Osirusoft Blacklists The World

ariehk writes "As of today, Osirusoft, distributer of the SPEWS and open relay blocklists, among others, is no longer operational. Servers using these lists (including the FTC) are currently rejecting ALL email. This shutdown seems to be in response to a several-week-long DDoS attack on Osirusoft, SPEWS and others, resulting in both sites being down. This has caused much discussion on n.a.n-a.e, including the suggestion that the attack is somehow related to the SoBig worm. The spammers must be hurting if they can devote these kinds of resources to attacking blocklists." Read on below a related submission.

NSXDavid writes "Earlier today our site mysteriously ended up on Joe Jared's Osirusoft SPAM blacklist which is used by lots of antispam software (like SpamAssassin and sendmail). Since he is currently under a serious DDoS attack, there was no way to appeal this decision. We contacted Mr. Jared by phone who informed us that 'everyone needs to stop using Osirusoft and that he's going to be shutting the service down.' Then he says he's going to blacklist 'the world' (aka, ban *.*.*.*) to get his point across. Later on this evening, he apparently went ahead and did just that. Succumbing to lawsuits and DDoS, a once great blacklist is dead. SpamAssassin is removing it from their config in the next release (rc3) and email admins around the globe are reconfiguring their mail servers."

Comments

Blacklists and reality

[Dancin_Santa]

It may take a little more work, but the only solution to spam is the whitelist.

Re:Blacklists and reality

[Gherald]

Will yahoo and hotmail be on that whitelist?

Most of the spam I get comes from those domains, or at least it is spoofed to appear its from there.

Re:Blacklists and reality

[WolfWithoutAClause]

What happens when the spammers start using worms and viruses to create open relays on people you trust?

Re:Blacklists and reality

[Anonymous Coward]

Only whitelist addresses, not domains.

Re:Blacklists and reality

[Gherald]

At a personal or server level?

Re:Blacklists and reality

[Anonymous Coward]

Optimally, you'd have a manageable list of users so that you could identify the problem and notify them as soon as you notice that something is wrong.

Do we have such a big problem with this kind of thing now?

Re:Blacklists and reality

[Zeinfeld]

Will yahoo and hotmail be on that whitelist? Most of the spam I get comes from those domains, or at least it is spoofed to appear its from there.

The vast majority of spam is sent with some form of false address. Developing a way to be able to trust the origin of email is the way to end the spam crisis.

This type of action does not surprise me. SPEWS and the other blacklists are poor solutions to spam because they are in effect private censorship with no accountability. They are also single points of failure for the Internet as today's episode proves.

The backwash caused by this event was huge. It wasn't just spews and spews users who were affected, the load on the backbones was causing severaql nets to brown-out repeatedly.

It is just as well that we did not have as many idiotic 'hack-back' schemes in operation as some have been calling for.

Re:Blacklists and reality

[Anonymous Coward]

Personal level for personal contacts. e.g. friend@ISP.com, buddy@webmail.com

Server level for business contacts. e.g. client@companyA.com, consultant@companyB.com

It should be easy enough to whitelist all of your friends. Phone contacts are very easy to perform for business.

Re:Blacklists and reality

[Pig Hogger]

Whitelists are unworkable. How do you reach someone for the first time?

Re:Blacklists and reality

[Anonymous Coward]

I don't want you reaching me if you don't know me.

If you know me, you already know how to get in touch with me.

Re:Blacklists and reality

[geordie]

The only solution to spam is to stop the spammers.
Everything else is just a bandaid which will eventually be circumvented.

Re:Blacklists and reality

[Gherald]

Then how could someone post their e-mail on a website or forum and expect others to be able to reach them?

Preemptive whitelisting is usefull for making sure messages do not get wrongly classified as spam by a filter, but I do not see it as being a workable solution to everything.

Re:Blacklists and reality

[Anonymous Coward]

What happens when spammers spoof the addresses of common mailing lists and email addresses of major sites? If spammers start forging spam with return addresses such as "orders@amazon.com", basically we're screwed.

Re:Blacklists and reality

[Anonymous Coward]

Lots of sites already do this, actually. Well, not the whitelisting, but an "email address on the website" alternative. Just use a modified form of forum software where instead of the messages getting posted onto the website, you get it posted to a personal spool where it can be retrieved at any convenient time. If the message poster wants to have a return email, they can whitelist the website owner and put their email in their message. It's a workable authentication scheme.

The main problem would be that a determined spammer could post messages at will to a board, but that situation really isn't any different from the current situation where spammers can send emails at will to anyone.

Re:Blacklists and reality

[Gherald]

Still, whitelisting complicates things without effectively solving the problem. It would be like not being able to put your telephone number on a business card.

SMTP is really what needs to go. But that will take years, perhaps a decade.

Re:Blacklists and reality

[lpontiac]

Developing a way to be able to trust the origin of email is the way to end the spam crisis.

PGP and S/MIME allow you to trust the origin of email. Both have been around for years

Re:Blacklists and reality

[srw]

> What happens when the spammers start using worms and viruses to create open relays on people you trust?

They already get through whitelists... a few months ago a person I provided free webspace for got a nasty porn spam with my address in the *from*. She was rather concerned. When she contacted me, I found that I had in fact recieved the same spam "from her." What's more, her address was a special purpose address that was only listed on the website I provided for her. A few lines lower on the site was a "Thanks to Scott Walde for providing this webspace for free" with a link to my email address. The only reason I can see for using email addresses found near each other this way is to get through whitelists. (software or human... I often scan the "from" to decide which emails to read.)

--srw

Re:Blacklists and reality

[jovlinger]

typically, there is a way for the sender to get onto the whitelist, without the recipient needing to take special action.

Alternatives are confiriming the email (respond with this specially crafted string as subject) or running some computationally expensive operation For example, postmasters of well adminstered machines may run a number factoring service: to prove that a non-whitelisted message isn't spam, they are willing to spend their computational resources to factor a largish number for you.

The idea for both of these is that the main difference between spam and legit mail is that a legit sender will have just a few recipients but many messages, and thus can afford a one-time-per-recipient hassle to get on a whitelist, while a spammer cannot.

Neither address distributed compromised senders, which is effectively a way for spammers to make others pay to get on whitelists. If whitelists become wide-spread, a worm-based mass-compromise is the only option left to spammers.

Re:Blacklists and reality

[Kris_J]

How do you reach someone for the first time?

Challenge-response using a machine-unreadable image.

Personally, I don't use whitelists as my primary spam defense, I use an aliasing service (spamgourmet) that allows me to automatically create any number of email addresses with a limited life span. Once someone appears trustworthy they get my main email address (spamcop). Since no one is supposed to know my real email address, it can be changed at a moment's notice -- like the night before last when it was filling up with viruses.

Re:Blacklists and reality

[norsk_hedensk]

i for one recieve NO spam what soever. i run my own email server with NO spam filter either. i just never post my email address... ANYWHERE. it is easy to avoid recieving it, dont post it anywhere, and dont sign up for those "win one million dollars by shooting the moving monkey" ads. now to be honest this IS excluding the occasional spam from inktomi trying to get me to sign up to get my site listed on their search engine, but compared to others who recieve hundreds or more pieces of spam mail a day, this is nothing.

Re:Blacklists and reality

[chromatic]

What happens when a spammer forges a whitelisted From address?

Re:Blacklists and reality

[Anonymous Coward]

How would they get that information? The odds of guessing whether someone is on someone else's whitelist is pretty bad.

It would have to be something as serious as a worm like Sobig which spams itself out to everyone in the address book. Such a thing would be as illegal to execute as worms and viruses are now.

Re:Blacklists and reality

[ComputerSlicer23]

Somewhat that is true. However, what constitutes trust of the origin of e-mail? One of the replys says to use PGP or S/MIME.

That only works if I require them to sign mail they send to me, with my public key.

Possibly having a key system of public keys and private keys. You put your own private key out there, saying you'll accept mail with anything that signs their mail with the public key. You add any mailing lists you want public key, they sign all outgoing messages with their private key. Thus you'll accep their mail.

You can white list on anybody else you're willing, using a Web of Trust from PGP if they are considered "trusted" enough. However, that will lead to problems.

However, public and private keys will suddenly become tokens of value to spammers. Suddenly people will start creating worms, and scripted attacks to pull peoples keys. They will start trying to break into machines. It'll create a black market for trusted keys the world over. They'll just be new attacks, and new problems. Creating a large scale web of trust, won't work. A worm can easily go steal the tokens of trust, and then start using them to spam with. It'll just be another arms race.

Now letting forcing people to sign with your key is probably the most doable, but it also means that running mailing list software is a real, real CPU intensive application. I'm not particularly thrilled with that.

The only way to stop spam is to make it stop being cost effective, that involves causing e-mail to be an expensive operation if it involves untrusted e-mail servers.

Kirby

Re:Blacklists and reality

[fussman]

that'd solve my RIAA C&D order problems

Re:Blacklists and reality

[JoeBuck]

Yes, let's kick blind people off the net! If they can't parse your machine-unreadable image, screw them. Right?

Me, I do pretty well with Bayesian spam filters.

Re:Blacklists and reality

[Anonymous Coward]

The odds of guessing whether someone is on someone else's whitelist is pretty bad.

It's not hard to do with mail lists. The spammer joins the lists and gets the email addresses of the members. Then the spammer creates spam messages by forging the From header using the mailing list address. Then mail list members receive whitelisted spam.

Re:Blacklists and reality

[chromatic]

Maybe I'm an atypical e-mail user, but I've received plenty of spam "from" people I'd whitelist. Most of the core Perl developers, for example, have been joe-jobbed from time to time. Relying on spammers never to forge public information is pretty unworkable.

Speaking of Sobig, I've received 14.4 megabytes of bounce messages in the past two days. If a spammer forges my e-mail address, how many whitelist challenges will I receive? Saying it's "illegal" doesn't help; spammers regularly break the rules.

Any workable solution to spam has to address two realities. One, forging addresses is trivial. Two, client-side filters mean you still have to pay for receiving and storing messages you don't want. I don't see whitelisting as handling either challenge.

Re:Blacklists and reality

[russellh]

Whitelists are unworkable. How do you reach someone for the first time?

public key encryption is a good model

Re:Blacklists and reality

[Kenja]

White lists work in the same way that shooting yourself prevents cancer. Sure it works, but it undermines the whole point. Email is supposed to make it easy to communicate. If I need to fill out a form in order to send someone email they simply wont be getting the message.

Re:Blacklists and reality

[CoolVibe]

You probably don't have much of an online presence then and aren't on mailinglists that get archived publicly.

You could say I shouldn't enlist on such things, but development on open source stuff pretty much demands that you give your mail address to the general public in order to receive patches and whatnot.

So, we have to live with the spam, or try really hard to blokc it. Losing this dns based blacklist is a shame. And I think blacklisting the world is just an antisocial thing to do. He could have just shut down the DNS server and have stuff time out or fail (NXDOMAIN). If he just killed his nameserver, we wouldn't have this problem with mail being rejected.

Re:Blacklists and reality

[leviramsey]

This is exactly why I think that SoBig is the perfect spamming mechanism. AFAICT, it essentially gets around nearly every non-content-based spam filter (ie Bayesian and SpamAssassin et al).

By sending spam from an amazing depth and breadth of compromised networks, it forces blacklist operators to go into "block everything" mode, which is so draconian that users of the blacklists will disable them.

As I posted in another story, if ISPs start blocking outbound port 25, the next iteration of the worm simply uses the Outlook SMTP settings to relay through the official MXs of the ISP. Given the flood of abuse reports, many ISPs (especially larger ones) are simply going to /dev/null abuse reports; they can be reasonably sure that their servers aren't going to end up in blacklists used by a lot of people (because heads will start to roll among the admins who use the blacklists).

By pretending to come from an address that has at most two degrees of separation from the recipient, they will get around a fair amount of whitelisting (this is exploiting the greatest flaw in TMDA and the like: trust of the From: address).

Re:Blacklists and reality

[commodoresloat]

That explains a lot. I have a few email addresses and shortly after I put two of them on a web page near each other they started getting email from each other. I started to worry that I was sleepwalking to my computer and sending myself invitations to look at porn.....

Re:Blacklists and reality

[leviramsey]

And neither is used by a significant portion of the Internet on a regular basis.

If AOL really wants to redeem themselves in geeks' eyes, they should include PGP support in the next version of AOL (say that using PGP will reduce the spam in your mailbox and is ideal for protecting yourself from identity theft, yadda, yadda, yadda).

Re:Blacklists and reality

[liquid-groove]

Easy enough? For a company with 5k users, they likely routinely communicate with 100k or more external addreseses (being generous and claiming only 20 external contacts per user). That's a list of 100k addresses leaving aside any alternate e-mail addresses those users might have. Going to train your users to search for any addresses they might want to add to see if they are already whitelisted and to add entries through as of yet unimplemented mechanism? My users can't fill out a form to get access to a network share properly, now I'm going to be asking them to do this?

If they whitelist my entire domain, then aren't the still susceptable to spoofing? OK, so I work for a small company, but what if you looked at Oracle's largest 100 customers; they'd likely need to whitelist the entire Oracle domain. If I wanted to spam those customers, I'd just forge an Oracle from address.

A tool like SpamAssassin requires much less work on the part of users, vendors and IT staff. Whitlelists might be a useful way to make sure that imortant mail from specific people isn't flagged as spam, but as a primary mechanism it's not particularly scalable.

Re:Blacklists and reality

[twenex]

And what's to stop a spammer from getting a public key too?

Re:Blacklists and reality

[eric76]

I like the idea behind challenge response systems, even though I'm sure that none have been done properly yet.

What I really hate are the ones requring you to go to a web page. Nobody should have to use a web browser to confirm their identity. The computer I often use for e-mail doesn't even have a browser installed.

For what it's worth, I've considered just rejecting all incoming e-mail unless the from address is white-listed or the message is encrypted with my PGP key.

The white-listing of the from address would either be by the e-mail address and the IP address of the sender's SMTP server or by verifying the digital signature of the sender. Of course, the latter requires people to digitally sign their e-mail.

Re:Blacklists and reality

[liquid-groove]

Alternatives are confiriming the email (respond with this specially crafted string as subject)

Very good friend of mine works for MailFrontier, so I'm predisposed to think nice things about them and their products. However the first time I got a challenge (2 people on the same message) when posting to a large mailing list, I said 'fsck it, I could care less if those people see my e-mail' and deleted the challenge messages.

Interesting concept, but actual implementation has a significant behavioral barrier to overcome IMO.

Re:Blacklists and reality

[iq in binary]

Alternatives are confiriming the email (respond with this specially crafted string as subject) or running some computationally expensive operation.

Unfortunately, spammers already cracked this one, too. Any information used to get past filters will ultimately be presented in the header (otherwise is illegal). Get a sample, run some numbers and bam: you have an algorithm.

I need not go further into the explanation for most to know how they did it. Probably don't need much more proof either, for many recieve spam with keys in their subject or headers.

Someone before mentioned: "...We need to get rid of SMTP..."

He was right as day.

Re:Blacklists and reality

[eric76]

Possibly having a key system of public keys and private keys. You put your own private key out there, saying you'll accept mail with anything that signs their mail with the public key. You add any mailing lists you want public key, they sign all outgoing messages with their private key. Thus you'll accep their mail.

Correction. You sign the e-mail with your private key. Others verify it with your public key.

Re:Blacklists and reality

[eric76]

Clearly, white lists need to do more than just whitelist the sender's addresses. They also need to perform a sanity check on the source of the e-mail.

If you receive an e-mail from orders@amazon.com and the IP address of the SMTP server that is sending the e-mail to you is in China, it should fail the sanity check.

Re:Blacklists and reality

[magores]

This is fine for person to person, but what about person to business?

Let's pretend I'm a business. I WANT you to send me an email.

I WANT emails from every single person in the world that isn't a customer yet.

I NEED to accept every email on the chance that one of them might be a sale. (Yep. This means I need to look at the ones that include *details* in the subject.)

Whitelist doesn't work here.

I do NOT want a phone call from you as first contact. A one minute email response is now a 40 minute phone call explaining that "Yes you must turn on your computer first if you want to actually use it"

White-list is unworkable for business, because everything must be "whited" by default.

Challenge-Response is unworkable because I/we (as a small to mid business) simply could not keep up with that. Sure. One of the real programmers we have (i'm not one of them) could come up with an auto-bot to respond to challenge-response, but then we end up back where we started, don't we?

I don't have the answers. But I do know what the answers aren't. And Whitelist/Challenge-Repsonse aren't it

Just my 3 cents worth of rant for today.

Re:Blacklists and reality

[eric76]

Any challenge response system that sends challenge messages in response to mailing list messages is broken.

Ideally, a well written challenge response system would look for signs of e-mail from a mailing list and put it on hold without issuing a challenge. It should be solely up to the user to accept such e-mail.

Of course, any mailing list that does not adequately identify itself as a mailing list in a way that a good challenge response system can identify is broken as well.

Re:Blacklists and reality

[afidel]

You block outbound 25 and limit the number of messages per account to something reasonable (even 1K messages would severly curtail the problem and should not affect many legitimate users). Also by using legit mail relays all of the messages will have lefit FROM: headers so tracking down the infected machine(s) will be much easier.

Re:Blacklists and reality

[afidel]

Mailing lists have to be whitelisted manually, they get no special consideration. If you sign up for a mailing list without adding it to the whitelist then it is your own faux pa (sp?). People can live with a little inconvenience like adding addresses to whitelist and getting challenges on their mailing lists, what people can't live with is thousands of pieces of spam a month.

Re:Blacklists and reality

[afidel]

My ISP already does this, all incoming emails are checked to confirm that the email address's MX record is legit and the server that the message is coming from matches one of those MX records. This sometimes trips up bad mail admins or people running new mail servers, but so what?

Re:Blacklists and reality

[zangdesign]

I'm not sure it can be correctly called censorship - that requires a governmental entity. While I certainly do not agree with the ultra-aggressive attitude of SPEW and Osirusoft, to call what they did censorship nominates them to a category of governorship to which they were not elected.

It was a private list, maintained by a private entity who released this information to the world. Nowhere does the government enter into it.

I really hate starting this debate up again, but we need to be clear on what is censorship and what is not. If I restrict people from voicing their opinion on my network, that is not censorship. It is only censorship when the government does. I think the theory is that a government is supposed to represent all of the people, so therefore all of the people are supposed to have an equal voice (yeah, there's theory and reality and never the twain, yada yada). But a private entity is allowed to restrict content whenever and wherever they choose within that entity.

Re:Blacklists and reality

[Micah]

No, the only solution is Internet Mail 2000.

Re:Blacklists and reality

[warrax_666]

Encrypting/signing 1 million emails individually is much more computationally expensive than encrypting/signing 1 email. (Although it may not be enough with e.g. OpenPGP to foil spammers, it would certainly be possible to increase the computational cost of encrypting/signing to the point where it becomes impractical for spammers).

Re:Blacklists and reality

[Kris_J]

the latter requires people to digitally sign their e-mail.

I used to digitally sign my email, but all it did was confuse people. :(

Re:Blacklists and reality

[paule9984673]

This is great because it can be handled on connection while all filtering methods only work on already received messages.

Maybe this could be improved to also initiate an smtp connection to the From-address and discard the connection attempt if there is no such user on the other side.

Re:Blacklists and reality

[Kaotiq]

Thats why blacklists or whitelists to work have to be based on which mail relays you trust or don't.

From adresses are too easy to fake.

Sure blocking mail from given relays isn't perfect but it keeps the spam level down for me.

YMMV however.

Re:Blacklists and reality

[Anonymous Coward]

well, thats an easy solution... add a unique key signature to your email, if someone emails someone else claiming to be you and that key isnt in the title/body, then its not from you. so long as your key signature is not publicly displayed, youd be fine. but knowing the vast majority, theyd end up posting them in e-mail quotes on websites and such anyway...

Re:Blacklists and reality

[Anonymous Coward]

sorry, but: you must be kidding !

The supposed 'solution' is neither near to 'ready to use' nor do I see a chance to interoperate with RFC822 mail.

If this would be the only way out of the spam dilemma, I quit my ISPs contract today ...

Re:Blacklists and reality

[zabieru]

Not a great solution. For now, fine, but do let's find an alternative... Say, voice recognition of a number. Yes, that kicks those who are both deaf and blind off the net. Sorry, folks. Still not perfect, but it's much, much better.

Re:Blacklists and reality

[Anonymous Coward]

faux pas.

and building a challenge/response list that varies through time [i.e. as computers become more powerful] and is available at some standard website and can be used with virtually all mail clients to automate challenge/response

"The recipient 'X' of e-mail 'Y' has challenged your email. Would you like to take a minute to complete it? After you do, you will not have to repeat this process for this user again.
Yes/No"

Re:Blacklists and reality

[Anonymous Coward]

Yeah, theres a solution. Make blind people rely on their friends whenever they want to do something; that'll really impress them.

After we've enacted your brilliant scheme, we should get rid of wheelchair ramps. People in wheelchairs have friends who can walk, after all.

Re:Blacklists and reality

[slumos]

1. not everyone (or even a large enough percentage of internet users to make your statement in any way meaningful as a solution) can run their own mail server, but surely you knew that.
2. spammers do dictionary attacks against any of the large email providers. create a yahoo address, forget about it for a few weeks, log in and see thousands of spams.

Re:Blacklists and reality

[Vitus Wagner]

What happens when the spammers start using worms and viruses to create open relays on people you trust?

Supposing that these people also trust you, you have to educate them how to protect themselves from viruses and worms.

Re:Blacklists and reality

[Anonymous Coward]

One approach would be to not whitelist based on the sender, but also on the recipient. I know, right now you're saying "but I'm the recipient, stupid!"... yeah, you are, but use more than one address to do it.

Whitelist orders@amazon.com going to you+xyzzy-amazon@example.com, assuming sendmail. I think qmail people can do the same thing with a - as the separator. You get the idea.

The special recipient address becomes a shared secret between you and Amazon. Anyone else trying to forge that sender address also has to guess the recipient address which is associated with it.

By the way, if you control an entire domain, then just make up completely new addresses and don't worry about the + or - tagging.

Re:Blacklists and reality

[eric76]

Any challenge response system that issues challenges to mailing lists that are readily discrnible as mailing lists is going to be hated by the people using the mailing lists and whoever designed the system is rightly going to be seen only as a pathetic luser.

I'm not saying that anything that looks like a mailing list should be passed through to the user. Just put it on hold as if a challenge was issued.

Of course, that means that any decent challenge response system must give the users a chance to review what is waiting and allow selected e-mail to be delivered even without a response.

Re:Blacklists and reality

[Anonymous Coward]

Your ignorance of what censorship is shows in your post, zang.

Censorship is defined as "The act, process, or practice of censoring".

The verb form is defined as "To examine and expurgate", while the noun is "A person authorized to examine books, films, or other material and to remove or suppress what is considered morally, politically, or otherwise objectionable."

I do not see the word "government" in there. You are confusing TWO different things. The GOVERNMENT cannot CENSOR the press, our religious rights, and most other things..they CAN censor things that are of "National Security", or dangerous to the public health (yelling fire in a crowded theatre for example).

A private organization CAN censor thoughts and ideas and email. SPEWS and Ori don't do the ACTUAL censoring, but they provide the data by which ISP's DO CENSOR email.

SPAM sucks...everyone knows it. But the wholesale methods that SPEWS and Orirusoft provide do little to effectively stop it and only cause problems for the legit email users.

THEY HAVE NO ACCOUNTABILITY...and THAT is MY concern...the GOVERNMENT can be held accountable, but private vigilante groups like SPEWS and ORI cannot..obviously.

Re:Blacklists and reality

[junklight]

Some good points - I get a spam occasionally with my own address forged as the from address.

AT the end of the day whitelists need work to administer - and that is almost as unacceptable as getting spam. I just want my email to work. Like my cell phone - I don't want to have to think about it I just want it there and functional for when I need it.

SpamBayes is doing the job for me these days and it does it well. I only have to reclassify the very odd email and have been getting NO false positives. All with little or no effort on my part.

I don't think that there will ever be a panacea to spam though. The sad fact is that there are sufficent morons out their (and if you look at your spam you cannot think otherwise) that buy the crap that spammers are selling to make it worth their while to send this nonsense to everyone in the whole world just to target this group. Perhaps we are attacking the wrong people - anyone that buys anything from a spammer should have their computer taken away from them.

Re:Blacklists and reality

[Anonymous Coward]

Sorry, I won't drink your Libertarian Kool Aid. I don't buy that just because a private entity undertakes some action it somehow magically isn't the same as if the government were to undertake the same action. Censorship is censorship no matter who the censor is: Government, private corporation or individual.

Re:Blacklists and reality

[Anonymous Coward]

You don't white-list the from-address, you white-list the ip-address of the remote endpoint that connects to your mailserver.

Re:Blacklists and reality

[raju1kabir]

This is exactly why I think that SoBig is the perfect spamming mechanism. AFAICT, it essentially gets around nearly every non-content-based spam filter (ie Bayesian and SpamAssassin et al).

Sobig.F is dead easy to filter with Spamassassin - it generates a uniquely malformed date header.

Of course they'll fix that next time around.

Re:Blacklists and reality

[Robmonster]

These kind of challenge and response solutions are not really viable. I run a double opt-in email list with over 3000 members. A few of my users did install something like this, and it took a long time to jump through the hoops they required just for them to receive mail they had already asked for (twice)

If everyone did this....?

Say it takes 30 seconds to load in the Challenge website, read the word hidden in the .gif/.jpg type it into the box, click accept and then wait for the server to update its database.

30 * 3000 = 90,000 seconds = 25 hrs!

Granted, I'd only have to do it once for each user. Oh, thats until they decide to change their subscription address or alter a setting on their software....

Even if only 10% of the users did this it would still take 2.5 hours to sort through. Thats assuming that they al used the exact same kind of C&R system so I wouldnt have to spend extra time reading instructions to figure out exactly what I have to do each time.

I agree we need a solution, but Challenge And Response isnt it.

Re:Blacklists and reality

[DrHyde]

Hell no!

I run several mailing lists, free of charge. They currently require virtually no effort from me at all to maintain. I will not put in the effort required to jump through the challenge-response hoops - even if it's only a minute or so per challenge, that would amount to many hours of my time wasted. And I dread to think what it would be like for people who run larger lists with thousands or hundreds of thousands of subscribers.

So in the couple of occasions when I have seen that stupidity, I simply unsubscribe the user and, if they have an account on my system, delete the account and all their data.

Re:Blacklists and reality

[Anonymous Coward]

Yep, or at least let us make a choice instead of regulating it

Hey, you have to wonder which is more important - blocking spam, of the few non sighted people who get blocked - Which is the greater good?

Re:Blacklists and reality

[Anonymous Coward]

You are perfectly right. But the ways to stop spammers are pretty limited. Currently only going after spammers who spamvertize websites or email addresses seems to have any chance to work out.

But what i see most often these days is spam which uses as mean of contact either a telephone number or an ICQ#. Since its much harder to find out the phone company providing some number _and_ explaining to them why they should shut down a spamvertized number, i see the spammers in clear advantage. And to mention ICQ... the guys at ICQ dont give a damn about providing service to spammers. Great, yet another safe haven for spammers. (thank you, aol.)

Re:Blacklists and reality

[inquisitor]

They already do. ISTR that a couple of recent viruses drop open proxies, even more evil than open relays (because of the other uses they have: bombing USENET, DDoSing, attacking websites and blaming it on someone else...)

Also, a certain popular provider of faux-"internet connection sharing" proxy software not only leaves it fully open in its default configuration, but it doesn't log either. You can guess the result.

Re:Blacklists and reality

[Karora]

Developing a way to be able to trust the origin of email is the way to end the spam crisis.

In another recent thread, a suggested enhancement is for DNS to publish "allowed sender IP" addresses. The structure for this information is already there.

What is needed is for more people to opt in, in protecting their domains in this way, and for people to unilaterally start using that information. If any one of yahoo, aol or netscape opted into this approach I could well imagine it would cascade to comprehensive success overnight, forcing spammers to more obscure domains (such as my own - currently victim to a 12 month "Joe Job").

Because this is distributed information, it is not easily modifiable by spammers. Ultimately this sort of approach is the only one that can work.

Ultimately, I would be able to set spamassassin to add +5 for any e-mail coming from a domain that didn't publish this information, or -5 for any one that did.

And I would not be receiving 1000's of bounce messages for messages from spammers using my domain name.

Yes please. I want it.

Re:Blacklists and reality

[Zan Zu from Eridu]

I'm not sure it can be correctly called censorship - that requires a governmental entity.

Censorship is the act of censoring, which is defined as surpressing or deleting anything objectionable. It's mostly done by governments, but that's not a requirement. (Religious organisations often censor their own holy texts.)

As such, any entity or organisation relaying information between the producers and consumers of that information has the capability of censoring this information.

If an ISP blocks or alters emails (to remove virusses), it is censoring email. This censoring is done with the consent of the recipients; the recipients can move to an other ISP if they don't like the censorship policy. This is the big difference with government censorship: you have a choice of getting your information from somewhere else.

In the workplace, an employee is in agreement with his employer to only recieve emails relevant to his job, so there is an issue of consent also. If the employee doesn't like it, he's got the choice of quitting his job.

So it's definitely censorship, but it's on a voluntary basis.

Re:Blacklists and reality

[Mjec]

The only way to stop spam is to make it stop being cost effective, that involves causing e-mail to be an expensive operation if it involves untrusted e-mail servers.

Apart from the problems in forcing people to pay for email (at what end, how to enforce cross compatibility etc), I want free email. It would really suck to pay even $0.01 (or even $0.001) for every message I send.

Simply deal with it. Install a decent filter, with lots of herustic and baysian checks, then deal with the one or two that leak through. Yes, spam of 50+ a day is bad, but most of that can be easily blocked by common, easy, free spam filters on any platform, even with settings so low that there are no false positives.

Alternatives such as charging for email or enforcing use of cryptography suck generally (signing requires me to type my password, or compromise my security by caching), but more than that they'll never be implimented. Forced signing (or somesuch thing) is standard with IPv6 - but has it been implimented? Try getting everyone to change; not going to happen. Install a spam filter and deal people.

Re:Blacklists and reality

[Anonymous Coward]

I cease to trust those people.

Re:Blacklists and reality

[neillewis]

I sent an email to SCO recently, they are using qconfirm which basically sends you an email asking you to confirm your email address before it will deliver your enquiry. Now, SCO probably has its reasons to use a system like that right now, but a singificant percentage of leads will probably just ignore the confirmation message, especially if they're wary of fakes like the paypal ones that are going around.

Anyway two days later and SCO still haven't bothered to reply to me so either the system doesn't work or they're too busy to be interested in my business...

Re:Blacklists and reality

[schotty]

Censorship doesnt require a goverment body, just someone with power or control.

Re:Blacklists and reality

[bgp4]

You're kidding, right?

This idea of evil spammers writing worms to take over computers to do mass emailing sounds REALLY appealing to the press. Man, that's better than a drug dealing pedophile midget. It's tech, it involves the black art of hacking, and can effect anyone without them knowing. It's the stuff that headline stories are made of.

But I really don't think we're going to see this activity as a trend. Occam's razor solves this for us. Hackers will write worms because they're trying to make a point/create a DDos network. It's a lot of work for spammers when it appears they're not really having a problem getting spam to me right now. And can you imagine the laws being broken when a spammer breaks into a computer, uses it to send email, that email actually sells something, then the spammer gets busted? Wowzers... interstate fraud can be fun.

Come on... THere are a lot of other problems to tackle before worrying about this.

Re:Blacklists and reality

[chialea]

I'm sure that Dwork, Goldberg, and Naor are really happy to know this. Their scheme requires interaction (as do all of them I've seen) and has a quite reasonable complexity assumption.

As far as I know, NO ONE has implemented any of the reasonable schemes that I've seen float around the crypto community. You can, however, find the paper and slides from talks on google:

http://www.google.com/search?q=On+Memory-Bound+F un ctions+for+Fighting+Spam&ie=UTF-8&oe=UTF-8

If you actually do have a way of breaking any of these family of schemes, I'd be very interested to know how. But "get a sample, run some numbers and bam: you have an algorithm" isn't very descriptive. The point that those numbers have special relationships which are believed to be difficult to compute without knowing a special piece of information (called the trapdoor information) may be slipping by you. If you send a response to a query which wasn't given out recently by the server, it's not going to be accepted. If you give out a wrong response, it's not going to be accepted. The probability that one of a reasonable (polynomial) number of queries was given recently is quite small (negligable).

In any case, I'm very interested if you can break any of these schemes, since most of them reduce to useful complexity assumptions, which I'd prefer to avoid if they were false.

Lea

Re:Blacklists and reality

[julesh]

White-list is unworkable for business, because everything must be "whited" by default.

Challenge-Response is unworkable because I/we (as a small to mid business) simply could not keep up with that. Sure. One of the real programmers we have (i'm not one of them) could come up with an auto-bot to respond to challenge-response, but then we end up back where we started, don't we?

I don't have the answers. But I do know what the answers aren't. And Whitelist/Challenge-Repsonse aren't it


A couple of questions - what makes challenge response unworkable for you? I don't understand what about it you would find hard to keep up with, it would be handled automatically by your mail server (or possibly a client side implementation if you didn't run a server).

BTW... my business is working with a fairly aggressive content-based filter (similar to SpamAssassin) combined with partial blacklisting (i.e. a blacklist hit doesn't automatically disqualify, just adds points to make rejection more likely), whitelisting and challenge response for messages that fail that. Without challenge response we would probably lose something like 1 important message per month. Now its probably down to something like 1 per year.

Our spam problem has been reduced from approximately 30 per-person-per-day to about 4 pppd.

I'm thinking of switching from content-based triggers to bayesian, but need to come up with a good way of adding received messages to the corpus from the client end. If I can figure that one, projections from various experiments suggest we should get down to less than 1 per day.

Re:Blacklists and reality

[rot26]

Right on. Oh, by the way, take a look at this wicked screen saver.

attachment: wicked_scr.scr

Re:Blacklists and reality

[Anonymous Coward]

Challenge-response using a machine-unreadable image.

How about this?
http://www.cs.berkeley.edu/~mori/gimpy/gimpy.html

Re:Blacklists and reality

[johnpettigrew]

However, public and private keys will suddenly become tokens of value to spammers. Suddenly people will start creating worms, and scripted attacks to pull peoples keys.

In addition to the point already made about private and public keys (i.e. you sign emails using your private key to prove to the world that you wrote it), this misses another point about signing schemes such as PGP/GPG. The private key cannot simply be stolen - to use it, you also need a matching passphrase that you create at the same time as the key. And this passphrase is not stored on the HD (unless you're very silly), certainly not in any standard place.

As has been said, there is no way to force everyone to start signing messages. However, if we could add a rule to a spam filter that messages signed from trusted email addresses are always accepted, that greatly reduces the false-positive problem.

John

Re:Blacklists and reality

[tgd]

I can't see why a blind person would be e-mailing me.

*ba-dum bum!*

Sorry, that was bad :)

Re:Blacklists and reality

[gpinzone]

SMTP is really what needs to go. But that will take years, perhaps a decade.

I agree. However, the open source community and Internet standards bodies are moving too slowly to develop and approve alternatives. Yeah, there are a few possible replacements now, but none have enough support to be used on a widespread basis. I have this nagging feeling that this is a perfect opportunity for Microsoft to yet again "rescue" the day by coming up with their own solution to the problem. And we all know how well that works for everyone not running their OSes.

Re:Blacklists and reality

[Anonymous Coward]

Moral of this story: Don't post your email in machine-readable format on the web. Period.

Re:Blacklists and reality

[Ronin Developer]

I kicked the idea of digital signatures around as well. As somebody else mentioned, this will create a market for stolen private keys (and identities). One solution is the deem identity theft as a terroristic act (ala the Patriot Act) and bomb would be identity thieves into non-existence.

Taking a rather less extreme approach, why not require all e-mail senders to have their own digital identity (ala Verisign, Thawte, etc) and make those who issue those identities accountable for whom the issue them to (i.e check identity and background checks).

Then, have each would be receipient of e-mail also be their own certificate issue agency.

Now, if you want to send e-mail to me, you send an introduction message to my mail server. That message is signed by you and you provide your public key. My server creates a unique key that applies only to my server, encrypts and digitally signs the key and sends it back to you.

When you want to send me mail, you use that key to encrypt and sign the mail and then sign the whole thing with your own identity key.

I can now verify that YOU sent the message and that I already authorized you to send me mail. If you start sending mail, I revoke your certificate and the process has to start all over again. Naturally, a way would have to exist to notify your friends should you be compromised. Another issue.

Spammers would have to retain a lot of these user-issued certificates. And, as soon as one of them sends a spam, their certificate is revoked.

Now, imagine a web of these servers talking to each other. As soon as a SPAM hits (or on a periodic delay), all users in the web get notified. Those users now are on the lookout for spam from the offensive party and the user becomes black listed.

Eventually, this reaches the root certificate authoritity. It is now their job to either reissue a certificate to a legit user or revoke the cert in general.

Yes, there has to be a way to prevent fraudulent blacklisting, but it could work.

a) It requires minimal effort on each user to issue and store and verify certs for those they will do business with.

b) It requires extensive resources of the spammers to send to any particular user.

c) Combine the whole thing with a smart token to unlock you identity certificate to alleviate the possibility of someone stealing your private key. That is, of course, provided that you can prevent your machine from being infected by viruses and trojans.

Thoughts?

RD

Re:Blacklists and reality

[squiggleslash]

Nobody's talking about regulating it. We're just saying you're an arsehole if you adopt a scheme that deliberately makes it difficult for blind people (or other similar groups), especially when there are legitimate alternatives.

Re:Blacklists and reality

[peterb]

I disagree; that's like saying I need to desalinate the water in the ocean; it's an impossibly hard task.

While I'm not a big believer in "technical solutions to social problems," it's clear to me that SMTP as it currently exists is not up to the task of meeting the needs of the community in a world where noise exceeds signal by several orders of magnitude. The first, biggest problem is that we can't reliably trace messages back to their source, thus allowing spammers to operate indefinitely. We need a mail system that uses cryptographic signatures to get some accountability into the system.

[cue conspiracy theorists.]

Re:Blacklists and reality

[minas-beede]

Don't say "only" unless you've examined all possible solutions.

Proxypots are doing a great deal toward stopping spam, and that's just a small number of them.

Proxypots aren't the end of that line of attack, either. ISPs that don't want spammers operating from their space can watch for traffic characteristic of spammers and nuke the accounts responsible when they find any. ISPs that climb out of their stupor enough to realize they can protect their customers against proxy abuse can monitor incoming traffic for spammer-characteristic patterns and divert the spammer traffic away from the destination IPs.

It's all very simple - it just has to be done.

At the individual IP level almost anyone can run a proxypot or relaypot.

Whitelists are fine but they're mostly a sophisticated JHD. Probably JHD has defeated more spam than all other techniques combined but all of those plus JHD obviously haven't ended spam - more is needed.

I suggest you try a proxypot. Or do the almost minimal version of one: watch for and report attempts to contact the proxy ports on your system.

In response the spammers could try a SOBIG.F based type of distribution method. That's already pretty well blown. They are almost dead. Don't let up until they are gone.

P.S. Seriously: try running a proxypot. You'll be glad you did.

Re:Blacklists and reality

[scrytch]

> It may take a little more work, but the only solution to spam is the whitelist.

Insightful, eh? The only solution, eh? Let's consider for a moment that was mere hyperbole, and you didn't actually mean "only" (I've decided to start giving people the benefit of the doubt, goodness knows my own rhetoric doesn't shine with rigor .. insofar as rigor can shine. It's too early in the morning).

Let's come up with some problems with whitelists in terms of user population:

* The blind. Most whitelists make you read off some challenge text that's been mutated in some fairly surrealist/cubist style.
* The just plain impatient. I refuse to jump through 20 different hoops to say hi to 20 people who left their email on a guestbook at a wedding.
* Helpdesks, and other public points of contact. They still need an antispam solution though.
* Old guard types who still believe in having an open email box (I should practice what I preach, but I so rarely read my "public" inbox). They may still want to block based on content and blacklists of known bad operators.

Whitelisting on a simple "from" is insufficient, spammers will simply begin harvesting address pairs... though that may make enough people mad to get more laws passed (hey it's grandma. enlarge my WHAT?) The prospect of more laws does not reassure me; the government would probably lock up anyone who sent an unpopular political newsletter to a typo'ed address.

Re:Blacklists and reality

[M. Silver]

m3 t00.

Generally the challenge responds to the Sender address, which is also where bounces go. Generally, the daemon that listens to bounces interprets it as a rejection message, concludes that the email address is no longer valid, and unsubscribes them without any intervention on my part.

I consider it a feature rather than a bug.

Re:Blacklists and reality

[squiggleslash]

I do hope they whitelist RFC compliant legitimate domains for which this doesn't apply. For example, my From: address is under myhost.dynip.com and will usually originate from Earthlink.net's SMTP server (because Earthlink block outbound port 25 so it has to be relayed via their SMTP server), or alternatively I hope the default is to allow email through, with a greylist for domains for which the ISP has more information available.

Despite being in common use, an MX record is not a prerequesite for an email domain to be legitimate, indeed, it was originally introduced as a hack because it was becoming more and more common for people not to want email sent to a specific machine.

A lot of anti-spam schemes end up making it more difficult for normal users to send email, and in some ways that's the biggest tragedy of all - spam clutters up inboxes, spam fighters cripple outboxes.

Re:Blacklists and reality

[deepvoid]

If spammers attack, then we should attack back. My point: That nz spammer who appears to have given up, due to having his personal info exposed to his unhappy recipients. If this same method is applied equally to ALL spammers, we might turn the tide. As far as I can tell, these worms give up any privacy when they choose to spew to the world, and when they go on the offensive and organise a ddos on sites that blacklist them, the only civil response is to expose as many details of thier lives as possible.

Public figures have this happen all of the time. Every detail of thier lives are visible for everyone to see. Spammers, people who broadcast messages, unwanted or otherwise, are just as public as a politician or an actor, and thier acts could be construed as a means to get attention. Let's give them that attention, and see if they can stand up to the all seeing eye of e pluribus unum.

Re:Blacklists and reality

[Anonymous Coward]

This sounds very interesting... could you provide with the name of the faux proxy software?

People need to be informed about this.

Re:Blacklists and reality

[blitziod]

The only way to stp spam is for people to stop buying products from spammers. The success of spam only shows that in their heart of hearts many people like spam, ergo they purchase from it. Spam filtering only increases the amount of spam to be sent, thus using more bandwidth.

Re:Blacklists and reality

[Anonymous Coward]

But letting AOL users[1] loose in the world of PGP would be, if anything, worse. Using something like PGP to "trust" things[2] without taking the time to understand how a web of trust should work is worse than not using it at all; it leads to a false sense of trust and security.

[1] Sorry, not all AOL users are like that, but YKWIM.
[2] The things are also people.

Re:Blacklists and reality

[terrab0t]

Along with what jovlinger said, you can create tagged addresses to give out to anyone you choose. You don't post these ones publicly because they require no "challenge-response".

A full working scheme for whitelisting and tagged addressing can be found here.

The only thing that can get through this kind of filtering is an extremely smart spammer who (as srw described above) can find the address of somebody on your whitelist to put in it's "from" field, or email worms which will most likely come from people on your whitelist.

Email worms are another problem altogether, but spammers smart enough to spoof your friends are something no filter can properly deal with right now. In the meantime, Dacin Santa is right. Whitelisting is more work (if you use the full scheme), but it's the best way.

Re:Blacklists and reality

[afidel]

Nope, if you don't have a valid MX record and the server sending the message isn't yours then you don't get through. I have kept with this ISP for over a decade precisly because they do what the customer wants and today the number one thing a residential ISP can do to keep customers happy is to reduce and minimize spam. After having their servers repeatedly crushed under the onslaught of spammers they finally became somewhat militant about blocking spammers and I congratulate them for doing so. A very large %age of spam comes from hijacked boxes on cable or dsl lines so one of their first checks is to see if the line is in a registered dialup/consumer dsl/cablemodem netblock so you would never even get to the MX check =) Sorry but spammers have abused the system so much that blindly following RFC's written in a MUCH more innocent time just doesn't work.

Re:Blacklists and reality

[squiggleslash]

. A very large %age of spam comes from hijacked boxes on cable or dsl lines so one of their first checks is to see if the line is in a registered dialup/consumer dsl/cablemodem netblock so you would never even get to the MX check

What on Earth are you talking about? I just said, my email is transfered via Earthlink's SMTP servers.

As I said though, this is just making email less usable. I'm glad you're happy with it, but ultimately all it's doing is damaging email even further. If I can't send legitimate, solicited, RFC compliant email to someone because their ISP is rejecting email without being sane about it, then that's broken, and they need to fix it.

Gah, this kind of incompetence with "Well, I don't care what the consequences are, people who want to send me email should just set themselves up so they're forced to receive spam and are unable to change ISPs without losing their email address" being considered a reasonable position really pisses me off.

Follow the RFCs. Spam should be rejected as spam, not email routed unusually but legitimately.

Re:Blacklists and reality

[Anonymous Coward]

Censorship is still not the right word, and the word is only chosen by either the spammers, or by the uninformed, to try and paint what blacklists do as 'wrong' or 'evil'..

Censorship implies you prevent someone from speaking to the world, usually based on what they have to say.

No one is preventing anyone (even the spammers) from SENDING email. All the blacklists are doing, is allowing some entities (ISP's and other owners of mailservers) to choose not to RECEIVE mail from some sources.

Re:Blacklists and reality

[Anonymous Coward]

forget keys use actual MAC addresses and reverse lookup validation this will kill spoofing and add a way to backtrack hackers

Re:Blacklists and reality

[timeOday]

I run my own mail server on my cable internet so I can make up a different email every time. For instance, the email address I give to Barnes and Noble is barnesandnoble@mydomain.com.

The problem is, just because I want to see my order confirmation email doesn't mean I want them to spam me once a week for the rest of my life. I have ordered from enough companies that this is now a substantial source of annoyance! Half.com is the worst, you have to read their email because you might have made a sale or need to re-list something, but they often send junkmail too. Yet no blacklist or whitelist or encrypted authentication will do a thing to help it.

Re:Blacklists and reality

[eyeye]

booooo, that should have been +5 funny
notice the ;-)

I googled his email address before posting, its already out on the internet (and worse on usenet!).

Re:Blacklists and reality

[martyros]

Actually, even having them sign it with your public key might not be so bad. Signing something with public/private key encryption is not a lightweight operation; it's a lot more CPU horsepower to sign 10,000 mail messages with 10,000 different public keys, than to just send them out cleartext. This puts more cost at the spammer's end, and would make it more worth their while to use more accurately targeted e-mail -- i.e., we can make e-mail actually analogous to postal junk mail.

Most people just don't send enough mail in a day to have it be a big problem, but listservs might require a different solution.

Re:Blacklists and reality

[Zan Zu from Eridu]

Censorship implies you prevent someone from speaking to the world, usually based on what they have to say.

The real goal of censorship is to prevent the world (or the targetted audience) from hearing your speech. There are different ways of achieving this goal:

1. prevent the speaker from speaking in public
2. prevent the audience from getting the message
3. prevent the message from reaching the audience

The 3rd option is most popular in modern western culture: to use the 1st option you often have to imprison or kill the speaker, to use the 2nd option you have to have farreaching (repressive) control over each individual in the audience.

Re:Blacklists and reality

[Anonymous Coward]

If an ISP blocks or alters emails (to remove virusses), it is censoring email. This censoring is done with the consent of the recipients

How many recipients really consented to this? How many people on an ISP really know that such blacklists are being used and further that such blacklists create false positives with legitimate mail. The reality is that only those who have been hit by a false positive -- either by being the sender or the recipient will realize that this kind of filtering is going on. The fact is SPEWS and similar organizations have lost their goal: filtering SPAM. SPAM is unsolicited email from which I cannot remove myself. Blacklists open ISPs up to lawsuits (ex: AOL is now being sued for their own blocking practices). If just one member wanted to receive an email that was blocked by a blacklist, you are violating their rights to receive it and censoring the sender.

