The Spam Problem: Moving Beyond RBLs

whirlycott writes "I just published a paper called The Spam Problem: Moving Beyond RBLs on my site. I comprehensively describe RBLs and list eight specific problems with them. I also get into ideas that next generation antispam system creators should read. I hope that this will be useful to anybody who is attending the Spam Conference at MIT on Jan 17th."

Comments

You know, that would suck.

[aetherspoon]

(refering to the intro in the article)
I mean, you can compare it to having your entire town roped off because one person was a fraud... completely destroying said town, but you still live in it.

Wasting an entire netblock by blacklisting it is not good....

Re:You know, that would suck.

[Anonymous Coward]

How about a pizza company refusing to accept orders from a paticular motel because often noone will admit to ordering there? Stay at a different motel.
If you are using an ISP that does not enforce acceptable use policies restricting unsolicited email, you are supporting spaming activity.

In the past, when just systems that were directly associated with spam were blocked, the ISPs would move the spammer to one of the unblocked ips, and move an innocent to the blocked ip. Turns into 'whack-a-mole'.

With most blocklists, the block starts out small, targeting just the spammer. If the ISP gets rid of the spammer, the block goes away. If the ISP ignores complaints, the block grows.

Re:You know, that would suck.

[minas-beede]

What? With most blocklists the blocks are aimed verified spam sources, exclusively. SPEWS alone escalates, and it appears you assume you know how they escalate. Who, other than SPEWS, operates in a manner even remotely resembling what you claim?

If you would limit yourself to dealing with facts then you'd find factual episodes in which SPEWS escalated a listing long after the spammer was removed, escalating apparently because some non-useful, non threatening vestige of the spam operation (like a DNS entry) remained. In such a case there is no spam threat, no need to list, no need for collateral damage. Your glib explanation doesn't apply: it's a screw-up, an over-zealous action taken carelessly. SPEWS apparently started to believe the extravagant claims being made for it. It's often dangerous to start believing your own PR. Apparently it's dangerous even when you don't originate the PR.

There have been episodes of egregious collateral damage. The total of these do not begin to approach a reason to stop using DNSBLs. Even one episode is reason enough to re-examine and revise a listing policy - the enemy is spam, make sure you hit spam and spam only. Fight the enemy. Making excuses for shooting the innocent is not fighting the enemy, nor is making incorrect claims about what is done.

Re:You know, that would suck.

[Anonvmous Coward]

"How about a pizza company refusing to accept orders from a paticular motel because often noone will admit to ordering there? Stay at a different motel."

Um, exactly how much research are you expecting people to do on motels? Call them up and say "Can I order pizza there?"

"If you are using an ISP that does not enforce acceptable use policies restricting unsolicited email, you are supporting spaming activity."

As opposed to what? Exactly how is one supposed to go about finding out about how effective an ISP's attempts to filter spam are? The biggest problem with your argument is that spammers always change how they operate.

Sorry, but your answers struck me as oversimplified and unhelpful. How that was modded up as 'insightful' I'll never know.

Re:You know, that would suck.

[Senior Frac]

I mean, you can compare it to having your entire town roped off because one person was a fraud... completely destroying said town, but you still live in it.

You're right! I think the townspeople should talk to the sheriff and demand the fraud be arrested already, before he destroys the town's reputation even further. Or, better yet, run him out of town. (remember, this is a privately owned town, no one has a right to live here)

Instead, I think beating the tourists for driving past the town is a bit counterproductive. Don't you?

Re:You know, that would suck.

[silentbozo]

It's more like refusing to accept cargo outbound to or inbound from certain countries, like say Cuba, Iraq, or Afghanistan (when the Taliban were in power.) Some countries still trade with them, and you're more than welcome to stay there, but don't expect to do any business with the US if you do.

If you're smart, you'll do some checking up on your ISP before you commit money to an operation that is going to hand you IP addresses that have been blackholed, and are now worthless.

Easiest way to stop spam...

[Anonymous Coward]

Tell EVERYONE you know never to click on any spam links, or buy spamvertised products. People spam because it WORKS. The only real way to stop it is to STOP BUYING SPAMMED PRODUCTS.

Re:Easiest way to stop spam...

[sfled]

Absolutely. Spread the message to new users. The response to spam is very small, on the order of hundredths of a percent. The spammers get negligible responses because of the sheer numbers of recipients. I can't help but think that it's mainly newbies that respond to spam; x amount of unwary sheep getting sheared the first time they see the opportunity to 'Meet lonely married people' or 'add inches to penis/bust/whatever'.

Re:Easiest way to stop spam...

[Zeinfeld]

Tell EVERYONE you know never to click on any spam links, or buy spamvertised products. People spam because it WORKS. The only real way to stop it is to STOP BUYING SPAMMED PRODUCTS.

The problem is that you are in a global network. It is like the problem of eating whale meat, you can persuade 99.999% of the world population that eating whale meat is a bad idea but the other 0.0001% that is left can eat the endangered species to extinction within a matter of months.

It only takes a vanishingly small number of businesses out there to SPAM and you have a massive problem.

SPAM does not have to even be profitable for people to do it. If I wanted to launder a lot of drug cash I would set up a spam house and bombard people with ads for herbal viagra..

There was a time not so long ago when the majority of the SPAM being sent out was adverts for spam software. SPAM does not have to work as a marketing method for creeps to get rich charging others to spam. The pitch line they use to haul in suckers is 'it must work or why would people do it', well no, it does not have to get one single end customer for it to work for the spammer.

Re:Easiest way to stop spam...

[Frater 219]

People spam because it WORKS. The only real way to stop it is to STOP BUYING SPAMMED PRODUCTS.

Not exactly. Besides being a theft of end-user and mail-site resources, spamming is also a scam perpetrated upon businesses. If you got spam advertising Joe's Naked Kinky Web Site, that probably isn't because Joe thought up the idea of spamming you all on his own. Most likely, a career spammer (let's call him Alan) convinced Joe that spamming was:

1. effective,
2. legal, and
3. everyone's doing it anyway, so why miss out?

Joe then paid the career spammer to spam for his naked kinky Web site. Since all three of Alan's claims are false, and he knows it, this means that Alan has defrauded Joe. He exploited the fact that Joe is probably neither an Internet expert nor a lawyer, but he does feel competition from other naked kinky Web sites, to convince him to pay for spamming.

(Yes, Alan the spammer told the news media that spamming is effective, too ... and they believed him. He was lying there, as well -- but it got him, and spamming, free advertisement in the news!)

This scam does not rely on spamming actually being effective, so long as vendors still believe it might get them an edge over the competition. Thus, getting people to quit buying spamvertised products cannot (directly) affect it. Only when all vendors on the Internet -- yes, including naked kinky Web sites -- realize that spamming doesn't work, isn't legal, and that they can do just as well without it, will spamming go away.

Re:Easiest way to stop spam...

[Pig Hogger]

(Yes, Alan the spammer told the news media that spamming is effective, too ... and they believed him. He was lying there, as well -- but it got him, and spamming, free advertisement in the news!)

Those scumbags often get big, (supposedly) reputable companies: I got spammed by none other than Equifax about a month ago!!!

And did he publish a paper

[TerryAtWork]

on getting his site /.'d into a little ball of slag?

Seriously, I'll try and review the paper...

Incomplete!

[Murrow]

You'll notice that he listed and then did not address the "Common Arguments and Justifications" for running and/or using a RBL. Just couldn't come up with a reason why privately owned servers have to accept mail from any particular person or group if they don't want to.

Re:Incomplete!

[Frater 219]

He's pointing out that current blacklisting systems are stupid. He's pointing out that the people who run the blacklisting systems are generally unaccountable (most lists are secret), that they do impose arbitrary blacklist entries against groups they disagree with, well outside of their advertised remits (such as MAPS blocking an ISP that had a handful of customers that sell spamming software), that ordinary bystanders are frequently the victims of over zealous blocking and that, per se, anyone relying on a third-party RBL based solution is making a huge mistake.

But, you see, those things he's "pointing out" are wrong. They just aren't so. They aren't the way the world works, and they aren't the way DNSBLs work.

• DNSBLs are not secret or unaccountable. They can't be! They are accountable to those who use them (mail server operators), who are respectively accountable to their users. Individual DNSBLs have force solely because sites use them; a DNSBL nobody uses is a no-op. I use certain DNSBLs because I trust them to accurately do what they say they will. If a DNSBL that I use starts going haywire and listing things that it said it would not, then nobody will continue to use it -- and it will therefore be without force in the world. (Incidentally, anonymity or pseudonymity does not equal unaccountability -- but if you don't know that, get the fuck off the Internet, since we fought that one almost a decade ago, and St. Julf of Penet was right.)
• MAPS screwed up, and was held accountable for it. That is why nobody who is serious about spam-fighting takes MAPS seriously any more. They fucked up, they fucked up bad -- and so today they are naught but a minor player. SPEWS, SBL, and ORDB are the big players in the world of DNSBLs, because they do what they say they will do, and they don't fuck around. (Note: That they do what they say they will do doesn't mean they do what you want them to do. You don't get to decide that except for your own mail server.)
• There is no "overzealous blocking" problem. There just isn't. If you are thinking about SPEWS, keep in mind that sites which use SPEWS know what it does and want it to be doing that -- otherwise, they would quit using it. SPEWS doesn't force itself upon unwitting mail servers -- rather, operators have turned to it because it works, it works well, and because they and their users are sick and tired of putting up with ISPs which don't boot off their spammers. It isn't "overzealous" -- it is doing precisely what we want.
• Using DNSBLs isn't a "huge mistake"; it's effective collaboration. Right now, DNSBLs represent the best means for sites to share information with one another about which IP addresses emit spam, or are open proxies, or belong to spam supporters. They are used not only by mail server operators, but also by IRC operators tired of proxy-borne abuse. They are effective -- and if they were not effective nobody would use them. If a better means comes along to do what DNSBLs do, then we will happily use it -- but it ain't here yet.

It is not mail users who want us to consider DNSBLs passe' or something to "move beyond". It is spammers who want us to give up our current most effective tool for collaborating to impede their crimes.

Re:Incomplete!

[squiggleslash]

Uh?

Why do you feel he has to come up for a reason why privately owned servers have to accept mail from any particular person or group if they don't want to? What kind of stupid, inane, black and white, world do you live in?

He's pointing out that current blacklisting systems are stupid. He's pointing out that the people who run the blacklisting systems are generally unaccountable (most lists are secret), that they do impose arbitrary blacklist entries against groups they disagree with, well outside of their advertised remits (such as MAPS blocking an ISP that had a handful of customers that sell spamming software), that ordinary bystanders are frequently the victims of over zealous blocking and that, per se, anyone relying on a third-party RBL based solution is making a huge mistake.

This isn't about forcing anyone to do anything. It's about making people aware that if they chose certain solutions, what the consequences of those solutions are, and that there are other methods that are more sensible and affective.

I've been blocked by the stupid effing incompetent and irrelevent DUL (designed so anyone with more than one ISP account can't send email without an enormous amount of hassle every time they log into the other account: they can't use one SMTP server, because open relays are pretty close to non-existant, and can't send email themselves, because of the entirely irrelevent DUL which could be replaced by an obvious redirect of port 25 by the ISPs that publish on those lists anyway) I have to be careful which DSL provider to go with because many block incoming SMTP connections which means I can't do my own spam management with them, but if I look at my Yahoo Mail account - or any account I've actually used that I can't self-manage, the account is so swamped with spam I can barely find the stuff that really is sent to me, regardless of how good the spam filters are that are provided.

The current situation is stupid. I can manage spam myself (which I am fairly successful at, but only if I have an ISP that lets me do so), I can have an ISP do it, in which case legit email is blocked and illegitimate email still swamps my mailbox, or I can subscribe to a service run by unaccountable activists who frequently abuse that position of trust.

Do I need to come up with an argument that people should be forced to receive email, or even suggest I'd agree with such a mandate (I don't), for you to understand my problems with current filtering systems, and my belief, in general, that those responsible for the Internet email infrastructure are a bunch of mindless jerks who'll be second against the wall when the revolution comes?

Re:Incomplete!

[squiggleslash]

I must admit to having less of a problem with DNSBLs than other types of RBL such as the open relays (which I semi-agree with but wish had taken place simultaneously with pushing standards for authentication) and the DUL - the most dumb idea in the universe since banning people from EFNET for not having IDENTD installed on their home computers.

That said:

DNSBLs are not secret or unaccountable

You semiaddress the issue of accountability but not of secrecy. It's a fact that most services keep their lists secret until affectively revealed by dropped emails. Accountability is tied into list use, yes, after the fact people may drop a clearly abusive operator, but a substantively less abusive operator may get away with blocks for years.

The MAPS case was high profile because MAPS were public about their ban and their reasons for banning. Had they been dishonest, we'd still be arguing the case and MAPS would still be regarded as part of the solution, especially as the usual assumption made by pro-block-list advocates is that any criticism is simply net-kookery or from the spammers themselves. Take a look at some of the stories here and the Usenet groups for prime examples.

As an aside, I have personal experience of spending months trying to get a false entry in the DUL corrected. I had an internet account with an ISP that used a class C block allocated by Bellsouth. Bellsouth flagged the entire /16 block as being dial up. I discovered this trying to email a friend on Netcom.

Who was accountable? Not Bellsouth, they didn't care. Not Netcom/Mindspring/Earthlink (it's one ISP), nobody's going to lose an address they've had for years if they can help it, and indeed my friend prefered to believe it was a fault of my configuration than that it could possibly be Netcom subscribing to an unaccountable blocking list. Not my ISP either, what the hell could they do about it? It took weeks of badgering finally involving phoning Earthlink's 800 number and making a pest of myself before something got done about it.

There is no "overzealous blocking" problem

That rather depends on whether you're a normal user trying to get in touch with people you know or whether you're a BOFH.

Look, let me put it this way: I am not a spammer. I email friends, I email myself (at work, to my Yahoo address, etc), I email family. I don't even operate any mailing lists. And I have problems. I have problems because I have a non-simple config - by that, I mean I don't have ONE internet account with ONE IMAP email address and ONE SMTP server.

Every time I send an email to someone who wanted to receive it, or someone tries to send email to me that I want to receive, and they can't get it, or I can't get it, that's a problem. And I can honestly say that with the exception of the odd occasion where my .dynip.com address has fallen off the net and email hasn't been deliverable to my SMTP server, every problem I've had with undeliverable email in the last few years has been down to over-zealous blocking procedures.

Now, you're saying "Yeah, but it's Yahoo's computers, not yours" (or whatever). That's true, but that doesn't change the fact that legitimate email is not being routed, and it's not being routed because of measures intended to aleviate spam. Yahoo are saying they operate an Internet email system, but when I tried sending stuff to my own account on Yahoo from my static IP Earthlink DSL connection, my computer spent 3 days trying to send it before giving up because the MX host was unreachable. That means that, for these purposes, that service they claimed to be providing didn't exist. And it didn't exist because someone between me and Yahoo - maybe Yahoo, maybe Earthlink - had blocked an email. Oh, but ok, I could have gotten it through if, at that moment, I'd used Earthlink's SMTP relay, but (a) WHY? (b) I have sendmail set up to send email for a reason, I don't particularly want to hunt through my configuration files every time I point at a slightly different but otherwise identical reason. When I'm using my backup non-Earthlink dialup, for instance. Or on the road using a friend's account.

The end result of this is that legit email is blocked, spam (very clearly) still gets through (I already know how to enlarge my penis thank you very much), and so it's fair for me to say that the measures sysadmins are taking to block spam are not working, that they're interfering with legitimate use, that they're not actually ever going to be effective anyway, that they interfere with the communication of unconnected third parties.

The only person in the world who seems to have a 100% effective, never interferes with legitimate email, anti-spam system, often seems to be me. That's because I manage my own email. I don't use lists, I just make sure that businesses trying to contact me only have specially created email addresses (on my system) that, if abused, will vanish in as long as it takes to edit my /etc/mail/aliases file. Works too, I get one spam message every few months.

But the blocks that are constantly being proposed are making that approach more and more difficult. BT, in the UK, apparently block all incoming port 25 connections. Why? Because of complaints about open relays. So if/when I go back, I'm not going to be able to do the kind of filtering I do above, thanks to the so-called anti-spammers.

It is not mail users who want us to consider DNSBLs passe' or something to "move beyond". It is spammers who want us to give up our current most effective tool for collaborating to impede their crimes.

It is mail users, it's not mail administrators, and this seems to be a distinction many in the pro-block camp fail to understand. Between me and any person on the Internet, there are many machines. By creating ineffective and incompetant blocking measures with no clear accountability and no obvious way of rectifying errors (for the vast majority), these systems cause headaches and make the whole issue of sending email a chore. As these systems continue to have less and less relation to the task at hand, as pro-list advocates become more and more militant, and as spammers continue obliviously, email will become steadily more and more unusuable.

And if pro-list advocates continue to ignore the cries of users, and continue to protest that only kooks and spammers complain about their methods, that situation will get worse. From my point of view, as long as emails I send from my machine using completely legitimate (RFC mandated, etc) methods without anything being radically awry about the way I'm doing it, get routinely blocked because of incorrect assumptions, email is broken, and it's the advocates of block list's fault that it is.

Re:Incomplete!

[Frater 219]

I must admit to having less of a problem with DNSBLs than other types of RBL such as the open relays

It is not clear to me what you mean by this. "DNSBL" is the generic term for any DNS-based Blackhole List. "RBL" is a trademark of MAPS, Inc., for a particular DNSBL which they operate. Different DNSBLs have different criteria for what they list.

For instance, some list only open relays, e.g. ORDB. Some list only open proxies, e.g. Blitzed OPM. Some list IP addresses which have sent spam to particular detectors. Some list IP addresses which belong to repeat spammers, e.g. SBL. Some list IP addresses allocated to particular countries or ISPs, such as the blackholes.us lists.

There's as great a diversity of DNSBLs as there is of opinions as to how to run a DNSBL.

You semiaddress the issue of accountability but not of secrecy. It's a fact that most services keep their lists secret until affectively revealed by dropped emails.

I'm not sure what you are claiming here. Do you mean that most mail sites do not tell their users which DNSBLs (if any) they are using? Or do you mean that DNSBLs do not disclose what IP addresses they list?

If the former, I agree that this can be a problem, particularly if the mail sites in question are ISPs. ISPs should disclose their mail filtration policies to their users; it's also nice (but by no means ethically necessary) if they give their users choice as to which filters apply to their individual mail. For other mail sites, such as corporations or research institutions (my workplace is one of the latter) it may be unnecessary given the site policies.

If you mean that DNSBLs don't disclose which addresses they list -- well, this is certainly the case for some DNSBLs, and certainly isn't for others. SPEWS, for instance, publishes their entire list in a text file (warning: long!). Many others do likewise. Some permit DNS zone transfers, so your nameserver can automatically download a full copy of the list and you don't have to query them constantly.

Any of the DNSBLs which I would recommend have clearly stated policies as to how addresses get on the list, and how they can get off. It is certainly the case that some mail operators use DNSBLs that I would not recommend. (Nobody, I say nobody, claims that your mail site should use every DNSBL out there, or that you should use them indiscriminately.) That is, I fear, their problem.

As an aside, I have personal experience of spending months trying to get a false entry in the DUL corrected.

Yes, there are badly operated DNSBLs. Yes, it's unfortunate that some sites use badly operated DNSBLs. That is a problem with the badly operated DNSBLs and not with DNSBLs in general. Please do not tar Steve Linford (operator of Spamhaus SBL) with the Paul Vixie brush.

Yahoo are saying they operate an Internet email system, but when I tried sending stuff to my own account on Yahoo from my static IP Earthlink DSL connection, my computer spent 3 days trying to send it before giving up because the MX host was unreachable. That means that, for these purposes, that service they claimed to be providing didn't exist. And it didn't exist because someone between me and Yahoo - maybe Yahoo, maybe Earthlink - had blocked an email.

I'm a little bit confused here. The issue at hand is DNSBLs, but the usual use of DNSBLs cannot yield a "host unreachable" -- it yields an SMTP error message and possibly a bounced mail. It sounds to me more like your own ISP, Earthlink, was filtering outbound port-25 connections from client addresses, to keep its dialup and DSL users from being used as spammable open proxies or relays. A ham-handed policy, indeed, but a policy decision that it's Earthlink's to make -- and nothing to do with DNSBLs or other sites' spam filtering.

Oh, but ok, I could have gotten it through if, at that moment, I'd used Earthlink's SMTP relay, but (a) WHY?

Presumably, if they're filtering port 25, because that is how Earthlink has chosen to run their network. That is undoubtedly cheaper and easier for them, than it would be to chase down every damn user on their system with an open proxy, open relay, backdoor trojan, or other piece of crapware and kick them off.

Sure, they could do that. But your fees would be triple, and they would go out of business -- so you'd have to find a new ISP anyway.

The end result of this is that legit email is blocked, spam (very clearly) still gets through (I already know how to enlarge my penis thank you very much), and so it's fair for me to say that the measures sysadmins are taking to block spam are not working, that they're interfering with legitimate use, that they're not actually ever going to be effective anyway, that they interfere with the communication of unconnected third parties.

It strikes me as foolish to say that DNSBLs as a category don't work, when anyone who runs a professional mail site and uses them can tell that using the right DNSBLs does make a difference in spam load. My site, with ~1000 users, blocks 2000-3000 spam per day using DNSBLs, local IP blocklists, and some content filters for obvious spam signatures (e.g. "S.1618") and viruses. We also get maybe one false positive a month reported by our users, which we whitelist; we also give users the choice of opting-out of spam filtering entirely for their accounts. (The demand for this? A few Chinese researchers whose home institutions operate open relays.)

It is mail users, it's not mail administrators, and this seems to be a distinction many in the pro-block camp fail to understand.

Thing is, from what you've said, you aren't an ordinary mail user, so you don't get to make that call for the entire mail-using public. You're a network hobbyist, who's choosing to operate his own mail site on a network that has chosen not to support that kind of operation -- namely, an end-user ISP. If your ISP doesn't allow port 25 outbound, or tells other sites not to accept mail from its client addresses (which is what a DUL listing indicates), that doesn't mean you have a problem with other sites' spam filtering ... it means you have a problem with your ISP and its choices for how to minimize problems on its own network.

