of all the MMF/Porn/Junk spam he's getting these days.

If there were any decent ways to block spam without resorting to the netblock method, We would gladly use it, but given the past attempts at such methods, I just don't see it happening.

Re:Whiner...

[melonman]

Are you also taking legal advice on whether you can sue the /. posters who post a reply containing the word 'idiot' for libel or something similar?

No, because none of our customers read /. :-)

Re:Whiner...

[Anonymous Coward]

"Ok hotshot, I've just added cyberporte.co.uk to our local RBL list and taken the liberty of posting a link (with a C&C warning) to your post on NANAE. Would you like the address of our attorney now...."

See it's the responsible blocks based on merit such as these that show the positive uses of various filtering technologies. Many think that some sysadmins are of the vendictive spiteful sort apt to enact rage and furious anger through some pitiful display of the systems under their control. The preceeding post dispells this myth entirley.

pm

Re:Whiner...

[melonman]

Ok hotshot, I've just added cyberporte.co.uk to our local RBL list and taken the liberty of posting a link (with a C&C warning) to your post on NANAE. Would you like the address of our attorney now....

This is great, you've just demonstrated that RBLs are not neutral, and are driven more by a desire to punish than to solve the problem. If I ever need to send an email from that domain, I'll use one of our other smtp servers, or that of one of my ISPs, or rent a clean one, or... the problem last time was that I didn't know how ineffective RBLs are. The one thing I'm not going to do is change my server park because someone on the other side of the world is on a quixotic crusade. It's not my battle, and I object to people trying to enlist me.

Why your netblock or address range has been rejected.

In our case, it is because one machine in our 16-bit IP range had been used for spam, so SPEWS blocked 65,000 machines, each of which is administered by a different person/company. How does jeopardising the existence of my company, whose smtp server is clean, help to fight against spam? Like I said, we can't just pick up a fairly full server and take it somewhere else, so there is no real economic pressure on the server park.

Joe Internet user is tired of spam

See n previous /. discussions about this, but the (statistically) average email address gets about 3 a day. Quite a lot of /.ers say they get very few spams, and many of those who do say that the annoyance value is pretty low. On the other hand, if you are trying to buy a skyscraper (real example) and you can't get emails from the estate agent, who happens to be in a different continent, that is extremely annoying, especially if there is absolutely no reason for blocking that particular server.

Any decent way to block spam

Err, if netblock is such a greeeeat system, how come spam is increasing? Am I missing something? If there is a consensus that spam is a major problem, legislate against it. I don't have a problem with that. I do have a problem with what mrneutron calls 'collateral damage', ie people damaging my reputation to get at someone else, especially when the system obviously isn't reducing the amount of spam sent globally.

Re:Whiner...

[Anonymous Coward]

That was my thought as well. Sigh.

This is great, you've just demonstrated that RBLs are not neutral, and are driven more by a desire to punish than to solve the problem.

Re:Whiner...

[ciscoguy01]

You said:
In our case, it is because one machine in our 16-bit IP range had been used for spam, so SPEWS blocked 65,000 machines, each of which is administered by a different person/company.

That is to get you up off your butt and call the hosting company and scream bloody murder at them.
As a customer you should have way more influence on them than the victims of the spam sent from the machine at their facility.
The system works.

Re:Whiner...

[melonman]

That is to get you up off your butt and call the hosting company and scream bloody murder at them.

I know what the idea is, I just don't think that it is a fair way to proceed. If you have a problem with my server park sys admin, feel free to scream at him, don't threaten me in order to get me to do your work for you! In ethical terms, it's the same logic that says that kidnapping children to put pressure on the parents is a really neat idea.

The system works

I hate to sound slow, but why is spam increasing? Is it that the system doesn't work, or that so few people use it?

Re:Whiner...

[Just Some Guy]

I'd mentioned this in response to another thread, but it's still true.

I live in a small Midwest town. There is exactly one viable option for Internet access: a small DSL/wireless ISP. If that ISP were blocked by SPEWS and I subsequently lose the ability to contact some of my customers via email, I can yell at said ISP all I want - but that's my only recourse. I don't have the possibility of switching, short of going with one of those "$6.95 per month unlimited dialup!" companies.

Where's my ISP's pressure to enforce anti-SPAM policies? They're the only game in town and they know it.

Fortunately, they seem to be as intolerant of SPAM as any other network company, and their customer service is great. That's good, because I'm effectively stuck with them.

Re:Whiner...

[AndroidCat]

I just don't think that it is a fair way to proceed.

Ask me if I care.

Re:Whiner...

[ciscoguy01]

If you are a customer you have horsepower with the company that is hosting the spammers. I have no such horsepower. I am just another complaint.
If your mail is not being delivered because of activities at your ISP, you can do many things:
1. you can obtain oursourced SMTP for your use and deduct it from your bill.
2. you can move elsewhere.
3. you can sue your hosting company and make them address it.
I can't do any of those things.

Why is spam increasing?
Spam is increasing because spam is increasing.
Spammers have said in nanae that they have to send out 10x as much to get the same amount delivered as they did 2 years ago. That is because of DNSBLs.
They have to work harder. Lots harder.

As a test I would propose the three main blocklists (SPEWS, SBL, ORDB) disable their lookups for 24 hours.
Assuming you have 150 spams a day now, and you get 3000 that day, well, that would be illustrative, wouldn't it?
A wake up call.

Re:Whiner...

[Tadghe]

> This is great, you've just demonstrated that RBLs are not
> neutral,and
> are driven more by a desire to punish than to solve the problem.

No, I demonstrated our desire not to recieve email from people waving C&C threats. Care to take back that threat of suing anyone who blocks you and maybe helping find a better solution instead bitching and moaning about how unfair DNSRBL's are? I'm all for a better solution (as are most people).

> The one thing I'm not going to do is change my server park because
> someone on the other side of the world is on a quixotic crusade.
> It's not my battle, and I object to people trying to enlist me.

Nobody said you had to, but if your ISP chooses to host spammers, then you'll have to deal with the issues of getting blocked. An analogy would be living in a apartment where the landlord lets drug dealers live next to you. You don't have to move, but you can't really complain about the police cars parked outside either. Again, it's not an ideal solution, but we'll stick with it until a better one exists that:

1. Doesn't increase my server costs (e.g content filtering overhead)
2. Doesn't increase my bandwidth costs (e.g some whitelisting techniques)
3. Doesn't increase the overhead of administration (We spend enough time keeping the bad guys out now thank you)
4. Catches as much SPAM as DNSRBl's.

> See n previous /. discussions about this, but the (statistically)
> average email address gets about 3 a day.

Great, now multiple that 3 by the number of users.. for example take a clients 11000 users, multiple that by 3...33000 messages, assume a average size of 10K-20K and suddenly I'm looking at around half a gig in bandwidth....

> Err, if netblock is such a greeeeat system, how come spam is
> increasing?

I never said, nor implied that netblocks are a good way to block spam, what I did imply is that they are at the moment, the most cost effective way for an ISP or company to block spam.

Re:Whiner...

[melonman]

I don't need to. All the discussions I have had on this subject suggest to me that the people in favour of this sort of solution really aren't worried about preserving other people's rights at all.

Re:Whiner...

[melonman]

Care to take back that threat of suing anyone who blocks you

See my last posting, or just show me where I said that in the first place. The point on which I would attack is the content of the rejection message, not the fact that the address is blocked. The difference between me and a spammer is that I can demonstrate that any rejection message associating our server with spam is false, and I can quote this very thread to show how damaging this allegation can be :-)

Better solutions

Sue the spammers, like AOL, or, if everyone really feels so strongly about the issue, as you claim, change the law.

Drug dealers living next door

If the police start harassing me or telling all the other neighbours that I am a drug dealer, I think you will find that the law is my friend. But, in any case, you are assuming that my server park is a den of iniquity. You have an IP address, check it out. How bad is their record? No-one can stop the first spam being sent, and, as far as I can tell, we spent a week answering angry emails from our clients because the sys admin at the server park went fishing for a couple of days.

Re:Whiner...

[melonman]

I can't do any of those things either when the problem is transient and the server park is basically clean. If I was hosted by Verio I could understand it, but anyone offering an smtp server to third parties can get caught from time to time.

OK, so spammers have to work 10x harder. How many times more cost and time effective is their set-up? As long as there is a margin in spam, people will continue to spam. The fact that spam is increasing suggests that it still pays. At what point are blocklists going to stop spam paying? I have a hunch that the answer is 'never'.

Turning off the blocklists would indeed be interesting, but, unless the spammers are completely stupid, I wouldn't expect it to have much immediate effect at all. Do they really continue to send to blocked addresses, long term?

Re:Whiner...

[Desert Raven]

All the discussions I have had on this subject suggest to me that the people in favour of this sort of solution really aren't worried about preserving other people's rights at all.

And what rights are those?

Sorry to bust your bubble, but nobody has a right to connect to my mailserver. Not even my customers. In their case, I have a contractual obligation to them to provide the service, but it's still not a right.

I use DNS Blacklists, both public, and my own private list. On the very few occasions (two in three years) that it has impacted my clients, I have whitelisted certain addresses. These lists don't stop everything, buy they do bring the spam load down to manageable proportions.

There's only one standard list I absolutely refuse to use, and that's SpamCop's DNSBL. His methodology is so fundamentally flawed it should be a case-study in stupidity.

Re:Whiner...

[theLOUDroom]

In your case it worked out. If you had simply been asked to persuade your ISP to boot the spammer would you have ignored the request? Are you actually so dense that it takes blocking your email to get you to act?

Dense?
Why are you even mentioning the word dense?
He was a friggin customer! His email being blocked was the first indication he had that a spammer was hosted by his isp.
So what next? He asks his isp to boot the spammer. If they refuse, he doesn't want to have an acount with them anyways, so he'll go somewhere else. Seems fine to me.

It's hardly "brutal" anyways. The email bounces, it doesn't just disappear and leave him wondering why no one ever replies.

Finally, if the isp is only partially fixing a spam problem, after booting the spammer, then they're incompetent and you don't want to be working with them anyways. The ip you complain was "wrongly blacklisted" was actually rightly blacklisted. It just wasn't removed from the list, because someone wasn't doing their job.

If an isp gets a notification that an ip has been added to a blacklist, isn't it obvious that they should contact the maintainer of that blacklist when the problem is fixed? The fault in your example does not lie with the blacklist, but with the isp. If you choose a crappy isp, expect problems.

Re:Whiner...

[ciscoguy01]

You Said:
>OK, so spammers have to work 10x harder.

The war on spam, which the DNSBLs are a tool is about increasing the cost of spam. Making spammers work harder, keep opening new accounts, and changing ISPs is the strategy.

>As long as there is a margin in spam, people will continue to spam. The fact that spam is increasing suggests that it still pays. At what point are blocklists going to stop spam paying? I have a hunch that the answer is 'never'.

You may be right!

>Turning off the blocklists would indeed be interesting, but, unless the spammers are completely stupid, I wouldn't expect it to have much immediate effect at all. Do they really continue to send to blocked addresses, long term?

Yes, they almost never have valid return addresses so they never know whether the mail gets there or not. The just have stats based on hits on sites and web bugs in html mail. So the answer is yes, they do send long term to blocked addresses.
There were some stats on that, how much actual spam was being blocked by spews, for example.

Re:Whiner...

[Erik Fish]

Not to mention that there's been more than one case in NANAE where the collateral damage was suffered by someone related to an ISP that had long ago booted the spammer but had not removed all traces.

That's life in the big city. Most of the time this happens when an ISP thinks that it's good enough to just remove the web site but still host DNS or mail for the spammer. This is called "spam support services" and is a no-no. Even on the rare occasion when it's something like IP addresses still showing up as being allocated to the spammer, how is anyone outside the ISP supposed to know that the spammer is no longer a customer? So many ISPs come to NANAE begging to be delisted when they have done literally nothing about their blatant spam problems that why should the one out of ten that is simply incompetent be given special consideration?

And, of course, the brutal blocking actions haven't ended spam

Oh somebody call a waaaaam-bulance. Free clue: Nothing will end spam. Even if e-mail becomes metered you will still get spam -- it will just come from the people who send you paper junk mail instead of Alan Ralsky.

Re:Whiner...

[minas-beede]

"...how is anyone outside the ISP supposed to know that the spammer is no longer a customer?"

If you can't tell is there a problem? And you appear to claim a dead DNS entry does something - what I can't imagine.

"Free clue: Nothing will end spam."

Check with me in April. spam probably won't be gone by then but it might be "spitting up blood in the morning." Do you have some notion I propose sitting meekly and doing nothing? Hah! that's been the central policy for years, for relay spam (the one that hurts the most.) I propose NOT sitting meekly, doing nothing. Patting yourself on the back for what a clever sysadmin you are for bouncing all relay email doesn't end spam. Look at the history - it hasn't.

You want to end spam? Then end spam. The internet is awash in relay test messages and relay spam and you can't see how to stop that?

Spammer sends a test message to a bunch of IPs.
A few IPs deliver the test message.
Spammer concludes those IPs are open relays, spammer sends relay spam to them (now, often through open proxies.)

If YOU would deliver his test messages then he'd send the relay spam to YOU for delivery. Well? Would you deliver the spam or wouldn't you?

This is not idle theory. Right now the spammer is in charge. When will YOU be in charge, when will YOU control whether or not relay spam gets delivered? Not all, but some - others can control the rest. (I do assume you would NOT deliver the spam - that's all it takes, once you have control of it. Getting control is ridiculously easy.)

My home honeypot is pretty feeble. It's trapping spam only from the cursed Hinet spammer in Taiwan, spam directed to recipients in Taiwan. Only 665 messages since 12/20, only 6274 recipients. Others do far better - see how you can do. It did pick up some today - busiest day yet.

Here's his latest test message. It didn't even get delivered but the idiot sends spam anyway:

Message data for C0A87BB3-B80A025 (from 218.147.98.232)

250 OK
Mail from:china9988@21cn.com
250 Sender china9988@21cn.com OK
RCPT to:china9988@21cn.com
250 Recipient china9988@21cn.com OK
Data

(I had to remove the angle brackets around the addresses for them to display.)

Message:

Received: from 1217-vkztw12ofn by homebrad (ESMTP Sendmail V8); Tue 31 Dec 2002 03:03:35 GMT
From: china9988@21cn.com
Subject: 66.222.28.6
To: china9988@21cn.com
Date: Tue, 31 Dec 2002 11:55:39 +0900
X-Priority: 3
X-Library: Indy 8.0.25

t_Smtp.LocalIP

Google on china9988 - you'll see it is a known test message dropbox.

The above from Jackpot's web-page spam report.

http://jackpot.uk.net/

Obviously what you trap depends on which spammer tests your IP. Note that if they figure you out and stop testing that is still a win, particularly if they leave your whole IP block alone because of one honeypot.

Re:Whiner...

[Dun Malg]

the people in favour of this sort of solution really aren't worried about preserving other people's rights at all.

Oh, now I see your problem. You seem to think people have a basic right to unfettered email. Sorry to say, friend, but access to my inbox isn't a right. ISPs provide a service. If your customers' ISPs use an RBL, and part of your ISP's IP address range gets blocked, then that's a business matter you need to take up with your ISP, or your customer needs to take up with his. The Internet isn't a public works program. Hell, it's not even really a fully definable entity; its basic common denominator is a few communications protocols.

Don't cheapen real rights by trying to lump crap like "the right to send email to my business clients". The Internet is an amalgamation of commercial enterprises, for the most part. If you don't like it, petition your government to create a happy-socialist public network where there's no spam and no blocked IPs. Otherwise, get over it.

Re:Whiner...

[Erik Fish]

If you can't tell is there a problem? And you appear to claim a dead DNS entry does something - what I can't imagine.

I know this may be hard to imagine, but some ISPs actively collaborate with spammers. They switch their spammers around to different IP blocks, pretend to cancel their accounts and play tricks with the DNS. If an ISP is going to claim that a spammer is no longer their customer there needs to be no trace of the spammer on the ISPs machines that is visible to the outside world or there are going to be questions raised as to the veracity of the claim. This is not a difficult thing to arrange for an ISP that has really, truly and fully booted a spammer.

Check with me in April. spam probably won't be gone by then

Isn't that what I just wrote?

bouncing all relay email doesn't end spam. Look at the history - it hasn't.

Neither does (or has) honeypots. The real open relays will always outnumber the fake ones. Honeypots also do nothing against spamhauses. Who needs open relays when there are plenty of cash strapped ISPs willing to sell connectivity to spammers for a quick buck?

That honeypot of yours is cute, but the 6000 user ISP I work for has blocked almost 4000 messages today thanks to SPEWS and other blocklists. If you want evidence just check out how many spammers there are crying their eyes out in NANAE because of SPEWS.

Re:Whiner...

[Anonymous Coward]

Which part of "local" don't you understand? He is adding you to a private list used on his network; his network, his rules. He did not say that he was adding you to a list used by the world at large.

SPEWS didn't list you because one machine was used for spam; they listed you because complaints were not acted on decisively and expeditiously.

A blocking list will not reduce spam unless you use it. I want my provider to block known spam sources; I don't really care whether that affects your e-mail. If you don't feel that the lists are worthwhile, then don't use them, but those that do want to use them on their own networks have every right in the world do do so, regardless of your kvetching.

Re:Whiner...

[minas-beede]

"Check with me in April. spam probably won't be gone by then"

"Isn't that what I just wrote?"

You left off the "coughing up blood in the morning" part.

"That honeypot of yours is cute, but the 6000 user ISP I work for has blocked almost 4000 messages today thanks to SPEWS and other blocklists. If you want evidence just check out how many spammers there are crying their eyes out in NANAE because of SPEWS."

"Cute" isn't a bad word at all for mine - it is a nice effort but not tremendously meaningful in the battle. OTHER HONEYPOTS TRAP FAR MORE SPAM. Unless I run the honeypot I do not and can not know how much spam would come to it - I have to do the experiment.

I won't look at NANAE to see how many spammers are crying out their eyes but when I did read NANAE the spammers were few and far between - it was the collateral damage victims causing most of the threads. If it's gotten better since then then hooray for SPEWS.

You can stop 4000 spam messages FOR YOUR users. I stopped millions of spam messages for AOL, hotmail, and huge numbers of other ISPs with my prototype honeypot, at work. Michael Tokarev stopped millions of spam messages FOR OTHER ISPs with his Moscow honeypot. It should be clear that if a honeypot stops spam that would be blocked by a DNSBL at its destination it hasn't done much. You prepared to tell me that AOL has successfully blocked spam the last three years? Your DNSBLs all have to have external data to identify spam. The honeypot identifies spam simply: if it comes to it it is spam (in the preferred, non-server implementation.) Collateral damage, false posiives? Not with a honeypot. Get the ISP to throw off the spammer? Three ISPs in one weekend nuked off Ralsky on the basis of honeypot reports.

By all means use SPEWS. Don't ask everybody to wait forever for SPEWS to work. Don't ask me to wait, either. I see how spammers can be hit hard at the relay level - a level that up to now they've been able to command with ease (nobody did anything.) Spam survives - all the techniques used up to now haven't been enough. Take away the relay level and watch spam die.

1 million cute honeypots would do it. Right now there's probably 20 to 30 honeypots (some people run multiple honeypots.) 999,980 to go. It's not like that's hard.

I know of a honeypot with a truly incredible number of stopped spam messages but the owner wants me to reveal neither his location nor his count. I'm sure you would not believe me if I told you the number stopped (since February.)

The internet is awash in spammer relay test messages and in relay spam - some spam may make three or more hops before reaching the destination, multiplying the bandwidth used. The chances are excellent that more than one spammer is attempting to give you the opportunity to trap his spam (although HE doesn't see things that way.) Up to now most people have passed on that opportunity. Let's watch and see how that goes in 2003 - I'm telling people that they can, often on their simnple home systems (with cable or DSL connections) actively trap spam aimed at others. Trap enough and the spammers will quit. (Yes, I know that first they'll send more. Eventually they will quit.)

Re:Whiner...

[JoeBuck]

In many areas there is only one available ISP for high-speed net access (DSL or cable). What happens when this ISP gets on a popular RBL? Do you sell your house and move?

But there are alternative ISPs selling DSL service in your area, you say. Not for long, thanks to people like Michael Powell at the FCC (who want to take away the rules requiring your phone company to provide access to competitors).

Re:Whiner...

[Anonymous Coward]

No, not DNSBL's (I'm being trademark-conscious). Just SPEWS. SPEWS does what you describe - other DNSBLs don't. (Irony here) Don't blame all DNSBLs for the misdeeds of one.

Re:Whiner...

[Anonymous Coward]

SPEWS doesn't start by blocking /16's, but I suspect you knew that already. In general, it seems they start with small blocks (sometimes even a single IP). If the spam continues, the block size slowly grows. Postmaster@ & abuse@ pretty much have to be aliased to the toaster to get a block expanded to a /16. Pat your ISP on the back.

If you actually know of someone so damned stupid that they would trust a skyscraper-sized transaction to something as inherently unreliable as email, you should probably distance yourself from that person. There's a reason why 911 doesn't travel via email.

Re:Whiner...

[grbyrd]

I'm glad you like it, but do other users? Has anybody asked them what they think of RBL's? Would they understand it if you did ask? What if they found that they were losing mail due to RBL listings? Legitimate ones? Emails they consider important?

Re:Whiner...

[grbyrd]

And SPEWS is damned sure gonna keep it that unreliable.

Re:Whiner...

[Anonymous Coward]

You wrote.....

>See n previous /. discussions about this, but the (statistically) average email address gets about 3 a day.

Dream on dude! only 3 per day? What part of heaven are YOU from?

I think it's more like 100 per day....

Re:Whiner...

[SacredNaCl]

I want my provider to block known spam sources; I don't really care whether that affects your e-mail. If you don't feel that the lists are worthwhile, then don't use them, but those that do want to use them on their own networks have every right in the world do do so, regardless of your kvetching.

I want my provider to block *spam* and only *spam*. Blocking 50,000 or 1.5 billion users (as a few of them do) from being able to send us email is not protecting us from the 150 or so spammers targeting us. It's keeping us from being able to communicate with a large chunk of the world.

It's very frustrating to find out your legit email is not getting through, and even more frustrating to learn (usually a substantial time later..sometimes not at all!) that mail sent to you is not getting through. As much as I hate spam, RBL's are a very poor solution.

This is a rotten situation. You can't send a mail to someone because you aren't on their whitelist, or you can't send a mail to someone because your netblock is listed on some list completely unrelated to you, you work in sales and mention "We can finance that for you, we get some great interest rates through XXX bank" and your mail gets flagged spam by some ISP's content filter, or you can't recieve it for any of the above.

It's petty, and it's making email useless for all. So instead of destroying email -- let us start to work on a new mail transfer protocol that can avoid most of these problems. Get a working solution, get the specs out, make it temporarily backwards compatible with existing systems, and have a hard switch date for the change to the new system. Maybe a period of 2 years to impliment the switch. They are doing it for IPV6, why can't we do it for email?

Re:Whiner...

[melonman]

Making spammers work harder, keep opening new accounts, and changing ISPs is the strategy.

Yeah, I get that bit. So the result is that big ISPs won't touch them, which is good, and that they end up in server parks next door to me, which is inevitable, and that SPEWS blocks my mail because of my (very occasional) neighours, which is absurd. According to most of the people posting on the thread, the aim appears to get me to keep changing ISPs to put pressure on the ISPs. Except that my ISP has a pretty good reputation to start with, so where would they like me to go next? Verio? No server park can stop people renting a machine and spamming like mad until they get shut down. If they start spamming on Thanksgiving, it could take several days to shut them down.

I don't have a problem with blocking addresses. We have blocked one or two ourselves (to avoid getting several thousand copies of various viruses a day rather than to block spam). I don't have a problem with blocking IP ranges when all those IP addresses are administered by one company. I do have a big problem with blocking IP ranges when, to all intents and purposes, the IP addresses have nothing to do with each other. As far as I can tell, the only solution would be for me to take my server out of a park, lease a big pipe and buy my own IP range, which I can't afford to do at the moment.

[RBLs will never stop spam being profitable] you may be right!

So we've reached dynamic equilibrium. The spammers will keep wandering around the server parks, and my mail will keep getting blocked, in order to not deal with the problem of spam, and if I complain about the damage this does to my business it makes me slightly less popular than Osama Bin Laden. I'm glad this makes sense to someone.

Spammers keep spamming blocked addresses

So there goes another argument. If they keep spamming blocked addresses, RBLs don't reduce backbone bandwidth usage either.

Re:Whiner...

[silentbozo]

So there goes another argument. If they keep spamming blocked addresses, RBLs don't reduce backbone bandwidth usage either.

I would argue that as an incorrect interpretation. The spammer must not only successfully attempt to connect to the target ISP's box, they must be able to mail the text of the entire message. RBLs deny the spammer the ability to mail the text at worst (cutting down the amount of crap that needs to be accepted), and at best totally deny the spammer the ability to connect at all.

Thus, they can still try to send to blocked or bad addresses, but because the delivery handshake is refused, the message isn't sent, and backbone bandwidth is conserved.

Now, the above assumes that the ISP actually blocks based upon an RBL (ie, deny connection or delivery) - if they accept the connection and just filter (ie, tag the received message), then yes, your criticism would be valid, as no bandwidth would have been conserved.

Re:Whiner...

[melonman]

Oh, now I see your problem. You seem to think people have a basic right to unfettered email.

Err no, I'm with you on this one. It's a business matter, and ISPs who block addresses for no good reason will end up losing customers. That's why the guy who is blocking me for threatening legal action (which I didn't, but there you go) hasn't the guts to block all .fr sites, despite the French government's landmark case against Yahoo. It's the logic of the school yard bully: you pick on the little guys and polish the shoes of the big guys.

The rights I was talking about concern what ISPs say about me to third parties, and I maintain that the content of a rejection message is subject to the same law as any other written communication. So block away, but please make sure the rejection message is factually accurate.

Re:Whiner...

[minas-beede]

"Yes, they almost never have valid return addresses so they never know whether the mail gets there or not. The just have stats based on hits on sites and web bugs in html mail. So the answer is yes, they do send long term to blocked addresses. There were some stats on that, how much actual spam was being blocked by spews, for example."

Don't forget that two different things are done by SPEWS and that the argument is over only one of these. Blocking spam is something SPEWS does well - may they continue to do so as long as needed. Blocking non-spam to pressure non-spammers to do something (SPEWS apologists aren't crystal-clear in their explanation of this) is abusive and wrong-headed. The impression I have is that they have perhaps done only a few hundred such blockings in their history, making essentially no progress in fighting spam. They have made many innocent users associated with the blocked IPs associated aware of SPEWS. Awareness could be good, but the majority of those made aware now hate SPEWS, and, by extension, all DNSBLs and all anti-spammers. OK, maybe not all of either but the actions and attitude of SPEWS and its backers pisses off real, normal people.

For other than huge ISPs most could block most of the net and cause little problem. If there's no email coming from all those blocked IPs then the blocks do nothing that stops spam. They don't hurt, don't help - are immaterial. Add to that lunatics who take the complaints of legitimate mailers as signs that blocking aimed at non-spam sources is having a good effect and you have a rotten situation. It would be seemly for the SPEWS blockers who claim that the customers of the ISP have more clout to actually test that claim and document their results. My suspicion is that a spam-tolerant ISP is not measurably more affected by complaints from customers than from non-customers. They know what they are doing and intend to continue. Harrassing their non-spamming customers does not end spam and diverts effort away from something that might have an effect into something that doesn't. Add to this the apparent frequent occurrence of SPEWS targeting ISPs who are not spam-tolerant but who have, by error (and the perfidy of spammers) gotten a spammer in their space and you have SPEWS grandly attacking targets that are not in any way the main source of the spam problem. In addition, Doesn't SPEWS, when it takes on a large ISP such as Verio, only list non-spam-source IPS in some subset of the blocks belonging to that ISP? Weird.

When the popular press discusses SPEWS and states that what SPEWS is doing is wrong it appears that the SPEWS apologists take the attitude "screw the popular press." Last time I looked in NANAE that's how it was, at least. That is not going to win SPEWS any friends (not any worth having, at least), is not going to win DNSBLs any friends (look at this thread), not going to win anti-spammers any friends.

The solution is for SPEWS to stop listing IPs of non-spam sources. They probably won't soon embrace that situation. Until they do they will receive well-deserved criticism and contempt. It's clear that SPEWS, during it's more than one year of existence, has not stopped spam. They don't have a highly-successful track record to point to as evidence that they are correct - they just sit quiet and let people weave lies about how effective SPEWS is. I'd like to flat-out decree that no one ever again use the good results SPEWS achieves by blocking spam sources to justify the blocking of non-spam sources. The decree won't work - SPEWS apologists will continue to pop up with that illogical defense - there's apparently no way to get them to use logic instead of emotion.

I'd also like to decree that those who block only for their own email not cite their perfect satisfaction as sufficient grounds for ISPs with large numbers of customers using SPEWS. It is two different situations - you are free to screw with your own email any way you please - why not? That this works for you has no bearing on whether it is good for an ISP to inflict SPEWS on its customers. The LOGICAL thing to come out of satisfaction with SPEWS for single-user IPs is to say SPEWS should be used only by single-user IPs. THEN if an important email message is blocked because of the SPEWS policy of listing non-spam source IPs the one suffering the consequences will be the one who decided to use SPEWS. That's just.

(SPEWS-supporters who delude themselves into thinking they've said something smart by responding that "SPEWS doesn't block anyone, SPEWS only lists" are welcome to do so. The issue is that of valid email blocked because some ISP used SPEWS. Your cute little objection doesn't speak to the issue - it's just noise.)

Not true

[Anonymous Coward]

There was this woman who spammed and made a living out of selling anti-spam services. A bit like the mob, really.

She doesn't really on people clicking through - all she needs is to drive up the irritation factor.

EFF said it better

[Lumpish Scholar]

whirlycott's article points to the Electronic Freedom Foundation's Public Interest Position on Junk Email (Google cache), which begins:

Executive Summary: Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

For the past several years, the Electronic Frontier Foundation (EFF) has watched with great interest the debate regarding what to do about unsolicited bulk email from strangers, or spam. We have been asked to lend our support to bills that have been introduced in Congress, and we have been approached in various other ways to help lead the fight against this annoying intrusion into people's email mailboxes.

While members of the EFF staff and board find this unsolicited email to be as annoying as everyone else, we believe that the two most popular strategies for combatting it so far--legislation and anti-spam blacklists--have failed in their fundamental design. Anti-spam bills have been badly written, are unconstitutionally overbroad, and frequently wander into areas where legislators have no expertise, such as the establishment of Internet standards. And anti-spam blacklists, such as the MAPS RBL (Mail Abuse Prevention System Realtime Blackhole List, the most popular), result in a large number of Internet service providers (ISPs) surreptitiously blocking large amounts of non-spam from innocent people. This is because they block all email from entire IP address blocks--even from entire nations. This is done with no notice to the users, who do not even know that their mail is not being delivered.

The focus of efforts to stop spam should include protecting end users and should not only consider stopping spammers at all costs. Specifically, any measure for stopping spam must ensure that all non-spam messages reach their intended recipients. Proposed solutions that do not fulfill these minimal goals are themselves a form of Internet abuse and are a direct assault on the health, growth, openness and liberty of the Internet.

Email is protected speech. There is a fundamental free speech right to be able to send and receive messages, regardless of medium. Unless that right is being abused by a particular individual, that individual must not be restricted. It is unacceptable, then, for anti-spam policies to limit legitimate rights to send or receive email. To the extent that an anti-spam proposal, whether legal or technical, results in such casualties, that proposal is unacceptable.

Re:EFF said it better

[Zeinfeld]

Executive Summary: Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

The problem with the vast majority of psuedo-solutions to spam is that the promoters simply will not listen to any ideas other than the one they first thought of and they simply won't listen to people who point out that blocking good mail is a serious problem.

The 'cry me a river' response is as idiotic as it is arrogant. SPAM is a problem, failure to deliver email is a bigger problem.

That does not mean that we don't address the problem of SPAM, it just means that we have to approach the problem from both ends, identifying the good signal as well as eliminating the bad.

The MIT conference is likely to be a failure because the organizers are only presenting the tried and failed filtering approaches of the past. Those approaches are now well understood, they can mitigate the problem but can never do more than that. Filters suffer from reverse network effects, the more widely used they are the greater the incentive to program arround them.