There are many companies working under the original classification of consent (opt-in) which end up on SPEWS list, but yet they are not Spam. There is a difference. The reality of the situation (despite conspiracy theories otherwise) is that most opt-in and opt-out based companies honor opt-out requests. Why? Because you are more of a hassle to them on their lists than you are off of them.

Take this as an example: I used to receive on average 80 advertising emails per day on my Yahoo account. Today I receive only 2-3 per week. Why? Because I used the opt-out links. I opted-out of every ad that I could. The only emails I continue to receive are true SPAM -- lists that I didn't join and that I don't have the ability to remove myself from. The reality is that I don't like being on lists that I didn't join, but so long as I can remove myself from them, I don't mind it so much. It is only when I cannot remove myself that I truely find it more than a nucense.

And WRT SPEWS, good riddance. Is it any wonder that when you declaired 'War on Spam' that the spammers faught back? As Raymond said to SCO, when you threaten somebody's hard work and livelyhood, they will fight back. I don't agree with the use of a virus to combat the blacklist epedemic, but I don't disagree with its effects

Accept it: the internet does not exist as it did in 1990, when there was no commercial email. I was there in 1990 before all of this. It was nice to find research information from universities, but face it: so much of what exists now because of commercial entities was not there. If your goal is the decommercializing of the internet, you will fail. Besides, you would lose so much of what you have available to you now if the net was not commercial -- including Slashdot, a forum run by a for-profit commercial entity. What will reduce the volume of UCE is innovative marketers finding new ways to bring UCE to you and consolidation within the industry. The same consolidation that has always taken place when a new form of business has arrived.

Remember: Advertising makes the net as it exists today possible. UCE drives sales towards various web sites, who employ people to handle distribution, manufacturing, etc. You are not attacking just UCE, you are attacking the very foundations of the economy. You are attacking millions of jobs -- from the emailer to his client to his clients employees to the manufacturer, and so on. Yahoo, Slashdot, etc can not provide the services they provide unless they at least break even. Advertising allows them to do this without charging you.

Yes, UCE does cost money for recipients, but so does the snail-mail you receive every day despite the fact that the sender paid completely for the postage. Like with bulk email, you have to spend time sorting through it. Further, it costs society MORE because the paper that is used is then thrown into landfills (though much of it can be recycled). Unlike the hard drive space which is used for UCE, which is always recovered when the message is deleted. And despite popular belief, in UCE (as opposed to SPAM), the sender DOES pay

Re:Blacklists and reality

[Anonymous Coward]

> Encrypting/signing 1 million emails individually is much more computationally expensive than encrypting/signing 1 email. (Although it may not be enough with e.g. OpenPGP to foil spammers, it would certainly be possible to increase the computational cost of encrypting/signing to the point where it becomes impractical for spammers).

(Shrug) Depends on how many compromised broadband-connected Windows PCs you have available to you, doesn't it? With enough unknowing CPU resources there's no such thing as needing "too much" computations to be practical.

Say hello to the initial design of SoBig.G.

Re:Blacklists and reality

[Elwood P Dowd]

Most sites that use machine unreadable images for automated Turing testing (Yahoo, for example) also use machine unrecognizable audio for blind users. I don't see why this wouldn't work for email.

Iduno what blind-and-deaf folks will do. It's hard to think of a problem that could be piped to a teletype and be hard for a machine to solve while easy for a human.

Re:Blacklists and reality

[ComputerSlicer23]

Aren't you clever enough to consider the fact that the virus would wait until you have decrypted the key, and steal it? That it would hook into the prompt that requests your passphrase?

How would you run a mailing list? That mailing list would have to have a trusted private key that is decrypted in memory at all times.

If I want your private key, I'll get it if the computer is on the internet. (Okay, I can't do it, but I know the proper techniques, and know that people with the proper skills exist).

The only network that can secure a private key, is sneaker net, and that's unacceptable for something I use for e-mail.

Kirby

Re:Blacklists and reality

[ciscoguy01]

That was reported to be an additional function of the SOBIG worm from last week.
I haven't seen it confirmed yet, but it was reported.

Re:Blacklists and reality

[srmalloy]

The vast majority of spam is sent with some form of false address. Developing a way to be able to trust the origin of email is the way to end the spam crisis.

It's going to be functionally impossible to fix the problem of spammers opening an account and pumping email through it until it gets closed, but the transmission of email could be hardened by changing the SMTP protocol from 'call-up' to 'call-back'.

The SMTP protocol is set up to allow a host to contact another host and dump mail to it; there's no validation that the originating host is who it claims to be in the SMTP transaction. If you change the setup for the mail transfer connection to use the following mechanism:

1. Host A contacts host B and sends its FQDN (fully qualified domain name) and a request for a mail transfer connection
2. Host B performs a DNS lookup on the FQDN sent from host A and connects back to the host identified by the resolved FQDN. Hostnames that don't resolve, or which aren't in the FQDN form, are ignored.
3. Once the connection back to the originating site is established, the rest of the existing SMTP protocol transaction occurs. The sequence of validated hostnames would be processed into the 'Path:' mailheader, or another mailheader as determined when the protocol was updated.

This would establish a traceable chain of resolved hosts from the point at which the email entered the SMTP routing to its destination. Putting an email message into a mail transfer agent would still be vulnerable to the use of hacked or temporary accounts, but the upload would still require a trackable username and password for an account on the MTA. From that point, getting an MTA to accept an SMTP connection from a bogus host would require hacking the DNS server chain so that, when the receiving MTA host received the request, the IP address the passed hostname resolved to pointed back at the spammer's machine -- otherwise, you'd get a mail transaction sequence that looked like this:

Spam.com: Hello, [mta.com], [realhost.com] has mail to send.
Mta.com: (resolves 'realhost.com')
Mta.com: Hello, [realhost.com]; you have mail to send me.
Realhost.com: [Mta.com], I don't have any mail to send you.

Not a panacea, but it would make the mail hop path trustable until you start seeing hacked mail daemons that would mangle the mail hop path of any mail going through it -- but that would still leave the host with the hacked daemon having to identify itself, from which it could be blocked.

Re:Blacklists and reality

[Zan Zu from Eridu]

How many recipients really consented to this? ... If just one member wanted to receive an email that was blocked by a blacklist, you are violating their rights to receive it and censoring the sender.

The important thing here is contract, the formal agreement the customer has reached with the ISP. If the ISP states it reserves the right to block UCE and remove viruses from emails and the customer agrees by signing the contract, then obviously the ISP isn't doing anything wrong when it actually does block UCE or removes a virus. If this was illegal then you should also be able to sue cyberpatrol or netnanny for blocking your porn.

The reality of the situation (despite conspiracy theories otherwise) is that most opt-in and opt-out based companies honor opt-out requests. Why? Because you are more of a hassle to them on their lists than you are off of them.

That's all true for some massmailing companies, but you fail to recognize there is a lot of guys out there trying to make a quick buck. Chances are you've recieved some of their UCE: they try to sell you cds with millions of email addresses they collected themselves; or when they work for other companies their spam is unusable because it contains broken links only.

Take this as an example: I used to receive on average 80 advertising emails per day on my Yahoo account. Today I receive only 2-3 per week. Why? Because I used the opt-out links.

Then you're very lucky. I experimented with opt-out myself on a throwaway account, and initially the number of spams dropped on that account, but then it climbed out of all proportions. I guess it ended up on a spammer-cd, because I got mail in languages I can't even read.

Accept it: the internet does not exist as it did in 1990, when there was no commercial email. I was there in 1990 before all of this. It was nice to find research information from universities, but face it: so much of what exists now because of commercial entities was not there. If your goal is the decommercializing of the internet, you will fail.

The internet is most certainly not financed by commercial email. It's true it's partly financed banner-ads and in even larger part by porn, but I guess that's not the same guys trying to sell me viagra illegally. (Because you can only get viagra legally if it's perscripted to you by a doctor around where I live.)

Yahoo, Slashdot, etc can not provide the services they provide unless they at least break even. Advertising allows them to do this without charging you.

Yes, but on the other hand I never recieved UCE from slashdot or yahoo, I just watch their banners.

Re:Blacklists and reality

[Anonymous Coward]

But it isn't, unless everyone has it, and knows how to use it. When the inevitable happens, and another AOLer finds himself scammed out of his identity, AOL's gonna hear it, in court.

Re:Blacklists and reality

[schon]

The vast majority of spam is sent with some form of false address.

True.

Developing a way to be able to trust the origin of email is the way to end the spam crisis.

False, unless by "end the spam crisis", you mean "force spammers to use throw-away addresses".

Forcing spammers to use real addresses will simply cause them to use disposable addresses.

How difficult is it to get an email address? Not very. I can get a virtually unlimited number for under $10. Considering this is less than the cost of a throw-away dialup account (already in use by spammers), it won't even put a dent in the amount of spam sent.

Others who have proposed this have come back with "well, we can just blacklist them!" - OK, and how is this different than what we have right now?

Re:Blacklists and reality

[SCHecklerX]

shop online much? How are they going to send your order status, or if there is a problem, if you are dumping anything not signed to /dev/null?

Re:Blacklists and reality

[EvilAlien]

Censorship implies the lack of consent.

An entitity choosing not to receive a message is not censorship, it is the entity exercising its right to choose what it receives. You cannot cry censorship with one breath while advocating stripping any entity of its right to choose what communications it receives with the other. That is logically and ethically inconsistent.

Re:Blacklists and reality

[ZWithaPGGB]

There are a couple of problems with this:

1: Most domains have more than one MX. While the mailhost you connect to to verify may not have mail to send you, one of the other ones, or a private mailserver that is used by users but is not a gateway MX, may actually be trying to send mail to you.

2: Spammers could just use long, short lived, subdomain/host combinations. OK, you'd know what IP address the message came from, but you can generally figure that out now, and in fact, the spammer could add forged prior relay headers in front of their own anyway, just like they do now.

The only solution is a whitelist with sender authentication. The only way to do that is PKI. IE: I sign every message I send, and all recipients verify the signature, and compare my credentials to a whitelist. If I'm on it, the message gets through, if I'm not, then, depending on the recipient's policy, I'm asked to perform some verification steps, they review messages that are held for review, or they trash my message. This process COULD be made part of the SMTP exchange, as in I send a signed response to a challenge phrase that veifies who I am, but that would probably be too much work for the servers.

Re:Blacklists and reality

[aztracker1]

I was thinking, what would be nice is a little script that checks the profile of a yahoo, or msn/hotmail user, or the aol hometown page for aol users, and if certain pieces of information aren't available, reject the message.

Also, confirming that for non-null return paths, that the address actually exists.. and requiring that messages with a null return path have a valid "from" address, or contain "undeliverable" ... *AND* have the TO: address in a nested mail, or quoted mail for the original message.. junking it otherwise..

Re:Blacklists and reality

[icebike]

BZZZZT, Wrong, but thanks for playing...

Any functionality solely in the hands of the
sender does nothing to create trusted mailers.

In 5 minutes I can set up a bogus one-time pgp sig and send you spam that you could positivly prove came from bogus-Me.

SMTP is broke and needs to be fixed.
MTAs need to insert traceable headers that are standardized so as to be traceable by automated means.

MTAs need to be sure they could reply to the envelop sender if they needed to, and that reply
would go back to the machine attempting to send.
This alone would keep SoBig from spamming the net, by allowing the first receiving MTA to verify that they could send an email back to the sender before accepting any mail.

Bogus or contrived headers need to be detected
and mail rejected till fixed.

Re:Blacklists and reality

[Kris_J]

Regarding the comments from the two mailing list operators. If a user has requested that they be added to your mailing list they should automatically whitelist you themselves. Forcing someone you've just explicitly requested email from to jump through such hoops is not a failure of the technology, it's a fault between keyboard and chair.

Re:Blacklists and reality

[Ironica]

However, public and private keys will suddenly become tokens of value to spammers. Suddenly people will start creating worms, and scripted attacks to pull peoples keys. They will start trying to break into machines. It'll create a black market for trusted keys the world over. They'll just be new attacks, and new problems. Creating a large scale web of trust, won't work. A worm can easily go steal the tokens of trust, and then start using them to spam with. It'll just be another arms race.

It will be a lot like the business of selling addresses for junk snail-mail. Not terribly difficult to get, but somewhat resource-consuming. It will up the ante for those who want to send spam, and will turn a lot of those lists of 30 million recipients to the 30,000 or so they could get more easily. It wouldn't eradicate spam, but it would lower the rate of return by a whole lot to clutter your list with tons of people who don't want your ad. That would really, really help.

Now letting forcing people to sign with your key is probably the most doable, but it also means that running mailing list software is a real, real CPU intensive application. I'm not particularly thrilled with that.

Er, why? Are you trying to send thousands and millions of e-mails a day? It would mean that legitimate businesses with a lot of email to send, such as reputable online shopping sites, would probably have to buy another couple of dedicated servers for the task. It would be an expense, but not an ongoing one, and one that is theoretically proportional to your profits. It would price some people right out of the mass-mail game, though... the people who right now can afford to send 10,000 emails for every one order they get.

The only way to stop spam is to make it stop being cost effective, that involves causing e-mail to be an expensive operation if it involves untrusted e-mail servers.

Never mind, I shouldn't have bothered... you answered your own objection.

Re:Blacklists and reality

[lpontiac]

In 5 minutes I can set up a bogus one-time pgp sig and send you spam that you could positivly prove came from bogus-Me.

You're missing my point .. grandparent post was yet another if we just adjust the protocol so we can authenticate senders rant, and I'm saying the technology is already there. I mentioned S/MIME for a reason - there are CAs who will, today, give you a certificate if and only if you can prove who you are. It's conceivable that a central trusted authority could do the same with signing PGP certificatess.

I left unsaid that you'd need widespread use for it to become useful. While that's true, it's no more true of existing technologies than the magical way of authenticating senders that the original poster wanted invented.

Re:Blacklists and reality

[Kris_J]

We're just saying you're an arsehole if you adopt a scheme that deliberately makes it difficult for blind people (or other similar groups), especially when there are legitimate alternatives.

What legitimate alternatives? Do you have the solution to spam that none of us have thought of?

Fine, a challenge-response system that has the choice of either a machine unreadble image or a machine un-whateverable audio clip (eg; numbers recorded in noisy environments).

But what about all the blind deaf people that use email..?

Re:Blacklists and reality

[ComputerSlicer23]

I care mainly because I subscribe a lot of mailings lists that aren't funded by major money holders. In a perfect world, I can subscribe to a list that has 200 Million people on it, that isn't funded by a fortune 500 company, or a world gov't.

A lot of lists could then use this as a reason to charge for a subscription. Say BugTracker, or the LKML, or any number of other high volume lists, that have an huge number of subscribers who merely lurk. merely lurk on a number of lists to read interesting material periodically. I try and read the lists from a lot of different projects I am interested in.

I suppose this could re-invigorate the Email to Usenet Gateways (where the group is moderated only things that are sent on e-mail are allowed to post).

In the end, I'd like a solution that means running a large mailing list is cheap, but running a spam house is expensive. Essentially a large mailing list is a very small spammer. A lot of lists are run out the goodness of someones heart. However, nearly all mailing lists opt in, not opt out.

I'd like to create a way for it to be cheap for companies to send lots of e-mail. If I want their e-mail, I want it to be cheap to get it to me. Then the cost won't be passed onto me as a consumer. E-mail is a very efficient way to get the word out, and is a cheap way to do business. I think lower the cost of business is good. (In that sense spammers have the right idea).

Kirby

Re:Blacklists and reality

[Anonymous Coward]

>That only works if I require them to sign mail they send to me, with my public key

Actually that will only work if someone develops an easy to use interface for dealing with keys in their email client.

For this to work someone will need to enable joe shmoe to deal with these keys as easily as clicking a button. Otherwise it will be a support nightmare.

I am a programmer and it took me a good week of futzing in my spare time to get this stuff to work, and find someone else who actually uses it. It is so much of a pain to use that I decided not to sign messages anymore.

The gain isn't there until large scale adoption of the technology is made by all email server admins, and it is made 'click of a button' easy to use.

Hmmm, maybe I will start building the http driven key distribution system tonight...

I bet it will be a hit...

l8,
AC

Re:Blacklists and reality

[Zan Zu from Eridu]

An entitity choosing not to receive a message is not censorship, it is the entity exercising its right to choose what it receives.

Technically speaking, consent is not an issue. If a receiving entity R appoints an entity C to filter or delete messages from sending entities Ss based on content or origin, entity C is censoring information from entities Ss.

You cannot cry censorship with one breath while advocating stripping any entity of its right to choose what communications it receives with the other. That is logically and ethically inconsistent.

But I don't advocate that at all. What I'm implying is that sensorship isn't always a bad thing, and free speech is not always a good thing. One could judge this morally flawed (depending on ones personal morals), but it certainly has sound logic and is ethically consistent: If you consider some kind of speech (like inciting a hate crime) to be intolerable, you're not finished by punishing people who publicly produce such speech; you must also censor the media or you (and the media) are helping to spread an intolerable message. Consent of the public is implied here by putting those limitations to free speech in to law.

Spam is not (yet) illegal and could perhaps be free speech, but I do think it should be the right of the public to not receive spam by appointing a censor, so they don't have to filter and throw away the junk themselves. Confusing? I don't think so.

Re:Blacklists and reality

[ComputerSlicer23]

Sorry if I wasn't clear. You aren't using your private key to send me e-mail. You are using my public key to sign the e-mail. In the system I describe, there are no secrets. Anything that is a secret, that gets you onto the "in" list will just create a black market.

I'd like to get to a point in life, where SPAM is economically infeasible. Right now, spam costs money, time and effort. Right now, paying a person to follow me around telling me about your wonderful products all day is economically infeasible. I'd like SPAM to be roughly in that same category. I want to stop SPAM, because it's incredibly inefficient waste of my time for the benefit of the spammer. I'd like to encourage them to come up with a different way to make a living.

That is my proposed filter. I'll still accept e-mail that isn't signed, but it'll get dumped in my high probability spam folder. You'll white list straight to my Inbox if you sign it with a key on a list of keys I trust in my procmailrc/e-mail client. The first time you send an unsigned e-mail, I'll personally write you an e-mail explaining the situation if getting email from you in a timely manner is important (no I won't use a crappy auto-repsonder).

Eventually, the hope is to bootstrap to a point where all legitimate e-mail clients automatically sign with a public key I make available on the MIT PGP server (or via the SMTP protocol on the other end). Heck that the sending SMTP server automatically signs it for you at the server (so that legit ISP's could just do it for you, if your client doesn't).

Mailing list software could just auto-sign with a private key that cooresponds to the public key they distribute to add to your trusted key list.

It'll take years of time to get into full use, but early adopters who communicate with other early adopters, and a couple of ISP's who offer mail service that will do this, would have a great deal of appeal. Once the software is available, I'd easily pay $10 a month to an ISP that would do the auto-signatures of e-mails. Even if it was an e-mail only account (not IP connectivity, just mail service). I'd happily pay for it, knowing that it was an investment in creating a final solution for e-mail.

If that e-mail provider also added Baysian filtering, and offered the CPU power to do the signatures with off the shelf clients. I'd be up for it.

That will make e-mail still be an option for targetted marketing (which I've got a lot fewer problems with then SPAM). Eventually, just black listing e-mail servers that allow non-signed, or mis-signed messages will solve the problem and have it expire in 48 hours. No bandwidth wasted (other then once every 48 hours), and no more of my time playing games categorizing mail, as spam or not. It's completely automated, it leverages economics to ensure that nobody wastes my time because wasting my time is a cheap thing for them to do.

Kirby

Re:Blacklists and reality

[r5t8i6y3]

whitelists are problematic in the same way that the Welchia/Nachi "anti-blaster worm" worm is problematic. consumption of too much bandwidth replying to all the spam for a confirmation in case it's a legitimate human.

Re:Blacklists and reality

[Vitus Wagner]

I disagree; that's like saying I need to desalinate the water in the ocean; it's an impossibly hard task.

There are so much people you trust? Or they are so hard to educate? In both cases only thing you have to do - to choose ones you trust more carefully.

While I'm not a big believer in "technical solutions to social problems,

Educationg is social solution,

Yhe first, biggest problem is that we can't reliably trace messages back to their source,


It seems that you have first to educate yourself.

There is reliable way to trace originating host using Recieved lines. Only thing we need is universal internatinal law which would punish spammers with big fines. So owner of computer shown last in the Recieved line would either have to pay or to prove (via logs) that he is not responsible for this particular spam.

I.e if spam comes from dialup IP range provider would have either to pay fines himself or to disclose who of his clients have used this IP at given time.

This poses minimal penalty for people with open relays - they only have to give evidence of origin of spam message (but it is enough to force them to fix this setup), but held owners of computers, infected by virii and worms responsible.

And I think this is correct.

Re:Blacklists and reality

[Anonymous Coward]

Its good when spews is shut down,i hope its not comming up again. I think Spews is a modern form of Terrorism (CyberTerrorism). Spews blocks not only spam, it blocks also mails from normal server, because they are in the same subnet. The reason, they hope the Customers will force the Provider to stop hosting spam.... Its like Terrorism "Hurting innocents for reaching their goals".... Ill Think its the wrong way. Ill think there much better ways to stoping spam,like spamassasin. The best solution would be a new law,stopping spam

Re:Blacklists and reality

[srmalloy]

1: Most domains have more than one MX. While the mailhost you connect to to verify may not have mail to send you, one of the other ones, or a private mailserver that is used by users but is not a gateway MX, may actually be trying to send mail to you.

The host that is trying to send mail is the host that gets verified; if there is a private mailserver trying to send mail out, it would need to have a resolvable hostname for the receiving mail server to use to connect back to it to fetch the mail it has.

2: Spammers could just use long, short lived, subdomain/host combinations. OK, you'd know what IP address the message came from, but you can generally figure that out now, and in fact, the spammer could add forged prior relay headers in front of their own anyway, just like they do now.

While a spammer could set up a complete system as a mailhost, it would still need to have a registered FQDN in order to be a valid mail forwarding host. What I proposed eliminates the problem of J. Random Spamhost connecting to a mailhost, claiming to be, say, mail.yahoo.com, and dumping several hundred thousand mail messages onto the Net; there still will have to be some verification process to keep the backtrail through prior systems from being forged.

Re:Blacklists and reality

[ComputerSlicer23]

Make it part of the e-mail servers job, if the mail isn't signed, then sign it. If it is signed, whoopie, just send it.

Re:Blacklists and reality

[ninewands]

Quoth the poster:

Sorry if I wasn't clear. You aren't using your private key to send me e-mail. You are using my public key to sign the e-mail. In the system I describe, there are no secrets. Anything that is a secret, that gets you onto the "in" list will just create a black market.

Actually, I want incoming mail signed with the sender's private key so I KNOW who sent it. I can then trash everything that I can't verify from my "public key ring". Anyone can obtain my public key from the keyservers it's on ... but only those having private keys that correspond to a public key on my ring can send me mail without getting filtered. Simple as that.

As for new legitimate correspondents, well, unidentifiable mail can go into a folder labelled "Unverified" ... I can check the contents of that folder for false positives and pull the appropriate public key for the new correspondent from the keyserver.

Simple system, no challenge/response test ... and impenetrable by spammers.

Re:Blacklists and reality

[ComputerSlicer23]

It's easy to penetrate as a spammer. Having secrets will create a black market, end of story. Look at identity theft. Look at Credit card fraud. Look at any number of computer security problems. The next worm that comes along will hook into your Mom's e-mail client, wait until she sends an e-mail so her private key is decrypted, then the worm forwards that home. Lets say they get 1000 of them out of a worm. The worm phones home, and removes itself everytime that happens, and stops spreading. Now they have a worm they can release anytime they want to send 1000 spams. They spam until the key gets revoked.

Your Mom is now officially classified as a spammer. Congratulations.

Insert my Mom, if that makes the story less offensive. In your situation, you assume that there is perfect security, and that everyone you trust (via your key ring), and all of theISP's they use perfect security. That's simply not the case. I don't want to have to trust them. Things I sign with my private key, get signed after being sneaker net'ed to a machine that has never been connected to a network. Not even an internal only network. Then I can be very, very sure my private key has never been compromised.

Plus how many people will get tricked out of their public key. Just send mail your e-mail address, and this file off of your machine, and I'll send you $500? Getting into the web of trust isn't that hard. Just go to public key signing events. Everyone will sign your key, and your on the web of trust. Everytime your key gets broken, find another set of people to sign them. Wow, there you are back on the web of trust. Goodie...

Plus your system requires work on behalf of the mail client, and the mail user. Technically, mine could easily be implemented in the SMTP protocol, and my ISP does it for me. (You could also do at the client if your client supported). If you wanted to prove you aren't spam friendly, don't allow non-signed e-mail off your network.

In my system, I don't need to trust anybody. I don't need to secure anything. I can leave the public key in the clear, with no passphrase. Technically speaking it doesn't need to be private at all. I could post both keys to the world, and I couldn't care less (obviously, I wouldn't use that key as my sigature to prove I wrote it then, I'd only use it to verify that you did the work I requested to read the e-mail).

Kirby

Re:Blacklists and reality

[nacturation]

I think the theory is that a government is supposed to represent all of the people, so therefore all of the people are supposed to have an equal voice (yeah, there's theory and reality and never the twain, yada yada).

The quote you might be looking for is:

In theory, there is no difference between theory and practice. In practice, there is.

Re:Blacklists and reality

[squiggleslash]

Do you have the solution to spam that none of us have thought of?

Does it need to be something you haven't thought of for you to consider it?

I mean, I do indeed have a solution to spam. It's not exactly original (though when I first started doing it 5 years or so ago, it was something I thought of independently), it's 100% solid with no false positives.

I forget the name of the Sourceforge project to set up an automated version of the same thing, but the description of my implementation is in my journal. If I had a website, I'd use a CGI to deliver email rather than put up an email address, and business cards would have a trackable address for each card, if they had an email address at all.

I don't know why you think legitimate alternatives do not exist. It suggests, to me, that you're so enamoured of a particular "solution" and the technology behind it that you're unable to even think about the actual problem. It's the geek with the talking frog yet again.

Re:Blacklists and reality

[Anonymous Coward]

You said:
Spam.com: Hello, [mta.com], [realhost.com] has mail to send.
Mta.com: (resolves 'realhost.com')
Mta.com: Hello, [realhost.com]; you have mail to send me.
Realhost.com: [Mta.com], I don't have any mail to send you.
Not a panacea, but it would make the mail hop path trustable until you start seeing hacked mail daemons that would mangle the mail hop path of any mail going through it -- but that would still leave the host with the hacked daemon having to identify itself, from which it could be blocked."

The problem is that tracing the spams back to the open relay or actual server it came from isn't necessarily the problem. Yes, most is forged, the "From" address is meaningless, but lot's on perfectly legit email uses other sending domains too so that's not it. The problem is that there's always some ISP willing to harbor the spammer's pages or drop box while they abuse some other network to actually send the crap.

You want to end the spam? Null route the ISPs who harbor the scumbags. They can always find an insecure computer or pay some Bozoo in Korea to leave a relay open to send it. You will never stop the spammers from being able to send the garbage. But the decent ISPs can certianly stop peering with those who participate in the abuse by harboring the spammers.

William R. James

Re:Blacklists and reality

[johnpettigrew]

Viruses - yes, a clever one could steal private-key passphrases, But if you're virus-protected and firewalled, it would find it hard to tell anyone about it. In any case, this is not a fatal objection because (if it was that easy) it would already be being done on a huge scale with credit-card details. And, sure, it does happen, but it's not common - and with far greater incentive than stealing keys would have.

Mailing lists - not a problem, because the posters sign their emails, not the list. The list isn't the originator of the post and so doesn't sign it.

John

Re:Blacklists and reality

[ComputerSlicer23]

First, CC info is pretty hard to steal via e-mail. It's hard to know when someone types it into an e-mail (In my 8 years online, I've never put CC info into an e-mail ever). I've seen or heard of a number of scams that try and get you to enter in passwords to your bank at a false front site, by using a confusing link or by DNS posioning. I've seen ones that try and get you buy from Amazon look alikes. It's not that hard. When you take away the money supply from spammers some of them are going to get desperate. They'll do crazy stuff, clearly they lack anything that resembles ethics or morals that are in line with mine.

Second, Mailing lists are a problem. Mailing lists alter the message (they alter important headers that you want authenticated, and they normally change the subject line and/or alter the header/footer to tell you how to unsubscribe from them. That won't just pass thru a signature check. Otherwise as a spammer, I just take a known good message signed message I received then put my spam before or after it like a header or footer. So the mailing list will in fact have to sign it for me to authenticate it.

Kirby

Re:Blacklists and reality

[ComputerSlicer23]

Oh, and your still assuming, that everyone has perfect security. That just isn't a fact. I might be willing to tolerate a system where when my security is broken, I have to deal with spam. I'm unwilling to accept a spam solution where I have to trust the security of the internet at large. I've been around that block before, as a general rule people will in fact have piss poor security. I accept this fact. I want to account for it in a spam solution.

The only solution to spam is to make it economically infeasible for the spammer to do untargetted messages. You won't every stop them by making hoops they have to jump thru, they will find a way to defeat the defense. Make it so they can't make a living doing it any more, and it should stop.

Kirby

Re:Blacklists and reality

[Anonymous Coward]

Fuckin troll.

Re:Blacklists and reality

[Anonymous Coward]

White lists work.

On a small scale, using the filtering system in my email client, any message from someone not in my address book is dropped into the trash. You can add a quick eye-scan of the senders in the trash once a week and add legit addresses to the address book.

In a business, block all mail except for those (white listed ones) specifically requested by your employees. This keeps businesses on business. Do the same for the Web. Block everything but need-to-know sites, requested by employees. No hotmail, yahoo, et al. Let the employees request the sites and get out without IT involvement. But monitor who requests what. It is perfectly okay, polite and legal for a business to censor content.

Of course, if a profitable percentage of people did not respond to the ads, spam would go away today.

Well, fine, but...

[Pig Hogger]

Well, this is fine, but why doesn't Joe Jared tels us HIMSELF to stop using his lists???

The non-communication only breeds rumours.

Re:Well, fine, but...

[Anonymous Coward]

You wouldn't receive the email. Duh.

Re:Well, fine, but...

[Anonymous Coward]

what the hell do you think a "*" entry to 127.0.0.2 for all zones, that reports "Please stop using relays.osirusoft.com" means?

Re:Well, fine, but...

[gorbachev]

He did, several weeks ago.

Re:Well, fine, but...

[bigberk]

He does tell us. There is a new TXT record that has been inserted by the owner of the DNS site, and it carries his message in plain English:

$ host -t TXT IP.relays.osirusoft.com
IP.relays.osirusoft.com text "Please stop using relays.osirusoft.com"

Re:Well, fine, but...

[lrucker]

Well, he could send out a mass email to everyone who's ever used his lists...

Re:Well, fine, but...

[muirhead]

I think you've forgotten to include the tags in you comment.

Re:Well, fine, but...

[Anonymous Coward]

Flaggin' DHTML weenies. Time to get back into real code, you're getting grumpy.

Re:Well, fine, but...

[wkcole]

"He did, several weeks ago." Can you cite something public to support that? I can't find a post from Joe in any of the public fora focused on spam for months. I suppose one could consider the increasingly poor availability of DNS under osirusoft.com a message of some sort, but it surely wasn't a very clear one. (Note that I do not use Joe's DNSBL and have not and would argue that Joe Jared has been making DNSBL's look bad for a long time. )

ouch!

[Anonymous Coward]

long live whitelisting

Sweet, Sweet Justice.

[eyez]

This isn't any different from any time spews blacklists anybody; They've never claimed to not blacklist legitimate people. And, it's impossible to contact spews to get yourself removed if unfairly blacklisted. Everyone in the world, who has been blacklisted unfairly by spews is now celebrating. Hopefully now, people using spews will realize that spews really is a poor solution to the problem, that causes more harm than it prevents.

Re:Sweet, Sweet Justice.

[paitre]

Collateral damage, as much as I detest it and is why I do all blocks locally as opposed to using a "published" DNSBL, -works-.
If an ISP has 5000 customers and 3/4 of them are unable to email family at AOL or Yahoo because they're being blocked due to ISP having a spammer or two, the spammers tend to get dropped.
There are exceptions to this, but by and large, collateral damage works.

And like I said, I think it's piss poor policy.

Re:Sweet, Sweet Justice.

[gid]

spews listens to usenet for unblock requests, my work's class c was black listed when we got it. I had to post to usenet, eventually I got a response and was unblocked, but ya, it's kind of a pain. I think spam assassin/filtering is a much better method, but I suppose a dual pronged attack is better, SA can use blacklists to rate email as well I think....

Re:Sweet, Sweet Justice.

[eyez]

[i]If an ISP has 5000 customers and 3/4 of them are unable to email family at AOL or Yahoo because they're being blocked due to ISP having a spammer or two, the spammers tend to get dropped.[/i]

Yes, this is indeed a poor policy. SPEWS exists so that the people who are violently against spam can pass the burden of fighting it onto the innocents who aren't as bothered by it.

Re:Sweet, Sweet Justice.

[Acidic_Diarrhea]

I believe the point the grandparent was alluding to was the fact that once on a blacklist, there is no way to get a domain off a blacklist. So an ISP would root out the spammers and not allow them as customers any longer but then you're still left with a situation where 3/4 of the customers can't contact family at AOL or Yahoo. Blacklists work but, thus far as an implementation, the colleteral damage cannot be corrected.

Re:Sweet, Sweet Justice.

[Daniel_Staal]

No, it is different. This one is shutting down, and this is how the operator is making sure that everyone knows it is no longer functional.

It is a public service, of sorts. He is guaranteeing that no one is using the blacklist. That way it can't be misused by someone hijacking it, or just left in place by someone who doesn't care. It is shut down. And everyone will know it.

Re:Sweet, Sweet Justice.

[mungtor]

SPEWS exists so that the people who are violently against spam can pass the burden of fighting it onto the innocents who aren't as bothered by it.

amazingly succinct. If I had mod points, they'd be yours.

Re:Sweet, Sweet Justice.

[Felinoid]

Thats not helpful to people who don't know they can be reached by usenet (a very strange way to make contact with a single entity you must admit) and even worse for anyone who dosen't know what usenet is.

Re:Sweet, Sweet Justice.

[steeviant]

Amen to that, Joe Jared is an egomanical cowboy who manipulated the blacklists for personal reasons, goodbye to him and his invitation-only approach to e-mail.

Re:Sweet, Sweet Justice.

[Mr Bill]

And how is this a responsible way of alerting people they should stop using the blacklist???? Anyone using there blacklist will automatically start bouncing all incoming mail based on the fact that every mail server is listed in the blacklist...

This means even more legitimate mail is being bounced or dropped than normally is by mail servers stupid enough to use SPEWS. SPEWS sucks and needs to disappear.

Although I don't agree with the tactics of a DDos, I am happy they are getting a taste of their own medicine.

SPEWS is all about getting other people to fight their battles for them. The are a bunch of fanatics that don't care who they stomp on and anyone who trusts their services should have their head examined.

Good riddance...

Re:Sweet, Sweet Justice.

[Anonymous Coward]

getting 0wn3d is funny!

epilepsy, sweet music, bush, cheney, lieberman, and some other d00d dancing, and some other d00d shaking hands with the k00l-aid mascot! what else could you want?!

Re:Sweet, Sweet Justice.

[doorbot.com]

He is guaranteeing that no one is using the blacklist. That way it can't be misused by someone hijacking it, or just left in place by someone who doesn't care.

Actually that was exactly what I thought happend when I dealt with my Sendmail servers this morning.

For a few minutes, I entertained the idea that the original owner had let the domain expire accidentally, and a spammer who had been blacklisted by Osirusoft sniped the domain, quickly setting up a DNSBL list to cause problems for everyone who used Osirosft. Thus admins everywhere remove Osirusoft from their DNSBLs and said spammer is (hopefully) free to spew their message without fear of blacklisting.

Clearly, there would be flaws in this spammers' plan (I use multiple DNSBLs), but that wouldn't be the first time spammers didn't think something all the way through. ;)

Re:Sweet, Sweet Justice.

[eyez]

Thats not helpful to people who don't know they can be reached by usenet (a very strange way to make contact with a single entity you must admit) and even worse for anyone who dosen't know what usenet is.

It's pretty much not useful to anybody. Thing is, if anyone on your network has even looked at a spammer in real life, your isp is considered guilty, as charged, and you stay blacklisted under spews. And if that ever happens, you basically can't get unblocked. you can probably get the listing lowered to one that a lot less people use, but you're permanently marked as a spammer, or a stooge of a spammer, or something.

Re:Sweet, Sweet Justice.

[josh crawley]

First they blacklisted the porno spammers... ...and I emailed nobody, for I was not a porno spammer.
Then they blacklisted the open relays... ...and I emailed nobody, for I was not an open relay.
Then they blacklisted the ISP dialup subnets.... ...and I emailed nobody, for I was not on an ISP dialup subnet.
Then they blacklisted everyone... ...and there was nobody left for me to email.

Re:Sweet, Sweet Justice.

[Skapare]

Spews was an excellent solution. It wasn't perfect and a few mistakes were made. The fact that the real operators had to remain secret due to all the lawsuit threats did make it difficult to provide feedback to make corrections. I predict SPEWS will be back, but in a different form, possibly as a distributed file of sites to block ... which will make it even harder to get removed since it will then not be operating as a live database.

Much of the problem was because a lot of people didn't understand that the purpose of SPEWS went beyond just blocking spammers (which will not accomplish stopping spam), but actually blocking the ISPs that allow spammers to continue to operate and continue steal resources from networks and mail servers. This was in effect a boycott of that ISP, and it was intended to drive customers from that ISP to other ISPs that do not harbor spammers. In many ways it was working because it clearly got a lot of spammers upset, and a lot of ISPs upset as well. I even believe it is possible that the DDoS attack on OSIRUSOFT was caused by many of these ISPs.

My question to you is, did you understand that SPEWS was blocking whole ISPs, not just spammers? You don't have to agree with that method or principle ... just understand that others do think it is right, and understand why they do.

Re:Sweet, Sweet Justice.

[BJH]

Small correction: "...the innocents who don't know they're bothered by it".

Strange as it may seem, spam damages everyone who uses email. It costs ISPs more in storage and bandwidth, which gets passed onto the enduser. It slows down legitimate email. It makes it harder for "innocents" to determine which mail is geniune and which is not.

Face it. Spam is bad for everybody, whether they know it or not.

(And don't even get me started on worms. I've got over 100MB of crap from SoBig.F so far.)

Re:Sweet, Sweet Justice.

[eaolson]

Yes, this is indeed a poor policy. SPEWS exists so that the people who are violently against spam can pass the burden of fighting it onto the innocents who aren't as bothered by it.

No, SPEWS exists so that the people who are violently against spam can pass the burden of fighting it onto the people who are responsible for causing it, i.e. spam-friendly ISPs.

The fact that "innocents" are caught up in the block is unfortunate, but unavoidable from a practical standpoint. SPEWS doesn't list netblocks because they have a spammer or two present. SPEWS lists netblocks because the ISP knowingly and willfully hosts spammers even after they have been notified about them. Once the spammers go, the listing goes. Usually quite rapidly.

Re:Sweet, Sweet Justice.

[Jeff DeMaagd]

I too would suggest using such lists as just another point of reference for statistics and not block solely because the ISP is on the list.

Re:Sweet, Sweet Justice.

[eyez]

Small correction: "...the innocents who don't know they're bothered by it".

Strange as it may seem, spam damages everyone who uses email. It costs ISPs more in storage and bandwidth, which gets passed onto the enduser. It slows down legitimate email. It makes it harder for "innocents" to determine which mail is geniune and which is not.

Face it. Spam is bad for everybody, whether they know it or not.

Not everyone. I run my own email, I don't broadcast my mail addresses all over the internet, and I use some simple filtering to knock it down to the point where I get less spam than I get junk email in my physical mailbox most days.

There are people who can get over having to hit "D" in their email clients a few times a day. Email advertising is a natural side effect of being on the internet, and it's not so bad if you're smart about it.

I certainly don't feel as hurt by it as everyone else seems to be. Maybe there's something wrong with me, but it certailnly doesn't seem that way to me.

Re:Sweet, Sweet Justice.

[Mr Bill]

Here again is another move that shows how responsible these idiots really are. To notify people to stop using their blacklist, they decide to blacklist the world. What a brilliant idea. After all email isn't really that important.

Email used to be one of the most reliable means of communicating on the net. You were always guaranteed that your message would either arrive, or you would hear about it (bounce). But with all of the email worms Microsoft has written (you have to admit these email worms/viruses practically write themselves), and the idiotic attempts at stopping the SPAM problem, email is becoming practically useless. mail admins are using blacklists and just dropping mail, which is effectively breaking the mail system. SPAMers may be the cause, but what is the point in destroying email all together. I would rather receive 100 SPAMs a day that loose one legitimate email that was intended for me. Sort of the same reason I am against the death penalty.

As blacklists go, SPEWS is the worst of them. They block entire netblocks so that innocent bystanders will fight their fight for them. If my IP gets blocked even though I haven't sent any SPAM, I am expected to bitch to my ISP and/or move to another ISP, and then maybe in a couple of months my IP might get removed from the list.

Reminds me of the way things work in the middle east. Pick either side, and they are using the same tactics. The Palestinians are blowing up civilians in the hope that the civilians left alive will do something about their problems. And the Israelli government is firing missiles into crowded cities to kill some suspected criminals and anyone else who happens to be within 100 meters of these guys...

Guerilla tactics like SPEWS employ won't work in the long run, and I am happy that SPEWS is getting hit hard.

SPEWS is claiming that the SPAMers are hitting them with this DDos, but I wouldn't be surpirsed if it was some disgruntled and innocent bystanders who were hit by the SPEWS "Collateral Damage" misile.

Re:Sweet, Sweet Justice.

[BJH]

Filtering doesn't help the ISP - the spammer has already done his job by the time his crap has hit your filter.

I love these people who assume that the problem can be solved if everybody would just get used to 'using their D key', as you put it.

Re:Sweet, Sweet Justice.

[eyez]

No, SPEWS exists so that the people who are violently against spam can pass the burden of fighting it onto the people who are responsible for causing it, i.e. spam-friendly ISPs.

The fact that "innocents" are caught up in the block is unfortunate, but unavoidable from a practical standpoint. SPEWS doesn't list netblocks because they have a spammer or two present.

Idiotic rambling like this is exactly why spews was accepted at all in the first place.

When you post on NANAE and say "Help, i've been blacklisted but my company has nothing to do with spam!", Everyone replies with "Sorry, SPEWS is run by mighty space robots from the future who have travelled back in time to stop it SPAM from destroying the world. Unfortunately, we have no way of contacting them. Your only hope is to talk your isp into kicking off their spammer clients, or change isp's. Maybe the robots will unblacklist you then."

SPEWS doesn't consider the innocents being caught up as unfortunate, they consider them the target. The collateral damage is where they're trying to affect the internet.

If it was about blocking spam and ISP's they'd strategically blacklist ISP-critical machines and the spammers. There's no reason to blacklist the innocents. ISP's won't listen to them about not hosting spammers, and have you tried to find good decent hosting that doesn't rip you off? Especially if you're a larger site.

The "Collateral Damage" is the main damage spews hopes to cause, to try to get innocent people to fight their battles for them.

Re:Sweet, Sweet Justice.

[SirFozzie]

You are an idiot.

Mail Admins are tired of seeing spammers try million plus dictionary attacks.

1 spam email=little bandwidth.

HUNDREDS OF THOUSANDS of spam emails, OVER AND OVEr.. consumes bandwidth, cleanup AND has been known to knock machines off line from the sheer amount of crap.

You try running a mail server, even at a small ISP, and see how much crap you have to deal with.

Re:Sweet, Sweet Justice.

[Kishar]

You have a strange notion of responsibility.

The party responsible for causing the spam problem are the spammers. SPEWS lists netblocks instead of ISPs for the exact same reason that spammers spam: cost shifting. The spammers shift the cost of advertising to the recipient; and SPEWS shifts the cost of the anti-spam battle to the ISP.

Re:Sweet, Sweet Justice.

[Mr Bill]

Blacklisting at the mail server doesn't help the end user - their legitimate emails have already been dropped.

I love these people who assume that the problem can be solved if all ISPs just used blacklists like SPEWS.

Re:Sweet, Sweet Justice.

[Kishar]

The "Collateral Damage" is the main damage spews hopes to cause, to try to get innocent people to fight their battles for them.

Nail. Hammer. Head.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

Amen. I was blacklisted by Spamcop once, because of some asshat who signed up for my newsletter, then turned around and reported the next three issues to Spamcop. One person reporting 3 newsletters got my IP blacklisted.

It took 2 days of threatening them with a lawsuit and being flamed by the trolls in their newsgroup before an administrator looked at the spam reports and saw they were bullshit. It was delisted on the spot.

As bad as that was, at least they were willing to remove a bad listing. SPEWS did that shit on purpose. And the attitude was unbelievably stupid.

"If your web host is listed, find another host".

That's complete bullshit. Web hosts and ISPs cost fucking money, and so do contracts, especially when you terminate them early.

If you want to ban a spammer's IP, then do so. Don't block 5,000 legitimate web site owners because of one dickhead. It just makes you the bigger dickhead.

Re:Sweet, Sweet Justice.

[BJH]

If it's a choice between your users and my bandwidth, I'll take my bandwidth, thank you very much.

Re:Sweet, Sweet Justice.

[JoeBuck]

It only works as long as the blacklist provider has credibility (that is, that ISPs believe that the provider is being responsible), and SPEWS has long since blown theirs.

Re:Sweet, Sweet Justice.

[eyez]

HUNDREDS OF THOUSANDS of spam emails, OVER AND OVEr.. consumes bandwidth, cleanup AND has been known to knock machines off line from the sheer amount of crap.

You try running a mail server, even at a small ISP, and see how much crap you have to deal with.

I've done it. My point is that while blacklisting can have it's uses, there's two big problems with spews:

a) They blacklist people specifically to cause harm.
b) USING ANY BLACKLIST AS A CATCHALL IS STUPID. Nobody should be doing this, and anybody who is should be fired for incompetence. It takes more than 'Some group of people who have nothing to do with us have decided that there's a small chance that this could be spam' to efficiently block spam.

SpamAssassin seems to have this down; give everything a score, and if it has a high enough score, then you can block it. But trusting a single source whose purpose is to hurt spam rather than to efficiently block it and only it, and using that as a sole source, like so so so so so many people do, is just plain fucking idiotic.

Re:Sweet, Sweet Justice.

[SirFozzie]

in response to

A) they're doing it more to get rid of the person creating harm at that ISP (the spammer). If just the spammer space was blacklisted, what does the ISP care? they can either let them spew at the 80% of the world that doesn't use SPEWS or whatever, or at the spammer's demand, move them around. give the spam-supporting ISP a choice. Play nice with the rest of the net (what the Internet was built upon), or get your email blocked. Email is not a right.

B) I use it. I love it. As I said. I'm tired of pink contracts, and folks hijacking relays, and now writing fscking VIRUSES to create new ways to spam (look into the discussion on that issue)

SpamAssassin is great, except one thing.. you have to receive the whole body. (and thus spend the computing cycles and bandwidth to acquire it and to check it). In this case, the ISP gets stopped after the first HELO (IIRC) and much less bandwidth is consumes.

Re:Sweet, Sweet Justice.

[SirFozzie]

don't blame Joe Jared. Blame the fucknuts who are DDoS'ing him off the face of the planet.