If you, a hobbyist, want business grade connectivity rather than end-user connectivity which is filtered to minimize abuse, then you need to go to an ISP and get a contract for that kind of connectivity. It will cost more. That you assumed that an end-user ISP would support your hobby -- at the expense of being unable to clamp down on abuse of their own systems -- indicates to me that you might need to think your plans through a bit more.

Re:Incomplete!

[squiggleslash]

If you, a hobbyist, want business grade connectivity r...

No, I want to send email and want to be able to do it without changing my configuration every time I use a different ISP. Hobbyist? If, by that, you mean "someone who uses the Internet", then yeah, I'm a hobbyist.

I explained that. I explained it more than once. You have some how come to the conclusion that using more than one ISP is equivalent to "requiring business grade connectivity". That's exactly the kind of idiotic assumption that's causing email to be broken by poorly thought out so-called "anti-spam" systems.

It's perfectly reasonable for a user to expect an email message sent via the normal RFCs to arrive at its destination. Anyone who believes that "ordinary users" shouldn't expect that, that they should use something that originally was intended as a convenience compulsorarily even though their email software does not require it, and that "ordinary users" should find anything other than a one ISP one mailbox configuration a complicated nightmarish chore to use, has ludicrous expectations.

I'm not a spammer. I don't look like a spammer. The DUL doesn't do a damn thing to prevent spamming. It prevents legitimate email only. It, and all the other idiotic spam filtering systems that have nothing to do with spam and everything to do with politics and half-arsed pretenses to make it look like the implementer is doing something about spam, should go.

Re:Incomplete!

[Frater 219]

I'm not a spammer. I don't look like a spammer. The DUL doesn't do a damn thing to prevent spamming. It prevents legitimate email only.

And I didn't defend the DUL as a DNSBL; I think it's one of the less useful ones that exist (partly because it is secretive being commercial). Your ISP's choice to list its dial-ups with the DUL -- or to filter port 25 -- however, is its decision, not the decision of "zealots" or "anti spam fanatics" -- and your problem is with the ISP, not with "spam filtering systems" in general. Whining about generalities never solves problems; addressing specifics does.

FWIW, if you do not understand the history of the DUL then you are probably not going to reason very effectively about it. The DUL was created to combat a particular sort of spammer abuse which was common at the time -- namely, using "throwaway" dial-up accounts to send spam directly to victims' MX hosts. That is no longer a particularly common spammer tactic (partly as a result of the DUL's actions at that time).

Today, however, there's still a common sort of spam abuse which comes from end-user ISP client networks -- namely spam through open proxies on client systems. We have open-proxy lists (such as Blitzed or the Monkeys.com list) which pick up new open-proxy addresses, but they aren't terribly adequate against dynamic addresses.

Preemptive methods

[LunarOne]

Simple, preemptive methods of fighting spam are often the best:

1. Don't let a spammer verify your email address
2. Don't post your email address on the internet
3. Secure your email client
4. Avoid common email traps
5. Fight back

Let me know if these can be improved.

Re:Preemptive methods

[robbyjo]

So... according to the webpage, the all the 5 tips are summarized as follows:

Please try the following:

• Click the Refresh button, or try again later.
• Open the www.thomsonville.com home page, and then look for links to the information you want.

Gee... many thanks Slashdot!

Re:Preemptive methods

[DeadSea]

You have no control of your email address. I only give my address that I use for personal correspondence to my family and closest friends. My father gave me a DVD rental for my Birthday, and on of my friends invited me to a party and used one of those web sites that do invitations. Between the two leaks, my address is now in the hands of spammers and I am getting 2 to 3 a day at that address. Short of beating my friends and family around the head, I don't think I can stop that sort of thing.

Not posting your address is important. If you you post your address on the internet, expect more than 10 spam a day. Similarly if you use it to post on usenet, expect more than that. It seems to be hardly sufficient, however.

I have decided that my only recourse is to change my address every time it starts getting spam. People that email me at an old address get a note saying why the address has been disabled and a url on my website where they can fill out a form to contact me. (btw, if you are interested, you can get the contact form that I use on my website, it is designed to thwart spammers, unlike formmail and other cgi to email gateways.)

Re:Preemptive methods

[artemis67]

I can't read your links because of a good slashdotting, but from what I see, your arguments are flawed.

1. Don't let a spammer verify your email address

This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.

Additionally, the extremely low cost of spamming means that bogus addresses are a marginal problem at best. The spammer would rather take a chance that the email account is active and send the spam than not send it.

2. Don't post your email address on the internet

I learned this lesson too late. A Google search pulled up a dozen newsgroup messages with my email address in them. Nine were posted by me, and I asked Google to remove them. Unfortunately, 3 are by other people quoting me, and I have no recourse to remove them. Spammers will therefore have permanent access to my main email address.

Additionally, I have no control over emails that other people send that include my address. I hate "pass along" emails that certain people get and feel the need to send to everyone in their address book, but I can't help that a) my email address is included in a batch of 50 others, and b) it's a very convenient way for spammers to collect verified email addresses.

3. Secure your email client

By this I assume you mean using client-level filtering. I do. Alot. I typically get about 60-80 pieces of spam a day, and have set up 30 or so filters. But that only catches about 2/3's.

Simply put, there is no client-level filtering solution that is going to work 100% of the time.

4. Avoid common email traps

I assume here that you mean things like "posting to newsgroups". You can only avoid traps that you already know about, and most people don't know about them.

Besides, why should we live in fear of the spammers? They are encroaching on our free expression. I certainly think that the structure of email needs to be revisited to put the prohibitions on the spammers, not the recipients.

Re:Preemptive methods

[Neon Spiral Injector]

I have several domains, which I host myself. When ever a company asks for my e-mail address, it is always "company"@mydomain, if it is being passed through a 3rd party billing company, it is "billing"-"company"@mydomain.

This works well, if someone sells my address, I just kill that alias.

But what happens is some idiot I know in real life will do exactly what you said above. Or just add me to their address book, and get infected with some virus which starts sending stuff out with my address. Or what ever, my address slips out.

So I go and kick them in the head, tell them how stupid they are.

I also run SpamAssassin, which does catch a lot of the stuff, so for the most part my inbox is pretty bareable.

Re:Preemptive methods

[Dammital]

Between the two leaks [...] I am getting 2 to 3 a day

I opened a new account at bellsouth.net as a result of installing DSL at home, and was spammed the next day. Because my userid is four characters long, I presume that the spammers were using a permutation technique to develop addresses.

Sending spam is so cheap, they can afford to send stuff to *all* short email addresses, published or not.

You can guard against leaks in your best paranoid fashion -- but they'll find you.

Unfortunately, with so many government entities to deal with we will never have legal protection against spam. The low-lifes will simply move to more agreeable jurisdictions. Any long-term solution to the spam problem is therefore a technical issue. I predict that whitelists will become far more common in the next couple of years.

Re:Preemptive methods

[ryanvm]

You are correct that the methods you list are effective at fighting spam. However, effective does not mean practical.

For example, how does a site's webmaster (for instance - you) seperate legitimate mail from spam. Obviously because it has to be posted on the Internet, it's going to be deluged with spam. Yet it also must be read. So your failsafe rules for eliminating spam fall flat on their face.

The real solution to spam is upgrading SMTP to require authentication before accepting mail. Booting spammers (and later, enforcing anti-spam legislation) would be a lot easier if mail headers couldn't be forged.

Re:Preemptive methods

[Pig Hogger]

This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.

This is precisely why HTML e-mail is ***TRIPLE (secret probation) PLUS BAAAAAD***. Disable that HTML e-mail display bug^h^h^hfeature now!!!!!!

Re:Preemptive methods

[artemis67]

Switching to plain text is not the issue. Confirmation is a minor point to spammers, because the cost of sending emails to inactive addresses is negligible. So why inconvenience yourself by switching to text-only email? That's a lot of trouble for so little effect. If you hate HTML emails (as most of the respondents seem to), then that's something else entirely different. I don't hate HTML emails and I don't want to sacrifice HTML functionality. To me, that's killing a fly with an elephant gun.

My workaround is much simpler; I always select spam email as a block in my email client (because 99% are easy to spot without opening), and delete them without previewing.

Of course, the other means of verification for the spammer is the absence of a bounce-back message. A little less reliable, but as I say, I don't think the problem is that huge for the spammer.

Regarding the use of aliases on the internet, I concur; I have several email addresses set up for just that purpose. But guess what. Those aliases still receive the spam! So, you haven't really solved the problem, you've just moved it to an account which you check less frequently.

Ultimately, the SMTP server model needs to be rethought from the ground up.

Re:Preemptive methods

[Phroggy]

This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.

I use Mozilla as my mail client, which is configured not to load images or execute scripts in HTML e-mail. If images are attached, they'll be displayed below the message (not inline), but images will not be loaded from a web server. If I really want to see the images in a particular piece of mail, I could always turn images back on, but I don't think I've had occasion to do this in several months.

Re:Preemptive methods

[orthogonal]

1. Don't let a spammer verify your email address

This isn't a huge problem for spammers. If they send you an HTML email, then just opening the email (or previewing it in Outlook) can provide the verification that they need.

Using your firewall, prevent your email client from connecting to any addresses other than your mail servers.

You can still view HTML mail (if you are unfortunate enough to have correspondents who are too clueless to use HTML for mail); but any linked images just won't be downloaded. You'll still be able to click links to lauch your browser if you actualoly feel the need to.

Re:Preemptive methods

[DeadSea]

Pardon a lame paraphrasing of a tired idea, but if we stop using our email any way we like, the spammers have won. ;-)

For me the spammers won a long time ago if this is the standard you are using. I used to:

1. Put my email address on my web page so that people could contact me.
2. Post to news groups using a non-obfuscated address.
3. Think that I would have an email address forever--"You can always contact me at..."
4. Read my email without filtering it.
5. Look forward to the new mail sound.
6. Run an open mail relay.
7. Expect that emails I send would get to the person I sent them to without being filtered.

Re:Preemptive methods

[artemis67]

This doesn't solve the underlying problem of the spam clogging up the mailserver, but it does mean I don't have to deal with it.

Do you trust it, though? When it flags incoming messages as spam and moves it to the trash (or the Junk Mail folder), do you feel secure enough that you can routinely trash them without scanning the subject lines?

No matter how good, client-level filtering is not a solution. All it takes is for one Really Important Email to get flagged and deleted to lose confidence in the system.

Re:Preemptive methods

[Lulu of the Lotus-Ea]

> Don't post your email address on the internet

This bad advice has become a real pet peeve of mine. I guess because it is so absurd for me personally... but I share that trait with 90% of people who actually work for a living.

In particular, I am a writer, and publish on "the Internet." For example (in which I discuss the need for email disclosure along with spam filtering techniques):

http://www-106.ibm.com/developerworks/library/l-sp amf.html

In other words, it is my -business- to disclose my email address. Email is not, and should not be, restricted to a little clubby thing with your family and close friends. It is an important and legitimate purpose to allow previously unknown parties to contact you (individually, and relevantly, not as a generic member of a list of 14 million address). People sell things, we work on free software projects, we are interested in discussing topics of interest in our lives, and so on... strangers aren't -per se- spammers, and should not be treated as such automatically.

Re:Preemptive methods

[silentbozo]

For me the spammers won when I had to install filters to use my e-mail. I still report the bastards, but it's nothing more than a formality now - the ISPs who care about spam have cracked down, and the ISPs who don't care about spam (and who are based in places like China, safe from effective retribution) just ignore your reports. The declining reliability of e-mail (directly and indirectly caused by spam and worms) is an equally bad, if not worse problem - short of re-engineering the SMTP protocols to let you know if your message has been sent and read, I'm not sure what we can do.

At least some of my reports contribute to weighting for IPs when they add new listings to the RBLs.

RBLs in Spamassassin

[reaper20]

My spamassassin-tagged mail usually scores between 1 and 1.5 ( a 5 is needed for a **SPAM** tag) - which in the grand scheme of things seems to be enough of a weigh for the value of an RBL. Don't absolutely trust it's value, but don't ignore it completely either.

I don't really see why anyone would use RBLs just by themselves. Personally, I have spamassassin catching the "big spams", you know the ones with webbugs, html-only, forged headers, etc. etc. I occasionally tag those as junk in my Mozilla Mail, while tagging my normal mail as not-junk. The Bayesian filter takes care of the occasionally sneaky spam. Once trained it's an awesome combination.

Re:RBLs in Spamassassin

[spacefight]

I don't really see why anyone would use RBLs just by themselves.

That is easy. While spamassasin does the work pretty good - you still have to download the whole crapload. RBL enabled MTAs won't accept any email as soon as a blacklisted IP wants to connect. This saves bandwith, disk space, client side filtering (read: cpu time) and so on.

what he missed...

[erc]

Quite a bit, actually. This reads like a topical treatment by someone who really doesn't know the subject. For example he mentions whitelisting, but in the solutions section, completely ignoring the fact that there are already solutions, both commercial and open source, that use whitelisting, blacklisting, and greylisting. In fact, I wrote one about 6 months ago for a client, and they are quite happy about it, it affords them complete spam protection.

Re:what he missed...

[Russ Nelson]

I agree with you that Phil Whirlycott doesn't understand DNSBLs very well.

But shouldn't your URL be http://www.escarpade.org ? :-)
-russ

Published?

[Flamesplash]

Is this "published" just because he put it up on his website and told people about it, or will it actually be published in a journal somewhere?

Re:Published?

[Flamesplash]

Journals are just as suspect as the web.

I realy have to disagree with this. I could "publish" the statement 'poop is healthy to eat because after eating some I got over a sickness' but that would never get published in a medical journal of any type without substantial medical inquiry to back it up.

No one can prevent you from making false scientific claims on your website, and while they may pop up from time to time in journals they are fairly rare.

-shane

Whiner...

[DaGoodBoy]

My company was collateral damage on SPEWS last month and I kicked the *^&^#$* out of our ISP for hosting Global Travel on our netblock. They got booted and we got cleaned off the list. Bada-bing bada boom.

RBL's are like a fever. They tell you when something it wrong and only a dork blames the fever when the problem is the disease. Get your ISP to whack the spammer or change ISP's.

http://groups.google.com/groups?threadm=Fc6K9.2625 2%24Db4.726975%40twister.tampabay.rr.com

Re:Whiner...

[minas-beede]

In your case it worked out. If you had simply been asked to persuade your ISP to boot the spammer would you have ignored the request? Are you actually so dense that it takes blocking your email to get you to act?

Note that I'm not trying to claim you are dense or prove it - my point is that you could have been reached in a way that led to the same result but that DID NOT block your valid email. Is there any reason why the brutal method should be the one chosen first? Uh, any good reason - surely there are thugs who enjoy using their power to abuse others.

Not to mention that there's been more than one case in NANAE where the collateral damage was suffered by someone related to an ISP that had long ago booted the spammer but had not removed all traces. No spam flowed because of the omission, the listing was long after the spammer was removed, no risk to anyone existed. Still, the IP of an innocent party was wrongly listed, wrongly blocked, much time and energy was spent discussing it in NANAE, a person and organization that could perhaps have become spam opponents were given reason to hate the guts of spam fighters. No win of any kind I can see in that.

And, of course, the brutal blocking actions haven't ended spam, other than the occasional anecdotal victory. I ran an open relay honeypot, I saw how modern bulk spammers operate. The DNSBLs are a weak tool to deal with that. Don't take my word for it: run your own open relay honeypot. You'll quickly learn a lot about how spammers operate. All the while you'll be stopping their spam, too. Open proxy honeypot? Bless you - you'll also do wonders.

(Any of you sendmail experts able to figure out my pseudonym?)

Re:Whiner...

[melonman]

RBL's are like a fever. They tell you when something it wrong and only a dork blames the fever when the problem is the disease.

It's not like any fever I've come across. For the analogy to hold, when I'm ill my entire village would get a fever, and some of the population might die, in the hope that the sound of the ambulances and funerals might alert me to the fact that I have a problem.

I'm glad you are so happy about having your reputation threatened when you have done nothing wrong. Our business is hosting websites on our own machines in a server park. Server parks are always going to be a good place for spammers to rent cheap machines, and if our clients start getting their mails bounced, they don't write to the server park owners, they cancel their contracts with us. And, no, we can't just take our servers elsewhere at 3 minutes' notice, so the RBL puts zero economic pressure on our server park (which seems to act fairly promptly on abuse compaints anyway).

RBLs punish the innocent to get at the guilty. This is wrong. The next time my business is hit by SPEWS or any other such system, I'm going to start writing pithy articles for the general press, with the aim of scaring customers away from ISPs that use RBLs, eg "Do you want your ISP to tell you what email you can read?. And I shall certainly take legal advice on whether I can sue companies who bounce my mail with any rejection message containing the word 'spam' for libel or something similar.

Re:Whiner...

[Steve B]

And I shall certainly take legal advice on whether I can sue companies who bounce my mail with any rejection message containing the word 'spam' for libel or something similar.

Are you also taking legal advice on whether you can sue the /. posters who post a reply containing the word 'idiot' for libel or something similar?

Re:Whiner...

[Tadghe]

"And I shall certainly take legal advice on whether I can sue companies who bounce my mail with any rejection message..."

Ok hotshot, I've just added cyberporte.co.uk to our local RBL list and taken the liberty of posting a link (with a C&C warning) to your post on NANAE. Would you like the address of our attorney now....

This tactic has been tried several times before. There is no right to deliver (or even connect to) our or anyone else's systems. we can (and will :) reject you with any message, or none at all, at our choosing.

If you decide to read abit more you'll find that most RBL rejection messages refer to you a page, or site that is usually pretty explict in telling you why your netblock or address range has been rejected.

oh, and for the record, we make sure our users are aware that we use RBL's. Currently we have (including yours) 549 netblocks listed in our local RBL list, that's not including the 12519 that we have SPEWS blocking at the firewall... I'm not counting the 6 country wide netblocks that are banned.

The argument "Do you want your ISP to tell you what email you can read?" is sure to carry a hell of a lot of weight with joe internet user who's tired of all the MMF/Porn/Junk spam he's getting these days.

If there were any decent ways to block spam without resorting to the netblock method, We would gladly use it, but given the past attempts at such methods, I just don't see it happening.

Re:Whiner...

[melonman]

Are you also taking legal advice on whether you can sue the /. posters who post a reply containing the word 'idiot' for libel or something similar?

No, because none of our customers read /. :-)

Re:Whiner...

[melonman]

Ok hotshot, I've just added cyberporte.co.uk to our local RBL list and taken the liberty of posting a link (with a C&C warning) to your post on NANAE. Would you like the address of our attorney now....

This is great, you've just demonstrated that RBLs are not neutral, and are driven more by a desire to punish than to solve the problem. If I ever need to send an email from that domain, I'll use one of our other smtp servers, or that of one of my ISPs, or rent a clean one, or... the problem last time was that I didn't know how ineffective RBLs are. The one thing I'm not going to do is change my server park because someone on the other side of the world is on a quixotic crusade. It's not my battle, and I object to people trying to enlist me.

Why your netblock or address range has been rejected.

In our case, it is because one machine in our 16-bit IP range had been used for spam, so SPEWS blocked 65,000 machines, each of which is administered by a different person/company. How does jeopardising the existence of my company, whose smtp server is clean, help to fight against spam? Like I said, we can't just pick up a fairly full server and take it somewhere else, so there is no real economic pressure on the server park.

Joe Internet user is tired of spam

See n previous /. discussions about this, but the (statistically) average email address gets about 3 a day. Quite a lot of /.ers say they get very few spams, and many of those who do say that the annoyance value is pretty low. On the other hand, if you are trying to buy a skyscraper (real example) and you can't get emails from the estate agent, who happens to be in a different continent, that is extremely annoying, especially if there is absolutely no reason for blocking that particular server.

Any decent way to block spam

Err, if netblock is such a greeeeat system, how come spam is increasing? Am I missing something? If there is a consensus that spam is a major problem, legislate against it. I don't have a problem with that. I do have a problem with what mrneutron calls 'collateral damage', ie people damaging my reputation to get at someone else, especially when the system obviously isn't reducing the amount of spam sent globally.

Re:Whiner...

[melonman]

That is to get you up off your butt and call the hosting company and scream bloody murder at them.

I know what the idea is, I just don't think that it is a fair way to proceed. If you have a problem with my server park sys admin, feel free to scream at him, don't threaten me in order to get me to do your work for you! In ethical terms, it's the same logic that says that kidnapping children to put pressure on the parents is a really neat idea.

The system works

I hate to sound slow, but why is spam increasing? Is it that the system doesn't work, or that so few people use it?

Re:Whiner...

[Just Some Guy]

I'd mentioned this in response to another thread, but it's still true.

I live in a small Midwest town. There is exactly one viable option for Internet access: a small DSL/wireless ISP. If that ISP were blocked by SPEWS and I subsequently lose the ability to contact some of my customers via email, I can yell at said ISP all I want - but that's my only recourse. I don't have the possibility of switching, short of going with one of those "$6.95 per month unlimited dialup!" companies.

Where's my ISP's pressure to enforce anti-SPAM policies? They're the only game in town and they know it.

Fortunately, they seem to be as intolerant of SPAM as any other network company, and their customer service is great. That's good, because I'm effectively stuck with them.

Re:Whiner...

[AndroidCat]

I just don't think that it is a fair way to proceed.

Ask me if I care.

Re:Whiner...

[Tadghe]

> This is great, you've just demonstrated that RBLs are not
> neutral,and
> are driven more by a desire to punish than to solve the problem.

No, I demonstrated our desire not to recieve email from people waving C&C threats. Care to take back that threat of suing anyone who blocks you and maybe helping find a better solution instead bitching and moaning about how unfair DNSRBL's are? I'm all for a better solution (as are most people).

> The one thing I'm not going to do is change my server park because
> someone on the other side of the world is on a quixotic crusade.
> It's not my battle, and I object to people trying to enlist me.

Nobody said you had to, but if your ISP chooses to host spammers, then you'll have to deal with the issues of getting blocked. An analogy would be living in a apartment where the landlord lets drug dealers live next to you. You don't have to move, but you can't really complain about the police cars parked outside either. Again, it's not an ideal solution, but we'll stick with it until a better one exists that:

1. Doesn't increase my server costs (e.g content filtering overhead)
2. Doesn't increase my bandwidth costs (e.g some whitelisting techniques)
3. Doesn't increase the overhead of administration (We spend enough time keeping the bad guys out now thank you)
4. Catches as much SPAM as DNSRBl's.

> See n previous /. discussions about this, but the (statistically)
> average email address gets about 3 a day.