Blacklists fail for many reasons, not least complete lack of accountability. As the paper reports the operator of one blacklist that claimed to only list open relays actually listed sites for other reasons. Ultimately a blacklist that does not have some robust accountability structure is simply a vigilante operation. Vigilantes are frequently popular with people who think they are victims of crime regardless of whether they create more problems than they solve.

The tools we need to start applying are digital signatures and email authentication in combination with whitelists. This follows sound business process, if you want to talk to someone well known their secretary will use a two step process, first ask who you are and check to see if you match the access criteria (e.g. to set up a cold call meeting with a Fortune 100 CEO you had better be a Fortune 500 CEO), then check to see if you really are who you claim to be.

Authentication and Authorization requires no heuristics and there is no feasible counter-strategy for the spammers.

I believe that the way to stop spam in the long term is to deploy signed email ubiquitously. Self signed certificates are sufficient for this purpose if we can provide a lightweight authentication via a DNS-linked PKI.

For example consider the problem of stopping spam to email lists. These are a prime target for spammers as the email server does most of the work. As a result most email lists are now filtered so that only subscribed readers can post. This has in turn been gamed by the spammers who use automated tools to scan the archives of an email list and send emails with forged headers purporting to come from another subscriber. Authentication and authorization prevents this mode of attack.

The counter-argument to using authentication is that the spammers can get their own credentials. If you spend some time analysing SPAM however you will find out that this is unlikely. Almost every spam has forged or obscured headers. While this does not prove that this is a requirement it is certainly indicative of the fact that the spamers do not want this type of visibility.

Even if a spammer can get a credential they are most unlikely to get a credential that would match my personal whitelist which would consist of the signing keys of the email lists I subscribe to and the domain names of the member companies of W3C and OASIS.

Re:EFF said it better

[F452]

The MIT conference is likely to be a failure because the organizers are only presenting the tried and failed filtering approaches of the past. Those approaches are now well understood, they can mitigate the problem but can never do more than that. Filters suffer from reverse network effects, the more widely used they are the greater the incentive to program arround them.

I think they will talk a lot about using Bayes, which I don't think has been widely tried with respect to email filtering.

Spammers are already trying work arounds to get past statistical filtering, but I don't know if they'll be as successful.

Spam with images? They'll have to embed them in html which is itself a red flag.

Like Paul Graham said in that article, the spammers can't hide their message very well.

Re:EFF said it better

[Zeinfeld]

I think they will talk a lot about using Bayes, which I don't think has been widely tried with respect to email filtering.

It does not matter what content inspection approach you try. They all suffer from the fact that as the number of people who have access to your filter grows so does the incentive to test against the filter and shape their content to get through.

There is an exact analogy here to email viruses. The virus writers are constantly counter-gaming the scanners. The only reason the system works is that writing a virus is a relatively high cost, low incentive operation and the virus fingerprints are updated in realtime.

The solution to the virus problem is not better virus detection. The solution is email clients that do not blindly execute active content.

Re:EFF said it better

[fermion]

This is well though out, but I have a few comments.

First, Spam is, to an extent, protected speech. Therefore, if you are going to raise the specter of protected speech, then you damn well better have a narrow enough definition of Spam to insure that it is clearly illegal speech. Without this, there is no way to stop it. For instance, telemarketers have a right to call you. You have a right to hang up. The telephone company does not have a right to filter. You have a right to prosecute.

Second, a black list, if properly implemented, can bypass some of these concerns. For instance, if one works from a standard TOS, and a provider violates that TOS, then they can be blacklisted. The problem with this is that it resembles vigilantism, and is very open to abuse. Also, customers that will be affected must be notified and given a chance to adjust. Several months ago speakeasy.org changed their blacklist and did not notify customers. Neither did they respond to complaints. That is just bad customer service and wrong.

Finally, the case that all email must get through is silly. The post office does not deliver every letter. Your answering machine does not guarantee delivery of a message. No web hosting guarantees 100% uptime. We can't even define what a piece of spam is. If we could, we would just prosecute the offenders legal like.

What, in reality, exists, is stuff we want and stuff we don't want. We have pretty much solved this in the mail and telephone situation not only because these are more mature than email, but also because they cost real money and are controlled by a few institutions. We still get stuff we don't want. Most of our mail is junk, and most of my phone calls are junk, but it is manageable. What we need are personal filters and general regulations.

Re:EFF said it better

[F452]

It does not matter what content inspection approach you try. They all suffer from the fact that as the number of people who have access to your filter grows so does the incentive to test against the filter and shape their content to get through.

But they don't have access to my filter. My filter is unique with regard to the messages I've labeled as "good" or "bad."

I'm not saying that Bayesian filtering is the ultimate solution, but if widely deployed and used it could be harmful enough to spammers to reduce their activity.

Re:EFF said it better

[KC7GR]

The EFF was quoted as saying...

"Email is protected speech. There is a fundamental free speech right to be able to send and receive messages, regardless of medium."

Actually, no. That's only partly correct. It would be fully correct if the Internet, and its associated E-mail functionality, were a true "public" resource, with free access for all funded by federal income taxes. However, such is not the case.

While it is true that the act of writing E-mail is indeed protected speech, sending E-mail is a PRIVILEGE, not a right, just like a driver's license. There is (rightfully so) no law or any legal requirement for the admin/owner/operator of any E-mail system to accept any traffic that they do not wish to.

Why? Because the vast majority of the 'net-connected servers are PRIVATELY owned and operated. This is a critical point that all too many people, both admins and end users, are either unaware of or choose to forget.

"Unless that right is being abused by a particular individual, that individual must not be restricted. It is unacceptable, then, for anti-spam policies to limit legitimate rights to send or receive email."

There they go again. Until the EFF gets it through their head that the ability to E-mail is not a "right," they're just going to loop themselves into an endless argument.

If someone is paying monthly fees to an ISP that has a high spammer population along with legitimate customers, and the ISP is doing nothing about their spammers, then that someone is supporting (indirectly) abuse of other people's 'net resources.

Also, I have a challenge for the EFF or anyone else. Show me an ISP service contract which GUARANTEES 100% E-mail delivery to ANY host under ANY conditions, AND the ISP that actually manages to pull it off.

No? I didn't think so.

"To the extent that an anti-spam proposal, whether legal or technical, results in such casualties, that proposal is unacceptable."

And what would be more "acceptable" to the EFF? No functional E-mail at all? Because that's exactly what we'd get, in very short order, if all the current blocklist providers were to simply shut down, as the EFF seems to want.

Come to think of it, there might be an idea. Have SPEWS, Spamhaus/ROKSO, etc. all stop operations for just one or two days. I would wager that the resultant vast increase in spam load would be an excellent example of what would happen if we were to believe the EFF.

I may have agreed with them on other issues, but this position of theirs that E-mail is a "right" won't hold water. Neither will their stance on blocklists.

Perhaps I should just forward all the spam I get to their feedback address? ;-)

Re:EFF said it better

[markwelch]

> Executive Summary: Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients. <

Sorry, but NO. This is great in theory, but the problem is that spam shifts all costs to the victim, and the victim cannot be forced to accept unlimited costs for creation of a complex system that insures due process and appeals.

My personal mail server receives many THOUSANDS of mail delivery attempts per day, all of which come to me (or nobody). Approximately 98% of these are spam, and more than 90% are forged in multiple ways (fake headers, fake server names, invalid return addresses, and frequently forged to show MY server name as the sender).

A week ago, I turned off my server-side filtering and collected several hundred spam emails in about an hour, before re-activating the filtering.

I spend approximately 15 minutes per day managing my spam filters (mostly adding new IP addresses and domains to the filters). Whenever I skip this management for a few days, my incoming spam volume rises substantially (in other words, if I don't close the door, dozens of spams per day come into my email client through some of the doors I didn't close).

Other people have irrational filters, too. AT&T, for example, has blocked all email that contains "markwelch" as part of the source address (hence all email from my servers is refused). I'm not sure why -- it might be because I've send hundreds of spam complaints to ATT.com, or it might be because so much spam has been forged with my domain name faked as the sender ("joe jobs"). But I don't dispute AT&T's right to do this, nor do I demand that AT&T provide me with a response or explanation or oppportunity to be heard. It sucks, but responding to spam is a triage activity, you must skip over some of the complex problems and try to manage the ones you know you can.

I do not currently use any third-party RBL or listing service; I manage my own filters. It's expensive and annoying, but I do this so that I can manage the process of filtering so that I don't constantly block my friends who are stuck with ISPs who are on some other blocklists.

I periodically post my complete filter list at: http://www.MarkWelch.com/Welch_Filters.htm so that people who can't reach me, can check to see if their IP address or domain has been blocked on my end.

Re:EFF said it better

[Dimensio]

Here's my problem with the EFF's position.

If an ISP like QWest or Sprint is going to be openly friendly to spammers, then I'm going to consider ANY traffic from them to be noise that needs to be filtered. As far as I'm concerned, I don't want ANYTHING that comes from their network because they've proven that they are either apathetic or openly supportive of criminal activity committed by their customers (Qwest has been observed supporting criminal activity from their customers, and it wouldn't surprise me if Sprint has done the same). As such, there isn't any legitimate e-mail coming from them in the first place, so blocking all messages from their domain doesn't strike me as a bad idea.

Re:EFF said it better

[Erik Fish]

Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

This is what is stopping me from donating to the EFF. They do a lot of good work, however this is a ridiculous position that refuses to acknowledge the realities of the situation. E-mail is and has been from the very beginning an unreliable way of sending information. With this paper the EFF is taking the position that anyone with an e-mail address is required to recieve anything sent to it. Because after all, even speech from someone abusing their right could stop at any time! So we'd better not try to block them because they might realize the error of their ways and send an apology and if it couldn't get through then we would be evil oppressors of free speech!

Re:EFF said it better

[Dimensio]

Therefore, if you are going to raise the specter of protected speech, then you damn well better have a narrow enough definition of Spam to insure that it is clearly illegal speech.

How about "it shall be illegal to send unsolicited advertising where the cost is shifted upon nonconsenting third parties." That would cover...pretty much all spam.

The telephone company does not have a right to filter.

The telephone company cannot filter because of their 'common carrier' status. It means that they must allow all traffic through regardless of content. Individual ISPs, however, are not common carriers and as such they are not subject to such rules. This means that they get to put up whatever filters they want, and it is all legal (as it should be, since it is their equipment).

Re:EFF said it better

[Anonymous Coward]

If an ISP like QWest or Sprint is going to be openly friendly to spammers, then I'm going to consider ANY traffic from them to be noise that needs to be filtered. As far as I'm concerned, I don't want ANYTHING that comes from their network

Hey, if it is your own private little mail server, that is fine. If you are an admin at my ISP, I wouldn't be happy if you are setting up that filter for everyone. If you are configuring the filters for a company, you'd better check with the boss about blocking any and all customers from Sprint and QWest.

And this noise about "criminal activity" isn't helping the conversation. If it were criminal activity, we could call the cops.

Call your congresscritter and ask for anti-spam laws!

Re:EFF said it better

[Dimensio]

Don't tell me that you haven't heard stories of law enforcement from local PD to the FBI ignoring small-time crack jobs when someone reports a system compromise. Those are cases where decidedly illegal actvitiy has taken place and law enforcement has decided that it's not worth pursuing.

Re:EFF said it better

[Anonymous Coward]

Vigilantes *also* tend to be popular in times and places where governments either cannot or will not do anything about crime.

Clearly, spam is a Denial-of-Service attack. That's a felony, a Federal crime in the US. Laws exist to deal with this crime.

So, somebody explain to me why Alan Ralsky, Tommie Cowles, et al, walking around free? The government locked up a harmless kid, Kevin Mitnick, for three and a half years without charging him with a crime. Why aren't Ralsky and Cowles sharing a six-by-eight-foot cell with half a dozen members of the Rolling Sixties Crips?

Re:EFF said it better

[cmacb]

I don't agree that blocking email is a free speech issue quite so much as the EFF statement implies, on the other hand I reject totally that it is my responsibility as a consumer to make sure that my ISP is not either (a) hosting other users that SPAM, or (b) using a black hole list that keeps me from getting legitimate email.

I know for a fact that I have had legitimate messages that I sent blocked, and I know for a fact that I have had legitimate messages sent to me that were blocked. I know this from phone conversations and ICQ messages etc. I have no way to independantly verify WHO was responsible for the blockage. So being an "informed consumer" in this case is practically impossible. Changing ISPs every few weeks as they drift onto and off of the various block list is not practical either.

If the cost of stopping spam is to make use of email a hit-or-miss proposition then I would much rather have the spam. I understand that other people have a different opinion about this. All the more reason to put spam blockage in the hands of the end user where it can be most effectively managed. That is, at least until changes to the SMTP protocol make anonymous spam harder to initiate. At that point, enforcable laws, ISP penalties, and per-piece mail charges will work wonders. *Pretending* to solve the problem will only delay real solutions.

Re:EFF said it better

[Anonymous Coward]

You wrote:

The MIT conference is likely to be a failure because the organizers are only presenting the tried and failed filtering approaches of the past. Those approaches are now well understood, they can mitigate the problem but can never do more than that. Filters suffer from reverse network effects, the more widely used they are the greater the incentive to program arround them.

Actually, that's not entirely true. The MIT Conference is a lot broader then dealing with the Filtering issues.

This is the first time a number of really key anti-spam people will be in one place.

Re:EFF said it better

[Anonymous Coward]

Actually, I'm getting better then expected results. I remember before I started using it, I started collecting a lot of spam to learn how to classify them. I found some really interesting things... I find that if I use my HUGE corpus of spam and ham, I'm only getting 80% (which is really not that good).

But I found out, that with a week of training, it gets it right about 95% of the time.

Then, as time goes on (because the spammers change tactics), it gets less accurate, so I've worked it out so only the last 2 weeks of corpus is used. Now I'm getting constant results, regardless of how the spammer's change. And this is good enough for me.

Re:EFF said it better

[Erik Fish]

I have no way to independantly verify WHO was responsible for the blockage. So being an "informed consumer" in this case is practically impossible. Changing ISPs every few weeks as they drift onto and off of the various block list is not practical either.

If you care that much then get your own domain and run your own mail server. Otherwise get used to the fact that unless you can trust your ISP you'll never know for sure what's going on -- with your e-mail or anything else. A few months ago there was a three or four day period when my cable modem was dropping off the network promptly at 1:00 in the morning every day and coming back up after 10 minutes to half an hour of downtime. When I called the support line after the third time it happened (open 24 hours, incredibly enough) they said they had no idea what it could be. My suspicion is that someone somewhere was performing some kind of maintenance but nobody had bothered to tell the support department. Granted this is pretty minor stuff, but it illustrates my point.

On the internet your connectivity is always going to be in the hands of someone else. You can either buy some fiber and become a player who can negotiate (and re-negotiate if necesary) or you can continue to use consumer level services with the features and drawbacks that most consumers are comfortable with.

As for my opinion on end-user software for spam "blocking" (which by that point is really just spam deletion) my journal says it all.

Oh cry me a river

[portwojc]

It's funny. First it was the spammer networks complaining about getting blocked. Now it's the customers on those networks complaining.

Here's an immediate answer to the problem. Change to an ISP that can control their network better. There are more ISPs out there than you can shake a stick at. Find one that actually cares. Now every ISP will have a spammer on it but alls it takes is a staff who cares to get the problem solved.

However good article. I personally don't agree with bouncing email - tagging it is far better like with using SpamAssassin.

RBLs however are a necessary evil since some networks are willing to allow spamming (or aren't capable of fixing the problem). There has to be some way to identify those networks who aren't playing nice.

Re:Oh cry me a river

[Anonymous Coward]

This isn't really true in most western countries that provide some sort of high speed access (DSL, cable). Your choices dwindle to 2 or 3, tops in major metropolitan areas if you want high speed.

There are more ISPs out there than you can shake a stick at. Find one that actually cares.

Re:Oh cry me a river

[Anonymous Coward]

Here's an immediate answer to the problem. Change to an ISP that can control their network better. There are more ISPs out there than you can shake a stick at. Find one that actually cares. Now every ISP will have a spammer on it but alls it takes is a staff who cares to get the problem solved.

Im currently affected by this since my companys ISPs mail server is on the SPEWS list. This is because a client just registered a domain at my ISP, and then used the SMTP server for spam there. This is something you can't prevent, since the client first paid his bills, and he could use the mail servers then. Of course he got booted by the ISP, but the damage is already done, and now the server is on the list and getting from it isnt so easy. The admins are currently trying to get off the list, but that seems to be a real problem. So all that currently happens is that a lot of innocent customers are affected by this. And you have this problem with every ISP which hosts a lot of domains. And changing ISPs is not a solution for this problem since it isnt really the fault of the ISP.

Re:Oh cry me a river

[Erik Fish]

To become so widely blocked your ISP had to ignore complaints. Acting slowly is most definitely their fault. If the spamming customer paid his bills first so they were "forced" to allow him to continue spamming it is still their fault for not having a proper acceptable use policy. There is no reason why their policies can't give them the leeway to kick off any customer found to be spamming at any time without a refund. Some ISPs even charge a cleanup fee.

Open Relays

[Znork]

The section on open relays I find rather odd. An 'open' relay is a relay that accepts mail from anyone to anyone, something which is an extremely bad habit. This guy starts arguing it's necessary to have open relays to deliver mail for some unspecified reason. It's not. You relay mail to legitimate adresses behind your mail relay, and you relay mail from legitimate adresses behind your mail relay and you dont relay to anyone else. Then you dont have an open relay. There is no way there's any technical reason to relay from anyone on the outside to anyone else on the outside, ever.

Has he completely missed that point?

Oh, well. If I'm to replace RBL type filtering with another anti-spam mechanism, there's only one I'd consider. That one is going complete pre-mail opt-in, in which case he's far more screwed than he is today. Live with the trouble of RBL's and get your ISP to do the right thing, or get a far, far more draconian solution.

Re:Open Relays

[andyveitch]

Agree. And Space Corps Directive 2505, sorry RFC2505 says you shouldn't run open relays, he gets round this by citing obsolete RFCs.

I didn't think this was a very good article. Unsubscribe me.

Re:Open Relays

[operagost]

The only situation I can think of is one where the SMTP server in place must run an old version of the software for compatibility or licensing reasons. In that case, one could probably still manage access via stateful packet inspection, although the cost outlay there would probably outweigh any savings gained by maintaining an obsolete SMTP server.

There are surprisingly recent OSes that stil can't limit relaying to specific hosts; it's all (open) or nothing (closed). One example: OpenVMS. Until TCPIP v5.1 last year, it didn't have this capability. Of course, the excellent third-party Multinet has for some time.

Re:Open Relays

[stephenbooth]

Has he completely missed that point?

I'd have to say, yes.

Personally I use Spamcop's RBL and reporting service. I check the held mail page a couple of times a day. I have yet to see a legitimate mail be blocked and it's reduced the number of spams a day I get from hundreds to 2 or 3.

Maybe some RBLs still work the way the author decribes but from what I'm hearing that's not the way many work now. Now it's more like a reporting user recieves a spam (hopefully very near the start of the spamming run) and reports it. The reporting system works out the most probable source and lists it (due to the fact that spoammers often move within a netblock the netblock rather than the individual IP address has to be blocked for the RBL to be effective), the system also mails the admin address for the appropriate domain (and any listed interested third parties) with the information required to identify the spammer and asks them to deal with them. That IP address is also monitored by the RBL. When the spammer stops sending spam or the administrator informs the RBL operator that they've dealt with the problem the netblock is taken off the RBL.

If the mail system administrator are on the ball and not asleep at the switch there's no reason why the total time from a netblock being entered into an RBL to being removed need be more than a couple of hours. If they're crap at their job or beligerant then they don't deserve honest customers.

The complaints made by the author of this paper are very reminisent of some of those I've seen on antispam/pro-RBL mailing lists from spammers who've had their spams stopped by RBLs. Draw your own conclusions, but I'm inclined to go with "If it looks liek a duck, it quacks like a duck nd tastes great with plum sauce...".

Stephen

Re:Open Relays

[dubl-u]

There are surprisingly recent OSes that stil can't limit relaying to specific hosts; it's all (open) or nothing (closed).

If an OS is not secure enough to be put on the big, bad, internet, it should be put behind one that is. Obsolete and/or deficient software is a reason for firewalls and proxies, not for being a menace to the network.

Re:Open Relays

[deanatav8net]

RFC 2505 is a BCP (best common practice). Best common practices are "common practice". It is not a binding standard. It went through with very little comment. Also, RFC 821 is not obsolete. There are reasons where open relays are necessary. Not every email-using entity is a residential dialup user, with a single ISP for both sending and receiving email. SMTP AUTH isn't standardized, isn't widely supported, and looks dead. This is why ISP's refuse to close open relays. The spammer is the source of spam. No one else. The spammer can send via their ISP's relay, directly, or via an open relay. The only way to stop the spammer is to remove the spammer's connection, and the only entity that can do that is the spammer's ISP. There is a huge amount of mis-information spread about open relays. Open relays can be protected from spammer abuse (volume, message signature, and scanning activity detected before use) just like closed relays. Perhaps better than closed relays. Open relays don't hide the spammers identity. Open relays don't prevent anyone from blocking spam. One should be looking at the Received headers, which cannot be forged _after_ the spammer sends the email. So the spammer source IP address is _always_ in the message. Message signatures can detect when the source IP address changes. Blocking this way allows one to block spam regardless of whether it is sent directly, through a closed relay, or through an open relay. It also avoids collateral damage caused by blocking a relay. This is a good thing, unless it is your goal to cause collateral damage, in which case I have no sympathy for you. Also, bonafide commercial spammers aren't the ones abusing open relays. Mostly KLEZ viruses and such abuse open relays. KLEZ is already illegal (it is a crime to break into a computer with a virus in the US). KLEZ is run by script kiddies whose goal is to harrass someone. Its already illegal in most cases, if anyone cared to organize the effort to track them down.

Re:Open Relays

[minas-beede]

Right on - RFC 2505 gives good advice on not running an open relay. You, in general, do not want to be running an open rely.

RFC 2505 also says (many overlook this) that securing open relays is not the approach to use if you want to end spam. Why? Because the spammers will continue to find open relays, so even securing 99% of the servers won't stop spam. As has been the case.

There's a third reason to relay a message, if you wish to stop spam: relay the spammer's message sent to test to see if you relay. Give him the answer: "Yes, I relay." Prove it: relay his test.

Then don't relay anything else for him.

Up to now most people haven't acted this way. the result has been, as can be seen on reflection, that all the relay spam goes to systems that will relay it. Well heck, is that what you want? Sure a surprise to me if you do. In general you don't know where the open relay is, you don't know how to contact the operator, you can't get him to understand the problem and change, you are frustrated. That's because the wrong guy is in charge of the relay that gets the spam. If you were in charge it wouldn't be delivered, would it? Think of how powerful it would feel to be able to stop a batch of relay spam dead. Think of a spammer burning a whole weekend, sending spam to your dead-end relay. That is BOFH-time. BOFH-time for a good cause is quality time - give yourself that.

So. Get in charge. Set up a system that delivers the spammers' test messages and nothing else. (By the way, there's people that pop up almost every time this is said who reply that the spammers will spam themselves, see non-delivery, and drop the relay. Do the experiment and see. I can promise you neither that they will nor that they won't. You can find out. I'd be very keen to hear.) It's cheap, it's easy, you may seen something in the trapped spam that lets you really wallop the spammer, you will have a much better current picture of how spammers spam. It's very likely you'll see the relay spam coming from open proxies. spammers can run a whole chain of these, making it hard to see where they are in IP space. One of those proxies will get the connection direct from the spammer - that proxy can see where the spammer is. Open proxy honeypots are in their infancy - you can get in on the ground floor now, if you hurry.

For Windows users (and others with a JVM):

http://jackpot.uk.net/

Re:Open Relays

[deanatav8net]

I know that Spamcop has blocked Declan McCullagh's politech mailing list several times, in revenge against Rackspace.com. Only bad press has made them stop. Their blocks have had no effect on Rackspace. They have only created bad press.

Spamcop is just as bad as the others. However, it seems the users of such lists always think the list they are using isn't irresponsible. They often stop using the list when they learn of its irresponsibility. However, for some reason, this doesn't seem to motivate the blacklists to act responsibly.

Re:Open Relays

[djmurdoch]

I know that Spamcop has blocked Declan McCullagh's politech mailing list several times, in revenge against Rackspace.com. Only bad press has made them stop. Their blocks have had no effect on Rackspace. They have only created bad press.

I think the last time Politechbot.com was blocked was in November, when Spamcop was introducing a new listing policy to target "round-robin" spammers. These spammers buy a block of IP addresses, and spam from each of them in turn, switching away from one when it gets blacklisted. Spamcop started listing the whole /24 block when it saw evidence that a large proportion of the IPs had been used for spamming. Unfortunately, politechbot.com shares a /24 with enough spammers that it got caught in the crossfire.

Once that happened, Spamcop refined the rules to make listing of a whole /24 harder. Since then I don't think politechbot.com has been listed.

There are other cases (e.g. spamex.com) where the current policy doesn't work either. In this case, there's a spammer doing round-robin spamming in a /27 that's near spamex's IP; currently Spamcop isn't flexible enough to block a /27.

Re:Open Relays

[Skapare]

The open relay obscures the ability to block spam. It's either all permitted or all denied based on IP address. Some selection can be made by sender email address. But then, the open relay operator could filter on that, too.

Open relays impose added costs on recipients to filter out the spam. And this is done by the open relay operator to lower his costs. And that's one of the reasons I block open relays. But I do whitelist individual senders, so they can still use the open relay. I block them at SMTP MAIL FROM, not at the router.

The spammer can send via their ISP's relay, directly, or via an open relay. The only way to stop the spammer is to remove the spammer's connection, and the only entity that can do that is the spammer's ISP.

You repeatedly make pointless statements like that. Not all ISPs are willing to remove the spammer's connection. Of course we block those ISPs that do that. But because the spammer can get around it through open relays and open proxies, those get blocked, too.

There are reasons where open relays are necessary.

I've still not seen any specific reason for an open relay that isn't shot down by there being shown a way to do it without an open relay. I can't say there isn't one, but I've just never seen one, despite your repeated statement. But I am at least certain that if one is found, it represents and extremely rare circumstance. In any case, if you must run an open relay, be it for some obscure technical reason, or just laziness, then don't run any other customers through it. And don't make threats against those who choose to not accept it. Then those who prefer to block only the open relays and not the whole network of the operator, can do so. It's the threats that I believe have resulted in most of the blocking of your entire net.

And BTW, any mail from wherever it cannot be delivered in a legitimate way, I consider not to be legitimate mail. So I wouldn't be losing any legitimate mail by blocking an open relay used only for such obscure cases. Whether anything else gets lost is up to you.

Re:Open Relays

[Skapare]

The blocking of Rackspace.com is not revenge blocking. It is simply being blocked because Rackspace.com is not doing its part in being a member of a spam-free network community. By being blocked, it is thus cut off from the spam-free network community. It can go on sending to the spammy network community all it wants.

Re:Open Relays

[minas-beede]

Ah, Rackspace. The only ISP to ever telephone ME to lie about taking action against a spammer I reported. That's not something you forget.

Now that I think of it, they may be the only ISP that ever telephoned ME for any reason. Doesn't it seem right for alarm bells to go off in your head when an ISP telephones to report something other ISPs report by email? It did for me - I made the same spammer complaint to Rackspace's upstream when they got off the phone. Whether anything happened as a result I don't know...

There's been some indication Rackspace has been cleaning up but if they aren't clean yet (I don't know myself) then that indication doesn't correspond to what is.

Re:Open Relays

[Skapare]

Rackspace is the ISP that has called me three times to try to sell me service, even though my phone number has been listed with the Texas No Call list for months. But they aren't the only one to call me. Comindico called me all the way from Australia to try to threaten me for blocking them because of spam. Their threat? That they would block me back. Oh boy.

Re:Open Relays

[deanatav8net]

The open relay obscures the ability to block spam. It's either all permitted or all denied based on IP address.

This is just your broken filtering, which you insist on keeping broken. Your broken filtering isn't my problem. It is trivial to filter on the IP address in the Received Header. Even if the spammer inserts some additional forged headers, their real IP address is still there, and will be found on an IP address RBL.

The open relay obscures the ability to block spam. It's either all permitted or all denied based on IP address.

It doesn't obscure anything. There is no difference (Header-wise) between spam sent through the spammer ISP's closed relay or an open relay. The same headers are in the messages as there are when the spammer uses their ISP's closed relay. If you filtered on IP addresses in the Received Headers, it wouldn't matter what relay (open or closed) the spammer used. They could use any relay, anywhere in the world, and it wouldn't make any difference. The spam would still be blocked. Which is my goal.

But of course, as you have said in the past, it isn't your goal to block spam. This explains why you insist on simplistic filtering and your insistence on the "necessity" of blocking open relays.

Not all ISPs are willing to remove the spammer's connection. Of course we block those ISPs that do that. But because the spammer can get around it through open relays and open proxies, those get blocked, too

That doesn't mean you can't block spam. And this isn't my problem. I'm not responsible for some other ISP's policies. Their spammers still have IP addresses, just like everyone else. Those IP addresses go into Received headers, no matter what relay they use. Anonomizing relays and open proxies are a different problem, but can still be blocked by IP address, whether they use their ISP's closed relays, or some open relay.

And don't make threats against those who choose to not accept it. Then those who prefer to block only the open relays and not the whole network of the operator, can do so. It's the threats that I believe have resulted in most of the blocking of your entire net.

This is false. We are blocked in revenge because we block the relay testers. Also, we haven't made and 'threats' against anyone. We have successfully engaged the legal department of one ISP, after we learned of a credible threat to block our relays. The lawyers went head to head, and we won. Its not case law, but its clearly expert opinion. However, most ISP's don't block open relays. Very little of our email has ever been blocked. When it has, we've contacted the ISP, and the usual response is that they stop using the open relay list altogether. They could just whitelist us and keep using the open relay list. Instead, most people consider such blocking of legitimate mail, and entire ISP's inappropriate. They think the blacklist's goal is to block spam, and are usually quite unhappy to find out that isn't the case. And they're usually appreciative of the suggestion to use the IP address in the Received header, which improves their ability to block spam. Which is their goal, too.

As far as legal action goes, the end users of an ISP have an expectation of privacy. There are laws that protect that privacy. That precludes ISP's from joining boycotts of legitimate email. The users' email isn't a pawn to be played with at the whim of some admin. It belongs to the user, not the ISP.

Re:Open Relays

[minas-beede]

"This is just your broken filtering, which you insist on keeping broken. Your broken filtering isn't my problem. It is trivial to filter on the IP address in the Received Header. Even if the spammer inserts some additional forged headers, their real IP address is still there, and will be
found on an IP address RBL."

I have the advantage in this discussion of having trapped relay spam at the relay - I can see the headers, I can log the actual source IP. At the beginning of 2002 a lot of relay spam did come direct from the spammer - many spammers try very hard to obscure their own IPs (even the spam I'm trapping now has HELOs with forged IP numbers in them - that deceives some MTAs, I think.) Now I think it is far more typical for spam to arrive at the relay from an open proxy someplace (South America being a very common "someplace.") In that case you don't see the spammers IP at all - you see, at best, the IP of the open proxy. There's millions of those - most probably aren't yet listed by any RBL. The spammer may add fake headers that show a source at AOL or elsewhere - these are pure fiction.

During one long period of trapping relay spam I observed that it was all directed to AOL addreses. At that time AOL didn't (apparently) use any RBL or local equivalent - all that spam would have reached the recipient if it had not been trapped at the relay. DNSBLs do not stop all spam (if for no other reason than that many ISPs don't use them.) Filters don't stop all spam (my ISP uses Brightmail - I get classic 5-report chain-letter spam, still.)

In any case there are two aspects to stopping spam: stopping spam to you (or to your users) and stopping spam, period. The major efforts right now are directed to stopping one's own spam. It isn't working well enough to stop spam overall. If spam is to be stopped by technical means it had better happen soon - the DMA backs an anti-spam bill and that could become law this year. If that happens the odds are great that the "stupid" spam will end in a year or so - the law wil work against that. That will open the gates for a flood of "respectable" spam that the law will grnadly declare legitimate. Maybe the law would forbid blocking of such spam. Few sane email users should want that.