Public blacklists were tried.. and they were harassed, death threated and sued into oblivion.

Semi-Private Blacklists like Osirussoft has been tried. It hurts the spammers so much that they write viruses specifically to get around it and try to DDoS it off the net.

You won't like the next step.

What's coming will make SPEWS look like responsible.

Remember Pandora's Box? I sure do.

Re:Sweet, Sweet Justice.

[Dimensio]

SPEWS exists so that the people who are violently against spam can pass the burden of fighting it onto the innocents who aren't as bothered by it.

SPEWS exists so that admins who don't want e-mail from crime-ridden ISPs can reject it as they see fit.

SPEWS does not force anyone to use their lists for filtering. If you don't like SPEWS, don't use it to filter your mail.

Re:Sweet, Sweet Justice.

[Have Blue]

You know, when you put it that way, SPEWS are terrorists. Hurting innocents in an attempt to force a party only vaguely connected to the victims to accede to their wishes? What's the difference?

Re:Sweet, Sweet Justice.

[Dimensio]

Thing is, if anyone on your network has even looked at a spammer in real life, your isp is considered guilty, as charged, and you stay blacklisted under spews.

You are either lying or being deliberately ignorant. SPEWS does not list on insinuation. SPEWS lists only after an ISP refuses to boot a spammer after repeated reports of their spamming. Once the spammers (all of the spammers) are gone and a note goes to nanae, the listing disappears very quickly.

It seems that many of the arguments against SPEWS are based on outright lies without any evidence to back them up (which is logical, since there is no such evidence).

Re:Sweet, Sweet Justice.

[harlows_monkeys]

Maybe there's something wrong with me, but it certailnly doesn't seem that way to me

No, there's nothing actually wrong with you. You just are completely clueless. :-)

If you use the internet, you are affected by spam, because pretty much every ISP is spending significant time and money dealing with it. That gets passed on to you. Find the interview with Barry Shein, which I think was the subject of a Slashdot story a few months ago.

Your cluelessness is also shown by mentioning hitting "D" a "few times a day". Try a few hundred times a day for many of us, and a few thousand times a day for those of us who have businesses with email contact and support addresses listed on our web sites. For businesses, that CAN'T whitelist everyone who might legitimately send mail, those spams can't just be quickly deleted...it is too easy to accidently delete customer mail if you do it quickly.

Re:Sweet, Sweet Justice.

[eaolson]

You know, when you put it that way, SPEWS are terrorists. Hurting innocents in an attempt to force a party only vaguely connected to the victims to accede to their wishes? What's the difference?

Because terrorists don't "hurt innocents," they engender fear and terror. They blow up bombs in crowded areas. They send horrible, infectious diseases through the mail. In one, your email doesn't get read. In the other, men, women, and children generally die agonizing deaths.

I hate it when people use the word "terrorist" to describe something that is totally unrelated. It belittles the word, and cheapens it. Much like "Nazi" was before 9/11.

Re:Sweet, Sweet Justice.

[cha0sadddddddd]

to be a pedant, the problem WOULD be solved if EVERYONE hit the "D" key.
therefore the assumtion is correct.
it's the very few that buy the shit that keep it coming.
I will say that therin lies the problem.
some people are dumb enough to buy shit from a spam.

Re:Sweet, Sweet Justice.

[hazem]

There are people who can get over having to hit "D" in their email clients a few times a day. Email advertising is a natural side effect of being on the internet, and it's not so bad if you're smart about it.

I think it goes deeper than that - to something more profound in the individual. I think that out of the some 6 billion people on this earth, most of them feel lonely. Getting an e-mail is great because someone out there seems to care - hopefully a friend or colleague. But then, you find it's just a commercial, or a piece of junk. In a way, you feel a bit let down... a bit more lonely, because you got your hopes up for a moment, only to have them dashed.

I have a similar feeling when I have received traditional junk mail that appears to be hand-written (particularly by a woman's writing), and appears to be possibly from some woman I once knew. I'm quite disappointed to find it's a bunch of junk for insurance, and I find myself actually angry about it.

Maybe I'm way off base here, but I think there is a psychological response that is at the heart of so many people hating spam.

So, your inbox chimes, and you have a new message and who knows what potential it may have. It's spam and it sucks. Maybe you even feel like you were fooled.

I, for one, divert any mail from a .com into my trash. I then go browse my trash every once and a while and will be pleasantly surprised when I find a legit message.

Sysadmins and ISP's of course see the actual cost side, but that's a different story.

Re:Sweet, Sweet Justice.

[Have Blue]

Actually, I was using the most precise sense of the word: One who makes threats, or carries out said threats, against one group with the intent of forcing another group to bow to their demands. True, the definition does specifically mention violence, but "terrorists use bombs and anthrax" is also a generalization.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

Interesting that you repeatedly post this interpretation of what SPEWS is supposed to do. First you make the assumption that every host on the internet has an entitlement to send email to every other host. This is a bullshit assumption. Second you assume that the users of SPEWS have a desire to receive email from every ISP if only the ISPs would kick off the spammers. This is also a bullshit assumption. Most of us don't give a fuck if Joe ISP is able to deliver mail to our hosts or not. The people we care about, we make sure their mail gets to us. Everybody else is mostly just annoying and we don't want to talk to them anyway.

And the final view that spam is just a matter of fact when it comes to being on the internet.... well getting shot in the fucking head is just a matter of fact when annoying people enough.

Re:Sweet, Sweet Justice.

[leviramsey]

Public blacklists were tried.. and they were harassed, death threated and sued into oblivion.

Tough. As far as I know, the blacklists won every single case.

What's coming will make SPEWS look like responsible.

Care to say what that is?

Re:Sweet, Sweet Justice.

[SirFozzie]

It's a fall back plan discussed by admins. Look up Pandora's Box in news.admin.net-abuse.email.

The blacklists won every single case, but who says the folks doing these things were law-abiding citizens (look at Eddy Marin, the guy currently suing everyone to hell and back, a convicted Heroin runner). It's hard to do your job when you're scared for your life, you know?

Re:Sweet, Sweet Justice.

[Felinoid]

That is harsh.. but then so was the person your responding to.

Fighting spam is a very difficult task and spammers you stop will spread lies. It's something they do very well. That talent makes them think they'd be good in marketting. What a supprise it is when they fail in traditional marketting techniques.

But lies are always based on a truth. Big lies usally contain a small truth.

I have no doupt SPEWS has to tolerate a great many lies all of them having a droplet of truth and all backed by some form of evedence.

But it is becouse of those lies that spam hunters tend to become a slight warpped and considerably jaded.
All spam hunters make mistakes. Why would SPEWS watch usenet for mistakes if they never happend? I'm sure SPEWS is careful but I'm reminded of annother spam hunting organisation that was not and ignored it's mistakes.

Usenet is an alternitive for people who can't reach SPEWS any other way. But that is not the best of options becouse as I said before not helpful if people don't know they can contact SPEWS this way or worse don't even know about Usenet.

Re:Sweet, Sweet Justice.

[PReDiToR]

<<the people who are responsible for causing it, i.e. spam-friendly ISPs>>

Why is it that nobody on this comments board has thought to mention that (well, nobody above Score: 1) its not the ISP's or the spammers, its the CONSUMERS clicking away at every damn commercial that comes their way?

If you didn't ask for it, don't click it. The monkey running accross the screen turns your pointer to a hand? Don't click.

Educate the masses, tell your mom, your kids, your neighbour. Spammers only do this because they make money from it. The war is won when there is no profit for the agressor.

Re:Sweet, Sweet Justice.

[leviramsey]

So it's a week where the public blacklists just turn off in protest of a lack of strong legislation?

Won't work. Only admins that run public blacklists or run a private blacklist, read nanae, and decide it's time to open Pandora's Box will do it; every other admin will blithely continue along. Also, I don't see the admins at any of the major consumer ISPs diabling their blacklists (because of customers' bitching).

As for your second paragraph, escalating it to the point where a spammer hires a killer may be the ticket to getting it strongly outlawed. The question is, who's got the balls to sacrifice their life to stop spam?

Re:Sweet, Sweet Justice.

[SirFozzie]

Actually, there's a stronger version of Pandora's Box that's been mentioned.

And that's a version of the old "an eye for an eye" if spam becomes legal. That means spam runs at spammers that do JUST as much damage as the spammer's initial run. I don't agree with it, but you have to wonder about what it's going to take to stop these spammers.

After all, we're already into the criminal realm with the DDoS's.

Re:Sweet, Sweet Justice.

[randyest]

Why would SPEWS watch usenet for mistakes if they never happend?

I think you misunderstood. SPEWS doesn't "watch usenet for mistakes", they watch for groveling repenters who say something to the effect of "OK, we screwed up and let spammers in, but we kicked them off, we promise, really this time, and we know you'll roast us if we're lying, so we aren't, so pretty please, un-list us? Mkay? Thanks."

I don't use it, but is I had a bigger (and more public) mail server, I would, and I would advertise that fact. It's a plus, IMHO, but each potential user should have a choice whther or not to use an ISP/mail provider that filters.

Re:Sweet, Sweet Justice.

[Hurga]

SPEWS doesn't consider the innocents being caught up as unfortunate, they consider them the target.

Your "innocent bystanders" aren't innocent, they're giving their money to a spamming ISP. Which means, they're contributing to the problem that there are irresponsible ISPs who send out spam.

Hurga

Re:Sweet, Sweet Justice.

[Anonymous Coward]

I was trying to figure out why the heck this person would set his defunct service to "default to filter" (exactly the opposite of what a typical responsible sysadmin would do in this case), and reading your message made the answer go click for me. The RBL types already believe that it's ok to block any amount of legitimate mail in order to stop one spam message. This dumbass move is just another expression of that. They see it as the equivalent of a firewall failing on a system where access control is critical - of course it should fail closed. Truly a demented view of email; the thing I always wonder is whether the people who subscribe to these lists really share it? I think with the inclusion of point scores for RBLs in Spamassassin by default, normal folks are even less likely to agree than they have been in the past.

As for the rest of your post, RBLing is probably enough of a hot-button issue without throwing in capital punishment and Palestine. ;) If you're going to go that far, may as well get it over with and invoke the Nazies.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

Hopefully now, people using spews will realize that spews really is a poor solution to the problem, that causes more harm than it prevents.

Hear hear! I should've just added all of the IPs that SPEWS so diligently maintained into my own unmaintained local blacklist ages ago. And now, I'm going to do just that. There's no way that I'm going to start accepting mail from lauderdale.net just because SPEWS is down, and since I don't read news.admin.net-abuse.email, there will be no way for any of their unfairly listed neighbors to get removed either. Bye-bye spammers and those unfortunate enough to have given money to their providers and been given IP netblocks right next to them.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

You (or your dictionary) forgot that terrorist comes from the word TERROR. No terror, no terrorist. It's as simple as that.

Re:Sweet, Sweet Justice.

[91degrees]

Firstly, that's not the point.

The point is that SPEWS is a crappy product that affects people who don't use it. We therefore have a responsibility to tell admins thatit is a crappy product, and urge them not to use it.

Secondly, it doesn't allow admins to refuse email as they see fit. It allows them to reject email as SPEWS sees fit. While you could argue that the admin has the right to unblock any site he wants, this ability is worthless without the knowledge of which sites are wrongfully blocked.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

Your only hope is to talk your isp into kicking off their spammer clients, or change isp's.

Yep, holding the ISPs accountable is the only way to make this work and most ISPs don't give the time of day to non-customers, so since you have a business relationship with the ISP and they are failing to render the service it is their obligation to make things right.

For those who are actual business ISP customers you actually have some power -- your account is more profitable often by an order of magnitude than residential customers.

Also, if the ISP is providing adequate service, most business customers do not switch ISPs with out a really good reason -- unlike residental customers for whom churn is an expected part of the business.

So, your ISP should rectify the problem or expect to lose your business to an ISP that is diligent about policing their customers.

When you sign a contract with an ISP, you should be sure that they will check out abuse complaints against their customers and if valid drop them like a bad habit. If not don't sign with them, there are plenty of that will do it.

ISPs that can't keep profitable customers go out of business -- so the choice is do what it takes to keep them or go bankrupt.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

You are in the truth. I'm actually unable to send an e-mail from the biggest provider from my country to the second greatest university.

Personnaly I prefer SPAM than beeing block (With bayesian filters you get rid of them, just a little more bandwith waste)

----- The following addresses had permanent fatal errors -----

(reason: 571 ... Mail from 195.238.2.127 refused
+(your mailhost listed in RBL+), see http://www.vub.ac.be/tools/antispam.html)

Re:Sweet, Sweet Justice.

[Anonymous Coward]

>Your only hope is to talk your isp into kicking off their spammer clients, or change isp's.

So you're saying ISPs will be forced to either get rid of the spammer clients or risk losing business?

Sounds fscking excellent to me.

Re:Sweet, Sweet Justice.

[danila]

Well, if you change ISPs, your IP is going to change in the process, isn't it?

Re:Sweet, Sweet Justice.

[Cheech Wizard]

To me it's not just hitting the 'D' key a few times a day. I've had an internet presence since 1995 and have several domains. My server rejects over 200 messages a day alone. Mail which gets through goes to Spamcop for a check and then I pop my spamcop account. Some even get through that. And I have to check my Spamcop account daily. This morning I had to go through 17 pages of Held e-mails over the last 24 hours - all of which were bogus (I rarely see a false positive). As a business person who needs to receive e-mail, I can't use a whitelist and the challange idea isn't for me either. You are in the minority if spam is not a significant problem to you.

Re:Sweet, Sweet Justice.

[Cheech Wizard]

So - your suggestion is that we rid the world of idiots who buy the stuff? How would one go about doing that?

Re:Sweet, Sweet Justice.

[tsvk]

Spews was an excellent solution. It wasn't perfect and a few mistakes were made. The fact that the real operators had to remain secret due to all the lawsuit threats did make it difficult to provide feedback to make corrections. I predict SPEWS will be back, but in a different form, possibly as a distributed file of sites to block ... which will make it even harder to get removed since it will then not be operating as a live database.

Please note that Osirusoft is not SPEWS. You are speaking as if SPEWS has shut down. This is not the case. (AFAIK.) Osirusoft hosted many mirrors of popular blocklists. One of them was SPEWS. Many people used Osirusoft to access the SPEWS list. Even if Osirusoft shut down, SPEWS is still accessible for example at http://bl.reynolds.net.au/spews/.

Re:Sweet, Sweet Justice.

[Cheech Wizard]

Not always so. One of my sites was 'Black Listed' by SPEWS last year. I was, in that case, renting from a Verio reseller. How as I to know that the ISP was also hosting spammers (they claimed they weren't, so who knows)? I had to go through the 'big change' to another IP block because - as we all know - getting off the SPEWS listing was impossible. I'm not against blacklists. I like what they do for me. They stop a lot of SPAM.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

You idiot, Osirusoft != SPEWS

SPEWS is alive and well thanks to many mirrors and it being distributed with other blocklists.

Re:Sweet, Sweet Justice.

[slonob]

Spam assassin is not practical for high volume service. I've seen it take 75% of the CPU on a fairly new Intel box. Of course, this was with a stupid out-of-the-box configuration. Setup with defaults, it's an enormous strain on resources and is just begging for a DoS attack. I think of Spam Assassin as spam blocking for script kiddies. Now kids, let's actually read the script before we use this.

Re:Sweet, Sweet Justice.

[rhadamanthus]

Precisely correct. A good example is Something Awful.

SPEWS sucks.

---rhad

Re:Sweet, Sweet Justice.

[Anonymous Coward]

It seems that many of the arguments against SPEWS are based on outright lies without any evidence to back them up (which is logical, since there is no such evidence).

People tend to lash out at shadow organizations with no accountability. They feel they're somehow illicit. Sheesh, I wonder why? Personally I'd never knowingly use SPEWS since you can't seem to contact them directly. It just seems filthy.

Re:Sweet, Sweet Justice.

[Isofarro]

to be a pedant, the problem WOULD be solved if EVERYONE hit the "D" key.

How does hitting the "D" key prevent mail servers from being clogged up with spam to the point that proper email cannot be delivered? That to me is sufficient reason to that "just hit delete" is no solution at all.

Re:Sweet, Sweet Justice.

[Isofarro]

[Spews] It doesn't allow admins to refuse email as they see fit. It allows them to reject email as SPEWS sees fit. While you could argue that the admin has the right to unblock any site he wants, this ability is worthless without the knowledge of which sites are wrongfully blocked.

That is complete and utter tripe. Admins do not have to use Spews, and the don't have to use only Spews. They can use as many and varied collection of blacklists as they wish. Spews only returns a result of a query, and does no actual blocking. An administrator does not have to reject all email that querys as spam positive - it is his choice on how he deals with Spews query results on the incoming mail. If an admin requires the knowledge of which sites are blocked, then he can get that information when he needs it by configuring his mail servers accordingly.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

Once the spammers (all of the spammers) are gone and a note goes to nanae, the listing disappears very quickly.

First of all, that's bullshit about "quickly." They even say in the FAQ that it could take months to get off. Secondly, what if your provider is a huge colocation facility that will ALWAYS have incoming spammers to deal with. You will then never be able to be taken of the list, even if the colocation facility is dealing with the problems as they come in, because there will always be some spammers on that service.

Re:Sweet, Sweet Justice.

[xenobyte]

SPEWS may listen but they rarely (if ever) unblock anyone except those precious few that they like, asks the right way or just catches the resident I-am-not-SPEWS guy in a good mood.

I work for an ISP that *had* a spammer on the net but kicked him out back in March. We're still listed because we host a subsidiary of a company who has another subsidiary that has used spam in the past. That's the only spam-relation but we're still listed at max. due to that. Our customer has never used spam anywhere so we can't throw them out, and why should we? - But SPEWS calls us spam-friendly and refuses to de-list us.

Sigh. SPEWS must either go or come around. Instead of making enemies of everyone they should unite people in the fight against the spammers. Hurting and blackmailing innocent people to turn against their ISP isn't the best way to make friends.

Re:Sweet, Sweet Justice.

[matuscak]

I believe the point the grandparent was alluding to was the fact that once on a blacklist, there is no way to get a domain off a blacklist
From what I've seen, SPEWS fixes listings that are incorrect promptly and in the case of correct listings once the spammers are gone, so are the listings. All in all, I think it works pretty well.

Re:Sweet, Sweet Justice.

[91degrees]

That is complete and utter tripe. Admins do not have to use Spews, and the don't have to use only Spews.

I never said they did. However, if they do, they will typically be rejecting email as SPEWS sees fit.

They can use as many and varied collection of blacklists as they wish.

Indeed they can. I would suggest that SPEWs should not be in this list

An administrator does not have to reject all email that querys as spam positive - it is his choice on how he deals with Spews query results on the incoming mail.

Why else would he be using SPEWs?

If an admin requires the knowledge of which sites are blocked, then he can get that information when he needs it by configuring his mail servers accordingly.

He doesn't require this knowledge. He simply requires an assurance that measures are taken to ensure that the number of false positives is kept to a minimum. If the admin is obliged to check this for himself, then the list is worthless since it will be as much effort to create his own list.

Re:Sweet, Sweet Justice.

[gid]

Probably because we were the new owners of the class c, that why we got removed, any other circumstances it sounds like we would have had a hard time. I hardly a SPEWS supporter, far from it. I relying soley on blacklists to block spam is a bad solution, and causes numerous headaches that I have experienced in the past.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

dammit I need to proof read my posts better. :)

Re:Sweet, Sweet Justice.

[Anonymous Coward]

That's bullshit. I have a netblock which is from Lightyear which in turn is from UUNet. I posted to Usenet three times, explaining my situation and asking that my netblock be removed. I was told to "stop throwing my money at spammers." Because apparently me doing business with UUNet, through some twisted logic, is the same as me financially supporting spammers. We're just trying to do OUR business here, we got a good deal with a certain provider, and now a bunch of asstards are telling us we need to switch ISPs to meet the needs of their agenda, and that we are simply "collateral damage" in their war on spam.

Fuck SPEWS.

BT

Re:Sweet, Sweet Justice.

[Anonymous Coward]

Case in point, this article on the Register shows that even China can't ignore being blacklisted indefinately.

Re:Sweet, Sweet Justice.

[gid]

As someone else suggests. It sounds like you have to ask the right way and be lucky enough to catch the SPEWS guy in a good mood. Damn annoying yes, and I'm glad another spews feed has gone down.

Maybe SPEWS is still ticked off at UUNet and how crappy they were at taking action against spammers in the past. Which is dumb, but very possible...

Re:Sweet, Sweet Justice.

[Isofarro]

However, if they do, they will typically be rejecting email as SPEWS sees fit.

An admin decides what is best for his organisation. If he decides to automatically reject email based on a SPEWS query - that is his choice. Also, if he decides not to reject an email based on a SPEWS query, he can chose do that. The use of SPEWS does not force either.

Why else would he be using SPEWs?

For any number of reasons. No-one is forced to use SPEWS, and no-one is forced to reject mail based on a SPEWS query - the admin choses what is best for his network.

He doesn't require this knowledge.

Sure he believes he does, otherwise his system wouldn't be quering SPEWS at all.

He simply requires an assurance that measures are taken to ensure that the number of false positives is kept to a minimum.

Spews offers multiple lists - use the right one like Level 1, which lists netblocks owned by spammers and spam support operations. Its not terribly difficult, is it?

Re:Sweet, Sweet Justice.

[Pete]

Cheech Wizard:

How was I to know that the ISP was also hosting spammers (they claimed they weren't, so who knows)?

You can ask a representative of the ISP if they host spammers. You can ask them if they've ever been on a blacklist. Then you check the major public blacklists to see if they're lying, and if they are lying then you don't deal with them.

If they aren't dealing with spammers when you sign up, but take on spamming clients later on - then you complain loudly and incessantly. Cost them as much time and money as possible to deal with your complaints. And of course if they ever lie to you, leave. Or take the weaker approach of paying to relay through an external unblacklisted mailserver and reduce they amount you pay your ISP appropriately. If they still continue to keep the spammer, then at some time you'll have to leave - otherwise you're essentially telling them that they can treat you as badly as they want and you'll keep taking it and keep paying them money.

I had to go through the 'big change' to another IP block because - as we all know - getting off the SPEWS listing was impossible.

No it's not.

BTW, some other good alternatives to "as we all know" are the old classics "Clearly,..." and (if you want a nice condescending tone) "Obviously,..."

I'm not against blacklists. I like what they do for me. They stop a lot of SPAM.

When referring to spam, you shouldn't capitalise it. It's not an acronym. SPEWS (Spam Prevention Early Warning System) is an acronym, so it should be all-caps. Spam is just an ordinary noun, so only the first letter is capitalised, and that only at the start of a sentence.

It's really strange why people sometimes feel the need to use all-caps for a word. It's not quite as bad as the loose/lose or hear/here confusions, nor the erroneous apostrophes issue, but it's still irritating. Oh well. :-)

Pete.

Re:Sweet, Sweet Justice.

[Zeinfeld]

You know, when you put it that way, SPEWS are terrorists. Hurting innocents in an attempt to force a party only vaguely connected to the victims to accede to their wishes? What's the difference?

They have not killed anyone or attempted to kill anyone (yet).

The basic mindset is very similar, you will comply with our demands or else we will hurt you, you will force others to comply with our demands or else we will hurt you.

Very few ISPs take any notice of SPEWS, at this point they are irrelevant because they are completely indiscriminate. Any ISP who uses SPEWS as a blacklist is guilty of negligence in my view. I would not switch ISPs because an ISP was listed in SPEWS but if they filtered my mail using SPEWS I would drop them immediately.

There is no point in responding to SPEWS demands for the simple reason they will not bother to respond to you.

Re:Sweet, Sweet Justice.

[Pete]

Hurting innocents in an attempt to force a party only vaguely connected to the victims to accede to their wishes?

Well, if this party is only "vaguely" connected to the "victims", then it shouldn't be a problem at all for the "victims" to disconnect themselves completely, should it? I mean, since the connection's so very vague, as you say...

But of course the "victims" do have an extremely strong connection to the party (ie. the ISP) - they pay them money for services. That money helps keep the ISP alive. They're paying money to help keep spammers online.

And of course the victims can leave the ISP at any time. The ISP and spammer is the target, not them. If they leave, the blacklist won't follow them.

SPEWS are terrorists. [ ... ] What's the difference?

The most obvious distinction is that none of the people using SPEWS (or any other bl[ao]cklist are hurting people - they're just shunning them. Refusing to accept mail from them. Same as shunning in the meatspace world. No violence involved.

Pete.

Re:Sweet, Sweet Justice.

[Pete]

91degrees:

He simply requires an assurance that measures are taken to ensure that the number of false positives is kept to a minimum.

SPEWS make their criteria for listing very very clear. They document them right out in the open (I'd give you a link but of course spews.org is down at the moment). If I remember correctly, they actually say on their website, in several places, something like "if you want zero false positives, don't use SPEWS." Of course, there are going to be some false positives with just about any RBL, the question is more "how many are acceptable?" And that's the call for the person ultimately responsible for the mailserver - no-one else.

As far as I'm aware, SPEWS haven't ever made additions to their list that violate their published guidelines (aside from the very occasional honest mistakes, which are usually corrected extremely quickly upon discovery).

Pete.

Re:Sweet, Sweet Justice.

[XSforMe]

ISPs who choose SPEWS as blackhole providers are basically clueless. They are basically saying its ok to block 1% fake positive (even worse if you mail comes from several parts of the world).

At this point I turn the tables on the blocking ISP. I notify the receiver that due to their current ISP's policies I am unable to comunicate with them. If the recipient is a provider for our business, I notify them the fact that their ISP is blocking our mail and thus disqualifying them as providers to our business (our procurement system sends email notifications). End of story.

Re:Sweet, Sweet Justice.

[onepoint]

>>There is no point in responding to SPEWS demands for the simple reason they will not bother to respond to you.

that's an outright lie, I was on there blacklist once and within 30 days I was off. I did process there request and had all my issues resolved. since then I have no problems.

Onepoint

Re:Sweet, Sweet Justice.

[Alderete]

As blacklists go, SPEWS is the worst of them. They block entire netblocks so that innocent bystanders will fight their fight for them. If my IP gets blocked even though I haven't sent any SPAM, I am expected to bitch to my ISP and/or move to another ISP, and then maybe in a couple of months my IP might get removed from the list.

You don't understand SPEWS, or the word "innocent." If you are a customer of a spammer-friendly ISP (which is the only way SPEWS can hurt you), then you are a part of the problem, a silent collaborator with the spammers.

Patronizing spammer-friendly ISPs is almost as bad as actually buying things from spam. You're providing economic incentives to the people who make spam worth their while.

To be perfectly clear: if you're a customer of a spam-friendly ISP, you are supporting spam, and you deserve to be hit by SPEWS.

Re:Sweet, Sweet Justice.

[Kishar]

Because once people stop buying HGH and penis pumps from spam, there will be no reason to send it. Why go through the trouble to send 10 grillion mails if you're not going to have ANY return?

Solve this problem and spam goes away like magic.

Re:Sweet, Sweet Justice.

[Cheech Wizard]

1. When I got the account they weren't listed on any blacklists so checking ahead didn't help. Nor were they, as far as I could tell, hosting spammers. 2. Apparently a few people know (knew?) how to get off the list. I didn't and when I tried I did not find a way to get off it short of changing IP blocks. As I grow older, I learn, but this was something I had not figured out how to do. 3. I'll consider my use of "as we all know" but considering the postings by many, my English isn't all that bad. At least I leave out the childish vulgarities so many use. 4. I have seen spam capitalized many places. I don't feel a 'need' to use capitals - I did it by habit. For this venue I stand corrected. By all means excuse my ignorance. I've 'visited' /. for about a year and enjoy it. But I'm not an IT professional. I'm just a guy who keeps his own business web site online. I'll keep in mind your admonishments.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

If you pay taxes, you support all the actions of your Government, and should be killed when someone doesn't like them.

Re:Sweet, Sweet Justice.

[Yorkshire]

Unfairly blacklisted?

If someone is knowingly giving money to a spam support isp, being a customer, allowing that spam support isp to be bigger and therefore harder to deal with, then that person is a spam supporter too.

so how is blocklisting spam supporters wrong?

Re:Sweet, Sweet Justice.

[Anonymous Coward]

In one, your email doesn't get read. In the other, men, women, and children generally die agonizing deaths.

As long as they die AFTER they read my e-mail...

Re:Sweet, Sweet Justice.

[WNight]

Their "demand" if you can call it such, is that they demand you take off your shoes before entering their house, or the houses of their friends. If you do not, they will tell their friends you are uncouth and their friends will likely not admit you either.

They don't want spam. If you send spam, or are hard to distinguish from a spammer because you use a company that hosts spammers, they simply tell their friends that you are a spammer, or are indirectly involved in spam, and to not accept email from you.

You have no right to force them to accept your email, which means that they may freely block your email. This causes MUCH less harm to you than the spam does to them. You get a nice bounce letter explaining that your email won't go through, whereas they, if they accept email from these spammers will get gigabytes of penile enlargement spam flooding their mailboxes and the mailboxes of their customers.

How does this cause you so much harm?

Re:Sweet, Sweet Justice.

[WNight]

Gotcha, a business that says "No shirt, No shoes, No Service" is a terrorist organization because they're threatening (to not to business - doesn't have to be violent) you to force you to comply with their wishes.

It's perfectly valid under the lame definition you posted.

Maybe you should admit you're full of it.

Re:Sweet, Sweet Justice.

[Dimensio]

First of all, that's bullshit about "quickly." They even say in the FAQ that it could take months to get off.

That's just a caveat, so that spam-friendly ISPs won't expect instantaneous results. The observed reality, however, is that SPEWS listings clear up very quickly after spammers get booted.

Secondly, what if your provider is a huge colocation facility that will ALWAYS have incoming spammers to deal with. You will then never be able to be taken of the list, even if the colocation facility is dealing with the problems as they come in, because there will always be some spammers on that service.


If the colocation boots spammers quickly, then they won't get listed in SPEWS. SPEWS lists when spammers aren't kicked off -- not when spammers are quickly kicked and replaced with new spammers. Further, ISPs that kick spammers quickly soon earn a reputation and the more hardcore spam cases won't go to them.

Re:Sweet, Sweet Justice.

[Dimensio]

The point is that SPEWS is a crappy product that affects people who don't use it. We therefore have a responsibility to tell admins thatit is a crappy product, and urge them not to use it.

If a SPEWS-using admin isn't aware of how SPEWS works, then said admin should be fired for incompetence.

Secondly, it doesn't allow admins to refuse email as they see fit. It allows them to reject email as SPEWS sees fit.

SPEWS returns a value based upon a DNS query. It does nothing more. Admins who use SPEWS have options other than blocking all SPEWS-listed sites -- they can flag mail from such domains as potential spam, they can whitelist specific entries as they see fit or they can even reject all mail EXCEPT that from SPEWS-listed IP ranges.

While you could argue that the admin has the right to unblock any site he wants, this ability is worthless without the knowledge of which sites are wrongfully blocked.

Please cite a "wrongful" SPEWS listing.

Re:Sweet, Sweet Justice.

[WNight]

SPEWS does no such thing. They offer a list of ISP that harbour spammers. Other ISPs take that list and use it to ignore mail that's likely spam.

As for shifting, whose fault is the spam, the cost for which you are somehow saying is shifted? It's the fault of the ISPs who don't police their customers. If these ISPs didn't enable spammers, there wouldn't be any costs for anyone. But, no costs are being shifted. These ISPs who refuse to act in a net-friendly manner are simply being ignored. If anything, this will end up costing them less as their bandwidth costs will no doubt go down when their legitimate customers leave for an ISP whose peers actually accept traffic from them.

Re:Sweet, Sweet Justice.

[WNight]

The only things SPEWS and services like it do, are suggest that you might be someone I want to ignore. I then ignore you. You are not directly affected by SPEWS, it's only an automated way of sysadmins saying "Don't accept mail from foo.com, they harbour spammers."

There's no product involved, so it can hardly be a crappy product. Perhaps SPEWS advice is crappy, but then considering what you pay for it, it's a pretty good deal.

Re:Sweet, Sweet Justice.

[WNight]

I get very little spam, but a lot of spam is sent to me for automated deletion. That slows down my net access and, if over a certain limit, costs me for every megabyte. It'd be much worse if I connected over a modem.

Then there's the time involved in dealing with spam. You either set up Spam Assasain (or similar) and subscribe to black-hole lists of one sort or another, or download and test a ton of rules trying to describe spam, or you go through and press delete up to a few hundred times a day. Either way it takes time and time isn't unlimited. If you're doing it for work there's even a dollar cost involved.

More importantly though, is the chance that you'll accidently delete a real email, either with an automated script, or by hand. That could cost you a lot.

You know all of this though. You know spam costs a fortune, for network traffic, storage, and time. You also know that most of these costs are paid for by the recipient who doesn't want to read the email, let alone pay for it. Why do you even waste time pretending otherwise?

Re:Sweet, Sweet Justice.

[WNight]

Everyone I know who uses a blacklist to drop email sends bounce messages explaining this to the sender. No mail is silently lost in this situation, the user is simply informed that they need to communicate the message in another fashion (phone, web-form, etc) or in email from a different ISP preferably.

Compare this to the false-positives hidden or deleted by spam filters, or accidently by users trying to delete spam manually. No warning goes out in this case.

Re:Sweet, Sweet Justice.

[sudleyplace]

I never could understand the basis for SPEWS blocking innocent domain holders who happen to have an IP address NEAR a spammer's IP address.

By using this type of guerilla warfare, blacklisters delude themselves with the fervent hope that innocent civilians such as ourselves will enter the war on their side in order to punish the offending ISPs.

Why they think that by screwing us, we would ever be inclined to help their cause defies understanding.

Re:Sweet, Sweet Justice.

[cha0sadddddddd]

cmon I said and I quote
"therin lies the problem"
meaning I have no theory as to how to solve the problem... I just know it exists.

Re:Sweet, Sweet Justice.

[cha0sadddddddd]

YES!! you are correct SIR!!!
you gotta take the long view here.
we get spam anyway.
If no one buys anything from it it will stop.
period.
eventually.How long? I dont know. I bet 6 SOLID months of ABSOLUTLY 0 sales resulting from a spam and BAM! no more spam.
so now all we gotta do is wait for someone smarter than me to figure out exactly how to coordinate this......

Re:Sweet, Sweet Justice.

[91degrees]

The only things SPEWS and services like it do, are suggest that you might be someone I want to ignore. I then ignore you. You are not directly affected by SPEWS, it's only an automated way of sysadmins saying "Don't accept mail from foo.com, they harbour spammers."

I am affected if SPEWS adds me though, whether directly or indirectly. The intention of adding my IP address to the SPEWS list is to cause that email address to be blocked. I'd say it does more than suggest that a site should be ignored. Their suggestions are taken as good advice (no idea why).

There's no product involved, so it can hardly be a crappy product. Perhaps SPEWS advice is crappy, but then considering what you pay for it, it's a pretty good deal.

Okay. It's a crappy service. The fact that its free does not excuse it from being crappy. My crappy operating system and crappy web browser seem to work perfectly well thank you.

Re:Sweet, Sweet Justice.

[Anonymous Coward]

"Usenet is an alternitive for people who can't reach SPEWS any other way. But that is not the best of options becouse as I said before not helpful if people don't know they can contact SPEWS this way or worse don't even know about Usenet."

Then they should not be running servers on the net, or they should be talking to their provider.

JEFF K wins again!

[Anonymous Coward]

I guess Jeff K and Jerry, with their 1337 h4x0r 5|!11z, have finally retaliated for the blacklisting of somethingawful.com. G

Re:JEFF K wins again!

[Anonymous Coward]

They wrote an interesting update about their problem with SPEWS, a month back or so:

http://www.somethingawful.com/articles.php?a=1605

"In fact I received dozens of e-mails from network admins working for companies large and small who said exactly that with most also emphasizing that "only a lazy idiot" - to quote one of the e-mails - would use the SPEWS listing on their network."

"SPEWS provides a blocklist with zero oversight, zero accountability, and zero recourse for average users caught between their ISP and SPEWS.ORG's moral crusade. SPEWS will tell you that you in fact do have recourse and that is to switch ISPs. For Something Awful that is not economically feasible, for users in the nation of Brazil where their entire broadband provider has been blacklisted that is impossible. In addition to all this most of the SPEWS advocates on the newsgroups we so unceremoniously invaded demonstrated a willingness to add IP ranges to their own blacklists and potentially SPEWS for petty personal reasons. Complain about how SPEWS operates? Get added to the blacklist, often permanently, while they pretend that it somehow makes your situation worse."

Re:JEFF K wins again!

[Anonymous Coward]

Heh, the best part of that SPEWS debacle was when, instead of asking rationally about the block and trying to resolve it with their provider, they sent their idiot minions to crapflood a net.abuse newsgroup. SA got on a ton of personal blacklists then, SPEWS notwithstanding.

Re:JEFF K wins again!

[Zeinfeld]

In addition to all this most of the SPEWS advocates on the newsgroups we so unceremoniously invaded demonstrated a willingness to add IP ranges to their own blacklists and potentially SPEWS for petty personal reasons. Complain about how SPEWS operates? Get added to the blacklist, often permanently, while they pretend that it somehow makes your situation worse."

There are quite a few anti-spam zealonts who are as bad as the spammers or worse.

This hit the IETF anti-spam research group list. One clown decided to start reporting people he argued with on the list as spammers.

This was a Fox News 'fair and balanced' type strategy, Franken's real complaint about O'Reilly is not the lies, its the bullying. The Fox lawsuit proved O'Reilly and Fox are bullies. It was the same with this clown, anyone who objected that blacklists can be abused as a means of personal censorship got censored.

Whoa

[josh crawley]

I'm glad I read this; I got a bounce message earlier saying one of my emails was blocked due to our corp. mail server being blacklisted by relays.osirusoft.com, and I drove myself just about mad trying to figure out how or why.

Speaking of blacklisting...

[Naysayer]

It's August 27th... why isn't Slashdot showing the protest page, huh?

Re:Speaking of blacklisting...

[Anonymous Coward]

Its still August 26th in the real world, friend.

Re:Speaking of blacklisting...

[mcpkaaos]

Speaking of off topic, when do we get a "-1, Irrelevant" mod, huh?

Wtf does that link have to do with blacklisting?

(Hmm, the capital 'W' should satisfy the grammar nazis, but what will the acronymn nazis think?)

Re:Speaking of blacklisting...

[Anonymous Coward]

Grammaticly it should be WTF.

w00t

[Anonymous Coward]

Ding dong the witch is dead!

Well,

[Sebby]

I never found osirusoft to be too reliable, or accurate in the past (it usually had sites listed as 'spammers' that weren't while all other services didn't list those sites, and there didn't seem to be any appeals process to their own list), so I'm tempted to say 'good riddence', but obviously putting it (and others) out of commission is not a good thing.

Good riddance to bad rubbish

[Sebastard]

My co-located server has been blacklisted by SPEWS for months now. And it's only because of a spammer elsewhere on my two-providers-up-the-chain regional ISP. And the spammer is on a different C-class entirely, yet my IP range was still included as punishment to the ISP. The fact that I suffer as a result doesn't matter to these people. Changing providers is not an option for me at this point (long story) so I've just had to live with it. I can't email several friends, and regularly field complaints from people who host on my server.

I believe in fighting spam, and I think that blacklists are a good idea to a certain degree, but I've always felt that SPEWS was too draconian, and had no option for recourse for those of us who were (as they put it) "collateral damage".

I posted to the referred newsgroup a few times, and got nothing but venom from the locals.

I'm not sad to see them go.

Re:Good riddance to bad rubbish

[Kishar]

I posted to the referred newsgroup a few times, and got nothing but venom from the locals.

That's all you'll ever get there, and that's why SPEWS makes that their only means of contact. They want you to get flamed to death as further punishment.

Re:Good riddance to bad rubbish

[tomstdenis]

Not only that but SPEWS [et al.] are optional. I run my own SMTP/POP3 and I simply blacklist IPs manually from abusers [e.g. virus, spammers, etc.].

Ya I still get spam and viruses sent to my box but once I ban their IP [or class C] I never have to hear from them again.

Doing so manually I think is a bit better than letting others pick and choose what to bam. In this case SPEWS is just poorly maintained and could cost business.

Tom

Re:Good riddance to bad rubbish

[bigmaddog]

SPEWS is dead, and it's not a bad thing. They were arbitrary and indiscriminate in blacklisting huge chunks of the internet, and one was more likely to get ravaged by a pair of nymphos in a dark alley than get taken off their list. Amongst their more notable achievements, I hear they had the entire country of Brazil blacklisted. They also blacklisted somethingawful.com at some point in time, and comedy ensued. Now quick, while they're down, drive a stake through the heart, chop of the head, and don't forget the words; "Klatu Verata Nrmnphnfhr..."

Re:Good riddance to bad rubbish

[Kenja]

If that where the case I could have gotten off the black list. twice.

Re:Good riddance to bad rubbish

[next_permutation]

SPEWS is NOT dead. The osirusoft.com mirror of the SPEWS list is dead. The DDOS of the SPEWS web site does not matter (much); the SPEWS list is still being updated, distributed and used.

Re:Good riddance to bad rubbish

[leviramsey]

I take that approach a step further: every week, I remove networks that have behaved for a certain period of time from the list.

Re:Good riddance to bad rubbish

[Anonymous Coward]

If that where the case I could have gotten off the black list. twice.

Hmm I wonder if that was the same pair that I ...

Re:Good riddance to bad rubbish

[harlows_monkeys]

My co-located server has been blacklisted by SPEWS for months now. And it's only because of a spammer elsewhere on my two-providers-up-the-chain regional ISP. And the spammer is on a different C-class entirely

SPEWS starts out with a listing of JUST the IP address that is spamming. It gets wider only if abuse reports are repeatedly ignored. It takes many steps to get as wide as you are describing. I suspect you are greatly understating the magnitude of the spam flowing from your ISP or the upstream providers.

I can't email several friends

Email them from somewhere else and ask them to whitelist you. If they are on an ISP that doesn't support whitelists, then either they have to move, or you have to move.

Re:Good riddance to bad rubbish

[Mowog]

Email them from somewhere else and ask them to whitelist you.

That's fine if you're a consumer who has problems with an ISP -- you can arguably churn somewhere else that isn't blacklisted.

My company is in the business of fighting spam -- we operate a service which filters spam (and viruses, and other malware) out of our clients' email. We have had several boxes in a hosted environment caught as collateral damage directly by SPEWS. Their attitude? Too bad, take your business elsewhere, vote with your wallet.

What they don't understand is that it costs real money to set servers up, and just as much to tear them down and move to another ISP. We simply don't have that much time or money, and as a result have been stuck with the repercussions and complaints from customers.

I'm drinking a bottle of red in celebration of SPEWS demise. Their goal was honourable, but their methods despicable and I'm thrilled to see them off the face of the earth.

Good riddance.

Re:Good riddance to bad rubbish

[R.Caley]

I've just had to live with it. I can't email several friends, and regularly field complaints from people who host on my server.

If your friends have decided that they want to use an ISP/mail service with a draconian anti-spam policy, surely that is their choice. Unless the mail service dropping your mail lied to them of course, in which caseyou have presumably informed them.

ISTM that you are in the position of someone who has a friend who unplugs their phone in the evening to avoid telesales calls, and are blaming the company which manufactured phones which could be unplugged.

All the various blacklists do is provide a choice of policies. This is no different from people making firewall software or hardware which can be configured anywhere from totally open to totally closed. Yes, some ISP could set it up totally closed and deny their customers all service, but that would be their choice, and the customers could decide to like it or to stop giving them money.

Re:Good riddance to bad rubbish

[mvpll]

It gets wider only if abuse reports are repeatedly ignored. It takes many steps to get as wide as you are describing.

No, it doesn't take many steps, just two poorly worded emails with an insufficient grovel content. Anti-spam fanatics like all humans come in a range of hues from upstanding and truthful to petty and dishonest ...

Re:Good riddance to bad rubbish

[Anonymous Coward]

So it's YOU who have been spamming us with all those "Tired of spam?" e-mails?

Re:Good riddance to bad rubbish

[PyromanFO]

Nobody uses it outside of osirusoft because it is useless. By default most spam filters included osirusoft, which is the only reason SPEWS was used. Now they don't. Also, spamassassin decided to stop using osirusoft a couple of weeks ago, completely unrelated to this stuff. Still, good riddance.

Re:Good riddance to bad rubbish

[scrytch]

> SPEWS starts out with a listing of JUST the IP address that is spamming. It gets wider only if abuse reports are repeatedly ignored

Yeah, and now they've "widened" the block from the /24 to the /16, and now to his entire /0 ;)

Re:Good riddance to bad rubbish

[jbelcher56]

Same thing has happened to me. We can no longer email several business contacts because of Joe Jared and his lovely list. I had to change our IP address serveral times. It is starting to get old. We never spam, or send out email on mailing lists, yet we are punished becaue of those that do. There has to be a better solution than SPEWS!

Re:Good riddance to bad rubbish

[jidar]

hahah!
We never spam, or send out email on mailing lists,

If all you have to do is change IPs then that means your IP was targeted directly which means, barring open relays, the spammer being blocked is YOU.
My guess is some of the people on your mailling lists are reporting you as spammers.

Re:Good riddance to bad rubbish

[jbelcher56]

Jackass, Wait a fucking minute. Maybe it was because we had a dynamic IP and it changed to an IP that was used by a spammer? Do you think maybe that could be the reason? We switched to static and fixed the problem. Also, these lists block blocks of IP addresses, you could be blocked if you happened to get an IP address in that block even though you didn't spam anyone. We dont have an open realy. Oh, but I forgot, everyone on /. is a fucking genius and knows everything. Your late for home room fuck wad!

Re:Good riddance to bad rubbish

[Pete]

What they don't understand is that it costs real money to set servers up, and just as much to tear them down and move to another ISP.

I'll tell you something that I sure as hell understand. First, people complaining about being blocklisted always whinge that they can't move from their spam-supporting ISP because of cost issues. They also always try to exaggerate their cost of moving for dramatic effect (usually failing to grasp the fact that nobody really cares if they have to pay for making a bad business decision).

Tell you what. Let us know exactly how much it'll cost you. Precisely how much (in Australian or US dollars). Just take it from the detailed cost analysis that you've had done, listing several alternative (unblacklisted) co-location services in Melbourne (or wherever you prefer to be hosted). I promise to be impressed by the large figures and I will duly agree that that sort of figure is untenable for your business.

...Oh, you haven't got such a cost analysis? So you don't know exactly how much it'd cost you to move? So you were basically handwaving and pulling guesstimates out of your arse?

Gee. What a surprise. :-)

My company is in the business of fighting spam

Then it's a damn shame you're so ill-informed about the nature of the spam problem and about the other ways of fighting spam.

I'm drinking a bottle of red in celebration of SPEWS demise. Their goal was honourable, but their methods despicable and I'm thrilled to see them off the face of the earth.

So will you be vomiting the red back up again when you realise that SPEWS is still alive? (I hope not, that'd probably be a dreadful waste ;-))

The spews.org website may be unreachable due to a DDOS attack, and likewise the relays.osirusoft.com query site, but neither of those are needed for SPEWS to continue operations (osirusoft is certainly not needed at all). The blocklist data is still being maintained, and is still publicly available from many sources.