Great, now multiple that 3 by the number of users.. for example take a clients 11000 users, multiple that by 3...33000 messages, assume a average size of 10K-20K and suddenly I'm looking at around half a gig in bandwidth....

> Err, if netblock is such a greeeeat system, how come spam is
> increasing?

I never said, nor implied that netblocks are a good way to block spam, what I did imply is that they are at the moment, the most cost effective way for an ISP or company to block spam.

Re:Whiner...

[melonman]

I don't need to. All the discussions I have had on this subject suggest to me that the people in favour of this sort of solution really aren't worried about preserving other people's rights at all.

Re:Whiner...

[melonman]

Care to take back that threat of suing anyone who blocks you

See my last posting, or just show me where I said that in the first place. The point on which I would attack is the content of the rejection message, not the fact that the address is blocked. The difference between me and a spammer is that I can demonstrate that any rejection message associating our server with spam is false, and I can quote this very thread to show how damaging this allegation can be :-)

Better solutions

Sue the spammers, like AOL, or, if everyone really feels so strongly about the issue, as you claim, change the law.

Drug dealers living next door

If the police start harassing me or telling all the other neighbours that I am a drug dealer, I think you will find that the law is my friend. But, in any case, you are assuming that my server park is a den of iniquity. You have an IP address, check it out. How bad is their record? No-one can stop the first spam being sent, and, as far as I can tell, we spent a week answering angry emails from our clients because the sys admin at the server park went fishing for a couple of days.

Re:Whiner...

[melonman]

I can't do any of those things either when the problem is transient and the server park is basically clean. If I was hosted by Verio I could understand it, but anyone offering an smtp server to third parties can get caught from time to time.

OK, so spammers have to work 10x harder. How many times more cost and time effective is their set-up? As long as there is a margin in spam, people will continue to spam. The fact that spam is increasing suggests that it still pays. At what point are blocklists going to stop spam paying? I have a hunch that the answer is 'never'.

Turning off the blocklists would indeed be interesting, but, unless the spammers are completely stupid, I wouldn't expect it to have much immediate effect at all. Do they really continue to send to blocked addresses, long term?

Re:Whiner...

[theLOUDroom]

In your case it worked out. If you had simply been asked to persuade your ISP to boot the spammer would you have ignored the request? Are you actually so dense that it takes blocking your email to get you to act?

Dense?
Why are you even mentioning the word dense?
He was a friggin customer! His email being blocked was the first indication he had that a spammer was hosted by his isp.
So what next? He asks his isp to boot the spammer. If they refuse, he doesn't want to have an acount with them anyways, so he'll go somewhere else. Seems fine to me.

It's hardly "brutal" anyways. The email bounces, it doesn't just disappear and leave him wondering why no one ever replies.

Finally, if the isp is only partially fixing a spam problem, after booting the spammer, then they're incompetent and you don't want to be working with them anyways. The ip you complain was "wrongly blacklisted" was actually rightly blacklisted. It just wasn't removed from the list, because someone wasn't doing their job.

If an isp gets a notification that an ip has been added to a blacklist, isn't it obvious that they should contact the maintainer of that blacklist when the problem is fixed? The fault in your example does not lie with the blacklist, but with the isp. If you choose a crappy isp, expect problems.

Re:Whiner...

[Erik Fish]

Not to mention that there's been more than one case in NANAE where the collateral damage was suffered by someone related to an ISP that had long ago booted the spammer but had not removed all traces.

That's life in the big city. Most of the time this happens when an ISP thinks that it's good enough to just remove the web site but still host DNS or mail for the spammer. This is called "spam support services" and is a no-no. Even on the rare occasion when it's something like IP addresses still showing up as being allocated to the spammer, how is anyone outside the ISP supposed to know that the spammer is no longer a customer? So many ISPs come to NANAE begging to be delisted when they have done literally nothing about their blatant spam problems that why should the one out of ten that is simply incompetent be given special consideration?

And, of course, the brutal blocking actions haven't ended spam

Oh somebody call a waaaaam-bulance. Free clue: Nothing will end spam. Even if e-mail becomes metered you will still get spam -- it will just come from the people who send you paper junk mail instead of Alan Ralsky.

Re:Whiner...

[Dun Malg]

the people in favour of this sort of solution really aren't worried about preserving other people's rights at all.

Oh, now I see your problem. You seem to think people have a basic right to unfettered email. Sorry to say, friend, but access to my inbox isn't a right. ISPs provide a service. If your customers' ISPs use an RBL, and part of your ISP's IP address range gets blocked, then that's a business matter you need to take up with your ISP, or your customer needs to take up with his. The Internet isn't a public works program. Hell, it's not even really a fully definable entity; its basic common denominator is a few communications protocols.

Don't cheapen real rights by trying to lump crap like "the right to send email to my business clients". The Internet is an amalgamation of commercial enterprises, for the most part. If you don't like it, petition your government to create a happy-socialist public network where there's no spam and no blocked IPs. Otherwise, get over it.

Re:Whiner...

[Erik Fish]

If you can't tell is there a problem? And you appear to claim a dead DNS entry does something - what I can't imagine.

I know this may be hard to imagine, but some ISPs actively collaborate with spammers. They switch their spammers around to different IP blocks, pretend to cancel their accounts and play tricks with the DNS. If an ISP is going to claim that a spammer is no longer their customer there needs to be no trace of the spammer on the ISPs machines that is visible to the outside world or there are going to be questions raised as to the veracity of the claim. This is not a difficult thing to arrange for an ISP that has really, truly and fully booted a spammer.

Check with me in April. spam probably won't be gone by then

Isn't that what I just wrote?

bouncing all relay email doesn't end spam. Look at the history - it hasn't.

Neither does (or has) honeypots. The real open relays will always outnumber the fake ones. Honeypots also do nothing against spamhauses. Who needs open relays when there are plenty of cash strapped ISPs willing to sell connectivity to spammers for a quick buck?

That honeypot of yours is cute, but the 6000 user ISP I work for has blocked almost 4000 messages today thanks to SPEWS and other blocklists. If you want evidence just check out how many spammers there are crying their eyes out in NANAE because of SPEWS.

Re:Whiner...

[JoeBuck]

In many areas there is only one available ISP for high-speed net access (DSL or cable). What happens when this ISP gets on a popular RBL? Do you sell your house and move?

But there are alternative ISPs selling DSL service in your area, you say. Not for long, thanks to people like Michael Powell at the FCC (who want to take away the rules requiring your phone company to provide access to competitors).

Re:Whiner...

[SacredNaCl]

I want my provider to block known spam sources; I don't really care whether that affects your e-mail. If you don't feel that the lists are worthwhile, then don't use them, but those that do want to use them on their own networks have every right in the world do do so, regardless of your kvetching.

I want my provider to block *spam* and only *spam*. Blocking 50,000 or 1.5 billion users (as a few of them do) from being able to send us email is not protecting us from the 150 or so spammers targeting us. It's keeping us from being able to communicate with a large chunk of the world.

It's very frustrating to find out your legit email is not getting through, and even more frustrating to learn (usually a substantial time later..sometimes not at all!) that mail sent to you is not getting through. As much as I hate spam, RBL's are a very poor solution.

This is a rotten situation. You can't send a mail to someone because you aren't on their whitelist, or you can't send a mail to someone because your netblock is listed on some list completely unrelated to you, you work in sales and mention "We can finance that for you, we get some great interest rates through XXX bank" and your mail gets flagged spam by some ISP's content filter, or you can't recieve it for any of the above.

It's petty, and it's making email useless for all. So instead of destroying email -- let us start to work on a new mail transfer protocol that can avoid most of these problems. Get a working solution, get the specs out, make it temporarily backwards compatible with existing systems, and have a hard switch date for the change to the new system. Maybe a period of 2 years to impliment the switch. They are doing it for IPV6, why can't we do it for email?

Re:Whiner...

[melonman]

Making spammers work harder, keep opening new accounts, and changing ISPs is the strategy.

Yeah, I get that bit. So the result is that big ISPs won't touch them, which is good, and that they end up in server parks next door to me, which is inevitable, and that SPEWS blocks my mail because of my (very occasional) neighours, which is absurd. According to most of the people posting on the thread, the aim appears to get me to keep changing ISPs to put pressure on the ISPs. Except that my ISP has a pretty good reputation to start with, so where would they like me to go next? Verio? No server park can stop people renting a machine and spamming like mad until they get shut down. If they start spamming on Thanksgiving, it could take several days to shut them down.

I don't have a problem with blocking addresses. We have blocked one or two ourselves (to avoid getting several thousand copies of various viruses a day rather than to block spam). I don't have a problem with blocking IP ranges when all those IP addresses are administered by one company. I do have a big problem with blocking IP ranges when, to all intents and purposes, the IP addresses have nothing to do with each other. As far as I can tell, the only solution would be for me to take my server out of a park, lease a big pipe and buy my own IP range, which I can't afford to do at the moment.

[RBLs will never stop spam being profitable] you may be right!

So we've reached dynamic equilibrium. The spammers will keep wandering around the server parks, and my mail will keep getting blocked, in order to not deal with the problem of spam, and if I complain about the damage this does to my business it makes me slightly less popular than Osama Bin Laden. I'm glad this makes sense to someone.

Spammers keep spamming blocked addresses

So there goes another argument. If they keep spamming blocked addresses, RBLs don't reduce backbone bandwidth usage either.

Re:Whiner...

[silentbozo]

So there goes another argument. If they keep spamming blocked addresses, RBLs don't reduce backbone bandwidth usage either.

I would argue that as an incorrect interpretation. The spammer must not only successfully attempt to connect to the target ISP's box, they must be able to mail the text of the entire message. RBLs deny the spammer the ability to mail the text at worst (cutting down the amount of crap that needs to be accepted), and at best totally deny the spammer the ability to connect at all.

Thus, they can still try to send to blocked or bad addresses, but because the delivery handshake is refused, the message isn't sent, and backbone bandwidth is conserved.

Now, the above assumes that the ISP actually blocks based upon an RBL (ie, deny connection or delivery) - if they accept the connection and just filter (ie, tag the received message), then yes, your criticism would be valid, as no bandwidth would have been conserved.

Re:Whiner...

[melonman]

Oh, now I see your problem. You seem to think people have a basic right to unfettered email.

Err no, I'm with you on this one. It's a business matter, and ISPs who block addresses for no good reason will end up losing customers. That's why the guy who is blocking me for threatening legal action (which I didn't, but there you go) hasn't the guts to block all .fr sites, despite the French government's landmark case against Yahoo. It's the logic of the school yard bully: you pick on the little guys and polish the shoes of the big guys.

The rights I was talking about concern what ISPs say about me to third parties, and I maintain that the content of a rejection message is subject to the same law as any other written communication. So block away, but please make sure the rejection message is factually accurate.

EFF said it better

[Lumpish Scholar]

whirlycott's article points to the Electronic Freedom Foundation's Public Interest Position on Junk Email (Google cache), which begins:

Executive Summary: Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

For the past several years, the Electronic Frontier Foundation (EFF) has watched with great interest the debate regarding what to do about unsolicited bulk email from strangers, or spam. We have been asked to lend our support to bills that have been introduced in Congress, and we have been approached in various other ways to help lead the fight against this annoying intrusion into people's email mailboxes.

While members of the EFF staff and board find this unsolicited email to be as annoying as everyone else, we believe that the two most popular strategies for combatting it so far--legislation and anti-spam blacklists--have failed in their fundamental design. Anti-spam bills have been badly written, are unconstitutionally overbroad, and frequently wander into areas where legislators have no expertise, such as the establishment of Internet standards. And anti-spam blacklists, such as the MAPS RBL (Mail Abuse Prevention System Realtime Blackhole List, the most popular), result in a large number of Internet service providers (ISPs) surreptitiously blocking large amounts of non-spam from innocent people. This is because they block all email from entire IP address blocks--even from entire nations. This is done with no notice to the users, who do not even know that their mail is not being delivered.

The focus of efforts to stop spam should include protecting end users and should not only consider stopping spammers at all costs. Specifically, any measure for stopping spam must ensure that all non-spam messages reach their intended recipients. Proposed solutions that do not fulfill these minimal goals are themselves a form of Internet abuse and are a direct assault on the health, growth, openness and liberty of the Internet.

Email is protected speech. There is a fundamental free speech right to be able to send and receive messages, regardless of medium. Unless that right is being abused by a particular individual, that individual must not be restricted. It is unacceptable, then, for anti-spam policies to limit legitimate rights to send or receive email. To the extent that an anti-spam proposal, whether legal or technical, results in such casualties, that proposal is unacceptable.

Re:EFF said it better

[Zeinfeld]

Executive Summary: Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

The problem with the vast majority of psuedo-solutions to spam is that the promoters simply will not listen to any ideas other than the one they first thought of and they simply won't listen to people who point out that blocking good mail is a serious problem.

The 'cry me a river' response is as idiotic as it is arrogant. SPAM is a problem, failure to deliver email is a bigger problem.

That does not mean that we don't address the problem of SPAM, it just means that we have to approach the problem from both ends, identifying the good signal as well as eliminating the bad.

The MIT conference is likely to be a failure because the organizers are only presenting the tried and failed filtering approaches of the past. Those approaches are now well understood, they can mitigate the problem but can never do more than that. Filters suffer from reverse network effects, the more widely used they are the greater the incentive to program arround them.

Blacklists fail for many reasons, not least complete lack of accountability. As the paper reports the operator of one blacklist that claimed to only list open relays actually listed sites for other reasons. Ultimately a blacklist that does not have some robust accountability structure is simply a vigilante operation. Vigilantes are frequently popular with people who think they are victims of crime regardless of whether they create more problems than they solve.

The tools we need to start applying are digital signatures and email authentication in combination with whitelists. This follows sound business process, if you want to talk to someone well known their secretary will use a two step process, first ask who you are and check to see if you match the access criteria (e.g. to set up a cold call meeting with a Fortune 100 CEO you had better be a Fortune 500 CEO), then check to see if you really are who you claim to be.

Authentication and Authorization requires no heuristics and there is no feasible counter-strategy for the spammers.

I believe that the way to stop spam in the long term is to deploy signed email ubiquitously. Self signed certificates are sufficient for this purpose if we can provide a lightweight authentication via a DNS-linked PKI.

For example consider the problem of stopping spam to email lists. These are a prime target for spammers as the email server does most of the work. As a result most email lists are now filtered so that only subscribed readers can post. This has in turn been gamed by the spammers who use automated tools to scan the archives of an email list and send emails with forged headers purporting to come from another subscriber. Authentication and authorization prevents this mode of attack.

The counter-argument to using authentication is that the spammers can get their own credentials. If you spend some time analysing SPAM however you will find out that this is unlikely. Almost every spam has forged or obscured headers. While this does not prove that this is a requirement it is certainly indicative of the fact that the spamers do not want this type of visibility.

Even if a spammer can get a credential they are most unlikely to get a credential that would match my personal whitelist which would consist of the signing keys of the email lists I subscribe to and the domain names of the member companies of W3C and OASIS.

Re:EFF said it better

[Zeinfeld]

I think they will talk a lot about using Bayes, which I don't think has been widely tried with respect to email filtering.

It does not matter what content inspection approach you try. They all suffer from the fact that as the number of people who have access to your filter grows so does the incentive to test against the filter and shape their content to get through.

There is an exact analogy here to email viruses. The virus writers are constantly counter-gaming the scanners. The only reason the system works is that writing a virus is a relatively high cost, low incentive operation and the virus fingerprints are updated in realtime.

The solution to the virus problem is not better virus detection. The solution is email clients that do not blindly execute active content.

Re:EFF said it better

[KC7GR]

The EFF was quoted as saying...

"Email is protected speech. There is a fundamental free speech right to be able to send and receive messages, regardless of medium."

Actually, no. That's only partly correct. It would be fully correct if the Internet, and its associated E-mail functionality, were a true "public" resource, with free access for all funded by federal income taxes. However, such is not the case.

While it is true that the act of writing E-mail is indeed protected speech, sending E-mail is a PRIVILEGE, not a right, just like a driver's license. There is (rightfully so) no law or any legal requirement for the admin/owner/operator of any E-mail system to accept any traffic that they do not wish to.

Why? Because the vast majority of the 'net-connected servers are PRIVATELY owned and operated. This is a critical point that all too many people, both admins and end users, are either unaware of or choose to forget.

"Unless that right is being abused by a particular individual, that individual must not be restricted. It is unacceptable, then, for anti-spam policies to limit legitimate rights to send or receive email."

There they go again. Until the EFF gets it through their head that the ability to E-mail is not a "right," they're just going to loop themselves into an endless argument.

If someone is paying monthly fees to an ISP that has a high spammer population along with legitimate customers, and the ISP is doing nothing about their spammers, then that someone is supporting (indirectly) abuse of other people's 'net resources.

Also, I have a challenge for the EFF or anyone else. Show me an ISP service contract which GUARANTEES 100% E-mail delivery to ANY host under ANY conditions, AND the ISP that actually manages to pull it off.

No? I didn't think so.

"To the extent that an anti-spam proposal, whether legal or technical, results in such casualties, that proposal is unacceptable."

And what would be more "acceptable" to the EFF? No functional E-mail at all? Because that's exactly what we'd get, in very short order, if all the current blocklist providers were to simply shut down, as the EFF seems to want.

Come to think of it, there might be an idea. Have SPEWS, Spamhaus/ROKSO, etc. all stop operations for just one or two days. I would wager that the resultant vast increase in spam load would be an excellent example of what would happen if we were to believe the EFF.

I may have agreed with them on other issues, but this position of theirs that E-mail is a "right" won't hold water. Neither will their stance on blocklists.

Perhaps I should just forward all the spam I get to their feedback address? ;-)

Re:EFF said it better

[markwelch]

> Executive Summary: Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients. <

Sorry, but NO. This is great in theory, but the problem is that spam shifts all costs to the victim, and the victim cannot be forced to accept unlimited costs for creation of a complex system that insures due process and appeals.

My personal mail server receives many THOUSANDS of mail delivery attempts per day, all of which come to me (or nobody). Approximately 98% of these are spam, and more than 90% are forged in multiple ways (fake headers, fake server names, invalid return addresses, and frequently forged to show MY server name as the sender).

A week ago, I turned off my server-side filtering and collected several hundred spam emails in about an hour, before re-activating the filtering.

I spend approximately 15 minutes per day managing my spam filters (mostly adding new IP addresses and domains to the filters). Whenever I skip this management for a few days, my incoming spam volume rises substantially (in other words, if I don't close the door, dozens of spams per day come into my email client through some of the doors I didn't close).

Other people have irrational filters, too. AT&T, for example, has blocked all email that contains "markwelch" as part of the source address (hence all email from my servers is refused). I'm not sure why -- it might be because I've send hundreds of spam complaints to ATT.com, or it might be because so much spam has been forged with my domain name faked as the sender ("joe jobs"). But I don't dispute AT&T's right to do this, nor do I demand that AT&T provide me with a response or explanation or oppportunity to be heard. It sucks, but responding to spam is a triage activity, you must skip over some of the complex problems and try to manage the ones you know you can.

I do not currently use any third-party RBL or listing service; I manage my own filters. It's expensive and annoying, but I do this so that I can manage the process of filtering so that I don't constantly block my friends who are stuck with ISPs who are on some other blocklists.

I periodically post my complete filter list at: http://www.MarkWelch.com/Welch_Filters.htm so that people who can't reach me, can check to see if their IP address or domain has been blocked on my end.

Re:EFF said it better

[Erik Fish]

Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

This is what is stopping me from donating to the EFF. They do a lot of good work, however this is a ridiculous position that refuses to acknowledge the realities of the situation. E-mail is and has been from the very beginning an unreliable way of sending information. With this paper the EFF is taking the position that anyone with an e-mail address is required to recieve anything sent to it. Because after all, even speech from someone abusing their right could stop at any time! So we'd better not try to block them because they might realize the error of their ways and send an apology and if it couldn't get through then we would be evil oppressors of free speech!

Re:EFF said it better

[Dimensio]

Therefore, if you are going to raise the specter of protected speech, then you damn well better have a narrow enough definition of Spam to insure that it is clearly illegal speech.

How about "it shall be illegal to send unsolicited advertising where the cost is shifted upon nonconsenting third parties." That would cover...pretty much all spam.

The telephone company does not have a right to filter.

The telephone company cannot filter because of their 'common carrier' status. It means that they must allow all traffic through regardless of content. Individual ISPs, however, are not common carriers and as such they are not subject to such rules. This means that they get to put up whatever filters they want, and it is all legal (as it should be, since it is their equipment).

Re:EFF said it better

[Dimensio]

Don't tell me that you haven't heard stories of law enforcement from local PD to the FBI ignoring small-time crack jobs when someone reports a system compromise. Those are cases where decidedly illegal actvitiy has taken place and law enforcement has decided that it's not worth pursuing.

Re:EFF said it better

[Erik Fish]

I have no way to independantly verify WHO was responsible for the blockage. So being an "informed consumer" in this case is practically impossible. Changing ISPs every few weeks as they drift onto and off of the various block list is not practical either.

If you care that much then get your own domain and run your own mail server. Otherwise get used to the fact that unless you can trust your ISP you'll never know for sure what's going on -- with your e-mail or anything else. A few months ago there was a three or four day period when my cable modem was dropping off the network promptly at 1:00 in the morning every day and coming back up after 10 minutes to half an hour of downtime. When I called the support line after the third time it happened (open 24 hours, incredibly enough) they said they had no idea what it could be. My suspicion is that someone somewhere was performing some kind of maintenance but nobody had bothered to tell the support department. Granted this is pretty minor stuff, but it illustrates my point.

On the internet your connectivity is always going to be in the hands of someone else. You can either buy some fiber and become a player who can negotiate (and re-negotiate if necesary) or you can continue to use consumer level services with the features and drawbacks that most consumers are comfortable with.

As for my opinion on end-user software for spam "blocking" (which by that point is really just spam deletion) my journal says it all.

Open Relays

[Znork]

The section on open relays I find rather odd. An 'open' relay is a relay that accepts mail from anyone to anyone, something which is an extremely bad habit. This guy starts arguing it's necessary to have open relays to deliver mail for some unspecified reason. It's not. You relay mail to legitimate adresses behind your mail relay, and you relay mail from legitimate adresses behind your mail relay and you dont relay to anyone else. Then you dont have an open relay. There is no way there's any technical reason to relay from anyone on the outside to anyone else on the outside, ever.