("Stupid spam" isn't precisely defined, but it's the common crap you now get: porn, organ enlargement, Viagra, mortage, debt consolidation, ... One aspect of stupid is "If 90 percent of spam is blocked we'll just send 10 times as much." The distinction I'm making, while imprecise, is between the millions-of-addresses-CD type of spam and spam that's modeled on traditional bulk-mail advertising. The DMA wants the latter to be allowed.)

Re:Open Relays

[Guppy06]

"even though my phone number has been listed with the Texas No Call list for months"

No Call lists and the like don't work if you already have a pre-existing business relationship.

Solution? Dump them, then tell them to stop calling. If that doesn't work, take them to small claims court and get the $500 federal law entitles you to (as well as any legal fees)

Re:Open Relays

[Skapare]

I have no pre-existing business relation with Rackspace. I don't use their service. There is nothing to dump. They were cold-calling, probably from leads extracted from domain registrations (my guess). They did violate the No Call List.

Re:Open Relays

[Skapare]

The open relay obscures the ability to block spam. It's either all permitted or all denied based on IP address.

This is just your broken filtering, which you insist on keeping broken. Your broken filtering isn't my problem. It is trivial to filter on the IP address in the Received Header. Even if the spammer inserts some additional forged headers, their real IP address is still there, and will be found on an IP address RBL.

This is where you are wrong. But I'm glad you are finally making it clear you expect people to accept the full body of every piece of junk mail and have to spend all that CPU time parsing each and every one of those headers.

You complain about standards, or lack thereof, for things like SMTP AUTH (even though a non-mandatory standard does exist for it, so we all can know how to do it in an interoperative way, which is what standards are really about). Yet there exists no standard on the syntax of the Received headers. The format might well be consistent for each piece of mail from your open relay, but that is just not so across the spectrum of all received header formats out there. The cost for me to parse these non-standardly formatted headers is greater than the cost to you to test the IP address, or user authentication, of incoming mail on your servers to be sure it's really your customer.

The open relay obscures the ability to block spam. It's either all permitted or all denied based on IP address.

It doesn't obscure anything. There is no difference (Header-wise) between spam sent through the spammer ISP's closed relay or an open relay. The same headers are in the messages as there are when the spammer uses their ISP's closed relay. If you filtered on IP addresses in the Received Headers, it wouldn't matter what relay (open or closed) the spammer used. They could use any relay, anywhere in the world, and it wouldn't make any difference. The spam would still be blocked. Which is my goal.

There is still the issue of having to accept message content and parse headers. See above.

Your concern is getting your legitimate mail through. To do that you need to find a way to make your legitimate mail distinguishable from any spam, or else make sure there is no spam. The choice is yours.

But of course, as you have said in the past, it isn't your goal to block spam. This explains why you insist on simplistic filtering and your insistence on the "necessity" of blocking open relays.

You've claimed this before. But I've never said such. You are apparently unable to distinguish between goals and methods.

Not all ISPs are willing to remove the spammer's connection. Of course we block those ISPs that do that. But because the spammer can get around it through open relays and open proxies, those get blocked, too

That doesn't mean you can't block spam. And this isn't my problem. I'm not responsible for some other ISP's policies. Their spammers still have IP addresses, just like everyone else. Those IP addresses go into Received headers, no matter what relay they use. Anonomizing relays and open proxies are a different problem, but can still be blocked by IP address, whether they use their ISP's closed relays, or some open relay.

If you run an open relay, your are responsible for making it difficult for me to distinguish legitimate mail sent through your server, from spam that irresponsible ISP is allowing their customers to send. You are responsible for your open relay. Why not mark which messages coming through are from your customers, and which are not?

And don't make threats against those who choose to not accept it. Then those who prefer to block only the open relays and not the whole network of the operator, can do so. It's the threats that I believe have resulted in most of the blocking of your entire net.

This is false. We are blocked in revenge because we block the relay testers. Also, we haven't made and 'threats' against anyone. We have successfully engaged the legal department of one ISP, after we learned of a credible threat to block our relays. The lawyers went head to head, and we won. Its not case law, but its clearly expert opinion. However, most ISP's don't block open relays. Very little of our email has ever been blocked. When it has, we've contacted the ISP, and the usual response is that they stop using the open relay list altogether. They could just whitelist us and keep using the open relay list. Instead, most people consider such blocking of legitimate mail, and entire ISP's inappropriate. They think the blacklist's goal is to block spam, and are usually quite unhappy to find out that isn't the case. And they're usually appreciative of the suggestion to use the IP address in the Received header, which improves their ability to block spam. Which is their goal, too.

I don't know if it's most or not, but a substantial number of ISPs do block open relays. It probably is most because the number of small ones run by the people in the trenches who really do know what is going on outnumber the few big ones run by pencil heads and golfing buddies who really don't have a clue about spam (or are looking to actually do some spamming for themselves some day). It sounds to me like you lied to a few ISPs because you very well know what blocking is all about. Or more likely you told them about the costs they would have litigating in court to a pinhead run ISP.

As far as legal action goes, the end users of an ISP have an expectation of privacy. There are laws that protect that privacy. That precludes ISP's from joining boycotts of legitimate email. The users' email isn't a pawn to be played with at the whim of some admin. It belongs to the user, not the ISP.

Joing boycotts, if you want to call it that, has nothing to do with privacy. It has everything to do with business relationships. Of course an ISP that blocks some mail a customer wanted in a manner outside of their business relationship is wrong. If the ISP advertised a service where all mail gets through, but secretly are blocking some mail for any reason, then that customer has cause to bring action against the ISP. Or they can take the easy route and switch to another ISP.

However, if the ISP offers as part of their service to help clean up the email by removing spam, and does not pretend that the system is perfect (no method is), then the business relationship is sound, and this is not a case of "playing with mail". That's what I offer to my customers now, and doing anything less would be against that business relationship.

Customers who have separate mail servers for their own domains (most of them) do get to have these things customized. A few have all anti-spam measures turned entirely off. Their choice, and it's easy to manage because it's a separate server. But I am planning on the next phase of mail services where customers can control their own email control policies even down to a single recipient address in the same domains as other users have different controls. Then it will be they who decide whether or not to trust your mail servers to carefully limit what they relay to just legitimate mail, or not.

Re:Open Relays

[Guppy06]

Then find out who handles small claims trials in your county and file against them.

One possible solution ...

[JSkills]

Ok this one's not for everyone. What we did at goofball.com is to set up a user configurable spam filtering system based on a combination of rules and use of the RBL.

There is a simple web based front-end that allows users to add and modify rules for accepting or rejecting mail based on a variety of factors - all saved in the datbase. Things like checking the subject, to, from, or the body of an incoming email for the presense (or lack) certain strings is a simple example.

All of this is done is Perl using Mail::Audit of course. I know there's Spam Assassin, but this was a little more fun (and customizable) for us.

The final check is the Realtime Blackhole List. When we first implemented this solution, we noticed in the logs that almost everything was on the RBL (even mail from yahoo.com). In fact, our own server was on the RBL. We'd never sent spam before, but I'm sure our relay was open at one time or another.

Since the system is configured to look for "accept mail" rules first, the solution came down to adding "accept" rules for pretty much everyone we knew, so that mail from known parties would be accepted even if on the RBL.

So now I get no spam at all - ever. I get very little mail at all in fact. It's really analogous to having an unlisted phone number. It's not the perfect solution by any means, but I'll take it any day over slogging through literally hundreds of spam mails every day ...

Tim and the RBL

[zzxc]

Tim had just set up an RBL replacement filter, since the RBL had quit wasting netblocks.

One week later, he checked to see how his spam filter (for windows) was doing. An animated trash can popped up in his face and said "Look at all the spam I collected - 500 messages!"

"Wow. That's a lot", Tom said to himself.

"Well, yes," the trash can said. Then waving its arm toward the
Outlook inbox, it added, "But look at all the stuff I'm
leaving behind! You must be really popular"

"But most of those are spam", Tom added after looking through it. "I'm Microsoft Spam Catcher, I set the STANDARD for what is spam and what is not, now that there is no RBL I have a MONOPOLY."

Re:Spam?

[Anonymous Coward]

I used to receive 60 or so per day. This was on my old dial-up account. And spam is getting bigger and bigger! There was one idiot who kept sending me files of 350K. To make matters even worse, my ISP had set up an alternative email address which also get spammed as bad as the regular one (despite the fact I never used it), effectively giving me a double copy of every spam that came in. Of course the ISP refused to even acknowledge the fact that they delivered mail from two addresses into my mailbox, let alone do something about it.

Some days I spent 20 minutes downloading other peoples' garbage. Yes, I can kill that in a matter of seconds. Just wait for the killer-phonebill at the end of the month (I'm in Europe, so local calls are paid by the second).

All this is in the past. My new provider offers excellent anti-spam services and ADSL.

you get what you pay for

[paschimghat]

OK. I do not have enough patience to read through the entire article. but here are some thoughts. SPAM is a form of intrusion of privacy. It would be best to apply all laws and regulations to prevent/deter SPAM as you would to prevent intrusion of privacy.

Re:you get what you pay for

[jgerman]

Maybe you SHOULD take the time to read articles. Any. I can understand the arguments against spam for taking up system resources, but there is no way in hell that it is an intrusion on your privacy. It's your responsibility to keep your email address private if you want it that way. It is a public vector of communication, if you make it public you have no right to complain about recieving communication through it. Complain all you want about it being irritating, wasting time, costing money (especially if you're on dialup), but a privacy issue, I think not.

Re:you get what you pay for

[Analysis Paralysis]

Email containing HTML links which cause your email reader to access the sender's web server can be an intrusion on your privacy. How? If unique links are used (i.e. a unique URL for each email) not only does it tell the sender that your email address is in use, it tells them when you read their emails. They can even set a cookie for future reference. This technique tends to be used a lot by marketing outfits - both "respectable" and downright dodgy (see here).

For this reason, my email is configured not to download HTML and is blocked from accessing any ports aside from POP3 and SMTP by my firewall just in case...

Re:you get what you pay for

[paschimghat]

Maybe breaking into private property that has not been secured properly is not intrusion of privacy either. That's sound logic.

Re:you get what you pay for

[jgerman]

That's a consequence of the medium. The openess, lauded one second by techies, is cursed the next. If you don't like the way it works, either change it on your end as you did, or don't use it.

Re:you get what you pay for

[jgerman]

Hmm, maybe your analogy isn't sound. For years techies have screamed bloody murder when RL metaphors are used to decide what laws to apply to computer crimes. So don't fault my logic based on your inability to draw a strong analog. No one is breaking into anything. The internet, email in particular is an open, public medium. If you don't like it don't use it, it's that simple.

Re:you get what you pay for

[paschimghat]

Maybe you need to get a bit real. Computers are part of RL.

Re:you get what you pay for

[Analysis Paralysis]

Hmmm...I would not agree that this is a consequence of the medium (presuming that you mean the POP3/SMTP protocols) but more a case of certain "features" (in this case, HTML formatting) being exploited in ways unintended by their creators - web bugs also falling into this category.

Whether you regard this as an abuse of the system or a clever twist on it is your opinion, but I believe that most people are not aware of this usage and would object if they did.

Given most people's relative ignorance of network issues, "fixing it" by firewall configuration is not an ideal solution for the masses - and not using email at all is a little unrealistic for most. Having email clients that do not downloading HTML links for remote servers *by default* would be a good start, but without a widespread education programme (an Internet driving test?) most users are going to fall prey to further tactics of this nature.

The Author misses a few points

[cluge]

1. If SPAM wasn't so bad or annoying, or system resource draining the USE of RBL's would not only decline it would likely stop.

_NOTE_ IOHE RBL's in on a single mailserver rejected over 70% of all incoming requests. It took more than 90 days before we had our first complaint from using that RBL. Think of all the mail that didn't get delivered and the saved disk space, system resources et al.

2. Any RBL used is the choice of **insert org here** and not on the people sending mail.

_NOTE_
Very often the people charged with running **insert org here**'s mail server have been told "you must reduce the amount of spam I recieve". For many RBL's are an affective way of doing just that.

3. If the authors point about the legality of relay testing can in fact be upheld in a court, then ALL SPAM is illegal. Since this has not been found to be the case in US courts, then relay testing must be legal. (i.e. 18 USC Sec. 1030 (a) 2 (c))

4. If the Sherman anti-trust act can be applied here then it would also apply for spammers. SPAM is more in violation of the anti-trust act than RBL lists. (Why? because it prevents the delivery of legitimate e-mail, thus purposely causing delays and interfering with commerce)

Other solutions mentioned are worth merit, but it should be pointed out that these solutions are most often used and are most effective when used in conjunction with RBLs. A better solution would be to fundamentally change the way e-mail delivery works. DJB (http://cr.yp.to) had an idea some time ago where the cost of e-mail sent is born by the sender, not the reciever. That system may be the best bet. The ability to then block senders becomes a lot easier and your ISP doesn't have to do the very much "heavy lifting". The spammers get to do it. I like that idea better.

cluge

Re:The Author misses a few points

[swb]

We use SPEWS RBL and it takes out about 40% of the incoming as SPAM on a non-business day (holiday, weekend) and about 20% on a business day. This is on a site that gets a moderate amount of incoming email, about 8-10k messages per day.

We've had two collateral complaints, one from a vendor and one from a client.

The vendor I understand; they're a marketing concern and they have been dipping their toes in "direct email marketing" (highbrow spam?), but they do it from their business netblocks.

The client suprised me; a household name in the home products business -- you'd all recognize their name. But they're one of those "smart" businesses that buys low-budget ISP service, takes whatever 'free' /28 the ISP gives them and NATs everything to that block. Surprise, surprise, Joe Spammer had that /28 (or the /24 that contains it) so they're getting nailed as spammers. What I don't get is why someone wouldn't fix this! Get a different /28, get de-listed from SPEWS, do something.

But other than those two, I have gotten zero complaints. It's an imperfect tool (I still get a dozen or so per day), but easy to implement and as long as the people making the list are active and flexible, a valuable one.

Re:The Author misses a few points

[rocur]

get de-listed from SPEWS

From the SPEWS FAQ:
Q: How does one contact SPEWS?
A: One does not.

Instead you are told to post to a newsgroup and hope for the best. Our hosting company has been trying for over a year to get their entire address block removed from SPEWS. But since they once sold service to someone who violated the TOS and spammed anyway, all of their clients (including us) are being punished. And telling us to get a new hosting company is absurd.

Re:The Author misses a few points

[SN74S181]

DJB (http://cr.yp.to) had an idea some time ago where the cost of e-mail sent is born by the sender, not the reciever.

Whoops! There go all the mailing list servers. Oh well, I guess the Linux kernal developers can all congregate in IRC....

Re:The Author misses a few points

[AndroidCat]

Our hosting company has been trying for over a year to get their entire address block removed from SPEWS.

They can't have been trying very hard. Have you considered the possibility that they are lying to you? (Sadly it happens quite often.)

Re:The Author misses a few points

[rocur]

Lying to us is always a possibility, but highly unlikely in my opinion based on their other (verifiable) behaviour. And my personal experience with trying to deal with SPEWS has been entirely negative (hiding behind an anonymous newsgroup isn't very professional in my book).

Re:The Author misses a few points

[AndroidCat]

What's the SPEWS record number or the IP?

SPEWS might be anonymous (cuts down on the cartoony legal actions) but the newsgroup is hardly anonymous. Professional? How much are they getting paid? (If they are, I want a piece of that as a drafted unofficial SPEWS helpdesk support recruit. :^)

Re:The Author misses a few points

[rocur]

64.39.30.253. The entire range was blocked last time I looked.

Acting professional doesn't mean you are getting paid, just that you accept responsiblity for your actions. By it's very nature, an anonymous group can't do that.

But whether it is SPEWS or someone else doing it, netblocks are simply wrong. They are blackmail at best and terrorism at worse. "We had to destroy the village to save it" didn't play then and it doesn't play now.

Re:The Author misses a few points

[Anonymous Coward]

look here for some ideas on dealing with a SPEWS listing.

Re:The Author misses a few points

[AndroidCat]

64.39.30.253 isn't in SPEWS now. (Spooky! And No, IANS.)

I think the Vietnam reference qualifies under the Ron's Rule of Rubber Analogies variant of Godwin's rule.

Re:The Author misses a few points

[AndroidCat]

Not a bad list, but it could be more clear about when SPEWS will open a hole. Usually it's when someone is in the process of moving from their spammy ISP, and they have a definite timetable of when it will happen.

The last time that I saw them do it, SPEWS opened a hole within an hour of the formal statement/request on NANAE of a move in a month. Whoever they are, they're fast.

Bollocks!

[odaiwai]

Having briefly looked at the paper, it seems like the usual complaining about RBLs as being too broad you see all the time in NANAE (news:news.admin.net-abuse.email).

Summary: someone tries to send email and finds that they're listed on SPEWS. They complain because "we're not an open relay", without figuring out just why they're on that list. Almost invariably, they're on the list because their ISP persistently ignores spam complaints and prefers spammer money to honest customer money. I think there's been about two or three actual mistakes in the SPEWS listings in the year or so I've been following NANAE. Otherwise, it's all been a legitimate extension of the block because the ISP knowingly ignores complaints and supports spammers.

Spam is theft. Theft of Bandwidth, theft of service and theft of time. It's that simple. Spammers are thieves. ISPs which support spammers are thieves. Soon, they'll be blocked from the public internet for anti-social behaviour. After all, if your local bargain supermarket ignored the thieves stealing 20% from every transaction you make with them, will you go back?

Many South American and Asian ISPs are blacklisted because they were quite happy to spam everyone when they could steal bandwidth and service from other ISPs. Now that they're blacklisted, they're whinging and moaning about 'freadom of speach', interference with interstate commerce, and other such bullshit.

It's about none of these things. Blacklists are about protecting your network from a Denial of Service attack by spammers.

People who complaing about RBLs (OR DNSBLs, to be more accurate) are missing the point. They should be complaining about spammers who think it's acceptable to steal my bandwidth and your bandwidth to advertise their product..

dave "the only good spammer is a rotting corpse, dangling from the noose"

Re:Bollocks!

[FaRuvius]

Spam is theft. Theft of Bandwidth, theft of service and theft of time. It's that simple. Spammers are thieves. ISPs which support spammers are thieves.

Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves. When in reality, it is those "junk mail" advertisements that are keeping the postal service alive.
While spammers certainly are not keeping ISP's alive, grow up a little bit. We live in a capitalist/consumerist world. Advertisements go hand in hand with capitalism and free markets.
Just be thankful that with computers you can filter the through all the static. You can't filter out billboards, newspaper ads, loudspeakers, etc. etc. etc.
-

Re:Bollocks!

[djmurdoch]

Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves. When in reality, it is those "junk mail" advertisements that are keeping the postal service alive.
While spammers certainly are not keeping ISP's alive,

You pointed out the difference yourself. Your supermarket pays for its flyers to be delivered. Spammers steal resources from their recipients in order to deliver their ads.

Spammers are thieves because of the way they deliver their ads. Sometimes they're also thieves because they're cheating scum who deliver fraudulent scams, but that's beside the point.

Re:Bollocks!

[UdoKeir]

Spammers are not thieves.
Yes they are. They steal bandwidth and server space.
Your local supermarket has to pay out of their own pocket for printing and advertising. They also have to pay for delivery. With spam, you pay for all of that.

Re:Bollocks!

[Anonymous Coward]

"Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves. When in reality, it is those "junk mail" advertisements that are keeping the postal service alive."

Your justification falls apart because of the cost of sending and hosting of the ad is born by the advertisers versus spam where they cost is handeled almost exclusively by they recipient ISP's and users.

A better example would be junk faxes where similar cost ratios come into play. You will note that many places in North America and Eruope have laws agaist such practices. The worst spam is as costly as the worst junk faxing according to my brother who oversees premises and operations (including IT) and deals with these issues daily.

Re:Bollocks!

[Doc Hopper]

You've voiced an opinion on Slashdot which will be both unpopular and likely to quickly be moderated down. What we have here is two people arguing about an opinion:

• Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves.

Contrary to what many anti-spam activists would have people believe, you are correct. Spammers are not thieves. They are, however, engaged in an unethical form of guerrilla marketing which has the net effect of shifting costs of advertisement to the consumer, rather than to the advertiser. Much like the RIAA labels people that infringe copyright as "pirates" and "thieves", to little effect, calling spammers "thieves" is probably over the top and unlikely to bring positive change.

• Just be thankful that with computers you can filter the through all the static. You can't filter out billboards, newspaper ads, loudspeakers, etc. etc. etc.

The key difference you've missed is where the costs are borne. My company pays $650 a month for our T-1. By 9 AM this morning, we had received over 11,000 attempted emails. We have 300 employees. Of those 11,000, roughly 200 were legitimate mail. The rest were spam, double bounces, or roughly 4,000 attempts in nine hours to send mail to addresses which do not exist in our domain. We used to accept these and send bounces directly from our Groupwise server; I put Groupwise behind a firewall and Postfix mail relay shortly after I was hired here, and noticed that in two weeks we had over two gigabytes of double-bounces sitting in our queue. Yes, I use RBL, Anomy, and SpamAssassin. Nevertheless, the amount of time that I have had to spend to limit the problem to manageable levels that don't drive us out of disk space and bandwidth has cost my company dearly from payroll. I can drive past billboards and ignore them. I can choose not to listen to the radio or watch television. I don't miss much by not watching TV or listening to the radio, and thankfully any important global news I get relayed through my co-workers. In today's world, however, it would be extraordinarily difficult to decide to not use the telephone, or, if you conduct a great deal of business using electronic mail, to suddenly decide to stop using the medium entirely.

I'm not saying you are wrong, but it seems to me that both the "spammers are thieves" and "spammers are not thieves" arguments are not quite hitting the mark. Whether unintentionally or intentionally, a single unsolicited commercial email can end up collectively costing the world a great deal of money. It seems that the best analogy I could use is that spammers are like cigarette smokers. A smoker's behavior hurts only themselves, but the secondary aspects of their behavior (second-hand smoke) impact the health of others, and so that portion is regulated. It's difficult to find a public building in the U.S. these days that allows smoking due to the known, unhealthy side effects. But it took the human race hundreds of years of dealing with "annoyance levels" of the problem before coming face-to-face with the predictable health consequences of the smokers' actions.

No offense meant to smokers! I know it's a hassle to have to go outside when it's sleeting and windy in order to find a place to smoke. Spammers, also, are exercising their right to free enterprise and free speech, but, ultimately, I think spammers will find themselves in a similar regulatory position, that they must practice their craft only in designated, acceptable areas, and that spamming outside of those lines will have significant legal repercussions. Digital signatures are part of the solution, as are whitelisting and blacklisting. If spammers can be forced to operate legitimately, using only legitimate information so that they can be contacted and held liable for their actions, it would be a truly enormous step in the right direction. I don't think that part will happen through legislation, but through very large installed bases of users beginning to use mail platforms which transparently implement this kind of functionality...

Re:Bollocks!

[Random Walk]

Almost invariably, they're on the list because their ISP persistently ignores spam complaints and prefers spammer money to honest customer money.

Bullshit. My ISP actively fights spam, yet still it gets blocked by SPEWS. SPEWS is blocking so overzealously that it's just a matter of (bad) luck whether you get blocked or not. And even if your ISP is spam-friendly, why should you switch if bad luck can/will strike everywhere ?

Re:Bollocks!

[Anonymous Coward]

Spam is theft. Theft of Bandwidth, theft of service and theft of time. It's that simple. Spammers are thieves. ISPs which support spammers are thieves.

dave "the only good spammer is a rotting corpse, dangling from the noose"

You should really start seeing a therapist about your irrational hostility. It would do you good and you'd become a happier, better adjusted individual.

Re:Bollocks!

[KC7GR]

FaRuvius writes...

"Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves. When in reality, it is those "junk mail" advertisements that are keeping the postal service alive."

Not true. The supermarket PAYS the postal service to deliver their coupons to the neighborhood. There is no cost to the recipient incurred, so no theft has taken place.

Spamming, however, is an entirely different can of worms. Example; I own/operate all my servers. Mail, web, DNS, news, the works. I paid for the hardware out of my own pocket, and I continue to pay for the electricity that runs them, the bandwidth that supports them, and the maintenance in my time and parts cost when something breaks.

When a spammer hits me or my other users with their unwanted crap, it's no different than if one snuck up behind me and tried to pick my pocket. They're stealing MY resources just so they can avoid paying their own way, advertising-wise.

To put it another way; Imagine receiving junk postal mail with postage due, or getting collect calls from telemarketers. Spamming is the same thing.

If you choose not to believe me, believe the courts. In the landmark case of AOL vs. Cyber Promotions, the judge in the case determined (rightly so) that spamming constituted theft by conversion, and trespass to chattel.

So yes. Spammers are thieves. Period.

Re:Bollocks!

[AndroidCat]

Wah! Wah! Wah! Name the SPEWS record and let's see if it's justified or not.

Re:Bollocks!

[Anonymous Coward]

"People who complaing about RBLs are missing the point. They should be complaining about spammers who think it's acceptable to steal my bandwidth and your bandwidth to advertise their product.."

Like the spammers or the spam hosting ISPs give a fuck what we, the innocent-yet-blocked, think, any more than they give a fuck what you, the anti-spam nazi, thinks.

Hey, I got an idea! Why don't you just firewall off 255.255.255.255! You won't get any spam then! Of course, your customers might be a little pissed off at you, but who gives a shit about other people and their business right?

Re:Bollocks!

[tigga]

Almost invariably, they're on the list because their ISP persistently ignores spam complaints and prefers spammer money to honest customer money.

"Your credit rating, Mr Odaiwai, is low because your zip-code was used by people who declared bancruptcy. Why don't you change your address?"

Do you like collective punishment?

Re:Bollocks!

[Anonymous Coward]

Not true. The supermarket PAYS the postal service to deliver their coupons to the neighborhood. There is no cost to the recipient incurred, so no theft has taken place.

You prick tumoured wound fuck. If you'd just kept your mouth shut. And does the supermarket pay for my mailbox? Do they pay for my PO Box? Do they pay to haul out my garbage? Do they pay for my time to sort through their shit? Do they pay me to sort their fucking trash into recycle bins? Do they pay for my garbage bags?

Re:Bollocks!

[minas-beede]

Spammers, in my case, are not thieves: I give them the bandwidth needed to get the spam TO my server. But the only reason they send the spam is because I look to them like one of those fools from whom they steal service every day - like someone who will deliver the spam (the joke is on them.) For the mass of the spam, for the spam that reaches the recipient's server, delivered or rejected, the process of getting that spam to that server is based on deliberate theft. The spammers have an out in that theft of service alone isn't a federal crime unless the value of what is stolen is $5000 or more. Overall they steal many times $5000 worth of service - just not from the same victim. It would be hard to show they steal $5000 worth from any one entity (and once the entity sees the theft it stops it, so accumulating enough to hit the $5000 mark is even harder.)

There is a small fraction of spam that goes direct from the spammers server to the victimes server. All else is some form of relay spam, and relay spam is spam based on theft of service as the delivery method. Spammers are thieves. There's a lot more to spam than what the recipient sees and experiences. I'd not be paying much attention to this discussion tonight if I had not, 3 years ago, been the victim of a relay spammer.

Re:Bollocks!

[Zontar The Mindless]

> Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves. When in reality, it is those "junk mail" advertisements that are keeping the postal service alive.

But you miss a very important difference: people who send junk snailmail must pay for the privilege on a per-piece basis -- people who send junk email don't have to pay for the volume --> bandwidth that they send out. Spammers can afford to operate precisely because everyone else winds up paying for the bandwidth that the spammers use.

Re:Bollocks!

[schon]

Spammers, also, are exercising their right to free enterprise and free speech,

Spam has _NOTHING_ to do with free speech.

Free speech is the right to say whatever you want.

It it not, nor has it ever been the right to force people to listen to you, or the right to force people to pay you to speak.

The whole "free speech" argument is a red herring.

Easy

[ACNiel]

Since you don't really know who might be sending you mail from that area, you may as well just have an opt in list.

Then you can have all the people you want to send you mail, mail you to be put on your opt in list.

He did address it, if you'd care to read. He just didn't itemize the arguments, since they don't need to be. The arguments and justifications for are simple, and are addressed in batch right after the list you mentioned.

No, you don't have to accept mail from me, but when you ignore my entire network, you don't know who else you are ignoring. And, if you just subscribe to a list, you have no idea who you are blackholing, or why. And since you are posting on slashdot, I know you don't have the free time to acutally investigate these lists.

Can somebody explain how

[sqlrob]

Operates on a per message basis
and
Scalable (resources)

Aren't mutually exclusive?

Re:Can somebody explain how

[JohanV]

XS4ALL, one of the largest Dutch ISP's, has made a system where users can specify their own RBL settings. They can choose for up to 13 RBL's to be used to either reject or tag email messages with custom headers which can easily be processed further. I think that is about as good as it gets, and since it is the user himself that has to set his own preferences, the default is to allow everything to pass, all the arguments about free speach are also pretty moot.
It currently serves over 140.000 users, so I think that it is pretty scalable (although it doesn't do content scanning).

Re:Can somebody explain how

[sqlrob]

Still not scalable though.

Let's suppose that it stays a constant 140,000 users, with no gain or loss.

How long before they have to upgrade the mail servers?

Re:Can somebody explain how

[dskoll]

You can have high-performance message scanning; you just have to be clever about how you implement it.

For example, someone was using MIMEDefang to scan almost 2 million messages/day on a single machine.

To scale up, just throw in another equally-preferred MX record.

Re:Can somebody explain how

[sqlrob]

Why should I upgrade hardware if the valid load on the machine does not change?

Re:Can somebody explain how

[thogard]

I ran mail for 87,000 users in late '92 (pre html email and almost no attachments) on a pyramid system that had a total of 12 machines that were almost as powerful as a sony play station. How much faster is a $600 pc? We also didn't have any 80 gig drives either.

Re:Can somebody explain how

[dskoll]

> Why should I upgrade hardware if the valid load on > the machine does not change?

The good news is you probably won't have to. Very few production mail servers are CPU-bound, so adding content scanning actually evens out the resource usage. You go from a horribly-overengineered CPU to one which matches the network and disk capacity.

The bad news is that nothing in life is free, and if you want to content scan absolutely huge quantities of e-mail, you need fast hardware. It's up to you to decide if hardware or wading through spam is cheaper.

Re:Can somebody explain how

[sqlrob]

Don't forget about the bandwidth waste. Wanna buy a few more T1s simply to support spammers?

Collateral Damage

[Detritus]

The author seems to be upset that innocent third-parties are being inconvenienced by black-hole lists. Tough shit. If it takes a thousand back-hoes cutting every Internet link to South Korea, China, Russia and other spam havens, to suppress spam, I will chip in for the diesel fuel. These ISPs don't care about spam and I don't care if they get BGP'd off the face of the Earth, along with any legitimate users they might serve.

Re:Collateral Damage

[sboyko]

I hate spam as much as the next person, but the vigilante attitude of the RBL'ers goes too far. Cutting off a large netblock because of the actions of a few is too much.

Re:Collateral Damage

[Anonymous Coward]

The actions of A FEW??

Tell me, how many legitimate mail messages did you get from South Korea this year? And how many SPAM messages?

What is the ratio? For me the ratio cannot even be computed because the number of legitimate messages is ZERO.

When Korea cannot control their spammers, that is their problem. Let the legitimate users suffer. Too bad for them, their country is supposed to be a democracy so when they suffer too much they will make their government do something about it and the problem will be solved.

Re:Collateral Damage

[scheme]

If it takes a thousand back-hoes cutting every Internet link to South Korea, China, Russia and other spam havens, to suppress spam, I will chip in for the diesel fuel. These ISPs don't care about spam and I don't care if they get BGP'd off the face of the Earth, along with any legitimate users they might serve.

Hey I know what, how about we take a backhoe and cut your connection to the internet. That way you won't get any spam at all and we don't have to listen to your bitching. If that happens to inconvenience you then too bad. I'm sure no one will really care if you don't connect to the net again.

Re:Collateral Damage

[AndroidCat]

It wasn't legimate, but I did get spam from an open proxy on the firewall of the South Korean Naval headquarters. Ohmyflippinggawd. Bet your ass that I burned diplomatic and admin channels reporting that one with the recomendation that they do a full security audit.(And right after they shut it down, they had a naval incident with North Korea. Hmm.)