Pete.

sad news, but there are alternatives

[Indy1]

For mail admins around the world try these alternatives.

bl.spamcop.net
one of the best blacklists, it catches a huge % of incoming spam, and virtually no collateral damage.

blackholes.easynet.nl
almost as good as spamcop, and seems to nail a lot of the spam hauses

dynablock.easynet.nl
nukes a lot of the dsl and dialup spammers

argentina.blackholes.us
south american country, what more needs be said ? : )

brazil.blackholes.us
ditto

cn-kr.blackholes.us
china and korea, what more need be said ? : )

turkey.blackholes.us
whole lotta spammers here

sbl.spamhaus.org
a bit too conservative for my tastes, but gets a lot of spam gangs, and has very low collateral damage

bl.reynolds.net.au
if you want to use the spews list, this provides a feed for it

malaysia.blackholes.us
another spammy asian country

wanadoo-fr.blackholes.us
one of the worst european isps

hongkong.blackholes.us
another spammy asian country

Re:sad news, but there are alternatives

[Anonymous Coward]

You are a moron. Just because spam comes from other countries there is no reason to blacklist all of their IPs. I get more spam from the United States than from my own country (Brazil).

Re:sad news, but there are alternatives

[Czmyt]

I recommend bl.spamcop.net also although it costs money to use it for business purposes.

Re:sad news, but there are alternatives

[Anonymous Coward]

Nice going, asshat. I thought the point of the Internet was that it could bring in people from around the world, not just the U.S. and Western Europe.

I hope to God I never get a mail server admin like you.

Re:sad news, but there are alternatives

[Anonymous Coward]

Nice going, asshat. I thought the point of the Internet was that it could bring in people from around the world, not just the U.S. and Western Europe.

Hey, it's not his fault the majority of spam gets relayed through those evil countries. Not to mention they don't speak English anyway so you can't complain to the admins. Who cares if they don't receive e-mail from Korea or Brazil? The only people I want to talk to are in Western Europe, North America, and Australia.

Re:sad news, but there are alternatives

[Anonymous Coward]

I sure as fuck care if I can't receive e-mail from my business associates in HK and Korea, for one. I'm sorry you limit yourself to the western hemisphere and Australia, but plenty of us keep contacts in eastern Asia. As another anonymous poster already noted, a LOT of spam comes from the U.S. Should we blacklist the Americans too?

But who cares if they don't receive e-mail from France or Germany? Not to mention they don't speak English anyways.

Re:sad news, but there are alternatives

[Indy1]

why should i allow abusive traffic into my network? Its my network, my server, my rules. And the sad truth is, FAR too much spam comes from asia and south america. And their network admins DO NOT RESPOND to complaints at all. A lot of mail admins who dont need asia traffic or south american traffic often block out of hand most of 202.0.0.0/7 and all of 200.0.0.0/8. When South America and Asia clean their network abuse problem, I'll clean out my firewall spam blocks.....until then, they can eat the ether silence.

Re:sad news, but there are alternatives

[Indy1]

our business here uses bl.spamcop.net and they did not require any sort of payment, though i did donate
to them after using it and finding it to be excellent.

Re:sad news, but there are alternatives

[Indy1]

if one country bombards me with spam, and i get no legit traffic from that country, then that country gets introduced to my firewall. The mail and network admins in brazil DO NOT respond to abuse complaints. I do not do business in Brazil. Ergo, its a simple solution to plonk 200.0.0.0/8 port 25 into my firewall and be done with it.

Dont like it?
Then be part of the solution and start fighting network abuse in your country. Or you can whine like the rest of the plonked spammers and watch a boatload of mail admins nuke south america. There was an informal poll held in NANAE (network.admin.net-abuse.email) on how mail server admins block all of 200.0.0.0/8. And dozens if not hundreds of people replied they do block all of it. How long before it becomes thousands of networks block your country for spam abuse?

Re:sad news, but there are alternatives

[Indy1]

if i did business in those countries, i'd do selective white listing. Since i dont, I plonk the entire countries and be done with it. Every mail admin will blacklist what he needs to nuke as needed . As far as american spam, you should see my firewall, its LOADED with entries for XO, CW, level3, qwest, etc. I terminate all spammers, be it foreign or domestic. And if the network they come from is just a spam network, then the whole network goes, be it American or foreign

Re:sad news, but there are alternatives

[Czmyt]

I cannot find the page now, so I guess you're right. As of a couple of months ago, they were mentioning that $50 per year was an appropriate payment for use in a small business organization.

Re:sad news, but there are alternatives

[Spruce Moose]

Good riddance. Osirusoft and SPEWS are a bunch of useless fucks anyway. Have you read any of the posts to nanae? I'd give an example but you can choose pretty much any post on the list to prove my point. Jesus talk about treating it all like a big game.

God forbid if you get on the list by mistake (yes it does happen) and get treated like a spammer. Yes, collateral damage is the name of the game here. Too bad if you are caught in the crossfire and are trying to run a business, school or an open source or community mailing list.

I have never conversed with a bigger bunch of arrogant fuckwit wankers in my life.

Re:sad news, but there are alternatives

[targo]

Then be part of the solution and start fighting network abuse in your country.

BTW, what have you done to fight abuse in the US?
To me personally, spam blacklisting is a much bigger problem than spam itself because many organizations abroad (like some departments of my former Uni) with whom I sometimes have to communicate (I live in the US right now) blacklist all major US ISPs (MSN, AOL, Yahoo, AT&T) and justify this behavior with the arrogance of US sys-admins that tend to block all foreign mail. This tit-for-tat behavior does not benefit anyone and if anything pisses me off it's the arrogant attitude of sys-admins who for some reason forget their place and think they have absolute power to decide with whom the people in their organization may communicate with and with whom they cannot.

Re:sad news, but there are alternatives

[b1t r0t]

Don't forget 210.0.0.0/7 (Korea)!

Re:sad news, but there are alternatives

[varslot]

Yes, it is your network and your rules. However, they are also your users. Without your users, you will be without a job. Users need, and rely on getting their email. Even if there is lots of spam comming rom a certain country, don't you think you should allow your users to receive email from these countries?

I am saying this because I have been a user not receiving *important* emails from certain people because some network admin. decided that email from a particular subnet was not worth receiving.

Don't forget that you might hurt your own users by this approach. It is much better to let the users themselves filter email with user-level clients. It should be your job to make this easy/possible for them. Not deny users their email. I much prefer Mozilla's approach. Leave it up to the individual. Don't presume you are able to make the correct desission for others!

Re:sad news, but there are alternatives

[Anonymous Coward]

Its so refreshing to see that US Foreign Policy is also applied to (anti)spam. After all, nothing bad ever comes out of the good 'ol US of A, so we never need to list the US.

Re:sad news, but there are alternatives

[jimbobborg]

Actually, it is our place and we do have absolute power. Thank you.

Re:sad news, but there are alternatives

[qute]

You forgot the best one: ordb.dk

Re:sad news, but there are alternatives

[Mc Fly]

> South American Country, what more needs be said ? : )
Hey you fascist redneck, do you know that most of the spam coming to USA and Europe from the "outside" is payed by USA operations.
So great, go blocking several continents... Hope your company doesn't find it out

Re:sad news, but there are alternatives

[mvpll]

Damn, we've been invaded ....

whois -h whois.apnic.net 210.0.0.1
% [whois.apnic.net node-2]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnu m: 210.0.0.0 - 210.0.7.255
netname: OPTUSONLINESERVICES-AP
descr: Optus Vision
descr: National Cable Operator in Australia

And to the parent poster

whois -h whois.apnic.net 202.0.0.1
% [whois.apnic.net node-1]
% Whois data copyright terms http://www.apnic.net/db/dbcopyright.html

inetnu m: 202.0.0.0 - 202.0.15.255
netname: DOMEWA-AU
descr: Department of Minerals & Energy (WA)
descr: Mineral House
descr: 100 Plain Street
descr: East Perth Western Australia 6004
country: AU

Re:sad news, but there are alternatives

[PhoenixFlare]

If you're going to call someone a fascist redneck and insult their intelligence, you should at least spell "paid" right, shouldn't you?

*hides*

Re:sad news, but there are alternatives

[PhoenixFlare]

I agree with most of your post, but this part bears some discussion:

There was an informal poll held in NANAE (network.admin.net-abuse.email) on how mail server admins block all of 200.0.0.0/8. And dozens if not hundreds of people replied they do block all of it. How long before it becomes thousands of networks block your country for spam abuse?

From all appearances, those on NANAE are seen as grouchy, stubborn, drunk-with-power, vindictive nerds by most of those outside the list. Don't go thinking you're going to impress anybody with informal polls or whatever done by them.

Re:sad news, but there are alternatives

[Shimbo]

From all appearances, those on NANAE are seen as grouchy, stubborn, drunk-with-power, vindictive nerds by most of those outside the list.

And which market research firm carried out the poll for you? Or was it just the voices in your head telling you this?

Re:sad news, but there are alternatives

[PhoenixFlare]

Let me guess, you think i'm completely wrong, but...what's that? You haven't done a formal poll either? Okay then.

Anyway, I guess it would be an aggregate opinion, based on what i've read while surfing Slashdot, Fark, SomethingAwful, some public mailing lists for government installations, various smaller sites around the web, and reading NANAE itself.

The reputation that list has did not come out of nowhere- pretending it did won't help much.

Re:sad news, but there are alternatives

[sweet 'n sour]

It should be stated that if you have backup mail servers, you'll have to block that ip address range on all the servers since blocking it at one will only cause the spammer to choose your secondard MX instead. A better block would be to add the rule to your access file (Assuming you're using sendmail). Possible examples for that 8.0.0.0/8 range:

This will tell the sender that they've been blocked before the e-mail content is sent.
200. REJECT
This will accept the spam but silently /dev/null it.
200. DISCARD

Btw, does anyone know if the access file accepts cidr or netmasks for an ip address range?

Re:sad news, but there are alternatives

[Shimbo]

Anyway, I guess it would be an aggregate opinion, based on what i've read while surfing Slashdot, Fark, SomethingAwful, some public mailing lists for government installations, various smaller sites around the web, and reading NANAE itself.

Personally, I'd give a lot more weight to even an informal poll on NANAE, than a few people grouching off on /. and elsewhere. That does tend to select very heavily for unhappy campers.

To be fair, the subset of mail admins that read NANAE is likely to be more aggressive anti-spam folk than general.

Thanks for clarifying though.

Re:sad news, but there are alternatives

[jefp]

Blacklists are for chumps.

Re:sad news, but there are alternatives

[niom]

why should i allow abusive traffic into my network? Its my network, my server, my rules.

What an immature attitude. It's not your network; as long as you have users it's their network too. They're using it because they're confident that you will administer it in a responsible way.

To all the admins who say "it's my network": do you think you have the right to read your users' private mails for fun? Do you think you have the right the to delete mails from users whose names you don't like? Would the "it's my network" explanation work for those kind of actions? I'm curious.

Re:sad news, but there are alternatives

[Anonymous Coward]

and if anything pisses me off it's the arrogant attitude of sys-admins who for some reason forget their place and think they have absolute power to decide with whom the people in their organization may communicate with and with whom they cannot.

Ah, but they do have that power. And they are in fact paid to use it to protect the interests of whoever owns the equipment or service they are maintaining.

Re:sad news, but there are alternatives

[Pete]

Just out of curiosity, can you tell us the SPEWS record you were "mistakenly" listed under? When did it happen? Can you quote any Message-ID: headers so that we could check back in nanae and see how politely you asked for help?

No? Thought not.

Sorry, I'm just too used to seeing people misrepresent reality in their favour, then start obsfucating and/or hiding when someone starts asking questions. You sound far too much like someone who's just pissed off because someone else got the better of them. *shrug*

Pete.

Re:sad news, but there are alternatives

[Indy1]

I fight spam in the US by not supporting spam friendly isps. I fight spam by reporting what little spam i do get (thanks to heavy and agressive filtering / blocking) to both spamcop and NANAS and sending out LARTS to the spamhosters as well.

Re:sad news, but there are alternatives

[Indy1]

believe it or not, i agree with you. My users are involved with me as far as the spam blocking policy goes around here, and with a few tweaks and tune, we've struck a great balance between blocking spammers and blocking legit mail. What we currently do now is redirect all of the blocked ranges into a dedicated spam trap machine. If i accidently do block a friendly, i'll see their mail hit the spam trap, where i can then redirect it to the right user, and correct the firewall to not block them in the future. True spam that goes to the spam trap is reported to NANAS and spamcop, which helps the spammers get blocked even more ;)

Re:sad news, but there are alternatives

[Spruce Moose]

Here you go.

The fact that the TXT referred to a similar netblock suggested that perhaps it was a typo (why didn't they block all of datapipe?) but nooo, no-one would entertain that possibility at all. The thread is derailed into a smug argument about how superior SPEWS is and how stupid you are for choosing your particular ISP. Real helpful.

Re:sad news, but there are alternatives

[Anonymous Coward]

Indy1 (99447) says:
> sbl.spamhaus.org
> a bit too conservative for my tastes

By "conservative" I guess you mean "I don't see lots of blood of innocent users which is what I want to see". i.e: "has too little collateral damage for my tastes"?

> but gets a lot of spam gangs, and has very low collateral damage

which is the whole point. There's no spammer sbl.spamhaus.org doesn't block. A large block list doesn't need to create collateral damage to get spammers booted, just the fact a spammer is listed by sbl.spamhaus.org is enough to get him the boot because ISPs take sbl.spamhaus.org seriously.

Re:sad news, but there are alternatives

[Anonymous Coward]

Why not just use the current spews blacklist? Looks like that would accomplish about the same thing...

Re:sad news, but there are alternatives

[minas-beede]

"why should i allow abusive traffic into my network? "

Run with that thought. You apply it to your situation, rejecting traffic South America and Asia. What can they do in South America, in Asia?

Should they allow abusive trafic into their network?

If they (and others) would take simple, reasonable actions against the spam coming in there very soon would be no spam coming in. They don't have to get all their IPs cleaned and secured, they just have to in some way end the abusive traffic. Proxypots are a tool very useful for that.

Once a spammer learns an ISP or a country is no longer a pushover he'll stop using that ISP or that country to relay spam. In the mean time he'll send a lot of spam that does not reach its destination. He loses now, he loses later. That's good.

matrix.net

[bucketoftruth]

Due to all these viri and ddos's over the last month the reachability index at xaffire has been pretty rocky. Fun to watch though.

Garbage

[josh crawley]

I'm sorry, but this guy is a true blue asshole. My condolences for being DDoSed, but by banning "the world" to try to tell people to stop using his service ASAP, plenty of legitimate non-spam email got blocked, meaning that people may have to resend, and in some cases may not even know their email was missed. That's worse than spamming, people.

Oh, I forgot, the standard propaganda line from these SPEWS.ORG type anti-spam fundamentalists is "we didn't block your email, the ISP using our service did, blame them."

Re:Garbage

[secolactico]

"we didn't block your email, the ISP using our service did, blame them."


And he does have a point. The blame is entirely on the admin that set up SPEWS as a blocking option. Why trust a third party to maintain your blocklist out of the kindness of their heart?

I'd much rather pay for it. That way, there's a contractual obligation. Accountability is a must in the business world.

However, the only policy I disagreed with SPEWS was the anonymacy (sp) one. While I understand the reasons behind it, I can't quite trust a provider that gives no appeal resource and the removal instruction are far too vague (post a message in a newsgroup and hope for the best).

Well, I guess they'll be picked up by another dsbl provider.

Re:Garbage

[sweetooth]

When he put up the black list an error message was returned saying unable to deliver message smtp connection refused "Stop using relays.osirusoft.com." Or something along those lines. You couldn't not know your email wasn't sent unless your mail client was severely broken.

Re:Garbage

[josh crawley]

How about this. Your credit report is vastly inaccurate. This seems to be due to some guy with a similar name to yours who buys a lot of expensive stuff and never pays his bills. You have contacted the credit reporting agency to ask them to fix this and have provided full information, but they are either ignoring you or taking their sweet time. They also treat you like a deadbeat jerkoff. Meanwhile, you have plenty of income, but can't get a home or car loan.

Are you supposed to go after the company that won't give you a loan and try to convince them to do so in spite of this? And how did any of this become your problem to spend time solving?

I think you can see the analogy here.

Re:Garbage

[josh crawley]

It depends on if my own MTA is set to deliver NDRs. Mine does, but the message returned by the refusing MTA was "Your mail server is on relays.osirusoft.com's blacklist". The only way I get the message about "Stop using relays.osirusoft.com" is if I dig for text records for relays.osirusoft.com. Even then, it doesn't do shit for me because it's the other guys ISP which is using the blocklist. The other guy doesn't know about the NDR, so I have to call him, or call his ISP. So basically, I personally have no dealing whatsoever with Joe Jared, but he's succeeded in creating extra work for me. Sounds a lot like a spammer.

Re:Garbage

[SirFozzie]

And the usual bullshit from clueless morons continues.

What the Fsck is he supposed to do, drop it silently and then continue to get hammered by 100,000 queries an hour? Personally Call each and every ISP that uses his lists? Remember, he can't use the net to do this, because some dipwad jerk is DDoS'ing the crap out of him and other anti-spam sites.

Oh, I forgot, the standard line from these spews.org haters is "I don't care if my ISP is letting spammers hijack relays and fuck up the net, I Want my EMAIL WHAWHAWHAWHA"

Re:Garbage

[LoadWB]

As an admin myself, I found this problem somewhat frustrating, but easily correctable.

However, I think its fabulous. By banning the entire world, JJ has shown that the world as a whole is responsible for this spam mess we are all facing, and that he's not showing favoritism for everyone.

(How to I qualify the world? Easily; first the spammers, second the phuqwits that buy from spammers, third the idiot politicians that don't understand the problem, fourth the jackass politicians who don't care about the problem, and fifth the apathetic users who ignore the problem but bitch about it all the time.)

In the end, I think this is quite funny. Sure, I had to reconfig about a dozen servers, but 1) I got to bill time for it, and 2) it's not that big of a deal.

Re:Garbage

[bedouin]

My university uses the spews list, and I've missed tons of messages tonight because of it. I think I'm more angry at the admins who haven't removed the filtering though.

What really freaked me out was when I sent a message from a shell account, got it through, and then was blocked after the second message. Before I found out about this blackout and I thought someone was blocking me intentionally :)

Re:Garbage

[josh crawley]

What the Fsck is he supposed to do, drop it silently and then continue to get hammered by 100,000 queries an hour?

If that's his concern, unplug the fucking wire. Change DNS resolution for relays.osirusoft.com to a blackhole address. Change the IP.

Personally Call each and every ISP that uses his lists? Remember, he can't use the net to do this, because some dipwad jerk is DDoS'ing the crap out of him and other anti-spam sites.

Obviously, the box in question is able to return DNS query responses, so it's not DoSed off the wire. Since the blocklist is typically queried by SMTP servers, by logging the IP addresses which query, he has an instant list of all the SMTP servers of people who use the service. He can then reverse-lookup these, and send an email to postmaster@whatever, CC:ed to root and whomever else. He can use a separate machine and IP to do so so this traffic is not affected by the DoS.

There, that's a responsible way of dealing with the problem, and if you'd like I can write a script to do it automatically. The way in which he dealt with this is not responsible, given that he chose to run a blacklist service which he knew was being used by administrators to block email. He was well aware that by doing this, he would affect innocent people.

Then again, to the spews.org crowd, anyone who doesn't devote their life to their single minded pursuit of purifying all email traffic is a guilty party.

Oh, I forgot, the standard line from these spews.org haters is "I don't care if my ISP is letting spammers hijack relays and fuck up the net, I Want my EMAIL WHAWHAWHAWHA"

This is precisely what we recite at the beginning of every regional meeting of The Spews.org Haters Association; how did you find out?

Re:Garbage

[Vermifax]

Actually according to standard NANAE retards, he should find a new isp and/or get a new ipaddress.

Re:Garbage

[SirFozzie]

Well that's because your spam-spewing-supporting ISP won't get off their spammer-paid ass to DO something about the problem, thus LANDING you on the list in the first place.

Re:Garbage

[SirFozzie]

Because it's something crybabies would whine repeatedly, bashing their fists against the ground.

You have no RIGHT to EMAIL. There is no "Pursuit of Life, Liberty, Happiness and 100% working email".

If you lay down with dogs (have a spam supporting ISP), you get fleas (people don't want to deal with your email because your ISP doesn't give a fsck about fixing their problems)

Re:Garbage

[Vermifax]

Erm....lets try this again....

You:"What the Fsck is he supposed to do, drop it silently and then continue to get hammered by 100,000 queries an hour? "

Me:"According to NANAE retards he should get a new ISP/IP address"

You:"Well that's because your spam-spewing-supporting ISP won't get off their spammer-paid ass to DO something about the problem, thus LANDING you on the list in the first place."

In case you hadn't noticed, I said nothing about ME getting a new ISP/IP address, I was answering your 'WTF is he supposed to do' question. I've never had my email rejected by any blackhole list.

Re:Garbage

[secolactico]

Yes, I see what you mean. But at least the credit report agency has a point of contact and that sets them apart from SPEWS.

I know very little of banking and financial institutions. But I guess the banks pay the agency for their services. My point was that SPEWS/Osirusoft are (where?) maintaining the list as a service to the internet community. As comendable as that might seem, this implies that nothing is guaranteed (sp?) and if your business depends on e-mail, you should know better than to use them.

A financial agency has to strive for accuracy. After all, it's better for the bank (that pays the agency) if you qualify for a loan.

And if it comes to the worst (and reason is with you), you can always try legal pressure on the agency (IANAL). If you try that with a dsbl, even if you are right, you'll get labeled as a "cart00ney".

Re:Garbage

[CurlyG]

How the fuck are you supposed to do that if there's only one ISP available to you, you goddamn self-righteous genius?

Re:Garbage

[SirFozzie]

Ok, mea culpa on that. I read that wrong.

That's my standard response to folks who whine about being added to the list. If their ISP's gave a fsck about the net, they would do the right thing ;)

Re:Garbage

[SirFozzie]

Too fscking bad. As I sad before, you have no right to email. If your ISP is such a monopoily that it thinks it can crap up the net and host spammers willy nilly, I have NO pity for those blocked until the ISP gets a clue.

Remember, the Internet is a cooperative enviroment. In the older days, if one node was screwing up the rest of the network, it got pulled, and be damned if you were using it.

I hate to say it, but those WERE the good old days.

Re:Garbage

[leviramsey]

Raise a stink with your Congresscritter to try and get them to write a letter to the President of the University threatening to remove as much federal funding as possible as soon as possible unless they quit using SPEWS.

As for any university admin who deploys any DNSBL on their network, you deserve summary execution.

Re:Garbage

[josh crawley]

You're a funny guy, Nice chatting with you.

Re:Garbage

[CurlyG]

You -and anyone else defending or using this moronic service- are clearly as much a part of the problem as the spammers themselves.

I'm not in the slightest bit against using RBLs - I do so myself - but denying services to thousands of people who have done nothing wrong and generally are unable to do anything about it anyway is exactly as damaging as sending the spam in the first place.

Where do you get this nonsense about having a right to email or not? Who mentioned having a right to it?

I pay for a service and it's denied to me because some irresponsible zealot nutjob has decided that an upstream provider to the ISP I use has provided bandwith to another ISP that has a user that has been alledged to have sent spam. No proof, no recourse. I *know* there's no legal or practical way I can stop this and that nothing I do or say to my ISP can have the slightest effect (and even if it did there's no way to get off the blocklist anyway), so frankly I celebrate when this fucking headcase and his mates give it up in the face of massive protest.

And if you're considering trying the line about how SPEWs don't blacklist, the admins that use it do, just forget it. That's a weasle excuse at best, and seems to me to admit that the service was as useless and damaging as it indeed was.

Re:Garbage

[SirFozzie]

Wish I could say the same.

Re:Garbage

[SirFozzie]

You- and anyone else whining or protesting that you can't affect your ISP are clearly as much a part of the spammers themselves.

You enjoy the DDoS's that's happening? Great. Hope you enjoy your spam.

Re:Garbage

[Anonymous Coward]

That's right - don't frick up My Net with your stupid capitalist pig business email - I need my pr0N!! NOW!!!! (Wait, my Mom's coming down the stairs - l8ter d00d)

Re:Garbage

[Lost Race]

Please, let us not cheapen the concept of summary execution by wasting it on anyone other than spammers.

Re:Garbage

[Anonymous Coward]

guy, you're absolute idiot, get a life

Re:Garbage

[Anonymous Coward]

God you're a fucking idiot. I hate you. Go die. You've OBVIOUSLY never been on the blocked end of SPEWS. Ever buy a T1 dumbass? You sign a multiyear contract usually. Sometimes you _cant_ switch ISPs. I really hate people like you.

Re:Garbage

[Anonymous Coward]

Actually, it's not "I wan't my e-mail", it's "I want to force my e-mail down peoples throat".

Just said in a different way.

Re:Garbage

[Anonymous Coward]

For some stupid reason, that's what congress seems to think. You can't even hold the credit reporting company liable. I wont rant more.

Re:Garbage

[Anonymous Coward]

Because it's something crybabies would whine repeatedly, bashing their fists against the ground.

Strange, but you're the biggest whiner here. Lots of all caps and name calling. Think about it. Who looks like a cry baby?

Re:Garbage

[PhoenixFlare]

Remember, the Internet is a cooperative enviroment. In the older days, if one node was screwing up the rest of the network, it got pulled, and be damned if you were using it.


Gee, maybe most people have figured out that it's not a good idea to throw the baby out with the bathwater these days?

Sorry, but not everyone shares the attitude of the holier-than-thou asses on NANAE.

Re:Garbage

[SirFozzie]

No, they just see the net as something they can abuse and not give a fuck about the results on the rest of the net.

Sorry, but not everyone shares the attitude that Abusing the net is ok.

Re:Garbage

[Anonymous Coward]

the ISP should have been on the ball. As a mail administrator I have had to delete ref. to the blacklist.

Re:Garbage

[Brendan Byrd]

SPEWS suck. Plain and simple. I'm glad he got DDoSed (though I don't agree with the methods) because his list blocks a lot of legitimate e-mail AND it's popular, which is a bad combination. Kill it, admins, and let it die die die!

So what DO we do?

[RealisticWeb.com]

I would like some serious talk about just what exactly we ARE supposed to do about spam. Government moves too slow to pass an effective law, and the spammers don't abide by the law anyway. Filters don't work effectivly, blacklists are not working either apparently. Does anyone have a usefull suggestion about how to fix this problem?

One idea I've had (or maybe I've heard it somewhere else, I can't remember) is authorization. Change the protocol, or maybe just implement at server, so that before anyone can send you an email they have to request permission. In that request they would identify themselves, and before they start emailing you stuff you would have to send them back permission. Anyone that is in your contact list would automatically be given permission. If it turns out to be spam you could revoke permission. Also analyze the email header and do reverse lookup to see if the domain names resolve properly. If a domain is spoofed, deny it automatically.

Perhaps this has been done before, and I'm sure there are flaws, but I am tierd of hearing about how big a problem this is, without hearing any good ideas about fixing it. Any other thoughts?

Re:So what DO we do?

[Basehart]

When you waste time every day going through the spam that got through your IPS's filters, and your own filters, deciding what is, and what is not actually spam, you are effectively doing what you suggest in paragraph two of your post, namely wasting time going through your mail and deciding what is, and what is not actually spam. The only difference is you would have to notify the non-spammer that you did indeed want them to send you some mail, and how would they know you weren't them spamming them?

Re:So what DO we do?

[Basehart]

IPS should read ISP. Ok, ok, I didn't use the Preview button just this one time and see what happens!

Re:So what DO we do?

[AKnightCowboy]

One idea I've had (or maybe I've heard it somewhere else, I can't remember) is authorization. Change the protocol, or maybe just implement at server, so that before anyone can send you an email they have to request permission.

You mean like TMDA? From their freshmeat description:

The Tagged Message Delivery Agent (TMDA) reduces the amount of SPAM/UCE (junkmail) you receive. It combines a "whitelist" (for known/trusted senders), a "blacklist" (for undesired senders), and a cryptographically-enhanced confirmation system (for unknown, but legitimate, senders).

The problem is, that's fine and dandy for most things, but are you sure every mailing list you're on is whitelisted? Did you remember to whitelist any companies you do business with? I'm sure their auto-responders aren't going to respond to your automatically generated cryptographically-enhanced confirmation system so you may not ever get that info about your eBay bid or the receipt for an online purchase. You may have whitelisted store.com but their confirmation mail comes from store.yahoo.com, etc. What do you do? It's an annoying problem. I say legalize the ability to punch known spammers in the nuts once per spam message. That should fix the problem.

Re:So what DO we do?

[Jeremiah Blatz]

Filters don't work effectivly

Funny, Mail.app caught all but 3 of my 309 spam messages yesterday. I probably get about 1 false positive in 5000. Maybe your filters just suck?

Re:So what DO we do?

[Chester K]

Perhaps this has been done before, and I'm sure there are flaws, but I am tierd of hearing about how big a problem this is, without hearing any good ideas about fixing it. Any other thoughts?

There are plenty of good ideas -- the problem is that you need a massive amount of support to get something off the ground because the whole concept revolves around the mail servers cooperating on a new method.

The IETF is probably the only group with enough ears listening to them to be able to pull it off.

Re:So what DO we do?

[complete loony]

Hows this for a suggestion; we need a protocol where mail server's can verify each other and prevent spoofing of messages passed between them.

Can't SSL be used in this fashion? issue each ISP's mail server with a key which can be used in all email conversations.

The ISP should then be able to issue, and later revoke, sub keys to their customers. As I understand it this is how the SSL certificate process works (well maybe not revoke).

It is then up to the mail server to authenticate the user (which could also use SSL keys buy this becomes problematic and hard to manage).

Abuse reporting should (in part) be handled automatically by the mail server to black (or grey?) list the offender.

After being reported for abuse, perhaps emails could still be sent, but flagged by the sending mail server as potentially suspect (evil bit?) allowing the final recipient of the email to decide to filter the message.

Re:So what DO we do?

[RyuuzakiTetsuya]

BULL SHIT.

If we can get a federal ban on spam then we could EASILY get those spammers in Jail.

Hello McFly, they leave thier URLs and their money needs to get to them anyway...

Re:So what DO we do?

[badzilla]

BULL SHIT.

If we can get a federal ban on spam then we could EASILY get those spammers in Jail.

Umm, I'm guessing you're American? Sounds to me like your proposed "federal ban" could only work for spammers who live in your country. Good luck demanding that some spammer in Korea/Estonia/Nigeria gets tossed in jail next time you get a viagra ad.

Re:So what DO we do?

[kajiki]

Geez, has everyone forgotten about PGP already? A corporation could require that all business email is at least signed. Unsigned email is likely to be either spam or irrelevant to business (unless it's support mail from non-corporate users) and should, if nothing else, be led into a separate filter monitored by someone. This would also mean that all attempts to fake the sender would be detected immediately.

For private persons, other solutions will probably be neccessary since no mail client developer ever considered how nice it would be if this was an integrated feature. Well, at least the only client I've used which had anything like this was Powermail, and its PGP implementation was rather clunky.

Re:So what DO we do?

[danila]

You ask what do we do? How about real-word harrassment? Poison their dog, threaten their kids, put a head of a dead horse into their bed. Get a flashmob and trample down their lawn, piss on their car. There are millions of ways, the only necessary thing is to find their real-world contact information. A few well-publicised cases of spammer's suicides (suicides?) will do a lot in resolving this problem.

Re:So what DO we do?

[Simon Brooke]

Funny, Mail.app caught all but 3 of my 309 spam messages yesterday.

Yeah, yeah. And SpamAssassin has filtered out 562 spams for me since yesterday... at an average of 100K each or 50 megabytes in total. That's 50 megabytes of my upstream bandwidth that I've paid for.

This is not a solution. At best it's hiding the problem from us so we don't deal with it. A staggering proportion of the backbone bandwidth of the Internet is being eaten up by UCE, worms and other malware traffic.

We have to do better than this and an authenticated replacement for SMTP has to be one of the places to start.

Re:So what DO we do?

[Anonymous Coward]

>Also analyze the email header and do reverse lookup
>to see if the domain names resolve properly. If a
>domain is spoofed, deny it automatically.

This is not so great an idea either. Me and a lot of people I know run their own mailservers on a cable connection for outbound mail. I do know how to set up my mailserver properly and no one can abuse it. I cant however afford a machine thats 24hrs on the net and have to send mail from the domain I want to send with. Lets say @linux-delhi.org I would have to spoof it. Me and all these people who do this do so to learn how a mailserver works and the best way to learn nything is to do it. My mails get blocked or dropped for example on the freebsd list. So I cant post on the freebsd list even if i know the answers to every query. In my view checking reverse lookup is not a very nice thing to do. In effect you are stopping from young ones from learning.

Re:So what DO we do?

[radish]

The vast majority of spammers are american. As has been stated a million times, they may be using relays in china/korea/wherever but they're sitting pretty in Nowhere Alabama with a cocktail. Get rid of them and you'd have made a big impact (although I'm sure others would step in to fill the void). The other fact is that many of the companies being advertised via spam are american, so again, go after the sources of funding.

Re:So what DO we do?

[cluge]

Baseball bats and a bunch of friends and go spammer hunting. Until you take the consequences of spamming out of the cyber world and put them into the real world, you won't get anywhere. The best you can hope to do against spam is tread water.

Why do I have this atitude?

A certain 3 year old I know gets PORN spam, boy his mother is happy about that. At work we have had to invest LOTS of money just to keep up with the spam. This was mostly for new mail servers that wouldn't be needed if more than 50% of the incoming mail wasn't spam. Run spamassasin for 50,000 people and see how much it costs in equipment!

Spammers say that they don't hurt anyone, bullpuckey the above examples are proof that they do hurt people, they cost us money, and they don't care. If we take the consequences out of the cyber world and bring it into the real world, they WILL care. How you decide to do that is up to you.

Suggestions, besides hiring Vinny the Enforcer to visit your neighborhood spammer?

cluge

Re:So what DO we do?

[Kishar]

Suggestions, besides hiring Vinny the Enforcer to visit your neighborhood spammer?

Yeah, for starters, how about not giving an unfiltered email account to a fucking 3 year old.

Now that the inflammatory "fur da chilrun" part is gone, you can concentrate on a reasonable anti-spam solution. Perhaps you can make it the next Ask /.

Re:So what DO we do?

[Anonymous Coward]

1. The 80-20 rule applies to spammers too, find the worst of them and persecute them (yes I mean persecute, not prosecute). It works, one gave up just recently.
2. Compose a letter to Congress, for every spam you get, append it to the letter and email them to Congress, instead of just deleating the spam. They will feel our pain. Then we'll get some laws we can use to prosecure the spammers. This can be semi-automated. While spammers may move their relays offshore, that doesn't exempt them from the laws of the country they live in.
3. Spammers routinely forge From headers, and the Sobig worm looks to be setting up compromised systems as spam relay nodes, but a spammer has to have valid contact information in the body of the message, otherwise what's the point. So Bayesian filters will continue to work, despite the spammers efforts to get through them.
4. Spammers can make good money with a response rate of .25% (yep, 1 in 4,000). So forget about teaching people not to respond. But if email wasn't free ...

Re:So what DO we do?

[cluge]

Yeah, for starters, how about not giving an unfiltered email account to a fucking 3 year old.


It IS filtered , and he doesn't access it, his mother does. The shit STILL gets through. Imagine on an account that has never existed on a domain that has been in existance for more than 12 years and it gets porn spam that beats spam assassin. Oh yeah, on a domain that has only about 40 active e-mail accounts. njabl blocks more than 75% of attemtped connects from mail servers - how crazy is that?

What makes you think I want a "reasonable" anti-spam solution? I want to make people PAY for what they put me through -

Bayesian Filtering

[someguy456]

I can't completely describe my satisfaction with Bayesian filtering. I've been using SpamBayes for a few weeks w/ Outlook (please don't smite me), and it hasn't let me down. I have received absolutely no spam in my inbox these last couple of weeks. Granted, I built up a collection of >500 unwanted e-mails, but it only took a couple of days :)

Re:Bayesian Filtering

[bucketoftruth]

Hooray for Bayesian filtering! I've got spamassassin running on all my servers blocking spam before it's even delivered. I get about 150 spam emails in my spam folder each day. Only 2 or 3 per week get through into my inbox. So far I, personally, have never had a false positive, but it's easy to fix with spamassassin's learning features and simple whitelisting.

Re:Bayesian Filtering

[Anonymous Coward]

filtering is fine for the end user: it does nothing to stop the problem but hide the symptoms from the end user. but the cancer is just waiting to get out of control...

Re:Bayesian Filtering

[TheRealSlimShady]

I found the SpamBayes plugin for Outlook broke some bits and pieces. Most annoying for me was the autocomplete of cached email addresses - it would show the list but the entries weren't actually visible. It's listed as a bug on their web site, but no indication of a resolution date. Apart from that it worked really well, no false positives.

Re:Bayesian Filtering

[Anonymous Spammer]

As a professional sender of UCE, I just want to tell you slashdotters to keep on playing with your spam filters. As long as you use spam filters on your e-mail, I can continue to reach my real intended targets, those non-slashdotters who do not know better and will buy my products or click through to my client's websites. Your filters really help cut down on the complaints to the Internet service providers I do business with, and as long as not too many complaints come in their marketing people assure me we can do business. Of course, I still waste your bandwidth and mailbox capacity, but you no longer complain to uce@ftc.gov, my access providers, or anyone else who might cause me problems. My yahoo and hotmail and other accounts for replies are lasting much longer before getting shut down because someone complained to these service providers. And my clients are even reporting that they can start mailing out 800 numbers like 1-800-901-3719 again and they will not have you damn geeks set up your modems to keep autodialing them, since you spend your own time and effort to filter the e-mail and only clueless users who might actually call will see the numbers.

Please don't bother your Congressmen or Senators proposing legislation that might not work 100%. Just keep on filtering the spam I send you, I know you would have never bought from me anyway. That you can filter legitimizes my business and my waste of your bandwidth.

P.S. To be sure of not getting a false positive, be sure to send all filtered mail to a special folder. Waste your storage space storing the mail until you manually go through every piece to be sure you didn't accidentally filter something important. Of course, this will take exactly as much effort as it would have to just check the e-mail when it first came in, not to mention the extra effort spent in setting up the filters and the extra space for storing your incoming spam folder, but what the heck. If you think that you can scan e-mail for false positives faster this way you are just fooling yourselves, if you are scanning faster e-mail that you expect to be all spam, you will miss the very false positives that you think you are looking for. And any fales positives that you do catch will have been delayed, perhaps days or more. You geeks enjoy wasting time this way, and I certainly appreciate it. It makes the work of all us spammers much easier. After all, slashdotters like Moderation abuser tell you that Bandwidth is cheap, disk is cheap, CPU is cheap , which is good, because at the rate spammers like me waste it the costs still adds up. I am gald I never pay for it, and I would just as well that everyone else takes the additude that all of the resources I waste are cheap than band together and pass laws against us. No one should care about spam because Bandwidth is cheap, disk is cheap, CPU is cheap and it is your job to filter it.

Think you've seen this before? Don't complain. Just go through lots more work to set up special filers on your computer so that you will not see it again. You should have to do that. It's the true geek solution, and I would really like it if you did.

Re:Bayesian Filtering

[Snover]

I've had problems with the Bayesian filtering in Mozilla; I suppose it just needs a bit more work. I mean, it catches ALL my spam, without contest, but it also catches automated messages from places like amazon.com. Unfortunately, even Bayesian can't overcome this problem.

No, the real solution is to have a trained monkey personally sort through your mail beforehand.

Re:Bayesian Filtering

[bobbozzo]

I can't completely describe my satisfaction with Bayesian filtering.

I second that... BogoFilter is great, it catches 95% of our spam that gets through spamcops RBL and a few other checks I have sendmail do.

Re:Bayesian Filtering

[afidel]

Have you made sure to unmark every incorrect email? Also turn off auto-placement and select all your legit email, if any of it gets flaged as spam untag it, then do the opposite with spam, if any of it gets unmarked by the filter remark it as spam. This will significantly increase your hit ratio and lower your false positives. For me it is about 99.7% effective and about 1.5% false positives, none of which have been important emails (mass mailings from companies I have a legitimate business relationship with, but their mass mailing address wasn't yet in my personal address book to get whitelisted)

Re:Bayesian Filtering

[randyest]

I can't moderate here because I've posted in this thread, but this isn't a troll folks. Just because it's written from an evil spammer perspective doesn't make it a troll. It includes several good points. If this is a troll, then so is every other post in this thread.

Re:Bayesian Filtering

[Silverfish]

Put the addresses those companies send from in your address book.

Mozilla automatically uses your "Personal Address Book" as a whitelist. If yours isn't set up that way, you can do so via "Junk Mail Controls" under the Tools menu.

Re:Bayesian Filtering

[blackbear]

Filtering of any sort does not solve the problem, it just treats the sysmtoms.

Spam wastes bandwidth, and costs money. If I wait until it's delivered and run an automated filter, I still pay to receive it, I just didn't have to spend time deleting it. Whoopee! I want my bandwith back! That means not accepting the spam in the first place.

So far, the only workable technology I've found is DNSRBL. I whish I had a better idea, I could probably make a HUGE profit on it and still save people money. But I don't. Filtering is nice for spam that gets through and it works well. But it's like having a 1gpm sump pump and a 10gpm hole in the boat. It's gonna sink eventually.

Re:Bayesian Filtering

[MrScience]

Not if you sort by subject.

Re:Bayesian Filtering

[Tamerz]

That's why I use SpamCop.net It does an excellent job of filtering and also allows you to report spam.

Re:Bayesian Filtering

[Snover]

Yes, I have. :)

Re:Bayesian Filtering

[Anonymous Coward]

I just took all 378 emails in my spam folder and forwarded them to uce@ftc.gov. Thanks for reminding me to.

Re:Bayesian Filtering

[Kinniken]

I just have a an automatic rule doing the same. OK, a false-postive might slip in, but they are rare and I'm not paranoiac.

Re:Slashdot Censorship

[Anonymous Coward]

"w30wnzj00.com" ? Sounds like troll...

blacklists -- bah!

[jxliv7]

Having never been a fan of blacklists, it's good to see one fail.

A blacklist is like the death penalty -- there is no 100% surefire positive no-mistakes without prejudice way to protect the innocent.

Look at the results of blacklists as similar to the casualties produced in a war -- you may kill a good many of the enemy, but how many of them were civilians?

Re:blacklists -- bah!

[gorbachev]

If you learn anything by past occurances, all this means is that the next generation of blocklists will be even more BOFHish.

That has been a consistent development since MAPS RBL became d***less. Every single blocklist that followed another one that went down, was more strict than the one it replaced.

Whoever is doing the DDOSing the nameservers of SPEWS and osirusoft is pretty achieving nothing in the end.

Re:blacklists -- bah!

[steeviant]

If you learn anything by past occurances, all this means is that the next generation of blocklists will be even more BOFHish.

I spot a fatal error in your reasoning, I contend that it's not actually possible for anyone to be more BOFHish than Joe Jared.

Re:blacklists -- bah!

[whoever57]

A blacklist is like the death penalty

Not at all, it depends how you use them. You have 3 choices:
1. Use them to block at the server or
2. Use them to tag incoming email or (the one I favor)
3. Use them as part of your spam scoring system.

The last is a built-in feature of SpamAssassin and works well.

Re:blacklists -- bah!

[Anonymous Coward]

The analogy breaks down in that you can get OFF a blacklist, while it's a tad harder to reverse an execution. Yes, it may be difficult, but it's possible, which just means that if you don't like it you should come up with a better way.

The problem is that it's hard to run a decent blacklist, considering how irresponsible various ISPs are. How much research needs to be done to identify the smallest possible domain that an ISP owns? How do you verify spam complaints? How do you tell an honest-but-I-made-a-mistake domain owner from a lying spammer, in general?

"I told him I wasn't a spammer, and he didn't believe me!" doesn't wash.

Is there a better way?

Personally, I think the correct approach would be to provide all the details about the user when they're caught spamming, even if only to those who received the spam.

You spam/scam me, I complain to your ISP, your ISP verifies the spam, and tells me your full (real) name, you mailing address, driver's license/ID #, etc.

Naturally, this will lead to spammers lying to an ISP -- but that just means the ISP can have a little side-income by suing spammers for breach of contract or fraud or somesuch.

SPEWS was shit

[Anonymous Coward]

It's nice that they tried to fight spam, but when your lists interfere with legitimate business, it's time to back down.
Assholes.

perhaps this is a lesson that needed learned

[Cogneato]

As someone who was blocked by both osirusoft and spews as part of their policy of blocking entire IP blocks, I feel no pity for them or for those who use them. In fact, I hope that at least some of them are learning their lessons.

The IP address of my server happened to fall a few dozen numbers away from that of a spammer. As a result, it cost me thousands of dollars in lost time and expenses to track down the issue, contact my isp and have them contact whoever it is on Mt. Self-Righteousness that takes you back off the list. Getting on the lists takes day(s), while getting off the lists takes weeks.

Blocking entire IP blocks is nothing short of techie-terrorism. In other words, you can't convince the real wrong doers to stop, so you harm the innocent bystanders to try to get them to revolt.

SPEWS and those that support them point the finger at the ISP while purposely hurting innocent small businesses like mine. It's time they take responsibility for the tools they provide, and in this way, they are no different than Microsoft.

Re:perhaps this is a lesson that needed learned

[Todd Knarr]

How about, instead of contacting your ISP to get you off the list, you contact them about not allowing spammers on their networks in the first place and/or terminating their accounts before the spammer lands the ISP and their customers on a blacklist?

Re:perhaps this is a lesson that needed learned

[Mad Bad Rabbit]

You say SPEWS should only block the spammer's IP address
and not yours. Then what incentive does your ISP have to
not to play whack-a-mole? (i.e as soon as a spammer js
blocked, the ISP just hands them another unused addy
in your neighborhood. And another, and another. Maybe
swap your address with theirs, too).

At what point shouldn't SPEWS just say screw it, block
the whole class C (instead of waiting for the next one
to popup)?

Re:perhaps this is a lesson that needed learned

[DevilM]

Are you serious? Imagine what would happen if we applied the same logic to other problems facing society. I can see it now, arresting whole neighborhoods because a single criminal was living there.

SPAM is a real problem and it won't be solved by brain-dead solutions.

Re:perhaps this is a lesson that needed learned

[DevilM]

ISPs are in the business of transmitting data. When you start forcing them to inspect the data they transmit you are asking for a whole host of larger problems than SPAM.

SPAM is a tough problem, but that doesn't mean the solution is to blame or attach --which is what you are suggesting-- anyone.

Re:perhaps this is a lesson that needed learned

[Cogneato]

My point exactly. You hit me to get me to complain. Did you ever think that I don't want to take that active of a role in your war? Did you even bother to ask me if I wanted to participate? Are you, or anyone who uses the list offering to help me out with the costs of forcing me to be your soldier?

Here's the deal I am willing to make: if you are going to block an entire C block that I am part of, send me an email and let me know and then I will happily complain to my ISP until I am red in the face. I am willing to make that promise.

But... if you want to just slam me on a list without any regaurd for the costs it will incur for me, then don't expect me to be a happy little soldier. It's just not going to happen.

Re:perhaps this is a lesson that needed learned

[William Tanksley]

At what point shouldn't SPEWS just say screw it, block the whole class C (instead of waiting for the next one to popup)?

I guess your answer is the same as SPEWS': "Don't ask, don't think, just nuke 'em all." The correct answer would be to think about it a while -- zero offences (i.e. a SINGLE spammer) shouldn't nuke the ISP; a documented shifting of spammers should (since the customers are having their costs reduced by spammers); and the space in between should be a documented grey area. The advantage of a centralised list like SPEWS is that this sort of judgement _is_ possible; spammers can dodge, but ISPs are a little less mobile.

Sorry, SPEWS is harmful to innocents, and therefore is harmful to blacklists.

-Billy

Re:perhaps this is a lesson that needed learned

[zakezuke]

Blocking entire IP blocks is nothing short of techie-terrorism. In other words, you can't convince the real wrong doers to stop, so you harm the innocent bystanders to try to get them to revolt.

In some cases blocking whole IP blocks was justified. I prefer spamhaus as a whole due becaue it makes my life easier making a valued judgement whether or not to block a whole block.