Has he completely missed that point?

Oh, well. If I'm to replace RBL type filtering with another anti-spam mechanism, there's only one I'd consider. That one is going complete pre-mail opt-in, in which case he's far more screwed than he is today. Live with the trouble of RBL's and get your ISP to do the right thing, or get a far, far more draconian solution.

Re:Open Relays

[operagost]

The only situation I can think of is one where the SMTP server in place must run an old version of the software for compatibility or licensing reasons. In that case, one could probably still manage access via stateful packet inspection, although the cost outlay there would probably outweigh any savings gained by maintaining an obsolete SMTP server.

There are surprisingly recent OSes that stil can't limit relaying to specific hosts; it's all (open) or nothing (closed). One example: OpenVMS. Until TCPIP v5.1 last year, it didn't have this capability. Of course, the excellent third-party Multinet has for some time.

Re:Open Relays

[stephenbooth]

Has he completely missed that point?

I'd have to say, yes.

Personally I use Spamcop's RBL and reporting service. I check the held mail page a couple of times a day. I have yet to see a legitimate mail be blocked and it's reduced the number of spams a day I get from hundreds to 2 or 3.

Maybe some RBLs still work the way the author decribes but from what I'm hearing that's not the way many work now. Now it's more like a reporting user recieves a spam (hopefully very near the start of the spamming run) and reports it. The reporting system works out the most probable source and lists it (due to the fact that spoammers often move within a netblock the netblock rather than the individual IP address has to be blocked for the RBL to be effective), the system also mails the admin address for the appropriate domain (and any listed interested third parties) with the information required to identify the spammer and asks them to deal with them. That IP address is also monitored by the RBL. When the spammer stops sending spam or the administrator informs the RBL operator that they've dealt with the problem the netblock is taken off the RBL.

If the mail system administrator are on the ball and not asleep at the switch there's no reason why the total time from a netblock being entered into an RBL to being removed need be more than a couple of hours. If they're crap at their job or beligerant then they don't deserve honest customers.

The complaints made by the author of this paper are very reminisent of some of those I've seen on antispam/pro-RBL mailing lists from spammers who've had their spams stopped by RBLs. Draw your own conclusions, but I'm inclined to go with "If it looks liek a duck, it quacks like a duck nd tastes great with plum sauce...".

Stephen

Re:Open Relays

[dubl-u]

There are surprisingly recent OSes that stil can't limit relaying to specific hosts; it's all (open) or nothing (closed).

If an OS is not secure enough to be put on the big, bad, internet, it should be put behind one that is. Obsolete and/or deficient software is a reason for firewalls and proxies, not for being a menace to the network.

Re:Open Relays

[djmurdoch]

I know that Spamcop has blocked Declan McCullagh's politech mailing list several times, in revenge against Rackspace.com. Only bad press has made them stop. Their blocks have had no effect on Rackspace. They have only created bad press.

I think the last time Politechbot.com was blocked was in November, when Spamcop was introducing a new listing policy to target "round-robin" spammers. These spammers buy a block of IP addresses, and spam from each of them in turn, switching away from one when it gets blacklisted. Spamcop started listing the whole /24 block when it saw evidence that a large proportion of the IPs had been used for spamming. Unfortunately, politechbot.com shares a /24 with enough spammers that it got caught in the crossfire.

Once that happened, Spamcop refined the rules to make listing of a whole /24 harder. Since then I don't think politechbot.com has been listed.

There are other cases (e.g. spamex.com) where the current policy doesn't work either. In this case, there's a spammer doing round-robin spamming in a /27 that's near spamex's IP; currently Spamcop isn't flexible enough to block a /27.

Re:Open Relays

[Skapare]

The open relay obscures the ability to block spam. It's either all permitted or all denied based on IP address. Some selection can be made by sender email address. But then, the open relay operator could filter on that, too.

Open relays impose added costs on recipients to filter out the spam. And this is done by the open relay operator to lower his costs. And that's one of the reasons I block open relays. But I do whitelist individual senders, so they can still use the open relay. I block them at SMTP MAIL FROM, not at the router.

The spammer can send via their ISP's relay, directly, or via an open relay. The only way to stop the spammer is to remove the spammer's connection, and the only entity that can do that is the spammer's ISP.

You repeatedly make pointless statements like that. Not all ISPs are willing to remove the spammer's connection. Of course we block those ISPs that do that. But because the spammer can get around it through open relays and open proxies, those get blocked, too.

There are reasons where open relays are necessary.

I've still not seen any specific reason for an open relay that isn't shot down by there being shown a way to do it without an open relay. I can't say there isn't one, but I've just never seen one, despite your repeated statement. But I am at least certain that if one is found, it represents and extremely rare circumstance. In any case, if you must run an open relay, be it for some obscure technical reason, or just laziness, then don't run any other customers through it. And don't make threats against those who choose to not accept it. Then those who prefer to block only the open relays and not the whole network of the operator, can do so. It's the threats that I believe have resulted in most of the blocking of your entire net.

And BTW, any mail from wherever it cannot be delivered in a legitimate way, I consider not to be legitimate mail. So I wouldn't be losing any legitimate mail by blocking an open relay used only for such obscure cases. Whether anything else gets lost is up to you.

Re:Open Relays

[Skapare]

The blocking of Rackspace.com is not revenge blocking. It is simply being blocked because Rackspace.com is not doing its part in being a member of a spam-free network community. By being blocked, it is thus cut off from the spam-free network community. It can go on sending to the spammy network community all it wants.

Re:Open Relays

[Skapare]

Rackspace is the ISP that has called me three times to try to sell me service, even though my phone number has been listed with the Texas No Call list for months. But they aren't the only one to call me. Comindico called me all the way from Australia to try to threaten me for blocking them because of spam. Their threat? That they would block me back. Oh boy.

Re:Open Relays

[Guppy06]

"even though my phone number has been listed with the Texas No Call list for months"

No Call lists and the like don't work if you already have a pre-existing business relationship.

Solution? Dump them, then tell them to stop calling. If that doesn't work, take them to small claims court and get the $500 federal law entitles you to (as well as any legal fees)

Re:Open Relays

[Skapare]

I have no pre-existing business relation with Rackspace. I don't use their service. There is nothing to dump. They were cold-calling, probably from leads extracted from domain registrations (my guess). They did violate the No Call List.

Re:Open Relays

[Skapare]

The open relay obscures the ability to block spam. It's either all permitted or all denied based on IP address.

This is just your broken filtering, which you insist on keeping broken. Your broken filtering isn't my problem. It is trivial to filter on the IP address in the Received Header. Even if the spammer inserts some additional forged headers, their real IP address is still there, and will be found on an IP address RBL.

This is where you are wrong. But I'm glad you are finally making it clear you expect people to accept the full body of every piece of junk mail and have to spend all that CPU time parsing each and every one of those headers.

You complain about standards, or lack thereof, for things like SMTP AUTH (even though a non-mandatory standard does exist for it, so we all can know how to do it in an interoperative way, which is what standards are really about). Yet there exists no standard on the syntax of the Received headers. The format might well be consistent for each piece of mail from your open relay, but that is just not so across the spectrum of all received header formats out there. The cost for me to parse these non-standardly formatted headers is greater than the cost to you to test the IP address, or user authentication, of incoming mail on your servers to be sure it's really your customer.

The open relay obscures the ability to block spam. It's either all permitted or all denied based on IP address.

It doesn't obscure anything. There is no difference (Header-wise) between spam sent through the spammer ISP's closed relay or an open relay. The same headers are in the messages as there are when the spammer uses their ISP's closed relay. If you filtered on IP addresses in the Received Headers, it wouldn't matter what relay (open or closed) the spammer used. They could use any relay, anywhere in the world, and it wouldn't make any difference. The spam would still be blocked. Which is my goal.

There is still the issue of having to accept message content and parse headers. See above.

Your concern is getting your legitimate mail through. To do that you need to find a way to make your legitimate mail distinguishable from any spam, or else make sure there is no spam. The choice is yours.

But of course, as you have said in the past, it isn't your goal to block spam. This explains why you insist on simplistic filtering and your insistence on the "necessity" of blocking open relays.

You've claimed this before. But I've never said such. You are apparently unable to distinguish between goals and methods.

Not all ISPs are willing to remove the spammer's connection. Of course we block those ISPs that do that. But because the spammer can get around it through open relays and open proxies, those get blocked, too

That doesn't mean you can't block spam. And this isn't my problem. I'm not responsible for some other ISP's policies. Their spammers still have IP addresses, just like everyone else. Those IP addresses go into Received headers, no matter what relay they use. Anonomizing relays and open proxies are a different problem, but can still be blocked by IP address, whether they use their ISP's closed relays, or some open relay.

If you run an open relay, your are responsible for making it difficult for me to distinguish legitimate mail sent through your server, from spam that irresponsible ISP is allowing their customers to send. You are responsible for your open relay. Why not mark which messages coming through are from your customers, and which are not?

And don't make threats against those who choose to not accept it. Then those who prefer to block only the open relays and not the whole network of the operator, can do so. It's the threats that I believe have resulted in most of the blocking of your entire net.

This is false. We are blocked in revenge because we block the relay testers. Also, we haven't made and 'threats' against anyone. We have successfully engaged the legal department of one ISP, after we learned of a credible threat to block our relays. The lawyers went head to head, and we won. Its not case law, but its clearly expert opinion. However, most ISP's don't block open relays. Very little of our email has ever been blocked. When it has, we've contacted the ISP, and the usual response is that they stop using the open relay list altogether. They could just whitelist us and keep using the open relay list. Instead, most people consider such blocking of legitimate mail, and entire ISP's inappropriate. They think the blacklist's goal is to block spam, and are usually quite unhappy to find out that isn't the case. And they're usually appreciative of the suggestion to use the IP address in the Received header, which improves their ability to block spam. Which is their goal, too.

I don't know if it's most or not, but a substantial number of ISPs do block open relays. It probably is most because the number of small ones run by the people in the trenches who really do know what is going on outnumber the few big ones run by pencil heads and golfing buddies who really don't have a clue about spam (or are looking to actually do some spamming for themselves some day). It sounds to me like you lied to a few ISPs because you very well know what blocking is all about. Or more likely you told them about the costs they would have litigating in court to a pinhead run ISP.

As far as legal action goes, the end users of an ISP have an expectation of privacy. There are laws that protect that privacy. That precludes ISP's from joining boycotts of legitimate email. The users' email isn't a pawn to be played with at the whim of some admin. It belongs to the user, not the ISP.

Joing boycotts, if you want to call it that, has nothing to do with privacy. It has everything to do with business relationships. Of course an ISP that blocks some mail a customer wanted in a manner outside of their business relationship is wrong. If the ISP advertised a service where all mail gets through, but secretly are blocking some mail for any reason, then that customer has cause to bring action against the ISP. Or they can take the easy route and switch to another ISP.

However, if the ISP offers as part of their service to help clean up the email by removing spam, and does not pretend that the system is perfect (no method is), then the business relationship is sound, and this is not a case of "playing with mail". That's what I offer to my customers now, and doing anything less would be against that business relationship.

Customers who have separate mail servers for their own domains (most of them) do get to have these things customized. A few have all anti-spam measures turned entirely off. Their choice, and it's easy to manage because it's a separate server. But I am planning on the next phase of mail services where customers can control their own email control policies even down to a single recipient address in the same domains as other users have different controls. Then it will be they who decide whether or not to trust your mail servers to carefully limit what they relay to just legitimate mail, or not.

One possible solution ...

[JSkills]

Ok this one's not for everyone. What we did at goofball.com is to set up a user configurable spam filtering system based on a combination of rules and use of the RBL.

There is a simple web based front-end that allows users to add and modify rules for accepting or rejecting mail based on a variety of factors - all saved in the datbase. Things like checking the subject, to, from, or the body of an incoming email for the presense (or lack) certain strings is a simple example.

All of this is done is Perl using Mail::Audit of course. I know there's Spam Assassin, but this was a little more fun (and customizable) for us.

The final check is the Realtime Blackhole List. When we first implemented this solution, we noticed in the logs that almost everything was on the RBL (even mail from yahoo.com). In fact, our own server was on the RBL. We'd never sent spam before, but I'm sure our relay was open at one time or another.

Since the system is configured to look for "accept mail" rules first, the solution came down to adding "accept" rules for pretty much everyone we knew, so that mail from known parties would be accepted even if on the RBL.

So now I get no spam at all - ever. I get very little mail at all in fact. It's really analogous to having an unlisted phone number. It's not the perfect solution by any means, but I'll take it any day over slogging through literally hundreds of spam mails every day ...

The Author misses a few points

[cluge]

1. If SPAM wasn't so bad or annoying, or system resource draining the USE of RBL's would not only decline it would likely stop.

_NOTE_ IOHE RBL's in on a single mailserver rejected over 70% of all incoming requests. It took more than 90 days before we had our first complaint from using that RBL. Think of all the mail that didn't get delivered and the saved disk space, system resources et al.

2. Any RBL used is the choice of **insert org here** and not on the people sending mail.

_NOTE_
Very often the people charged with running **insert org here**'s mail server have been told "you must reduce the amount of spam I recieve". For many RBL's are an affective way of doing just that.

3. If the authors point about the legality of relay testing can in fact be upheld in a court, then ALL SPAM is illegal. Since this has not been found to be the case in US courts, then relay testing must be legal. (i.e. 18 USC Sec. 1030 (a) 2 (c))

4. If the Sherman anti-trust act can be applied here then it would also apply for spammers. SPAM is more in violation of the anti-trust act than RBL lists. (Why? because it prevents the delivery of legitimate e-mail, thus purposely causing delays and interfering with commerce)

Other solutions mentioned are worth merit, but it should be pointed out that these solutions are most often used and are most effective when used in conjunction with RBLs. A better solution would be to fundamentally change the way e-mail delivery works. DJB (http://cr.yp.to) had an idea some time ago where the cost of e-mail sent is born by the sender, not the reciever. That system may be the best bet. The ability to then block senders becomes a lot easier and your ISP doesn't have to do the very much "heavy lifting". The spammers get to do it. I like that idea better.

cluge

Re:The Author misses a few points

[swb]

We use SPEWS RBL and it takes out about 40% of the incoming as SPAM on a non-business day (holiday, weekend) and about 20% on a business day. This is on a site that gets a moderate amount of incoming email, about 8-10k messages per day.

We've had two collateral complaints, one from a vendor and one from a client.

The vendor I understand; they're a marketing concern and they have been dipping their toes in "direct email marketing" (highbrow spam?), but they do it from their business netblocks.

The client suprised me; a household name in the home products business -- you'd all recognize their name. But they're one of those "smart" businesses that buys low-budget ISP service, takes whatever 'free' /28 the ISP gives them and NATs everything to that block. Surprise, surprise, Joe Spammer had that /28 (or the /24 that contains it) so they're getting nailed as spammers. What I don't get is why someone wouldn't fix this! Get a different /28, get de-listed from SPEWS, do something.

But other than those two, I have gotten zero complaints. It's an imperfect tool (I still get a dozen or so per day), but easy to implement and as long as the people making the list are active and flexible, a valuable one.

Re:The Author misses a few points

[AndroidCat]

Our hosting company has been trying for over a year to get their entire address block removed from SPEWS.

They can't have been trying very hard. Have you considered the possibility that they are lying to you? (Sadly it happens quite often.)

Re:The Author misses a few points

[AndroidCat]

What's the SPEWS record number or the IP?

SPEWS might be anonymous (cuts down on the cartoony legal actions) but the newsgroup is hardly anonymous. Professional? How much are they getting paid? (If they are, I want a piece of that as a drafted unofficial SPEWS helpdesk support recruit. :^)

Re:The Author misses a few points

[AndroidCat]

64.39.30.253 isn't in SPEWS now. (Spooky! And No, IANS.)

I think the Vietnam reference qualifies under the Ron's Rule of Rubber Analogies variant of Godwin's rule.

Re:The Author misses a few points

[AndroidCat]

Not a bad list, but it could be more clear about when SPEWS will open a hole. Usually it's when someone is in the process of moving from their spammy ISP, and they have a definite timetable of when it will happen.

The last time that I saw them do it, SPEWS opened a hole within an hour of the formal statement/request on NANAE of a move in a month. Whoever they are, they're fast.

Bollocks!

[odaiwai]

Having briefly looked at the paper, it seems like the usual complaining about RBLs as being too broad you see all the time in NANAE (news:news.admin.net-abuse.email).

Summary: someone tries to send email and finds that they're listed on SPEWS. They complain because "we're not an open relay", without figuring out just why they're on that list. Almost invariably, they're on the list because their ISP persistently ignores spam complaints and prefers spammer money to honest customer money. I think there's been about two or three actual mistakes in the SPEWS listings in the year or so I've been following NANAE. Otherwise, it's all been a legitimate extension of the block because the ISP knowingly ignores complaints and supports spammers.

Spam is theft. Theft of Bandwidth, theft of service and theft of time. It's that simple. Spammers are thieves. ISPs which support spammers are thieves. Soon, they'll be blocked from the public internet for anti-social behaviour. After all, if your local bargain supermarket ignored the thieves stealing 20% from every transaction you make with them, will you go back?

Many South American and Asian ISPs are blacklisted because they were quite happy to spam everyone when they could steal bandwidth and service from other ISPs. Now that they're blacklisted, they're whinging and moaning about 'freadom of speach', interference with interstate commerce, and other such bullshit.

It's about none of these things. Blacklists are about protecting your network from a Denial of Service attack by spammers.

People who complaing about RBLs (OR DNSBLs, to be more accurate) are missing the point. They should be complaining about spammers who think it's acceptable to steal my bandwidth and your bandwidth to advertise their product..

dave "the only good spammer is a rotting corpse, dangling from the noose"

Re:Bollocks!

[djmurdoch]

Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves. When in reality, it is those "junk mail" advertisements that are keeping the postal service alive.
While spammers certainly are not keeping ISP's alive,

You pointed out the difference yourself. Your supermarket pays for its flyers to be delivered. Spammers steal resources from their recipients in order to deliver their ads.

Spammers are thieves because of the way they deliver their ads. Sometimes they're also thieves because they're cheating scum who deliver fraudulent scams, but that's beside the point.

Re:Bollocks!

[Doc Hopper]

You've voiced an opinion on Slashdot which will be both unpopular and likely to quickly be moderated down. What we have here is two people arguing about an opinion:

• Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves.

Contrary to what many anti-spam activists would have people believe, you are correct. Spammers are not thieves. They are, however, engaged in an unethical form of guerrilla marketing which has the net effect of shifting costs of advertisement to the consumer, rather than to the advertiser. Much like the RIAA labels people that infringe copyright as "pirates" and "thieves", to little effect, calling spammers "thieves" is probably over the top and unlikely to bring positive change.

• Just be thankful that with computers you can filter the through all the static. You can't filter out billboards, newspaper ads, loudspeakers, etc. etc. etc.

The key difference you've missed is where the costs are borne. My company pays $650 a month for our T-1. By 9 AM this morning, we had received over 11,000 attempted emails. We have 300 employees. Of those 11,000, roughly 200 were legitimate mail. The rest were spam, double bounces, or roughly 4,000 attempts in nine hours to send mail to addresses which do not exist in our domain. We used to accept these and send bounces directly from our Groupwise server; I put Groupwise behind a firewall and Postfix mail relay shortly after I was hired here, and noticed that in two weeks we had over two gigabytes of double-bounces sitting in our queue. Yes, I use RBL, Anomy, and SpamAssassin. Nevertheless, the amount of time that I have had to spend to limit the problem to manageable levels that don't drive us out of disk space and bandwidth has cost my company dearly from payroll. I can drive past billboards and ignore them. I can choose not to listen to the radio or watch television. I don't miss much by not watching TV or listening to the radio, and thankfully any important global news I get relayed through my co-workers. In today's world, however, it would be extraordinarily difficult to decide to not use the telephone, or, if you conduct a great deal of business using electronic mail, to suddenly decide to stop using the medium entirely.

I'm not saying you are wrong, but it seems to me that both the "spammers are thieves" and "spammers are not thieves" arguments are not quite hitting the mark. Whether unintentionally or intentionally, a single unsolicited commercial email can end up collectively costing the world a great deal of money. It seems that the best analogy I could use is that spammers are like cigarette smokers. A smoker's behavior hurts only themselves, but the secondary aspects of their behavior (second-hand smoke) impact the health of others, and so that portion is regulated. It's difficult to find a public building in the U.S. these days that allows smoking due to the known, unhealthy side effects. But it took the human race hundreds of years of dealing with "annoyance levels" of the problem before coming face-to-face with the predictable health consequences of the smokers' actions.

No offense meant to smokers! I know it's a hassle to have to go outside when it's sleeting and windy in order to find a place to smoke. Spammers, also, are exercising their right to free enterprise and free speech, but, ultimately, I think spammers will find themselves in a similar regulatory position, that they must practice their craft only in designated, acceptable areas, and that spamming outside of those lines will have significant legal repercussions. Digital signatures are part of the solution, as are whitelisting and blacklisting. If spammers can be forced to operate legitimately, using only legitimate information so that they can be contacted and held liable for their actions, it would be a truly enormous step in the right direction. I don't think that part will happen through legislation, but through very large installed bases of users beginning to use mail platforms which transparently implement this kind of functionality...

Re:Bollocks!

[Random Walk]

Almost invariably, they're on the list because their ISP persistently ignores spam complaints and prefers spammer money to honest customer money.

Bullshit. My ISP actively fights spam, yet still it gets blocked by SPEWS. SPEWS is blocking so overzealously that it's just a matter of (bad) luck whether you get blocked or not. And even if your ISP is spam-friendly, why should you switch if bad luck can/will strike everywhere ?

Re:Bollocks!

[KC7GR]

FaRuvius writes...

"Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves. When in reality, it is those "junk mail" advertisements that are keeping the postal service alive."

Not true. The supermarket PAYS the postal service to deliver their coupons to the neighborhood. There is no cost to the recipient incurred, so no theft has taken place.

Spamming, however, is an entirely different can of worms. Example; I own/operate all my servers. Mail, web, DNS, news, the works. I paid for the hardware out of my own pocket, and I continue to pay for the electricity that runs them, the bandwidth that supports them, and the maintenance in my time and parts cost when something breaks.

When a spammer hits me or my other users with their unwanted crap, it's no different than if one snuck up behind me and tried to pick my pocket. They're stealing MY resources just so they can avoid paying their own way, advertising-wise.