Zero legitimate email, but those Russian babes did seem pretty hot. :^)

Re:Collateral Damage

[tigga]

Tell me, how many legitimate mail messages did you get from South Korea this year? And how many SPAM messages?

AAAAAAA!
Do you think mail messages about Warcraft are illegitimate?

I know a person receiving some mail from South Korea. Have I tell him he'll be cut off?

Re:Collateral Damage

[Anonymous Coward]

Cut his connection to the Internet?

Why? Does his ISP tolerate spamming? Is he in a netblock that is a known source of spam?

GoAT.

Re:Collateral Damage

[sboyko]

I get a lot of spam, from a lot of places. My Outlook spam filter has a little over 300 domains that I have received spam from. Some are from Korea, some are major American ISPs.

By your logic, I should block aol.com because I get no legitimate messages from there.

Put the control of spam into the hands of the users - they can decide what's spam and what is not. I don't trust my ISP to decide what web pages I can see; I don't trust them to decide what email I should receive either.

MailWasher

[Kajakske]

I have an interesting program i use to check my mail with before my client downloads it.

It's called MailWasher (probably locatable on tucows or something).
It downloads a list of messages and depending on your configuration (now comes example of mine) the program has it's own blacklist (flags those mails as blacklisted), uses the SpamCop blacklist (to flag them as Blacklist by SpamCop) and has some rules flagging messages as spam and possible spam. Then, depending on your config again, those messages are either tagged as Bounce, Delete or Friend ... Obviously, friends e-mails are left alone, even if they are tagged as spam (als has internal friends list).

This works very well. It only tagged 1 friend of mine once as Listed by SpamCop, and that probably was justified :ppp

Re:MailWasher

[Anonymous Coward]

Mailwasher is LAME. While it does ATTEMPT to filter, it fails. The blacklist is a sham. Once blacklisted, mail from that source should never come in, but that is not what happens. Mailwasher does not report to any central location for SPAM prevention. I played with Mailwasher for several days, but the lameness began to fill the house with lame, so I deleted it. Oozing lameness had to be cleaned up with a Swiffer and spam juice. It was a tasty endeavor.

Re:MailWasher

[Anonymous Coward]

Just a note to anyone else considering this - if for some reason you do, make sure you turn off its 'forge a bounce' feature. This automatically tries to send a bounce message, forges your ISP's mailer-daemon address. The thing the author forgot is that the vast majority of sender addresses on spam are either fake, or belong to some innocent third party. So you either jam up your ISP's mailserver, or you mailbomb some person whose email address the spammer chose to forge in their spam.

Refer to
http://groups.google.com/groups?selm=BehE9.121 1%24 37.136642%40cletus.bright.net&output=gplain

how do you get off the list

[Anonymous Coward]

I run a server that was open relay for 2 weeks by accident. over 120,000 emails went threw and the server was added to the lists of spam servers out there. How do you get off teh spam lists now that its locked down???

My SPTP greeting

[cluge]

Clever message on the open relay. How about this one?

220 mail.XXXXX.com: By connecting to this host
220 you agree to be open relay tested by
220 njabl.org. You also agree
220 to only send traffic that complies with our
220 AUP and our providers AUP. ESMTP

Seeing that your server must connect to mine first, I wonder which contract will be upheld in court?

cluge

Re:My SPTP greeting

[Paul Wright]

Neither. A contract requires consideration (something of value exchanged) and the intention to form a contract on both sides. I'm not a lawyer, but both your banners rely on the person connecting actually seeing the banner. The odds are that they won't.

Re:My SPTP greeting

[Anonymous Coward]

220 you agree to allow your your testicals for research in exchange to sending spam through the server....
each side gets something. That makes for a vaild contract (assuming one can give away their balls in a contract)

Re:My SPTP greeting

[Russ Nelson]

Neither one. To form a contract, both parties must realize there is a contract. Since there is no standard, nor any kind of accepted practice, for putting conditions on the acceptable email in the SMTP banner, there is no contract.
-russ

Re:My SPTP greeting

[satterth]

Congrats, you now have a CLICK though contract with a SMTP server...

What are you going to do? Have the computer program arrested and thrown in jail. Or are you going to take the SMTP server to court.

I can just see it now.

"I would like to intoroduce to the court, the case between Joe Blow and the installed Sendmail on the computer 127.0.0.1"

Re:My SPTP greeting

[tigga]

What are you going to do? Have the computer program arrested and thrown in jail.

I know! I know!

FreeBSD has a gooood jail - take a look:
JAIL(2) FreeBSD System Calls Manual JAIL(2)
NAME jail - imprison current process and future decendants

full text here:
http://www.freebsd.org/cgi/man.cgi?query=jail&sekt ion=2&apropos=0&manpath=FreeBSD+5.0-curren t

Read the mail

[WillRobinson]

I suggest you read the mail. Go to the site. Use the resubmit for testing function, and hopefully if your secure. You will be off it in a few days.

Several things

[dangermen]

1. RBLs are a good penalty for the world as a whole because no one wants to create good legislation(everyone is at fault for this).
2. If you hate spam, only accept encrypted messages. After all if you only hand out your public key to 'trusted' individuals, then you know when your mail is good.
3. This is yet another reason why everyone using the Internet should be required to be licensed. If you've been busted spamming, you should lose your license.

Re:Several things

[Anonymous Coward]

This is yet another reason why everyone using the Internet should be required to be licensed

You are a retard

There is no spam problem.

[Moderation abuser]

I don't get spam. At all. Despite my email address being posted to usenet groups regularly and being available on web sites.

If you're still getting spam, and whining about it, you really need to start thinking about how competent you are with respect to information technology and perhaps, maybe, it isn't the right profession for you.

There are many anti-spam technologies available and you know what? Some of them even work.

Re:There is no spam problem.

[micromoog]

So . . . only ultra-l337 "information technology" "professionals" like yourself deserve spam protection? And as long as the "information technology" types can avoid it, there's not a problem?

Re:There is no spam problem.

[Anonymous Coward]

So you're saying that any information technology person who gets spam is incompetent? This is a troll through and through. I'd mod you down but don't have it today.

Re:There is no spam problem.

[AndroidCat]

There are many anti-spam technologies available and you know what? Some of them even work.

How would you know troll? You don't get spam.

Oh, boo hoo.

[turambar386]

Well, I have mod points but I have to reply.

So, this guy has a problem: his mail server is blacklisted because it is part of the same netblock as a spammer.

So, rather than switching to a responsible ISP that doesn't allow spammers on its network, he writes a long winded whine about how to solve the "problem" of RBLs (although, mind you, he doesn't give a solution, just what he thinks should be part of the solution).

What he doesn't seem to understand is that the blacklisting of entire netblocks is only done as a last resort when ISPs refuse to get rid of spammers on their networks. It is a punitive measure to try to force the ISP to act.

While I applaud this guy for doing his research, I think he is misguided and even narrow minded. If you are part of the 'collateral damage' because your ISP allows spammers on its network, do the right thing and take your business elsewhere.

Re:Oh, boo hoo.

[dentar]

Some people live in a town where only one choice is offered and cannot choose a responsible ISP or they must resort to something as horrible as dial-up. (i.e. a MONOPOLY)

I thought the FCC and the gummint didn't want all them monopolies! Oh wait.. the lobbyists all got what they paid for. Never mind.

Re:Oh, boo hoo.

[turambar386]

Sure, but who is hosting their mail server on a dial-up connection?

Re:Oh, boo hoo.

[Anonymous Coward]

if his ips got slashdoted over hosting a spamer and did everyday for a week, then his isp might fix the situation. till the hes just crying in the rain.

Re:Oh, boo hoo.

[rocur]

What he doesn't seem to understand is that the blacklisting of entire netblocks is only done as a last resort when ISPs refuse to get rid of spammers on their networks. It is a punitive measure to try to force the ISP to act.

Then answer me one simple question. Why are only small ISPs netblocked? Why isn't AOL? Because the RBLs know that AOL would sue them into oblivion and the small guys can't afford to.

...do the right thing and take your business elsewhere

And who is going to pay for the thousands of dollars of relocation expenses to move our server farm, not to mention the 10s of thousands of dollars in lost revenue while we are down. Try climbing down from your ivory tower and work in the trenchs for a while, it's not a black and white world.

Re:Oh, boo hoo.

[Senior Frac]

Then answer me one simple question. Why are only small ISPs netblocked? Why isn't AOL?

I can count the number of spams I actually received from AOL accounts this year on one hand. I got plenty of emails with a @aol.com forged in the From: header, but almost none of those came from AOL's servers. Don't tell me you're one of those people who actually believe the From: header. I thought we exterminated that species long ago.

Quit making excuses. Trying to turn the whole thing into some sort of conspiracy theory to weasel out of conditions for delivery. Remember, shiny side out for the tinfoil hat!

Re:Oh, boo hoo.

[AndroidCat]

Why are only small ISPs netblocked?

Take a closer look at those lists.

Re:Oh, boo hoo.

[rocur]

Obviously you need the tinfoil hat if you've got that many fingers! I got 1 in my inbox from AOL this morning. As for reading the headers, I was working for Jon Postel when he wrote the spec, I think I know a little about how e-mail works.

And just how are we trying to "weasel out of conditions for delivery"? We do everything possible to play by the rules; we do confirmed opt-in, we list who we are and how to contact us or unsubscribe on every e-mail, we answer our support e-mails, our domain registration has real contact info. And yet some snot-faced kid hiding behind a web site that laughs about the fact you can't contact them says that my choice of hosting services is somehow wrong and I should change? Just because you don't like SUVs may give you the right to keep me out of your driveway, but it doesn't give you the right to keep me out of your neighbor's.

Re:Oh, boo hoo.

[Senior Frac]

And yet some snot-faced kid hiding behind a web site that laughs about the fact you can't contact them says that my choice of hosting services is somehow wrong and I should change?

If reaching your customer base requires the cooperation of that "snot-faced kid", and there are enough "snot-faced kids" cooperating to affect your business, then, yes, I think you should listen to them.

Boycotts are entirely legal and legitimate form of social reform. Your ISP doesn't sound like it is social reforming very well.

The rest of the net is tired of being victimized by spammers and lazy ISPs. While the spam hasn't stopped, the shared blocklist idea has certainly been one of the most effective spam cost-reduction measures implemented. The fact that it's inconvenciencing you is by design. The implementors don't care. You don't pay their paychecks. Get over it. Do something about it. Just quit whining about it.

You do pay your ISP's paycheck.

Re:Oh, boo hoo.

[rocur]

The implementors don't care

And there is the problem in a nutshell. The implementors only care about what they want. We don't want you to drive SUVs, we don't want you to eat McDonalds, we don't want you to use that ISP. If people can't get up the hill to their house, or can't afford the time to eat at Chez Paul, or can't send e-mail because their ISP can't keep track of what each of the thousands of clients do, that's just too bad, F 'em.

And I am tired of being victimized by lazy ISPs who can't be bothered to find out who those RBLs are actually blocking. I'm all for blocking spammers by whatever works, but I'm caught in the crossfire and don't like it and won't sit still for it. If that means harasing my ISP daily, fine. If it means sueing the RBLs to get my address off, also fine. As you said "The implementors don't care". If you want to call that whining, feel free.

Re:Oh, boo hoo.

[Senior Frac]

And there is the problem in a nutshell. The implementors only care about what they want.

Why should they care?

And I am tired of being victimized by lazy ISPs who can't be bothered to find out who those RBLs are actually blocking.

Fact not in evidence. While I'm sure this has happened, I see no evidence it's as prevalent as you claim. Proof, please, that the subscribers are not aware of the DNSbl listing criteria.

I'm all for blocking spammers by whatever works, but I'm caught in the crossfire and don't like it and won't sit still for it.

Where's this inherent right to transit you're claiming?

If it means sueing the RBLs to get my address off, also fine.

On what basis? Suing, with the knowledge it's unwinnable, with the intent to cost the defendent time and money is illegal in many places. It's a published opinion. The mere fact that you don't like that opinion is not basis for a lawsuit. (well, in most jurisdictions I know of)

As you said "The implementors don't care". If you want to call that whining, feel free.

Where is their obligation to care about your business? Where did they sign on the dotted line that you could subsidize your business costs by using their bandwidth/hardware? If they donate it freely, they're free to withdraw it at any time, for any reason.

You're a pititful little whiner. I feel sorry for you.

Re:Oh, boo hoo.

[rocur]

You're a pititful little whiner. I feel sorry for you.

Since this has ceased to be a discussion between adults and instead has dropped to juvenile name calling and ranting, I won't bother to respond to any of your "points". Feel free to have the last word.

Big deception ...

[Etyenne]

I did not read the article in whole (I am at work right now) but it is a big deception to see that the author, in the section about other anti-spam measure, wrote only a single paragraph on user education. It's a big deception because this is the root of the problem. Sysadmin can fiddle all their time with Spamassassin and Vipul's Razor but as long as some moron will buy pensu enlargement cream from spammer, spam will continue to be profitable.

The only way to reliably and permanentely stop spam is to to make it unprofitable. Since spamming have near-zero cost, anti-spam measure must attack the revenu stream of spammer. The revenu stream is people buying into spam. Thus having less people buy into spam is the only effective anti-spam prevention measure. All the rest is just Band-Aid in a loosing battle.

BTW, this is the same thing with tele-marketing, junk fax, etc.

Re:Big deception ...

[Steve B]

Since spamming have near-zero cost, anti-spam measure must attack the revenue stream of spammer. The revenue stream is people buying into spam.

The problem is that the relevant "people" are not necessarily the ones stupid enough to respond to spammed come-ons. Even in the (unattainable) case in which nobody ever responds to spamvertising, spammers will still make money.

Large-scale spammers don't sell their own crap; they sell the "service" of spamming advertisements for other people's crap. Even if nobody responds to the spam, the spammer still has the money. Eventually, some of the clients get tired of flushing their money down the toilet, but there will always be customers for the spammer's snake-oil pitch.

The two problems (which impact more than e-mail)

[Lumpish Scholar]

(1) You (and I) get too much spam.

(2) Your e-mail system administrator (and mine) need to keep beefing up the servers because the sheer volume of e-mail is growing so quickly.

To a first approximations, filters solve (1) but not (2), and black hole lists solve (2).

whirlycott summarizes the problem with (2) in two words: "collateral damage." How much of the e-mail network do we need to destroy in order to save it?

We need to move past first approximations. We need systems that work at the server level, but that somehow address the problems of collateral damage and false positives.

This is only the tip of the iceberg. Any network messaging medium is vulnerable to abuse by spammers. The problem started with Netnews, it continued with e-mail, it's happening now with instant messaging. We need at least high level solution that helps solve the problem regardless of prototcol.

I wish I had one.

Here is the plan to stop SPAM

[Anonymous Coward]

Grab a copy of AI Roboform, install it, create accounts for each and every Senator and Repersentative you have. Sign the bums up for as much SPAM as you can. They may get the point. It will remain a problem as long as legislators are not personally affected by it. Drive the point home! Post their email addresses in newsgroups.

-----IGNORE this part-----
This way, perhaps, we can get Ralsky in jail, and stripped of his money from the SPAM. Make SPAM not pay, make it illegal to spam. Nuke foreign countries who allow SPAM, it would just take one nuke, and you just know SPAM comes from North Korea.

Re:Here is the plan to stop SPAM

[squiggleslash]

This way, perhaps, we can get Ralsky in jail, and stripped of his money from the SPAM. Make SPAM not pay, make it illegal to spam. Nuke foreign countries who allow SPAM, it would just take one nuke, and you just know SPAM comes from North Korea.

If Ralsky goes to jail, doesn't that just mean he'll move into telemarketing?

Re:Here is the plan to stop SPAM

[Anonymous Coward]

There's something interesting about your reasoning here.
Since Ralsky is not in jail, we should assume the US is not interested in fighting spammers. Then we should nuke the US.

(well, the nukes are conveniently there anyway)

Moving Beyond SMTP is the Answer

[zentec]

The problem, as I've said here before, is SMTP itself.

The RFC pretty much states that to be compliant, you have to accept the mail as it is presented. Can't achieve accurate or trusted reverse name lookup information on the sending system? Well, that's tough, take the mail (read this for yourself).

This problem stems from when systems on the Internet were inherrently trusted. That's not the case any longer, and it's time for a new mail transmission standard.

For starters, it should allow system administrators the ability to give priority to systems that can present some form of credentials. SSL or keyed encryption, whatever the standard is, it will permit systems to give totally trusted access to systems that meet the specific security and trust guidelines of the receiving system, not the RFC (times have changed, tough).

Those systems that do not meet minimum trust levels will either have to clean up their act or take the time to contact the remote system to figure out the issue.

It won't stop spam, but it will go a long way to slowing it down and possibly providing some secure method of mail transport in the process.

Re:Moving Beyond SMTP is the Answer

[spectro]

I agree with the fact that SMTP should be revised/replaced with a new protocol. I think is time to create a new mail transport protocol plugging the holes exploted by spammers. There are a lot of different ideas on how to combat spam, but nobody has organized a "get together and solve the problem" convention.

Re:Moving Beyond SMTP is the Answer

[tgeerts]

SMTP is a weak protocol at best because it is a "push based" protocol. Replacement is most likely the best solution, but other people may speakout against replacement because it is not compatible with every prior SMTP related RFC. The ideas have been thrown around at best.

Organization of resources and people to change the system will be the first big step. Coming to an agreement on the feature set will be problematic because of the aforementioned compatibility issue and trying to anticipate future abuses and/or obstacles.

Does anyone know of a forum discussing replacement of SMTP?

tony

Re:Moving Beyond SMTP is the Answer

[gmuslera]

Think in IPv6, how much time since were implementatiosn available, and how much we will wait until is available universally and you can say safely that internet/internet2/whatever is fully ipv6.

Changing smtp to another protocol will be a very long process, and jumping before time to say "I only accept mail from new SMTPv6 servers" will be worse than dnsbl.

Re:Moving Beyond SMTP is the Answer

[thogard]

Its too late to be solved. X.400 tried to do it and failed is many, many ways.

All "fixed" systems imply that the only people that you want to get email from already have some sort of "trusted" email system. That doesn't exist in the real world and there is no way to create one now. just like there is no technological way to keep people from putting stuff in your letter box, there is no way to keep others from putting stuff in your email box. If you lock it down, then there is a chance that people that you want to try to send you a message won't be able to. The US post office solved the problem with a law with a stiff fine. Spam will only stop when that happens and lots of people get hit hard by it.

Re:Moving Beyond SMTP is the Answer

[sg3235]

It seems to me that PKI could solve the e-mail problem using white lists without the problem of missing e-mails because an acceptable sender is not on a white list. I'm curious as to what slashdotters think of this solution:

The first issue is that I don't see changing billions of MUAs. Therefore, mail servers must still accept SMTP traffic from their clients. However, they would not talk SMTP to each other (at least not in the final solution). First, they would have to authenticate themselves to one another. Then, one mail server would not accept a message from another server without a key authorizing the sender (end user) to send messages to the recipient. If the sending server has no such key, an intermediate message would be sent to the receiving server requesting a key. This message would only contain identifying information about the sender that could be passed on to the end user (recipient). The receiving server would create a normal e-mail message saying that someone for whom no key exists is attempting to send email. The recipient can then forward the message to one of two known addresses that correspond to the receiving mail server (such as accept@smtp.domain.com or reject@smtp.domain.com). The receiving mail server can then send a key to the sending mail server to allow it to send the message with a key, or send a rejection message to the sending mail server. Note that the message itself must be held on the senders mail server until they possess a key with which to send a message. A mechanism would have to exist to allow the end user to revoke a key, in which case a receiving mail server could respond to a sending mail server with a revocation message when it receives such a key.

Since we can't flash cut all of the mail servers in the world at once, the new mail servers would still communicate with standard SMTP if its peer does not yet support the new protocol. Even then, messages accepted via SMTP can be flagged as such by the server, providing a mechanism for MUAs to see that a received message was not authorized. ISPs and end users can handle that case as they do today. If standard headers are used to mark the messages generated by your mail server to ask about accepting or rejecting a sender, MUAs will begin to code for those headers, creating pretty GUIs to handle those requests instead of having the user respond to messages as if it were standard email.

While spammers could try to fake the identity information in requesting a key, I don't think that it would be likely that they could provide something that would make me think that it was a legitimate email. And if they could, they'd only get one through before I revoked the key and subsequent ploys would most likely fail.

The key feature here (pardon the pun) is that the MUAs don't have to deal with key creation, etc. Since traffic between the MUAs and the MTAs remains the same, MTAs could be swapped for ones using the new protocol without any impact to the ISPs customers.

Re:Moving Beyond SMTP is the Answer

[bad-badtz-maru]

I don't understand what advantage in fighting spam accurate or trusted reverse-name lookup information would offer. The sender's IP is there as plain as day, what advantage does pansy-fying it do? Since you can't forge IPs for a mail connection, IPs can be used as the authentication for which you speak, you can allow or disallow mail transport based on IP. Everything you suggest can be done already with the current transport mechanisms.

maru

Re:Moving Beyond SMTP is the Answer

[thogard]

Where does the pki infastructure come from? That will be a problem.

If you want to do this, you could build a whitelist RBL like system. It could work like this....
0) you grab a cool domain name and create a prety https web page
1) Since I will certify that abnormal.com's users won't ever send spam under pain of death, I go to your site and register my details and certify my site won't be spaming. You enter my details in your database and hand me a token.
2) I send email to one of my RBL using friends. My MTA does a DNS lookup of md5 of my token, domain and some other bit of data and includes it in a header of the message.
3) your smtp server reads that header and looks it up using the rbl dns to find out if it was issued and whitelists the message.

You will have to have a way to revoke people from the database. Most IPS's start out clean.

The problem with this is the dns is going to get hammered if it ever takes off. Right now the root name servers tend to get hit for many email messages but not all. This system will hit a dns server for jut about every message. The current root name servers are costing about $10mil a year to run.

my 13 and a half cents

[neildogg]

It's important to realize the point of RBL blocking. It isn't to make end-users happy, it's designed to lower traffic on the mail servers. So a proposed solution needs to be something that the ISP can execute without having to analyze the email. RBLs monitor a single variable, IP, to determine whether it should be accepted or not. If someone could come up with an idea that processed emails based on another single variable, then we'd have ourselves a good spam filter.

My server, my rules

[fruey]

I can whitelist. So I can also DNSBL. My server, my rules.

One proviso: if anyone complains, I will look at it.

RFCs require that one accepts mail for postmaster@domain.com and from the empty envelope sender. Since I do this, I believe I am fully RFC compliant.

So stop whining about DNSBL. The problem is wider than that, and will not be solved by getting rid of DNSBL. The system isn't perfect, but that is not the issue.

Re:My server, my rules

[ted_the_canuck]

Use of DNSBL also reduces the number of entries that are added to private blacklists, which are often "append only until someone complains". Some lists are there until the mail host is replaced, so connectivity from some netblocks will always be impaired to some degree. DNSBLs have a greater effect when entries are added, but at least there is some mechanism for removing entries, even if it involves removing spammers from a network. I utilize some DNSBLs, and although a large amount of unsolicited commercial email still gets through, there is a significant reduction in spam, and complaints about spam from our customers. The presence of DNSBLs also makes ISPs somewhat more accountable, and more likely to check out people who what to host domains like bulklolitasandmorgages4u-optin, and makes them aware that supporting senders of UCE could impair their connectivity.

Re:My server, my rules

[Flarenet]

I have (what I think is) an interesting question: if you block connections from certain IP addresses, how would they be able to send mail to postmaster@domain.com? I ask this since I want to be RFC compliant as well.

I'm using qmail and rblsmtpd to do the blocking, but I see no way of determining if the message is for postmaster@domain.com or the empty envelope sender until after I've already blocked the connection using rblsmtpd.

Any suggestions? What do you do to prevent this problem?

Re:My server, my rules

[fruey]

Whitelist postmaster@mydomain.com i.e. allow it to bypass RBL checks.

I can tell you how to do this with Postfix, but not with qmail. It should be possible with qmail nonetheless - you need an address class which does not go through the same checks as the others.

Complete SPAM protection?

[Anonymous Coward]

So where is the commercial version? Oh, I see you just unplugged the computer! Brilliant, but I point to prior art...

Curiosity

[Anonymous Coward]

What is your e-mail address like? Do you get spam, but won't see it (filtering) or do you not just get it at all. I was thinking that maybe there's some blacklisting of spammer addresses and yours fits the pattern. So, what's the address like?

Re:Curiosity

[Anonymous Coward]

Mike Bouma - mike.bouma@talk21.com

Preventing Spam through false positives...

[Anonymous Coward]

One idea that I've not seen discussed very much is that of mass false positive attacks on spammers.

The business models of most spammers depend on a very small percentage of respondents wanting to buy their crap. So if the internet community decided to swamp these true positives with as many false positives as possible, e.g. people asking for more info, saying they want to buy something but repeatedly forgetting credit card info, generally getting into purchasing correspondence with the spammers but never buying anything... then the business model of many spammers dies!

Of course, this depends on many people willing to dedicate time and effort to engaging spammers, but think of the satisfaction...

good idea / bad idea?

Re:Preventing Spam through false positives...

[MImeKillEr]

I'm no programmer, but surely someone could come up with an automated way to handle this. Maybe an evolving-type automated response letter with variables defined as %n for spammer's name or return email address, %p for product they're peddling, etc.

In Defense of RBLs

[minas-beede]

I have been a very loud protestor about collateral damage in news.admin.net-abuse.email. I well understand the problem but I think you over-estimate it. SPEWS deliberately lists non-spam-source IPS - that's collateral damage, that's wrong and avoidable. Take that away and the remaining collateral damage is unfortunate but not severe.

Many have changed how they use RBLs - instead of simply rejecting they send a reply asking for confirmation the sender is a real human. If that confirmation is made the original message is delivered. That seems to be simple, straightforward, and capable of reducing collateral damage to a very low level. It even has intelligence behind it.

I advocate relay spam honeypots (and open proxy honeypots - move with the times, keep up with the spammers). The white paper doesn't even mention these. The WP has the section asking if open relays are necessary. Well, no, they probably aren't. Is there a point? For how many years has there been an effort to secure open relays? Has it succeeded? The fact is that they are there - asking if they are necessary may inform you but it doens't change the situation in any useful way.

For all these years the spammers have been given free access to the relay level - there's a self-satisfying division into the secure systems run by the wise and the open relays run by inept administrators. that division allows the operator of a secure system to condemn the operator of an open relay with confidence - he can strut. Yipee. As a spam-fighting tool it's a close to a complete bust. Well, yeah, lots of open relays have been secured. BFD - there's still enough for the spammers, and RFC 2505 said it would be this way. Yo: RTFM (in this case RTFRFC.)

You want to hurt the spammers? OK, hurt them. It's not like you have to go out of your way - accept and deliver one of their relay tests and the chances are excellent they'll send you spam that you can discard. That's still a secure system, but it has teeth instead of gums.

There's all these people falling over themselves devising elaborate filters. If you simply open up a relay enough to accept the spam but not deliver it there's no filter needed - a non-mail-server system that receives relay email receives close to pure spam - you will never get a filter as selective as that. Accept and deliver the relay tests and you have screwed the spammer. I won't even enumerate all the ways he is or can be screwed but there's a bunch.

If 5% of the Windows systems with network connections ran Jackpot then spam would be dealt a mortal blow:

http://jackpot.uk.net/

It isn't hard, and it does tremendous good. Check it out.

Re:In Defense of RBLs

[Dimensio]

SPEWS deliberately lists non-spam-source IPS - that's collateral damage, that's wrong and avoidable.

It has unfortunately become the only way to make crime-friendly ISPs take action. I don't see it as 'wrong and avoidable', I see it as the course of action taken by sysadmins who have been pushed too far.

Consider this. AGIS, long ago, decided to be an openly spam-friendly provider way back in the day before single unified like SPEWS or the RBL. Because AGIS had openly admitted their willingness to allow their customers to break the law and victimize innocent ISPs with their criminal behaviour, many ISPs threw ALL of AGIS into their blocklists, figuring (quite correctly) that nothing that came from AGIS needed to hit their networks anyway.
Spam didn't work for AGIS. AGIS soon learned that all spammers are theiving scum who wouldn't pay the bills, and they realised that hosting spammers wasn't profitable if it was well-known that AGIS was just a private intranet that couldn't reach anyone. As such, AGIS did a full about-face and became very much antispam, kicking off all of thier criminal spamming clients.
Unfortunately, so many individual ISPs had thrown all of AGIS into individual netblocks that there was substantial damage to AGIS's connectivity. Some admins removed AGIS from their filters, but in many cases AGIS's netblocks were put in by an admin who had long since forgotten why they were there (or one who had even moved on, leaving a new admin with no idea why certain IPs were filtered), or who just didn't care to remove them. As such, AGIS's netblocks were still filtered from a large percentage of the Internet and AGIS died the death of a thousand cuts.

With a centralized single listing system, like SPEWS, this problem goes away. If everyone simply filters against SPEWs then an ISP who is blocked by all of the world can clean up their act, get delisted, and instantly they will have restored connectivity because everyone is filtering against the same list.

Of course, many here on Slashdot don't seem to think that is a good idea. They would rather go back to the day when individual ISPs were filtering on their own personal lists because they cannot stand that their upstream is a crime-friendly provider and they're getting listed in SPEWS. They would rather have a system where they are guaranteed to be filtered forever in thousands of different lists rather than filtered in a single list that will be fixed once their upstream cleans up its act.

Re:In Defense of RBLs

[Anonymous Coward]

I have been running a JackPot honeypot for about 50 days now and have captured close to 2 million spam. In the last 29 hours, my honeypot ate over 120 thousand spam. Lots of it mortgage spam, natural viagra spam, make money at home spam. Some chinese language stuff from .tw open proxies.

Each message captured is evidence of theft of your computer resources. Depending on your state of residence, you might be able to have the crime prosecuted, or might even sue the spammer.

Eating honeypot flavored spam is FUN.

If you have internet access allowing port 25 access(allowing you to run your own MTA) an old (or new) windows machine, you can download a FREE copy of JackPot and have fun making Spammy waste his time and money.

Lack of permanent connection is not a bar. My LAPTOP computer has eaten over 10,000 spam in a day! I take the laptop home at night, and in the morning, as soon as I put it back on the network, the spammers are hitting away at it again.

If you think SETI@home is fun, running your own honeypot should be great fun. You can even do BOTH at the same time.

Each spam your honeypot eats is one (or more) spam that can't end up in someones inbox.

The 2 million spam that my honeypots have eaten is just a drop in the bucket, compared to what spammers are sending each day, but if everyone who reads this were to start running a honeypot, it would put a SERIOUS hole in Spammy's bottom line.

Get your own honeypot and good luck spam hunting.

Re:In Defense of RBLs

[elvey]

Looking at the jackpot dox, I don't see that it has a facility for sending LARTS* or submitting to DNSBLS, or content based filters. It doesn't seem to create a good source of data for training bayesian filters either.

*It has a facility for URLs to the logged spam for including in the DIY LARTS.

Re:In Defense of RBLs

[minas-beede]

LARTing is a tough question for Jackpot (although you really should ask the author about this - I'm only giving my opinion.) If the spam is coming to the fake open relay through an open proxy (it may be) then LARTing the owner of the open proxy is a nice heads-up for him. This will in all liklihood never reduce the number of open proxies enough to matter. If the source is the spammer, himself then LARTS should go to his upstream, if that is likely to be productive. I don't think you can automate the LART/don't LART decision well enough - you have to use human judgment.

I don't know about Bayesian training. Sometimes on my (non-Jackpot) honeypot I got waves of exactly the same spam. I'd think one sample is enough for training. I (and Michael Tokarev) also sometimes trapped spam in which it looked like different parts of the spam were selected randomly from two or more equivalent but different (in checksum terms) text versions. Have twenty binary choices for the wording in the spam message and there's 1 million+ variants, all with different regular checksums (I don't know about DCC "fuzzy" checksums.) What's the impact of having 1 million different forms of the same spam on a Bayesian filter?

Note that spammer games with the content have no effect on a relay spam honeypot - it isn't content-based. Relay email through random open relays is, for legitimate email, a thing of the past. Set up a fake open relay and there is no filter needed - the spammer does the filtering for you. Well, not exactly filtering, but pretty much anything the spammer sends through an open relay is guaranteed to be spam (even more guaranteed for something sent first through an open proxy.) If it comes it's spam. No filter needed.