Spews does not seem to acknoloage the fact that they practice a form of censorship by encouraging others to censor out specific sites. What I find worse are their users who don't seem to understand that they are censoring sites. I use spamhaus my self and I freely admit i'm the final censor who is engaging in the censorship of unsolisited marketing materials.

Re:perhaps this is a lesson that needed learned

[Todd Knarr]

It isn't a matter of inspecting data, it's a matter of a) putting in place an AUP that says "no spamming" and b) enforcing that AUP.

Re:perhaps this is a lesson that needed learned

[GoofyBoy]

Thats like the police arresting everyone in the neighbourhood just because there is one criminal who the police saw run into a house.

Or the police shutting down an entire mall because one of the stores had a health violation.

Re:perhaps this is a lesson that needed learned

[Todd Knarr]

We don't want to keep reacting, though. We want you to ask your ISP before you sign up, and not do business with ISPs who may cause you problems because of their policies. Then the problem doesn't come up, and the spammers get isolated in places where there aren't any innocent bystanders around.

What you're asking for is for it to not affect the ISP at all to host a spammer. What incentive, then, is there for them to get rid of spammers?

Re:perhaps this is a lesson that needed learned

[Cogneato]

I talked to my ISP indepth about this when it happened. The problem for them is that a spammer is a moving target. They come in and happily pay the setup fees for a server, get it set up in 24 hours, send millions of emails overnight, and then move on.

We all like things like cheap introductory rates, low setup fees and quick setup times... and spammers do too. How would you feel if an ISP told you that they had to run a background check on you before they set up your server? That ISP would have no business.

SPEWS and the rest of the blacklists like to point the finger at the ISP, but have you really ever put yourself in the shoes of an ISP that is just trying to run a business? My ISP has a strict spam policy and shuts down spammers as soon as they are discovered. Even so, they now have to battle on two fronts, fighting the spam block lists at the same time.

If SPEWS wants to do some real good, how about making some tools for ISPs to monitor servers that may be rented by spammers?

Re:perhaps this is a lesson that needed learned

[heli0]

"The IP address of my server happened to fall a few dozen numbers away from that of a spammer...Blocking entire IP blocks is nothing short of techie-terrorism."

So you are mad at SPEWS because you are doing business with a company that allows spammers to operate freely?

SPEWS is just a list of IPs owned by companies who allow their connections to be used for abuse, mostly spamming. If your provider is listed it means they are harboring spammers and ignoring complaints. SPEWS is a list of IP addresses owned by providers who harbor spammers.

That is right, your IP address is owned by a provider who harbors spammers. If you choose to do business with scumbags then you should expect to have your email blocked by reasonable email server admins.

Re:perhaps this is a lesson that needed learned

[SirFozzie]

I'm learning something..

That you're a fscking moron.

ISP's who deal with spammers get their rights to play with the rest of the net until they do the right thing, ie, get rid of the spammers. The internet is built on a collective trust that "You take care of your problems, and I'll take care of mine"

If the ISP wants to shit all over the network, then fine, let them. But don't expect me to want to have anything to do with them.

Re:perhaps this is a lesson that needed learned

[Cogneato]

I have been with my ISP for years. They have a strict spam policy. They get rid of spammers as soon as they are discovered. They also get rid of anyone that is generally causing any pain to their other subscribers. I know this because I have seen it happen a few times.

Did it ever occur to you that a spammer does not walk up to an ISP an annouce that they are a spammer? What exactly would you suggest an ISP do? Background checks? Get a note from the spammer's mom? This may come as a surprise, but spammers sometimes tell lies.

And again, how fricking presumptive of you to think that you can fight your war at any cost, including costs you force upon me. The big problem with spammers is that the email they send costs the world way more than it does themselves. The ironic thing is, the same goes for the blocklists.

Re:perhaps this is a lesson that needed learned

[DevilM]

Come on! How are you going to enforce the AUP without first finding out if they are violating it? Maybe you expect to provide the ISP with evidence that one of their customers is violating the AUP. How is the ISP supposed to regard your evidence? Unless they can determine on their own what a customer is doing there is no way they can enforce the AUP.

Re:perhaps this is a lesson that needed learned

[martyros]

Blocking entire IP blocks is nothing short of techie-terrorism. In other words, you can't convince the real wrong doers to stop, so you harm the innocent bystanders to try to get them to revolt.

Yes, that's exactly what it is; but the reason people are doing this is because there is no other recourse. If there were justice, there would be no need for SPEWS; so until we do get justice against spammers, we're going to have terrorism and vigilantism, with all the nastiness that goes along with it.

I'm sorry that your business was hurt by this spammer on your ISP; I'm also sorry that my mom got an e-mail with a wide array of penises on it. I'm also sorry that I don't dare put my e-mail address in public places for real people to contact me because of something they've seen on my website or something I've said (which I'd enjoy), for fear that I'll get on 100x as many spam lists as I am now. I'm sorry for all the time I waste tweaking spam filters and grepping through my 'reject bin' when I could be doing something useful, and I'm sorry for all the mail I never look at, because it didn't happen to be whitelisted and I lost it in all the junk.

Re:perhaps this is a lesson that needed learned

[Ami Ganguli]

This is something the recipients of your mail have decided to subscribe to. They've weighed the downside: no mail from you, against up side: less mail from spammers, and decided it's worth it.

There's no point getting indignant about it. Just contact the person you're trying to mail by phone. Maybe if they know they're blocking you they'll re-evaluate.

Personally, there are very few people for whom I'd be willing to spend an hour a day deleting spam. Unless you're a really important client, you'd be out of luck with me.

Re:perhaps this is a lesson that needed learned

[dubl-u]

Blocking entire IP blocks is nothing short of techie-terrorism.

Don't be an idiot. Terrorism is when people bleed and die. Some of your email didn't get through. Nobody is forced to use SPEWS; every piece of your mail was rejected by servers whose admins chose to use SPEWS.

Blocking entire IP blocks is akin to boycotting a company whose policies you don't like. Or refusing to go to a bad neighborhood. Or voting against a candidate just because you don't like the last president from that party. Or supporting trade sanctions against a country that engages in terrorism or human rights abuses. All of these put pressure on a group of people in response to actions taken by a relatively small portion of that group.

In some ways, that sucks; there's no reason for some poor shmoe at Nike to get laid off just because his company does something that a bunch of people don't like. But sometimes that's the only way to get the message across to the people who can solve the problem.

SPEWS, for all its flaws, works. I used to keep my boxes at an ISP who started sheltering spammers; I wouldn't have known about it except for SPEWS. Thank goodness I did; the spam, and the ISP's willingness to ignore my complaints about it, were a sign of their impending doom. I got out ASAP, and the contract with my new ISP now includes substantial penalties for getting listed.

Re:perhaps this is a lesson that needed learned

[Dimensio]

SPEWS does not list until after an ISP refuses to take action after being notified of AUP violations. That your IP range was listed in SPEWS means that your ISP refused to act for quite some time -- as initial SPEWS listings only cover the spammer's IPs and they do not expand to other IPs until after the ISP takes no action and lets the criminal stay up and running.

Once again, the wrong target is attacked. Your ISP was negligent, that is why they were listed in SPEWS. Had they booted the spammer when it was first reported, there would have been no problem. Contrary to the lies of anti-SPEWS whiners, SPEWS does not list an entire ISP's IP range the nanosecond after a single spam run.

Re:perhaps this is a lesson that needed learned

[Dimensio]

No. It's like people boycotting all of the stores at a mall because the mall allows one of the stores to sell drugs -- and moves the drug dealer to different stores at random to avoid police raids (leaving an innocent shop owner to be the target of the raid).

Re:perhaps this is a lesson that needed learned

[DevilM]

Whether server admins chose to use SPEWS or not is generally a decision they make on their own that affects their entire organization. I have know of at least two server admins who lost their jobs because the company found out later they were losing email because the server's email policy.

Deciding to use a blacklist is a serious commitment for an organization to make that should not be taken lightly. I advise all admins to get approval as far up the chain as they can for their own protection. You haven't seen mad until your CEO learns about customers who can't email them.

Re:perhaps this is a lesson that needed learned

[Dimensio]

Do you have a better idea than SPEWS. If so, please present it. E-mail admins everywhere would be thrilled.

Re:perhaps this is a lesson that needed learned

[silas_moeckel]

LOL do you relize just how trivial it is to wall in a new client server? Generaly it's just a question of routing all outgoing traffic destined to port 25 to a proxy. That proxy has a few rules and counters. The guy that sets up a new box in 5 minutes gets on and generaly dosent notice anything because he's not breaking the rules (fairly high rules like a thousand messages a day, 100 messages and hour 10 messages a minute) leave things like this for a few months and then let his mail go out normaly. This isn't rocket science it's a bit of load on your router and a box to forward email.

Re:perhaps this is a lesson that needed learned

[DevilM]

Why should an ISP believe SPEWS unless the ISP can generate evidence of their own? Again, the problem here is you want the ISP to police the data they transmit, which has nasty side-effects.

I just don't see how blacklist advocates can see the problem of SPAM as black and white; it is much more complicated than that.

Re:perhaps this is a lesson that needed learned

[Dimensio]

Why should an ISP believe SPEWS unless the ISP can generate evidence of their own?

It's a matter of the ISP trusting abuse reports. SPEWS does not identify itself when contacting an ISP -- they just send a standard abuse report like anyone else would.

Further, if SPEWS behaved irresponsibly, there would be evidence. Someone would be able to point toa SPEWS listing that was inaccurate, not a spammer. Despite many whiners claiming that such listings exist, no one has pointed to a single specific example.

Re:perhaps this is a lesson that needed learned

[leviramsey]

Jesus Christ, you're a psychopath.

I suppose you're okay with flying planes into buildings until the US pulls out of Saudi Arabia.

I suppose you're in favor of burning shit until the WTO withers and dies?

I suppose you're in favor of lynching every black man you see until all the niggers leave?

Re:perhaps this is a lesson that needed learned

[silas_moeckel]

You know sending an email to postmaster@ might not be a bad feature. It gives people notice and I persoanly dont care if they arent reading there postmaster email well then they are violating RFC anyway. A simple note with next steps (namly the ISP in question).

There is still just a much simpler answer throttle outgoing email connections at least to new customers. Throttle also provided a good place to check outgoing mail (hey unencryed email is a postcard treat it as such besides your ISP can legaly look at anything your doing through them to keep there network working, just has some slight carrier status issues)

Re:perhaps this is a lesson that needed learned

[Cogneato]

A very good friend of mine uses spamhaus and gives it very good marks. He also has some really horrible things to say about SPEWS. I agree that a well designed blocking system can actually be a benefit, but it has to be done with far more care than what SPEWS did.

It is really refreshing to hear someone who uses a list take responsibility for its use and that actually has thought his way through the process. I talked to one ISP that was using SPEWS and he had it as first line or defense with no possible way to whitelist anyone. It is nice to know that everyone out there is not blindly acting as they did.

Another friend of mine gives a very good review to Spam Assassin. I, myself, don't use any spam blocking on my server. I just rely on my mail client's spam blocking (mail.app on OSX) combined with a few word-specific rules. On any one day, I might have about 200 emails in my junk mail folder and may have to delete 5 or 6 spam from my inbox each day. For me, deleting a handful of spam is not that much of a pain. SPEWS just seems like such overkill when compared to hitting the delete button 5 or 6 times.

Re:perhaps this is a lesson that needed learned

[Anonymous Coward]

"This is something the recipients of your mail have decided to subscribe to. They've weighed the downside: no mail from you, against up side: less mail from spammers, and decided it's worth it."

Bullocks. At best it is the hope for less spam. Most recipients know nothing about the potential for collateral damage or innocent victims. Heck most recipients just check the no spam please box and go on with their lives that is of course if they have the choice in the first place. Really though it is no more germain to the concerns or issue at hand.

"There's no point getting indignant about it. Just contact the person you're trying to mail by phone. Maybe if they know they're blocking you they'll re-evaluate."

The reason for the indignance is because you fail to comprehend that this is costing him money and he is not to blame. Hint he should not have to do that "phone" for each of the people he serves. This is the Internet Age, get with the program.

"Personally, there are very few people for whom I'd be willing to spend an hour a day deleting spam. Unless you're a really important client, you'd be out of luck with me."

Who cares about you? You dance around his valid complaints and concerns and beat your own drum. Oh the irony of such a low slashdot account number, and yet such a poor display of reading comprehension.

Re:perhaps this is a lesson that needed learned

[afidel]

Cool sounds like SPEWS did it's job, your ISP was forced to remove a spammer from their network. That's one less server sending gigs of unwanted email into the internet. Sorry but spam is a tragedy of the commons. We have this great public shared resource and a few people are pissing in the well. If we have to make some people taste the piss to get their neighbors to stop pissing then so be it.

Re:perhaps this is a lesson that needed learned

[DonnarsHmr]

A major flaw with your stance, and the stance of many people responding to this article, is that you assume end users have free will when it comes to ISPs. Due to regulatory bullshit, there is exactly one ISP available from my apartment. One. I have a choice to either accept their policies, or not use the internet. My father, due to his remote location, has exactly one ISP available at his house. One. Neither of us had the choice to approve of the ISPs' methods of doing buisness. We either accepted it or didn't use the internet. If either of our ISPs gets blacklisted, we no longer communicate. Neither of us have any appeal, neither of us have any choice. The ISPs don't have to care (though, thankfully, they are small enough that they do) a bit about our complaints. They know we have no where to go to. So how does preventing me from emailing my father help other people not recieve spam? I'm sure some of you think that it's still the ISP's fault, that I can always choose not to use their service, but if my ISP is blacklisted I cannot communicate, and if I refuse to use the ISP then I cannot communicate. Tell my how blacklisting with "collateral damage" helps a god damn thing. Hey, explain biological warfare is a good way of making nations behave while you're at it.

Re:perhaps this is a lesson that needed learned

[DonnarsHmr]

Actually, no, this isn't something the recipients of my email agreed to. This is something the sysadmins for their ISP subjected them, and me, to. What if, as is the case where I live, there is only one ISP. Use it or loose it, baby. Oh, and by "Just contact the person you're trying to mail by phone." I assume you actually mean "Spend 45 minuted having the call routed across two countries to a radio relay durning the hour a day it's active"? See that's the problem with blacklisting, you catch people who can't do anything about the problem either because they are disenfranchised or because they are unaware there's any mail being blocked. Blacklisting on a large scale is just not an acceptable response.

Re:perhaps this is a lesson that needed learned

[Ami Ganguli]

Who cares about you? You dance around his valid complaints and concerns and beat your own drum.

Presumably the people who are being blocked by my spam filter care about me. The question is whether or not I care enough about them to turn off the filter. Up until now the answer is 'no'. I'd rather have usable e-mail that blocks a few legitimate mails than e-mail that's totally unusable. That's the trade off I've made.

Similarly, if people whom you would like to do reach by e-mail aren't accepting your mail, take it up with them. They need to make an informed decision. If they only get a moderate amount of spam then they might well decide that you're worth a bit of annoyance. If the amount of spam they would normally receive is overwhelming, they'll probably tell you to get lost.

Re:perhaps this is a lesson that needed learned

[Anonymous Coward]

Actually, it's not really that bad if you do it right. The problem is that most email software deletes spam rather than bouncing it or notifying anyone useful.

Correct solution: Generate a 550 response to the RCPT TO in the SMTP conversation. Reject it there - if it's a false positive from a legit mailer, that will generate a bounce and inform the original sender and an investigation can occour.

If it's a spammer, well, you've saved yourself the bandwidth of recieving the spam.

I recommend www.vamsoft.com

Re:perhaps this is a lesson that needed learned

[Ami Ganguli]

If the recipients didn't agree to the mail filter then that's a different story. I wasn't aware that ISPs did that, and I certainly wouldn't condone it.

As for the inconvenience of the phone call, it honestly doesn't matter. I filter my mail because without the filter I wouldn't be able to use e-mail at all and you'd still have to make the phone call. In fact, I was harder to reach before the filter because I'd delete a lot of legitimate messages by mistake. I think the collateral damage now is actually much lower.

Re:perhaps this is a lesson that needed learned

[Anonymous Coward]

You didn't agree to your ISP's AUP? Then why did you sign it in the first place?

Re:perhaps this is a lesson that needed learned

[zakezuke]

I talked to one ISP that was using SPEWS and he had it as first line or defense with no possible way to whitelist anyone. It is nice to know that everyone out there is not blindly acting as they did.

Usually the argument is that Spews them selves isn't blacklisting people but it's rather the ISPs who are blacklisting. That's just bonehead logic cause Spews like any other similar service makes a freaking list.

To be honest, i'd have to read the sendmail docs to see how easy it would be to whitelist someone, but i'm sure it could be done. I have full empathy for people in Brazil who are victims of full fleged blacklistings. Granted my userbase isn't large at all, but if someone was indeed blacklisted and had just cause to e-mail someone on my machine, and at the very least had a fixed ip address, then by all means i'd look into it.

I agree with the bonehead admins to an extent, the fact that there are certain blocks that are proven to be troublesome. But that is no excuse for not having a valid procedure to actually whitelisting actual users.

Now what i'm curious about is if it would be reasonable to configure sendmail or other mail package to rather then "reject" flagged spam sites off the bat to put them on hold, making sure that you keep their outbound port open as long as possible.

Re:perhaps this is a lesson that needed learned

[danila]

you catch people who can't do anything about the problem either because they are disenfranchised or because they are unaware there's any mail being blocked.

I don't know how it is in the States, but in my experience you usually get a nice e-mail saying something "you've been blacklisted". I lived in Finland and my ISP (Sonera, one of the largest in Finland) was blocked by Mail.Ru - the largest e-mail provider in Russia. It took some time and a couple of e-mails, but eventually the problem was fixed (presumably the ISP acted or promised to act against spammers the way Mail.Ru required). All the time I knew that e-mail was not coming through and I had to use other SMTP servers to send it. An annoyance? Sure. Unacceptable problem? No way.

Re:perhaps this is a lesson that needed learned

[danila]

I have a choice to either accept their policies, or not use the internet.

False dilemma. You also have a choice to contact them, explain the problem and ask their help. My ISP went as far as to disable spam filtering for my personal accounts when I asked. There is no ingerent reason why your ISP should not (just try to ask them).

If either of our ISPs gets blacklisted, we no longer communicate.

Very recently, around mid-nighties some companies started to provide an innovative service called web-mail. Why don't you check it out? Another alternative - send the mail to your father through the SMTP server of his ISP (and vice versa).

In summary, blacklists are an annoyance for some, but they are hardly preventing people from using e-mail at all even in the worst cases.

Re:perhaps this is a lesson that needed learned

[Anonymous Coward]

Bottom line: if you deal with a cowboy ISP expect to get cowboy levels of service. If they can't keep spammers off their service why do you expect reliable mail delivery (or reliable anything) off them?

Re:perhaps this is a lesson that needed learned

[Anonymous Coward]

That your IP range was listed in SPEWS means that your ISP refused to act for quite some time -- as initial SPEWS listings only cover the spammer's IPs and they do not expand to other IPs until after the ISP takes no action and lets the criminal stay up and running.

Why do you refer to the spammer as a criminal? Last time I checked there was no law against spamming. It is actually SPEWS that breaks the law.

Re:perhaps this is a lesson that needed learned

[Tsu Dho Nimh]

"You hit me to get me to complain. Did you ever think that I don't want to take that active of a role in your war?"

It is your war too, because your ISP is your internet neighborhood. If someone did a review of your restaurant and pointed out that it was in a run-down building, with panhandlers out front, hookers displaying their wares from the second floor windows, and drug dealres in the lobby offering drugs to arriving customers ... would you act? Would you insist that your landlord clean up the place? Or would you bitch that the review ruined your business?

Re:perhaps this is a lesson that needed learned

[Anonymous Coward]

What if your provider's ISP is the one in SPEWS? I for one are glad they are gone, fucking morons. All blacklists are good for is pissing off legit email users.

'nuff said

Re:perhaps this is a lesson that needed learned

[tgibbs]

My point exactly. You hit me to get me to complain. Did you ever think that I don't want to take that active of a role in your war?

I'm sorry, are you saying that I am "hitting" you if I choose not to receive email from you (which is what I am doing when I contract with an ISP that uses a blacklist)? It seems to me that I am entitled to decide who I listen to.

Re:perhaps this is a lesson that needed learned

[haggar]

My point exactly. You hit me to get me to complain. Did you ever think that I don't want to take that active of a role in your war?

As someone who has to sift through tons of spam every day, I feel no pity for those who feel contempt towards spammers and the ISPs that house them. In fact, I hope that at least some of them are learning their lessons.

Re:perhaps this is a lesson that needed learned

[Cogneato]

Ok, as far as I am concerned, if you personally want to use a spam block list, great. Have fun. I have no problem with that.

What I have a problem with are the system admins and management of ISPs that are making the decision to use these blocklists to bounce email for all of their customers, including the ones that don't want their email blocked. Yes, it is easy to say that the customer should simply change ISPs, but in many areas, especially when it comes to high speed options, there are no other ISPs available.

Additionally, many of my clients have been with the same local internet provider for years and only recently has that provider started using the block lists. The cost of changing internet providers can be tremendous. Consider simple things like emails addresses printed on business cards and letterhead (they had their internet provider long before they had their own website).

I think many responses that put spam block lists in a positive light are not considering the huge costs they place on actual real businesses. Often times the effects are worst on small businesses that simply cannot afford the additional costs of trying to figure out how to get off the lists.

So I wonder, if you were working for a company that was struggling a bit, and was affected by inaccurately being placed on SPEWS list, costing them thousands of dollars, how would you feel about taking a partial pay or time cut to make up that money? Would your reverence to the list stay so high? The reason I ask is because, as a business owner, I had to take a pay cut, at least temporarily, as a result of inaccurately being placed on SPEWS' list.

If an ISP wants to use an IP blacklist, fine, but they need to take responsibility for its use, use it in an intelligent way, and really consider the quality of the list that they are using. SPEWS has a reputation for being far from the highest quality list, and that reputation has grown from their own actions.

Re:perhaps this is a lesson that needed learned

[tgibbs]

Ok, as far as I am concerned, if you personally want to use a spam block list, great. Have fun. I have no problem with that.

And I am also entitled to choose an ISP that does it for me.

If an ISP wants to use an IP blacklist, fine, but they need to take responsibility for its use, use it in an intelligent way, and really consider the quality of the list that they are using.

I think that the sole arbiter for whether an ISP's mail acceptance policies are reasonable should be its customers. If it wants to accept only email from IP addresses that end in an even number, and if that is OK with its customers, then it should be entitled to do so. I don't care about your business costs. You are not entitled to send any email to me, unless I choose to accept it.

Re:perhaps this is a lesson that needed learned

[Anonymous Coward]

Did you ever think that I don't want to take that active of a role in your war?

You really don't get it, do you? You're already taking a role in that war by paying that spam-friendly ISP of yours. One purpose of SPEWS is to get you and the other clients of that ISP to stop supporting of the pro-spam faction of the war, as a first step. By switching to another ISP, you can achieve the status of neutrality in this war. If you don't do that, you're at least indirectly supporting SPAM, and deserve what you get.

And that "mail the entire class-C subnet" idea of yourse is bonkers, too --- the only one who could legally do that is your ISP himself. If anyone else did that, that would be SPAM.

Re:perhaps this is a lesson that needed learned

[Dimensio]

Spammers steal bandwidth and resources to send unsolicited advertising.

What does SPEWS do that is illegal? Be specific, or be labelled a liar.

Re:perhaps this is a lesson that needed learned

[DonnarsHmr]

Actually, I was saying that a person could have an ISP that is using a blacklist and not be aware of it. If you're behind the block, all you'll see is maybe a little less mail than you might expect.

Re:perhaps this is a lesson that needed learned

[William Tanksley]

Yes. Any number of other blacklists do the job quite well, without anywhere NEAR as many false positives.

There are also a number of other technologies in development which look very promising, although none of them are here yet for the admin. (Although I'm pleasantly surprised to see that DSPAM seems to work for some.)

-Billy

Re:perhaps this is a lesson that needed learned

[DonnarsHmr]

As my first post clearly stated, I don't have a choice of ISPs. If I want to access the interent, I agree to their terms. Period.

Re:perhaps this is a lesson that needed learned

[Dimensio]

SPEWS has false positives in its listings? Could you point one or two out?

Re:perhaps this is a lesson that needed learned

[William Tanksley]

Read this thread. Read ANY thread in this entire discussion. There are hundreds, probably thousands of people who are "collateral damage" -- not spammers, not related to spammers, not in any way supporting spammers, but blacklisted anyhow, because the bandwidth provider for their ISP also supplies bandwidth to another ISP which doesn't kick spammers off as quickly as they should.

We do NOT have to destroy the village in order to save it. Other blacklists get it right; SPEWS just took too long.

Personally, I wouldn't use a blacklist in order to block anything; I would use it to suspect things. Remember the greylist technique Slashdot posted about a while ago? I would use that, but ONLY for blacklisted origins. Other antispam techniques, such as Bayesian filters (including webfetching), could be applied only to email from 'suspicious' addresses.

The collateral damage argument is enough reason to never irredemably block a blacklisted address (certainly not one from SPEWS); another argument is that in a while, the origin of the spam will become entirely irrelevant. If you think for ONE moment that SoBig will be stopped by the FBI... You're wrong. Spam *will* become massively peer-to-peer.

-Billy

Re:perhaps this is a lesson that needed learned

[Dimensio]

SPEWS is deliberately set up to cover more than just spammer IPs. SPEWS openly states that they list spammer-friendly ISPs and that this could cause collateral damage. This is the intent of filtering based upon SPEWS. As such, blocking "legitimate" mail from customers of crime-ridden ISPs like Verio or cogentco does nt amount to a "false positive" because the intent from the beginning was to block mail from that domain.

Deny filters are useful because they greatly offset the cost of spamming. Content-based filtering still requires storage and CPU cycles for processing the message. That costs money. If an ISP is known for letting their customers spew out nothing but garbage despite repeated complaints, then it's perfectly acceptable to drop all packets from said ISP at the router. If you don't like that idea, then don't do it for yourself -- leave those of us who want to stop the flow of cram from criminal-controlled ISPs like Qwest alone.

Spammers didn't care about their individual IPs being blocklisted. Spam-friendly ISPs would just move them to new IP addresses anyway. Spammers are constantly seeking means to evade filters. SPEWS works because it forces the crime-friendly ISPs to act or go out of business. If you have a better, more effective solution for getting rid of spammers short of killing them (I don't know why more people don't take that suggestion seriously), then please present it.

Online intimidation...

[stevens]

This could turn into the same sort of gang-induced protection rackets as in meatspace. What would a company or individual do if a cracker group sent them an email saying, in effect, "Do $this or you're off the net."

It's hard to see a good technical solution for this. It's a tort--and possibly assault---like any other physical intimidation tactic, and will probably only stop if legal means are brought to bear.

Unfortunately, tort suits are hard to press across continents.

Re:Online intimidation...

[forkboy]

That would make this sort of thing fall under the Rico Statute though, which would get the Feds involved. Once a few smart-ass cracka-gangsta wannabes go to Federal pound-me-in-the-ass prison, that sort of nonsense will stop real fast. (Assuming it's perpetrated from our country) If it's done by foreign crackers, I'm sure G.W. and friends can declare them "enemy combatants" and they will be quickly and quietly sent off to sunny Cuba.

I love spews

[Anonymous Coward]

My equipment, my rules. Don't like it? tough shit, you damn spammer.

Re:I love spews

[Anonymous Coward]

You are stupid.

SPEWS blacklists innocent people and people who would have to spend hundreds or thousands of dollars to move to non-spammer ISP's. Low-budget sites can't do that everytime a spammer happens to sneak onto an ISP's network.

Re:I love spews

[grayantimatter]

Yep. Spews is complete garbage. With any luck they will disappear forever. They blacklist organizations with ZERO proof or reasoning to substantiate their actions. They're self appointed internet vigilantes and it would not bother me at all if the people behind SPEWS disappeared from the face of the Earth.

Wrong

[quinkin]

Whitelist just changes the parity of the information.

A DDoS attack will just as effectively block a whitelist as a blacklist - leaving you in the same information void as currently.

If you meant only that it will help avoid future lawsuits you may be correct.

Q.

Re:Wrong

[leviramsey]

He's referring to a system a la TMDA, where individual users maintain their own whitelists for personal use.

who said the osirusoft list was dead?

[Anonymous Coward]

isn't it fairly obvious that Joe simply wants legitimate clients to stop using the zones immediately, so that he can see who the gits doing the DDoS are?

TXT Record.

[shird]

> set querytype=TXT

> 1.2.3.4.relays.osirusoft.com
Server: x.x.x.x
Address: x.x.x.x

Non-authoritative answer:
1.2.3.4.relays.osirusoft.com text = "Please stop using relays.osirusoft.com"

Authoritative answers can be found from:
osirusoft.com nameserver = ns4.osirusoft. etc...
>

Personnaly, Ive never liked blacklists that much. A whitelist system, combined with HashCash to allow people youve never contacted to get on your whitelist is the most ideal solution. The use of HashCash means spammers can't bulk mail millions of people to get on their whitelist, but it is very easy for someone to get on a few peoples whitelist at a time. The guys over at 'camram.org' are working on such a system. I think Microsoft is working on something called 'penny black' or something which does something similar.

Re:TXT Record.

[BJH]

I think Microsoft is working on something called 'penny black' or something which does something similar.

So, a penny a mail... and any guesses as to where the money goes?

Re:TXT Record.

[Anonymous Coward]

No, not a penny a mail, its just an old term originating as 'penny red' which I think had something to do with the origin of the postage stamp. HashCash and Penny black make use of client resources to generate a stamp for mail in such a way that they can't be mass produced - but are free to do so, only at the expense of a bit of computing time.

Re:TXT Record.

[BJH]

*Sigh*. Yes, I know what Penny Black means (btw, your comment is incorrect - the Penny Black was the first stamp to be introduced by the British Royal Mail, although it wasn't the world's first stamp). The "penny a mail" was figurative.

I got more spam than normal today

[bersl2]

It's weird... 3x the amount... I got four messages in ten minutes at one point...

Re:Slashdot Censorship

[empurium]

Sounds like you should actually LOOK at w30wnzj00.com.

good.

[Anonymous Coward]

Couldn't have happened to a better registry.

All I know is that every time I had a system
listed with them, I was unable to get it removed
in a timely fashion. Even if the problem
had been resolved.

I remember one time, a client with groupwise called. THey were listed, but they weren't actually relaying. THe server was misconfigured so it took everything it was given, then rejected it later. But even after the problem was fixed, I still couldn't get them off it. THe scripts for testing would always time out, etc.

Maybe it wasn't a spammer that DOSed them. Maybe it was just a pissed off admin that couldn't get de-listed!

I agree

[Anonymous Coward]

The only solution to spam is to stop the spammers.

How do you propose to do that, Einstein?

Re:I agree

[geordie]

I only said that it was the solution.... not that I had the means or ability to implement the solution.
If I could stop the spammers I would be a very happy person ( and probably a pretty popular one too)

Re:I agree

[Anonymous Coward]

We don't need means and ability here, we can get plenty of that. What we need are ideas.

Why do you think a whitelist wouldn't work?

Re:I agree

[geordie]

A whitelist will work just as well as a blacklist.
Until the spammers start spoofing the from address the spam comes from to make it look as though it is coming from someone on your whitelist.
Whitelist won't work so well then.

Re:I agree

[BJH]

A .44 Magnum sounds like a good place to start.

Re:I agree

[shepd]

>Until the spammers start spoofing the from address the spam comes from to make it look as though it is coming from someone on your whitelist.

If a spammer knows me so well that they know who I have whitelisted, I suppose I might just *want* their spam.

Maybe.

Re:I agree

[Lord Apathy]

To quick and clean. It needs to be painful and messy to send a message.

Re:I agree

[geordie]

It would more likely be the other way around... 1). Spammer unleashes a worm/virus which infects unsuspecting/stupid users
2). Said worm/virus goes through address book on infected machines and spams everyone in there using the email address of the owner of the infected machine.

If you're in that address book, then chances are that person is on your whitelist.

Alternatively, Spammer simply spoofs the email address of some well known/well visited/well subscribed to website ( dailystatus@ebay.com, associates@amazon.com, slashdot@slashdot.org )
If you're a regular at any of the above sites you won't want to block their emails....

trusted signing of mail servers

[d00dman]

The coolest way we could stop spam from being distributed is to require mail servers to register with a trusted signer, and do the delivery over ssl. anyone distributing spam via a trusted mailhost would be promptly identified by their ssl signature, and anyone sending mail from an untrusted source could be rejected. there is already enough infrastructure in place for this to occur now. verisign and friends as trusted signers, and smtp-ssl. the only other thing required is the will to put it to work.

Re:trusted signing of mail servers

[AKnightCowboy]

there is already enough infrastructure in place for this to occur now. verisign and friends as trusted signers, and smtp-ssl. the only other thing required is the will to put it to work.

Oh that's just fscking great. And to register a trusted mail server will no doubt cost $1000/year for a Verisign "trusted" certificate. Screw that. If you can do the same thing but make it open source then I'd say go for it, but if I have to be ass-raped by Verisign for another minute I'll give up on the entire god damn Internet.

Re:trusted signing of mail servers

[d00dman]

the cost of the certificate would be great for ensureing responsible use. someone's gotta pay for the book keeping. and a cert only costs $150, not $1000. hyperboly is just the sort of thing that got spews so hated.

Re:trusted signing of mail servers

[Lord_Dweomer]

" The coolest way we could stop spam from being distributed......"

I have a much cooler way to stop spam. It involves many blunt objects, and many sharp objects, as well as some objects that go BANG and cause things to fly out of them at very high velocity. I think these would be very effective but have not had a chance to test them yet.

Re:trusted signing of mail servers

[ComputerSlicer23]

Yeah, and spammers will be in the business of using trusted keys. Verisign will sell a key to anybody, and everybody who wants one. A big spammer, could easily afford to sign new keys. If you think Verisign will turn away their money, you are nuts.

If that doesn't work, spammers will start stealing keys and ruining them, thus making it easy to expediate the process of getting a new key. So the spammers will have an easy time a new key by claiming a spammer broke in and stole the key. If you tie it to IP, you'll wreak havoc on a number of load balancing mail solutions.

This isn't if counting the fact stopping a spammer involves making sending mail to other people expensive. If you don't do that, you can't make money. Period. SMTP-SSL will have to be computationally very, very expensive in order to stop spammers, which will make running a good sized mailing list pretty expensive.

The trick is making unknown users expensive, and making known users cheap. Keys and signatures are a good way to do it, but they will just be come tokens to be stolen, just like Credit Card numbers are now.

Hell, at some point, spammers will over to buy the tokens from stupid users. For $100, I'll by your bits, just send this file as an attachment please. They'll be something people steal off of old computers, or buy old mail servers at chapter 11 auctions. Users will send it right off. Alternatively, they will use a clever hack, like construction a virus that will latch onto your system after the key is decoded, and encrypt a set of known texts with your private key making it easy to decrypt, or to just send your private key if it can manage to get enough privledge.

Kirby

Re:trusted signing of mail servers

[ComputerSlicer23]

I know we just paid ~$800 for a 2 year certificate from Verisign a couple of years ago. Not sure why ours is special, but it's not impossible to pay extra for it. Ours was for a secure site.

Kirby

Re:trusted signing of mail servers

[Anonymous Coward]

Last I checked trusted certs are about $100/year, and that price could easily come down in bulk. Well within anybody's budget considering the time investment just to setup a proper filtering/blocking/dns service.

This is a great idea. Question is, how could a service like this be enforced ? Who does the enforcement? Verisign?

Re:trusted signing of mail servers

['nother poster]

I'd rather chew off my leg than give Verisign a penny to be a cash cow to spammers as a trusted mail host cert vending machine.

Re:trusted signing of mail servers

[Kenja]

Or better yet, they could implant microchips under our skin so that when ever we even TYPE spam the thought police will come by and arest us. Oh wait, that would be stupid. So would signing away all rights to electronic privacy because you cant figure out how to filter spam.

Here, I'll give you the best black list there is. Just type "ln -s ~/.mail/INBOX /dev/null" and you'll never get spam again. Better yet, just unplug from the network.

Re:trusted signing of mail servers

[Anonymous Coward]

Extra insurance, probably.

Re:trusted signing of mail servers

[Anonymous Coward]

You know, you are 100% correct that spammers would do all of those things, but it's still an order of maginitude easier to block certificates than it is to block IP Address blocks, and there will be considerably less collateral damage.

Seems like a big chunk of the anti-spam squad actually likes the status quo.

Re:trusted signing of mail servers

[Anonymous Coward]

Simple solution. Put it on the end users.

Joe Consumer doesn't know what a firewall or a server is, doesn't want to know, and doesn't care. Nor should he have to. Add a rule to browser software to allow a user the option of only accepting mail from "the below listed email addresses" as soon as he installs the browser. Hotmail does it, and it works fine. Three people can send me email to my Hotmail address all others go in a junk box where they are autodeleted in 7 days if not removed. Make it a multi choice rule. Allow users the option of sorting what goes into the junk mail and what is simply refused or autodeleted. For myself at this time in my life I would simply refuse any email from an address ending in .cn or .kr (my own firewall does). Everything else into the junk box for auto deletion at a date set by Joe Consumer. Joe Consumer installs the browser, enters the email address of his girl, his mom and maybe his aunt and his boss... After that he is done and will never see a Spam mail. If he clicks on a box that says "click here to receive email from anysource what so ever, no matter how obscene, or offensive, or likely to contain viruses that can result in your ISP denying you service)," then that is his choice. When he complains about the spam that results simply tell him to use the filter and enter the email addresses of people he wants to get mail from and the Spam will go away. Of course as he collects business cards in his life he would be able to add new "accept emails from XYZ@hey.com" as he needs and or remove them too (new ex-girlfriends, high school classmates he no longer cares about, etc.) Come out with a browser that does that and you will cut Spam off at the knees.

Re:trusted signing of mail servers

[qtp]

And then the spammers pay Verisign to certify them.

I do like the idea of mail being sent only from assigned smarthosts (using auth), as then it would be much easier to contact abuse@mailhost.com (and blacklist the server if there is no action).

Re:trusted signing of mail servers

[minas-beede]

"The coolest way ..." Well, there's cool and then there's cool . I find it to be cool to use software so that a spammer thinks I run an open proxy or open relay and send sends spam to be dleiverd (which it isn't.) If it's an open proxy I'm faking the spammer probably sends direct from his own server so I see his IP and can report him and his attempted abuse.

As a result I both stop spam AND may get a spammer thrown off his ISP (some ISPs are still altogether too spam-friendly.) It is noteworthy that no change in protocol is needed to do this: it can be done today, worldwide.

I've only touched on the possibilities. Think of the ways you could cause a spammer grief if that spammer started trying to use your system (which could be your home system) to send spam.

Quick Workaround (SpamAssassin)

[Anonymous Coward]

In your prefs file:

score X_OSIRU_OPEN_RELAY 0
score RCVD_IN_OSIRUSOFT_COM 0
score X_OSIRU_DUL 0
score X_OSIRU_SPAM_SRC 0
score X_OSIRU_SPAMWARE_SITE 0
score X_OSIRU_DUL_FH 0

Everything's gonna be all right.

Re:Quick Workaround (SpamAssassin)

[Tony Hoyle]

Hmm that's an old SA you have there..

try this:

score RCVD_IN_OSIRU 0
score RCVD_IN_OSIRU_DIALUP 0
score RCVD_IN_OSIRU_PROXY 0
score RCVD_IN_OSIRU_RELAY 0
score RCVD_IN_OSIRU_SPAMWARE 0
score RCVD_IN_OSIRU_SPAM_SRC 0

Re:Quick Workaround (SpamAssassin)

[tugrul]

Old? According to the current stable list of tests, those in your parent are the proper values. Maybe you happen to be running a release candidate of SA, but I prefer to leave my mail in the hands of the latest stable release (2.55 at the time of this posting).

Re:Quick Workaround (SpamAssassin)

[sdxxx]

For more recent versions of spamassassin (like 2.60-rc1) you will have to use:

score RCVD_IN_OSIRU 0
score RCVD_IN_OSIRU_DIALUP 0
score RCVD_IN_OSIRU_PROXY 0
score RCVD_IN_OSIRU_RELAY 0
score RCVD_IN_OSIRU_SPAMWARE 0
score RCVD_IN_OSIRU_SPAM_SRC 0

Be sure to test this out carefully. I left some of these out, and on some small fraction of my mail messages, spamassassin was dying from a NULL array reference.

Re:Quick Workaround (SpamAssassin)

[Anonymous Coward]

that's actually an unrelated issue fixed in rc2

Not going to miss it

[_narf_]

I once got modded down for saying this, and I'll risk it again. SPEWS rots... good riddance... their policies have always been irresponsible, and offer no reasonable notification or means to dispute a listing.

I'm a happy user of many other RBL style lists... but this one I would never have touched with a 10 foot pole, and I always advocated others do likewise.

Hopefully this final anti-social act of theirs ensures their complete demise.

Mod away....

Maybe it wasn't a DDoS attack

[Yeah-or-something]

SPEWS probably only had about 2 or 3 IPs left that weren't blacklisted anyway.

Re:Maybe it wasn't a DDoS attack

[gorbachev]

Someone actually checked how many IP addresses SPEWS listed.

It was less than 1% of all IP addresses.

But I guess for a spammer or someone hosted by a spam enabling ISP that's listed in SPEWS, it does pretty much feel like 100% blockage, don't it? And that's exactly how it should be.

Re:Maybe it wasn't a DDoS attack

[JeffSh]

out of hand remarks made by someone who is either
1) a zealot administrator/BOFH or a
2) uneducated user whos never adminned a system in his life.

do you realize how many ip's 1% of all ip addresses is?

1% of all ip4 ip addresses is approximately 40,000,000 ip addresses... first take that number and halve it to compensate conservatively towards a number represented the true blacklisted, and then consider the majority of blacklistings would be on server-class subnets.. now consider that each blacklisted subnet probably services 00s of individuals..

explain to me exactly how that is "such a minimal effect"

Re:Maybe it wasn't a DDoS attack

[gorbachev]

I know that 1% is not the same as "less than 1%".

But I guess you missed that...

Re:Maybe it wasn't a DDoS attack

[sirsnork]

Actually he didn't, he said half that to compensate.. obviously for the "less than half"

Jared blacklists the world?

[CPgrower]

Does this include www.subway.com ?

NNTP

[poptones]

I can't resist pointing out that p2p would be an ideal carrier for such "blacklists." Of course, that means the only way anyone is going to make money from it is via donation... and probably not even then, if the lawyers have their way with the author.

I'm willing to bet the big news carriers would give an account to any legitimate operators of such a service. Sign every post from trusted list creators with a public key to ensure validity, and it would be nearly impossible to ddos the service.

Ooooh... what about making the list itself a p2p app? Perhaps this could be a great excuse to motivate some big corps to install some freenet nodes...

Re:NNTP

[JeffSh]

won't work since a signed service also requires validating identity.

not going to happen on newsgroups.. ever :)

little help here?

[JeanBaptiste]

im not in charge of the servers. im just a programmer. my boss is in charge of our 5 servers. i know for a fact one of them is currently being used as a spam relay. its exchange 5.5 on NT.... the reason i suspect this is that there is a large amount of outbound messages rejected, being sent during non-working hours. I shudder to think of the messages that are getting through compared to my reject log.

well im not in charge of the servers, it took several days to convince my boss that there was a problem, several more for him to understand how much this problem sucks...

so if you could tell me how to secure my(bosses) server i would greatly appreciate it... (and yes, i understand linux would not have this problem but that is not an option right now)

i dont want to get blacklisted. the economy sucks enough right now.

Thanks.

Re:little help here?

[Anonymous Coward]

Are you sure those 'reject' messages aren't just bounced SoBig virus messages? The virus fakes the return address so that if the message doesnt get through, it bounces back to whoevers address it forged, which in some cases may be yours.

Re:little help here?

[M-G]

so if you could tell me how to secure my(bosses) server i would greatly appreciate it... (and yes, i understand linux would not have this problem but that is not an option right now)

Take a look at the material on this page.

Slipstick is probably one the best collections of Exchange Server info out there. Paul Robichaux's Managing Microsoft Exchange Server is also a good reference to have on hand.

The scariest part is that you're a large enough company to need 5 Exchange Servers, but the person in charge of them doesn't have the most basic understanding of what he's dealing with.

Re:little help here?

[dubl-u]

If you suspect you are relaying, the MAPS Transport Security Initiative has information for over 70 mail servers. I didn't even know there were that many.

Re:little help here?

[Tsu Dho Nimh]

"so if you could tell me how to secure my(bosses) server i would greatly appreciate it.."

Lose the install media, arrange for it to crash, badly, and offer to get it working with Linux.

My Postfix Logs

[Alowishus]

I run a Postfix setup which uses Osirusoft as one of its blacklists, and going through my maillogs I see that the RBL was unresponsive early on the 24th, and then started answering again later in the day. It was down the 25th and most of the 26th, until it briefly came on and started answering only some of the requests with "blocked using relays.osirusoft.com, reason: Please stop using relays.osirusoft.com". But it wasn't rejecting everything as the 2nd article says - just a subset of our mail. The rejects might even have been legitimate blacklisted IPs - perhaps they just changed the rejection message so admins would see it in their logs?

Additionally Postfix is a smart enough MTA so that during the RBL downtime it didn't reject any mail - the default behavior is to deliver if the RBL can't be contacted.

Re:My Postfix Logs

[dubl-u]

Also consider doing something like this:

maps_rbl_reject_code = 451
maps_rbl_domains =
relays.ordb.org
sbl.spamhaus.org
#proxy.relays.osirusoft.com
#socks.relays.osirusoft.com
#spews.relays.osirusoft.com

The 451 code asks the remote mail server to try again later. If you keep an eye on your logs, this gives you the chance to correct incorrectly blocked legit correspondents. And interestingly, a lot of spammers try only once, so it isn't as much as a resource drain as you'd think.

Re:My Postfix Logs

[bobbozzo]

Additionally Postfix is a smart enough MTA so that during the RBL downtime it didn't reject any mail - the default behavior is to deliver if the RBL can't be contacted.

Nice.
Anyone know how to acheive that in Sendmail 8.12?
(Spamcop's rbl goes down for a few hours at a time occasionally. Sendmail will give a service temporary unavailable in that case, but I'd rather get my mail now rather than later.)

thanks

Re:My Postfix Logs

[Lost Race]

Are there any RBL checkers that don't do that? I wrote my own and that failure mode was just about the first thing I thought of, so I made sure it failed safe (not blocking) on a lookup error. The spam it let through would be my "error message" for using an unreliable RBL. I assumed all RBL checkers work like that.

Re:My Postfix Logs

[ThrobbingGristle]

That's very sharp... I'll have to set that up.

I wish I would have noticed sooner... for some reason I seem to have lost all email from every mailing list I'm on, but not much else.

Re:Slashdot Censorship

[Anonymous Coward]

But if I try to look at it
they might be able to 0wnz my box!

How *do* we fight spam?

[michellem]

Having been myself unfairly blacklisted (not by Spews, but by another list) because of the actions of my ISP, I really have come to have serious issues about the blacklisting process. I understand the principle - get innocent bystanders pissed off at their ISPs, then have them complain to their ISPs, or switch ISPs, and then ISPs change their behavior.

The problem is that many people, for a variety of reasons (geography being one) can't change ISPs, and many ISPs (mine included) did nothing in response to my complaints (because they knew I wasn't going to move). So what does this do? It certainly doesn't help anyone!

I hate spam as much as the next gal, and I think that the SpamAssassin approach (which is to label mail as spam depending upon certain criteria) is a much, much better approach than blacklisting.

Re:How *do* we fight spam?