To put it another way; Imagine receiving junk postal mail with postage due, or getting collect calls from telemarketers. Spamming is the same thing.

If you choose not to believe me, believe the courts. In the landmark case of AOL vs. Cyber Promotions, the judge in the case determined (rightly so) that spamming constituted theft by conversion, and trespass to chattel.

So yes. Spammers are thieves. Period.

Re:Bollocks!

[AndroidCat]

Wah! Wah! Wah! Name the SPEWS record and let's see if it's justified or not.

Re:Bollocks!

[Zontar The Mindless]

> Spammers are not thieves. Under your logic, the weekly coupons your supermarket sends out snail mail would make your supermarket thieves. When in reality, it is those "junk mail" advertisements that are keeping the postal service alive.

But you miss a very important difference: people who send junk snailmail must pay for the privilege on a per-piece basis -- people who send junk email don't have to pay for the volume --> bandwidth that they send out. Spammers can afford to operate precisely because everyone else winds up paying for the bandwidth that the spammers use.

Re:Bollocks!

[schon]

Spammers, also, are exercising their right to free enterprise and free speech,

Spam has _NOTHING_ to do with free speech.

Free speech is the right to say whatever you want.

It it not, nor has it ever been the right to force people to listen to you, or the right to force people to pay you to speak.

The whole "free speech" argument is a red herring.

Can somebody explain how

[sqlrob]

Operates on a per message basis
and
Scalable (resources)

Aren't mutually exclusive?

Re:Can somebody explain how

[sqlrob]

Still not scalable though.

Let's suppose that it stays a constant 140,000 users, with no gain or loss.

How long before they have to upgrade the mail servers?

Re:Can somebody explain how

[sqlrob]

Why should I upgrade hardware if the valid load on the machine does not change?

My SPTP greeting

[cluge]

Clever message on the open relay. How about this one?

220 mail.XXXXX.com: By connecting to this host
220 you agree to be open relay tested by
220 njabl.org. You also agree
220 to only send traffic that complies with our
220 AUP and our providers AUP. ESMTP

Seeing that your server must connect to mine first, I wonder which contract will be upheld in court?

cluge

Re:My SPTP greeting

[Paul Wright]

Neither. A contract requires consideration (something of value exchanged) and the intention to form a contract on both sides. I'm not a lawyer, but both your banners rely on the person connecting actually seeing the banner. The odds are that they won't.

Re:My SPTP greeting

[Russ Nelson]

Neither one. To form a contract, both parties must realize there is a contract. Since there is no standard, nor any kind of accepted practice, for putting conditions on the acceptable email in the SMTP banner, there is no contract.
-russ

Read the mail

[WillRobinson]

I suggest you read the mail. Go to the site. Use the resubmit for testing function, and hopefully if your secure. You will be off it in a few days.

Oh, boo hoo.

[turambar386]

Well, I have mod points but I have to reply.

So, this guy has a problem: his mail server is blacklisted because it is part of the same netblock as a spammer.

So, rather than switching to a responsible ISP that doesn't allow spammers on its network, he writes a long winded whine about how to solve the "problem" of RBLs (although, mind you, he doesn't give a solution, just what he thinks should be part of the solution).

What he doesn't seem to understand is that the blacklisting of entire netblocks is only done as a last resort when ISPs refuse to get rid of spammers on their networks. It is a punitive measure to try to force the ISP to act.

While I applaud this guy for doing his research, I think he is misguided and even narrow minded. If you are part of the 'collateral damage' because your ISP allows spammers on its network, do the right thing and take your business elsewhere.

Re:Oh, boo hoo.

[Senior Frac]

Then answer me one simple question. Why are only small ISPs netblocked? Why isn't AOL?

I can count the number of spams I actually received from AOL accounts this year on one hand. I got plenty of emails with a @aol.com forged in the From: header, but almost none of those came from AOL's servers. Don't tell me you're one of those people who actually believe the From: header. I thought we exterminated that species long ago.

Quit making excuses. Trying to turn the whole thing into some sort of conspiracy theory to weasel out of conditions for delivery. Remember, shiny side out for the tinfoil hat!

Re:Oh, boo hoo.

[AndroidCat]

Why are only small ISPs netblocked?

Take a closer look at those lists.

Re:Oh, boo hoo.

[Senior Frac]

And yet some snot-faced kid hiding behind a web site that laughs about the fact you can't contact them says that my choice of hosting services is somehow wrong and I should change?

If reaching your customer base requires the cooperation of that "snot-faced kid", and there are enough "snot-faced kids" cooperating to affect your business, then, yes, I think you should listen to them.

Boycotts are entirely legal and legitimate form of social reform. Your ISP doesn't sound like it is social reforming very well.

The rest of the net is tired of being victimized by spammers and lazy ISPs. While the spam hasn't stopped, the shared blocklist idea has certainly been one of the most effective spam cost-reduction measures implemented. The fact that it's inconvenciencing you is by design. The implementors don't care. You don't pay their paychecks. Get over it. Do something about it. Just quit whining about it.

You do pay your ISP's paycheck.

Re:Oh, boo hoo.

[Senior Frac]

And there is the problem in a nutshell. The implementors only care about what they want.

Why should they care?

And I am tired of being victimized by lazy ISPs who can't be bothered to find out who those RBLs are actually blocking.

Fact not in evidence. While I'm sure this has happened, I see no evidence it's as prevalent as you claim. Proof, please, that the subscribers are not aware of the DNSbl listing criteria.

I'm all for blocking spammers by whatever works, but I'm caught in the crossfire and don't like it and won't sit still for it.

Where's this inherent right to transit you're claiming?

If it means sueing the RBLs to get my address off, also fine.

On what basis? Suing, with the knowledge it's unwinnable, with the intent to cost the defendent time and money is illegal in many places. It's a published opinion. The mere fact that you don't like that opinion is not basis for a lawsuit. (well, in most jurisdictions I know of)

As you said "The implementors don't care". If you want to call that whining, feel free.

Where is their obligation to care about your business? Where did they sign on the dotted line that you could subsidize your business costs by using their bandwidth/hardware? If they donate it freely, they're free to withdraw it at any time, for any reason.

You're a pititful little whiner. I feel sorry for you.

Big deception ...

[Etyenne]

I did not read the article in whole (I am at work right now) but it is a big deception to see that the author, in the section about other anti-spam measure, wrote only a single paragraph on user education. It's a big deception because this is the root of the problem. Sysadmin can fiddle all their time with Spamassassin and Vipul's Razor but as long as some moron will buy pensu enlargement cream from spammer, spam will continue to be profitable.

The only way to reliably and permanentely stop spam is to to make it unprofitable. Since spamming have near-zero cost, anti-spam measure must attack the revenu stream of spammer. The revenu stream is people buying into spam. Thus having less people buy into spam is the only effective anti-spam prevention measure. All the rest is just Band-Aid in a loosing battle.

BTW, this is the same thing with tele-marketing, junk fax, etc.

Re:Big deception ...

[Steve B]

Since spamming have near-zero cost, anti-spam measure must attack the revenue stream of spammer. The revenue stream is people buying into spam.

The problem is that the relevant "people" are not necessarily the ones stupid enough to respond to spammed come-ons. Even in the (unattainable) case in which nobody ever responds to spamvertising, spammers will still make money.

Large-scale spammers don't sell their own crap; they sell the "service" of spamming advertisements for other people's crap. Even if nobody responds to the spam, the spammer still has the money. Eventually, some of the clients get tired of flushing their money down the toilet, but there will always be customers for the spammer's snake-oil pitch.

Re:you get what you pay for

[jgerman]

Maybe you SHOULD take the time to read articles. Any. I can understand the arguments against spam for taking up system resources, but there is no way in hell that it is an intrusion on your privacy. It's your responsibility to keep your email address private if you want it that way. It is a public vector of communication, if you make it public you have no right to complain about recieving communication through it. Complain all you want about it being irritating, wasting time, costing money (especially if you're on dialup), but a privacy issue, I think not.

The two problems (which impact more than e-mail)

[Lumpish Scholar]

(1) You (and I) get too much spam.

(2) Your e-mail system administrator (and mine) need to keep beefing up the servers because the sheer volume of e-mail is growing so quickly.

To a first approximations, filters solve (1) but not (2), and black hole lists solve (2).

whirlycott summarizes the problem with (2) in two words: "collateral damage." How much of the e-mail network do we need to destroy in order to save it?

We need to move past first approximations. We need systems that work at the server level, but that somehow address the problems of collateral damage and false positives.

This is only the tip of the iceberg. Any network messaging medium is vulnerable to abuse by spammers. The problem started with Netnews, it continued with e-mail, it's happening now with instant messaging. We need at least high level solution that helps solve the problem regardless of prototcol.

I wish I had one.

Moving Beyond SMTP is the Answer

[zentec]

The problem, as I've said here before, is SMTP itself.

The RFC pretty much states that to be compliant, you have to accept the mail as it is presented. Can't achieve accurate or trusted reverse name lookup information on the sending system? Well, that's tough, take the mail (read this for yourself).

This problem stems from when systems on the Internet were inherrently trusted. That's not the case any longer, and it's time for a new mail transmission standard.

For starters, it should allow system administrators the ability to give priority to systems that can present some form of credentials. SSL or keyed encryption, whatever the standard is, it will permit systems to give totally trusted access to systems that meet the specific security and trust guidelines of the receiving system, not the RFC (times have changed, tough).

Those systems that do not meet minimum trust levels will either have to clean up their act or take the time to contact the remote system to figure out the issue.

It won't stop spam, but it will go a long way to slowing it down and possibly providing some secure method of mail transport in the process.

Re:Moving Beyond SMTP is the Answer

[thogard]

Its too late to be solved. X.400 tried to do it and failed is many, many ways.

All "fixed" systems imply that the only people that you want to get email from already have some sort of "trusted" email system. That doesn't exist in the real world and there is no way to create one now. just like there is no technological way to keep people from putting stuff in your letter box, there is no way to keep others from putting stuff in your email box. If you lock it down, then there is a chance that people that you want to try to send you a message won't be able to. The US post office solved the problem with a law with a stiff fine. Spam will only stop when that happens and lots of people get hit hard by it.

Re:Moving Beyond SMTP is the Answer

[bad-badtz-maru]

I don't understand what advantage in fighting spam accurate or trusted reverse-name lookup information would offer. The sender's IP is there as plain as day, what advantage does pansy-fying it do? Since you can't forge IPs for a mail connection, IPs can be used as the authentication for which you speak, you can allow or disallow mail transport based on IP. Everything you suggest can be done already with the current transport mechanisms.

maru

Re:Moving Beyond SMTP is the Answer

[thogard]

Where does the pki infastructure come from? That will be a problem.

If you want to do this, you could build a whitelist RBL like system. It could work like this....
0) you grab a cool domain name and create a prety https web page
1) Since I will certify that abnormal.com's users won't ever send spam under pain of death, I go to your site and register my details and certify my site won't be spaming. You enter my details in your database and hand me a token.
2) I send email to one of my RBL using friends. My MTA does a DNS lookup of md5 of my token, domain and some other bit of data and includes it in a header of the message.
3) your smtp server reads that header and looks it up using the rbl dns to find out if it was issued and whitelists the message.

You will have to have a way to revoke people from the database. Most IPS's start out clean.

The problem with this is the dns is going to get hammered if it ever takes off. Right now the root name servers tend to get hit for many email messages but not all. This system will hit a dns server for jut about every message. The current root name servers are costing about $10mil a year to run.

my 13 and a half cents

[neildogg]

It's important to realize the point of RBL blocking. It isn't to make end-users happy, it's designed to lower traffic on the mail servers. So a proposed solution needs to be something that the ISP can execute without having to analyze the email. RBLs monitor a single variable, IP, to determine whether it should be accepted or not. If someone could come up with an idea that processed emails based on another single variable, then we'd have ourselves a good spam filter.

My server, my rules

[fruey]

I can whitelist. So I can also DNSBL. My server, my rules.

One proviso: if anyone complains, I will look at it.

RFCs require that one accepts mail for postmaster@domain.com and from the empty envelope sender. Since I do this, I believe I am fully RFC compliant.

So stop whining about DNSBL. The problem is wider than that, and will not be solved by getting rid of DNSBL. The system isn't perfect, but that is not the issue.

Re:There is no spam problem.

[micromoog]

So . . . only ultra-l337 "information technology" "professionals" like yourself deserve spam protection? And as long as the "information technology" types can avoid it, there's not a problem?

In Defense of RBLs

[minas-beede]

I have been a very loud protestor about collateral damage in news.admin.net-abuse.email. I well understand the problem but I think you over-estimate it. SPEWS deliberately lists non-spam-source IPS - that's collateral damage, that's wrong and avoidable. Take that away and the remaining collateral damage is unfortunate but not severe.

Many have changed how they use RBLs - instead of simply rejecting they send a reply asking for confirmation the sender is a real human. If that confirmation is made the original message is delivered. That seems to be simple, straightforward, and capable of reducing collateral damage to a very low level. It even has intelligence behind it.

I advocate relay spam honeypots (and open proxy honeypots - move with the times, keep up with the spammers). The white paper doesn't even mention these. The WP has the section asking if open relays are necessary. Well, no, they probably aren't. Is there a point? For how many years has there been an effort to secure open relays? Has it succeeded? The fact is that they are there - asking if they are necessary may inform you but it doens't change the situation in any useful way.

For all these years the spammers have been given free access to the relay level - there's a self-satisfying division into the secure systems run by the wise and the open relays run by inept administrators. that division allows the operator of a secure system to condemn the operator of an open relay with confidence - he can strut. Yipee. As a spam-fighting tool it's a close to a complete bust. Well, yeah, lots of open relays have been secured. BFD - there's still enough for the spammers, and RFC 2505 said it would be this way. Yo: RTFM (in this case RTFRFC.)

You want to hurt the spammers? OK, hurt them. It's not like you have to go out of your way - accept and deliver one of their relay tests and the chances are excellent they'll send you spam that you can discard. That's still a secure system, but it has teeth instead of gums.

There's all these people falling over themselves devising elaborate filters. If you simply open up a relay enough to accept the spam but not deliver it there's no filter needed - a non-mail-server system that receives relay email receives close to pure spam - you will never get a filter as selective as that. Accept and deliver the relay tests and you have screwed the spammer. I won't even enumerate all the ways he is or can be screwed but there's a bunch.

If 5% of the Windows systems with network connections ran Jackpot then spam would be dealt a mortal blow:

http://jackpot.uk.net/

It isn't hard, and it does tremendous good. Check it out.

Re:In Defense of RBLs

[Dimensio]

SPEWS deliberately lists non-spam-source IPS - that's collateral damage, that's wrong and avoidable.

It has unfortunately become the only way to make crime-friendly ISPs take action. I don't see it as 'wrong and avoidable', I see it as the course of action taken by sysadmins who have been pushed too far.

Consider this. AGIS, long ago, decided to be an openly spam-friendly provider way back in the day before single unified like SPEWS or the RBL. Because AGIS had openly admitted their willingness to allow their customers to break the law and victimize innocent ISPs with their criminal behaviour, many ISPs threw ALL of AGIS into their blocklists, figuring (quite correctly) that nothing that came from AGIS needed to hit their networks anyway.
Spam didn't work for AGIS. AGIS soon learned that all spammers are theiving scum who wouldn't pay the bills, and they realised that hosting spammers wasn't profitable if it was well-known that AGIS was just a private intranet that couldn't reach anyone. As such, AGIS did a full about-face and became very much antispam, kicking off all of thier criminal spamming clients.
Unfortunately, so many individual ISPs had thrown all of AGIS into individual netblocks that there was substantial damage to AGIS's connectivity. Some admins removed AGIS from their filters, but in many cases AGIS's netblocks were put in by an admin who had long since forgotten why they were there (or one who had even moved on, leaving a new admin with no idea why certain IPs were filtered), or who just didn't care to remove them. As such, AGIS's netblocks were still filtered from a large percentage of the Internet and AGIS died the death of a thousand cuts.

With a centralized single listing system, like SPEWS, this problem goes away. If everyone simply filters against SPEWs then an ISP who is blocked by all of the world can clean up their act, get delisted, and instantly they will have restored connectivity because everyone is filtering against the same list.

Of course, many here on Slashdot don't seem to think that is a good idea. They would rather go back to the day when individual ISPs were filtering on their own personal lists because they cannot stand that their upstream is a crime-friendly provider and they're getting listed in SPEWS. They would rather have a system where they are guaranteed to be filtered forever in thousands of different lists rather than filtered in a single list that will be fixed once their upstream cleans up its act.

Working with the RBL idea.

[pheared]

You (ISPs) just need to modify your IP allocation policies such that you put all known spammers in the "ghetto" address range. Said range gets blocked by RBL, none of your more legitamate users notice. The spammers can't complain because they are breaking your AUP (you have a well-defined AUP, don't you?).

Wrong...

[artemis67]

People spam because it's dirt-cheap. If spammers had to pay 10 an email, you'd better believe they'd be a heck of a lot more cautious about who they send to.

And a "Stop Buying Spam Products" is doomed to fail, anyway, because it's a numbers game. If 1 person out of every 100 people spammed buys something, then it's probably an outrageously successful campaign.

The fact is, you may be throwing out 50 spam emails a day, but if you see a subject line that speaks to an immediate need, you're probably going to stop, read it, and consider a purchase.

Re:Wrong...

[anarchima]

No, because the spammers aren't making any money off you reading their email. They only make money if you actually _buy_ something. Therefore, blocking most (if not all) spam is still worthwile, just for the convenience factor. Your argument seems a little flawed.

This way, perhaps, we can get Ralsky in jail ...

[mustangdavis]

This way, perhaps, we can get Ralsky in jail, and stripped of his money from the SPAM

So what you are saying is that we can get Ralsky put in jail, which will become his new company H.Q. ... and he will generate enough $$$$ spamming from jail to provide all of the prison population enough cigs and workout equipment that they will stop making license plates for us .... hmmmm ... this sounds like a bad deal for us (except if you'd like to make license plates) and a great deal for the inmates of our country ....

However, if he makes enough money spamming, we could use the money to make bigger jails so that we can imprision the other spammers ....

... this might work!

Re:Preventing Spam through false positives...

[MImeKillEr]

I'm no programmer, but surely someone could come up with an automated way to handle this. Maybe an evolving-type automated response letter with variables defined as %n for spammer's name or return email address, %p for product they're peddling, etc.

Alternative ...

[LL]

... see http://cr.yp.to/im2000.html

If he's annoyed, then it's working.

[?erosion]

Isn't this how a blacklist is supposed to work? I thought the idea was precisely to annoy the honest users, such that they complain to the ISP. If the users know that they are blacklisted because of a spammer, they are likely to either leave the ISP or pressure it to turn the spammer off. It's not nice, but the intent is to get results.

Re:If he's annoyed, then it's working.

[Phroggy]

Isn't this how a blacklist is supposed to work? I thought the idea was precisely to annoy the honest users, such that they complain to the ISP. If the users know that they are blacklisted because of a spammer, they are likely to either leave the ISP or pressure it to turn the spammer off. It's not nice, but the intent is to get results.

Some people want blacklists to work this way, and indeed it can be an effective strategy. However, a blacklist is generally supposed to work by just blocking spam, without getting in the way of the honest users on systems that are NOT being used for spam.

If there's one open relay on a subnet and I want to block open relays, then that one open relay should be blocked, so I don't get spam. I still want to receive mail from the other 200 servers on the same subnet. Yes, blocking the other 200 will force the ISP to take action, but maybe the ISP would have taken action anyway? Maybe there's a better way to get them to take action? Maybe I want an RBL that will not list innocent servers such as those 200.

Re:If he's annoyed, then it's working.

[AndroidCat]

Yes, blocking the other 200 will force the ISP to take action, but maybe the ISP would have taken action anyway?

If they take action, they get off the list. If they had taken action in the first place, their other 200 probably wouldn't have been listed in the first place.

Re:If he's annoyed, then it's working.

[melonman]

The result it gets in my case is that before, I was considering doing my bit to block spam, and now I won't, because the people who run RBLs seem more intent on hurting me than the spammers. And I reckon there are a lot of people like me. Is that how the system is supposed to work?

Re:If he's annoyed, then it's working.

[melonman]

That doesn't tar the entire effort, does it? Don't fixate on the guys screwing up - there's a lot more guys that aren't screwing up.

I'm fixating on the system that blocked my IP address for no reason other than to get me to put pressure on my ISP (which I didn't, out of principle).

Before this, I had never heard of SPEWS, so my first contact with them was when they blocked my IP address. As cold calling methods go, I think I prefer spam :-)

I'm sure the people running the list are dear people with lovely families and a big cuddly dog, but the one little detail of using mafia tactics against me leaves a bad taste in my mouth. Sorry, but that's how it goes. I agree with most of what animal rights groups say, but they lost my support with the first nail bomb. Ditto a lot of single issue pressure groups.

What really impressed me about our IP block was how little difference it made. We had one complaint from one user on one of our domains. Given that this domain has 400 email addresses redirecting to 50 or so ISPs in 20 countries, this suggests that an awful lot of people aren't using SPEWS. And I think I know why :-)

Simple

[stephenbooth]

Instead of running your mail server on a PC running Linux or a low - mid range Sun/IBM/HP/whatever box you have to run it on a Beowulf cluster of E10,000/s390/V-Class/Indian Supercomputers. Perfectly scalable, it's just that your hardware and support costs have gone up by several orders of magnitude.

Stephen

Author seems not to get it

[theLOUDroom]

A huge amount of spam is being sent through unsecured relays in Asia and South America. Consequently, an overwhelmingly large percentage of the hosts listed on RBLs are in fact based in these countries (see Wired article: Not All Asian E-Mail Is Spam). This amounts to nothing less than discrimination and isolationism that is being used to slowly cut off countries that have a critical importance in global matters

Obviously, if a huge amount of spam is coming from a huge amount of servers in a country, a huge amount of servers in that country are going to get blocked.
How about we drop the sensationalism here?
It's not some conspiracy to block all mail from Asia.

Look, maybe some people need to get mail from Asia, but I don't have any reason to. I'm not obligated to let anyone on the internet contact me at will. I can pick and choose who to block/accept at will. If people in don't want their servers to get blocked, maybe they should deal with their spam problem. I don't have time to fix it for them.

Look at it this way:
The internet is this huge shared network. It has a finite amount of bandwidth and it works because everyone carries data to its destination.