If the sample collected by Jackpot is too uniform to be useful for training a Bayesian filter it's all the spammers fault. Of course the spammer doesn't know he's sending to a honeypot, so if he sends the exact same spam to a honeypot he probably sends the exact same spam to true open relays and will be caught just the same.

While there is spam it seems to me that anti-spam measures at every level are needed. As the relay level has been the property of the spammers for years it seems also that acting at the relay level will have a massive payoff. By all means continue with Bayesian filters. One of the beauties of honeypots is that they stop spam aimed at a broad specxtrum of recipients, including some truly clueless ones - ones who respond to spam, ones who would never have have the wit to use any filter. Maybe they even want the spam. Too bad - the spammer chose the wrong "open relay." His fault, not yours.

Scelson was sending direct spam - maybe he stll is. He's the sort I'd anticipate might sue a honeypot operator. There's some danger of dying of laughter if that ever happens - getting sued for not allowing theft of service to occur.

Working with the RBL idea.

[pheared]

You (ISPs) just need to modify your IP allocation policies such that you put all known spammers in the "ghetto" address range. Said range gets blocked by RBL, none of your more legitamate users notice. The spammers can't complain because they are breaking your AUP (you have a well-defined AUP, don't you?).

Wrong...

[artemis67]

People spam because it's dirt-cheap. If spammers had to pay 10 an email, you'd better believe they'd be a heck of a lot more cautious about who they send to.

And a "Stop Buying Spam Products" is doomed to fail, anyway, because it's a numbers game. If 1 person out of every 100 people spammed buys something, then it's probably an outrageously successful campaign.

The fact is, you may be throwing out 50 spam emails a day, but if you see a subject line that speaks to an immediate need, you're probably going to stop, read it, and consider a purchase.

Re:Wrong...

[Anonymous Coward]

That's like saying:

And a "Start Using Spam Filters" is doomed to fail, anyway, because it's a numbers game. If 1 spam out of every 100 spams gets through, then it's probably an outrageously successful campaign.

So by that logic, we shouldn't be using spam filters at all. They'll never stop all spam, so why bother?

Re:Wrong...

[anarchima]

No, because the spammers aren't making any money off you reading their email. They only make money if you actually _buy_ something. Therefore, blocking most (if not all) spam is still worthwile, just for the convenience factor. Your argument seems a little flawed.

Re:Wrong...

[Oloryn]

The fact is, you may be throwing out 50 spam emails a day, but if you see a subject line that speaks to an immediate need, you're probably going to stop, read it, and consider a purchase.

Maybe. But I won't consider purchasing from the spammer. If, unlikely as it seems, I see a spammed product that I might want to buy, I'd go and find some other company selling the product who doesn't spam, and buy it from them.

This way, perhaps, we can get Ralsky in jail ...

[mustangdavis]

This way, perhaps, we can get Ralsky in jail, and stripped of his money from the SPAM

So what you are saying is that we can get Ralsky put in jail, which will become his new company H.Q. ... and he will generate enough $$$$ spamming from jail to provide all of the prison population enough cigs and workout equipment that they will stop making license plates for us .... hmmmm ... this sounds like a bad deal for us (except if you'd like to make license plates) and a great deal for the inmates of our country ....

However, if he makes enough money spamming, we could use the money to make bigger jails so that we can imprision the other spammers ....

... this might work!

Alternative ...

[LL]

... see http://cr.yp.to/im2000.html

Re:Alternative ...

[Anonymous Coward]

It is 2002. Soon it will be 2003.

If he's annoyed, then it's working.

[?erosion]

Isn't this how a blacklist is supposed to work? I thought the idea was precisely to annoy the honest users, such that they complain to the ISP. If the users know that they are blacklisted because of a spammer, they are likely to either leave the ISP or pressure it to turn the spammer off. It's not nice, but the intent is to get results.

Re:If he's annoyed, then it's working.

[SN74S181]

Said 'honest users' can also become quite alienated from the anti-spam-zealot community. Which isn't necessarily a bad thing (zealots need something to give them an ego boost) but that's not really what the anti-spam-zealot community wants. (nobody really knows what they want, though some of them actually are just opposed to spam).

Re:If he's annoyed, then it's working.

[?erosion]

Said 'anti-spam-zealots' can also become quite alienated from spammers. Which isn't necessarily a bad thing (spammers need something to give them an ego boost) but that's not really what spammers want. (nobody really knows what they want, though some of them actually just want to make money at other people's expense).

Your move.

Re:If he's annoyed, then it's working.

[Anonymous Coward]

Every one of my email addresses is in some blacklist or another. (And no, I'm not a spammer!) Check out your smtp server's ip address at openrbl.org

If I move to another provider, will they stay off one of the lists for more than a week?

I did find one provider that threatens to charge me something like $1000 if someone accuses me of spamming. Gee, I guess they don't get many spammers (assuming the ISP is telling the truth - all the ISPs have some clause against spamming), but why would I want to run the risk of fighting a $1000 bill if there is some misunderstanding?

Re:If he's annoyed, then it's working.

[Phroggy]

Isn't this how a blacklist is supposed to work? I thought the idea was precisely to annoy the honest users, such that they complain to the ISP. If the users know that they are blacklisted because of a spammer, they are likely to either leave the ISP or pressure it to turn the spammer off. It's not nice, but the intent is to get results.

Some people want blacklists to work this way, and indeed it can be an effective strategy. However, a blacklist is generally supposed to work by just blocking spam, without getting in the way of the honest users on systems that are NOT being used for spam.

If there's one open relay on a subnet and I want to block open relays, then that one open relay should be blocked, so I don't get spam. I still want to receive mail from the other 200 servers on the same subnet. Yes, blocking the other 200 will force the ISP to take action, but maybe the ISP would have taken action anyway? Maybe there's a better way to get them to take action? Maybe I want an RBL that will not list innocent servers such as those 200.

Re:If he's annoyed, then it's working.

[?erosion]

You're right. The approach you describe would provide the same benefit but would not jeopardize the connectivity of the innocent. I suspect the primary reason this isn't done is because it's simply too much effort. The listing authority would probably have to investigate every server on the subnet for legitimacy before listing the offenders. Another problem might be that if a spam server is blocked, another could just pop up in its place on the same subnet.

In other words, I agree the approach is heavy handed, but circumstances seem to dictate its use. I'm not an admin, so I can't be sure. But if this is indeed the case, we can console ourselves by knowing that pressure will come to bear on the ISP from its customers... one way or another.

Re:If he's annoyed, then it's working.

[AndroidCat]

Yes, blocking the other 200 will force the ISP to take action, but maybe the ISP would have taken action anyway?

If they take action, they get off the list. If they had taken action in the first place, their other 200 probably wouldn't have been listed in the first place.

Re:If he's annoyed, then it's working.

[SN74S181]

I would assert that most spammers engage in their dubious activity for raw commercial reasons. Many anti-spam zealots, on the other hand, seem to have a lacking in their life. Something to get angry about is needed, a conquest to fight, and spam is rather annoying.

Re:If he's annoyed, then it's working.

[Anonymous Coward]

When did 'honest users' become spammers? Oh, right...that whole bit about being on an ISP that gets their service from another ISP that happens to also have some clients that send spam means that you're "supporting spammers". Too bad it's not always possible to determine that sort of thing before you buy access...and these sorts of things tend to come with long-term contracts if you want good prices. But hey, it's real easy to change providers, and the financial and technical resource burden of doing so should rightfully be placed on those bastards that just happen to use the same ISP as some spammers, right?

Fuck that.

Re:If he's annoyed, then it's working.

[Anonymous Coward]

The main purpose of a blacklist is to protect the networks of its users. Any pressure put on lax ISPs is secondary. That is why lists like SPEWS show individual IP blocks instead of showing every block owned by the provider.

Note that this is even more true of private lists. Those tend to be add and forget, or IP blocks check in, they don't check out, a mode of operation that would drive users away from a public list. The operator of a network generally does not like to spend time maintaining his list, and has no incentive to periodically reevaluate an offender once he has added it.

Re:If he's annoyed, then it's working.

[cmacb]

"Isn't this how a blacklist is supposed to work?"

While I see your statement has been countered by someone already, you are correct. If you read the news group news.admin.net-abuse.email as well as the several web pages that they refer people to they make this precise statement.

IMHO the SPEWS argument is rather circular:

(1) We just maintain a list, no one has to use it.
(2) If your ISP is either on the list or uses it then its your responsibility to find another ISP.
(3) If you are having trouble finding an ISP that is neither on the list or using it, then go back to (1).

So, while it can't be demonstrated that the black hole lists are responsible for any reduction in SPAM, the maintainers of the list disclaim any responsibility for any of the bad effects that they DO have.

They delight in being hard to deal with too. We all know people like this in real life. Of the two choices I'd much rather have the SPAM than the SPEWS. I can easily filter my own SPAM, I can't easily avoid the effects of black-holed email.

I also wish they would focus their energy in reducing my real junk mail. I'd save a jumbo size garbage bag a week if it were not for unsolicited real mail. A much bigger problem than SPAM for anyone interested in the "big picture". I bet almost as much bandwidth has been used TALKING about SPAM as has been saved by the efforts to stop it. Some updates to the SMTP specs would do a lot more to solve this problem. But then...what would the SPEWS people do for kicks?

Re:If he's annoyed, then it's working.

[?erosion]

I also wish they would focus their energy in reducing my real junk mail. I'd save a jumbo size garbage bag a week if it were not for unsolicited real mail. A much bigger problem than SPAM for anyone interested in the "big picture". I bet almost as much bandwidth has been used TALKING about SPAM as has been saved by the efforts to stop it. Some updates to the SMTP specs would do a lot more to solve this problem. But then...what would the SPEWS people do for kicks?

The key difference is that the junk mail you receive has been paid for by the party that sent it, and more importantly, said party is accountable for it. You can easily eliminate junk mail by following a few steps listed on junkbusters.com. Additionally, junk mail is held to certain standards. Imagine opening your mailbox and finding a postcard with goatse man on it!

Backing up a bit...

(1) We just maintain a list, no one has to use it.
(2) If your ISP is either on the list or uses it then its your responsibility to find another ISP.
(3) If you are having trouble finding an ISP that is neither on the list or using it, then go back to (1).


I'll leave the profit jokes for someone else. However, it looks like you made a typo in the list. Let's see here:

(1) We just maintain a list, no one has to use it.
(2) If your ISP is either on the list or uses it then its your responsibility to find another ISP if you don't want the protection a blacklist provides. :P
(3) If you are having trouble finding another ISP, contact your current ISP and demand they fix the problem.

I'm sure mistakes do happen, but the ISPs are probably on the list for a reason. If they take steps, they can get off the list. I'm sure the reason SPEWS is hard to work with is that they have been lied to many, many times.

And a philosophical angle, if I may. People don't focus on this much, but it's important to realize that any discussion of spam is going to get heated. People detest spammers because they behave in an atrocious manner.

"Check it out dude; I'm going to send, like, a billion ads for troutsex.com to these people that were stupid enough to type their email address somewhere. Get this: I pay $11.95 a month for a dial-up and shell account, but those suckers at troutsex are paying me a hundred bucks now and ten clams per response, regardless of whether they get any sales! And get this Bob; the beauty part is, nobody can stop getting my messages, even if they want to, because I'm using fake headers and a throwaway MSN account! I'm totally unaccountable! The vast majority of internet users will suffer so that I alone may grow richer! Say, would you like to eat some of this delicious baby?"

Re:If he's annoyed, then it's working.

[cmacb]

"I'm sure mistakes do happen, but the ISPs are probably on the list for a reason. If they take steps, they can get off the list. I'm sure the reason SPEWS is hard to work with is that they have been lied to many, many times.

And a philosophical angle, if I may. People don't focus on this much, but it's important to realize that any discussion of spam is going to get heated. People detest spammers because they behave in an atrocious manner."

Thanks for "correcting my spelling", but my evaluation was based on reading the (mostly) SPEWS oriented newsgroup for several weeks and also visiting their various web sites in an effort to understand how the system worked.

What I saw there was a lot of taunting, making fun of people's grammar (and spelling). Thinking that since "anything goes" in a newsgroup I went to web pages that were created in support of the black-hole lists and found more of the same. I hate spammers, and I hate biggots, and these people act a whole lot like biggots as far as I can tell.

Most importantly, you did not address the issue of effectiveness. I have seen no evidence that these measures have diminished SPAM *at all*. SPAM is on the increase (even in a drastically reduced internet economy).

I think the concept of going after open-relay mail servers is excellent. The black-hole lists got started that way, and established their good reputation that way. The next step should be to propose mechanisms that make it impossible to generate anonymous email messages at all. Once such a protocol exists, the black-hole lists could be used to encourage ISPs to adopt such protocols quickly.

The only people getting angry about SPAM are the vigilantes, the victims, and the inocent bystanders. The SPAMers are still laughing all the way to the bank.

Re:If he's annoyed, then it's working.

[melonman]

The result it gets in my case is that before, I was considering doing my bit to block spam, and now I won't, because the people who run RBLs seem more intent on hurting me than the spammers. And I reckon there are a lot of people like me. Is that how the system is supposed to work?

Re:If he's annoyed, then it's working.

[minas-beede]

Please. One DNSBL intentionally blocks non-spam sources. I agree - they're wrong in that.

Your question is a good one. No, I don't think that's how the system should work - it's dumb. But you have other options in DNSBLs than SPEWS and you have other options in fighting spam than DNSBLs. I can't prove it, I wish it weren't so, but it may be every large effort not carefully controlled by a central authority will have its share of participants that are imperfect. That doesn't tar the entire effort, does it? Don't fixate on the guys screwing up - there's a lot more guys that aren't screwing up.

I can only guess but I think I know who three of the SPEWS people are. Two I've seen posting - reasonable chaps, mostly, from what I saw. the third I think is also reasonable, mostly, but there I'm more guessing, partly on the basis of another thing he does. Even SPEWS is pretty good - they have this one quirk that diverts attention from all the rest they do that has merit. So be it - it's their choice, but I recognize they aren't all bad.

Re:If he's annoyed, then it's working.

[melonman]

That doesn't tar the entire effort, does it? Don't fixate on the guys screwing up - there's a lot more guys that aren't screwing up.

I'm fixating on the system that blocked my IP address for no reason other than to get me to put pressure on my ISP (which I didn't, out of principle).

Before this, I had never heard of SPEWS, so my first contact with them was when they blocked my IP address. As cold calling methods go, I think I prefer spam :-)

I'm sure the people running the list are dear people with lovely families and a big cuddly dog, but the one little detail of using mafia tactics against me leaves a bad taste in my mouth. Sorry, but that's how it goes. I agree with most of what animal rights groups say, but they lost my support with the first nail bomb. Ditto a lot of single issue pressure groups.

What really impressed me about our IP block was how little difference it made. We had one complaint from one user on one of our domains. Given that this domain has 400 email addresses redirecting to 50 or so ISPs in 20 countries, this suggests that an awful lot of people aren't using SPEWS. And I think I know why :-)

Re:If he's annoyed, then it's working.

[minas-beede]

You have described the situation perfectly - I hope many people see and understand what you say about SPEWS (including those who run SPEWS). My point was that most DNSBLs don't do the idiotic blocking of non-spam sources.

Not only do I have no quarrel with what you say I think what you say is on the mark and extremely well said.

Thanks.

See?.

[Anonymous Coward]

See? More jails and the only food served would be...yep, Spam. all day all night Spam and water.

Actually I favor prisons being just that. Small rooms that are cold in the winter and hot in the summer. Hard, matressless stainless steel sleeping quarters. No TV, no nothing. No exercise! Just Spam for breakfast, lunch and dinner.

Happy gnu year/millenniun

[Anonymous Coward]

The best is yet to come.

if you're not familiar yet with the good gnus, you may want to first acquire a browser that doesn't: begin to eXPloit you, &/or, "redirect" you, to the FraUDuleNT pourtolls of the stock markup hostage ransom scam liesense peddlers.

no phony DOWts any more?

ucann go over to father william's "free" hostdead session, if you knead this FraUDuleNT /.charade to .continue. you KNOW what to do, robbIE? @40?

Re:Happy gnu year/millenniun

[Anonymous Coward]

Friendly_fire,

Get an account so you may be properly modded down.

Better yet, just STFU -- those of us who support OSS projects don't wish to be associated with trolls.

It weould be really entertaining to see www.zenosoft.com get scragged.

Simple

[stephenbooth]

Instead of running your mail server on a PC running Linux or a low - mid range Sun/IBM/HP/whatever box you have to run it on a Beowulf cluster of E10,000/s390/V-Class/Indian Supercomputers. Perfectly scalable, it's just that your hardware and support costs have gone up by several orders of magnitude.

Stephen

html coding

[Anonymous Coward]

Quirks mode instead of standards compliance mode! For shame!

Author seems not to get it

[theLOUDroom]

A huge amount of spam is being sent through unsecured relays in Asia and South America. Consequently, an overwhelmingly large percentage of the hosts listed on RBLs are in fact based in these countries (see Wired article: Not All Asian E-Mail Is Spam). This amounts to nothing less than discrimination and isolationism that is being used to slowly cut off countries that have a critical importance in global matters

Obviously, if a huge amount of spam is coming from a huge amount of servers in a country, a huge amount of servers in that country are going to get blocked.
How about we drop the sensationalism here?
It's not some conspiracy to block all mail from Asia.

Look, maybe some people need to get mail from Asia, but I don't have any reason to. I'm not obligated to let anyone on the internet contact me at will. I can pick and choose who to block/accept at will. If people in don't want their servers to get blocked, maybe they should deal with their spam problem. I don't have time to fix it for them.

Look at it this way:
The internet is this huge shared network. It has a finite amount of bandwidth and it works because everyone carries data to its destination.

The question here should not be if any nodes should ever get blocked. The question should be: How much junk traffic should a single node on the network have to generate before it happens?

At some point you have to start blocking people. If I start DOSing an email server (almost what spam is), I can expect to have my traffic blocked at some point. Maybe I have to send a million junk messages, maybe a billion, but at some point it's costing too much to carry and process my traffic. Yes, bandwidth costs money. That's just the way a system like the internet has to work. There have to be mechanisms in block to handle the case were a node starts misbehaving. One of those mechanisms has to be dropping traffic from that node.

Carrying junk traffic costs money. Filtering costs money. At some amount of traffic, the cost becomes too high, and you have to block the traffic. Think of it as a signal to noise ratio. There always needs to be some number, at which you pull the plug, because the data isn't worth dealing with anymore.(And filtering it is too expensive)

Any time you share something you're going to need the ability to do this. If I start driving in the middle of a two lane highway, I can expectect to get pulled over and have my license revoked (eventually). It should be. I'm messing up things for everone else and the sensible way to fix it is to remove me.

Re:Author seems not to get it

[Anonymous Coward]

I have a simple question:

Why the fuck is it so difficult for Asians to secure their fucking mail servers?

Re:Author seems not to get it

[WetCat]

Heh, because information about security is in English and they are not very proficient in it...

Re:Author seems not to get it

[Anonymous Coward]

Then they should write localized systems and documentation for their operators to read.
Not the problem of English-speaking people.

Besides, the language issue cannot be the problem.
When these stupid Koreans and Chinese would even UNDERSTAND there was a language problem, they would not send all that spam in Korean or Chinese. I think they are just too dumb to understand this.

Re:Author seems not to get it

[Anonymous Coward]

I'm not obligated to let anyone on the internet contact me at will.

Of course you are correct. You can block all the even numbered IP addresses, and it won't bother me. The issue is that these blacklists are too widely used without all the end-users consenting to what is getting blocked. We need to stop the spammers without destroying email in the process.

Re:Author seems not to get it

[Zontar The Mindless]

> Look, maybe some people need to get mail from Asia...

Such as yours truly. My livelihood depends upon it, in fact. Your right not to receive email from India shouldn't interfere with my right to receive it. Nor the reverse.

Spammers suck, not only due to the annoyance factor and the bandwidth they waste, but the dissention they provoke among legitimate users. Hang the bastards.

(Um, hang the spammers, I mean -- not legitimate users.)

How to really stop spammers...

[MarkedMan]

Flood them with responses. A volunteer organization which floods them with answers. Not the answers they want, but answers they nevertheless have to take time to deal with. The trick is not to make spam impossible, but to make it unprofitable.

and a potential solution. Recently, I read an interview with a spammer. She said that she could make a profit with a response rate of .001 percent. That's right, .001 PERCENT. Our anti-spam measures actually help her target the gullible. But what if she had a response rate of 1 percent? She sends out millions of spams per day. Say she got 10,000 replies (or her customers did.) Not buying their dreck, but instead asking for more info or some such. Would they be able to find the legitimate responses in the deluge?

Re:How to really stop spammers...

[minas-beede]

Yes, and didn't she lie (like Ralsky) and say she didn't send porn spam? You are talking about the gal in Florida ho spammed from home, right?

Re:How to really stop spammers...

[Anonymous Coward]

1) Most spammers don't provide a valid email address to respond to, however many do provide a 1-800- number. How about a daemon dialer that dials that 800 number once per minute? If a thousand people ran such daemon dialers, the spammers couldn't afford their telephone bills. 2) If you want to legislate the spammers, legislate the companies that utilize their services. You might not be able to find the spammer, but you can easily find the company selling mortgages, or small race cars, etc. Hold *them* responsible and fine them.

Re:How to really stop spammers...

[nickdman]

GANG RAPE THEM?!?!?!?!!?!?

Sheer amount of collateral damage

[MerlynDavis]

I work in tech support at a major ISP. At least twice a day I get a call from a customer who either has a friend who's e-mail was blocked, or is getting their e-mail blocked. I spent a week hearing from the same customer every day about their travails with our abuse department. Their friend lived in a small town in Canada with limited ISP's. Their friend spent six months ISP-hopping, having to notify everyone about their new e-mail address, etc. and then waiting for the local spammer to find that ISP and having to repeat the process. Some sort of more advanced filtering process is desperately needed. Blacklisting entire netblocks isn't going to stop spammers, as they can always find a new way to spam (see the new trend in Windows Messaging system spam). It's the legitimate users who get hurt. Better filtering technology will help, but I'm still in favor of charging users for e-mail. Once the profit margin is reduced far enough, spam will cease.

lazy freeloading eyecons

[Anonymous Coward]

point taken. now we're up to -40.

Solution for dial-up ISP's problems?

[MickLinux]

blockquote: This [RBLs against dialup ISPs that source spam] puts undue pressure on a potentially responsible ISP and causes a disproportionate amount of inconvenience on the part of the affected ISPs customers. Why are they being punished? Should they automatically have to shop for a new access provider, reconfigure their computer and inform everybody in their addressbook of the new email address provided by the new ISP? Large ISPs are almost always going to be immune from RBL operators. If an RBL operator was to put the smtp servers of AOL, Earthlink, AT&T and a few other cable providers onto the RBL, the value of the filter would be reduced and many users would start wondering why they can no longer communicate with users at these large ISPs. RBL usage necessarily hurts small and medium size organizations whose proportional value in the network is small but who can easily be damaged by being listed on an RBL.

It occurs to me that one way to avoid the spam is to keep a record of all outgoing emails on the backup servers, for (say) 1 week. Also, don't take accounts without a real, physical address, phone number, and either a real name or a corporate identity.

Finally, part of the user agreement should be that "if you send spam through us that gets us put on an RBL, you agree to pay damages of $1 per spam sent, $10 per spam if the number of spam emails was over 5000". Do that, and you can collect after a while.

As for me, I've found that I can set my Mozilla to block emails that contain the words "opt-in". Usually it works, but sometimes Mozilla misses it. I'm not sure why.

Re:EFF says to do the impossible

[wayne]

Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

This sounds so nobel, but there isn't any system out there that won't have ANY false positives. Some false positives are just more obvious than others.

For example, the common technique of not letting your email address out in the public means that people who you would like receive email from (and vice versa) will often never happen because you don't know how to contact each other. Sure, this doesn't generate a bounce, or an error message, but it still means that this "solution" to the spam problem has interfered with legitimate email.

If you switch email addresses when old email addresses get too spammy, you will lose email from people who don't know about your new email address.

If you obscure your email address to try to prevent bots from collecting your address will also prevent some people from figuring out how to email you. The same goes to email responders that require the sender to prove they are human before the email gets through.

Blacklists are judging everything based off an IP address and that can't possibly have no false positives.

Filters will trigger on keywords when the keywords aren't used in a spammy way.

I propose a different goal: People should be allowed to deal with spam any (legal) way they want. They can choose the method(s) that create an acceptable level of false positives for them. If you can't send email to them because they have made a choice, DON'T WHINE ABOUT IT.

I personally use spamassassin with modified DNSBL checks and RAZOR enabled. I have used DNSBLs before the block all email, but decided that created too many false positives for me, but I respect the choices of other people.

Oh yeah?

[select * from]

I just added 3 inches to a part of my body, refinanced my mortgage for 4%, took care of my baldness, and made thousands thanks to a giving man in Zimbabwe.

It couldn't have been easier.

Re:Oh yeah?

[AntiNorm]

and made thousands thanks to a giving man in Zimbabwe.

Thousands? I've got some friends in Nigeria that have hooked me up with MILLIONS.

Great Article, Bad Law Idea

[Anonymous Coward]

" [National Laws] [s]hould be enforceable across borders - spam sent by a spammer in country A to a user in country B should constitute a crime in country B if it violates country B's anti-spam laws. Accordingly, the user in country B should be able to sue the spammer in country A. This is likely incredibly difficult to orchestrate, but nevertheless it seems like a worthwhile goal."

While the article was very interesting, it seems that this Property of a Real Solution is not fully cooked. Nations, States, and Unions are defined by their laws and by the territorial boundaries over which those laws are operative. Removing the jurisdictional considerations from the law removes the basic tenet that one must have notice that any particular activity is criminal.

There is the saying that "Ignorance of the law is no excuse." This proposed legal solution requires not just knowledge of the law of your State of residence, but of every other jurisdiction in the world as well. That is indeed an untenable proposition, as there is unlikely any person alive that knows the laws, rules, and regulations of every jurisdiction.

While UCE is annoying, it is nothing special from a legal perspective. A *solution* to UCE (or any other annoyance) is not worth the consequences of a legal theory that subjects every person on the planet to every law on the planet.

We need better mail clients

[PackMan97]

1. Don't let a spammer verify your email address

This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.

The easiest solution to this is to use a mail client that supports PLAIN TEXT as an option to view all mail. I'm currently switching over to Mozilla Mail for this very reason. It's easy to do the following: View->Message Body As->Plain Text.

Violla, problem solved. Try that in Outlook, Hotmail, or Yahoo?

In addition my mail provider (pair.com) uses SquirrelMail for their web interface which has a handy feature: "Display Attached Images with Message" -> Set it to NO. SquirrelMail also allows you to chose plain text or HTML as the default view for mail.

The best way to protect yourself is to find mail clients that work with you, not against you. Evil Outlook Preview is a great example!

Re:We need better mail clients

[fanatic]

It's easy to do the following: View->Message Body As->Plain Text.

Violla, problem solved. Try that in Outlook, Hotmail, or Yahoo?


If using hotmail or yahoo on your browser, turn off images and javascript in email. This stops the client from acting on any URLs in the mail (i.e. 1x1 images), hence your address doesn't get verified.

Re:We need better mail clients

[platos_beard]

Ummm, its not that hard in Outlook Express either

Tools->Options->Read tab

[x] Read all messages in plain text

"email authentication" == "blacklists"

[wayne]

I believe that the way to stop spam in the long term is to deploy signed email ubiquitously. Self signed certificates are sufficient for this purpose if we can provide a lightweight authentication via a DNS-linked PKI.

SMTP already has a good way of authenticating who you are receiving email from. It is called the IP address of the machine that is contacting you and the IP sequence numbers of the packets that have to travel between you. All you need is a list of the IP addresses of the people who you want to receive email from and a list of ones you don't.

But, of course, this is what the current blacklists do!

Any email authentication system is going to run into most, if not all, of the same problems that DNSBLs run into. They are also going to have the problem of trying to get the entire world to change.

Re:"email authentication" == "blacklists"

[Zeinfeld]

SMTP already has a good way of authenticating who you are receiving email from. It is called the IP address of the machine that is contacting you and the IP sequence numbers of the packets that have to travel between you. All you need is a list of the IP addresses of the people who you want to receive email from and a list of ones you don't.

Actually this approach is regularly proposed but actually it is more complex than that. The problem is that there is no single model for using SMTP and SMTP certainly does not provide one.

In particular a large amount of email is sent from machines that have no connection to the host name the email is purported to be from. Most unix mailers simply send the mail direct.

Any email authentication system is going to run into most, if not all, of the same problems that DNSBLs run into. They are also going to have the problem of trying to get the entire world to change.

I have helped do that before, your posting to slashdot is demonstration.

What is needed is a scheme such that the incentive to opt-in is greater than the cost of opting in for all network sizes. I believe that there are ways of promoting the authentication approach that have this property.

The problem with network effects is that they cut both ways. Whenever someone talks about viral marketing I short their stock unless they can show that there is a significant benefit to opting in before the network exists. Otherwise your 'network effect' is really a chicken and egg problem.

Re:"email authentication" == "blacklists"

[rocur]

No, IP addresses as signatures don't work. My company (PublishMail) manages e-mail newsletters for major newspapers around the world (Detroit News, Chicago Sun-Times, Jerusalem Post for example). We do confirmed/double opt-in on all of our lists. Due to the volume of e-mail we send, we have multiple servers, each with it's own IP address. There is no way for a subscriber to know what IP address our e-mails will come from, they change dynamically based on load. If there were a standard way to digitally sign our e-mails, we'd implement it in a flash.

Re:"email authentication" == "blacklists"

[Anonymous Coward]

How about GPG?

Re:"email authentication" == "blacklists"

[Zeinfeld]

There is no way for a subscriber to know what IP address our e-mails will come from, they change dynamically based on load. If there were a standard way to digitally sign our e-mails, we'd implement it in a flash.

For your particular application (sending messages from a newspaper) I would suggest that you go to a Certification authority such as VeriSign and pay the $20 a year it costs to register for an S/MIME email certificate.

I am not suggesting that as a general solution to spam since any 'solution' that depends on senders spending $20 is going to have takeup problems. However for that application you should do the job properly with an email certificate that is going to be automatically recognized by the email clients.

S/MIME is an IETF standard and is supported by Lotus, Microsoft and Netscape and has been for 6 years now. It works fine for signing content. If you send a signed message the recipient's email client will display a little seal.

The only major client this does not work with is Eudora where the problem is that the provider appears to have completely abandoned further development efforts 5 years ago. I can't do anything about that, sorry.

The part that is not quite finished on the standards track at the moment is a mechanism for locating certificates so that you can send an encrypted email. This is a little tricky since you need the recipient's certificate before you send the message. I have been promoting a scheme called DNS linked PKI which uses the DNS SRV record as a means of finding the certificate repository that can provide you with a key for the relevant email address. This is very close to done and since SRV is already deployed is not an infrastructure issue.

Note you can also do the same with PGP (I describe how to do that in the XKMS spec). However PGP is pretty good privacy and not very good authentication. The problem is that I don't have very strict criteria for choosing an encryption key when the alternative is to sent the message en-clair. If I really care about confidentiality in a particular instance I will authenticate the key directly. That does not really hold when it comes to authentication since the point of the authentication is that I will take a different action as a result. So there is a threshold effect.

For the purposes of blocking SPAM a self signed certificate with the minimal authentication that retrival through a dns-linked pki confers is adequate.

In Soviet Russia

[peterpi]

They tell you what the fuck RBLs actually are before moving beyond them.

Re:IN SOVIET RUSSIA

[tigga]

The Anti-Spam Nazis block YOU!

Hey, It's happening everywhere!

email that isn't

[zogger]

--well, wish I knew what I was talking about here, but I'll try anyway, perhaps someone will recognize what I'm trying for. It might even exist for all I know.

I see spam as being an email protocol problem as much as anything else. Too easy, too easy for bots to get addresses now or guess them. The spammers are like drunk drivers on their 15th DUI, lost their license long ago, but are still on the roads. the deal is, we don't really have any road control, there's no traffic cops (and don't want them thankew). So, we need "new roads" that people can use to send "electronic mail" to each other that ISN'T something in common use yet. It needs to be setup so that only people that are trusted by anyone "you" can use. It's this name@someplace.com. See that @ symbol? How about a replacement, and some sort of new way to start "electronic mail" from scratch and build trusted private networks for correspondence, and something that didn't use that @ symbol?