[gorbachev]

"...and many ISPs (mine included) did nothing in response to my complaints (because they knew I wasn't going to move)."

Uh, if that was really the case, the ISP belonged in the bloclist.

"It certainly doesn't help anyone!"

Um, yes it does. It helps the people, who use a bloclist that lists your ISP as a spam enabling ISP.

Re:How *do* we fight spam?

[SirFozzie]

No it's not.

Because you've still used the bandwidth and the computing power to accept and anylyze the spam. The pressure needs to be on ISP's to play nice with the rest of the net. Remember, the net used to be a collective before it became the Interweb?

Hopefully, all that's left to happen is the spammer/nutjob behind these DDoS's to get caught and sentenced to a long term in a federal-pound-the-felon-in-the-ass prison.

Re:How *do* we fight spam?

[heli0]

"It certainly doesn't help anyone!"

It helps everyone else because we do not have to receive spam from your scumbag ISP.

Re:How *do* we fight spam?

[Anonymous Coward]

One idea: spread the following rumor:

All these spams for Viagra, diet pills, etc.
are REALLY coming from Al-Quaeda operatives!
The merchandise they deliver is laced with
CYANIDE and could KILL YOU! They are trying
to exterminate as many Americans as possible,
with the help our own Internet! Hundreds of
innocent people have already DIED!

Do not purchase ANY medications from unknown
parties over the Internet! Delete all such
offers immediately; do not reply to them or
give any personal information to the spammers.

Re:How *do* we fight spam?

[Cogneato]

did it ever occur to you that spammers don't walk up to an ISP with a ballcap printed "I'm A Spammer"? Spammers buy service from an ISP, spam for 24 hours and then move on. By that time, it is too late to do anything. The whole IP block get slammed onto a list and then takes weeks to get it off.

No, you self-righteous crusaders are not part of the solution. You can't bomb an entire village to catch one bad guy and then expect the locals to think that you are doing them a favor.

Re:How *do* we fight spam?

[Anonymous Coward]

That's right. And to fight this heinious crime, I declare that we all purchase viagra pills with invalid credit cards. Do you know how much it will cost these Viagra sellers for accepting false purchases or even to process rejected paymets ? Millions !. That's right if every net user attempted to fake a credit card and attempted to purchase fraudulently from the penis enlargers and viagra sellers, we would dry up Al-Queida's funds immediatly as well as rid the world so much useless SPAM. So do it for the war against terrorism (not to mention the killing the spammers). Net users unite ! Go and fill out every solicitation you can with difficult to detect incorrect information. There will soon be no terrorists !!! ... war i say WAR ... cough cough against cough ......

Re:How *do* we fight spam?

[Anonymous Coward]

You utter fucking moron.

So this guy deserves to be barred from the internet because his only available ISP won't ban one of it's users as demanded by an organisation that won't identify itself and provides no way to remove an IP range from their blacklist?

Fuck you, dipshit. Get the fuck off my planet.

Some of us use the internet for things other than whacking off to pr0n and posting on slashdot and actually have businesses that rely on the internet, and email in particular.

Re:How *do* we fight spam?

[dubl-u]

The problem is that many people, for a variety of reasons (geography being one) can't change ISPs,

I'd be intrigued to hear the actual details on this. My mom lives in a town with one stoplight, 80 miles from the nearest metropolitan area, and she has several ISPs to choose from. Can you really not dial an 800 number from wherever you live?

and many ISPs (mine included) did nothing in response to my complaints (because they knew I wasn't going to move). So what does this do? It certainly doesn't help anyone!

Well, that's not quite the case. It has made you aware of the problem. You'll keep your eye out for a solution. And now you know exactly how much you matter to your ISP.

But that aside, I think there can be value in boycotts. There are some corporations whose practices I don't like, so I don't do business with them. (Those who hire telemarketers are one example.) There are some ISPs who allow spam; I don't accept mail from them.

Whether or not this results in actual behavioral change is almost beside the point. Take my girlfriend, a dedicated vegetarian for the last 15 years. She'll refuse to eat something with even a trace amount of gelatin. Is that really going to change anything? Probably not. But I respect her devotion to the principles behind her choice.

I feel the same way about spam. If people want to help fund an ISP that is helping to ruin the internet, hey, they can do that. But they shouldn't expect to use that same internet to get ahold of me.

Re:How *do* we fight spam?

[gorbachev]

Did it ever occur to you that ISPs do not get blocklisted in their entirety for signing up newbie spammers?

Did it ever occur to you that most career spammers that WOULD cause the ISP to get blocklisted to hell and back are all known and the reason why ISP's still sign them up is because they either do NO background checking or get greedy by the extra money the spamming scum is handing to them?

Re:How *do* we fight spam?

[wantedman]

My mom lives in a town with one stoplight, 80 miles from the nearest metropolitan area, and she has several ISPs to choose from. Can you really not dial an 800 number from wherever you live?

Although your mom might live in a one stoplight town, she prolly doesn't own a major buisness that needs lots of bandwidth, correct?

You must sign contracts to run large websites, and to move them, you'd have to break that contract. On top of that, you'll have to worry about breaking something during the transfer. Plus, what happens if the new ISP you've just moved to is put on SPEWS? Then you'll have to move again.

A company can't run like that, and a popular fan site, like maddox, seanbaby, something aweful, X-entertainment, fark, etc, just doesn't have the cash/time to move around whenever it feels like.

Re:How *do* we fight spam?

[fishbowl]

>I really have come to have serious issues about
>the blacklisting process

I'm surprised it's not actionable. Actually, I'm sure it would be, if someone were to enumerate the damages done by the blacklisting and press a civil case to demand compensation for the damages.

Doesn't sound like anyone has cared enough to do that yet.

Re:How *do* we fight spam?

[Anonymous Coward]

There is no bombing going on here, just some people saying *we* won't accept any mail from this ISP until this ISP stops hosting spammers.

People are allowed to chose who gets to send mail to their system, for whatever reasons they want.

Re:How *do* we fight spam?

[Anonymous Coward]

He is NOT barred from the internet. He is only barred from sending e-mail to people who have chosen to refuse receiving any mail from him or his ISP.

Why should he be able to send e-mail to people who don't want his mail?

Re:How *do* we fight spam?

[Anonymous Coward]

Are you serious? Suing people because they don't want to receive mail from you? What's next, suing people because they don't want to talk to you? And then suing people because they don't want to have sex with you?

(Actually, a lot of slashdot readers would like the last one)

Your "right" to send e-mail ends at my mail-server.

Re:How *do* we fight spam?

[michellem]

I have a T1 line - this is not your average ISP issue. And, it's not really a scumbag ISP - they are not, from what I know, an especially spammer-friendly ISP - they just got on someone's nerves one day.

Look, I am a systems administrator, and I deal with a lot of spam every day, for myself as well as people who have email on my servers. I don't get what the problem is with using a labeling approach to spam, instead of simply blocking it. Yeah, it takes processing power, and time to administer, but it's way better than spending my time (and $) chasing after my ISP or filing lawsuits, or dealing with clients who can't send mail to one person or another, or what have you to stop this.

I think that ultimately, the blacklisting approach is 1) a losing battle - (how long will it take for most addresses to be blocked?) and 2) just manages to make the lives of more and more legitimate people difficult. For every block of a class C address (or several, in my case), you might be blocking one spammer, but 10s or perhaps even 100s of legit people who just want to send email. And the stories I've heard about nonprofit organizations that send a mass-email to their constituencies, and one irate person who may have been on the list accidentally complains, somehow they get on spews, or some such list, and all of a sudden, they have real trouble communicating with people. This whole approach is just, IMHO using a bear trap for a mouse.

Re:How *do* we fight spam?

[Anonymous Coward]

Your "right" to send e-mail ends at my mail-server.

Fine, but, you need to come to grips with the fact that email is only an effective method of communication if it allows person A to transmit a message to person B. Blacklists break the established protocol by creating islands where messages are not permitted to pass. This may be legal, but, it cheapens the system for everybody... why bother having email at all if I can't use it as it was intended? SPAM is a nuisance, but blacklists do far more harm, since SPAM rarely prohibits the delivery of messages from A to B (which is, I repeat, the point of the system).

The point of trying to block SPAM is to increase the usefulness of email for most people. Blacklists have precisely the opposite effect.

Re:How *do* we fight spam?

[Phil John]

problem is, they may want his mail...but because they are signed up to a retarded blacklist they cannot get it. I've seen many cases of genuine solicited mail not getting through to it's intended recipient, who wanted it because of a blacklist. In this case, I would say "Move to an ISP that doesn't have a mail admin braindead enough to use Osirusoft".

Re:How *do* we fight spam?

[tybalt44]

You can't bomb an entire village to catch one bad guy and then expect the locals to think that you are doing them a favor.

It's not about whether you're doing "the locals" any favors. It's about doing millions and millions of others a favor... blocking a spammer.

I can understand that you would want your individual concerns to be considered far more important than the collective concerns of millions of other people. But I don't agree that they should.

Re:How *do* we fight spam?

[fishbowl]

>Your "right" to send e-mail ends at my mail-
>server.

I don't care what you do with your server. I'm more concerned that the people publishing blacklists might somehow be restraint of trade or libel. Put Microsoft and AOL on one of the more widely accepted blacklists, and see if you come out without a lawsuit being filed...

Re:How *do* we fight spam?

[TaliesinWI]

The problem is that many people, for a variety of reasons (geography being one) can't change ISPs, and many ISPs (mine included) did nothing in response to my complaints (because they knew I wasn't going to move).

Or in many cases the spammers are paying the ISPs far more per month than the $19.99 dial up guy who's complaining about spam.

Who do you think they're going to bend over backwards to serve?

Re:How *do* we fight spam?

[Mryll]

The blacklist providers aren't making anybody use their lists. They're not restraining trade.

Re:How *do* we fight spam?

[fishbowl]

But they are claiming that certain users are spammers when they are not. Spamming is illegal in some jurisdictions. That means they are accusing individuals of criminal activity without any process or evidence. In the wrong hands, that just might be a legal problem.

Re:How *do* we fight spam?

[dubl-u]

Although your mom might live in a one stoplight town, she prolly doesn't own a major buisness that needs lots of bandwidth, correct?

If you need lots of bandwidth, then put your servers somewhere they can get it. The whole point of the Internet is that you need not care where something is.

You must sign contracts to run large websites, and to move them, you'd have to break that contract.

If you can no longer send out email because your provider has gotten on blocklists, you should be able to get out of your contract pretty easily. It wasn't a problem for me.

Plus, what happens if the new ISP you've just moved to is put on SPEWS?

Then you, having learned a lesson from the first one, get to collect on the substantial penalty clause you wrote into your contract. It works for me.

popular fan site [...] just doesn't have the cash/time to move around whenever it feels like.

If you don't have time to do something right, maybe you shouldn't be doing it.

Re:How *do* we fight spam?

[dubl-u]

I think that ultimately, the blacklisting approach is 1) a losing battle

Great! You shouldn't use it, then. It works for me.

I don't get what the problem is with using a labeling approach to spam

Labeling only works at a certain spam volume. I'd guess spam is maybe 75% of my mail. Now I just route all of that to a folder, which I look at occasionally. But it's getting to be too much to even scan for mistakes; I now often flush it after just a glance at the TOC.

Now imagine you send me mail that gets misidentified as spam. I'll probably delete it unread. You'll never know. At least with a blocklist you'd find out that your mail was misidentified.

And the stories I've heard about nonprofit organizations that send a mass-email to their constituencies, and one irate person who may have been on the list accidentally complains, somehow they get on spews, or some such list, and all of a sudden, they have real trouble communicating with people.

It takes a lot more than one irate person to get a listing on the blocklists I use.

This whole approach is just, IMHO using a bear trap for a mouse.

Spam is a mouse? From the stats I've seen, it's approaching 50% of all email volume, and growing exponentially. That's a mighty big mouse. So far, even bear traps like SPEWS have only had small effect on the problem.

Monopoly

[yerricde]

They want you to get flamed to death as further punishment.

"Switch ISPs." So if a major residential cable modem ISP's mail server gets blacklisted, then how is anybody in any of the towns serviced by that cable company supposed to send e-mail to users of ISPs that use SPEWS?

Re:Monopoly

[Shimbo]

"Switch ISPs." So if a major residential cable modem ISP's mail server gets blacklisted, then how is anybody in any of the towns serviced by that cable company supposed to send e-mail to users of ISPs that use SPEWS?

Don't use your ISP's mail relay; use a webmail service, or an authenticated relay provider.
Sure it's not so convenient - you have to go to extra effort to route around the telco monopoly.

Re:Monopoly

[Anonymous Coward]

> Don't use your ISP's mail relay; use a webmail service, or an authenticated relay provider.
Sure it's not so convenient - you have to go to extra effort to route around the telco monopoly.

Many ISPs block outbound port 25 traffic not destined for their mailserver(s). So, what now? No "extra effort" will work unless those other mail relays accept traffic on non-25 portnums.

Oh, that's great

[El Cubano]

This shutdown seems to be in response to a several-week-long DDoS attack on Osirusoft,

They guy is dealing with a huge DDoS attack and we link his page from the front page of /. ??

I guess we can't make things any worse, but come on. Give the guy a break.

Written in dust on the e-mail system

[hackwrench]

FIX ME!

temporary SpamAssassin fix

[merlyn]

Until SA gets updated, you can add this to your local or global config to ensure that Osirusoft is never used:

score X_OSIRU_OPEN_RELAY 0.0
score X_OSIRU_SPAMWARE_SITE 0.0
score X_OSIRU_DUL 0.0
score X_OSIRU_DUL_FH 0.0
score X_OSIRU_SPAM_SRC 0.0

If I'm reading the default configuration correctly, the first two of those checks are non-zero only when relay checking is enabled but bayes is disabled, but you might want to use this entire list just in case.

Re:temporary SpamAssassin fix

[Anonymous Coward]

I would rather uncomment all the osirusoft headers. If I interpret the file correctly, the osirusoft DNS is still being queried in your setup, causing unnecessary lookups and possibly timeouts.

Re:temporary SpamAssassin fix

[MasTRE]

Surely you mean _comment out_ (or delete) the *_OSIRUSOFT_* entries in
/usr/share/spamassassin/20_head_tests.cf
? Works for me.

This have anything to do with changes at Spamhaus?

[Alowishus]

I recently saw a copy of this email from the Spamhaus project saying that they would no longer be making their blacklist available through other 3rd parties such as Osirusoft. Perhaps this sparked the shutdown of the Osirusoft project?

Date: Wed, 6 Aug 2003 18:42:07 +0100
From: Steve Linford
To: nanog@merit.edu
Subject: SBL soon only from sbl.spamhaus.org

If you currently use the SBL by querying the master zone
sbl.spamhaus.org then you can ignore this message.

If you are using the SBL via 3rd party composite DNSBLs and not
directly from sbl.spamhaus.org, then please read this as the
following change affects your DNSBL setup.

For a long time the SBL has been available either directly from
Spamhaus (as sbl.spamhaus.org) or via 3rd party composite zones such
as relays.osirusoft.com (as spamhaus.relays.osirusoft.com) and
blackholes.easynet.nl which import SBL data from Spamhaus. This
distribution is now changing. In order to better manage SBL
logistics, DNSBL zone and query traffic, from Monday 11 August 2003
the SBL should only be available from sbl.spamhaus.org.

The fact the SBL was available from multiple DNSBLs was causing some
confusion, plus other small factors (such as the different zones
having different build times - which for example meant that we'd tell
someone an IP had been removed, but they'd contact us a few hours
later to say it was still blocked), plus the likely emergence of
further composite lists which may add confusion, meant that it was
time to make a change now rather than in a year or two.

So, if you are not using sbl.spamhaus.org but would like to continue
using the SBL, please add sbl.spamhaus.org to your mail server's
DNSBL list.

--
Steve Linford
The Spamhaus Project
http://www.spamhaus.org

Re:Slashdot Censorship

[Anonymous Coward]

Install OpenBSD first ;)

Bad for any RBL!

[IdleLay]

I maintain a few smtp servers and use the osirusoft quite extensively. This kind of things really hurts when I lost a hell of a lot of emails because the admin can't be bothered to publish the fact that he is blocking the entire flaming world and only finding out about from people that are trying to email me and /.

So god sake, blocking the world is worst than not blocking at all. The decent thing to do was to either take the service down (rbl client times out) or unblock everything. This is just plainly vindictive behaviour. This pisses me off more than bloody spammers.

Re:Bad for any RBL!

[swordgeek]

Pretty simple. Osirus has been run by a juvenile, power freak for ages. You use it, you deal with his temper tantrums.

As others have said, this is an RBL that I wouldn't touch with a ten foot pole.

Re:Bad for any RBL!

[IdleLay]

Lesson learnt! Unfortunately the best lesson is always be learnt in the hardest way.

Re:Bad for any RBL!

[Paul Jakma]

This is bull. relays.Osirusoft.com was mainly a composite zone - data from other sources (eg SBL, SpamHaus, SPEWS) made available via a convenient DNSbl service. Joe had little to do with the content, only with hosting it, at considerable expense to himself.

Re:Bad for any RBL!

[IdleLay]

I do agree with this! However I strongly disagree wht the action that he has taken. It would have been more logical to unblock everything or to take the system down rather than blocking the whole world.

And as I said, lesson learnt.

Re:Bad for any RBL!

[Paul Jakma]

Logical depends on how you look at it - the problem is that if he simply takes it down, people dont deconfigure their systems to query his map and he continues to receive a flood of DNS queries - relays.osirusoft.com was high traffic, in excess of 300 queries/sec per server (at a time when there were 6 of them).

In order to stop the traffic he has to *force* people to deconfigure.

Does it seem more logical now?

Re:Bad for any RBL!

[IdleLay]

Logic has no relevenace to a pissed off man! Give it a few days and I'll will certainly send him an email to thank him for the services provided. Right now - I'm still pissed off.

Re:Bad for any RBL!

[Anonymous Coward]

The bad manners of the Spews people did more to help spammers than you can ever know. I know that I was so personally offended by Spews' attitude and methods that I refused to install RBL blocking software for 3 years. Ironically, the world may have had less spam had Spews never existed.

I've been a sysadmin for shared hosting ISPs since 1998. I do all the things you're supposed to -- strict no-spam policy for clients (1 strike), pop-before-smtp authentication, and I observe the SpamHaus SBL. But an early run-in with Spews soured me on anti-spammers for a long time.

(Note to sysadmins: only use SpamHaus SBL. All of the other blacklists are run by children. SpamHaus is run by responsible, thoughtful adults.)

That being said, my first exposure to the anti-spam forces was to Spews. I rented a dedicated server from an ISP that turned out to be on the blocklist. I had to abandon that server after 3 mos and find an ISP with clean IPs (that was legitimate -- it turned out that the ISP was spam-friendly).

A bit later that year, I was building a backup post office on a DSL line with static IPs. Since the IPs had previously been part of a DSL range, they were on Spews, even though they had never been used for evil. No response from Spews, ever.

When spam got really bad at the beginning of this year, I decided to use the RBL feature of qmail. I remembered that SpamHaus had been reasonable and decided to use them. I continue to be very happy with the results, and have yet to receive a complaint from a customer about a false positive.

My suggested solution: I think the solution to this will require a "registered SMTP host" via the registrar system. As a guy who runs shared hosting servers, I can tell you that it will be important for this system to be flexible and a bit forgiving. But if the originating IP of an email is registered as one of these "registered SMTP host" servers, it should be allowed in. We could use the RBL method to do it.

Re:Bad for any RBL!

[efextra]

This is bull. relays.Osirusoft.com blocks on its own too. eg. They block IPs listed on Spamsites.org which no one else blocks.

Is there such a thing

[Eezy Bordone]

As a good blacklist? They are notoriously difficult to get off if you find yourself on the wrong end of their 'mission'.

Osirusoft Going Down

[Czmyt]

I have been using relays.osirusoft.com in my Postfix configuration and also with SpamAssassin for the last few days. I've been unable to access relays.osirusoft.com at all since 6:15 A.M. New York time on Monday 8/25. I checked my mail logs and no messages were bounced because of their supposed blocking of the whole world.

Alternatives.

[Aneirin]

With the millions of dollars spent on blocking spam, one wonders why not upgrading the old mail servers. Quite a lot of spam goes through open relays. If there was a simple verification (dare I say the actual origin should be the origin listed by the mail) there would be a huge decrease in spam. As the world starts to adopt IP6, perhaps we should update email with loopholes being invalidated. If the email you receive isn't "updated" to ensure its origins, then discard it. In this case would people be so retisent to change?

Re:Alternatives.

[Anonymous Coward]

It's called DNSSWEC and it can be implemented now. You don't need to wait for IPV 6

SPEWS was worthless

[jube_fl]

I have been fighting problems with spews for months with the last 3 Class C IP blocks that we have recieved. It was the worst attempt that I have ever seen at a blacklist. Seems like they should have whitelisted everyone instead of blacklisting them. Going to be a lot of pissed off people tomorrow im sure.

Re:SPEWS was worthless

[Skapare]

I found SPEWS to work quite well. What was your problem? Were you using, and getting IP space from, an ISP that was harboring the spammers that keep attacking my network?

Re:SPEWS was worthless

[jube_fl]

I was using an ISP that had problems with 2 spammers years ago. Since then they had had no problems according to spews, yet they remained on the blacklist. Since then I have changed ISP's and don't have these issues. Blacklisting ISP's should not be done unless the offending ISP was a haven for spammers and does not do anything about it.

Re:SPEWS was worthless

[Skapare]

How many years ago was this? I'd like to see specific data. I've seen cases where SPEWS listed networks the admins thought should have been delisted, and it turned out there was a problem remaining (such as DNS hosting for a spammer still operating which would still get that ISP classified as a spammer haven). Many times ISPs think that because the SMTP traffic doesn't come through their network that they can't be harboring spammers. But SPEWS goes after any services provided to habitual spammers. I even read a case where a commercial real estate company was listed because they rented office space to a spammer. I don't have access to current SPEWS data, but I do have the last year of listings archived.

Many people consider spamming a form of theft already covered by existing law (and hence, feel that no new laws are needed, and only knowledgeable enforcement is what will help clean up the net), which just happens to not be enforced by the legal authorities because they don't understand where and how the theft is taking place. As far as I could tell, SPEWS considered it this way as well. And providing any resources whatsoever to a spammer whom you know is a spammer (as determined by whether that theft has taken place and been repeated) would be cause for being part of the SPEWS "boycott" (which is really more like a partitioning of the network between the spammy part and the clean part). What made it difficult to get unlisted is that it required posting in a very noisy USENET forum (NANAE), and required the poster to provide information they often didn't know was needed and had to read around the noise and find out what more needed to be posted to clear the matter up. Unfortunately, many didn't even bother to read any of the followups, and many situations were "dropped".

Re:SPEWS was worthless

[Anonymous Coward]

Having to reply on a USENET group to a bunch of "secret persons" is stupid.
Spews is stupid. You fuckers must all belong to the John Birch Society too.

Re:This have anything to do with changes at Spamha

[Anonymous Coward]

the DDoS has been going on for a looong time now (not that the fat asses at the FBI have been doing more than squat about this particular felony).

it should be fairly obvious that stiff linefeed wants clients of the sbl to be getting the most up to date version of his zone, i.e. using the previous osirusoft mirror is a bad idea at the moment.

put the batteries the wrong way round in your causality meter, did you?

do not use bl.spamcop.net for blocking

[Paul Jakma]

See:

http://spamcop.net/bl.shtml

You should /not/ use the spamcop DNSBl for blocking, as Spamcop themselves state.

Spamcop list on a statistical basis, based on headers of spam reports they receive. This means they also blacklist the upstreams of regular spamcop users (because if all of spamcop user X's mail comes to him via ISP Foo, then ISP Foo's mail server will be in all of user X's spamcop reports).

Do not use spamcop DNSBl for blacklisting - use it tagging or scoring.

Re:do not use bl.spamcop.net for blocking

[Indy1]

i think they say that to cover their asses on the off chance some pissed off spammy sues them. I know a LOT of admins use spam cop's blacklist, and based on my observation, i find that bl.spamcop.net is extremely accurate, and virtually never blocks a legit email.

Re:do not use bl.spamcop.net for blocking

[leviramsey]

How do you know that it virtually never blocks legit mail?

Do you hold off on the rejections until after DATA and simply route the mail to a mailbox for occasional perusal? If you do, I feel for you, man.

Or are you simply claiming a low false-positive rate because you don't get complaints?

Re:do not use bl.spamcop.net for blocking

[Paul Jakma]

From experience, as someone who used to submit all his spam religiously to spamcop, its a guaranteed way of getting your upstream mail servers listed on bl.spamcop.net. (esp if your ISP does any kind of internal email forwarding, not determined by MX records - eg passing mail between SMTP front and back-end servers).

Re:do not use bl.spamcop.net for blocking

[Therlin]

My dad's ISP was blocked by spamcop but for valid reasons (his ISP had a bad spammer that then got kicked out)

It was inconvenient for a couple days, since my dad's emails to me were bounced back to him (he ended up calling me up) but that's a small inconvenience, in my eyes, considering the large amount of spam that gets blocked by spamcop's blacklist. I keep a very close eye on the mail logs (some would say that I'm anal about it) and I see the addresses of the messages blocked by spamcop. Other than a couple of my dad's emails that one time, I have yet to recognize a single valid address (ie. an address I want to receive email from)

Re:do not use bl.spamcop.net for blocking

[Baloo Ursidae]

If you do use any blacklist to reject, be sure to make it clear in the bounce message that this was your doing, not the blacklist. Read spamcop for a while and you start noticing that morons thinking Spamcop is blocking their mail is somewhat common.

Re:do not use bl.spamcop.net for blocking

[swb]

you start noticing that morons thinking Spamcop is blocking their mail is somewhat common.

But aren't those likely to be the same morons that think 2^10 people they've never heard of are sending them a "Wicked screensaver" and they just *have* to open it?

I'm sorry, but I have no faith that the average computer user can interpret even the most obvious mail reject notification. As an example, at least a couple of times per week the users I support will get a bounce message back from some Exchange system with a very obvious description of why it couldn't be delivered (User doesn't exist, Mailbox over storage limit, etc). These are almost always accompanied by a voicemail or email from them asking what's wrong with *our* mail system.

If they can't understand those messages, how are they to be expected to understand anything more esorteric? As for who's responsible for blocking the message, it's "our" doing, but we're not responsible for the content of the RBL.

For RBL rejects, I have a line that redirects them to a web page with a "small words, big pictures" description of why their mail was rejected and alternatate contact means for us to override the blockage for them. But we're also pretty clear that we're *not* responsible for their listing in a given RBL, either as a source of their membership or a way out.

Re:do not use bl.spamcop.net for blocking

[djmurdoch]

Spamcop list on a statistical basis, based on headers of spam reports they receive. This means they also blacklist the upstreams of regular spamcop users (because if all of spamcop user X's mail comes to him via ISP Foo, then ISP Foo's mail server will be in all of user X's spamcop reports).

That's close, but not quite right. Spamcop tries to identify the source of the spam (or the open proxy where it was inserted). When things work, your upstream mail server won't get blacklisted.

Unfortunately, things don't always work, and that was probably the most common way a system is mistakenly listed, up until last week. Now I think the most common way to get a false listing is to bounce a Sobig virus message back to the From: address. Those useless bounces (which don't go to the infected machine) are really irritating, and some people are reporting them as spam.

When someone at Spamcop notices an error, they send a warning message to the person who sent in the false report. If too many errors arise from one reporter, then their account is suspended.

Re:do not use bl.spamcop.net for blocking

[Baloo Ursidae]

I'm sorry, but I have no faith that the average computer user can interpret even the most obvious mail reject notification.

You have a very good point. However, it is enough to weed out the easily mislead that do know how to read. There's no getting through to the selectively blind, so it's best to become selectively deaf. It works well. Most give up. The rest that wonder if you can hear them you can turn around and ask if they can read.

Re:do not use bl.spamcop.net for blocking

[benedict]

bl.spamcop.net blocks legit mail all the time.

I run email for a site, let's call it example.com. A couple
of our users report spam to SpamCop. example.com's IP
address appears in the headers of the spam, because it
was received there. SpamCop therefore listed us! They
are either crazy or stupid. Please do not use their DNSBL
for blocking.

Re:do not use bl.spamcop.net for blocking

[matuscak]

That's what the listing of what its figured out is for. Youre supposed to look at it before you press the "Send spam reports now" button.

Re:do not use bl.spamcop.net for blocking

[Indy1]

because i religously check my logs and look at the names i am bouncing. Domain names like optindeals.com, dynamic-dialup-some-ip.pacbell.com, etc etc. Also, i often redirect a bounced ip into my spam trap and inspect the messages. They're always spam.

Re:do not use bl.spamcop.net for blocking

[Paul Jakma]

You are confusing Spamcop's reporting service with Spamcop's DNSBl.

You have no influence on what goes into the DNSBl. (other than by not using spamcop).

Re:do not use bl.spamcop.net for blocking

[__aaevmb228]

You have no influence on what goes into the DNSBl. (other than by not using spamcop).

This is not true. The reporting service has a fairly large influence on what makes it into the blocklist. See What is on the list?

Re:do not use bl.spamcop.net for blocking

[Paul Jakma]

Yes, I'm aware of that page. Read it very carefully. Now read what I wrote, now consider that I have had experience of spamcop listing my ISP, despite me /never/ having clicked any of the reports to include reporting on my ISP.

Re:do not use bl.spamcop.net for blocking

[Paul Jakma]

When someone at Spamcop notices an error, they send a warning message to the person who sent in the false report. If too many errors arise from one reporter, then their account is suspended.

Great system, unfortunately is /spamcop's/ software (wrt to their DNSBl) which makes the error - not the reporter. Eg, Spamcop put far too much faith in their chaintest.

Re:do not use bl.spamcop.net for blocking

[__aaevmb228]

How can you be sure that your ISP was listed in SpamCop's blocklist as a result of you? It could have been someone else erroneously reporting your ISP, or even a valid report because someone at your ISP spammed someone.

Re:do not use bl.spamcop.net for blocking

[djmurdoch]

Great system, unfortunately is /spamcop's/ software (wrt to their DNSBl) which makes the error - not the reporter. Eg, Spamcop put far too much faith in their chaintest.

It's both the Spamcop and the user who made errors. Spamcop tells its users to check the parsing and confirm that it's been done correctly. It's up to the user to send the report.

If Spamcop makes an error and the user doesn't notice, then the wrong server gets blacklisted. If either one does their job correctly, then things are fine.

Re:do not use bl.spamcop.net for blocking

[Paul Jakma]

Again, like I said, I /did/ check the parsing was correct. Again, the spamcop DNSBl listings are /not/ influenced by whether the user selects or deselects reports.

I get 90% spam, and I'm not sad to see them go

[MattW]

Although the vast majority is filtered, I get as many as 2000 spams per day, personally (the downside to having the same email for 8 years). And I am NOT sorry to see SPEWS go. There's no question SPEWS was effective at getting spammers kicked off their networks. Likewise, arresting everyone in a town every time a crime was committed would probably be effective at stopping crime. That doesn't mean it is a good idea. When a blackhole list has something like a 100:1 legit-mai:spam ratio for blocked messages, the ends no longer justifies the means, in my book. I've had more legitimate mail blocked to or from me or companies I've administered servers for by SPEWS than any other cause in the past few years.

Now, let's continue to turn our attention towards methods of stopping spam that don't involve dropping 100x as much legitimate mail.

Re:I get 90% spam, and I'm not sad to see them go

[Indy1]

spews didnt go down. Osirusoft went down. Osirusoft merely provides a spews feed in addition to Joe Jared's own listings. Sadly, agressive blacklists like spews are needed to put pressure on spam friendly isps like qwest, cw, xo, etc. If you host with them, your giving money to criminals. Would you be upset if you got arrested along with all the islamic terrorists if you were simply providing them housing and shelter? Of course not, providing support to criminals is a crime in itself. And funding a spam haus is a blacklistable offense. I had to move my mail server off ATT some time ago for that very reason, and i sure as hell dont blame the blacklists, i blame ATT and their fucking spammers.

Re:I get 90% spam, and I'm not sad to see them go

[JeffSh]

oh jesus, comparing spam to terrorism, you sound like john ashcroft, and i'll bet that your feelings on him are conflicting your own post.

Re:I get 90% spam, and I'm not sad to see them go

[leviramsey]

I take it you favor arresting the kid at Mickey D's who sold the bank robber a Big Mac with being an accessory?

I take it you support arresting Tim Berners-Lee, the apache developers, and the mozilla developers for providing child pornographers with an amazingly efficient means of breaking the law?

Re:I get 90% spam, and I'm not sad to see them go

[bark]

Yes I would be very upset if that happened. Don't go comparing spam to being arrested by police and having your family and friends worry about you just because you "provided the terrorists with housing and shelter." I've been arrested before. Wrongfully. And I would think that the case you present for example is also wrongful arrest.

Don't talk about stuff you have no idea about.

Re:I get 90% spam, and I'm not sad to see them go

[MattW]

A better analogy would be would I be upset if, say, everyone in my apartment complex was arrested because one islamic terrorist lived there and was arrested. Yes, I'd be upset. Horrified at the injustice, really. In other words, it would be just like I feel about SPEWS listings affected a hundred times as many legitimate servers as they do actual spammers.

Re:I get 90% spam, and I'm not sad to see them go

[Bo Diddly Squat]

What's with the arrested stuff. Being blacklisted by SPEWS is nothing like being arrested.
Being blacklisted by SPEWS is being denied the service of having your mail delivered reliably, because some spammers use the same ISP as you do.
SPEWS doesn't just blacklist whole blocks immediately and first complaints are sent to the ISP's abuse desk. If that doesn't help, the IP is blocked. If that doesn't help, a whole block is blocked.

What I think is a better analogy (and feel free to shoot holes in it) is a taxi company not picking up passengers in your town anymore, because some people from your town who want a ride keep wrecking the taxi.

spews != osirusoft, osirusoft != spews

[Anonymous Coward]

it's called a zone mirror, einstein.

there's plenty more spews mirrors out there, too.

Re:Important Addition

[Czmyt]

I think you also need to add this line:
score RCVD_IN_OSIRUSOFT_COM 0 0 0 0
because all those X_OSIRU_* rules add on to the score of this base rule.

How does this affect my use of SpamAssassin?

[oliphaunt]

I use procmail and SA to filter my mail. One of my procmail.rc recipes opens a pipe to the SA on my hosting company's server, and SA does its thing.

Do I need to change my spamassassin.rc file? Do I need to ask my mailserver admin to make changes?

"To get his point across"

[Andy Smith]

From the submitted story...

We contacted Mr. Jared by phone who informed us that 'everyone needs to stop using Osirusoft and that he's going to be shutting the service down.' Then he says he's going to blacklist 'the world' (aka, ban *.*.*.*) to get his point across.

This sounds a lot like he's annoyed with the DDoSers, can't do anything to punish them, so he's taking out his anger on people who use his service. Nice attitude!

Personally the idea of privately-owned black/whitelists horrifies me. People complain about elected governments interfering with the Internet but then those same people trust un-elected and unaccountable individuals to decide who has the right to communicate by e-mail!

Oh and of course these individuals usually have a "no right to appeal" policy. Well any similarity to PayPal should ring a loud warning bell...

Re:"To get his point across"

[Paul Jakma]

unaccountable individuals to decide who has the right to communicate by e-mail!

They dont decide that at all. They simply make the information available. The people who administrate email servers and spam filters on email servers are the ones who decided to use that list for blocking email.

Re:"To get his point across"

[Andy Smith]

They simply make the information available. The people who administrate email servers and spam filters on email servers are the ones who decided to use that list for blocking email.

True, but this creates a problem of trust followed by abuse of trust.

Anyone setting up a blacklist which is clearly being used to silence certain people would of course fail, because nobody would use that list. But what about the trusted, reliable list that *occasionally* censors a certain IP address because of what is being said or who is saying it?

In that scenario, one of two things would happen.

Either,

1. The world would immediately stop using that once-trusted list.

or,

2. The world would accept that the list will occasionally be abused, but they'll continue using it because it's usually reliable and trustworthy.

I think we both know which is more realistic.

And this assumes that the censoring is ever discovered. The owner of a trusted anti-spam blacklist is likely to be believed over the complaints of a critic who claims he is being censored.

Satire?

[mad_dog3283]

From just reading the headline, I thought this article was going to be satirical.

waah! waah!

[Anonymous Coward]

maybe you should have found out about it months ago when Jared announced the fact in various online forums -- forums that any responsible person calling themselves an admin should take it upon themselves to read, especially when they are using an RBL whose policies are not under their control. hell, you could have just bothered to occasionally read the news updates on his website.

blocking the world is what happens to clean up the idjits who are still using a DNSBL weeks or months after it's been announced that the list is shutting down.

jeez.

Re:waah! waah!

[IdleLay]

As I stated before... lesson learnt. Not a lesson that I will forget. Thank you.

Re:waah! waah!

[AKnightCowboy]

As I stated before... lesson learnt. Not a lesson that I will forget. Thank you.

Aren't you glad you had the opportunity to deal with such juvenile spamcops? Who would've thought 8 years ago a small bit of annoyance with a rising mass-mail problem would fester into a steaming cauldron of 12 year old anti-spam crusaders? The earlier mail admins must've beat their toddlers everytime they received spam to instill such hatred of bulk-mail marketing.

(Oh I'm ever so anxiously awaiting their trademark comeback labelling me a spammer for disagreeing with them!)

Wow!

[OneIsNotPrime]

Osirusoft Blacklists The World

They finally figured out the solution to spam!

Spammers: BRING IT ON

[krray]

I don't see the problem. Well, personally at least. I mentioned to the wife, in March I believe, that I sensed something and nailed it on the head (spammers hi-jacking Windows PC's for relaying).

I have got to say. I sure do like the Unix's. Linux, BSD, OS X -- doesn't matter. A little thinking, some *shell* scripts, and even a few hack job "vi" scripts. Version .01 of nothing that I'd want to show any REAL programmer at least. :) It's dirty, ugly, yet very effective...

I've tried spamassassin, this filter, that filter. For me, my way seems to be working _very_ nicely. I use it at home (Linux), at work (Linux & BSD) and for a few architect friends/clients (OS X). Years ago now (right after the lawyer's emailed me :)I started peppering the Internet with email address' on USENET, and then web pages, etc.

Those are my harvesting address'. Nobody should EVER email them, realistically. Oh the spammers like to try dictionary type attempts/attacks. Thanks -- I added those to the alias database as well for future attempts.

A couple of hacked up scripts (I'm working on it in C for even FASTER speed and some learning :) -- and I frankly don't personally see it anymore. Literally. NONE. I read about it in the logs, of course. :)

Can it scale? Sure -- I'm figuring between 3-500 messages a _second_ isn't a problem. More will simply get queued and then I may notice a "lag" on my server. Bring it on. 1 IP and I whack the entire /24 subnet. I arbitrarily see X number of subnets and I block the /16 subnet.

It's the /8 ball after that and those are pretty much final. 210, 211, or 212 ring a bell to anyone?

Sure -- sometimes somebody will in inadvertently get blocked. The bounced message directs them to a web page explaining what to do next. BEST solution is to call me. You know me right? Heck, you probably have my 800 number... Oh, you DON'T? Piss off then.

Heck, I even spell out a completely external email address (@Mac.com) that you can forward the blocked message to ... I'll take care of it...

Ever wonder what those MAILER-DAEMON messages are all about? The Windows user's machine _starts_ the transmit of the message and disconnect. Your mail server sits there waiting for data from them to a local user -- which becomes un-deliverable and drops a note to whatever you use for the postmaster (can't publish THAT anymore, can we?).

Re-routed now. Thanks, got ANOTHER IP subnet to black ball.

I've racked up a large chunk of the Internet already -- and the stat's only seem to be increasing. Of course I've "white-listed" specific IP's of ISP's mail servers as needed. 3 so far I think. Most ISP's will put their mail server on a different subnet than their assigned IP's. Thanks. 1 white-listing was for a dedicated single IP user who's neighbor turned out to be a spammer. He had words with his ISP -- the spammer was kicked after that turned into conference call.

Sure -- some loser ISP will see more money from the spammer and side with them. We all know those ISP's -- and I've seen the same IP ranges in their listings as mine. I doubt the legit customer will remain there for long as I know I'm not the only one blocking them. Ultimately $$$ talks and the spammers are going to run dry eventually. They're now resorting to theft of services since they can't find legit connections anymore...

REJECT(S) TODAY: 482
Subnets Blocked: 434210 (110289340 total hosts in the /24 subnets [255])
Percentage: 2.834% (3906250000 Internet addresses' [~3.9 BILLION] Served :)
Subnets TODAY? 142 (36068 total IP's)
Harvested: 49 messages
URL Lookups: 0

That's 49 messages today to some dummy account. No hits for the right web page (from a blocked message) in the logs... 142 IP's (now complete subnets

Re:Spammers: BRING IT ON

[Anonymous Coward]

Jesus, are you really spending so much time fighting your spam? Just get a Baysian filter and be over it.

Your dick-waving doesn't impress me.

In the end, all you're doing is supporting a failing system with a bunch of crap-scripts that do way more harm by blocking out legitimate traffic [and no, I don't have to know your 800 number or bother with your 'extra @mac.com address' in order to have something to say to you; case in point: this post].

Fag.

Re:Spammers: BRING IT ON

[Anonymous Coward]

I tend to agree. He might as well setup a whitelist, save himself the hassle.

I don't understand the mentality of "everything is trusted, until it pisses me off, then it's not trusted, except a few times, I'll trust it, oh, and you can e-mail me or spam me here in case you aren't trusted by me.

Try starting with "everything is untrusted, except that which I already know. People who I know can get in touch with me and I'll trust them then."

Re:Spammers: BRING IT ON

[Anonymous Coward]

I suspect he thinks that spending dozens of hours on this scheme is some sort of revenge against Bill Gates or something.

Re:Spammers: BRING IT ON

[Nakiko]

rofl, nice

Re:Spammers: BRING IT ON

[Anonymous Coward]

Wanker... your post was an uninteresting, uninformative bash against windows. Karma whore.

Re:Spammers: BRING IT ON

[Anonymous Coward]

Spending time? I fucking wrote the program and batch routines in one sitting. After that I just look at the logs every so often.

Baysian filters are also being used on the client end. Placed in ~/Spam and ate/blocked by the system for EVERYBODY's benefit.

And no, if you don't know my 800# then chances are I don't want your fucking mail either. Period.

Schmuck

Re:Spammers: BRING IT ON

[Anonymous Coward]

No, maybe 8-10 hours total. Without it I would easily be seeing 500+ spams a day. I personally get MAYBE a dozen emails in a day. Revenge on Bill Gates? Fuck Bill Gates. I don't use and was never impressed with his shit.

Re:Spammers: BRING IT ON

[Anonymous Coward]

The whitelist *is* being built. As needed.

It's more along the mentality of YES, like the good 'ol days EVERYTHING *is* fucking trusted you dim wit.

And yes, once a spam gets in (typically harvested :) it does piss me off. Theft of services. My fucking bandwidth, computers, and network. Block the whole fucking subnet.

You'll only get whitelisted when you may fall into the broad brush strokes being used caused by the spammers. Don't like it? Fuck off. It's still my network, computers, etc.

Yes, I have refused to whitelist requested IP's since those specific IP's got blacklisted and were the cause. Again, fuck off.

We're small potatoes compared to Earthlink or AOL. A few thousand emails daily, maybe. If I let the spam in and tried to post haste filter it then it is still sucking my bandwidth and storage. Fuck off it you don't "get it" then.

And yeah, if you don't know how to get in touch with us (our phone number is posted on the fucking web site for God's sake) ... I again say FUCK OFF. Obviously a moron spammer -- we don't want your shit. EVER.

Without the heavy handed blocking our email would easily exceed 100,000 messages a day. Don't get it now? Fuck off.

I can count on one fucking hand the number of IP's I've had to whitelist due to this method. Sure, obvious and properly tagged communications are also being auto-whitelisted on individual IP's. You see -- my shit ain't mickey-mouse type softwaare and frankly, I've tried every method out there. It works. You schmuck.

Re:Spammers: BRING IT ON

[Anonymous Coward]

Pussy. you have no carma you whore of a anonymous coward. you must just be a uninteresting and uninformded windows loser. fucking stupid ass schmuck

Not a smart idea.

[Metasquares]

I understand that they want to get a point across, but blocking *.*.*.* is a very bad way of doing it. This'd probably break the default and current configurations on thousands of systems relying on SPEWS for blacklisting. They should ALLOW *.*.*.* instead, which would allow anything that depended upon SPEWS to operate as it would if SPEWS simply didn't exist. Since SPEWS doesn't exist anymore, that would make perfect sense.

Blocking *.*.*.* is a way to get people to stop using the server very quickly, though.

Re:Not a smart idea.

[bigberk]

Blocking *.*.*.* is a way to get people to stop using the server very quickly, though.

And that's what he's trying to do. His site is experiencing a major denial of service attack. This is his hardware, his network connection and his business which he's going to defend. His course of action is smart, since it will rapidly eliminate all the legitimate traffic (blacklist users) and leave only the attacking IPs. Then he can get the responsible ISP's to take action, and hopefully even prosecute someone.

Here we go a solution.

[ratfynk]

Simple solution charge more on the monthly cost to users that send more than 250 emails a month or make darn sure that they are legit businesses with genuine e-mail adverts. Charge them more for that based on the mail out rate. Spammers will evaporate overnight. If the isps would make this one move and be in agreement with users to impliment this. Make mass e-mailers that are not legit business pay through the nose. It can be done the ISPs will need to do that or change the protocol to stop forged addresses. One or the other take your choice. The opt out thing is a friggin' joke. Flame me but the situation is that simple.

Re:Here we go a solution.

[forkboy]

I'm not flaming you, although you requested it, but I'd like to point out that not all spam is generated by authentic customers. Many spammers abuse open relays which your solution would do nothing to solve. What needs to happen is the CUSTOMERS of the spammers need to start being punished. The people who are actually selling penis-enlargement cream or auto insurance...the spam will always give a phone number or URL. Trace this # or URL back a real person or business (easily done by citizens, let alone law enforcement) and levy a big honking fine upon them. THAT will make spammers evaporate overnight...these people aren't mass-mailing because it's fun for them, they're doing it because they're being PAID to.

Re:Here we go a solution.

[Skapare]

That's nice. Now explain how to make it actually happen, forkboy.

Re:Here we go a solution.

[forkboy]

Start a movement, last I checked www.punishspamcustomers.com was available. Write letters to congresscritters suggesting this sort of approach as an anti-spam bill. Hire lobbyists. You know, the usual way a law gets passed. If enough people get behind it, it will get attention in state capitols.

Re:Here we go a solution.

[Anonymous Coward]

you are a totally obnoxious looser.

It's called DNSEC .

Go choke on your own cock and die.

Re:Here we go a solution.

[ratfynk]

Then it is back to solution one only authenticated servers and mail, either that or a separated autheniticated pay for email service that is only point to point, and does not allow masked forwarding. Small ISP would not be able to afford implimentation unless there was a return. It could work though there are many who would pay to be on such a system. Businesses would also use it for legit advertising and customer updates and product info. That way any email that people receive with the old protocol would just be considered junk. Problem is you would need to exclude Microsoft software users, Which in reality would not be a bad thing. To get in touch with the company you would need to have authentication reciepts from the original mail. Same thing could be done by an ordinary user, mail a company and they can only reply to you one reply at a time. Most real businesses would not object to this at all. There has to be an easy way to authenticate traffic, the solutions Microsoft is implimenting suck. They are based upon everybody using their authentication software certificates, and are going to be included in Longhorn. This system will make all software and .NET code not run unless it has an authentication ident tag. I hope the MS virus and e-mail crap and their solution to it brings the bastards down. It is the script kiddies running MS mass mailers that are the biggest spammers. They even send you spam trying to recruit you if you are at all tech savy. Some of the software that they try to sell you is as bad as an NT Inet server and just about as much money!