The question here should not be if any nodes should ever get blocked. The question should be: How much junk traffic should a single node on the network have to generate before it happens?

At some point you have to start blocking people. If I start DOSing an email server (almost what spam is), I can expect to have my traffic blocked at some point. Maybe I have to send a million junk messages, maybe a billion, but at some point it's costing too much to carry and process my traffic. Yes, bandwidth costs money. That's just the way a system like the internet has to work. There have to be mechanisms in block to handle the case were a node starts misbehaving. One of those mechanisms has to be dropping traffic from that node.

Carrying junk traffic costs money. Filtering costs money. At some amount of traffic, the cost becomes too high, and you have to block the traffic. Think of it as a signal to noise ratio. There always needs to be some number, at which you pull the plug, because the data isn't worth dealing with anymore.(And filtering it is too expensive)

Any time you share something you're going to need the ability to do this. If I start driving in the middle of a two lane highway, I can expectect to get pulled over and have my license revoked (eventually). It should be. I'm messing up things for everone else and the sensible way to fix it is to remove me.

Re:Author seems not to get it

[Zontar The Mindless]

> Look, maybe some people need to get mail from Asia...

Such as yours truly. My livelihood depends upon it, in fact. Your right not to receive email from India shouldn't interfere with my right to receive it. Nor the reverse.

Spammers suck, not only due to the annoyance factor and the bandwidth they waste, but the dissention they provoke among legitimate users. Hang the bastards.

(Um, hang the spammers, I mean -- not legitimate users.)

How to really stop spammers...

[MarkedMan]

Flood them with responses. A volunteer organization which floods them with answers. Not the answers they want, but answers they nevertheless have to take time to deal with. The trick is not to make spam impossible, but to make it unprofitable.

and a potential solution. Recently, I read an interview with a spammer. She said that she could make a profit with a response rate of .001 percent. That's right, .001 PERCENT. Our anti-spam measures actually help her target the gullible. But what if she had a response rate of 1 percent? She sends out millions of spams per day. Say she got 10,000 replies (or her customers did.) Not buying their dreck, but instead asking for more info or some such. Would they be able to find the legitimate responses in the deluge?

Oh yeah?

[select * from]

I just added 3 inches to a part of my body, refinanced my mortgage for 4%, took care of my baldness, and made thousands thanks to a giving man in Zimbabwe.

It couldn't have been easier.

Re:Oh yeah?

[AntiNorm]

and made thousands thanks to a giving man in Zimbabwe.

Thousands? I've got some friends in Nigeria that have hooked me up with MILLIONS.

"email authentication" == "blacklists"

[wayne]

I believe that the way to stop spam in the long term is to deploy signed email ubiquitously. Self signed certificates are sufficient for this purpose if we can provide a lightweight authentication via a DNS-linked PKI.

SMTP already has a good way of authenticating who you are receiving email from. It is called the IP address of the machine that is contacting you and the IP sequence numbers of the packets that have to travel between you. All you need is a list of the IP addresses of the people who you want to receive email from and a list of ones you don't.

But, of course, this is what the current blacklists do!

Any email authentication system is going to run into most, if not all, of the same problems that DNSBLs run into. They are also going to have the problem of trying to get the entire world to change.

Re:"email authentication" == "blacklists"

[Zeinfeld]

SMTP already has a good way of authenticating who you are receiving email from. It is called the IP address of the machine that is contacting you and the IP sequence numbers of the packets that have to travel between you. All you need is a list of the IP addresses of the people who you want to receive email from and a list of ones you don't.

Actually this approach is regularly proposed but actually it is more complex than that. The problem is that there is no single model for using SMTP and SMTP certainly does not provide one.

In particular a large amount of email is sent from machines that have no connection to the host name the email is purported to be from. Most unix mailers simply send the mail direct.

Any email authentication system is going to run into most, if not all, of the same problems that DNSBLs run into. They are also going to have the problem of trying to get the entire world to change.

I have helped do that before, your posting to slashdot is demonstration.

What is needed is a scheme such that the incentive to opt-in is greater than the cost of opting in for all network sizes. I believe that there are ways of promoting the authentication approach that have this property.

The problem with network effects is that they cut both ways. Whenever someone talks about viral marketing I short their stock unless they can show that there is a significant benefit to opting in before the network exists. Otherwise your 'network effect' is really a chicken and egg problem.

Re:"email authentication" == "blacklists"

[Zeinfeld]

There is no way for a subscriber to know what IP address our e-mails will come from, they change dynamically based on load. If there were a standard way to digitally sign our e-mails, we'd implement it in a flash.

For your particular application (sending messages from a newspaper) I would suggest that you go to a Certification authority such as VeriSign and pay the $20 a year it costs to register for an S/MIME email certificate.

I am not suggesting that as a general solution to spam since any 'solution' that depends on senders spending $20 is going to have takeup problems. However for that application you should do the job properly with an email certificate that is going to be automatically recognized by the email clients.

S/MIME is an IETF standard and is supported by Lotus, Microsoft and Netscape and has been for 6 years now. It works fine for signing content. If you send a signed message the recipient's email client will display a little seal.

The only major client this does not work with is Eudora where the problem is that the provider appears to have completely abandoned further development efforts 5 years ago. I can't do anything about that, sorry.

The part that is not quite finished on the standards track at the moment is a mechanism for locating certificates so that you can send an encrypted email. This is a little tricky since you need the recipient's certificate before you send the message. I have been promoting a scheme called DNS linked PKI which uses the DNS SRV record as a means of finding the certificate repository that can provide you with a key for the relevant email address. This is very close to done and since SRV is already deployed is not an infrastructure issue.

Note you can also do the same with PGP (I describe how to do that in the XKMS spec). However PGP is pretty good privacy and not very good authentication. The problem is that I don't have very strict criteria for choosing an encryption key when the alternative is to sent the message en-clair. If I really care about confidentiality in a particular instance I will authenticate the key directly. That does not really hold when it comes to authentication since the point of the authentication is that I will take a different action as a result. So there is a threshold effect.

For the purposes of blocking SPAM a self signed certificate with the minimal authentication that retrival through a dns-linked pki confers is adequate.

email that isn't

[zogger]

--well, wish I knew what I was talking about here, but I'll try anyway, perhaps someone will recognize what I'm trying for. It might even exist for all I know.

I see spam as being an email protocol problem as much as anything else. Too easy, too easy for bots to get addresses now or guess them. The spammers are like drunk drivers on their 15th DUI, lost their license long ago, but are still on the roads. the deal is, we don't really have any road control, there's no traffic cops (and don't want them thankew). So, we need "new roads" that people can use to send "electronic mail" to each other that ISN'T something in common use yet. It needs to be setup so that only people that are trusted by anyone "you" can use. It's this name@someplace.com. See that @ symbol? How about a replacement, and some sort of new way to start "electronic mail" from scratch and build trusted private networks for correspondence, and something that didn't use that @ symbol?

Yes I know this is probably naieve, don't know how to describe this better though. Is there such a critter in existence? If I was living in a floodplain, and had to constantly add to the sandbag piles to keep the water out, and it still leaked all the time, well, I'd just move someplace better. I see the email problem now to be just that, never ending war with spam, anti spam, anti anti spam, anti anti anti spam, etc. I'd rather scrap the whole email thing as it stands and start over with something "better", move OUT of the floodplain. So, I'm asking, where's the "high ground" to move to?

How about this?

[rutledjw]

I agree with you. Look, all SPAM^h^h^h^h e-mail from Asia may NOT be SPAM, but we need some way to protect our networks from this flood of crap...

May I be rejecting legitimate e-mail if I block China.com? Absolutely. As a matter of fact I hope I do, I hope I block a whole bunch of them. Further, I'll tell them why.

"The network you're using sends an unacceptable amount of SPAM, there is a plethora of open relays and nothing is being done about it."

China.com admins may not give a rat's ass if I bitch and complain. But if their customer base goes ballistic because their service is unusable for this reason, then something may happen. The best solution? No, the best solution is to drag out and kill:

• Spammers
• Every idiot who's purchased herbal penis enlargement and HGH

IMHO

Re:This way, perhaps, we can get Ralsky in jail ..

[minas-beede]

Ralsky. He says, in a Detroit Free Press interview, that he has 50 spam servers in Dallas.

http://www.freep.com/money/tech/mwend22_20021122 .h tm

Just try to get the ISPs in Dallas to act with integrity, seek out the spam servers (they should leap out in any traffic analysis) and shut them down. The DNSBL's are close to useless here, it seems. Ralsky spams from Dallas using asymmetric IP routing: he spoofs the IPs of dialup systems from the servers. If anything gets nuked its the dialup account, not the high-speed-linked system that actually sends the spam (the dialups only receive the return packets from the systems that receive the spam.)

(Maybe Ralsky spams from Dallas differently - earlier this year he surely was using the asymmetric IP approach. Ralsky did lose throwaway accounts on three different ISPs because of the actions of one honeypot operator: Michael Tokarev in Moscow. Unfortunately Michael shut the honeypot down in July:

http://www.corpit.ru/cgi-bin/h0n5yp0t )

Getting Ralsky in jail wuld be nice, and he deserves it. Before that it would be effective to so disrupt his spam operation that he experiences a negative cash flow. Honeypots are the way:

http://jackpot.uk.net/

Setting up the honeypots is the first step. Once enough are intercepting Ralsky spam notify the spam advertisers that huge amounts (don't tell them the actual amount) of their spam is being intercepted. Get them in billing disputes with Ralsky. If they also see sales going down (as they should) they may have a flash of intuition that tells them spam doesn't work any longer, and the interceptions are the reason.

But don't stop doing what works for you, of course - add in the honeypot for its effect on the spammers beyond your own system.

Re:you get what you pay for

[Analysis Paralysis]

Email containing HTML links which cause your email reader to access the sender's web server can be an intrusion on your privacy. How? If unique links are used (i.e. a unique URL for each email) not only does it tell the sender that your email address is in use, it tells them when you read their emails. They can even set a cookie for future reference. This technique tends to be used a lot by marketing outfits - both "respectable" and downright dodgy (see here).

For this reason, my email is configured not to download HTML and is blocked from accessing any ports aside from POP3 and SMTP by my firewall just in case...

DNSBL Fallacy #1

[mrneutron]

'SPEWS is bad, so DNSBLs are bad!'

Wrong. I use DNSBLs to block 10,000+ spams/week aimed at my users. I was using static relay REJECTs via the sendmail access file, but could not keep up with the torrent and increasing user complaints.

Aside from the obvious potential waste of time and bandwidth those 10,000 spams represent, much of it is obscene and sent by criminals.

I also track rejected mail and whitelist relays when necessary. This system works very well.

I chose not to use SPEWS due to collateral damage concerns. It's my call. If you are a postmaster, it's your call as well. One size does not fit all. DNSBLs are an invaluable tool.

Re:Here is the plan to stop SPAM

[squiggleslash]

This way, perhaps, we can get Ralsky in jail, and stripped of his money from the SPAM. Make SPAM not pay, make it illegal to spam. Nuke foreign countries who allow SPAM, it would just take one nuke, and you just know SPAM comes from North Korea.

If Ralsky goes to jail, doesn't that just mean he'll move into telemarketing?

RBL's can help spammers

[bdsesq]

I am admin/postmaster for a small college. Several months ago a new hack was developed that got through my version of sendmail. This was kind of ok because the spammers didn't know I was vulnerable.

Along comes one of the RBL's and test my site. So far so good. But instead of sending an email to postmaster@the-blocked-site they post my IP and a sample of how to use my system to forward spam.

Several days later, on a weekend of course, the spammers started using me. The spammers aren't stupid either. They use the RBL's to find new relays.

I have fixed the problem. However, one small email notification would have prevented several hundred thousand spams. I wonder how many sites have been used this way?

The whole of his argument

[Russ Nelson]

The whole of his argument is "there might be collateral damage". Well duh! Choose an DNSBL (Note: RBL is the name of a specific DNS Blocking List) that has a policy against collateral damage. Some do, some don't. He's complaining that collateral damage hurts innocent parties. Well, he's just done the same thing he's complaining about by damaging the reputation of DNSBL's that don't do collateral damage.
-russ

Collateral Damage?

[blowdart]

My ass

Once your ISP allows people to test then maybe you'll get off the list of IPs that block open relay testing.

RBL results : 127.0.0.4, Test blockers: Null routed all access

So, exactly why is you, or your ISP afraid to be tested? Oh I see, your stance may be relay testing may well be illegal. Well tough. If someone turns up at your turn and asks for entry you would ask for identification. Your IPs stance in banning relay check connections is equivilant to not producing identification, but demanding entry anyway.

Until you can prove that you're not a spammer then don't expect your RBL status to change, and for those people that block on that status, you won't get through.

Re:Collateral Damage?

[schon]

I'm not afraid to be tested, I just block EVERYONE who tries to use my servers for relaying.

Well, IMHO, that's a pretty stupid thing to do.. someone here asked me if we could do something similar, and I told them we could, but it wouldn't be smart.

All someone needs to do is list your mail server as a MX for thier domain (or a useless subdomain), then get people to respond..

They sign up with hotmail, and you'll never recieve mail from hotmail ever again.. same with Yahoo..

Send mail to $BIG_ISP with a From: for this domain; they reply, and you'll never recieve any email from that ISP again.. you'll be blocking legitimate servers, who are doing exactly what they should be doing.

It's all of sudden pretty simple to screw you over.

Re:Collateral Damage?

[schon]

Thanks for responding, but do you have anything relevant to add?

Tell me where you live. I want to see if I can pick your locks, open your windows, and peek through your curtains. What is your IP address? I demand the right for complete and unfettered scanning abilities.

What does any of this have to do with my post?

You of course have zero right to ask who I am or my true identity.

You're a moron. Re-read my post, then point out where I asked you for your identity.

Re:Spam?

[AxelTorvalds]

IMAP? Read the header, drop it.

I can sympathize with paying the bill and the slow connection, there are solutions though. Building blacklists and te vigilantism that goes with them is nothing more and digital road rage.

Re:you get what you pay for

[jgerman]

That's a consequence of the medium. The openess, lauded one second by techies, is cursed the next. If you don't like the way it works, either change it on your end as you did, or don't use it.

Re:you get what you pay for

[jgerman]

Hmm, maybe your analogy isn't sound. For years techies have screamed bloody murder when RL metaphors are used to decide what laws to apply to computer crimes. So don't fault my logic based on your inability to draw a strong analog. No one is breaking into anything. The internet, email in particular is an open, public medium. If you don't like it don't use it, it's that simple.

Dream on...

[Rik van Riel]

Any measure for stopping spam must ensure that all non-spam messages reach their intended recipients.

If that were true, ISPs would have absolutely no reason to kick their spammers and the admins of open relays and open proxies would have no reason to secure their systems to abuse.

In short, nobody would slow down the spammers and our inboxes would be flooded by spam, even if the filters were 99% effective.

The only way to reduce the amount of spam you receive is by reducing the amount of spam being sent.

Personally I use the SBL and DSBL lists to block mail from known spammers, their supporters and open relays and open proxies.

Email is protected speech. There is a fundamental free speech right to be able to send and receive messages, regardless of medium.

Spammers have a right to free speech, but they have no right to free speech on my property. If they want to advertise, let them setup a website I can view when I want to. Free speech is about speech in public areas and is not relevant when it comes to private property. Free speech does not trump private property rights. If you think free speech does apply to private property, send me your address and I'll organise an industrial and hardrock concert in your garden.

Having said that, I think it would be good if every user could choose for him/herself the filters used on his/her mailbox. If only because the users are likely to choose much more agressive filtering than ISPs could ever setup by default.

Flaws with this article

[Paul Wright]

The author would have been better off hanging out on news.admin.net-abuse.email for a bit before going public with this. Here are some problems I spotted on a quick scan through:

• RBL is a trademark of MAPS. The generic term is DNSBL.

• It looks like his entire netblock is blacklisted because it blocks relay tests by null routing the osirusoft.com tester. Given the controversy over relay testing, it is reasonable for him or his ISP to block such tests. It is also reasonable for an open relay blacklist to list for it.

• The article fails to clearly distinguish between open relay/proxy blacklists (which are largely automatic) and blacklists and blacklists based on harbouring spammers (which will always have a human in the loop somewhere). It seems the author himself is confused about this.

• I doubt it's true that most admins who use RBLs "assume they are blocking only spam". Any use of filtering by a large organisation should only be done after examination of the consequences.

• The section headed "Network Effects and the Unscalable Nature of RBLs" has nothing to do with scalability as I understand the term. A DNSBL scales as well as the DNS itself. The increased use of DNSBLs could be argued to increase their effectiveness, since it puts pressure on irresponsible admins to fix their problems.

• My understanding of the more reasonable blacklists (the SBL, and to some extent, SPEWS) is that they only widen a listing to include "collateral damage" after the ISP has failed to respond to complaints. It is the responsibility of the ISP to have a working abuse@ address and to read what is send to it. For open relay lists, there is no "collateral damage" since the IP listed is an open relay, exactly as claimed by the list operator.

• The "geopolitical" section is just nonsense. The blackholes.us operators provide lists of IPs by country so that people who know they do not expect legitimate email from a particular place can block that place. They do not advocate that the entire Internet shuns Korea, say. An business with Korean customers clearly would not use that list.

• The example banner on the open relay can only form a contract if the spammer sees it and agrees to it. The Sherman Antitrust Act is of no consequence to the ORDB operators in Denmark, to SPEWS in Irkutsk, nor to me in the UK.

• The section on Distributed Notification Systems should probably mention the Distributed Checksum Clearinghouse, since that, to my mind, does away with some of the problems of Razor.

Passive denial doesn't work

[The Spoonman]

It only blocks LEGITIMATE e-mail from servers that may, at some time in the future possibly, be used by spammers as a relay. It does block from machines that have sent spam, but also those that have never done it, just the potential is there. It does not, however, block spam! At least, not effectively.

And, that's where the problems lie. Administrators are putting these things in, assuming they'll stop spam, and then getting pissy when you tell them legitimate mail isn't getting through.

I used to be the e-mail admin for my company. We somehow ended up on the worst of these lists, osirusoft. This, despite the fact that we used SMTP AUTH; YOU COULDN'T SEND MAIL WITHOUT A PASSWORD! And, once you get on one of the lists, you're on them all.

So, I spent the better part of a couple of days going through them all and having to prove I wasn't an open relay. They all but one removed us within a week, but that was a week we couldn't send mail to a few customers.

And, the one that didn't remove us in a week...osirusoft...they took over a month. Every day I went to their site and ran the "autotest". Every day I watched it say, "Relaying Denied, deleting from list". Every day, I watched another "proof" of our spamminess posted onto their list.

And, the idiot admins of the ISPs? "Well, you're obviously an open relay. I see dozens of spams being sent from your site on the osirusoft list!"

BTW, the osirusoft rbl is run by some loser in his basement. Great plan, basing your company's e-mail on some unemployed idiot with a chip on his shoulder.

Look at your spam, where does the majority come from? That's right, AOL & Hotmail. But, your company would NEVER allow you to block from them, they'd lose too many customers. Install an active filter, you'll see better results and less spam.

I understand, but...

[AlfaGiik]

He is misguided.

I run a spam filtering service which uses DNSBLs along with other measures to reduce the spam that my customers receive. The customers who sign up for this service typically are completely swamped by unwanted email, in fact - one customer has a hit rate of over 60%. Yes, 60%. They had reached the point where their email was becoming useless, so they had to do something about it.

DNSBLs are a valuable tool when combined with other technologies and have a very low 'collateral damage' rate. For example, the customer mentioned above has never called to complain that valid email was blocked even though I remove over half of their mail before they get it.

As for someone's right to run an open relay, I guess they do have the right to run their server however they choose, but that right ends at my door. My server, my T1, my customers asking for help. I explain the risk of collateral damage to potential new customers, and explain they must trust me to make decisions on what is blocked and what is not. I try very hard not to be overzealous and it has served me well because no customer has ever left the service once they signed up.

I'm very sorry if the author of this article was inconvenienced by being blacklisted. But the needs of the many outweigh the needs of the few... or the one. (TM)

I found your article to be of whiny, not helpfull.

[gurps_npc]

You seem to be upset that some groups have demanded that the smaller ISP's and less technological countries do the main work in solving the Spam problem. THEY ARE THE ONES RESPONSIBLE FOR IT IN THE FIRST PLACE. Yes, they may not personally be the people doing it, but they are part of a group that IS doing it. I think Blocking is TOTALLY appropriate Punishment to the Asian Countries for their failure to police their ISP's and fight the evil of Spam. Note, I personally have had my email to a friend blocked because of the RBLs. He gave me a new email address, (at another small ISP) and the problem was solved. If you have that problem, SOLVE it by moving AWAY from the SPAMMERS, instead of supporting them by your lazyness.

Re:SPAM

[inode_buddha]

Here's the part that really pisses me off:
"You are receiving this email because you opted in to receive special offers from (xyz.com) through one of our marketing partners...."

Exactly. I might have done business with one of your "marketing partners" in the past. That doesn't mean I'm interested in doing it with you, or any of the other "marketing partners". Usually, I can find what I'm looking for without any marketing assistance, thank you.

He missed DCC - Distributed Checksum Clearinghouse

[nneul]

It performs a very similar function to Razor, but is a lot more open. You can run your own servers and participate in the global database, or run your own database independently.

http://www.rhyolite.com/anti-spam/dcc

Re:We need better mail clients

[fanatic]

It's easy to do the following: View->Message Body As->Plain Text.

Violla, problem solved. Try that in Outlook, Hotmail, or Yahoo?


If using hotmail or yahoo on your browser, turn off images and javascript in email. This stops the client from acting on any URLs in the mail (i.e. 1x1 images), hence your address doesn't get verified.

TIRED OF UNFAIR BLOCKING?!

[BasharTeg]

Summary: someone tries to send email and finds that they're listed on SPEWS. They complain because "we're not an open relay", without figuring out just why they're on that list. Almost invariably, they're on the list because their ISP persistently ignores spam complaints and prefers spammer money to honest customer money. I think there's been about two or three actual mistakes in the SPEWS listings in the year or so I've been following NANAE. Otherwise, it's all been a legitimate extension of the block because the ISP knowingly ignores complaints and supports spammers.