Yes I know this is probably naieve, don't know how to describe this better though. Is there such a critter in existence? If I was living in a floodplain, and had to constantly add to the sandbag piles to keep the water out, and it still leaked all the time, well, I'd just move someplace better. I see the email problem now to be just that, never ending war with spam, anti spam, anti anti spam, anti anti anti spam, etc. I'd rather scrap the whole email thing as it stands and start over with something "better", move OUT of the floodplain. So, I'm asking, where's the "high ground" to move to?

How about this?

[rutledjw]

I agree with you. Look, all SPAM^h^h^h^h e-mail from Asia may NOT be SPAM, but we need some way to protect our networks from this flood of crap...

May I be rejecting legitimate e-mail if I block China.com? Absolutely. As a matter of fact I hope I do, I hope I block a whole bunch of them. Further, I'll tell them why.

"The network you're using sends an unacceptable amount of SPAM, there is a plethora of open relays and nothing is being done about it."

China.com admins may not give a rat's ass if I bitch and complain. But if their customer base goes ballistic because their service is unusable for this reason, then something may happen. The best solution? No, the best solution is to drag out and kill:

• Spammers
• Every idiot who's purchased herbal penis enlargement and HGH

IMHO

Here's a mirror

[Anonymous Coward]

Posting this as AC to avoid doubling up on the Karma. Sorry for the weak IIS server on a DSL connection I used on the original post. Here's a Linux box on a fatter pipe (but still slashdottable):

1. Don't let a spammer verify your email address

2. Don't post your email address on the internet

3. Secure your email client

4. Avoid common email traps

5. Fight back

-Lunar One (91127)

Re:This way, perhaps, we can get Ralsky in jail ..

[minas-beede]

Ralsky. He says, in a Detroit Free Press interview, that he has 50 spam servers in Dallas.

http://www.freep.com/money/tech/mwend22_20021122 .h tm

Just try to get the ISPs in Dallas to act with integrity, seek out the spam servers (they should leap out in any traffic analysis) and shut them down. The DNSBL's are close to useless here, it seems. Ralsky spams from Dallas using asymmetric IP routing: he spoofs the IPs of dialup systems from the servers. If anything gets nuked its the dialup account, not the high-speed-linked system that actually sends the spam (the dialups only receive the return packets from the systems that receive the spam.)

(Maybe Ralsky spams from Dallas differently - earlier this year he surely was using the asymmetric IP approach. Ralsky did lose throwaway accounts on three different ISPs because of the actions of one honeypot operator: Michael Tokarev in Moscow. Unfortunately Michael shut the honeypot down in July:

http://www.corpit.ru/cgi-bin/h0n5yp0t )

Getting Ralsky in jail wuld be nice, and he deserves it. Before that it would be effective to so disrupt his spam operation that he experiences a negative cash flow. Honeypots are the way:

http://jackpot.uk.net/

Setting up the honeypots is the first step. Once enough are intercepting Ralsky spam notify the spam advertisers that huge amounts (don't tell them the actual amount) of their spam is being intercepted. Get them in billing disputes with Ralsky. If they also see sales going down (as they should) they may have a flash of intuition that tells them spam doesn't work any longer, and the interceptions are the reason.

But don't stop doing what works for you, of course - add in the honeypot for its effect on the spammers beyond your own system.

It's a Real-Time-Blacklist

[Anonymous Coward]

numbnuts.

Kinda like the one you're on for employment.

DNSBL Fallacy #1

[mrneutron]

'SPEWS is bad, so DNSBLs are bad!'

Wrong. I use DNSBLs to block 10,000+ spams/week aimed at my users. I was using static relay REJECTs via the sendmail access file, but could not keep up with the torrent and increasing user complaints.

Aside from the obvious potential waste of time and bandwidth those 10,000 spams represent, much of it is obscene and sent by criminals.

I also track rejected mail and whitelist relays when necessary. This system works very well.

I chose not to use SPEWS due to collateral damage concerns. It's my call. If you are a postmaster, it's your call as well. One size does not fit all. DNSBLs are an invaluable tool.

RBL's can help spammers

[bdsesq]

I am admin/postmaster for a small college. Several months ago a new hack was developed that got through my version of sendmail. This was kind of ok because the spammers didn't know I was vulnerable.

Along comes one of the RBL's and test my site. So far so good. But instead of sending an email to postmaster@the-blocked-site they post my IP and a sample of how to use my system to forward spam.

Several days later, on a weekend of course, the spammers started using me. The spammers aren't stupid either. They use the RBL's to find new relays.

I have fixed the problem. However, one small email notification would have prevented several hundred thousand spams. I wonder how many sites have been used this way?

Re:RBL's can help spammers

[Anonymous Coward]

The operators of open-relay lists used to send notifications to postmaster. They were accused of spamming, so they stopped. Unless and until there is an accepted means of notifcation, don't expect them to start again.

And this is why the EFF aren't getting a donation

[UdoKeir]

Email is protected speech
That may well be so, but my choice not to listen to that speech is also protected.
If I want to block any and all email coming in to my server I will do so. If I choose to let another entity (like an blackhole list) tell me which email to block I will do so. This is my choice.
For an organisation with such high ideals, the EFF is really clueless with regard to this simple point.

Stop talking smack

[Anonymous Coward]

So I go and kick them in the head, tell them how stupid they are.

No you don't. People around you are probably not as "savvy" as you and don't feel the same way about spam (i.e. care enough to be meticulous), so they're not as anal about hiding your address (or anyone else's).

Sure, you get bitter when you get that first bit o spam, but it would be pathetic to call these people stupid. And I doubt that anyone who posts to /. has ever come close to kicking someone in the head. Getting kicked in the head, probably......

The whole of his argument

[Russ Nelson]

The whole of his argument is "there might be collateral damage". Well duh! Choose an DNSBL (Note: RBL is the name of a specific DNS Blocking List) that has a policy against collateral damage. Some do, some don't. He's complaining that collateral damage hurts innocent parties. Well, he's just done the same thing he's complaining about by damaging the reputation of DNSBL's that don't do collateral damage.
-russ

Re:The whole of his argument

[minas-beede]

As one who has argued long against collateral damage in NANAE I heartily agree - don't use a DNSBL that causes collateral damage. As far as I know only SPEWS does, and most SPEWS defenders cite the blocking success of SPEWS as the reason to use it. Most of these can't seem to grasp the difference between blocking spam from spam sources and blocking legitimate email from non-spam sources but you have to figure the SPEWS people recognize the difference - that's what matters most. SPEWS could give up blocking of non-spam-source IPS and hardly make any change in their effectiveness. If it weren't for its policy of sometimes blocking non-spam-source IPs SPEWS would be an excellent DNSBL (it is, anyway) without any taint of unfair damage.

If you want to get a message to an ISP or to the customers of an ISP: send a message. Don't assume the right to screw with their legitimate email in order to get their attention. It pisses off large numbers of the ones affected and has little practical effect. It is arrogant to assume the need and the right to act in such a brutal manner. SPEWS is over a year old - see any improvement due to their actions?

Move on. It's a failed approach. Let block lists do what they do (block spam sources) and quit trying to make them into a persuasion tool. It isn't working, it isn't helping.

Collateral Damage?

[blowdart]

My ass

Once your ISP allows people to test then maybe you'll get off the list of IPs that block open relay testing.

RBL results : 127.0.0.4, Test blockers: Null routed all access

So, exactly why is you, or your ISP afraid to be tested? Oh I see, your stance may be relay testing may well be illegal. Well tough. If someone turns up at your turn and asks for entry you would ask for identification. Your IPs stance in banning relay check connections is equivilant to not producing identification, but demanding entry anyway.

Until you can prove that you're not a spammer then don't expect your RBL status to change, and for those people that block on that status, you won't get through.

Re:Collateral Damage?

[minas-beede]

Afraid to be tested? Expand your mind and your understanding. I ran an open relay (with, heh-heh-heh, special features) and I ASKED ORBS to test me - I WANTED to be listed.

There's two things you need to understand:

(1) While it was an "open relay" the "special features" blocked spam.

(2) At the time I did this ORBS was so little used by systems with which my users communicated by email that there were virtually no valid messages blocked.

Part of my collaboration with ORBS was an effort to try to see if being on the aged-ORBS list attracted spammers. I never had enough data to find out if it did or didn't, but I did get lots of relay spam to whack.

I had to grow up myself to get the good sense to ask to be tested - I started with the attitude that ORBS was an arrogant intrusion. Once I thought of ORBS as my friend I could see how we could work together to fight spam and possible defeat it. Isn't that the goal? I tire of "solutions" that aim no higher than to have a tolerable situation for oneself while spam continues rampant. Don't you?

Re:Collateral Damage?

[Anonymous Coward]

So, exactly why is you, or your ISP afraid to be tested?

I'm not afraid to be tested, I just block EVERYONE who tries to use my servers for relaying. Period. You try it once, you go into the list. You've heard of "automation", I assume?

Until you can prove that you're not a spammer ...

You've not heard about the problems proving a negative, I guess, along with not knowing how to match your verbs to your subjects. Bye.

Re:Collateral Damage?

[Anonymous Coward]

I block because I find blind testing rude.

If you are going to test my host, I wanna see an e-mail to postmaster. And I wanna see a copy of the 'spam' comming from my host.

If you can't be bothered to have proof and ASK PREMISSION, then you are just a rude a fuck as the spammers.

Re:Collateral Damage?

[schon]

I'm not afraid to be tested, I just block EVERYONE who tries to use my servers for relaying.

Well, IMHO, that's a pretty stupid thing to do.. someone here asked me if we could do something similar, and I told them we could, but it wouldn't be smart.

All someone needs to do is list your mail server as a MX for thier domain (or a useless subdomain), then get people to respond..

They sign up with hotmail, and you'll never recieve mail from hotmail ever again.. same with Yahoo..

Send mail to $BIG_ISP with a From: for this domain; they reply, and you'll never recieve any email from that ISP again.. you'll be blocking legitimate servers, who are doing exactly what they should be doing.

It's all of sudden pretty simple to screw you over.

Re:Collateral Damage?

[Anonymous Coward]

Tell me where you live. I want to see if I can pick your locks, open your windows, and peek through your curtains. What is your IP address? I demand the right for complete and unfettered scanning abilities.

You of course have zero right to ask who I am or my true identity. Fork it over, or be labelled as a hypocrite piece of shit. Talk the talk, now start walking the walk.

Re:Collateral Damage?

[schon]

Thanks for responding, but do you have anything relevant to add?

Tell me where you live. I want to see if I can pick your locks, open your windows, and peek through your curtains. What is your IP address? I demand the right for complete and unfettered scanning abilities.

What does any of this have to do with my post?

You of course have zero right to ask who I am or my true identity.

You're a moron. Re-read my post, then point out where I asked you for your identity.

problem solved for me

[darp]

I forgot what does it mean to receive spam long time ago. I just started generating unique aliases to my real email address for everyone who wants my email i.e. instead of giving to Bill Gates realname@mydomain.com address I'm just giving him billgates@mydomain.com. If I start receiving spam sent to billgates@mydomain.com, I would know who leaked my address to the spammers and I can easily remove the alias. This is also very good for sites that don't have unsubscribe quite working - just delete the alias and you don't get more mails from these guys. You can do the same thing with subdomain i.e. me@billgates.mydomain.com
I wish all software supports this kind addressing and makes email address aliasing easy for everybody

Re:Spam?

[AxelTorvalds]

IMAP? Read the header, drop it.

I can sympathize with paying the bill and the slow connection, there are solutions though. Building blacklists and te vigilantism that goes with them is nothing more and digital road rage.

Dream on...

[Rik van Riel]

Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

If that were true, ISPs would have absolutely no reason to kick their spammers and the admins of open relays and open proxies would have no reason to secure their systems to abuse.

In short, nobody would slow down the spammers and our inboxes would be flooded by spam, even if the filters were 99% effective.

The only way to reduce the amount of spam you receive is by reducing the amount of spam being sent.

Personally I use the SBL and DSBL lists to block mail from known spammers, their supporters and open relays and open proxies.

Email is protected speech. There is a fundamental free speech right to be able to send and receive messages, regardless of medium.

Spammers have a right to free speech, but they have no right to free speech on my property. If they want to advertise, let them setup a website I can view when I want to. Free speech is about speech in public areas and is not relevant when it comes to private property. Free speech does not trump private property rights. If you think free speech does apply to private property, send me your address and I'll organise an industrial and hardrock concert in your garden.

Having said that, I think it would be good if every user could choose for him/herself the filters used on his/her mailbox. If only because the users are likely to choose much more agressive filtering than ISPs could ever setup by default.

Flaws with this article

[Paul Wright]

The author would have been better off hanging out on news.admin.net-abuse.email for a bit before going public with this. Here are some problems I spotted on a quick scan through:

• RBL is a trademark of MAPS. The generic term is DNSBL.

• It looks like his entire netblock is blacklisted because it blocks relay tests by null routing the osirusoft.com tester. Given the controversy over relay testing, it is reasonable for him or his ISP to block such tests. It is also reasonable for an open relay blacklist to list for it.

• The article fails to clearly distinguish between open relay/proxy blacklists (which are largely automatic) and blacklists and blacklists based on harbouring spammers (which will always have a human in the loop somewhere). It seems the author himself is confused about this.

• I doubt it's true that most admins who use RBLs "assume they are blocking only spam". Any use of filtering by a large organisation should only be done after examination of the consequences.

• The section headed "Network Effects and the Unscalable Nature of RBLs" has nothing to do with scalability as I understand the term. A DNSBL scales as well as the DNS itself. The increased use of DNSBLs could be argued to increase their effectiveness, since it puts pressure on irresponsible admins to fix their problems.

• My understanding of the more reasonable blacklists (the SBL, and to some extent, SPEWS) is that they only widen a listing to include "collateral damage" after the ISP has failed to respond to complaints. It is the responsibility of the ISP to have a working abuse@ address and to read what is send to it. For open relay lists, there is no "collateral damage" since the IP listed is an open relay, exactly as claimed by the list operator.

• The "geopolitical" section is just nonsense. The blackholes.us operators provide lists of IPs by country so that people who know they do not expect legitimate email from a particular place can block that place. They do not advocate that the entire Internet shuns Korea, say. An business with Korean customers clearly would not use that list.

• The example banner on the open relay can only form a contract if the spammer sees it and agrees to it. The Sherman Antitrust Act is of no consequence to the ORDB operators in Denmark, to SPEWS in Irkutsk, nor to me in the UK.

• The section on Distributed Notification Systems should probably mention the Distributed Checksum Clearinghouse, since that, to my mind, does away with some of the problems of Razor.

Re:Flaws with this article

[Anonymous Coward]

Feel superior yet?

Re:Flaws with this article

[Anonymous Coward]

doubt it's true that most admins who use RBLs

Don't you mean DNSRBLs, fucktard?

You're an evil dialup user! You must be a spammer!

[TrentTheThief]

Yes, the article does appear very one-sided.

However, the point being made is legitimate: RBL's find it simpler to tar an entire block as spam than to surgically excise the cancer. They've lost the pinpoint accuracy of years ago.

Simply defining a spammer as a sender with a dialup IP who relays email through a third-party smtp server is not valid.

I spend a couple thousand dollars a year on DSL, hosting, and network charges. I've owned and maintained several domains for a number of years. I don't send spam, none of my users send spam. So, why am I a "designated spammer?" Just because I have a dial-up IP? Damn. Isn't that kinda harsh?

Whining? Unfounded complaining? No. I guess I'm just one of the poor unfortunates who can't afford a T-1 to the noc where their servers live ;-) I wish I could afford a T-1 to my basement just like you!

In my region, the fast access choices are Verizon DSL or cable modem. Verizon (through its monopolistic business practices) has made it extremely hard for other companies to get 1.5MB DSL lines into most COs. That gives them a lock on fast DSL service. Unfortunately, Verizon does not give fixed IP addresses.

Mr. Simpleanswer says, "Well, just request one."

Simply requesting a fixed IP won't get you one. The mythical "fixed-IP" tests are almost always in the VA area or _very_ small service areas in NY. Verizon uses DHCP and only leases the IP address for 24-36 hours.

Comcast Cable still sucks. They have longer dhcp leases, but they are a suck-assed ISP listed as dial-up in many lists. And they transfer limits on USENET. (WTF! What's up with that? What a dime-store operation!)

Changing ISPs to get a fixed-IP isn't an option. I need a fast line.

Mr. Simpleanswer says, "Well, why don't you just send email through your ISP's email servers?"

Well, that would look very professional and business-like, wouldn't it?

_My_ users expect _my_ emails to originate from _my_ domain. Does your sysadmin frequently send you email from a YaHoo address? From a Juno.com address? From a Verizon address?

Personally, if someone who represented themself as a SysAdmin from Verizon sent _me_ an email from a different domain, it'd go into the trash. And anyone who says they'd pay heed to any such email is probably also one of those people you read about who do odd sexual things for unknown phone callers. You know the ones, like the lady who gave herself a breast self-exam for a "doctor" conducting a phone survey....

Anyway, to summarize, RBls have lost the keen, effective edge they once held. Instead, they use the "Kill everyone and let god sort 'em out" approach to spam control. This is not a good thing.

Changing ISP or using an ISP's smtp server is not always practical.

Yawn, the conference again...

[tuxlove]

Check out my spam-killing procmail script. It kills effectively 100% of all spam. You can find it here. I don't know why anyone would mess around with less effective spam filters. It's tiny, it's free, and NO MORE SPAM!

Re:Yawn, the conference again...

[n6zfx]

This rocks. Its basically what I've had in mind for a qmail plugin (hence all users could benefit.) Btw, does the "response" send out what essentially amounts to a "bounce"? or is it a friendly message? I'm thinking of basically bouncing when the address is not in the whitelist; when the user receives the bounce, there will be a link in the bounce reply so the user can put himself in the whitelist... of course there will be some magic passphrase that will require human intervention. The reason for the bounce is that hopefully the spam sender will process the bounce and remove the address from the list. jeff jlc 'at' myrealbox 'period' com

Re:Yawn, the conference again...

[tuxlove]

You should probably RTFC to see exactly what's going on, but to answer your first question, it's not a bounce. It sends a confirmation request email to the sender, and you decide what the body of the confirmation request says. Mine basically says, "I get a lot of spam, and you're not in my list of known senders. Please reply to this email so that I know you exist, and my spam robot will deliver your original email to me." The actual text is a bit more explanatory, but you get the idea.

The confirmation request is sent from a one-time response address, so spammers can't use it to spam you with. I have my doubts that a true bounce message would be noticed by spammers, but perhaps. Not sure if you can do that with procmail, since it depends on support from sendmail or whatever mail server you run. This script nullifies the need to fool spammers anyway. It just makes ALL of the spam go away.

Use POPFile

[Anonymous Coward]

POPFile is a GREAT Bayesian based email categorization program. I've been using it for a couple of weeks. After minimal (~10 messages) training it has since been over 97% effective.

Passive denial doesn't work

[The Spoonman]

It only blocks LEGITIMATE e-mail from servers that may, at some time in the future possibly, be used by spammers as a relay. It does block from machines that have sent spam, but also those that have never done it, just the potential is there. It does not, however, block spam! At least, not effectively.

And, that's where the problems lie. Administrators are putting these things in, assuming they'll stop spam, and then getting pissy when you tell them legitimate mail isn't getting through.

I used to be the e-mail admin for my company. We somehow ended up on the worst of these lists, osirusoft. This, despite the fact that we used SMTP AUTH; YOU COULDN'T SEND MAIL WITHOUT A PASSWORD! And, once you get on one of the lists, you're on them all.

So, I spent the better part of a couple of days going through them all and having to prove I wasn't an open relay. They all but one removed us within a week, but that was a week we couldn't send mail to a few customers.

And, the one that didn't remove us in a week...osirusoft...they took over a month. Every day I went to their site and ran the "autotest". Every day I watched it say, "Relaying Denied, deleting from list". Every day, I watched another "proof" of our spamminess posted onto their list.

And, the idiot admins of the ISPs? "Well, you're obviously an open relay. I see dozens of spams being sent from your site on the osirusoft list!"

BTW, the osirusoft rbl is run by some loser in his basement. Great plan, basing your company's e-mail on some unemployed idiot with a chip on his shoulder.

Look at your spam, where does the majority come from? That's right, AOL & Hotmail. But, your company would NEVER allow you to block from them, they'd lose too many customers. Install an active filter, you'll see better results and less spam.

Re:Passive denial doesn't work

[Anonymous Coward]

Osirus is also the host and source fo the SPEWS list. They try to hide where their zone transfers come from, but some backbones have sniffed his traffic and know the transfers come from his machine. Nulling his web server kills the zone transfer. Do that and watch Jarrod cry like a little fucking girl.

I understand, but...

[AlfaGiik]

He is misguided.

I run a spam filtering service which uses DNSBLs along with other measures to reduce the spam that my customers receive. The customers who sign up for this service typically are completely swamped by unwanted email, in fact - one customer has a hit rate of over 60%. Yes, 60%. They had reached the point where their email was becoming useless, so they had to do something about it.

DNSBLs are a valuable tool when combined with other technologies and have a very low 'collateral damage' rate. For example, the customer mentioned above has never called to complain that valid email was blocked even though I remove over half of their mail before they get it.

As for someone's right to run an open relay, I guess they do have the right to run their server however they choose, but that right ends at my door. My server, my T1, my customers asking for help. I explain the risk of collateral damage to potential new customers, and explain they must trust me to make decisions on what is blocked and what is not. I try very hard not to be overzealous and it has served me well because no customer has ever left the service once they signed up.

I'm very sorry if the author of this article was inconvenienced by being blacklisted. But the needs of the many outweigh the needs of the few... or the one. (TM)

I found your article to be of whiny, not helpfull.

[gurps_npc]

You seem to be upset that some groups have demanded that the smaller ISP's and less technological countries do the main work in solving the Spam problem. THEY ARE THE ONES RESPONSIBLE FOR IT IN THE FIRST PLACE. Yes, they may not personally be the people doing it, but they are part of a group that IS doing it. I think Blocking is TOTALLY appropriate Punishment to the Asian Countries for their failure to police their ISP's and fight the evil of Spam. Note, I personally have had my email to a friend blocked because of the RBLs. He gave me a new email address, (at another small ISP) and the problem was solved. If you have that problem, SOLVE it by moving AWAY from the SPAMMERS, instead of supporting them by your lazyness.

distribution problem: pkey list == ip-addr list

[wayne]

There is no way for a subscriber to know what IP address our e-mails will come from, they change dynamically based on load.

The same basic solutions to letting your customers know what public key(s) you use can be used to let your customers know what IP addresses you use.

While most DNS based systems are blacklists, there are DNS based whitelists such as Bonded Sender. The current version of spamassassin recognizes them.

The IP address is an identity and the IP sequence numbers prevent the identity from being spoofed/forged. Authentication based on the IP address is not the ultimate solution, but it has the advantage that it is already in use.

He missed DCC - Distributed Checksum Clearinghouse

[nneul]

It performs a very similar function to Razor, but is a lot more open. You can run your own servers and participate in the global database, or run your own database independently.

http://www.rhyolite.com/anti-spam/dcc

TIRED OF UNFAIR BLOCKING?!

[BasharTeg]

Summary: someone tries to send email and finds that they're listed on SPEWS. They complain because "we're not an open relay", without figuring out just why they're on that list. Almost invariably, they're on the list because their ISP persistently ignores spam complaints and prefers spammer money to honest customer money. I think there's been about two or three actual mistakes in the SPEWS listings in the year or so I've been following NANAE. Otherwise, it's all been a legitimate extension of the block because the ISP knowingly ignores complaints and supports spammers.

Wait wait wait, let me quote that again. "it's a legitimate extension of the block because the ISP knowingly blah blah blah." My SMTP server is sitting on an IP block that is being "punished" by SPEWS. My ISP is not UUNet, but another ISP which is a customer of UUNet. SPEWS intention of punishing UUNet by blocking MY IP block is not "legitimate" by any definition of the word. I am not a spammer, and my ISP is not tolerant of spammers. But our upstream provider is. So screw us, we're paying the price for the spam jihad.

Open Relay RBLs, hell yes. That is fair and legitimate. But when you take the power given to you through the trust of those who use your service, and use it to beat down on the innocent in order to further your cause, that is unacceptable. I could spend weeks on the phone with UUNet. Do you think I could somehow convince them to stop supporting spammers? Give me a break. You think I can just switch ISPs? My company does telecommunications with voice lines over a DS3 with a contract with our provider for voice and data service. There is no chance of going to another ISP. So, if in the end I am forced to subscribe to ANOTHER T1, from a different provider, just so that our small company can do business, what purpose does that serve? How does that advance the cause? I am willing to make sacrifices for the anti-spam movement, but I don't see exactly what purpose blocking completely secured SMTP-AUTH non-spamming servers does. I followed the rules. I setup my servers responsibly. I still got fucked over. You tell me that's "legitimate."

Now listen to me very carefully. I HATE spam. I employ several spam filtering systems. I even use open relay black hole lists. I have even gone as far as to write my OWN anti-spam content filter system. I use SpamAssassin, but of course I had to comment out the rule for Osirusoft because Osirusoft uses SPEWS, and otherwise SPAM ASSASSIN ENDS UP BLOCKING MY OWN FRICKIN EMAIL. Here I stand, a supporter of the anti-spam cause, blocked with no recourse by people who refuse to talk to me about why I'm being punished. Whose ideas of legitimate include punishing so many of the innocent that the outcry is supposedly supposed to affect the guilty. (Read that sentence again, Mr. Bollocks) Blackhole lists are fair and legitimate as long as you aren't punishing one man for the action of another, and as long as you provide a method for clear and easy removal once terms have been complied with.

Miles "the only good anti-spammer, is the one who will take you off his damned list when you jump through the hoops"

The following is a list of the innocent businesses around my IP range which are punished for the actions of that worthless bastard Eric Reinertsen.

United Promotions, Inc 65.244.178.0 - 65.244.178.63
Affordable Computer Supply 65.244.178.64 - 65.244.178.95
Enpro Services Co, INC. 65.244.178.96 - 65.244.178.127
Verestar/Atlanta-GA 65.244.178.128 - 65.244.178.143
No More Forms, Inc. 65.244.178.144 - 65.244.178.159
Component Distributors, Inc. 65.244.178.160 - 65.244.178.191
Broadband Wireless Communications 65.244.179.0 - 65.244.179.255
Cemtec USA 65.244.184.0 - 65.244.184.31
ALLSTATE INSURANCE/PAUL BONOMO 65.244.184.32 - 65.244.184.39
CPH Engineers Inc 65.244.184.40 - 65.244.184.47
Conrad Yelvington Dist, Inc. 65.244.184.64 - 65.244.184.79
Optimum Nutrition, Inc 65.244.184.80 - 65.244.184.87
Teckn-O-Laser 65.244.184.96 - 65.244.184.111
Badcock Home Furniture & More 65.244.184.112 - 65.244.184.127
The Thornestone Group 65.244.184.128 - 65.244.184.143
Talk Visual, Inc. 65.244.184.160 - 65.244.184.191
College Park Campus Partners 65.244.184.192 - 65.244.184.255
Florida Family Mutual Insurance Company 65.244.185.0 - 65.244.185.255
PEPSICO 65.244.186.0 - 65.244.186.255
YOUR INFO INC 65.244.188.0 - 65.244.188.255
Orex Technologies 65.244.189.0 - 65.244.189.63
NDS INC. 65.244.189.64 - 65.244.189.95
Intermedia / Fightertown USA 65.244.189.96 - 65.244.189.127
Delphax Technologioes Inc 65.244.189.192 - 65.244.189.207
ALLSTATE INSURANCE/KAYODE OKEWUSI 65.244.189.208 - 65.244.189.215
ALLSTATE INSURANCE/PAUL SMITH 65.244.189.216 - 65.244.189.223
ALLSTATE INSURANCE/NEIL DOBBS 65.244.189.232 - 65.244.189.239
Intermedia / Haynes Brothers Furniture 65.244.189.240 - 65.244.189.247
ALLSTATE INSURANCE/JERRY HAIRSTON 65.244.189.248 - 65.244.189.255
FIDELITY NETWORKS INC. 65.244.191.0 - 65.244.191.127
ALLSTATE INSURANCE/JEFFREY STERN 65.244.191.128 - 65.244.191.135
Radiology Group / East Ridge Hospital 65.244.191.136 - 65.244.191.143
Trimeris, Inc. 65.244.191.144 - 65.244.191.159
ALLSTATE INSURANCE/DEANE LONG 65.244.191.160 - 65.244.191.167
custardinsurance 65.244.191.168 - 65.244.191.175
ALLSTATE INSURANCE/ANGELA RAGAN 65.244.191.184 - 65.244.191.191
ALLSTATE INSURANCE/ DERRICK MADDOX 65.244.191.192 - 65.244.191.199
ALLSTATE INSURANCE/TIM BOYCE 65.244.191.200 - 65.244.191.207
ALLSTATE INSURANCE/PAUL STOVALL 65.244.191.208 - 65.244.191.215
Hamilton Risk Management 65.244.191.216 - 65.244.191.223
ALLSTATE INSURANCE/JIMMIE BROWN 65.244.191.224 - 65.244.191.231
navigant 65.244.191.232 - 65.244.191.239
ALLSTATE INSURANCE/RONALD BARNES 65.244.191.240 - 65.244.191.247
ALLSTATE INSURANCE/THOMAS FITZPATRICK 65.244.191.248 - 65.244.191.255
Money Line Direct 65.244.193.0 - 65.244.193.255
KELLEY DRYE & WARREN L.L.P. 65.244.194.0 - 65.244.194.7
Senn Palumbo, Meulmans 65.244.194.64 - 65.244.194.127
Systrends, Inc. 65.244.195.0 - 65.244.195.127
Skytell 65.244.195.128 - 65.244.195.143
BMR Neurotech 65.244.199.48 - 65.244.199.63
Metro Republic Commercial Services 65.244.199.64 - 65.244.199.95
Call Catchers 65.244.199.128 - 65.244.199.159

Re:TIRED OF UNFAIR BLOCKING?!

[AndroidCat]

As long as UUNET takes pink money, why should we give a damn? If you were important to anyone, you would have been whitelisted by now.

ITYM "So screw us, we're paying the price for supporting a company that supports a company that takes spammer money."

Re:TIRED OF UNFAIR BLOCKING?!

[Todd Knarr]

You hate spam, yet you're still giving UUnet your money knowing they harbor spammers. You're one of the people making it profitable for UUnet to harbor spammers. And note well, UUnet will continue to harbor spammers as long as it's legitimate customers keep giving it money despite that. They'll only change when people like you start saying "UUnet, we're switching to <alternate-upstream> because we refuse to bear the costs of you harboring spammers. When you've cleaned up your spam problem, maybe we'll think about coming back.".

Re:TIRED OF UNFAIR BLOCKING?!

[BasharTeg]

So your solution is not to boycott the company, but to boycott the people who don't take part in your boycott of the company? Well, you get points for originality I guess! Little bit low on the logic score however.

Re:TIRED OF UNFAIR BLOCKING?!

[AndroidCat]

If you want to live in a slum, don't complain about cockroaches. Try that for a prime computation "Bashar". If you think the SPEWS listing is unfair, post it. If SPEWS acts arbitrary, people will stop using it.

Re:TIRED OF UNFAIR BLOCKING?!

[Anonymous Coward]

"And note well, UUnet will continue to harbor spammers as long as it's legitimate customers keep giving it money despite that."

Proof?

It's obviously very easy to make that claim. So you're saying that some number of low-profit customers, if they all tell the ISP to boot spammers, will convince the ISP to boot the spammer? Right - they'll throw out the high-profit customer to keep the low-profit customers. Why do I not believe you? Why does anyone believe you? Why do you believe this?

I think it isn't logic, it's rationalization - made up to support the actions of SPEWS.

It's Voodoo: VDNSBL.

Re:TIRED OF UNFAIR BLOCKING?!

[Todd Knarr]

No, it's simple economics. One spammer provides X dollars of profit for the ISP. N non-spamming customers provide Y dollars each of profit for the ISP. When N*Y > X, it costs the ISP less to boot the spammer than lose the non-spamming customers. Solving for N is left as an exercise for the reader.