Re:Here we go a solution.

[Skapare]

You still have to achieve nothing less than a 100% impact to make it work. As long as there is some way to slip through, spammers will do so. They will be more clever in hiding, and will be in foreign jurisdictions. And if you go after the people that pay them to spam, the ones that are advertised, the spammers will do promotions of some businesses that never did anything (except maybe piss off a spammer) just to get you to attack them. As long as spammers know how you will react to what they do, then they control you.

What about DNS blocking..?

[Anonymous Coward]

I wonder how many places with crazy zealot admins. are left without any internet access at all now--some people actually used this for DNS blocking, http blacklisting, and denying routing.

Re:What about DNS blocking..?

[Skapare]

That was apparently the goal of the spammers who launched the attack. Take down the DNS blacklist by DDoS-ing it so much that it has to get shut down (not just unavailable, but literally switched off, as the case is now).

hmm, I got no extra

[Barbarian]

My email providers are a large regional cable modem ISP, and hotmail. Today I got 2 unfiltered spams on hotmail, and 1 on my regular ISP. pretty much regular traffic. And neither of them used SPEWS.

blackholes are doomed to suck

[bussdriver]

They were DOOMED as are the other blackholes; to suck, but they did pull in a mass of spam along with the innocents.

Re:blackholes are doomed to suck

[Skapare]

What makes you say they were doomed to suck? I found SPEWS to work quite well. Oh, and when it listed an ISP that harbored spammers, I cheered. And when some whiney land shark comes along and doesn't understand that it's a boycott against his ISP for harboring the people that keep on stealing my network and server resources, I laughed. And I tried to explain it. And if they didn't move on to another ISP (and I don't want to hear excuses about that not being an option, because it was an option in 99.9% of the cases), I laughed even more.

Re:blackholes are doomed to suck

[Anonymous Coward]

I want you to keep using that logic when you block my Earthlink or rr.com mail that is legitimate.
You one size fits all mentality is bullshit. You would block earthlink or rr.com and call them scumbags in a heartbeat.

fuck you.

DNSSEC is the answer but you fucks are to lazy to implement it. You would rather just play god for everyone else you drork fucks.

Anti-spam goals do differ and complicates things

[Skapare]

There are actually two different anti-spam goals. A few people have both of these goals, but quite many people have only one or the other:

• Prevent the spam from entering my mailbox.
• Prevent the spam from using my resources (or my company's, or my ISPs).

The first goal includes such things as making sure children and sensitive adults don't see porn spam. But lots of people are simply offended by the spam, especially porn or body part enlarging spam. And others are simply offended by someone assuming they were interested in a great money saving offer for something they have no need for. This first goal seems to be what most people have, and what the current political rumblings are about.

The second goal is one a lot of people are not aware of, or don't understand. yet it is as serious a goal, if not more so, by certain groups of people. This involves reducing the network bandwidth and server processing resources used by the spam, or stopping it entirely. These things cost money, and it costs about 10 to 40 times as much money to receive (delivered) spam as to send it. It still costs 5 to 10 times as much just to take the SMTP connection, carry out the talk, discover it's a spammer, and refuse the spam.

In other words: the spam problem is not solved by blocking spammers ... just reduced in cost a good bit.

Solutions that involve scanning spam content for the nature of what spam looks like does not help reduce the costs at all. In fact it increases it because all this extra processing is now done by the server, and the network bandwidth is used to send the content that might otherwise not have been sent.

To those, like myself, whose goal is to reduce costs, SPEWS was a great tool. It was very effective in blocking spammers, plus it forced quite a number of ISPs to terminate the spamming scumbags that slipped into their networks under the guise of legitimate customers. In that way, it worked; it did what it was supposed to do. Too bad a few other ISPs were too stubborn to deal with the problem, and too many customers of spammer harboring ISPs whined more about why SPEWS was targeting them, and making excuses why they could not switch to a decent ISP (excuses that didn't apply in 99.9% of cases). Unfortunately, quite a lot of people simply never "got it" as to what the purpose of SPEWS was. The SPEWS web site was more geek/admin talk, and not well enough written for the average person to understand. I was starting to work on my own "how to get out of SPEWS" document, but I just haven't had time to put in on it.

There are a lot of things people say as to how to stop spam. The one I hear most often is that if people would just delete the spam, or if network admins would just block only spammers and no one else, then spammers would cease making money and would stop. This is simply not the case. First, not everyone will do this. We see from these recent worms and virii that way too many people don't patch their computers anyway. There will always be gullible people who respond, and there will always be spammers to take their money.

The real way, and I think possibly the only way, to stop spam, is to treat all spammers as equivalent to cyberspace terrorists. Take no prisoners, and take no excuses.

Remember, spammers don't care what people who will never respond do with the spam they send. They don't care if you press delete, or filter it out with SpamAssassin, or even block them. They don't care because you aren't going to make any difference to them anyway. And if you do block it, you won't be complaining to the spammer's ISP, and hence, they get to spam even more. To a spammer, someone who blocks their mail is better than someone who gets their ISP account terminated. This is part of why just blocking spammers is actually making the problem worse.

If major blacklists can be sued...

[KalvinB]

What about local blacklists? Am I under some legal obligation not to use a blacklist on my server which I use to host e-mail accounts? What's the difference between my local blacklist and SPEWS?

Idiots need to learn that no one is obligated to allow others unrestricted use of their private resources. You don't have a legal right to tie up MY CONNECTION and MY HARDDRIVE with YOUR CRAP.

Can't send an e-mail to my server because I blocked your domain? Too f-in bad. Contact your "customer" with a letter or by phone. The first amendment doesn't override my ability to mark you as trespassing on my property if you attempt to tell other people who reside on my property how you like to suck on a horse. In fact I have a right to ban people who wear funny hats from my property if I so choose. It's MY PROPERTY. I CHOOSE who can be on it.

Blacklist == restraining order.

Last I checked those were still legal. You don't have a first amendment right to talk to your ex wife who you beat and banned you from comming near her.

People who try to pretend the first amendment grants them some kind of right to my resources needs to go back to kindergarten and start the educational process all over again.

Ben

Re:If major blacklists can be sued...

[leviramsey]

Wait until your customer sues your ISP for tortious interference and false advertising. Wait until they sue you the admin personally for a million or so and force you to either pay $250,000 to settle or endure a year with a major yellow flag on your credit record (thanks to having attachments on your assets).

I'll be laughing my ass off when that happens.

Re:If major blacklists can be sued...

[hazem]

an't send an e-mail to my server because I blocked your domain? Too f-in bad. Contact your "customer" with a letter or by phone.

But if YOU are my ISP, and I'm a paying customer with an inbox, I expect that I will receive mail that is sent to me. If this is not the case, you need to specify that to me so I can decide whether I want to use your service.

By blocking mail to my inbox, which I've paid for, you could possibly even be considered in breach of contract.

Of course, if you're just running your own server, you're free to do what you want with it.

Re:If major blacklists can be sued...

[zangdesign]

By blocking mail to my inbox, which I've paid for, you could possibly even be considered in breach of contract.

Depending on the TOS, of course.

Just thought I'd throw that in.

Re:If major blacklists can be sued...

[hazem]

And the EULA!

Re:If major blacklists can be sued...

[91degrees]

Good point, because we know that all ethics are clearly spelled out in the TOS agreement, and it isn't simply a legal mechanism to prevent people from suing an ISP for negligence.

Re:If major blacklists can be sued...

[Cederic]

The difference is that if SPEWS lists my IP, they're effectively declaring that I am spamming. This is libellous; I never spam.

If people subsequently block my emails as a result, then I have suffered from the libel, and that's actionable.

If you personally maintain your own blacklist, then you're not publishing falsehoods about me, you're merely holding them as your own opinion. That's not actionable.

Hmm, use of UK libel laws as anti-blacklist measure. Could be a fun one to try in court..

~Cederic

Re:If major blacklists can be sued...

[Anonymous Coward]

In fact I have a right to ban people who wear funny hats from my property if I so choose. It's MY PROPERTY. I CHOOSE who can be on it.

So long as:
1) your choice does not affect a whining minority that the government panders to, and
2) you have enough money to afford a good lawyer

Otherwise, your just a serf like the rest of us.

Re:If major blacklists can be sued...

[macdaddy]

If SPEWS lists you in one of their blocks, they aren't stating that you are a spammer. They are stating that spam is coming from a netblock and ultimately a provider. If you happen to be part of that netblock or provider then you may very well get listed. They aren't saying that you're a spammer or that spam is coming from you. It's coming from your netblock or your provider. I flat out reject mail from certain providers. Some of those providers are quite large like Broadwing and Ciberlynx. If you as a Internet user are STUPID enough to buy a service from one of those companies and not research a company you choose to do business with then you deserve exactly what you get.

Re:If major blacklists can be sued...

[Anonymous Coward]

Quote
"Blacklist == restraining order.
Last I checked those were still legal. You don't have a first amendment right to talk to your ex wife who you beat and banned you from comming near her.
People who try to pretend the first amendment grants them some kind of right to my resources needs to go back to kindergarten and start the educational process all over again." Endquote

I dont post in here regularly, so excuse the anonmously coward bit.

That is the most stupid post I have ever seen. Spews bans blocks of IP's, how would you feel if someone beat up their ex-wife and it wasn't you, but you got thrown in jail for it ?

This is a time for celebration. There are plenty of professionally run blacklists out there. Spews it not one. Time it was thrown out. Good riddance.

Re:If major blacklists can be sued...

[Isofarro]

But if YOU are my ISP, and I'm a paying customer with an inbox, I expect that I will receive mail that is sent to me.

Including the four thousand duplicates of the sobig email - the one that opens your machine as a spam relay.

Re:If major blacklists can be sued...

[zdislaw]

Blacklist == restraining order.

Not really. A restraining order has to be given by a judge. A blacklist is just some admin or robot. They are totally different.

Re:If major blacklists can be sued...

[Senior Frac]

The difference is that if SPEWS lists my IP, they're effectively declaring that I am spamming. This is libellous; I never spam.

Incorrect assumption. In fact, SPEWS is very careful to declare no such thing.

That you infer this meaning on it means nothing and does not make it libel.

Re:Anti-spam goals do differ and complicates thing

[Anonymous Coward]

you do know that you can still use SPEWS, right?

many zone mirrors (of which osirusoft was one), a good one is at bl.reynolds.net.au

(but in this case it's nice to drop them a note first saying that you want to use the zone...)

Global RE: people who are glad osirusoft is down

[Indy1]

I've seen a LOT of people here who are glad that osirusoft is down because they've got listed along with the spammers in the past. I think they are missing the point on why they got listed and I will attempt to explain the philosophy of the more militant blacklists like Spews, Osirusoft, etc.

Many mail admins (including myself) consider spam to be network abuse and liken it to a criminal offensive. Simply blocking the IP of the spammer itself has been shown to not work very well or for long as the spammer jumps to a different ip addy, often in a different /24 then he was orginally in.

In response to isp's shuffling the spammer around, more agressive blacklisting was done by the above mentioned blacklists. This instantly got a lot of the isps to pay attention and clean out their spammers. It also pissed off a lot of "innocent" users as well.

I say "innocent" because technically they are not pure white innocent, but more of a gray color innocent, because directly or indirectly, they ARE supporting spam. How so? Imagine the following.

Your next door neighbor is an islamic terrorist (spammer). Definitely a criminal. And his landlord (isp) (who is also your landlord) knows he is a terrorist and continues to willingly provide housing from him. In response, the FBI (the blacklists) blocks off your entire street (/24) (which the landlord owns all the housing on) and conducts house to house searches looking for terrorists. You complain when your house is searched. "But I am not a terrorist (spammer)". After finding out your landlord is housing terrorists, you continue to live there and pay rent to him, even though he is harboring terrorists and refuses to remove them off his property. As a result of you continuing to support your landlord finacially, your house keeps getting searched every so often (you stay on the blacklists with the spammer).

Now what do you do? Do you keep paying the landlord and supporting terrorism indirectly? Or do you move out and get a better landlord ?

Thats why you guys are on blacklists. Its not that you've done anything directly wrong, but your supporting spammy isps. The quickest way to find out if your isp is a spam haus, go here.
http://www.spamhaus.org/sbl/isp.lasso

good riddance

[JeffSh]

the death knell of a horrible service and a horrible idea led by machiavellian retards

good riddance

OH boo hoooooo

[NitroWolf]

Somebody call the waaaaambulance.

I'm an anti-spam nazi, and SPEWS gave us all a bad name. I'm glad SPEWS is dead, and it needs to stay dead. It did nothing good for the anti-spam movement, only exacerbated the situation. With no appeal process and the total lack of caring for innocents leaves me with nothing but happiness to see this travesty of justice get blown into oblivion.

Sometimes, the enemy of my enemy is my friend...

Goodbye Spews... we won't miss you, you hulking piece of ill-thought out crap. Let me wave goodbye with my middle finger.

Now, maybe System Admins without a clue will be forced to take real steps to protect their users from spam, instead of playing the lazy asshole and taking the Hail Mary approach that is SPEWS and hoping for the best.

I feel greasy, now... to have agreed with spammers. I think I'll go take a shower.

Re:OH boo hoooooo

[Anonymous Coward]

Well at least we know who one of the SPEWS fucks is. I see he will be voiting for Howard Dean too.
I make sure to vote for Kerry now.

Re:OH boo hoooooo

[NitroWolf]

Think about what you just said, brainiac... "Spews isn't dead idiot.. there's still tens of mirrors out there."

Either Spews is alive or it's dead... mirrors are MIRRORS, not SPEWS. Duh. What are they going to mirror at this point, now that it's dead? A dead SPEWS? The list will stagnate and languish until no one uses it anymore.

Go buy a clue before you call people idiots. You just make yourself look like the fool you apparently are!

YAY you!

Re:OH boo hoooooo

[SirFozzie]

Hate to us it, but it's quite needed here, you rebel without a clue.

Pot, Kettle, Black.

all Spews is missing right now is a primary DNS. There are zones for looking it up, and there already have been several offers to host SPEWS on a free basis, anonymously as before. So all

So Yay You, you cretin.

to quote a good man...

[Anonymous Coward]

"How much have you paid for the services provided by Osirusoft?

What rights do you have under the contract you signed with Joe Jared?

That's what I thought.

You can't be bothered to watch what your mail server is doing?

Then you're stupid, lazy, or both."

Well

[dtfinch]

A lot more than just spammers hate spam blacklists. Most of them block entire subnets, which allows them to fit the entire blacklist uncompressed into a 2mb bit array for very fast lookup. But they don't consider or don't care that they block as many if not more non-offending mail servers as they do offenders with that optimization.

I wouldn't be surprised at all if the people who knocked them out hated spammers just as much. I know some innocent victims who would like to see most blacklist maintainers go out of business or worse.

Re:Well

[Anonymous Coward]

According to RipCurl Spews is nothing but sweetnes and light. So you must be wrong.

Nope I think you are right. He is wrong.

easy fix

[Anonymous Coward]

deny connections to non-resolving hosts and you kill about 50% of the shit. block these addresses, and you'll eliminate 99% of the rest:
12.*.*.*
24.*.*.*
66.*.*.*
67.*.*.*
80. *.*.*
81.*.*.*
172.*.*.*
200.*.*.*
217.*.*.*
218.*.*.*

and somebody needs to declare whatever country "at" is to be a terrorist nation, and nuke their infrastructure. and the french. friggin wanadoo.fr anyway. and interbusiness.it can kiss my ass. and chello.whatever too. and adelphia and comcast and brazil and mexico and argentina. hong kong and taiwan suck bad.

Re:easy fix

[Anonymous Coward]

For the record (for anyone reading the parent), those will block a LOT of DSL (and Cable) subscribers in the US.

Re:easy fix

[Troed]

Nice list - it blocks both my IP and a whole ISP who's a friend of mine. I take your list as a joke.

require sender to know a password

[MrNally]

How about the following solution to spam:

It's not the best solution for all email situations, but I'm getting so sick of SPAM that I think I might like to have an ultra clean account that used the following...

Require the sender to have a password of some sort stored in their system. How they get the password is up to the as yet uncontacted recipient. How about a phone call? Or snail mail? The vast majority of the people I want to email me are easily contacted this way to get the ball rolling.

If ever someone who knows the password gets JIGGY in some way that the recipient no longer wants to recieve email from them, the receivers client could send a password change notice to all registered senders except for the soon to be ousted offender.

All of this could be managed in the background.

The cleanliness of email from such an account would be staggering!

Now I'm not suggesting that ALL email accounts be like this, but I sure as hell would like to have the option on an account or two.

I'm starting to think

[Sycraft-fu]

That we need to get the mafia to take out hits on the spammers. We just need to get them a domain, and get them on some SPAM lists :)

Re:Global RE: people who are glad osirusoft is dow

[JeffSh]

same reasoning used to pass DMCA, patriot act, and any of the other crap legislation.

do you support that as well, or do you only use this sort of arguement when its convenient for you to do so?

Somethingawful.com shut down spews

[Anonymous Coward]

Yeah they did it with their l33t haxors run by Jeff K. They are orginized and must be stopped.

http://www.somethingawful.com/articles.php?a=160 5

Re:Somethingawful.com shut down spews

[Anonymous Coward]

omg wtf lkj;'
www.goatse.cx

Re:Somethingawful.com shut down spews

[RipCurl808]

Patenly false. Somethingawful was not shut-down by Spews. The ISP that SA chooses to use was blocked because of their continuing spam support. SPEWS did nothing to SA. SPEWS cant do a thing to any website. Moron.

Re:Somethingawful.com shut down spews

[Anonymous Coward]

At least most of them are not in NANE waving their atom sized dicks arround, yet anyway. I strongly suggest they avoid doing so since SA can still make it in permanent block lists. These are much more worse then spews, get into one and you pretty much will neve get out.

Even with this warning, bet by the end of the the group will get some SA morons claming to be "t3h 37337 h4x0rrrs" who "brung down" spews. They must be pissing themselves with glee over this, if they haven't wet themselves already.

Re:Somethingawful.com shut down spews

[Anonymous Coward]

Yes, I agree. I strongly urge the FBI to investigate SA and their hand in these DoS attacks.

ah well...

[jpellino]

we had an open relay when our (very small) mail server was set up (still no clear consensus on how to batten down appleshare ip - so in goes the PO for server x...) , apparently osirusoft was a default check in a lot of systems, never actually toggled on in many of them until ashcroft warned everyone to do blacklist checking for open relays that terrosists could use to do something... a lot of mail servers suddenly refused our traffic based on a listing with osirusoft that was nearly a year old and never came up in any significant way - and it took a lot of finagling to get retested and off the list(s). from this perspective there has to be a better way. sorry for jared's troubles, let's hope something springs from this...

SPEWS has no credibility?

[Dimensio]

If SPEWS has blown their credibility, then no one is using them. I guess that Somethingawful.com's ranting against them was just immature whining, since obviously no one is using SPEWS.

Say, how did SPEWS blow their credibility in the first place?

It matters not... "Son of SPEWS" will rise...

[KC7GR]

I would guess it will take no more than three months for another blocklist, very similar to SPEWS, to rise from the ashes. Remember that SPEWS, and the anonymous group of admins that made it up, are still Out There -- they're just without DNS at the moment.

One important point to remember is that Joe Jared himself was NOT SPEWS. No one ever knew who they were (at least no one that will admit to it). He merely acted as a reflector for their listings.

Another thing to remember is that a DDoS attack -- ANY DDoS attack -- is a criminal act. If the release of the recent incarnations of the SoBig worm and the DDoS attacks against SPEWS are indeed related, then it only proves that spammers are indeed criminals.

For my part, I've already seen an increase in spam as the result of losing access to the SPEWS DNSBL. I've had to update our local blocklist six times today, and that's really unusual for my setup. I suspect I'll be fairly busy over the next couple of weeks, doing a little of the same each day.

Spammers may have won a battle today. They're a LONG way from winning the war.

Re:It matters not... "Son of SPEWS" will rise...

[mesocyclone]

I think it can be equally argued that SPEWS denying innocents access to email is also a criminal act! It is certainly a tort that could result in substantial damage settlements.

I was in the middle of a crisis at work (and I telecommute) when SPEWS suddenly cut off my email. This cost my company several hours of critical time.

If I knew who was behind SPEWS, I'd sue the bastards myself.

There are lots of ways to deal with spam. Harming innocent people is a pretty crappy way to do with it... and yes, I read all the analogies in this discussion.

Re:It matters not... "Son of SPEWS" will rise...

[Anonymous Coward]

I disagree on all tenets:

DNSBL's will continue to be attacked, reducing the overall effectiveness of the system. This is evidenced by attacks over the past few months. Expect spamcop to fail quite soon.

Spammers will continue to win this battle, they have millions of hosts, thousands new added daily, an impossible task for a RBL list to maintain continuously and accurately.

We're well aware it's a criminal act. WHat is your point? as if the FBI can stop this flow? as if it matters to them? Calling them criminals does nothing to stop the flow.

BYE BYE SMTP!

Re:It matters not... "Son of SPEWS" will rise...

[Anonymous Coward]

Okay, people, I know this is really difficult for you to grasp, but I'll explain it one more time. I'll use little words so you might understand it...

SPEWS DOESN'T BLOCK A DAMN THING. They publish a list. If an IP or IP range appears on the SPEWS list, it means that SPEWS has evidence that said IP/block is engaged in or is in the same netblock of spammers. Their evidence is always publically available on their website. It is entirely up to the system admins who use the SPEWS list to decide what to do with the contents of that list.

If you want to sue SPEWS or people who use SPEWS, you may want your attorney to explain barratry to you. You may also want to also brush up on your private property law. System admins who use SPEWS do so because they're protecting their private property from being abused by spammers.

Too bad your e-mail access got cut off by SPEWS. Maybe next time you'll perform due dilligence when selecting an ISP by checking that they don't host spammers.

Re:It matters not... "Son of SPEWS" will rise...

[Anonymous Coward]

"Too bad your e-mail access got cut off by SPEWS. Maybe next time you'll perform due dilligence when selecting an ISP by checking that they don't host spammers."

This attitude I find so fucking disgusting I want to pound the fuck out of every dork ass who repeates it. WTF do you get off telling anyone were they can or can not do business? Is this fucking Soviet Russia? People go with hosting they can AFFORD. Get that they go with a host because those hosts are afforable. When YOU start paying for my hosting you can tell me where to do it. If in my valid course of business I should need to contact a customer via email who you are blocking from reciveing my email you are fucking your customer and mine. This is not SPAM it's valid mail that aperson who has established a relationship with me wants to recieve. WTF do you get off blocking entire ISPs and personal email accounts? Only you can explain apperently? I sure as fuck can't explain it. Apperently you consider being a System Administrator the same as god. You people need to exercise some due dilligance on your brains and understand not every person works for a mega corperation with an unlimited budget and staff who can change isp's or hosting services at the drop of a hat as you are apperently able to do. Some people are trying to run a operation on a very close margins. You fucking bigots make me sick. Fuck you very much for screwing of countless persons who are in valid business. I hope your fucking job goes off shore where incidentally most of this fucking spam comes from.

Re:It matters not... "Son of SPEWS" will rise...

[RipCurl808]

This attitude I find so fucking disgusting I want to pound the fuck out of every dork ass who repeates it. WTF do you get off telling anyone were they can or can not do business?

And why do spammers have to cost us billions of dollars each year in time and money because they want to get their MAKE PENIS FAST scams to those who never asked for it? I haven't ever received payment from a spammer for using my INBOX that I pay $#$$ every freaking month to accept MAIL that I WANT to use as their means to get their shit across the net. Tell you what, you pay me $4,000,000 a year to maintain my servers so i dont have to filter for all the servers/hard drive space to accept ALL email for my users. It costs AOL 5 Billion a year to handle their spam load. I figure $4 million is enough to handle my small amount of spam problems.

Is this fucking Soviet Russia? People go with hosting they can AFFORD.

Heard of the old saying ; You GET what you pay for. Im currently with an ISP who boots spammers and was only LISTED once on SPEWS, which wasn't even their fault ( their host had a spammer in the same block as their services ) and once they made know to their ISP that would not tolerate that spammer, their host booted that spammer and now MY host and my website are no longer affected by any Blocklists. I pay for the service I get and it seems that MY HOST really cares that they dont want to be associated with spammers or do business with a company who harbors spammers. My hosting is not cheap for what I want, but it beats out paying $6.95 a month for the same deal I get and be lumped with an ISP who doesn't give a shit about who I am.

So you want cheap hosting ; go ahead. Dont blame us if your ISP values that your $$$ per month isn't enough for them to be motivated to boot spammers.

Get that they go with a host because those hosts are afforable.

There are many affordable hosts out there that dont allow spammers or act on ABUSE reports without so much as a peep of ire out of them. Why are they not crying about blocklists? Well, maybe cause they are smart NOT TO GET ON ONE in the first place?

When YOU start paying for my hosting you can tell me where to do it.

When spammers start paying me for the use of my servers and crapping in my inbox; YOU dont tell me what I can or can't do with email.

If in my valid course of business I should need to contact a customer via email who you are blocking from reciveing my email you are fucking your customer and mine.

If your valid cours of business depends on a system that is fallable and of course NOT DEEMED as a major source of communication, I Hope your business does fail YOU depend on a system that is not protected by any law or guarantee for your main business communication? That is highly stupid. ONLY the Telephone and USPS have such protection. IF your business requires you to be in contact with your customer, LEARN To use the damn phone. EMAIL shall never be a valid form of communication.

This is not SPAM it's valid mail that aperson who has established a relationship with me wants to recieve.

And what's wrong with using the phone? If i was doing business with someoen, I dont want them emailing me, I want to meet them in person, or at least be contacted by PHONE. I definitely would never do business with you.

WTF do you get off blocking entire ISPs and personal email accounts?

My server my rules. Dont like it, TFB.

Only you can explain apperently?

The deny message explains it quite clearly. You are on a ISP that harbors spammers. We dont play or do business with ISP's who contribute to the abuse of the net. Dont like it? TFB.

I sure as fuck can't explain it.

What part of YOUR isp harbors spammers do you not unders

Re:It matters not... "Son of SPEWS" will rise...

[danila]

How about distributing signed blacklists over the net from ISP to ISP (like DNS, Usenet, etc.)? You can't DDoS the whole Internet, can you?

Re:It matters not... "Son of SPEWS" will rise...

[Anonymous Coward]

Yes it's called DNSEC.

At least we now know who at least one of this secret groups members is. The only people who need to keep shit secret are up to no good it's said.

You have a total evil air about your response as well. I wonder if Ashcroft needs to check you little secret operation out.

Think I'll go leave a message at the DOJ they might want to check you out too.

Re:It matters not... "Son of SPEWS" will rise...

[jakob_grimm]

You are going on about how this guy shouldn't use email for business, and how he is an idiot, but you are the one asking for millions to keep spam off your mail server.

Either email is important and valid (to him and to you), or it is not. If it matters, then he should reasonably expect mail to get through regardless of his ISP. If not, then neither he nor you have a basis for complaint.

Re:It matters not... "Son of SPEWS" will rise...

[Anonymous Coward]

You are going on about how this guy shouldn't use email for business, and how he is an idiot, but you are the one asking for millions to keep spam off your mail server.

In the real world, people pay money for bandwidth, and when spammers send us crap we don't want, it costs us money. Real money. Not that pretty multi-colored stuff out of the Monopoly(tm) box. Is everyone on /. so stupid that they can't grasp this one very simple concept?!

Re:It matters not... "Son of SPEWS" will rise...

[mesocyclone]

Publishing a list which identifies my ISP as a spammer is slandering my ISP unless it is true. Facilitating others in blocking my email by intentionally inflicting harm on ME is a tort. Filing one suit when I have been harmed is NOT barratry.

And as far as chosing an ISP, perhaps you should try to understand that many people have exactly ONE choice in a high speed ISP.

In other words, my choice is to cease practicing my profession from my current office, or use this ISP.

Some choice.

Perhaps if people who are so fondly in favor of this realized that not everyone has a choice in ISP's, they would grow up and recognize that inflicting mass harm on others to enforce their cause is about as effective as terrorism, because it is a similar sort of behavior.

I lost more time due to this SPEWS thing than I lose in many months of spam, and there is no evidence that SPEWS does any good.

Re:It matters not... "Son of SPEWS" will rise...

[Anonymous Coward]

So by your reasoning I can call the Ashcroft because you are posting as an anonymous coward and you must have something to hide. I wouldn't be surprised if you are really an evil terrorist trying to cover your tracks and lead them off your trail.

Wow, making assumptions and stuff up sure is fun!

I wonder, which wacked spammer are you?

Re:It matters not... "Son of SPEWS" will rise...

[Anonymous Coward]

I have never sent a email to anyone that I didn't know or didn't fill out a web form to send in my life. So you are wrong. I find a group of secret persons who maintain a list of whole regions and blocks of IP to be extremely evil. Ashcroft needs to know about people who's intent is to break the internet and take the law into their own hands.

Spews is a secret orginization who are casuing damage to other people who have done nothing wrong. I call that an ongoing consparicy.

Re:It matters not... "Son of SPEWS" will rise...

[lx805]

This attitude I find so fucking disgusting I want to pound the fuck out of every dork ass who repeates it.

Eddy? Eddy Marin? Is that you? Because you sure are sounding like a spammer with whacked-pee-pee syndrome.

Is this fucking Soviet Russia?

Careful there... you're just a few thousand miles from Godwin's Law...

If in my valid course of business I should need to contact a customer via email who you are blocking from reciveing my email you are fucking your customer and mine.

If your sole method of contact with your customers is e-mail, then you have a severely flawed business model, bucko. If he's such an important customer, then chances are you have more than one way of contacting him. Quit being such a damn drama queen.

CHORUS: My Server, My Rules. If you don't like it, FOAD.

WTF do you get off blocking entire ISPs and personal email accounts?

REPEAT CHORUS

Apperently you consider being a System Administrator the same as god.

REPEAT CHORUS

You people need to exercise some due dilligance on your brains and understand not every person works for a mega corperation with an unlimited budget and staff who can change isp's or hosting services at the drop of a hat as you are apperently able to do. Some people are trying to run a operation on a very close margins.

I work for a small company with a very limited budget. I can't remember the specifics (I think it was some calculator on Cloudmark's website), but we figured out that spam costs us roughly $7,000 a year per employee in wasted time (at 40 employees we're talking $280,000 -- a lot of money these days). Blocklists like SPEWS save us money. That's money that we can roll back into the company and make it better. Maybe now you can understand why you're not getting much sympathy from me.

You fucking bigots make me sick. Fuck you very much for screwing of countless persons who are in valid business.

Your frothing and foaming at the mouth has been duly noted. If there were any doubts about you being a previously spanked spammer before, you just eliminated those doubts in two sentences.

I hope your fucking job goes off shore where incidentally most of this fucking spam comes from.

No, most of the world's spam is sent from Florida... probably not far from where you live... It gets pumped through foreign open proxies and relays and then ends up back in the US where it is promptly blocked by mine and countless other mail servers.

Oh, and $50 says your job goes before mine.

The only way to stop spam..

[fanatic]

...is to immediately kill anyone who buys anything as the result of receiving spam.

Anyone that fucking stupid doesn't deserve to live.

Stairs in your house

[Anonymous Coward]

Look...spam is dangerous. Stairs are dangerous. Do any of you have stairs in your house?

Slight correction...

[Dimensio]

They're now resorting to theft of services since they can't find legit connections anymore...


Spam is always theft of services. They're just doing it more blatantly now.

Re: Be More Specific About SPEWS

[Czmyt]

I do not like SPEWS's policy of using collateral damage in order to indirectly pressure ISP's to remove spammers. I do like their aggressive policy of adding spammers to blocklists. For these reasons, I was happy when they split their listings into the Level 1 list (known spewers only) and the Level 2 list (lists bigger blocks for political/pressure purposes). Osirusoft was using their Level 1 list, and I found it helpful to use osirusoft. Having relays.osirusoft.com at the end of my list of chosen RBL's (list.dsbl.org, dnsbl.njabl.org, sbl.spamhaus.org, bl.spamcop.net, and blackholes.easynet.nl) didn't leave much spam for their list to catch though.

Thank God!

[Anonymous Coward]

SPEWS' main problem was a complete lack of concrete methodology for who gets added to the list and who gets taken off. My company, who I won't name, was placed on SPEWS several months ago for the crime of being in the same state as a company with a similar name. Apparently, the people who run it have a fetish for conspiracy theories, because no less than 3 large companies were listed in the "trail" that lead to mine.

Even worse, since we were already "guilty", they wouldn't listen to our pleas of innocence, the dirty spammers that we were.

No, I don't feel sorry for these guys one bit. Their methods were about as good as the Salem Witch Trials. Most likely they weren't DDoS'd by spammers, but by people tired of the carpet bombing approach. You don't get away with banning a large ISP for one spammer, and you don't get away with trying to force your agenda on the world.

Good riddance.

Re:Thank God!

[Anonymous Coward]

SPEWS isn't gone just this little kid Jared who decided to "block the world" on his way out.

SPEWS is not stopping spam. They are just a bunch of fucktards.

At Last!

[Poeir]

Finally, a blacklist that doesn't let any spam mail through.

Re: Sad news, osirusoft blacklist dead at 55

[Brian Dennehy]

I just heard on tech news/geek site Slashdot that spam-blacklister Osirusoft was found dead in his parents' basement at age 55. There weren't any more details. Even if you have no idea what the fuck Osirusoft is, there's no denying that you took the time to read this post in its entirety. Truly an American icon.

And in other news ...

[Skapare]

... SPEWS, the (in)famous blacklist that got spammers mad enough to launch a massive attack, will new be distributed to end users via P2P file sharing networks.

Re:And in other news ...

[Anonymous Coward]

Fuck off Skapare you obnoxious human shit.

Your moronic intolerance of any another point of view in this matter is a example of how useless blacklist are always going to be. They are all run by assholes like you.

The way to stop spam is with DNSEC not with S.P.E.W.S or blacklists. But that would be progress and take away your self importance. That appears to be something the blacklisters can't stand for progress and a world that doesn't need their shit all intolerant activities. Whitness teh act of Jared as he closed down shop. Stupid fucks.

YUO ARE TEH FAGOTS!!!111

[Anonymous Coward]

My Emale si working good, but Jerrys mom siad he cant use EMAil anymnore bacause of teh virusses.

SMTP+SPF Plug (was Re:How *do* we fight spam?)

[tugrul]

I was actually thinking about this today after my boss got nailed by SoBig.F and started sending out all sorts of spoofed email. After digging through previous slashdot stories, I think the first step to make things a hell of a lot saner can be found here.

SMTP+SPF is an idea long overdue in production. The owner of a domain should have the right to dictate which IPs are allowed to send mail its name, and blacklisting becomes a lot more meaningful with that right IMHO. If servers maintained & endorsed by a domain are spam havens, just do away with the domain. No more banning entire subnets with all sorts of collateral damage on lots of different parties. And given the substantial control that can be exerted over a mail server, I believe there is a far slimmer chance a responsible domain would get blacklisted on the account of a few bad apples.

Granted, spammers will still be moving targets, and domain registrars will have their pockets lined by them, but I rather sully a jibberish domain than useful & easily transferred IP addresses.

Re:SMTP+SPF Plug (was Re:How *do* we fight spam?)

[Anonymous Coward]

Why do they want to use Microsoft Broken DNS With Underscores(R)(tm)?

Re:SMTP+SPF Plug (was Re:How *do* we fight spam?)

[WuphonsReach]

Or one of the other proposals (personaly, as a mail admin, I don't care which of the proposals make it so long as I can stop having my domain name forged onto e-mails that we didn't send):

RMX proposal

DMP proposal

DRIP proposal

Unfortunately, it'll probably be 2-3 years until the standard organizations get off their duffs and pass something.

The usual glib criticisms of SPEWS

[crucini]

If it was about blocking spam and ISP's they'd strategically blacklist ISP-critical machines and the spammers.

Please tell me more about these ISP-critical machines that don't affect innocent users. But then why are they critical?

As for narrowly listing spammers, it's been tried. Sleazy ISPs move the spammers around to evade such blocks.

Re:The usual glib criticisms of SPEWS

[wkcole]

"Please tell me more about these ISP-critical machines that don't affect innocent users. But then why are they critical?"

These would be the sorts of machines that Spamhaus targets when it does its (rare) escalations: corporate mail servers and the IP space around them. The machines that the ISP needs to conduct business, not the machines of their customers.

You will note that the SBL escalations tend to last only a matter of hours before ISP's have a change of heart about ejecting their spammers.

Re:The usual glib criticisms of SPEWS

[qtp]

Sleazy ISPs move the spammers around to evade such blocks.

Which is precisely why the entire sleazy ISP should be blacklisted.

There is no reason at all to not punnish sleazy internet providers, as they are as much the problem as the spammers they market thier services to.

Re:Important Addition

[ultraslacker]

SA fix for 2.55 / 2.60

Just one zero is needed, as it will disable the test for all modes.

By default, the OSIRU tests are enabled only when running network mode only, so if you havent customized your configuration and changed that, then you are in the clear - but it's a good idea to disable these tests nonetheless.

And they blocked a lot of other sites too...

[World_Leader]

not just The World.

president, The World, www.TheWorld.com

Intent

[Myuu]

This has caused much discussion on n.a.n-a.e, including the suggestion that the attack is somehow related to the SoBig worm. The spammers must be hurting if they can devote these kinds of resources to attacking blocklist

I think that the attacker being a somethingawful zealot is more likely.

"manipulated the blacklists"

[crucini]

Can you cite some examples of such manipulation?

The next SPEWS

[crucini]

Maybe it will come back as a series of signed files on Freenet. After all, Freenet was designed to resist censorship. Of course that would put an end to the speedy de-listings many ISP's got after booting their spammers. I guess it would go to a daily release of the zone file.

Re:Important Addition

[Czmyt]

I think that the default is to run in network mode, so you do need to disable the Osirusoft tests if you do not want their blocklist consulted by SA.

Re:Important Addition

[ultraslacker]

Default is running network and bayes mode - to run in network mode requires turning off bayes (use_bayes 0). skip_rbl_checks 0 is default (see comments in 10_misc.cf)

RBL Consequences

[nsxdavid]

Spam is starting to hurt me a lot worse than I would have ever imagined. It's not the volume of spam I get, which is obscene, but rather the shotgun anti-spam efforts that we somehow get caught in.

About a month ago Earthlink decided we were sending out spam and cut us off. So, despite the fact that we have no relationship at all to spam, we were unable to communicate with any of our customers who use Earthlink. After appealing, they realized the mistake and removed the block. How did it happen? Seems that if an Earthlink customer just accuses you fo spam you can end up on the list. Thankfully cooler heads prevailed at Earthlink and the matter was resolved quickly.

We were blocked by AOL once too. How ironic since we use to be their #1 3rd party content provider back-in-da-day (remember hourly?). They should have know about us. (grin) Fortunately that was resolved too.

Then, of course, today we got hit by SPEWS and that lead to our phone call to Mr. Jared. The poor guy was frazzled, and rightly so. But we had a legit beef...

Our business is entirely web based. We have to deal with a heavy volume of customer feedback, all of which want fast responses. Any hickup and we can get really far behind. But when we get blocked, we're almost helpless. We get an email "Hey, my character got killed by a ravenous bugblaster beast from trall!" And we write back, "Oh my, let me restore your character!" only to have it be filtered out by some shotgun blacklist. They get no response and start flaming us for "not responding". A day or more of this and things get really messy.

You start to feel like you are at the mercy of some so-called "authority" that could not care less about your guilt or innocence. If he or she wants to, they can just take you out. We've participated in opensource, contributed back, done the good netizen thing... yet this real-time blacklist thing hangs over us. We never know when something else like this is going to bite us. And maybe next time there won't be any appeal. :(

Re:RBL Consequences

[nsxdavid]

Errata: Ooops, it wasn't SPEWS but Osirusoft that we got listed on.

Catch 22?

[raehl]

"I have a firewall blocking all incoming mail from China, but I never get any incoming mail from China anyway."

I've already seen Baysian filetering defeated.

[raehl]

I've only seen it a couple times, but I get an email with a paragraph of words that are both fairly common AND fairly unlikely to appear in spam, then the spam plug. Since it has words in it that, due to your corpus of previously received mail, are very common in non-spam and non-existent in spam, it walks right through the filter.

Now, you could flag this message as spam, but then you slowly destroy half of what makes Baysian filtering work: The list of words that are not in spam.

Baysian filtering will probably be effective for a year at best.

Re:I've already seen Baysian filetering defeated.

[badzilla]

I wonder if spammers themselves are also using some kinds of statistical method to defeat Bayesian filters, in conjunction with delivery-percentage feedback methods such as 1x1 webbug gifs.

At first my Bayesian filter did a great job but now a slowly increasing proportion of my incoming spam has a "real" unrelated word in the title.

Re:I've already seen Baysian filetering defeated.

[Anonymous Coward]

You don't know what you're talking about, and are as clueless about bayesian filtering as you think you aren't.

Re:I've already seen Baysian filetering defeated.

[Crispy Critters]

"I get an email with a paragraph of words that are both fairly common AND fairly unlikely to appear in spam, then the spam plug...you could flag this message as spam, but then you slowly destroy half of what makes Baysian filtering work: The list of words that are not in spam."

This will not necessarily happen. These words will become neutral and not affect the score either way. There will still be words that appear in your email correspondence but not in the spam. First off, a Bayesian filter will in effect build up a whitelist of addresses to accept, so you need to be more worried about what words will show up in messages from random strangers who try to email you. They will be mailing about your web page, your business, or topics related to mailing lists and usenet groups you participate in. This should provide a more specialized set of words that are common in your mail but less likely to be chosen at random by a spam generator.

A fascinating feature of these filters is that they are tuned for specific characteristics your email. There is no general way of choosing content of a spam so it will slip through everyone's Bayesian filter.

Re:I've already seen Baysian filetering defeated.

[koehn]

The your bayes implementation isn't working correctly. It's supposed to find the n most spammy and n least spammy words in the message, and use those for doing the math. Including extra common language won't help, since common words won't affect the score one way or the other: "mortgage" will still rank high on my spam list. See paulgraham.com for a complete description of exactly this attack.

You volunteered.

[raehl]

You're financing the enemy.

Re:You volunteered.

[Anonymous Coward]

How would you like it if I harmed you for not boycotting something?

For an example recently discussed on slashdot, and unquestionably more evil than spammers (or ISPs that don't shut down spammers as quickly as blacklist maintainers would want) - DeBeers.

I should probably go around defacing the property of everyone who buys diamonds.

Taxing Emails?

[Anonymous Coward]

Can anyone enlighten me as to why there is not a tax on emails? Perhaps, $0.001, (one-tenth of a cent). This would cost $1 for every thousand emails you send, effectively making emails "free" for the average person. But for spammers it might be several thousand dollars, possibly hundreds of thousands. If this sounds like a naive question, that would probably be because I don't understand exactly how spammers make any money.

Re:Global RE: people who are glad osirusoft is dow

[SQL Error]

It would be nice if SPEWS only blacklisted your street. But when that doesn't work, they blacklist your suburb, then your entire city.

They don't care about your email. All they care about is stopping spammers.

The cure is worse than the disease.

MOD PARENT UP!

[automatix]

This is the most intelligent idea I have heard about spam in a long time. Beats things like signed email hands-down...

It would also help tracking down spammers - if spam came through an ISPs general @superisp.com domain, and it can only be sent through their network - then they can more easily find out who sent it. Blacklists of domains would be a lot better...

Only problem I see is that domains are cheap - up to a certain point.

Rob :)

How to figure out national ip blocks?

[Anonymous Coward]

I know how to whois. But how can I figure out the entire ip block of CI Net or another organization?

Better yet, how can I find out the ip blocks of countries that I know I'll never need to send an email to, or receive one from, such as China or Korea?

Is there a command (non-sco, non-dickhead mcbride unix) that does this? Or do I need to go to a site that lists the above info?

tia.

Re:How to figure out national ip blocks?

[Anonymous Coward]

Why don't you just block IPs that have spammed before ? Catch the initial spam with a bayesian filter or spamassin. It can be scripted and automated if you are careful about checking it regularly by hand, and respond when you get a "why am I blocked" inquiry.

Re:How to figure out national ip blocks?

[blowdart]

It varies, depending on if the IP blocks are SWIPed or not, arin/ripe/apnic updates and so on

Generally it's easier to trust other people and use their lists, for example CIHost (the spamming scum who send emails to role addresses spamming their service, then complain when they get blocked) blocks are listed at http://blackholes.us, as are some countries.

Re:Important Addition

[Czmyt]

Right, the default in version 2.55 is to run in Bayes and network mode. SA will actually run in Bayes and network mode as soon as its Bayes classifier has learned enough messages. It's going to start out in network mode, and quickly switch to Bayes and network mode. Since the scores in the 2nd and 4th positions of the default "score RCVD_IN_OSIRUSOFT_COM 0.0 0.552 0.0 0.864" line are non-zero, that means that SA will run this test in its default configuration, whether it's currently operating in either network, or network and Bayes mode. So either way, you need to set the score for this test to zero to disable it.

Re:Global RE: people who are glad osirusoft is dow

[Anonymous Coward]

Your next door neighbor is an islamic terrorist (spammer). Definitely a criminal

Get it all over with now, just nuke Canada. They're socialist, techno-aware, stealing our jobs and didn't sign-on to "Operation Get Saddam". Plus, they're border leaky and are seriously considering homo marriages and legal pot-smoking. Need I say more?

Patently false.

[Anonymous Coward]

"Servers using [lists on osirusoft] are currently rejecting ALL email."

That just pinged the bogosity meter. I was using Osirusoft for SPEWS lookups when it went down (I've since switched to one of the other mirrors). I didn't lose any mail. The worst side effect was actually helpeful: the timeout on the DNS lookup at osirusoft made most spammers drop the connection, but anyone with a properly configured mail server got through. Even when it was sick it stopped spam! ;)

You folks suggesting Whitelisting and CR should google the NANAE threads on the subject (There are only two or three thousand ;)). They don't work, for too many reasons to list here.

The IDEAL solution is the make spamming a capital offense.

-Ciro The Spider-man
(I don't post to /. enough to warrant making an account. I post on NANAE with the above semi-pseudonym).

Re:Global RE: people who are glad osirusoft is dow

[Anonymous Coward]

What are all still doing here then?

a thought....

[cjsnell]

Ok, this is really awful but...I wonder if it would be possible to implement an HTTP blocker based on these blackhole lists. Let me explain: my father's company has a huge problem with bogus (fraudulent) online orders being placed from Indonesia, Russia, Malaysia, etc. I love Russians, Indonesians, etc, but filtering out these orders from the queue is a pain the butt. Worse yet, new employees sometimes process these orders without knowing any better. Fortunately, our shipping clerks are wise to this and catch them but it's still a big waste of time.

But what if I was able to use these blackhole lists to stop these people from visiting our site to begin with. It's horrible, it's definitely not the way the Internet should be, but it's our business.

Re:a thought....

[Anonymous Coward]

You really are stupid, aren't you?

You have the source to Sendmail

You have the source to Apache

You have the source to the TCP Wrappers

What's stopping you?

Re:a thought....

[blackbear]

I just looked at blackholes.us. Based on what I saw in their text lists, I believe it would be easy to parse out the data into larger blocks (where appropriate) and write a set of iptables rules to block all or some (your choice) of the traffic originating from those IP addresses. If you used this as a choke firewall in front of your web servers performance should be pretty good. For a single fast server, you may be able to do it on the box.

Of course, for the fastest performance you would need an Apache module to deny based on DNS query. Ideally it would do different things based on the result (127.0.0.1 vs. 127.0.0.2) so you could have some granularity in your response, like giving better customers their own server, or blocking based on rough geographic region. Unfortunately, I know of no such animal at this time.