Wait wait wait, let me quote that again. "it's a legitimate extension of the block because the ISP knowingly blah blah blah." My SMTP server is sitting on an IP block that is being "punished" by SPEWS. My ISP is not UUNet, but another ISP which is a customer of UUNet. SPEWS intention of punishing UUNet by blocking MY IP block is not "legitimate" by any definition of the word. I am not a spammer, and my ISP is not tolerant of spammers. But our upstream provider is. So screw us, we're paying the price for the spam jihad.

Open Relay RBLs, hell yes. That is fair and legitimate. But when you take the power given to you through the trust of those who use your service, and use it to beat down on the innocent in order to further your cause, that is unacceptable. I could spend weeks on the phone with UUNet. Do you think I could somehow convince them to stop supporting spammers? Give me a break. You think I can just switch ISPs? My company does telecommunications with voice lines over a DS3 with a contract with our provider for voice and data service. There is no chance of going to another ISP. So, if in the end I am forced to subscribe to ANOTHER T1, from a different provider, just so that our small company can do business, what purpose does that serve? How does that advance the cause? I am willing to make sacrifices for the anti-spam movement, but I don't see exactly what purpose blocking completely secured SMTP-AUTH non-spamming servers does. I followed the rules. I setup my servers responsibly. I still got fucked over. You tell me that's "legitimate."

Now listen to me very carefully. I HATE spam. I employ several spam filtering systems. I even use open relay black hole lists. I have even gone as far as to write my OWN anti-spam content filter system. I use SpamAssassin, but of course I had to comment out the rule for Osirusoft because Osirusoft uses SPEWS, and otherwise SPAM ASSASSIN ENDS UP BLOCKING MY OWN FRICKIN EMAIL. Here I stand, a supporter of the anti-spam cause, blocked with no recourse by people who refuse to talk to me about why I'm being punished. Whose ideas of legitimate include punishing so many of the innocent that the outcry is supposedly supposed to affect the guilty. (Read that sentence again, Mr. Bollocks) Blackhole lists are fair and legitimate as long as you aren't punishing one man for the action of another, and as long as you provide a method for clear and easy removal once terms have been complied with.

Miles "the only good anti-spammer, is the one who will take you off his damned list when you jump through the hoops"

The following is a list of the innocent businesses around my IP range which are punished for the actions of that worthless bastard Eric Reinertsen.

United Promotions, Inc 65.244.178.0 - 65.244.178.63
Affordable Computer Supply 65.244.178.64 - 65.244.178.95
Enpro Services Co, INC. 65.244.178.96 - 65.244.178.127
Verestar/Atlanta-GA 65.244.178.128 - 65.244.178.143
No More Forms, Inc. 65.244.178.144 - 65.244.178.159
Component Distributors, Inc. 65.244.178.160 - 65.244.178.191
Broadband Wireless Communications 65.244.179.0 - 65.244.179.255
Cemtec USA 65.244.184.0 - 65.244.184.31
ALLSTATE INSURANCE/PAUL BONOMO 65.244.184.32 - 65.244.184.39
CPH Engineers Inc 65.244.184.40 - 65.244.184.47
Conrad Yelvington Dist, Inc. 65.244.184.64 - 65.244.184.79
Optimum Nutrition, Inc 65.244.184.80 - 65.244.184.87
Teckn-O-Laser 65.244.184.96 - 65.244.184.111
Badcock Home Furniture & More 65.244.184.112 - 65.244.184.127
The Thornestone Group 65.244.184.128 - 65.244.184.143
Talk Visual, Inc. 65.244.184.160 - 65.244.184.191
College Park Campus Partners 65.244.184.192 - 65.244.184.255
Florida Family Mutual Insurance Company 65.244.185.0 - 65.244.185.255
PEPSICO 65.244.186.0 - 65.244.186.255
YOUR INFO INC 65.244.188.0 - 65.244.188.255
Orex Technologies 65.244.189.0 - 65.244.189.63
NDS INC. 65.244.189.64 - 65.244.189.95
Intermedia / Fightertown USA 65.244.189.96 - 65.244.189.127
Delphax Technologioes Inc 65.244.189.192 - 65.244.189.207
ALLSTATE INSURANCE/KAYODE OKEWUSI 65.244.189.208 - 65.244.189.215
ALLSTATE INSURANCE/PAUL SMITH 65.244.189.216 - 65.244.189.223
ALLSTATE INSURANCE/NEIL DOBBS 65.244.189.232 - 65.244.189.239
Intermedia / Haynes Brothers Furniture 65.244.189.240 - 65.244.189.247
ALLSTATE INSURANCE/JERRY HAIRSTON 65.244.189.248 - 65.244.189.255
FIDELITY NETWORKS INC. 65.244.191.0 - 65.244.191.127
ALLSTATE INSURANCE/JEFFREY STERN 65.244.191.128 - 65.244.191.135
Radiology Group / East Ridge Hospital 65.244.191.136 - 65.244.191.143
Trimeris, Inc. 65.244.191.144 - 65.244.191.159
ALLSTATE INSURANCE/DEANE LONG 65.244.191.160 - 65.244.191.167
custardinsurance 65.244.191.168 - 65.244.191.175
ALLSTATE INSURANCE/ANGELA RAGAN 65.244.191.184 - 65.244.191.191
ALLSTATE INSURANCE/ DERRICK MADDOX 65.244.191.192 - 65.244.191.199
ALLSTATE INSURANCE/TIM BOYCE 65.244.191.200 - 65.244.191.207
ALLSTATE INSURANCE/PAUL STOVALL 65.244.191.208 - 65.244.191.215
Hamilton Risk Management 65.244.191.216 - 65.244.191.223
ALLSTATE INSURANCE/JIMMIE BROWN 65.244.191.224 - 65.244.191.231
navigant 65.244.191.232 - 65.244.191.239
ALLSTATE INSURANCE/RONALD BARNES 65.244.191.240 - 65.244.191.247
ALLSTATE INSURANCE/THOMAS FITZPATRICK 65.244.191.248 - 65.244.191.255
Money Line Direct 65.244.193.0 - 65.244.193.255
KELLEY DRYE & WARREN L.L.P. 65.244.194.0 - 65.244.194.7
Senn Palumbo, Meulmans 65.244.194.64 - 65.244.194.127
Systrends, Inc. 65.244.195.0 - 65.244.195.127
Skytell 65.244.195.128 - 65.244.195.143
BMR Neurotech 65.244.199.48 - 65.244.199.63
Metro Republic Commercial Services 65.244.199.64 - 65.244.199.95
Call Catchers 65.244.199.128 - 65.244.199.159

Re:TIRED OF UNFAIR BLOCKING?!

[AndroidCat]

As long as UUNET takes pink money, why should we give a damn? If you were important to anyone, you would have been whitelisted by now.

ITYM "So screw us, we're paying the price for supporting a company that supports a company that takes spammer money."

Re:TIRED OF UNFAIR BLOCKING?!

[Todd Knarr]

You hate spam, yet you're still giving UUnet your money knowing they harbor spammers. You're one of the people making it profitable for UUnet to harbor spammers. And note well, UUnet will continue to harbor spammers as long as it's legitimate customers keep giving it money despite that. They'll only change when people like you start saying "UUnet, we're switching to <alternate-upstream> because we refuse to bear the costs of you harboring spammers. When you've cleaned up your spam problem, maybe we'll think about coming back.".

Re:TIRED OF UNFAIR BLOCKING?!

[AndroidCat]

If you want to live in a slum, don't complain about cockroaches. Try that for a prime computation "Bashar". If you think the SPEWS listing is unfair, post it. If SPEWS acts arbitrary, people will stop using it.

Re:TIRED OF UNFAIR BLOCKING?!

[Todd Knarr]

No, it's simple economics. One spammer provides X dollars of profit for the ISP. N non-spamming customers provide Y dollars each of profit for the ISP. When N*Y > X, it costs the ISP less to boot the spammer than lose the non-spamming customers. Solving for N is left as an exercise for the reader.

Collateral damage is part of the design

[Skapare]

The author of the article is yet another person who misunderstands the problem. The problem is not how to prevent the delivery of spam; that has already been solved. The problem is how to get the ISPs hosting the spammers that continue to eat up our bandwidth to disconnect them from the network. Decent ISPs will just do that upon the discovery they have spammers. And it is acceptable to slap their hand once or even twice, but three spams and you're out. The problem is many ISPs are not decent at all, and will only act upon a financial incentive. Blocking the whole ISP is what is required. DNSBLs such as SPEWS are doing that incrementally with the intent to minimize the number of others affected for long enough to show to the ISP that they had better get rid of the spammers. At this point most ISPs will realize they will lose customers in the future, and will get rid of the spammers. A few will be stubborn, and will eventually have their entire address space listed. Not only do we not want mail from spammers, we don't want mail from anyone who supports spammers. And if you are paying money to an ISP who runs in turn is providing services to a spammer, then you are indirectly supporting spammers through financial benefits, such as the ISP offering the spammers lower rates through economy of scale. And do not forget that if you are doing this, that you and your ISP are benefitting off the costs incurred by others. All this article is, is a reflection of frustration by an individual who just doesn't get it, that he needs to either turn his ISP around to be a decent member of the internet community, or he needs to switch to another ISP. It looks like a lot of work went into it, but the premise being all wrong, the article is worthless and offers no solutions.

Re:Collateral damage is part of the design

[Skapare]

We clearly disagree as to what "the problem" is. One aspect of that disagreement could come from a difference in understanding what "spam is". Some people look at it as a message content issue. I believe you are one of those people. Others believe it is a behaviour issue. I see it that way. And thus, there are differences.

I also want spam stopped without stopping legitimate mail. But we disagree in how to accomplish this. Your position is that no matter how the sender of the legitimate mail wants to send that mail, even if they want to send it in a way in which it cannot be easily distinguished from spam, that the legitimate mail must get through no matter what, even if that means lots of spam gets through. My position differs in that I believe the senders of legitimate mail should take some reasonable steps to distinguish their legitimate mail from spam. There are a number of different ways to do that:

• Send the mail from an email address the recipient knows.
• Send the mail from a server the recipient trusts.
• Send the mail from a server the recipient has no reason to distrust.

The recipient's ISP, if one is involved, will certainly play a role, and the recipient and ISP need to have a known and agreed relationship with each other (if the ISP is using a blocking list the recipient is unaware of or does not approve of, that relationship isn't a proper one, and is beyond the scope of this discussion ... the recipient needs to regain control at their end).

So my position on how to accomplish stopping spam while letting all legitimate mail through is that the sender of the legitimate mail has to play some part in the process. They cannot be totally passive and expect the recipient to do all the work in distinguishing legitimate mail from spam.

You say your goal isn't stopping spam. Thank you for being honest and forthright.

I did not say that my goal isn't stopping spam. You made that up, which is something I've seen from you before, so I'm not surprised. So go back and read what I said. It's even in the title. I said that collateral damage is part of the design. It's part of the methods employed to stop spam.

Again, it comes down to the behaviour of the senders (and their agents, their ISPs) and the behaviour of spammers. In order to stop spammers, the senders need to take on part of work involved. Those that refuse to are part of the problem because they are forcing even more costs on the recipients (in addition to what spammers do) by forcing the recipients to have to do all the work to separate legitimate mail from spam.

Consider your open relays. What's happening here is that the inputs will accept both legitimate mail as well as spam. Any mail server is subject to spam coming in, but an open relay is particularly vulnerable to this. An ISP operating a closed relay can apply sanctions against their customer base, which is a fraction of the whole internet base. But an open relay is equivalent to an ISP that has as its customer base the entirety of the internet. Since legitimate senders that are not a customer of the ISP running an open relay won't use that relay, the volume of legitimate mail going through the open relay is still a function of the customer base. But spammers don't play by the rules, and will use any open relay they can find, law be damned. That means any open relay is going to have a substantially higher percentage of spam compared to legitimate mail.

That means there is less distinguishability of legitimate mail from spam, and greater costs to the recipient (and/or his agent, his ISP).

Therefore, it is reasonable to make demands on the ISP running an open relay to close it, so that the legitimate mail coming through it won't have such high costs imposed on the recipient. The "collateral damage" design is part of the pressure being applied. Blocking only your open relays has some degree of collateral damage, but you are certainly in a position to correct that by routing all legitimate mail through other servers which are not the open relays.

That all of 130.105/16 and 198.3.136/24 are blocked goes to other reasons, and I don't know what they all might be. Certainly the fact that you willfully operate open relays is part of it, I'm sure. The fact that you are blocking relay testers probably is, as well, although you'll find I am in agreement with you as to the legality of such testing without consent. But I also believe that much blocking of those addresses is simply due to how you personally are dealing with the situation. Perhaps you have moved the open relays around to various other output addresses. That would certainly warrant a large scale blocking.

So basically it comes down to you having legitimate mail to be sent, but you are mixing it up with possible spam through an open relay, and are expecting recipients and their ISPs to sort out which is, or is not, spam (and without the benefit of being able to do so based on the IP address, because the SMTP client at this point is your open relay), yet you refuse to do the very same vetting of the mail coming through your open relay.

Senders of legitimate mail need to carry some of the burden of the spam fight, too.

Some of your arguments are against some of the activities of DNSBL operators that include open relays. Among the problems are things like doing unconsented relay testing, and making relay input lists available. But consider what if I ran an open relay DNS blacklist that held to certain strict standards:

• Only actual open relay outputs will be listed.
• The inputs will not be made available except to a small set of trusted people who have a good reason to know.
• The networks hosting open relays will not be listed unless there is activity of moving open relays around to evade the blacklist.
• No testing will be done unless the owner of the machine at the address in question consents to the test.
• Once listed, an open relay will remain listed for 12 months since the last time any relayed spam was detected.
• A listing can be removed if the owner consents (in writing, including a clause to agree not to sue) to a relay test and that relay test passes (e.g. nothing is forwarded) without any indication of an attempt to block the test.
• If spam continues soon after a relay test passes, the relay will be listed for 12 years.
• A second separate DNSBL will also be operated, which users may elect to use instead, which will not include all open relays in which the owner disputes the determination.

That would still end up listing your open relays if they have ever passed spam in the past 12 months. If you actually do integrate spam detection and refusal on the inputs, the probably there would be no spam, and it would not be listed. Now the question is, how would you react to that kind of DNSBL?

Slashdotters: read Dean's paper justifying his open relays here . Judge for yourself.

Re:Collateral damage is part of the design

[Skapare]

At the time of posting this comment, I have not changed my reply to the paper. That's still the first iteration on my reply. maybe you're reading into it more than is there.

I think the difference between what you perceive is going on, and what actually is going on, is more in the area of intention and goal, than in actual methods employed. I most certainly do add network ranges of ISPs, rather than just the spamming/relaying/proxying addressess, to the list, and use DNSBLs that also do such. So you are correct in understanding that my actions involve these full address ranges.

What you fail to understand are three critical things:

• The reason this is done is because the actions of the ISP at the other end are causing my costs in dealing with spam to be greater. An open relay does this by preventing me from being able to test the originating IP address without having to go to the added cost of accepting DATA to get headers, and parsing it.
• The goal isn't to suppress communication, since the ISP has the opportunity to correct these problems which are recognized by the vast majority as problems they are causing.
• It's not the end of the world, since the addresses are not being blocked at the IP layer (with one exception right now). That does not mean I am refusing legitimate mail. What is means is I am applying finer tests to determine if the mail is legitimate; specifically I am in these cases testing the sender's email address.

Certainly the annoyance is a big cost. Costs are reduced by employing automated methods to prevent the spam from causing the annoyance. The issues I am dealing with regard the matter of keeping those automated costs low. If it was the case that I wanted to cut off all spam at all costs, I'd block your entire network at the IP layer and never have a process forked for any mail from there. But not getting legitimate mail is itself a cost, so I don't usually go to that extreme. Mail servers in your network can still establish an SMTP connection, and can still offer legitimate mail, and I still check the sender address to see if it is legitimate to the extent I know about. Your email address is in fact recognized; despite our disagreements, I have no reason to believe email from you is spam.

As for your cost figures, there are lots of things you are leaving out, and lots of things I'd most likely be leaving out if I spent the time to begin detailing them here. I won't, because it's not necessary. The reason is because my goal is to achieve the lowest cost, whatever I can determine that to be, not some specific fixed threshhold of cost. The lowest cost is going to depend on a lot of things, including my time (posting on slashdot, newsgroups, and mailing lists is not figured in), and goals of comfort, such as making sure my mail servers are typically running at less than 25% capacity (if one is regularly running at 30%, it's going to get upgraded somehow soon).

Re:I found your article to be of whiny, not helpfu

[minas-beede]

I suggest you grow up.

DNSBLs function to block spam, not to punish.

As to who is responsible, an intelligent analysis would reveal that those who herd-like joined the "secure all open relays" crusade without even bothering to read the RFC (2505) that said that was a failed approach are more to blame - they pissed away years that could have been spent in an effective battle against spam (which would have been long gone if that had been done.) Now the herds follow SPEWS - more years of ineffectuality are being risked.

It is smaller ISPs and less technological countries that are to blame? Let me just mention a few entities that stand in stark contradiction to your claim: the United States, Worldcomm (uu.net), Broadwing, Sprint, Verio, Starnet, Rackspace. You gonna tell me that the 50 spam servers Ralsky uses in Dallas are on a smaller ISP? OK, name it - let's start telling them to act. I don't care if it's big or small - name it. I'd like to know.

Still, I agree that the case made against DNSBLs by the web page is weak - too weak to heed. I loudly oppose collateral damage but I see no evidence that it is rampant.

Needs rework

[Anonymous Coward]

How was SpamCop missed in the "research" ?

By the stated definition (Technology, 1) there is only the act of theft but no such a thing as a thief ?

For the writing to be taken seriously it somehow needs to add some value to an intelligent discussion. Just stating that RBLs are not perfect is like stating that operations and amputations have drawbacks.

This guy is a fool

[Randy Rathbun]

I have been using DNSRBLs for a while now. I can say for a fact that in the past 5 months our mail server (75 users) has had 0 legit emails blocked. There were 2 emails blocked by two of our corporate customers because they were running open relays. I count those as legit because clue sticks were applied very fast.

Let's assume that those 2 emails were totally legit. That leaves me with 2 emails that were blocked out of approx 15,000 emails that have gone through this server.

I'm sorry if this guy is dealing with users who are using ISPs/working for companies where the mail admin's obvious job qualification was "I have a computer at home", but I am not going to subject my users to crap email any more than I have to, nor am I going to waste my bandwidth processing messages from con artists.

If this guy does not like it, tough. It is my mail server. I am in charge of it. My users all appreciate not walkin in the office Monday morning and having to sort through 300 emails trying to sell them fake viagra.

Double opt-in?

[AndroidCat]

We do confirmed/double opt-in

Oh-oh. "Double opt-in" is usually spammer-speak.

Re:Double opt-in?

[AndroidCat]

No calling it "double opt-in" is spammer-speak. Trust me. :^)

That said, from your description, you run a proper confirmed opt-in list with records of the confirmation. Excellent!

Re:Double opt-in?

[Senior Frac]

"Double opt-in" is the term the DMA invented to describe what the rest of the world calls "confirmed opt-in" or "closed loop opt-in". It was an attempt to make the process sound onerous so marketers could make excuses not to do it. As if proving the subscriber reallys owns the email address in question is a repetitive step. (It's not, it's an entirely logical next step)

"Double opt-in" is definitely spammer speak. Doing it, however, is not spammer action.

Re:you get what you pay for

[Analysis Paralysis]

Hmmm...I would not agree that this is a consequence of the medium (presuming that you mean the POP3/SMTP protocols) but more a case of certain "features" (in this case, HTML formatting) being exploited in ways unintended by their creators - web bugs also falling into this category.

Whether you regard this as an abuse of the system or a clever twist on it is your opinion, but I believe that most people are not aware of this usage and would object if they did.

Given most people's relative ignorance of network issues, "fixing it" by firewall configuration is not an ideal solution for the masses - and not using email at all is a little unrealistic for most. Having email clients that do not downloading HTML links for remote servers *by default* would be a good start, but without a widespread education programme (an Internet driving test?) most users are going to fall prey to further tactics of this nature.

There's sueing and sueing

[melonman]

Thinking about this (and having visited your website), I'd be really interested in seeing you spell out your logic. You say that you permanently block people who threaten to sue. Presumably those are people who are spamming? In that case, I can believe that you are within your rights not to receive their mail. For that matter, I can believe you within your rights not to receive anyone's mail.

If I was going to sue anyone (which looks unlikely, since we have only had one very short-lived SPEWS-related problem in over a year), it would not be for refusing to receive my mail, it would be for sending rejection notices that tell people that I am a spammer, which I am not. Exactly what is your problem with that? Has any innocent party ever tried litigation on that basis? If companies can be sued for the content of their websites, I really can't see how spreading damaging lies by automated email can be an acceptable activity.

Of course in this case, you are blocking my domain because I dared to express a point of view (which the moderators don't seem to dislike too much) in a discussion forum, despite the fact that our company has never sent a single spam, and I have never actually threatened you or any other company with any form of litigation. Have you seen Minority Report? If so, you appear to have been cheering for the wrong guys :-) This is the sort of orwellian behaviour that would normally result in a shock-horror article for YRO...

Re:There's sueing and sueing

[Tadghe]

" I can believe that you are within your rights not to receive their mail. For that matter, I can believe you within your rights not to receive anyone's mail."

Bingo, That sir,was my point in first place...Regardless of *why* someone blocks you (Mabye they don't like Brits or think your the anti-christ or that your secretly plotting to take over the world) they can block you for any reason, or none at all, if their 554 response says you dress funny and smell of cod, there's not much you can do about it. You could threaten to sue, but then you'd just wind up on more personal blacklists.... While I'm certainly not up on British law, In the U.S the level you must prove for Libel is pretty high (higher for a corporate entity I might add).

"Of course in this case, you are blocking my domain because I dared to express a point of view (which the moderators don't seem to dislike too much) in a discussion forum"

No, your blocked because you flew off the handle and went all C&C. I blocked you to prove a point.

A legal case that may interest you is the case of T3 vs Mcnicol (http://www.wired.com/news/politics/0,1283,53102,0 0.html for some background).

Re:There's sueing and sueing

[melonman]

Bingo, That sir,was my point in first place...

Good, so the problem is that you didn't read the initial posting. I never said anything about sueing people who block email. At all. Ever. Not even once.

If someone says you dress funny and smell of cod, there isn't much you can do about it.

Rubbish. If (and we are talking several levels of hypothetical here) someone publishes claims that I am a spammer, and if I am demonstrably not a spammer, and if as a result of this untrue allegation I lose business, I suspect that I have a pretty good case for sueing for at least the amount of business I lost.