This is why I like spamassassin...

[davburns]

The article points out that there are problems with RBLs, and that is true. On the other hand, they're very useful in blocking spam.

This is why I like spamassassin. It lets you look up DNSBLs, and include those in a mail's score. It combines these and distributed spam reporing services like razor (which could be abused, too, but only on a per-message basis, not whole sites or netblocks) with its own content-based checks and an automated whitelist facility.

Re:This is why I like spamassassin...

[mstefan]

For those who use Eudora on Windows, Spamnix is a plugin that is based on spamassassin and it works really well. Although you still have the overhead of downloading the mail, you never actually see it (I just have everything dump right into my trash folder). I'd say that at most, two or three spams slip through a day, which is something that I can tolerate.

Collateral damage is part of the design

[Skapare]

The author of the article is yet another person who misunderstands the problem. The problem is not how to prevent the delivery of spam; that has already been solved. The problem is how to get the ISPs hosting the spammers that continue to eat up our bandwidth to disconnect them from the network. Decent ISPs will just do that upon the discovery they have spammers. And it is acceptable to slap their hand once or even twice, but three spams and you're out. The problem is many ISPs are not decent at all, and will only act upon a financial incentive. Blocking the whole ISP is what is required. DNSBLs such as SPEWS are doing that incrementally with the intent to minimize the number of others affected for long enough to show to the ISP that they had better get rid of the spammers. At this point most ISPs will realize they will lose customers in the future, and will get rid of the spammers. A few will be stubborn, and will eventually have their entire address space listed. Not only do we not want mail from spammers, we don't want mail from anyone who supports spammers. And if you are paying money to an ISP who runs in turn is providing services to a spammer, then you are indirectly supporting spammers through financial benefits, such as the ISP offering the spammers lower rates through economy of scale. And do not forget that if you are doing this, that you and your ISP are benefitting off the costs incurred by others. All this article is, is a reflection of frustration by an individual who just doesn't get it, that he needs to either turn his ISP around to be a decent member of the internet community, or he needs to switch to another ISP. It looks like a lot of work went into it, but the premise being all wrong, the article is worthless and offers no solutions.

Re:Collateral damage is part of the design

[deanatav8net]

Your message is very insightful, because it brings some clarity to the goals of the abusive blacklists, and highlights the differences between their goals and the goals of the mainstream anti-spam community and those of the vast majority of the end users.

The `problem' as we see it is stopping spam without interfering with legitimate operations and legitimate email.

It is clear you disagree with that premise. However, this is problem that users are interested in. The mainstream just wants spam stopped, but not at the expense of legitimate email. The radicals see no expense as too great or too unreasonable. That's what defines them as "radical". Radicals want to damage ISP's they perceive as 'not doing enough', regardless of whether that perception has any basis in fact or reality. As Al Iverson (creator of MAPS RSS) said: "the blacklist operator feels power".

Radicals think they can do whatever they want without user consent. They think they don't need user consent. It is not surprising that end users and the mainstream disagree with that.

You say your goal isn't stopping spam. Thank you for being honest and forthright. We can see your goals are not the same as the rest of the anti-spam community, nor are they the same as the end-users. The rest of the email-using world isn't interested in collateral damage. Collateral damage isn't good business, and (as has been demonstrated) it isn't legal.

The abusive blacklists commit fraud on ISP's and end-users alike when they say or imply that their goal is stopping spam. Their goal isn't stopping spam. It has nothing to do with stopping ISP's from hosting spammers. Av8 Internet has never hosted a spammer, yet 130.105/16 is listed. The goal is, as you say, collateral damage.

Re:Collateral damage is part of the design

[Skapare]

We clearly disagree as to what "the problem" is. One aspect of that disagreement could come from a difference in understanding what "spam is". Some people look at it as a message content issue. I believe you are one of those people. Others believe it is a behaviour issue. I see it that way. And thus, there are differences.

I also want spam stopped without stopping legitimate mail. But we disagree in how to accomplish this. Your position is that no matter how the sender of the legitimate mail wants to send that mail, even if they want to send it in a way in which it cannot be easily distinguished from spam, that the legitimate mail must get through no matter what, even if that means lots of spam gets through. My position differs in that I believe the senders of legitimate mail should take some reasonable steps to distinguish their legitimate mail from spam. There are a number of different ways to do that:

• Send the mail from an email address the recipient knows.
• Send the mail from a server the recipient trusts.
• Send the mail from a server the recipient has no reason to distrust.

The recipient's ISP, if one is involved, will certainly play a role, and the recipient and ISP need to have a known and agreed relationship with each other (if the ISP is using a blocking list the recipient is unaware of or does not approve of, that relationship isn't a proper one, and is beyond the scope of this discussion ... the recipient needs to regain control at their end).

So my position on how to accomplish stopping spam while letting all legitimate mail through is that the sender of the legitimate mail has to play some part in the process. They cannot be totally passive and expect the recipient to do all the work in distinguishing legitimate mail from spam.

You say your goal isn't stopping spam. Thank you for being honest and forthright.

I did not say that my goal isn't stopping spam. You made that up, which is something I've seen from you before, so I'm not surprised. So go back and read what I said. It's even in the title. I said that collateral damage is part of the design. It's part of the methods employed to stop spam.

Again, it comes down to the behaviour of the senders (and their agents, their ISPs) and the behaviour of spammers. In order to stop spammers, the senders need to take on part of work involved. Those that refuse to are part of the problem because they are forcing even more costs on the recipients (in addition to what spammers do) by forcing the recipients to have to do all the work to separate legitimate mail from spam.

Consider your open relays. What's happening here is that the inputs will accept both legitimate mail as well as spam. Any mail server is subject to spam coming in, but an open relay is particularly vulnerable to this. An ISP operating a closed relay can apply sanctions against their customer base, which is a fraction of the whole internet base. But an open relay is equivalent to an ISP that has as its customer base the entirety of the internet. Since legitimate senders that are not a customer of the ISP running an open relay won't use that relay, the volume of legitimate mail going through the open relay is still a function of the customer base. But spammers don't play by the rules, and will use any open relay they can find, law be damned. That means any open relay is going to have a substantially higher percentage of spam compared to legitimate mail.

That means there is less distinguishability of legitimate mail from spam, and greater costs to the recipient (and/or his agent, his ISP).

Therefore, it is reasonable to make demands on the ISP running an open relay to close it, so that the legitimate mail coming through it won't have such high costs imposed on the recipient. The "collateral damage" design is part of the pressure being applied. Blocking only your open relays has some degree of collateral damage, but you are certainly in a position to correct that by routing all legitimate mail through other servers which are not the open relays.

That all of 130.105/16 and 198.3.136/24 are blocked goes to other reasons, and I don't know what they all might be. Certainly the fact that you willfully operate open relays is part of it, I'm sure. The fact that you are blocking relay testers probably is, as well, although you'll find I am in agreement with you as to the legality of such testing without consent. But I also believe that much blocking of those addresses is simply due to how you personally are dealing with the situation. Perhaps you have moved the open relays around to various other output addresses. That would certainly warrant a large scale blocking.

So basically it comes down to you having legitimate mail to be sent, but you are mixing it up with possible spam through an open relay, and are expecting recipients and their ISPs to sort out which is, or is not, spam (and without the benefit of being able to do so based on the IP address, because the SMTP client at this point is your open relay), yet you refuse to do the very same vetting of the mail coming through your open relay.

Senders of legitimate mail need to carry some of the burden of the spam fight, too.

Some of your arguments are against some of the activities of DNSBL operators that include open relays. Among the problems are things like doing unconsented relay testing, and making relay input lists available. But consider what if I ran an open relay DNS blacklist that held to certain strict standards:

• Only actual open relay outputs will be listed.
• The inputs will not be made available except to a small set of trusted people who have a good reason to know.
• The networks hosting open relays will not be listed unless there is activity of moving open relays around to evade the blacklist.
• No testing will be done unless the owner of the machine at the address in question consents to the test.
• Once listed, an open relay will remain listed for 12 months since the last time any relayed spam was detected.
• A listing can be removed if the owner consents (in writing, including a clause to agree not to sue) to a relay test and that relay test passes (e.g. nothing is forwarded) without any indication of an attempt to block the test.
• If spam continues soon after a relay test passes, the relay will be listed for 12 years.
• A second separate DNSBL will also be operated, which users may elect to use instead, which will not include all open relays in which the owner disputes the determination.

That would still end up listing your open relays if they have ever passed spam in the past 12 months. If you actually do integrate spam detection and refusal on the inputs, the probably there would be no spam, and it would not be listed. Now the question is, how would you react to that kind of DNSBL?

Slashdotters: read Dean's paper justifying his open relays here . Judge for yourself.

Re:Collateral damage is part of the design

[deanatav8net]

I did not say that my goal isn't stopping spam. You made that up, which is something I've seen from you before, so I'm not surprised. So go back and read what I said. It's even in the title.

You said it in your reply to the paper, which I see you've since changed. However, not quite enough. And your goals can easily be seen by your actions.

My goal is not specifically to have no spam at any cost. Instead, my goal is to reduce or eliminate the cost associated with spam and attempts to deliver spam.

There is almost no cost associated with spam. Disks cost $150 for 80Gig. Bandwidth costs $50/Meg per month at the ISP level. Peering is cheaper still. Computing has been under $10/MIP for a while. Spam, indeed email of any sort, is almost free. Many places are offering email accounts for $2/mo or less. The problem is not the cost, but the annoyance. Its having to delete 50 messages to get at 10 you want. At a very fundamental level, you either don't understand the problem, or you don't have the same goals, or both.

Re:Collateral damage is part of the design

[Skapare]

At the time of posting this comment, I have not changed my reply to the paper. That's still the first iteration on my reply. maybe you're reading into it more than is there.

I think the difference between what you perceive is going on, and what actually is going on, is more in the area of intention and goal, than in actual methods employed. I most certainly do add network ranges of ISPs, rather than just the spamming/relaying/proxying addressess, to the list, and use DNSBLs that also do such. So you are correct in understanding that my actions involve these full address ranges.

What you fail to understand are three critical things:

• The reason this is done is because the actions of the ISP at the other end are causing my costs in dealing with spam to be greater. An open relay does this by preventing me from being able to test the originating IP address without having to go to the added cost of accepting DATA to get headers, and parsing it.
• The goal isn't to suppress communication, since the ISP has the opportunity to correct these problems which are recognized by the vast majority as problems they are causing.
• It's not the end of the world, since the addresses are not being blocked at the IP layer (with one exception right now). That does not mean I am refusing legitimate mail. What is means is I am applying finer tests to determine if the mail is legitimate; specifically I am in these cases testing the sender's email address.

Certainly the annoyance is a big cost. Costs are reduced by employing automated methods to prevent the spam from causing the annoyance. The issues I am dealing with regard the matter of keeping those automated costs low. If it was the case that I wanted to cut off all spam at all costs, I'd block your entire network at the IP layer and never have a process forked for any mail from there. But not getting legitimate mail is itself a cost, so I don't usually go to that extreme. Mail servers in your network can still establish an SMTP connection, and can still offer legitimate mail, and I still check the sender address to see if it is legitimate to the extent I know about. Your email address is in fact recognized; despite our disagreements, I have no reason to believe email from you is spam.

As for your cost figures, there are lots of things you are leaving out, and lots of things I'd most likely be leaving out if I spent the time to begin detailing them here. I won't, because it's not necessary. The reason is because my goal is to achieve the lowest cost, whatever I can determine that to be, not some specific fixed threshhold of cost. The lowest cost is going to depend on a lot of things, including my time (posting on slashdot, newsgroups, and mailing lists is not figured in), and goals of comfort, such as making sure my mail servers are typically running at less than 25% capacity (if one is regularly running at 30%, it's going to get upgraded somehow soon).

Re:I found your article to be of whiny, not helpfu

[minas-beede]

I suggest you grow up.

DNSBLs function to block spam, not to punish.

As to who is responsible, an intelligent analysis would reveal that those who herd-like joined the "secure all open relays" crusade without even bothering to read the RFC (2505) that said that was a failed approach are more to blame - they pissed away years that could have been spent in an effective battle against spam (which would have been long gone if that had been done.) Now the herds follow SPEWS - more years of ineffectuality are being risked.

It is smaller ISPs and less technological countries that are to blame? Let me just mention a few entities that stand in stark contradiction to your claim: the United States, Worldcomm (uu.net), Broadwing, Sprint, Verio, Starnet, Rackspace. You gonna tell me that the 50 spam servers Ralsky uses in Dallas are on a smaller ISP? OK, name it - let's start telling them to act. I don't care if it's big or small - name it. I'd like to know.

Still, I agree that the case made against DNSBLs by the web page is weak - too weak to heed. I loudly oppose collateral damage but I see no evidence that it is rampant.

Whitelist protection

[klang]

What I do is rather simple .. I filter all mail through my adressbook. If you are not on the list, I don't care about your mail.

This way, I only get mail from 'known sources' into my INBOX, the rest goes to a SPAM folder. Every few days I'll quickly scan the headers of the SPAM folder to see if I have some mail from somebody who should be on the whitelist.

Needs rework

[Anonymous Coward]

How was SpamCop missed in the "research" ?

By the stated definition (Technology, 1) there is only the act of theft but no such a thing as a thief ?

For the writing to be taken seriously it somehow needs to add some value to an intelligent discussion. Just stating that RBLs are not perfect is like stating that operations and amputations have drawbacks.

This guy is a fool

[Randy Rathbun]

I have been using DNSRBLs for a while now. I can say for a fact that in the past 5 months our mail server (75 users) has had 0 legit emails blocked. There were 2 emails blocked by two of our corporate customers because they were running open relays. I count those as legit because clue sticks were applied very fast.

Let's assume that those 2 emails were totally legit. That leaves me with 2 emails that were blocked out of approx 15,000 emails that have gone through this server.

I'm sorry if this guy is dealing with users who are using ISPs/working for companies where the mail admin's obvious job qualification was "I have a computer at home", but I am not going to subject my users to crap email any more than I have to, nor am I going to waste my bandwidth processing messages from con artists.

If this guy does not like it, tough. It is my mail server. I am in charge of it. My users all appreciate not walkin in the office Monday morning and having to sort through 300 emails trying to sell them fake viagra.

Double opt-in?

[AndroidCat]

We do confirmed/double opt-in

Oh-oh. "Double opt-in" is usually spammer-speak.

Re:Double opt-in?

[rocur]

No, opt-out is spammer-speak, double opt-in is non-spammer speak. It means that you go to our web site and sign up. We then send a confirmation e-mail to that address and ask you to reply. Until we receive that reply, nothing more is sent to you. This keeps your "friend" from signing you up for e-mail and gives us a record of your having requested to receive e-mail from us.

Re:Double opt-in?

[AndroidCat]

No calling it "double opt-in" is spammer-speak. Trust me. :^)

That said, from your description, you run a proper confirmed opt-in list with records of the confirmation. Excellent!

Re:Double opt-in?

[Senior Frac]

"Double opt-in" is the term the DMA invented to describe what the rest of the world calls "confirmed opt-in" or "closed loop opt-in". It was an attempt to make the process sound onerous so marketers could make excuses not to do it. As if proving the subscriber reallys owns the email address in question is a repetitive step. (It's not, it's an entirely logical next step)

"Double opt-in" is definitely spammer speak. Doing it, however, is not spammer action.

Re:Double opt-in?

[rocur]

I won't quibble over the entamology of the term. But do note that I orignally said double/confirmed opt-in. We use both terms since our clients don't always understand one or the other. But at least we both agree that whatever you call it, it isn't spammer action, and I believe that is the important part to both of us.

There's sueing and sueing

[melonman]

Thinking about this (and having visited your website), I'd be really interested in seeing you spell out your logic. You say that you permanently block people who threaten to sue. Presumably those are people who are spamming? In that case, I can believe that you are within your rights not to receive their mail. For that matter, I can believe you within your rights not to receive anyone's mail.

If I was going to sue anyone (which looks unlikely, since we have only had one very short-lived SPEWS-related problem in over a year), it would not be for refusing to receive my mail, it would be for sending rejection notices that tell people that I am a spammer, which I am not. Exactly what is your problem with that? Has any innocent party ever tried litigation on that basis? If companies can be sued for the content of their websites, I really can't see how spreading damaging lies by automated email can be an acceptable activity.

Of course in this case, you are blocking my domain because I dared to express a point of view (which the moderators don't seem to dislike too much) in a discussion forum, despite the fact that our company has never sent a single spam, and I have never actually threatened you or any other company with any form of litigation. Have you seen Minority Report? If so, you appear to have been cheering for the wrong guys :-) This is the sort of orwellian behaviour that would normally result in a shock-horror article for YRO...

Re:There's sueing and sueing

[Tadghe]

" I can believe that you are within your rights not to receive their mail. For that matter, I can believe you within your rights not to receive anyone's mail."

Bingo, That sir,was my point in first place...Regardless of *why* someone blocks you (Mabye they don't like Brits or think your the anti-christ or that your secretly plotting to take over the world) they can block you for any reason, or none at all, if their 554 response says you dress funny and smell of cod, there's not much you can do about it. You could threaten to sue, but then you'd just wind up on more personal blacklists.... While I'm certainly not up on British law, In the U.S the level you must prove for Libel is pretty high (higher for a corporate entity I might add).

"Of course in this case, you are blocking my domain because I dared to express a point of view (which the moderators don't seem to dislike too much) in a discussion forum"

No, your blocked because you flew off the handle and went all C&C. I blocked you to prove a point.

A legal case that may interest you is the case of T3 vs Mcnicol (http://www.wired.com/news/politics/0,1283,53102,0 0.html for some background).

Re:There's sueing and sueing

[Anonymous Coward]

Yeah, in this case, the point you proved is that you are a small-minded *SSHOL*.

Re:There's sueing and sueing

[melonman]

Bingo, That sir,was my point in first place...

Good, so the problem is that you didn't read the initial posting. I never said anything about sueing people who block email. At all. Ever. Not even once.

If someone says you dress funny and smell of cod, there isn't much you can do about it.

Rubbish. If (and we are talking several levels of hypothetical here) someone publishes claims that I am a spammer, and if I am demonstrably not a spammer, and if as a result of this untrue allegation I lose business, I suspect that I have a pretty good case for sueing for at least the amount of business I lost.

But then you'll just end up on more personal blacklists

Keep talking, in terms of making RBLs look as ugly as possible to anyone reading this thread, you are doing a fantastic job. What you appear to be saying is that you have a God-given right to destroy anyone's reputation as part of your so far utterly unsuccessful crusade against spammers, and that if anyone complains about their company being damaged as a result, you and your mates are going to damage it even more, just to show who is boss. If we were talking about any subject other than spam, there would be 3,000 /.ers complaining about this on a yro thread.

While I'm certainly not up on British law

Not sure where British law comes into it...

You went all C&C

What is C & C? You're the one with the lawyer, I've never considered sueing anyone in my life. You blocked because you can't read English, and, in the process, provide evidence to anyone wanting to attack RBLs that the blacklists are arbitrary, and often motivated by pettyminded vindictiveness rather than any concern about spam.

A legal case that might interest you

Why? I have never mentioned anyone sueing anyone over whether or not you can block email addresses. Which part of "You misread my original posting" are you struggling with?

While I'm here, I have to know, exactly how does blocking the whole of China put any pressure on anyone to do anything? The people in power will just get a .com address, it's the dissidents you are penalising, and what are they supposed to do, rise up and provoke regime change in the name of a spam-free world?

Doesn't work

[Anonymous Coward]

Spammers also scan mailservers for addresses. They try common last names with a letter or two prepended or appended, sometime truncated to eight caracters. They try common handles and nicknames. They try account names from other systems, etc.

Where I work, about every three months, our mailservers get massively attacked. It slows down incoming and outgoing mail and clogs our network. The only way we have thought to stop it is to modify sendmail to throttle the number of connections by IP, but that's a lot of work to stop a stupid spammer.

How?

[PackMan97]

If using hotmail or yahoo on your browser, turn off images and javascript in email.

How? I can't find those options in the Yahoo Mail Options. Now I could disable images and javascript entirely on my browser, but that's like putting a tourniquet arounds one neck to stop the bleeding from a bloody nose.

Mail providers need to make it easy and painless for users to protect themselves.

Re:The two problems (which impact more than e-mail

[Anonymous Coward]

We need a new protocal that makes the sender more accountable and traceable maybe. I would not think of knocking on your door to convince you that your disk is too small. But maybe via spam. Perhaps a protocol that demands a certain accountability from the sender ...

what about disposable email addresses

[jqh1]

Another alternative is to use disposable email addresses for untrusted applications - qv spamgourmet.com (open source, with a free-to-use implementation).

The SMTP structure we have is a remarkable piece of engineering - it does a fantastic job of delivering each and every piece of mail, notifying the sender of failure, and trying for days to get through to intermittent servers. These principles are great for a network of people who are trustworthy -- we don't have that anymore. Spammers don't deserve this kind of reliability. Prolific use of disposable addresses that don't report back, and delete by default, would tend to lessen the value of the spammer's efforts.

spam==junkmail, SPAM==food

[Anonymous Coward]

Please use the lowercase version. Hormel has nicely let everyone use it even though it is similar to the name of their product. They only reserve the uppercase version.

Re:spam==junkmail, SPAM==food

[Anonymous Coward]

Indeed, and here are some tasty recipes. Thanks Hormel!

Time to ditch SMTP

[LostCluster]

Blackhole lists right now focus on the open relays. Why not focus on the original spammers themselves? Becuase the SMTP protocol doesn't allow for it. The fact is, you can put whatever addresses you want into the From: and Reply To: fields. There is no accountablity to assure that the return addresses are owned by the person who sent the message, or even that such addresses even exist. If mail servers were required to "stand behind" the messages that they sent, receiving server can call back the sending server, basically to ask "Did you really send that?" If the server denies sending the message, or the server doesn't exist in the first place, the message gets canceled and is never delivered to the named user. This would end the cloak of invisiblity for the spammers. They'd have to either use a traceable user account at their ISP, or spam only from their own domain. No traceroute required, an autheticated username and domain show up in the From: line. This would cut down the collateral damage, because instead of blocking by IP address or netblock, the block would be by username and/or domain. What's more, really reputable ISPs could kill most of the spam in the time delay between the sending and the reading, as it would simply be able to refuse to authenticate the messages after being told they were spam. If the ISP doesn't, a retroactive black hole can lock out offending user accounts without having to lock out whole domains, unless it is determined that the domain belongs not to a multi-user ISP but a single-user spammer.

Re:Time to ditch SMTP

[mstefan]

The contents of the header fields in a message have nothing to do with SMTP protocol itself; the sender is identified with MAIL FROM at the beginning of the transaction and could choose to validate the address if they wish (either returning a 550 or 553 result code if they don't like it for some reason). Requiring that the From: and/or Reply-To: header fields match the return path means that you're effectively eliminating relaying, "smart hosts" and some gateways that forward messages from different mail systems.

And, bottom line, it wouldn't do anything to stop spammers, or even slow them down. So what if they have to use a "traceable user account" with some service provider? Spammers move from provider to provider (often providing false information), or they use spam-friendly/neutral providers who don't give a damn as long as they get their monthly fee.

RBL solutions remind me of the "War on Drugs"

[Anonymous Coward]

In both cases they attack only a symptom, they barely reduce at all the actual problem, they produce far greater damage than they solve, they are carried out by largely unaccountable fascists, their advocates show not the slightest hint of understanding in their response to complaints, and they continue down a single path forever with total disregard of cause and effect. Sentience not required, pure inertia will do.

I don't know why whirlycott and the IETF folk even bother to present such comprehensive arguments, it's a complete waste of time --- the RBL crowd response here was totally predictable, and very much a la "War on Drugs".

There is only one way to leave RBL behind, and that is to create a really good and totally ubiquitous mail control system that allows ISPs to accept or block items on a per-message basis under the control of rules which are configurable by their end users, with defaults for simplicity. The whole RBL thing will then become obsolete, and we might at long last focus again on getting mail delivered rather than not delivered.

Re:distribution problem: pkey list == ip-addr list

[rocur]

Neither IP based whitelists nor PGP/SMime are workable until enough servers recognize them. If everyone could agree on a system, we'd be all over it. Plus global whitelists are susceptable to the same whims that blacklists are, both are a reflection of the group that maintains them. Some IPs are on blacklists for political or personal reasons. I'll bet that some whitelist will refuse to list us because we send e-mail for a Muslim newspaper, ignoring the fact that we do the same for a Jewish paper also.

not much luck with RBLs here

[stinky wizzleteats]

I have a serious spam problem on my server. I have a couple of users who are amazingly profligate with how and where they share their e-mail address, and it has turned my server into an interesting anti-spam lab.

I tried the RBLs, but in my experience, they only work if you are reasonably careful with your address. Once you get on enough opt-in lists, you get so much spam from legitimate servers that RBLs don't work anymore.

The final answer has been to use a Bayesian filter which tags messaages for filtering on the client. I'm using bogofilter, trained with a message corpus of about 10,000. This has been the only thing which has really worked, and the client side filter provides a safety valve against false positives. (Although, to date, I've had no false positives).

Re:not much luck with RBLs here

[Glendale2x]

Once you get on enough opt-in lists, you get so much spam from legitimate servers that RBLs don't work anymore.

The big difference being that one can usually get themselves removed from a legitimate mailing list. The "enlarge your equipment 500 times while pleasing her for hours" spams typically aren't opt-in. (If they are, perhaps one should consider a change in the websites one frequents.)

Seems to me that you've got a user problem. If you're on an opt-in list, chances are good that you did it yourself.

So killing your own with friendly fire is OK?

[Anonymous Coward]

Well it's good to know where you stand on this.

However, you're being inefficient. Once you've identified a spammer's country, or at least their city, why not just nuke them? This will be really effective, as it takes out the spammer's infrastructure at the same time.

You really must try harder, or you'll get thrown out of the BOFH fascist guild for being a namby pamby moderate. I mean for crying out loud, you haven't even mentioned torture once. Sheesh.

PORN!!!!!!!

[nickdman]

What about all the porn spam??????

I am personally going to kill the bitch with her webcam, I AM SICK OF THE SPAM FOR PORN!!!

What about EULAs and shinkwrap

[Anonymous Coward]

If that is true, then how do those work?

Suggestion approved!

[SilentReproach]

Thanks. I grossly underestimated the slashdot effect. I have since redirected my weak IIS server to a more tolerant Linux-hosted site, and it seems to be handling the load.

Digitial Signatures etc

[jefu]

I agree. Using digital signatures and other authentication/authorization methods are likely to be the only effective way to curtail spam. What's nice is that these methods could similarly be used to prevent spam on IM services and in other communications services.

Even if only implemented at a server level (verification of host/sender) this could remove a good deal of spam - and could do that on a per host basis.

For the most part its not hard to do either.

It will be hard to get done. At an individual level everyone needs to get the right software and keys. This won't be easy. Nor will it be easy to get governments - filled with politicians who are more likely to label any cryptographic services as helping terrorism or anti-government activities (and who may well have sold their souls to the spammers) to agree. And I can easily see the spammers suing people to try to prevent them from using this (more a problem at the server level - the idea of spammers filing a million or so suits against individuals just makes me grin - Spam Lawsuits).

Then too, if cryptographic services are available many people might just encrypt their email - and the folks in power would like that even less.

Key distribution is also a problem in the case that you might want to add someone to your accept list - you need to verify their identity somehow.

So its a great solution. It would probably work. And its unlikely to occur.

Re:Digitial Signatures etc

[Zeinfeld]

It will be hard to get done. At an individual level everyone needs to get the right software and keys. This won't be easy. Nor will it be easy to get governments

People already have 90% of the software they need. Every major email client has supported S/MIMe for 5 years.

The main missing piece is filters that use the fact an email is signed as a means of authentication (authorization will also be needed once the spammers catch on).

The remaining piece is a certificate (or more accurately key) lookup mechanism that uses the DNS as the index rather than the broken schemes based on "directories" that key of an X.500 infrastructure that will never exist.

Thanks, it's apache now

[SilentReproach]

I redirected the IIS site (which still must briefly handle the redirects) to an apache server, and it seems to be holding up...I grossly underestimated the slashdot effect.

I would have liked to read it...

[Anonymous Coward]

...but I couldn't stand being labeled as the author's enemy and begged to keep reading.

Which RBL?

[Anonymous Coward]

They are many and varied. Some are completely automated and have no way to include "collateral damage". Some specifically say they will block entire netblocks if the ISP is unresponsive.

I have no problem with DNS black lists as long as they do what they say they are doing.

When they deviate, yes, that's a problem for both their users and, potentially, for owners of the IPs in the list.

So exactly which lists are you complaining about? MAPS? I believe they have been dropped by most users.

Re:Spam?

[Anonymous Coward]

Since I blocked Asia (except Japan) in my firewall I get exactly 0 spam messages a day :)

ekrout (xmas edition)

Re:He missed DCC - Distributed Checksum Clearingho

[bigberk]

Yes, DCC looks very promising. My university uses it and I have never seen it mark a message as spam when it wasn't (this is very good).

It often misses spams, but as more people run DCC servers the detection will improve. Detection also improves as spammers target more recipients at once - in a way, they're announcing their presence to the system.

Keep an eye on this one! See the dcc FAQ.

Jail Intrusions

[Anonymous Coward]

With luck he'd be in one of those jails where he might find himself on the receiving end of (um, sorry about this) UCE (Unsolicited Cock Explorations) of his private space.

Re:Jail Intrusions

[Anonymous Coward]

We can only hope. That would be a Sperm Packing in Anal Mucus.

Re:Jail Intrusions

[Anonymous Coward]

Gosh. An American obsessed with anal sex. What a surprise!

RBLs are a stop-gap solution

[thorrbjorn]

And a stop-gap solution is what is needed.

Legal solutions will take years, if they are ever effective. Fixing the SMTP protocol will take even longer. The process of writing the RFC is bound to be long and drawn out, and implementing it ... damn, just think of all the boxes, all the software, that would have to be rewritten to use the new protocol. And filters are increasingly ineffective, basically because the spammers are aware of them and design the spam accordingly.

We need a solution now, not years from now. Today, a portion of what I pay my ISP bill to cover the costs of receiving spam. Today, I have more than one email address that's become unusable due to the sheer volume of spam. Today, while I'll let my kid surf the net without worrying about it, I won't let her have an email address due to the fact that eventually she'll start getting explicit sexual photos in her mail.

Some have said that the spam situation should be fixed without breaking email. I agree. However, the spam situation is on the verge of breaking email all on its own.

Yet another "Wah" article.

[Harik]

Here's my problem with the article... It's "WAH! I'm using a shitty ISP who's spammer friendly and my email is blocked!"

No, your email isn't blocked. Were it blocked, it'd never leave your mail client. Here's what REALLY happens. Your email leaves your mail client, and goes to your ISPs mailserver. You have a contract with them, so they accept it. Then THEY try to send it to us. Now, at this point you're dealing ENTIRELY on OUR hardware, OUR bandwidth, and OUR good graces. Those of us who are SICK AND FUCKING TIRED of having 100x more spam then real mail have quit accepting mail from well-known spammers.

As long as you DIRECTLY support spammers by continuing to use a spam-friendly ISP, your mail will be blocked. Period. You subsudize the rape and pillage of my mailserver and the mindless wasting of my time. And you really have no choice but to move. Wah. Because the alternative is for EVERYONE ELSE ON THE FUCKING INTERNET TO CHANGE THEIR EMAIL ADDRESS EVERY MONTH SO IT'S NOT ON THE SPAMMERS LISTS. DO YOU UNDERSTAND THE COST SHIFTING INVOLVED HERE? IS THIS LOUD ENOUGH TO GET THROUGH?

YOU are DIRECTLY responsible for sending me "Young horny teens get f**ked by a horse with a 31 inch c**k!" (Yes, really *'d out in the message)

Spamassassin is useless. Spammers tune their spams to be under the 3.0... you can't really filter harsher then that without blocking legit mail. The fact that it's open source only makes about a 1 week difference anyway. (Closed filters like hotmail/AOL/earthlink get bypassed in about that long)

The 'bayesian' solution is cute, but dosn't really work beyond an individual level, which means that everyone gets to spend hours sorting through spam (and it still slips through). It also fails because it's looking at single-words. If a friend sends me a mail that includes just 15 poorly chosen words, it gets blocked. If someone implements a two-word version, it may work better.

Add to the fact that a single legit email blocked means you have to read through EVERY spam-marked message looking for more.

So far, the only solution that's made my email workable is whitelisting. And THAT is a lot fucking worse then the RBL. If you're not on my whitelist, you don't talk to me. Period. No Chineese. No Koreans. No Brazilians. No Dutch. No AOL users. Nobody from a small ISP. You're ALL off the net as far as I'm concerned. Nothing that's not a reply to an email I sent. My email is useless for you, but it works for me.

(That's actually an overstatement. I do read the discard folder. Once a week. With the 'd' key. So if you don't invite me to see your webcam, I may read your email.)

Re:Yet another "Wah" article.

[talks_to_birds]

Right on!

t_t_b

Re:Yet another "Wah" article.

[CleverFox]

The Bayesian solution works for my company. We block 90% of our spam with a Bayesian filter, and use collateral filters to catch the other 10%, with very few false positive repurcussions. Bayespam, which our filter is based off of, looks at single and dual word chunks. Hypothetically, you could even look at three word chunks if you have the CPU power and database size to do it.

The Bayesian filter took a week to implement, but my corporation is extremely pleased with the results.

Re:Yet another "Wah" article.

[Harik]

...with very few false positive repurcussions.

In other words, it's still useless. Especially for a corperate mailserver. You CANNOT EVER block legitimate mail. Ever.

You forgot one:

[Anonymous Coward]

Hunt down spammers and IMPALE THEM!!!

Not just incomplete, but serious flaws

[level3rockethead]

While I like seeing reasonable balanced presentations of the pros-and-cons (having to operate spam filters for a very large corporation), his paper is not only riddled with factual errors, it's clear he doesn't understand the subject matter at all. The most egregious mistake: 1) He talks about RBLs (in his terms, "open relays"). The minority of DNSBLs are open relay lists. By his terms, several of his sample RBLs (ie: Spamhaus), are _not_ RBLs. His paper should have been about DNSBLs in general, not RBLs specifically, and indicated DNSBLs have different listing criteria. Ie: spam sources (ie: SPEWS, Spamhaus), open relays (his "RBL": ie: RSL, OSIRUS inputs, ORDB, ORBL, etc), open http/socks proxies (BOPM, MONKEYS, OSIRUS socks and proxy), DHCP pools (eg: PDL). Given the above _extreme_ defect, the paper is essentially useless. Here are defects in his coverage of RBLs: 2) He talks as if RBL listings for open relays should be "appealable". An open relay is either open and abuseable or it isn't. Most RBLs mechanically test servers for open relay - there is no subjective judgement here. 3) Claims that getting delisted by RBLs is difficult and rare - a little research will show that most RBLs retest (either on demand or by time schedule). ORDB and OSIRUS inputs are _particularly_ good at delisting relays that now test closed within a very short period of time. 4) He implies that open relays are desirable. There is no legitimate reason of _any_ kind for an unrestricted open relay. By policy, we will simply not accept email from an open relay/http/socks proxy, because virtually all of it is spam. 5) Unaccountable? If they were, we wouldn't use them. Undocumented? Ditto. DNSBLs have to have predictable behaviour before they're safe to use. Several of the ones he lists are very professionally run and quite trustworthy. Some of them are the opposite. Whether they're good or not is a defect in the implementation, not the concept of DNSBLs. 6) His research on alternate techniques is quite deficient - no mention of DCC, CloudMark, Postini etc. My favourite remark in the paper: RBL mechanisms frequently cause a lot of trouble for legitimate Internet users who are trying to send non-spam email in addition to their intended goal. This implies that the intended goal is to send spam. Oops.

Re:Not just incomplete, but serious flaws

[Anonymous Coward]

My favourite remark in the paper: RBL mechanisms frequently cause a lot of trouble for legitimate Internet users who are trying to send non-spam email in addition to their intended goal. This implies that the intended goal is to send spam. Oops.

Or it could be their intended goal is something else, like providing a service, building widgets, surfing web sites.

Re:Not just incomplete, but serious flaws

[level3rockethead]

Or it could be their intended goal is something else, like providing a service, building widgets, surfing web sites.

Said within the context of a paper on email, that carries about as much meaning as the "intended goal" being to shovel snow off the driveway. It should be clarified or removed.

Re:You're an evil dialup user! You must be a spamm

[schon]

With all due respect, you're an idiot.

"Well, why don't you just send email through your ISP's email servers?"
Well, that would look very professional and business-like, wouldn't it?

If you actually knew how to configure an email client, it sure would.

_My_ users expect _my_ emails to originate from _my_ domain.

You're saying that your users check the Received: headers, to make sure that the email you send comes from your server? If so, I call bullshit on you.

Does your sysadmin frequently send you email from a YaHoo address? From a Juno.com address? From a Verizon address?

Well, I am a sysadmin. And the "From:" line in my email comes from (gasp) my domain, even when I dial in from home, because (unlike you) I know how to configure an email client.

If you really are an admin, I have great pity for your users. I hope they find out how incompetant you really are, so they can find someone who actually knows what they're doing.

Whitelists.

[NFW]

Whitelisting has cut my spam intake down to almost nothing. The costs are small:

People who email me for the first time will get a "please confirm" message to get their email address into the whitelist. This request is sent automatically and the response is processed automatically, so it requires none of my time.

The bandwidth cost is the biggest thing. Every spam I get creates an outgoing "subscription request" message, and usually a "no such user" bounce because spammers almost always use bogus From and Reply-to addresses. The impact is pretty trivial for me on my DSL-hosted SMTP server. I'm not sure how it would scale for an ISP. But, if it cost a dollar per user per month... it works well enough that I'd pay that if I had to. Heck, it's half the reason I'm paying an extra $20/month for static IP address.

An PKI-based authentication with support at the transport level would be even better. In the meantime, this approach works for me, and it works really, really well. I get about a hundred messages a day, and about one spam per week.

Re:Whitelists.

[tigga]

People who email me for the first time will get a "please confirm" message to get their email address into the whitelist. This request is sent automatically and the response is processed automatically, so it requires none of my time.

I'd hate to send e-mail twice to anybody.
And I hate to receive "please confirm" message if I have not sent original one. You know email headers are forgible...

Re:Whitelists.

[NFW]

I'd hate to send e-mail twice to anybody.

Fair enough. At first I thought this might be a problem, but then I realized it's actually an added benefit. If someone feels that the message they sent me is so unimportant that it's not worth answering the confirmation request, then I myself consider it so unimportant that I'm glad not to be bothered by it.

And I hate to receive "please confirm" message if I have not sent original one. You know email headers are forgible...

Yes, I know headers can be forged - the fact that almost all spam arrives with a bogus From address is one of the reasons the whitelist works so well. The few bits of spam that have gotten through the whitelist have been from Nigerian chain letter spammers, becuase they are just about the only spammers who use real addresses and bother to reply to my "secretary's" confirmation request. Anyhow, if a spammer forges someone else's valid email address, that person will receive a boatload of bounce messages, because spammers send their crap to mailing lists with large numbers of invalid addresses and other auto-response accounts. The message the victim receives from my whitelist autoresponder will leave them no worse off than the bounce message they would get if my email account didn't exist.

It might even be helpful to the victim, since it will definitely include a copy of the message I received in the first place. When one of my addresses was used by a spammer, it took me a while to figure out what was going on, because mostly what I got was bounces and flames without copies of the original spam.

Deliberate abuse does present a potential problem. Someone could cause my autoresponder to send a bunch of confirmation messages to a victim as (part of) a DoS attack. I'll extend the whitelist autoresponder so it doesn't send multiple whitelist confirmation requests to the same address. Thanks for bringing that possibility to my attention.

"Potentially Responsible"??

[schon]

This puts undue pressure on a potentially responsible ISP

Potentially responsible? Isn't that like me claiming I was "potentially a 8'5" swedish woman"?

Either the ISP is responsible or they aren't. If they are, then they won't be on the DNSBL.

Re:This way, perhaps, we can get Ralsky in jail ..

[fanatic]

he spoofs the IPs of dialup systems from the servers.

Bzzzt! Thanks for playing, but you cannot send SPAM (or any other kind of email) using a spoofed IP address. SMTP rides over TCP, which requires a handshake prior to establishment of a session. And this requires a real IP address, because the initiator must reply to the reply, before any higher layer data can be sent. Nice try, though.

SPEWS collateral damage whitelist

[persaud]

SPEWS co-opts individual admins (via osirusoft, SpamAssassin, etc.) into a clearly documented process which bears many similarities to economic extortion. SPEWS (with justification) delegates responsibility for economic collateral damage to the indvidual admins whose servers act upon SPEWS RBL publications.

Some experienced sysadmins do not endorse SPEWS' wholesale blacklisting of entire netblock neighborhoods. Those admins choose not to use SPEWS RBL, but may choose to use RBLs that cause less collateral damage. Some experienced sysadmins use SPEWS RBL because they do endorse SPEWS' clearly documented process which bears many similarities to economic extortion.

Many inexperienced sysadmins use osirusoft (e.g via SpamAssassin) without knowing the difference between SPEWS and other RBLs aggregated by osirusoft. Without knowing that difference, these inexperienced sysadmins unknowingly endorse SPEWS' clearly documented process which bears many similarities to economic extortion.

One answer is a SPEWS whitelist + reciprocal blacklisting. Create a whitelist of SPEWS-blacklisted-but-collateral-damage IPs which have *never* been accused by SPEWS (or other RBL) of spamming. When an ISP causes collateral damage by enforcing the SPEWS RBL against a presumed-guilty-but-never-accused IP that exists in the SPEWS whitelist, ask the individual sysadmin to use the SPEWS-collateral-damage whitelist.

If an individual sysadmin uses the SPEWS RBL but chooses not to use the SPEWS-collateral-damage whitelist, they would be endorsing SPEWS clearly documented process which bears many similarities to economic extortion. Such explicit endorsement will earn such individual sysadmins membership in an IP blacklist of "sysadmins who support SPEWS' clearly documented process which bears many similarities to economic extortion". This blacklist would then be enforced by sysadmins whose IPs are SPEWS-blacklisted-without-spam-accusation .

This unbundling mechanism provides a technical means for individual sysadmins to endorse SPEWS valuable spam-fighting contributions without endorsing SPEWS' clearly documented process which bears many similarities to economic extortion.

Long-term, the solution is pseudonymnous, non-profit TLS certificates for SMTP servers with social (not economic or calendar) seniority (c.f. Apache Incubator). The economic variety exists at bondedsender.org, along with whitelist patches for popular open-source MTAs.

How about a different solution...

[Dimensio]

Instead of a single global list, would you rather your upstream's IP holdings be placed in the filters of thousands of individual ISPs? That way, when your upstream cleans up its act rather than being delisted from a single source, they'll have to be delisted from thousands of different sources (many of whom won't bother to fix their lists).

Re:How about a different solution...

[SN74S181]

As everybody here is so contented to say: customers can switch away from ISPs that don't provide the service they pay for. Perhaps ISPs should be required to disclose their list of blocked IPs. With a good consumer-education program in place, people would figure out which ISPs to avoid. Those who want a Net-Nanny type operation could pick the ISP that blocks content and email.

It's rather amusing that a person can get leaped upon as if they are a spam advocate for just talking some commmon sense about freedom in discussions like this. That's how it goes when zealots start ranting about their chosen ire-of-the-moment.

Re:How about a different solution...

[Dimensio]

Perhaps ISPs should disclose that they are willing to host customers who violate their AUP and that they allow their customers who have 'special' contracts to commit theft of service and trespass to chattel so legitimate users will know to stay away.

Re:How about a different solution...

[SN74S181]

"Give me a Z. Z! Give me an E. E!" etc. etc. etc.

Nuts. Just plain nuts. Spam really bugs some people.

Of course it workswork

[Anonymous Coward]

Patently false on all counts. But the last is the one that blew me away:

Look at your spam, where does the majority come from? That's right, AOL & Hotmail.

I've looked at my spam. The majority of the spam does not come from AOL and Hotmail. In fact, the majority of the spam claiming to come from AOL and Hotmail does not come from them. The majority of the spam comes from at&t, chinanet, eli, kornet, pbi, qwest, rr, telstra, uunet, verizon, etc., plus miscellaneous providers in .ar, .br, .cn, .hk, .sg, .mx, .nz, .oz, .tw

Re:EFF says to do the impossible

[Nakoruru]

The problem is not you making a personal decision to create false positives for yourself. The problem is other people making decisions for you which block mail which is not spam without your knowledge.

The problem is some ISP between you and your friends/family/coworkers deciding that your friends'/family's/coworkers' mail is spam without you having any say in it.

The idea is that YOU should decide what false positives to deal with, not a government or an unaccountable entity like an ISP.

Straw dummy

[Anonymous Coward]

Is there any reason why the brutal method should be the one chosen first?

Is there any reason why you should take money to support spammers? Is there any reason that anybody should bother to answer a "question" that presupposes something contrary to fact?

The fact is that RBLBLs in general, and SPEWS in particular, do *not* choose the brutal method first. But if the ISP insists on being irresponsible, then he has no right to a second warning.

Re:Straw dummy

[minas-beede]

Hmm. While I don't see "straw dummy" I can see "overblown language" in what I posted. By "brutal" I meant blocking non-spam-soure email, and "brutal" is too extreme a word.

I could say more, and did. I removed it.

Happy New Year.

Re:This way, perhaps, we can get Ralsky in jail ..

[minas-beede]

Yo - I **saw*** it. Read what I said: he spoofs the IP of a dialup from a system with a fast connection and receives the handshake packets on the dialup IP. These he communicates back to the sending system - the loop is complete. That way he can do port 25 traffic on dialups (e.g. those of uu.net) which don't allow OUTGOING port 25 traffic. The outgoing traffic is on the fast side and spoofs the dialup IP. If a succesful spam complaint is made then all he loses is the account used to do the dialup - it's a throwaway account anyway. For a while the complaints would be ignored, if the claim was made that the spam came from the dialup. Abuse at the ISP KNOWS that outgoing port 25 is disabled - it can't be a spam source. But it is, as far as the IPs indicate. The ISP DOESN'T and CAN'T block outgoing spam with it's systems' IPs when that spam goes out from another ISP.

It took a while to convince uu.net (one of the dialup ISPs.) Once they were convinced they moved right smartly.

But Ralsky never anticipated getting throwaway accounts thrown away one after the other, in just minutes. By sending the URL of the Moscow web page (the last contents can still be seen at http://www.corpit.ru/cgi-bin/h0n5yp0t) to abuse at the ISP of the dialup you give the abuse desk a tool they can use to watch for new IP addresses in their space. They only need to hit reload on their browser to see if a new IP in their space appears. Once it does they verify how it is being used (to receive return packets for spam) and nuke.

Ralsky lost three ISPs in one weekend that way - he burned all his throwaway accounts on three different ISPs. He never saw anything like that before.

Next weekend he was back - he didn't figure out how he was being hit (right about then Shiksaa, who is know to communicate with Ralsky, said in NANAE "a spammer" was begging her to get off SPEWS - it was kiling him. Would *I* tell him what was really causing him the grief? I can't be sure it was Ralsky, but that's what I'd bet.)

As far as I can tell the sending system need not ever have an IP. Even if it does it need never use it or respond to it. (This is immaterial to the scam - just observations.)

You may not see one of the morals: The spammer can be tres clever but a simple, dumb honeypot can still overthrow him. Not that Michael's honeypot was dumb - he added the brilliant idea of a web page that had a real-time log of incoming relay spam.

(More recently Michael's very simple open proxy honeypot that he wrote at about the same time fooled another spammer - it was idle for months, then a spammer hit it. Too beautiful for words, almost.)

EFF got it wrong

[Anonymous Coward]

The Devil is in the details. The right to free speech does not confer a right to steal the property of others in order to get your message out. Further, commercial speech does not enjoy the same protection as personal speech. In particular, unsolicited bulk e-mail is not protected speech but rather constitutes

• Theft by conversion
• Theft of service
• Trespass to chattel

EFF got it wrong

[Anonymous Coward]

"failure to deliver email is a bigger problem." is idiotic. Unless you have a contract with a provider requiring him to deliver mail from you, he has no obligation to you. If his customers are happy with the blocking techniques that he uses, then there is no problem for the people whose opinions are relevant. Their servers, their rules.

If you can't deliver mail to me because my provider bounces it, then find a different way to contact me. Don't tell him that I want him to whitelist you, because I don't. Had I wanted him to, I would have asked him to. If he stops blocking known spam sources, then I will move to a provider that is willing to block.

IN SOVIET RUSSIA

[Anonymous Coward]

The Anti-Spam Nazis block YOU!

SMTP not *that* bad

[Anonymous Coward]

The RFC pretty much states that to be compliant, you have to accept the mail as it is presented. Can't achieve accurate or trusted reverse name lookup information on the sending system? Well, that's tough, take the mail (read this for yourself).

No, you don't have to accept all traffic to be RFC compliant. In fact, the RFC even explicitly mentions blocking mail for policy reasons. From RFC 2821:

The SMTP protocol allows a server to formally reject a transaction while still allowing the initial connection as follows: a 554 response MAY be given in the initial connection opening message instead of the 220.

This is only one example of many.

Charging for e-mail is not the answer

[Anonymous Coward]

Charging for e-mail would kill the legitimate
mailing lists. What we need is legislation
comparable to the junk fax provisons of the TCPA
and to the failed H.R. 1748 from Rep Smith.

Only because spammers lie...

[billstewart]

"Opt-in" is a perfectly legitimate term, which was intended to mean "yes, the recipient really asked us for this", but spammers being the liars that they are, often really means "the recipient made his email address known somehow so we're going to use it" or "checked a box saying something and we did something else" or "I opted in to send him that mail" or "didn't use enough nuclear weapons while opting out".

The legitimate part of the email list industry responded with "double opt-in" to indicate that the listbot sends the recipient a message saying "you or somebody pretending to be you asked to subscribe you to the list, click here or reply if you really want to be on the list" and doesn't add the user to the list if they don't confirm. Most legitimate mailing lists bots do that, though some don't bother. Spammers occasionally claim to be double opt-in, but that's just because they're liars.

Re:You're an evil dialup user! You must be a spamm

[marcovje]

There are a lot of ISP's that only allow their own
email adresses to pass. I think OP is hinting on this.

Re:You're an evil dialup user! You must be a spamm

[Anonymous Coward]

The cancer is not the originating IP address; the cancer is the provider that condones it. Blocking an individual address does nothing to block new spammers at the same provider and does nothing to block old spammers whom the provider has moved around.

The Internet community used to do what you describe. It was ineffective, which is why the current tactives were adopted.

ISP Volume Reduction and Defense In Depth

[billstewart]

If you're an individual user, a computation-intensive spamassassin approach can do a really good job of blocking most spam and blocking very little non-spam. But if you're an ISP or Mail Service Provider, having a conservative RBL can save you a lot of resources, including bandwidth and computation, by throwing away the high-volume relay-abuse spams with as little work as possible, saving the more complex work for mail that's less likely to be spam. (By conservative, I mean "trying to only block actual relays and other known spammer systems", as opposed to "broad-spectrum insecticides and lists that do collateral damage to pressure ISPs or harass their competition.") That might be a 25-50% reduction in total email that the ISP needs to handle, but from an instantaneous-resources standpoint, it's probably higher than that, because spam tends to come in high-volume blasts, while real email is mostly Poisson arrivals. And if an ISP's failure responses are the "Temporarily inaccessible, try again later" type as opposed to permanent rejections, real email systems are much more likely to try again later than spammers are (though of course open relays may still try again later, because they're just mal-administered, not necessarily broken.)

AOL is 200 times that large

[billstewart]

I don't know quite how many people use AOL, but it's about 30 million, plus or minus 50-200%. That's about 200 times as large as XS4ALL. Most of the other big US ISPs have somewhere between 1 and 10 million dialup users. I don't know how many people Hotmail and Yahoo provide email for, but most of those accounts are disposable and low-use. On the other hand, the ISP I use for my email and web page has somewhere around 1000 users, maybe a bit more, so XS4ALL is about 100 times as big :-)

Re:AOL is 200 times that large

[JohanV]

If you use AOL you don't care about your email anyway.

Tagged / Changeable Email Addresses

[billstewart]

If you only use one address, eventually a spammer will get it. One of the solutions for spam prevention is to have an essentially infinite number of addresses, and use different ones for different recipients so you can easily dispose of ones you don't want. If you've got your own domain name, this is somewhat obvious - use addresses like anything1@mydomain.com, anything2@mydomain.com, etc. If somebody starts spamming anything3@mydomain.com, discard it.

A number of the Unix email systems let you get a similar effect by tagging addresses - myusername+tag1@example.net, myusername+tag2@example.net, etc., though sometimes the separator is a "-" or a "+" or something else, and sometimes web forms choke on the separators, and mail forwarding systems don't explicitly support them, and too many humans aren't good at copying them correctly (which has been the real limitation, unfortunately.) You have to discard the abused addresses in your mail client or procmail instead of rejecting it from sendmail or pointing the mailbox to /dev/null, but it otherwise works the same way as the domain solution. Also, if anybody sends mail to myusername@example.net, without the tag, you'll probably get it, and spammers can figure that one out.

Fastmail.fm has a nice intermediate solution, using third-level domains. If your account is username@fastmail.fm, you can use username+tag@fastmail.fm, or you can also use tag@username.fastmail.fm, which works well in web forms and people seem to be able to copy accurately. (They also seem to be much more generally clueful than most webmail systems I've seen.) Their system runs on some kind of Unix system - I think *BSD rather than Linux, but it's at least a flexible and stable enough environment for them to build mail handling tools.

Re:EFF says to do the impossible

[Murrow]

an unaccountable entity like an ISP.

I can leave my ISP at any time if I don't like what they're doing. Sound pretty accountable to me.

If I had a wideband option that advertised that they used SPEWS, I'd swap TO them in an instant.

Repeat after me:

[Anonymous Coward]

There is no legitimate reason to have an open relay.
Repeat 10x.

Sendmail

[Anonymous Coward]

Just to clear this up... why do spammers need an "open relay server"? Why can't they just send from their machines directly with something like sendmail?

Re:Sendmail

[level3rockethead]

Why? Simple. They start to spam from their fixed location, and they get blackholed just as quick. Then they have to move to another IP. Which is a pain.

Better to fire your spam off through open relays (preferably anonymizing the true source), or through open http/socks proxies (inherently anonymizing), and just move to the next when you think the open relay has been burned.

There are spammer-providers who sell lists of open relays/socks/http proxies to spammers.

Re:This way, perhaps, we can get Ralsky in jail ..

[Krellan]

Read the above post more carefully. The spammer was successful in spoofing the IP address of a TCP session, because he controlled both the dialup account and the high-speed account.

SYN from the dialup account.

SYN+ACK from the helpless email server back to the dialup account. Dialup account now has observed both sequence numbers.

ACK from the dialup account, and the SMTP transaction begins.

As sending mail consists mostly of uploading, upload packets to the server are forged from the high-speed account to the server. The dialup account only needs to receive the ACK for the sent data, and the SMTP responses from the server. The spammer uses both the dialup and the high-speed accounts in tandem to keep the connection alive, in effect intentionally hijacking his own TCP connection.

Very clever! The spammer must have had some help in setting up a scheme like this. I don't think he'd be smart enough to write the software on his own.

popfile it!

[zonker]

popfile it!

Re:You're an evil dialup user! You must be a spamm

[schon]

There are a lot of ISP's that only allow their own email adresses to pass. I think OP is hinting on this.

If there are a lot, then you won't mind listing some of them, right?

Links, please.

Another way to fight spam

[melonman]

If there were any decent ways to block spam without resorting to the netblock method, We would gladly use it

Cut off their income by billing people who respond to spam. Last time I suggested this, everyone said it couldn't be done, so please forgive the detail. All you need to do is build a database of spam messages (which already exist), extract the 'click here' addresses (about 3 lines of perl), scan the http log of the gateway your customers use (another 3 lines of perl), pick up the dynamic IP address of the machine requesting that page, find out which user it was and bill them.

I would start with three warnings followed by a bill of $5 a spam reply. For paying accounts, you debit their card. For free accounts, you close them after 3 violations. The point is that 99% of people will get the message after one warning, and certainly after one bill. Spam revenue plummets, game over.

Of course ISPs might not want to do this in case it upset their customers. It's much better upsetting my customers. But, as you appear to have conceded, this isn't about Joe Internet user, it's about reducing bandwidth for ISPs.

BTW, if RBLs are such a staggeringly great idea, you would expect ISPs that use them to be 2 to 3 times cheaper than those that don't, because their overheads are so much lower. Is this the case?

RBLs are a reactionary measure

[Control-Z]

Ok, this guy is seems to be a particularly motivated victim of collateral damage. His paper was pretty much accurate though.

RBLs are primarily a reactionary measure. Sure spammers would keep sending spam from the same server if it were allowed, but they keep getting many accounts all over the world to send from. RBLs are like killing fleas with a hammer. You can't hit them fast enough to keep up, and what about the dog?

Users should not have to deal with being collateral damage, or having their mail arbitrarily filtered before it ever gets to them. Rural internet users may only have one ISP to choose from that's not long distance.

The only real solution to the spam problem is going to be in SMTP itself.

Active Spam Killer (ASK)

[Puppet Master]

I'm surprised that no one mentions A-S-K (Active Spam Killer). It's a small Python script, that uses whitelist technology.

I've used it for about 4 months now, and it has cut my spam from the 100 or so a day I was getting to about 3 a month...

Author Philip Jacob is a clueless newbie

[elvey]

/me whacks Philip Jacobe with a clue-by-four:

1)DNSBLs aren't perfect, therefore we should abandon them? Democracy isn't perfect, therefore we should abandon it? Come up with a better idea, then let's talk.

2)users of well-designed DNSBL-based systems can bounce mail that they suspect is spam, that include information (or a link thereto) about getting out of the DNSBL, AS WELL AS GETTING WHITELISTED/USING A WHITELIST KEYWORD to get mail through despite being blacklisted. This eliminates the false positive problem for email from people for whom it's important that the email get through, provided that they can follow the instructions (put a whitelist phrase in the email subject), and if they can't then I don't want to hear from them anyway.

3)DNSBL operators define an RBL as "A list of servers which send out spam or are known to be open relays"??? This is blatantly false; libelous even.

Who own the AGIS netblocks now???

[silentbozo]

Given then the AGIS netblocks are effectively black holes now, which ISP do I avoid in order to not get assigned one of these cured IPs?

Re:You're an evil dialup user! You must be a spamm

[marcovje]

I know for sure that European cable ISP Chello does.

Re:This way, perhaps, we can get Ralsky in jail ..

[fanatic]

Yeah, I missed that little detail in the parenthetical.

Has anyone ever killed a spammer and claimed self-defense or justifiable homicide? Sure wqould be nice if Ralsky and other swine like him moved on to the next plane of existence.

I'm planning on putting up TMDA and some DNSRBL support on my server at home.

Re:You're an evil dialup user! You must be a spamm

[TrentTheThief]

Ah, well yes. A SysAdmin. I see. Well, I call "newbie," so sit back down and do that homework so teacher isn't cross with you.

You'd better review the bat book and a simple dns/bind book (Sorry, O'Reilly, your's isn't) and see how things really work before you get huffy with your betters.

So, know how to use reply-to. La-di-da.

How are you spoofing the $client_* macros on server side? Schon, stick to playing with _User side_ software (snicker) and leave the server side to others, okay?

The client macros expand to provide the IP address and hostname for a header on the receipient's server. Some mere users (with more knowledge than you) filter on from, IP, and hostname to provide an additional level of filtering beyond what the sendmail provides.

Stick to Outlook Express and imapd and stop butting in.

And you pay for what you get

[minas-beede]

See subject. That's a lot of the objection to spam - the recipient has to pay for it even though the recipient doesn't want it.

(This is old information, of course. I just couldn't resist the opportunity to turn the subject around.)

One out of four isn't bad.

[Anonymous Coward]

I intend for this to be an accurate, even-handed and balanced discussion

While it isn't accurate, even handed or balanced, it is a discussion. One out of four isn't bad.

I believe that all of the ideas that I put forth here are consistent with the Electronic Frontier Foundation's public statement on the use of RBLs as tools to combat spam.

That must be comforting to those who agree with the position of the EFF. However, most of us have to pay for our own Internet access, without any subsidy from the EFF, so our own needs come first.

Definitions
Spam or UCE (Unsolicited Commercial Email)

All Unsolicited bulk e-mail (UBE) is spam, not just the UCE. That includes political and religous advocacy; it's not about content.

We call it unsolicited because the user does not have a relationship with the sender.

No, we call it unsolicited because the recipients did not request it. An existing relationship is irrelevant unless it includes prior permission. If I order an item by e-mail, the seller is free to contact me with information about the transaction and about the specific item shipped, e.g., recall notices. He has no automatic permission to ship announcements of other products, pointers to his cool pr0n site, or lose money fast schemes. This has nothing to do with the issue of what any particular staute designates as actionable.

For balance, please see an RBL operator's definition of spam and compare it with your own experience.

Guess what? His matches, yours doesn't. RBL - Realtime Blackhole List / Relay Blocking List I think there are two definitions here. The definition I am proposing is:

A system for arbitrarily rejecting email messages (spam or otherwise) based on an unknown entity's unknown criteria

Begging the question is hardly "accurate, even-handed and balanced"

Most mail system administrators also assume that they are blocking only spam,

Are you saying that they are illiterate, or only that they are too irresponsible to read the description of a list before using it? If you have trouble poinding in a nail with a screwdriver, that is not the fault of the screwdriver. It is your responsiblity to understand the difference between one tool and another. Some RBL operators misuse their positions of power and knowingly block open relays which have never sent spam, but could be used to do so. There you go again. If they follow their published criteria, then they are not misusing their power. I don't want my ISP to accept mail from open relays. I want my ISP to block them as soon as it is aware that they are open. If my ISP agrees with me and uses an appropriate list, that is NOYB unless you are also their customer, even if mail from you gets bounced.

There's a lot more, but it's all along the same lines: factually inaccurate, loaded language and one sided. It does not reflect the case law and it does not reflect the difference between public and private actions. It does not accede to the right of an individual to control his own assets, property and time, as opposed to the desire of others to intrude on and seize them. And it presumes that the users agree with him. Well, I'm a user, and I dropped my previous provider because he wasn't blocking.

Re:You're an evil dialup user! You must be a spamm

[schon]

I know for sure that European cable ISP Chello does.

No link? (I went to www.chello.se, but I'm english-only.)

How do you know? Do you have a chello.se account?

So (at best) that's one unconfirmed.

Last time I checked, "lots" generally meant more than (at least) one.

Moving Away from RBLs

[JasonAZ]

When my company used UUnet/Worldcom for Internet services, we were plagued by the constant blacklisting of nearly all UUnet IP address blocks. I have sympathy for people who are in this situation. Last week, I tried a different approach from the typical RBL use. I tried using SpamAssassin, Razor in conjunction with Mailscanner. It worked amazingly well. Razor works in a way that legitimate e-mail will not be blacklisted and unsolicited email will be flagged. It is as simple as that. From what I understand, Razor takes the checksum of the incoming mail and compares it to a database of blacklisted mail. Spamassassin, although not flawless, does a pretty good job on determining what is spam. The only RBL I insist you use now is ORDB.

Re:You're an evil dialup user! You must be a spamm

[marcovje]

Am Ex Chello-helldesker.

Therefore I have no link, but maybe one can find one on their main site in a faq section, but probably not in English.

You'll have to find sb with a chello account (and IP, because they check the range too) to verify.

Since the mailservers are mostly unified over the countries (in Austria IIRC), that will be the same over most of the European countries. (don't know about Israel). At least for the larger countries(subscriberwise) like Belgium and the Netherlands.

An observation

[alexo]

>Isn't this how a blacklist is supposed to work? I thought the idea was precisely to annoy the honest users, such that they complain to the ISP. If the users know that they are blacklisted because of a spammer, they are likely to either leave the ISP or pressure it to turn the spammer off. It's not nice, but the intent is to get results.

Isn't this how terrorism is supposed to work? I thought the idea was precisely to intimidate the innocent civilians, such that they pressure their government. If the civilians know that they are attached because of the actions of their government, they are likely to either emigrate or pressure their government to change its policy. It's not nice, but the intent is to get results.