But then you'll just end up on more personal blacklists

Keep talking, in terms of making RBLs look as ugly as possible to anyone reading this thread, you are doing a fantastic job. What you appear to be saying is that you have a God-given right to destroy anyone's reputation as part of your so far utterly unsuccessful crusade against spammers, and that if anyone complains about their company being damaged as a result, you and your mates are going to damage it even more, just to show who is boss. If we were talking about any subject other than spam, there would be 3,000 /.ers complaining about this on a yro thread.

While I'm certainly not up on British law

Not sure where British law comes into it...

You went all C&C

What is C & C? You're the one with the lawyer, I've never considered sueing anyone in my life. You blocked because you can't read English, and, in the process, provide evidence to anyone wanting to attack RBLs that the blacklists are arbitrary, and often motivated by pettyminded vindictiveness rather than any concern about spam.

A legal case that might interest you

Why? I have never mentioned anyone sueing anyone over whether or not you can block email addresses. Which part of "You misread my original posting" are you struggling with?

While I'm here, I have to know, exactly how does blocking the whole of China put any pressure on anyone to do anything? The people in power will just get a .com address, it's the dissidents you are penalising, and what are they supposed to do, rise up and provoke regime change in the name of a spam-free world?

Time to ditch SMTP

[LostCluster]

Blackhole lists right now focus on the open relays. Why not focus on the original spammers themselves? Becuase the SMTP protocol doesn't allow for it. The fact is, you can put whatever addresses you want into the From: and Reply To: fields. There is no accountablity to assure that the return addresses are owned by the person who sent the message, or even that such addresses even exist. If mail servers were required to "stand behind" the messages that they sent, receiving server can call back the sending server, basically to ask "Did you really send that?" If the server denies sending the message, or the server doesn't exist in the first place, the message gets canceled and is never delivered to the named user. This would end the cloak of invisiblity for the spammers. They'd have to either use a traceable user account at their ISP, or spam only from their own domain. No traceroute required, an autheticated username and domain show up in the From: line. This would cut down the collateral damage, because instead of blocking by IP address or netblock, the block would be by username and/or domain. What's more, really reputable ISPs could kill most of the spam in the time delay between the sending and the reading, as it would simply be able to refuse to authenticate the messages after being told they were spam. If the ISP doesn't, a retroactive black hole can lock out offending user accounts without having to lock out whole domains, unless it is determined that the domain belongs not to a multi-user ISP but a single-user spammer.

Re:Time to ditch SMTP

[mstefan]

The contents of the header fields in a message have nothing to do with SMTP protocol itself; the sender is identified with MAIL FROM at the beginning of the transaction and could choose to validate the address if they wish (either returning a 550 or 553 result code if they don't like it for some reason). Requiring that the From: and/or Reply-To: header fields match the return path means that you're effectively eliminating relaying, "smart hosts" and some gateways that forward messages from different mail systems.

And, bottom line, it wouldn't do anything to stop spammers, or even slow them down. So what if they have to use a "traceable user account" with some service provider? Spammers move from provider to provider (often providing false information), or they use spam-friendly/neutral providers who don't give a damn as long as they get their monthly fee.

not much luck with RBLs here

[stinky wizzleteats]

I have a serious spam problem on my server. I have a couple of users who are amazingly profligate with how and where they share their e-mail address, and it has turned my server into an interesting anti-spam lab.

I tried the RBLs, but in my experience, they only work if you are reasonably careful with your address. Once you get on enough opt-in lists, you get so much spam from legitimate servers that RBLs don't work anymore.

The final answer has been to use a Bayesian filter which tags messaages for filtering on the client. I'm using bogofilter, trained with a message corpus of about 10,000. This has been the only thing which has really worked, and the client side filter provides a safety valve against false positives. (Although, to date, I've had no false positives).

Re:Collateral Damage

[AndroidCat]

It wasn't legimate, but I did get spam from an open proxy on the firewall of the South Korean Naval headquarters. Ohmyflippinggawd. Bet your ass that I burned diplomatic and admin channels reporting that one with the recomendation that they do a full security audit.(And right after they shut it down, they had a naval incident with North Korea. Hmm.)

Zero legitimate email, but those Russian babes did seem pretty hot. :^)

Digitial Signatures etc

[jefu]

I agree. Using digital signatures and other authentication/authorization methods are likely to be the only effective way to curtail spam. What's nice is that these methods could similarly be used to prevent spam on IM services and in other communications services.

Even if only implemented at a server level (verification of host/sender) this could remove a good deal of spam - and could do that on a per host basis.

For the most part its not hard to do either.

It will be hard to get done. At an individual level everyone needs to get the right software and keys. This won't be easy. Nor will it be easy to get governments - filled with politicians who are more likely to label any cryptographic services as helping terrorism or anti-government activities (and who may well have sold their souls to the spammers) to agree. And I can easily see the spammers suing people to try to prevent them from using this (more a problem at the server level - the idea of spammers filing a million or so suits against individuals just makes me grin - Spam Lawsuits).

Then too, if cryptographic services are available many people might just encrypt their email - and the folks in power would like that even less.

Key distribution is also a problem in the case that you might want to add someone to your accept list - you need to verify their identity somehow.

So its a great solution. It would probably work. And its unlikely to occur.

Re:Digitial Signatures etc

[Zeinfeld]

It will be hard to get done. At an individual level everyone needs to get the right software and keys. This won't be easy. Nor will it be easy to get governments

People already have 90% of the software they need. Every major email client has supported S/MIMe for 5 years.

The main missing piece is filters that use the fact an email is signed as a means of authentication (authorization will also be needed once the spammers catch on).

The remaining piece is a certificate (or more accurately key) lookup mechanism that uses the DNS as the index rather than the broken schemes based on "directories" that key of an X.500 infrastructure that will never exist.

Re:There is no spam problem.

[AndroidCat]

There are many anti-spam technologies available and you know what? Some of them even work.

How would you know troll? You don't get spam.

Re:He missed DCC - Distributed Checksum Clearingho

[bigberk]

Yes, DCC looks very promising. My university uses it and I have never seen it mark a message as spam when it wasn't (this is very good).

It often misses spams, but as more people run DCC servers the detection will improve. Detection also improves as spammers target more recipients at once - in a way, they're announcing their presence to the system.

Keep an eye on this one! See the dcc FAQ.

Yet another "Wah" article.

[Harik]

Here's my problem with the article... It's "WAH! I'm using a shitty ISP who's spammer friendly and my email is blocked!"

No, your email isn't blocked. Were it blocked, it'd never leave your mail client. Here's what REALLY happens. Your email leaves your mail client, and goes to your ISPs mailserver. You have a contract with them, so they accept it. Then THEY try to send it to us. Now, at this point you're dealing ENTIRELY on OUR hardware, OUR bandwidth, and OUR good graces. Those of us who are SICK AND FUCKING TIRED of having 100x more spam then real mail have quit accepting mail from well-known spammers.

As long as you DIRECTLY support spammers by continuing to use a spam-friendly ISP, your mail will be blocked. Period. You subsudize the rape and pillage of my mailserver and the mindless wasting of my time. And you really have no choice but to move. Wah. Because the alternative is for EVERYONE ELSE ON THE FUCKING INTERNET TO CHANGE THEIR EMAIL ADDRESS EVERY MONTH SO IT'S NOT ON THE SPAMMERS LISTS. DO YOU UNDERSTAND THE COST SHIFTING INVOLVED HERE? IS THIS LOUD ENOUGH TO GET THROUGH?

YOU are DIRECTLY responsible for sending me "Young horny teens get f**ked by a horse with a 31 inch c**k!" (Yes, really *'d out in the message)

Spamassassin is useless. Spammers tune their spams to be under the 3.0... you can't really filter harsher then that without blocking legit mail. The fact that it's open source only makes about a 1 week difference anyway. (Closed filters like hotmail/AOL/earthlink get bypassed in about that long)

The 'bayesian' solution is cute, but dosn't really work beyond an individual level, which means that everyone gets to spend hours sorting through spam (and it still slips through). It also fails because it's looking at single-words. If a friend sends me a mail that includes just 15 poorly chosen words, it gets blocked. If someone implements a two-word version, it may work better.

Add to the fact that a single legit email blocked means you have to read through EVERY spam-marked message looking for more.

So far, the only solution that's made my email workable is whitelisting. And THAT is a lot fucking worse then the RBL. If you're not on my whitelist, you don't talk to me. Period. No Chineese. No Koreans. No Brazilians. No Dutch. No AOL users. Nobody from a small ISP. You're ALL off the net as far as I'm concerned. Nothing that's not a reply to an email I sent. My email is useless for you, but it works for me.

(That's actually an overstatement. I do read the discard folder. Once a week. With the 'd' key. So if you don't invite me to see your webcam, I may read your email.)

Re:Yet another "Wah" article.

[talks_to_birds]

Right on!

t_t_b

Whitelists.

[NFW]

Whitelisting has cut my spam intake down to almost nothing. The costs are small:

People who email me for the first time will get a "please confirm" message to get their email address into the whitelist. This request is sent automatically and the response is processed automatically, so it requires none of my time.

The bandwidth cost is the biggest thing. Every spam I get creates an outgoing "subscription request" message, and usually a "no such user" bounce because spammers almost always use bogus From and Reply-to addresses. The impact is pretty trivial for me on my DSL-hosted SMTP server. I'm not sure how it would scale for an ISP. But, if it cost a dollar per user per month... it works well enough that I'd pay that if I had to. Heck, it's half the reason I'm paying an extra $20/month for static IP address.

An PKI-based authentication with support at the transport level would be even better. In the meantime, this approach works for me, and it works really, really well. I get about a hundred messages a day, and about one spam per week.

Re:Whitelists.

[NFW]

I'd hate to send e-mail twice to anybody.

Fair enough. At first I thought this might be a problem, but then I realized it's actually an added benefit. If someone feels that the message they sent me is so unimportant that it's not worth answering the confirmation request, then I myself consider it so unimportant that I'm glad not to be bothered by it.

And I hate to receive "please confirm" message if I have not sent original one. You know email headers are forgible...

Yes, I know headers can be forged - the fact that almost all spam arrives with a bogus From address is one of the reasons the whitelist works so well. The few bits of spam that have gotten through the whitelist have been from Nigerian chain letter spammers, becuase they are just about the only spammers who use real addresses and bother to reply to my "secretary's" confirmation request. Anyhow, if a spammer forges someone else's valid email address, that person will receive a boatload of bounce messages, because spammers send their crap to mailing lists with large numbers of invalid addresses and other auto-response accounts. The message the victim receives from my whitelist autoresponder will leave them no worse off than the bounce message they would get if my email account didn't exist.

It might even be helpful to the victim, since it will definitely include a copy of the message I received in the first place. When one of my addresses was used by a spammer, it took me a while to figure out what was going on, because mostly what I got was bounces and flames without copies of the original spam.

Deliberate abuse does present a potential problem. Someone could cause my autoresponder to send a bunch of confirmation messages to a victim as (part of) a DoS attack. I'll extend the whitelist autoresponder so it doesn't send multiple whitelist confirmation requests to the same address. Thanks for bringing that possibility to my attention.

Re:This way, perhaps, we can get Ralsky in jail ..

[fanatic]

he spoofs the IPs of dialup systems from the servers.

Bzzzt! Thanks for playing, but you cannot send SPAM (or any other kind of email) using a spoofed IP address. SMTP rides over TCP, which requires a handshake prior to establishment of a session. And this requires a real IP address, because the initiator must reply to the reply, before any higher layer data can be sent. Nice try, though.

Re:We need better mail clients

[platos_beard]

Ummm, its not that hard in Outlook Express either

Tools->Options->Read tab

[x] Read all messages in plain text

Re:Oh cry me a river

[Erik Fish]

To become so widely blocked your ISP had to ignore complaints. Acting slowly is most definitely their fault. If the spamming customer paid his bills first so they were "forced" to allow him to continue spamming it is still their fault for not having a proper acceptable use policy. There is no reason why their policies can't give them the leeway to kick off any customer found to be spamming at any time without a refund. Some ISPs even charge a cleanup fee.

SPEWS collateral damage whitelist

[persaud]

SPEWS co-opts individual admins (via osirusoft, SpamAssassin, etc.) into a clearly documented process which bears many similarities to economic extortion. SPEWS (with justification) delegates responsibility for economic collateral damage to the indvidual admins whose servers act upon SPEWS RBL publications.

Some experienced sysadmins do not endorse SPEWS' wholesale blacklisting of entire netblock neighborhoods. Those admins choose not to use SPEWS RBL, but may choose to use RBLs that cause less collateral damage. Some experienced sysadmins use SPEWS RBL because they do endorse SPEWS' clearly documented process which bears many similarities to economic extortion.

Many inexperienced sysadmins use osirusoft (e.g via SpamAssassin) without knowing the difference between SPEWS and other RBLs aggregated by osirusoft. Without knowing that difference, these inexperienced sysadmins unknowingly endorse SPEWS' clearly documented process which bears many similarities to economic extortion.

One answer is a SPEWS whitelist + reciprocal blacklisting. Create a whitelist of SPEWS-blacklisted-but-collateral-damage IPs which have *never* been accused by SPEWS (or other RBL) of spamming. When an ISP causes collateral damage by enforcing the SPEWS RBL against a presumed-guilty-but-never-accused IP that exists in the SPEWS whitelist, ask the individual sysadmin to use the SPEWS-collateral-damage whitelist.

If an individual sysadmin uses the SPEWS RBL but chooses not to use the SPEWS-collateral-damage whitelist, they would be endorsing SPEWS clearly documented process which bears many similarities to economic extortion. Such explicit endorsement will earn such individual sysadmins membership in an IP blacklist of "sysadmins who support SPEWS' clearly documented process which bears many similarities to economic extortion". This blacklist would then be enforced by sysadmins whose IPs are SPEWS-blacklisted-without-spam-accusation .

This unbundling mechanism provides a technical means for individual sysadmins to endorse SPEWS valuable spam-fighting contributions without endorsing SPEWS' clearly documented process which bears many similarities to economic extortion.

Long-term, the solution is pseudonymnous, non-profit TLS certificates for SMTP servers with social (not economic or calendar) seniority (c.f. Apache Incubator). The economic variety exists at bondedsender.org, along with whitelist patches for popular open-source MTAs.

How about a different solution...

[Dimensio]

Instead of a single global list, would you rather your upstream's IP holdings be placed in the filters of thousands of individual ISPs? That way, when your upstream cleans up its act rather than being delisted from a single source, they'll have to be delisted from thousands of different sources (many of whom won't bother to fix their lists).

Re:How about a different solution...

[Dimensio]

Perhaps ISPs should disclose that they are willing to host customers who violate their AUP and that they allow their customers who have 'special' contracts to commit theft of service and trespass to chattel so legitimate users will know to stay away.

Re:EFF says to do the impossible

[Nakoruru]

The problem is not you making a personal decision to create false positives for yourself. The problem is other people making decisions for you which block mail which is not spam without your knowledge.

The problem is some ISP between you and your friends/family/coworkers deciding that your friends'/family's/coworkers' mail is spam without you having any say in it.

The idea is that YOU should decide what false positives to deal with, not a government or an unaccountable entity like an ISP.

Only because spammers lie...

[billstewart]

"Opt-in" is a perfectly legitimate term, which was intended to mean "yes, the recipient really asked us for this", but spammers being the liars that they are, often really means "the recipient made his email address known somehow so we're going to use it" or "checked a box saying something and we did something else" or "I opted in to send him that mail" or "didn't use enough nuclear weapons while opting out".

The legitimate part of the email list industry responded with "double opt-in" to indicate that the listbot sends the recipient a message saying "you or somebody pretending to be you asked to subscribe you to the list, click here or reply if you really want to be on the list" and doesn't add the user to the list if they don't confirm. Most legitimate mailing lists bots do that, though some don't bother. Spammers occasionally claim to be double opt-in, but that's just because they're liars.

ISP Volume Reduction and Defense In Depth

[billstewart]

If you're an individual user, a computation-intensive spamassassin approach can do a really good job of blocking most spam and blocking very little non-spam. But if you're an ISP or Mail Service Provider, having a conservative RBL can save you a lot of resources, including bandwidth and computation, by throwing away the high-volume relay-abuse spams with as little work as possible, saving the more complex work for mail that's less likely to be spam. (By conservative, I mean "trying to only block actual relays and other known spammer systems", as opposed to "broad-spectrum insecticides and lists that do collateral damage to pressure ISPs or harass their competition.") That might be a 25-50% reduction in total email that the ISP needs to handle, but from an instantaneous-resources standpoint, it's probably higher than that, because spam tends to come in high-volume blasts, while real email is mostly Poisson arrivals. And if an ISP's failure responses are the "Temporarily inaccessible, try again later" type as opposed to permanent rejections, real email systems are much more likely to try again later than spammers are (though of course open relays may still try again later, because they're just mal-administered, not necessarily broken.)

AOL is 200 times that large

[billstewart]

I don't know quite how many people use AOL, but it's about 30 million, plus or minus 50-200%. That's about 200 times as large as XS4ALL. Most of the other big US ISPs have somewhere between 1 and 10 million dialup users. I don't know how many people Hotmail and Yahoo provide email for, but most of those accounts are disposable and low-use. On the other hand, the ISP I use for my email and web page has somewhere around 1000 users, maybe a bit more, so XS4ALL is about 100 times as big :-)

Tagged / Changeable Email Addresses

[billstewart]

If you only use one address, eventually a spammer will get it. One of the solutions for spam prevention is to have an essentially infinite number of addresses, and use different ones for different recipients so you can easily dispose of ones you don't want. If you've got your own domain name, this is somewhat obvious - use addresses like anything1@mydomain.com, anything2@mydomain.com, etc. If somebody starts spamming anything3@mydomain.com, discard it.

A number of the Unix email systems let you get a similar effect by tagging addresses - myusername+tag1@example.net, myusername+tag2@example.net, etc., though sometimes the separator is a "-" or a "+" or something else, and sometimes web forms choke on the separators, and mail forwarding systems don't explicitly support them, and too many humans aren't good at copying them correctly (which has been the real limitation, unfortunately.) You have to discard the abused addresses in your mail client or procmail instead of rejecting it from sendmail or pointing the mailbox to /dev/null, but it otherwise works the same way as the domain solution. Also, if anybody sends mail to myusername@example.net, without the tag, you'll probably get it, and spammers can figure that one out.

Fastmail.fm has a nice intermediate solution, using third-level domains. If your account is username@fastmail.fm, you can use username+tag@fastmail.fm, or you can also use tag@username.fastmail.fm, which works well in web forms and people seem to be able to copy accurately. (They also seem to be much more generally clueful than most webmail systems I've seen.) Their system runs on some kind of Unix system - I think *BSD rather than Linux, but it's at least a flexible and stable enough environment for them to build mail handling tools.

Re:This way, perhaps, we can get Ralsky in jail ..

[Krellan]

Read the above post more carefully. The spammer was successful in spoofing the IP address of a TCP session, because he controlled both the dialup account and the high-speed account.

SYN from the dialup account.

SYN+ACK from the helpless email server back to the dialup account. Dialup account now has observed both sequence numbers.

ACK from the dialup account, and the SMTP transaction begins.

As sending mail consists mostly of uploading, upload packets to the server are forged from the high-speed account to the server. The dialup account only needs to receive the ACK for the sent data, and the SMTP responses from the server. The spammer uses both the dialup and the high-speed accounts in tandem to keep the connection alive, in effect intentionally hijacking his own TCP connection.

Very clever! The spammer must have had some help in setting up a scheme like this. I don't think he'd be smart enough to write the software on his own.

Re:You're an evil dialup user! You must be a spamm

[schon]

There are a lot of ISP's that only allow their own email adresses to pass. I think OP is hinting on this.

If there are a lot, then you won't mind listing some of them, right?

Links, please.

Another way to fight spam

[melonman]

If there were any decent ways to block spam without resorting to the netblock method, We would gladly use it

Cut off their income by billing people who respond to spam. Last time I suggested this, everyone said it couldn't be done, so please forgive the detail. All you need to do is build a database of spam messages (which already exist), extract the 'click here' addresses (about 3 lines of perl), scan the http log of the gateway your customers use (another 3 lines of perl), pick up the dynamic IP address of the machine requesting that page, find out which user it was and bill them.

I would start with three warnings followed by a bill of $5 a spam reply. For paying accounts, you debit their card. For free accounts, you close them after 3 violations. The point is that 99% of people will get the message after one warning, and certainly after one bill. Spam revenue plummets, game over.

Of course ISPs might not want to do this in case it upset their customers. It's much better upsetting my customers. But, as you appear to have conceded, this isn't about Joe Internet user, it's about reducing bandwidth for ISPs.

BTW, if RBLs are such a staggeringly great idea, you would expect ISPs that use them to be 2 to 3 times cheaper than those that don't, because their overheads are so much lower. Is this the case?

RBLs are a reactionary measure

[Control-Z]

Ok, this guy is seems to be a particularly motivated victim of collateral damage. His paper was pretty much accurate though.

RBLs are primarily a reactionary measure. Sure spammers would keep sending spam from the same server if it were allowed, but they keep getting many accounts all over the world to send from. RBLs are like killing fleas with a hammer. You can't hit them fast enough to keep up, and what about the dog?

Users should not have to deal with being collateral damage, or having their mail arbitrarily filtered before it ever gets to them. Rural internet users may only have one ISP to choose from that's not long distance.

The only real solution to the spam problem is going to be in SMTP itself.

Who own the AGIS netblocks now???

[silentbozo]

Given then the AGIS netblocks are effectively black holes now, which ISP do I avoid in order to not get assigned one of these cured IPs?

Re:This way, perhaps, we can get Ralsky in jail ..

[fanatic]

Yeah, I missed that little detail in the parenthetical.

Has anyone ever killed a spammer and claimed self-defense or justifiable homicide? Sure wqould be nice if Ralsky and other swine like him moved on to the next plane of existence.

I'm planning on putting up TMDA and some DNSRBL support on my server at home.

Re:You're an evil dialup user! You must be a spamm

[schon]

I know for sure that European cable ISP Chello does.

No link? (I went to www.chello.se, but I'm english-only.)

How do you know? Do you have a chello.se account?

So (at best) that's one unconfirmed.

Last time I checked, "lots" generally meant more than (at least) one.