Isolationist policies. Not a fan

[Hecatonchires]

I read a lot of fanfic, and original fiction on the net. I like to zip off little 'Hey, I liked your story' notes, often to people I have never communicated with. I can do this because its easy and I like giving authors feedback. Your solution will make it incredibly difficult to start a dialogue with strangers.

Whitelists and blacklists, 'us and them' policies... I'm guessing you're american.

Many of Your Analogies Are False

[DonnarsHmr]

Well, first of all:
Terrorism is when people bleed and die.

No, actually, terrorism is when you traumatize people who would have otherwise remained uninvolved in order to create pressure for change. So, literally, SPEWS and it's ilk are terrorism of the highest form.

Secondly:
Nobody is forced to use SPEWS; every piece of your mail was rejected by servers whose admins chose to use SPEWS.

Actully, I could be forced to use SPEWS, and I wouldn't necessairly even know it. You see, I don't have a choice of ISPs where I live. I either go with the one choice or I don't use the internet. So if my ISP begins to use SPEWS, I'm screwed.

On to the false analogies:
Or refusing to go to a bad neighborhood. Or voting against a candidate just because you don't like the last president from that party. Or supporting trade sanctions against a country that engages in terrorism or human rights abuses.

What about people who can't afford to live in a better neighborhood (equivalent to only one ISP available)? Also, it isn't like not voiting for the canidate, it's like imprisoning everone who happens to live in the same city as the canidate. Trade sanctions don't hurt the regime, they hurt the people, much like blacklists.

You're right, it does suck for a worker to get fired because his employer is disliked. However, causing his children to starve is can only even masquerade as a good thing if he can scream at someone who will listen. With ISPs, all to often the managment doesn't care and the users don't have a choice.

Re:Many of Your Analogies Are False

[dubl-u]

No, actually, terrorism is when you traumatize people who would have otherwise remained uninvolved in order to create pressure for change. So, literally, SPEWS and it's ilk are terrorism of the highest form.

Really, you need to get out more. My refusal to take email from spammy ISPs is not remotely like hopping onto a bus with 20 pounds of explosives wrapped with roofing nails.

You see, I don't have a choice of ISPs where I live.

I don't believe it. There may be only one cheap choice, but there are plenty of choices. Even if only one company provides broadband to your doorstep, you can still buy email services from a legitimate company. Or you can send your email via dialup to an 800 number. Or satellite. Or via T1. Or webmail.

Actully, I could be forced to use SPEWS, and I wouldn't necessairly even know it.

Uh, that's not forced. That's just ignorance. If your local ISP uses SPEWS and won't let you opt out (something I've never heard of) then you can always by email service from some other vendor.

What about people who can't afford to live in a better neighborhood

That sucks for them, doesn't it. But how much time do you spend helping out people in the inner city? Not nearly as much as you're spending bitching about things that you're too lazy or too cheap to fix, I'd wager.

And the people who dont understand

[RipCurl808]

Are directing their anger in the wrong place to the wrong people....amazing what ignorance can do.

Re:And the people who dont understand

[Anonymous Coward]

I say a lot of them are astroturffing spammers, brain dead admins, unfortunate ISP users that don't understand, and spamhauses.

nice going

[MasTRE]

This was a nice surprise for me at 2:30 AM!

don't blame Joe Jared

[Eunuchswear]

Why the fuck not? His stupidity, blacklisting the whole world, has just made all offsite blacklists useless.

Re:don't blame Joe Jared

[Eunuchswear]

Ah well, yet more proof that usenet is still more intelligent than slashdot.

Er, clueless

[MattW]

First, this is more like because there's a terrorist in a town 30 miles from you, the military parks a tank in your living room until that terrorist moves out of state.

Second, were you aware that by consuming fossil fuels, you are funneling money the middle east, which produces almost all terrorist threats to the United States? That's supporting terrorism. I don't see you volunteering to stop buying fossil fuels until the OPEC countries clean up their terrorist problem.

Third, the idea behind spam prevention is to make email MORE USEFUL for legitimate users. SPEWs does not meet that criteria, because it causes more problems for legitimate users than gain. Moreover, it hides the true cost because few people are fully aware of what spews is doing and why. Even most email admins using spews are NOT AWARE of how it operates. They should publish their philosophy everywhere related to it. If every SPEWS doc had said, "We block enormous blocks of legitimate users, trying to use collateral damage to force ISPs to take action against their tiny fraction of spamming users", SPEWs would be irrelevant today.

Finally, spews is horribly non-responsive and error prone. I still have a colocated server blocked because some ISP on a block that's not even in the same /10 as my ISP happens to have a similar name to my ISP. (the spammer was once a customer of my ISP; they spammed, they were removed. They moved across town to ISP #2, and continued to spam. But customer name and my ISP name are highly similar. Spews concludes they are the same company, despite NO evidence but the name. Result: my ISP is permanently blacklisted on spews because of a spammer that is NOT on their network). Both sets of IPs -- my ISPs and the spammer's new ISP -- are in the same evidence file, and my ISP continues to look 'fresh' as a spammer because of activity on the other net.

how to disable it.

[perbu]

put the following line in your local.cf:
score RCVD_IN_OSIRUSOFT_COM 0

Re:how to disable it.

[perbu]

ehh. nevermind. this is wrong and redundant. *blush*

I Have Only One ISP Available

[DonnarsHmr]

I live in a major metropolitan area. I also happen to do both my job and a large part of my schooling online. This means I have to have broadband. Due to some interesting regulatory bullshit in my Republican-dominated state, there aren't allowed to be two providers in the same area. Oh, sure, they "share" the market, but in a "you get that street, I get this on" kind of way. The upshot, if I want to change ISP, telco, or cable provider, I have to sell my house and buy another one. Tell me, how much choice in ISPs do I have again? Second case, I have relatives that live in the middle of nowhere on a island in the Bearing Strait. Their ISP is packet radio. Hmmm, looks like there's only 1 ISP for a thousand miles in any direction. I guess they can switch ISP by placing penguins in the water alternatingly on their backs and bellies (white for 1). Error correction'd be a bitch though.

Yes, I know there's no penguins there, it was the only binary animal I could come up with at 3:30am

Re:I Have Only One ISP Available

[iCEBaLM]

You have a multiissue problem. 1. your government sucks, try to change it and 2. your ISP sucks, see #1 aswell as 3. spam sucks.

Now with all this sucking going on, do you really expect the rest of us to put up with it because your government sucks, your ISP sucks and spam sucks? No, not going to happen homestar.

My government doesn't suck (as much), my ISP definately doesn't suck, so why should I put up with the suckness of spam because both your government and ISP suck?

-- iCEBaLM

Re:I Have Only One ISP Available

[Anonymous Coward]

You can post on Slashdot, but don't know how to use a remote computer for e-mail. Sad.

MOD PARENT UP

[Anonymous Coward]

This is exactly what I just looked at SpamAssassin's site to put in my local.cf file, and was about to post it here. This is the most useful post on the subject here. When SA's web site is updated for the removal, it may be harder to find this line for those who aren't runnig SA from CVS.

We've had so much discussion o nthe faults/ virtues of RBLs that I'm more sick of it than SCO trolls.

I'll dance on their grave

[jarran]

Quite frankly, they desserve it. I've had no end of problems with one of my mailservers after it was incorrectly blacklisted by Osirusoft, even though:

1. It was not an open relay, and as far I could tell from my logs, prior to banning it they never actually checked to see if it was an open relay.
2. Their own online checker, which I activated several times, repeatedly showed that the server in question was not an open relay.

The online checker repeatedly told me that my server would be scheduled for more tests, and would then be removed from the blacklist.

But this never happened. No further checks were made. My server was never removed from the blacklist. And what's more, Osirusoft refused to reply to any of my e-mails. They refused to even explain why they were blacklisting, despite the fact on several occasions I politely requested either removal from the blacklist, or an explanation as to why I was on it. Ultimately I had to get a different IP address for the machine in question, which was exteremely inconvenient.

I'm strongly opposed to spam. However, any company that offers services to block spam have to accept that they will sometimes accidentally cause problems for legitemate users, and they have to have mechanisms in place for such users to sort the situation out. Ignoring people who have legitemate complaints against you is not the way to do it.

Drop of blood

[Anonymous Coward]

The new internet postage: for every email you send, you have to give up one drop of your blood. I think that would solve the spam problem for good.

What?

[poptones]

The whole point is to validate identity. Are you saying no one does this on usenet? Can't be that, cuz you'd be very, very wrong.

There's already newsgroups devoted to exchanging spams for the purposed of filtering. Why on earth is it so hard to believe this would work for exchanging DNS blocks?

Bigots and censors?

[Anonymous Coward]

It appears in fact SPEWS are just a bunch of bigots and childish censors. Their fanatical anti supposed spam zelotry shows they are persons with ill minds and serious power triping issues. If I find a system administrator at my companies using this list they will be fired. I don't like getting sued for the acts of stupid persons whom are paid to do a good job out of my wallet.

Your job to administer the systems given unto your care. Using SPEWS kind of list is lazy. If you need such a list to do your job I will pay for it. Meaning you will be expected to prepare it your self or I will purchase it for your use. Other wise I am paying for the bandwidth. This is a service company. We rely on email from all over the world to stay in that business. Your use of this list precludes our making money from addresses you block when using this kind of list.
Do your fucking job or find another.

The Boss.

No, THEIR KEY

[bluGill]

You got it wrong: by signing with your public key you, and only you can verify that it was intended for you. That is not what you want, what you want is email signed with their private key, so you can use their public key to verify who sent it. If I sign all my email with my private key, everyone in the world knows that it is me who sent it, and I cannot deny it. If I sign outgoing email with your public key (because I can't know your private key) then only you can verify it, and then all you know is I inteded for you to read it. To a Spammer that may cost enough CPU that it isn't worth it, but it does nothing to help you track down who sent it. (Since much spam is for illegal things tracking down who sent it would be very useful)

Re:No, THEIR KEY

[irc.goatse.cx troll]

". If I sign all my email with my private key, everyone in the world knows that it is me who sent it, and I cannot deny it"

Thats fine until your private key leaks. Didnt Microsofts private key leak a while back? (refering https, not pgp, but the problem is still there).

Re:No, THEIR KEY

[regen]

Actually, the best way would be that both keys would be used. Their private key is used to insure that they actually sent the e-mail, and your public key would be used to prevent mass mailing. By have each e-mail having to be signed with a key for each recipient, you make it computationally expensive to send mass mailings. The one problem is how to deal with mailing lists.

Re:No, THEIR KEY

[ComputerSlicer23]

NO, THEIR KEY, is useless. Unless there is a finite number of them, I am screwed. I've signed up for public keys before. All I had to do was run a couple of PGP commands, then submit it to MIT, now I have a PGP key.

I can't track down who it is, if they use bogus e-mail addresses and create a new key every couple of days. Then just throw away the private key. Now how do I track them down? They had a bogus e-mail address, and a private key that they don't have any more. Plus, I really want to make damn sure they have to re-encrypt it every single time the mail leaves the server. Otherwise some the CPU power will be trivial. Well, encrypt this 1, send it 5 Million times. It's just another hoop to make a spammer jump thru.

Beyond all that, that will just create a black market for private keys of known trusted users.

If you create a system where there are a limited number of private keys (not sure how you accomplish that), then they will just compromise a large enough percentage of them, that it's useless. It'll just create identity theft with e-mail.

If you want my trust, you'll have to use an object I have control of. Namely my public key. It will ensure, you wanted me to have it, and that you had to expend CPU time to get that mail accepted by me. I'll read all of the e-mail that gets signed by my public key. I won't bother if you sign it with a key I've never heard of.

Now, possibly, we can say you have both, but if I wanted to stop spam to my Inbox, I'd require anything that didn't originate off my e-mail server to be signed with my public key (and I'd white list in some e-mail addresses, mostly mailing lists, and my non-technical friends). Possibly I would include other people's keys as e-mails I'm willing to accept signatures for.

Remember identifing the spammer, and proving he sent the e-mail will not stop spam. Making spam a money losing operation, will cause spam to stop. The spammers are pretty well known (it's my understanding). We know who they are, and what spams they send. Still it hasn't stopped.

Make it computationally infeasible to have no targetting involved in your e-mail, and it'll be all spams will at the very least be more targetted, if you make it incredibly expensive, they will stop. The collateral damage is that people will stop using e-mail for a lot of things.

Kirby

serves him right

[Anonymous Coward]

I have been trying for 2 months to get a site removed from this blacklist, the removal procedures from most of these sites simply dont work or are a pain in the ass, requiring support of [] in email addresses etc which ofcause ms exchange doesnt so you cant get sites that run exchange of the blacklist at all, even when they have been made secure.

Re:serves him right

[RipCurl808]

**cough** bullshit **cough**

If you can't follow simple directions, how the hell did you pass the third-grade?

If you can't set up a server correctly in the first place, how the hell did you become a system admin?

what part of private property...

[bani]

...dont you understand?

greylisting

[jdunlevy]

Time again to discuss greylisting?

Looks to me to be an elegant, viable alternative to traditional black/white -listing, both of which require lists be maintained -- and well maintained. Sometimes very large, very centralized lists, which have ugly consequences when they fail.

From the Greylisting Web site (with bolding from me):

The Greylisting method is very simple. It only looks at three pieces of information (which we will refer to as a "triplet" from now on) about any particular mail delivery attempt:

1. The IP address of the host attempting the delivery
2. The envelope sender address
3. The envelope recipient address

From this, we now have a unique triplet for identifying a mail "relationship". With this data, we simply follow a basic rule, which is:

If we have never seen this triplet before, then refuse this delivery and any others that may come within a certain period of time with a temporary failure.

Anybody know where we are as far as a working implementation of this idea goes?

Re:greylisting

[schnozzy]

Greylisting is fantastic. We are using it at one client who received ~15000k spams/month, and now they receive about 12 spams/week with nearly no false positives. Best spam deterrent yet (including Bayes, which solves the wrong problem)

Re:greylisting

[Anonymous Coward]

Google is your friend:

http://projects.puremagic.com/greylisting/

The example is a Milter for Sendmail. There's also ways of getting it working in Exim and Qpsmtpd. Wietse Venema is putting it into Postfix (at which point I start using it...aw yeah). I'm sure there's lots of other examples; sign up for their mailing list like I did.

Re:greylisting

[Anonymous Coward]

You realize that is the exact same URL as the parent? I don't think you have to google for it.

Works for whom?

[amcguinn]

Boycotting mail from spam-friendly ISPs may "work" in that it makes life harder for spammers, but it doesn't work for the poor end user who is losing mail from contacts with "unlucky" IP addresses

Central to SPEWS success was the pretence that it was providing a service to its users, when in fact it was providing a service to the internet at large at the expense of its users.

The end result was that dedicated admins and advisors would force or trick people to bear this cost, who would not have chosen to do so if they knew what was going on.

Incidentally, another good reason for relying on local block lists is that all centralised blocking lists - either DNSBL or per-message like Razor - are vulnerable to deliberate spoofing by third parties who want to deny particular email.

new domain, new spam

[RMH101]

i registered a new domain through ukreg.com and am getting spam to it already. mail at that account has never been used and the only online presence it has is a holding page at that domain's web page without an email address on it.

Re:Global RE: people who are glad osirusoft is dow

[jonesvery]

In response, the FBI (the blacklists) blocks off your entire street (/24) (which the landlord owns all the housing on) and conducts house to house searches looking for terrorists. You complain when your house is searched. "But I am not a terrorist (spammer)". After finding out your landlord is housing terrorists, you continue to live there and pay rent to him, even though he is harboring terrorists and refuses to remove them off his property. As a result of you continuing to support your landlord finacially, your house keeps getting searched every so often (you stay on the blacklists with the spammer).

Holy crap...I couldn't agree less. So I'm supposed to think that it's reasonable for the FBI to block off any street and search any house, for any reason or no reason at all? Without providing any evidence of any wrondoing, much less proving wrongdoing through the system of justice that we established to deal with such things?

You should seriously think about this -- I disagree with some parts of your position on the blocking question, but see plenty of room for discussion there. If this example actually represents your idea of appropriate government measures that might be taken to ensure security, however, then I am absolutely terrified.

Casualites of Spam War

[Channard]

Spammers may have won a battle today. They're a LONG way from winning the war.

But what will be left? What with the DOSes and Spews refusing to whitelist anyone, I see high casulaties. In fact, I'm getting flashbacks to those Daffy Duck/Marvin the Martian cartoons, the one where both Daffy and Marvin were left standing on the one remaining piece of a shattered planet.

So hunt the evil little ******* down and...

[Chris.Boyle]

In this instance the obvious motive for the DoS is to protect spammers' interests, so there's a good chance the attacker is a spammer (well, either that or someone *really* angry about a bad blocking decision). I think it's worth devoting special effort to finding and prosecuting the originator of this attack, since it might lead to a spammer being locked up as well, which can only ever be a good thing. :-)

Re:So hunt the evil little ******* down and...

[Anonymous Coward]

"well, either that or someone *really* angry about a bad blocking decision"

The Spamers are the ones who are to busy to spend time DDOSing this stupid bastard. They are spending there time getting the spam out that is how they make money. DDOSing takes time and time is money. It more likely was some poor bastard who can just afford the hosting he has getting even after finding he can't do anything to get off this list even though he personally has done nothing. You people who are so in love with SPEWS and blacklisting don't get it. More often than not you hurt plain old no spamming persons and business. Read this thread you will see case after case where these people have been fucked over by blacklisting. NO excuse you have can justify hurting persons not involved in spamming by blacklisting their IP. This vigilante bull shit has to stop. Their is a better way DNSEC is way better than any blacklist will ever be.

Re:So hunt the evil little ******* down and...

[RipCurl808]

Become a mail admin/system administrator for a day and you will soon realize how naieve you really are.
How about I send you the 10,000 messages I just blocked today to you so you can "just hit delete". You realize how long that would take you right?

Re:So hunt the evil little ******* down and...

[Anonymous Coward]

So you will not even try to see DNSEC implemented. you will just block mom and pop compmanies who are not spamming instead becasue it makes you work for your money? So some one putting your mom and pop out of business is ok too then. These people on teh blocklist 99.9% have done nothing wrong, never spamed a soul. You just blocklist or blacklist them out of exisistance. It must be wonderful to play god and wreck other peoples business because you don't want to work too hard.

Re:So hunt the evil little ******* down and...

[Anonymous Coward]

And just WHAT business are you specifically talking about, the business of spamming?

pussy

[Anonymous Coward]

Typical tough-talking pro-spam pussy. You don't make the rules, your network admins make the rules.
Don't like it? Too bad.

I understand completely

[Anonymous Coward]

In your zeal to stop SPAM you will blacklist persons who have never sent one peice of SPAM in their lives. I understand you make the asumption that they have the time, know how or money to change their hosting company, the behaviour of the hosting company or the one person who actually is a spammer according to your methods. I understand that you feel making it difficult or impossible to remove ones self from such a blocklist impossible or near impossible is a just or reasonable thing to do> Even if they can't get removed it's OK with you "fuck'um". I also understand you fell putting economic pressure on some mom and pop web operation who is not a spammer is a fair and reasonable thing as well you don't want to know about it as long as you don't have to work too hard for Mega Corperation "hell you have yours fuck everyone else".

In short I understand you are an asshole.

Re: Osama's reasoning

[Talence]

Wasn't that the same reasoning that Osama used? I.e. americans have 'democratically' elected their president and they pay taxes to support the military. Therefore, they are legitimate targets since they support that which is being fought against.

Sometimes it's just impossible to move to a different landlord because the landlord owns too much or you don't have enough money to make the move.

Nice analogy, but it doesn't really cover everything ;-)

whitelisting for websites

[pwarf]

In addition to your whitelist, you can have a rotating password to include in e-mails from new contacts that will be filtered into a folder to decide whether you want to put the address on your whitelist. You can change the non-whitelist password whenever spammers get a hold of it.

This sounds like a lot of trouble, but it is actually pretty easy to implement with the current e-mail system. Here's how:
My address is "person@site.com". Give your e-mail address as person(foo)@site.com. This mail will show up as to "foo". Before applying your whitelist, filter mail to foo into your approve/disapprove folder or your inbox. If it is from someone you trust, add their address to the whitelist. Otherwise, shift to putting another password in parentheses and notify those people on your whitelist that still use that password to move on. This is also a convenient way to track who sends you spam. Register with the site's name in parentheses.
You get the benefits of a disposable e-mail address without the overhead.

Re:whitelisting for websites

[IpalindromeI]

You might also want to take a look at SpamGourmet, which can do this type of thing already and filter it at their level so you don't have to deal with it at yours. I always use a spamgourmet address to sign up for things and I get barely any spam at all.

Re:whitelisting for websites

[pwarf]

Thank you very much for the reference to SpamGourmet. It looks like a great service.

I'd suggest a combination of the SpamGourmet solution and my earlier proposal.

My proposal has the downside of revealing my address to anyone clever enough to realize it. (Which is not a problem once you start whitelisting, but whitelisting is a little drastic.)

On the other hand, I'm a little skittish relying on an ad-supported site for all my e-mail contacts. Also, there are many people I don't want to give an address to with the domain "spamgourmet.com" (sending out resumes, etc.). Less importantly, anyone you send mail will get your real e-mail address in the From: field, so whitelisting may eventually become necessary, too.

The "no-brainer-mode" is depending upon security through obscurity, but changing to the advanced mode with prefixes doesn't seem like too much trouble.

Currently, my spam situation is easily manageable (5 a day or so); I don't even have to use any filtering yet. However, if it gets worse, I think I'll set up a new e-mail address and sign up for automated services with spamgourmet addresses and give out "name([password])@domain.com" addresses to real people.

Re:whitelisting for websites

[TomServo]

I haven't used SpamGourmet, but I do use SpamMotel pretty regularly. I've been very happy with them so far, I used them with an account that gets no spam to date, and no new spam has shown up after signing up with them. If SpamGourmet makes you nervous, my personal experience with SpamMotel has been absolutely flawless.

Pro Spam?

[Anonymous Coward]

Pro Spam my ass. When did I say I was not seriously concerned with SPAM? That is totally besides the point. Blocklisting keeps customers who my business has a relationship with from communicating with us. This is a bad thing. What happens when we are put on suck a list mistakenly? This is a bad thing. Blacklisting and blocklisting are not ever going to be a workable system for dealing with SPAM any more than passing laws will. The last thing we need is a bunch of vigilanties who will not reval who they are forcing their ideas of how to deal with the issue on the people who have to use the system and pay the bills.

When the Network Admins start buying the equipment, paying for the OC-3 and power they can make all the "rules" they want. Until then we live by the golden rule. I got the gold I make the rules. You don't like it quit. If I catch you defing my rules you get fired.

The Boss.

Re:Pro Spam?

[RipCurl808]

Since when has SPAM become a problem. I thought it was spam. Learn the correct terms if you want to even remotely sound like you know what you are talking about.
And if you dont understand the difference between SPAM and spam, then you're like every clueless dweeb who has no idea what sys admins and mail server administrators have to go through.

Re:Pro Spam?

[Anonymous Coward]

STFU you you little Hitler ass hole. He can call it what he wants and guess what He is right.
STFU and get back into you cubicle you stupid little twit.

Uh oh...

[Anonymous Coward]

They shouldn't have blocked Something Awful.

Re:Global RE: people who are glad osirusoft is dow

[Pip]

I think they are missing the point.

So because your neigbour is a terrorist, it is ok for the police to kill you, just because you happen to live next to a terrorist? Or even better, it is ok for a govenment to nuke your city because a terrorist lives in that city?

Now The militant blacklist are not even the police! They are civillians taking justice into their own hands, without first having tried to get the police involved in the problem they are trying to solve. "We'll just kill a bunch of random people, maybe nuke a city or two, maybe that draws attention to our case", this attitude is not less criminal than the terrorist acts you are trying to fight!

Now, as to how to fight the real problem, getting decent laws in place is the first step. This will probably never happen unless you make it very clear to the politicians you elect that this is important to you, as important as fighting any other crime. The second step is getting the police involved once the laws are in place. This will cost money, your (the taxpayers) money, but hey, you thought this was important, so you are probably willing to pay some extra tax.

...And his landlord knows he is a terrorist....

Which is more likely not true that it is likely that it is. Remember, you are only shooting nukes at a city, there is no police involved. The policy has no right to search a house without a judge having looked at the case. Where is the judge in your story? There is none! It is not up to the landlord to put people out of their house, that is up to the police to do on order from a judge, based on a fair trail. This is where blacklists go wrong, they don't obey the basic principles of justice....

I concur!

[Anonymous Coward]

Here Here!

Sippenhaft

[Wudbaer]

In WWII in Germany (but AFAIK in the Soviet Union as well) there was a similar thing called Sippenhaft. That meant: If the ruling powers had the feeling that a soldier or an officer was not showing enough courage or even was lacking enthusiasm (which also could be an euphenism for people voicing dissent with the respective regime), not only he was shot but also all of his family was arrested and often put into concentration camps. Family was often interpreted in a very far-reaching way: If a more or less distant relative was the evildoer, but the regime's thirst for revenge was big enough or no one else was there you still would lose your job, put into prison etc.

I think they use the same line of thought you are using here.

Thank you...

[DarkDust]

for telling me, I wouldn't have noticed this myself. This is the first time I'v encountered a real problem with having your own mail server and making it as spam-proof as possible...

Anti-spam fantasy world.

[moncyb]

Are you kidding? Of course this fanatic supports the DMCA, patriot act, &etc. He's probably counting the days until Microsoft fully imbeds DRM into Windows and knocks all other systems off the internet. "Then the evil spammers will be no more!" Yeah right...none of these extreme measures will stop spammers, but they believe it because they don't want to accept reality.

How to trust email origins

[Bartmoss]

Here is a proposal/idea on how to do it. You are welcome to provide me with feedback on the idea. There is only one loophole in the theory I am aware of, and that is not a very significant one.

I'd love to hear from everybody.

Laugh it up, fuzzball...

[Anonymous Coward]

because I'm laughing right now. And when your unwashed freinds at nanae or whatever the fuck crufthole of usenetland decide to unleash "pandora's box" (OoOoOOooOooOooooO) and start getting fired because all of a sudden the boss isn't getting email, I'll laugh even harder. When your ISP goes titsup because people start deciding that the old 'hit d and forget it' is STILL better than missing real emails, and their freinds at AOL don't have this problem, I'll have problems breathing from all the laughter.

Re:Global RE: people who are glad osirusoft is dow

[Robmonster]

To continue your analogy...

What do you do if this is the only apartment block for miles around, and its either live there or sleep on the streets?

Global RE to people who Re to your "Global Re"

[danila]

Yeah, perhaps Indy1 took it a bit too far. A better analogy would be the following. Your country (your ISP) is harbouring terrorists (spammers). These terrorists use our planes (network) to bring down skyscrapers (e-mail system) and kill civilians (annoy users). My country's Ministry of Exterior (SPEWS) publishes a warning (blacklist), suggesting that our citizens avoid travelling to your country (receiving e-mail from you).

I think this is perfectly acceptable. And even if our airline will cancel some of the flights and inconvenience some of our citizens, because they have to fly to Frankfurt and then to your country (use another SMTP server or webmail), this is perfectly legal and accepted way to deal with the problem.

You elite opressors.

[Anonymous Coward]

You "Sys admins and Network admins don't get it. Most of the world doesn't operate like your "mega corp" that you all seeem to all work for.

Many people are their own admins while trying to run a business that hasn't a thing to do with IT except they have a few workstations and a server. They don't have all your know how or skill. They are to busy trying to feed their families to allow others like me who know what is up to allow you to get away with this eliteist bull shit you are trying to pull. No they are not able to figure this all out and doubtfully can afford to pay someone who can. They are trying to make a living. But you insist your sysadmin job is more imoportant than them. You by endorsing vigilante banlists that put their mail servers out of business are as bad or worse than any spammer ever could be. Spammers are thiefs but you by using these lists are corperate oppressors. Don't try to justify your discrimination and opression in any way. If you use these lists and they have no simple method and fair imeadate way to be removed or the "secret group" running them refuses to whitelist them you are just a Daryl Mcribe clone. An exploiter of others and an opressor. So quit trying to justify fucking over other people who may not have the financial resources or skills equal to you or the place you are lucky enough to have a job.

Nice try blocklist and Blacklists are bad. Secretly maintained ones are even worse since you know you are fucking people over you are hiding out. The KKK was secret too it wasn't right and thsi isn't either.

Re:You elite opressors.

[DirkDaring]

You can't take 8 hours out of your 365 days a year to sit down and learn how to setup a server and do basic security on it?

You don't deserve to have a business. Close shop, go apply for a waiter position at the local TGI Fridays.

Re:Global RE: people who are glad osirusoft is dow

[Anonymous Coward]

wow a list for spammers to find new isp's.

very informative!

Why don't you just admit it.

[Anonymous Coward]

You are a member of Spews. All you have been doing is defending them. With all the posts of how they have fucked innocent persons over with their blocklist and refusals to whitelist people one has to determine that you are a Spews member.

Re:Global RE: people who are glad osirusoft is dow

[Anonymous Coward]

You don't have to explain your crap to us, we understand your reasoning just fine...

It's not that different from the reasoning that those Al Qaeda bastards used for bombing the WTC.

Fuck blacklists.

Re:Spews was really effective

[zakezuke]

In a pigs eye. I understand where they are comming from, really I do. However Spews's mision statement of attempting to encourage real users to move from their spam infected ISP just didn't work. If all the real users left, and only spammers remained, it does jack shit for discouraging that form of behavier. If all the real users just switched to hotmail, again it does jack shit to discourage the behavier. The only way that their mission would be successful if their list was in wide spread use cutting off the spammers income and making it a pointless business venture.

While quite a few people actually used spews, mailadmins whom i've spoken with pretty much didn't want the headache complaints generated both spammers and legit users attempting to get e-mail out.

Why the hell would /spammers/ be the ones?

[Lord Bitman]

Open your eyes, take a look around- plenty of people who aren't spammers hate SPEWS, and SPEWS makes it obvious that such is very much their intention. They're attempting to break the internet, and hide behind "It's entirely volentary" when people point out that they're encouraging people to, on an entirely volentary basis, break the internet- by spreading lies and telling people that innocents deserve what they get when they unknowingly exist on a host that somebody may have spammed once. Do you know what this is called in the modern age? Why, that's Terrorism! It's a terrorist organization which is entirely volentary to join, good job!

is SPEWS legal? Yes
should SPEWS be legal? Yes
is SPEWS full of shit? Yes
should SPEWS shut down? Yes
Will SPEWS shut down? no.

Re:Hey! That's funny!

[Lord Bitman]

That's funny, damnit. Stupid mods.
I didnt see this post before, modding this up would be worth more than the rant I posted, sorry :/

Re:Holy fuck! Someone who doest understand SHIT!

[Lord Bitman]

Did you know that..
it's illegall to yell "Fire" in a crouded theater?

This is because, even if you dont take direct action, you can be deemed responcible for the actions of those who react to something you say when you knowingly say something intended to provoke them into doing something which causes damage.

This is a basic concept of society. Figure it out.

SPEWS in no way denies that what it is doing is harmful- check their page, they INTEND it to be harmful, they want to scare people into submission. They are Terrorists.
The same people hunting Osama Bin Ladin would assure you that he never flew a plane in his life, and certainly was not one of the pilots which crashed into the WTTs. Yet somehow, they can believe him to be responcible. Imagine that!

Er, um, ...

[cascadingstylesheet]

Pick either side, and they are using the same tactics. The Palestinians are blowing up civilians in the hope that the civilians left alive will do something about their problems. And the Israelli government is firing missiles into crowded cities to kill some suspected criminals and anyone else who happens to be within 100 meters of these guys...

Um, those aren't the same tactics ... oh, never mind.

No Blacklists

[Sandman1971]

Bah, no need to use blacklists. Just do what I did. I blocked all of APNIC from being able to connect to port 25 of my mail servers. Maybe a little drastic, but it has cut down spam by more than 70%.

Re:No Blacklists

[Anonymous Coward]

How inane. Your world must indeed be small....you're american, aren't you.

Re:No Blacklists

[Anonymous Coward]

Well, I did the same as him, but at least left most of the Australian portion of it open. Australia is not so bad as far as source of spam. If you have no need to receive mail from the far east, then it does work well.

Re:Holy fuck! Someone who doest understand SHIT!

[amcguinn]

SPEWS in no way denies that what it is doing is harmful- check their page, they INTEND it to be harmful, they want to scare people into submission. They are Terrorists.

Now wait a second. I'm on your side, I'm anti-SPEWS. I've never (to my knowledge) had outgoing mail blocked, but I hate the idea that my ISP might stop a message reaching me because SPEWS doesn't like the sender's netblock.

But refusing incoming email messages isn't terrorism. It isn't even a crime. In my book, it's bad service, but unless you've got a contract that says differently it's not even defective service.

The answer is not to rant about "terrorism", but to advertise the idea that consumers should make sure that some "spam filtering" service provided to them by the ISP that they pay money to isn't following an agenda beyond just blocking messages reasonably determined to be unwanted.

Re:Holy fuck! Someone who doest understand SHIT!

[Lord Bitman]

you falsely assume that I think it is a crime, or think that all terrorism is a crime. I don't. I think they're full of shit and that people who claim SPEWS is innocent because they are not physically going out to people's servers and shutting them down are fucking idiots.

But it Is terrorism. They are using fear to push a political agenda, that's terrorism.

There is a solution to spam.

[Anonymous Coward]

Round up the top 10 spammers in the world and shoot them. Repeat every 2-3 months. Watch the amount of spam decrease exponentially.

Sorry about that, just venting. Seriously, something must be done, or else email as we know it will become completely unusable in the next year or two.

Re:There is a solution to spam.

[Anonymous Coward]

Are you not affraid America will become rather quiet after a while? Most spam leads to American companies anyway who all seem to sell Generic Viagra.

If we put the trials on international television we can make some money out of this to maintain the grid for those who use it the way it was meant to be used.

SPEWS didn't cut off your email.

[nuggz]

SPEWS suddenly cut off my email

No they didn't. The person you were sending to chose to cut off your email. SPEWS just suggested it.

Libertarian Newspeak Doesn't Negate Censorship

[FreeUser]

I'm not sure it can be correctly called censorship - that requires a governmental entity.

That is a fucking myth, and I am sick and tired of hearing people parrot that nonsense. Saying a business can't censor because it isn't a government is akin to a black man saying he can't be racist because he is black. These are both examples of the same logical fallacy: just because a behavior is traditionally associated with one entity or group doesn't mean it is impossible for another entity or group to begin behaving in exactly the same behavior.

Obviously, anyone of any ethnicity is capable of becoming a racist, just as anyone with any power or influence over others is capable of engaging in censorship.

Responsible parents routinely censor what their kids see and hear. We as a society, by and large, find this to be an acceptable form of censorship.

Many religions routinely censor what their congregations are and are not allowed to see and hear (the Catholic church has had a censorship office for centuries, but they are hardly alone. The Mormons censor what they deam inappropriate for their membership, just as the Jehovah's Witnesses do, and I really don't need to cite example after example for Islam, do I?).

And finally, yes, many, many companies engage in censorship, both the obvious 'media' companies that bury stories they don't like or can't be bothered with, as well as other more subtle businesses (like Monsanto pressuring Fox News into not running a news story on how their hormone saturated milk was actively harmful to the health of children, an action that resulted in Fox News firing two reporters who refused to disavow their story, and said reporters winning a lawsuit against Fox News under Florida's whistleblower laws).

Anyone with any form of power over another, be it parental, religious, corporate, or governmental, has the power in some capacity to censor information available to those less powerful. It is a telling, and appalling, commentary on our culture to observe just how common this sort of censorship is, and how eager we have become to silence those with opposing viewpoints, rather than to argue the counterpoint (as I am doing here, for example).

Your Libertarian Newspeak definition of censorship is plain wrong. You may have the right to censor what comes across your network, and you may chose to excersize that right, but don't think for a moment you aren't engaging in censorship, or think you can convince the rest of the world (a few gullible moderators aside) you are not simply by trying to spin your verbiage.

And lest there be any doubt as to what censorship is:


censorship
n.

1. The act, process, or practice of censoring.
2. The office or authority of a Roman censor.
3. Psychology. Prevention of disturbing or painful thoughts or feelings from reaching consciousness except in a disguised form.

censor

1. A person authorized to examine books, films, or other material and to remove or suppress what is considered morally, politically, or otherwise objectionable.
2. An official, as in the armed forces, who examines personal mail and official dispatches to remove information considered secret or a risk to security.
3. One that condemns or censures.
4. One of two officials in ancient Rome responsible for taking the public census and supervising public behavior and morals.
5. Psychology. The agent in the unconscious that is responsible for censorship.

tr.v. censored, censoring, censors

To examine and expurgate.

(source: dictionary.com)

You will notice, that with the exception of historical references to Rome, none of these definitions presuppose governmental authority over just plain authority, indeed, quite the contrary.

Re:Libertarian Newspeak Doesn't Negate Censorship

[Abm0raz]

As a Liberatarian, I have to say ... you are 100% right. The act of censoring is NOT limited to the government. ANYONE can censor. Censorship (in layman's terms) is preventing another individual or group from receiving all or part of a communication. What the ORIGINAL poster SHOULD'VE said is that it's only ILLEGAL for the Government to censor private citizens, except in the cases where the lack of censorship would lead to injury (yelling "FIRE!" in a movie theater), intimidation (blackmail, threats), or immediate damage to public or private property (unauthorized protests). There are a few other minor cases such as outlawing porn to minors and where the act disrupts public proceedings or safety, like a mime performing on a major interstate.

Now, that being said, the Government is in no way OBLIDGED to reward "free speech" either. If the government gives an art museum $1,000,000 in grants a year to showcase art through the National Arts Endowment and then the bigwigs there see a statue of the virgin mary covered in blood and feces displayed as art, they are well within their rights as a governing body to NOT renew the grants. This is not censorship. The government is NOT required to reward behavior that it doesn't find acceptable, regardless of whether that behavior is legal or not.
The same way the Lesbian, Gay, BiSexual, Transgender Association on here on campus had a "SexFaire" and "CuntFest" a few years back that "promoted safe sex and raised awareness of students inherant sexuality". About 200 of the university's 45,000 students went to it, but it became a big deal cause they handed out condoms, gave kissing lessons, and other stuff that escapes me at the moment. The state government heard about it and decided to cut the universities funding because the groups that put on these events used campus funds. Were the censored? No. They were no longer rewarded for their behaviors. The money was given to them for free before and they lost that priviledge.

"Don't bite the hand that feeds you" comes to mind.

-Ab

Re:Libertarian Newspeak Doesn't Negate Censorship

[gpinzone]

When people make that statement, they're referring to censorship in the legal sense, meaning that it's perfectly legal for a business to censor forms of speech that a government entity could not. It's not that the business isn't censoring, it's that they have every right to do so.

Re:Libertarian Newspeak Doesn't Negate Censorship

[darkweasel]

Horror horror. Condoms and kissing. I agree it wasn't censorship, but just basic prudish fucks who need to get with the times or get out of government.

Re:Libertarian Newspeak Doesn't Negate Censorship

[Anonymous Coward]

Damn straight.. you have a problem with a company censoring something? Don't buy their product.. end of story...

Re:Libertarian Newspeak Doesn't Negate Censorship

[RealAlaskan]

Saying a business can't censor because it isn't a government is akin to a black man saying he can't be racist because he is black.

Can't argue with that!

There is a reason for the confusion about censorship, though. Private censorship is a private choice, with (generally) no public impact. Generally, your decisions to censor materials for your family/clients/churchmembers doesn't impact me at all, unless I choose to be your client/churchmember (dependents have to take what they get...). As an example, private censorship is a responsibility for every parent, and every parent handles it differently, and that's all as it should be. Really objectionable examples of censorship requires either a government, or the powers of a government, to force others to accept that censorship.

Even though none of the definitions you give presuppose governmental authority, governmental authority is necessary to make bad censorship widely harmful. Absent that power to force others to acquiesce, censorship becomes groups of consenting adults, doing to themselves what feels good. A lot of folks today think that defines ``harmless''.

Great evil requires great power. Whether any particular act of censorship is good or bad depends on the details, but whether it can hurt people who haven't consented to it depends on the power of the censor. Only governments can censor materials for billions, or kill millions. Without the power of a government, Stalin would have been just another Charles Manson.

So, if censorship is ``bad'' (that seems to be the common belief), but restricting your children's access to snuff flicks and kiddie-porn is ``good'' (I hope that's a common belief), then obviously protecting your kids isn't censorship. Thus, the confusion. It isn't because of ``Libertarian Newspeak'', it's because of this assumption that censorship MUST be bad.

Re:Libertarian Newspeak Doesn't Negate Censorship

[rweir]

he same way the Lesbian, Gay, BiSexual, Transgender Association on here on campus had a "SexFaire" and "CuntFest" a few years back that "promoted safe sex and raised awareness of students inherant sexuality". About 200 of the university's 45,000 students went to it, but it became a big deal cause they handed out condoms, gave kissing lessons, and other stuff that escapes me at the moment. The state government heard about it and decided to cut the universities funding because the groups that put on these events used campus funds.

What the fuck? Your state government cut a universities funding because a student group ran a little festival about sexuality. WHAT THE FUCK? My uni has a student-run and Uni-funded Sexuality Office specifically to help and support students. There's a Sexuality Officer elected to the student association each yer, right up there with the President and Social Officer.

Why was the funding cut? Because they didn't like something the students ran? That is utterly FUCKED up.

Hm, sorry for the ranting, but stupid shit like this really gets me pissed off. Why the fuck would a government cut funding based on this? What possible reason is ther for your state to cut funding to a uni because some students are more enlightened than they?

Re:Libertarian Newspeak Doesn't Negate Censorship

[Anonymous Coward]

Goverment, Authoritcy, Censorship...

The quick reply to all of this is that I'm amazed you can all waste so much time debating something that is a sematic issue. You each have your own arbitrary interpretations of what Censorship is, so clearly you disagree; what's impressive is how much time you waste bantering to each other about it.

Especially the guy who says, "That is a fucking myth, and I am sick and tired of hearing people parrot that nonsense."

Why don't you post something of value or go write some code. This isn't a debate about censorship, it's a debate about linguistics.

Re:Libertarian Newspeak Doesn't Negate Censorship

[Abm0raz]

Easy ... cause the house was controlled by right-wing conservative fucks. Now, I didn't go to *CUNT-FEST* or *SEX-FAIRE*, so my information is all from news sources and talking with friends on campus. There were tents in the HUB lawn (Student Union Building) that were running events such as "Orgasm Bingo" and "Pin the Clitorus on the Vulva". Here are 2 links: The first is a listing of the campus newspaper's articles favorable towards them (As most are). The second is an editorial by a student that has links to more articles at the end.

Personally, they have the right to put on an event like this. I would've liked to see it a little less "IN YOUR FACE" because, believe it or not, people do bring their kids and families to walk around campus. Seeing huge banners stating *CUNT-FEST* isn't exactly a family atmosphere at 3 in the afternoon on a Saturday. My only real beef with them is the inequity of funds distribution that those groups get. I was in 3 different UPAC supported clubs that year. Every club is supposed to get a minimum of $350-$450 if they have at least 15 (maybe 20) members. All of the clubs I was in had at least 50 (one, the Deck-hockey club had over 200). All of my clubs got nothing because "funds had run out," yet these people, several weeks later, get nearly Ten-Grand to put on a show that less than 200 people showed up to and was basically put on to tell the culture around them, "FUCK YOU!".

Now, don't get me wrong. The representative (Lawless R-Montgomery County) that spearheaded this crusade to cut funding is a cocksucker in his own right. If it were up to him, the entire campus would be dry and anyone caught buying condoms would be expelled. He's a self-rightous, pompous douchebag. I *believe* (unsure) that he was voted out of office last year in the elections. I'm too lazy at the moment to look it up.

As I said in my original post, it is one thing excercise your free speech, it is another to expect to continue to be rewarded for it if a significant amount of people find it offensive or dumb. Just like it is a poster's right to put up "GNA FPs" and "Natalie Portman covered in Peanut Butter!" and "BSD is DEAD!" posts, but don't expect to be modded up for it.

-Ab

Re:Libertarian Newspeak Doesn't Negate Censorship

[DesertFalcon]

I'm going to disagree with you on the subject of religious censorship, and I hope that if I'm missing the boat here on the subject of censorship (as opposed to the subject of religion) you'll correct me.

I am a member of one of the religions you listed (Mormon,) and my religion doesn't censor anything for me. If I decide I want to buy a keg of beer or sign up for a porn site or go watch an R rated movie (a big no-no in some social circles in Utah,) nobody is going to stand in my way and say "Nope, not as long as you're Mormon."

My religion does offer suggestions and commandments regarding behavior, and I do my best, on a voluntary basis, to censor *myself* based on those suggestions and guidelines. But that's me acting on my own decisions and values, not my religion controlling what I consume and am exposed to.

I have a better one.

[dmaxwell]

Proscecute the businesses that hire the spammers. Roll on them extra hard if they don't give up the spammers they hire. Granted this only takes care of the domestic businesses doing this but if enough countries do it then spamming is no longer a low-cost/low-risk endevour.

Opt out mail filtering.

[nuggz]

An ISP should be permitted to filter spam on their server. Most users want this, the ISP wants it.

Users should be able to opt out of this filtering if it is broken. Yahoo has a nice "bulk mail" folder that routinely catches stuff that is not spam.

Properly done Parents concerned about spam could check the Bulk mail box for false positives. Little sally doesn't see the porn, which is what most parents care about anyway.

Re:Opt out mail filtering.

[Mryll]

My ISP gives a web interface allowing detailed server-side SpamAssassin configuration per user account. I guess this might be too much for a large ISP with users that don't understand much about email and filtering. Maybe that's part of why I avoid large ISPs. :)

GPG lists.

[nuggz]

Just sign the IP with an appropriate GPG key.
You could select whos keys to accept, and let the "web of trust" keep it clean.

Just use the set of keys that have a spam policy you agree with.

Re:GPG lists.

[poptones]

Exactly. Although I like the idea of making it a p2p app, myself: gives an onus for a lot of big players to operate some well connected freenet nodes...

penicillin

[RevDobbs]

My private key leaked for a bit, but a shot at the clinic helped that.

I mean, it wasn't SPEWing or anything, just a little leak...

Re:penicillin

[irc.goatse.cx troll]

You wasted a trip to the clinic for that? bah! back in my day we just tied it in a knot.

collateral damage

[nuggz]

Darn, sucks doesn't it?
Fighting against SPAM will occasionally interfere with other peoples email.

You are complaining that you just get sucked into this "war on spam". But wars don't ask permission from the people either.

I'm sure the average Iraqi isn't all that happy about having their country invaded, government overthrown, losing security, power, clean water and generally in a big mess.
They didn't ask for it either, and all the bitching and complaining by the world didn't stop it either.

SPEWS

[Anonymous Coward]

Check out somethingawful.com's ongoing issues with SPEWS. They don't just block individual servers, they block entire ranges affecting many legitimate, non-spamming servers. Yes it's good to block open servers, but at the cost of many other closed servers is a shame.

The simplest solution...

[Anonymous Coward]

I have not received a spam for years, despite not having any filtering in place. Wanna know how to do it?

You too can be spam-free for only $4.99! Just send an email to spam.me@spot.the.dog with your credit card details to find out!

Complain to administrators, not upstream providers

[Don'tTreadOnMe]

What seems to be lost in all of this discussion about whether SPEWS is a reasonable thing to use or not is that it is up to the mail administrator (and whomever employs the mail administrator) to use it. Are you on SPEWS and upset about it? Can't get your mail to that all-important recipient whose mail administrator blocks based on SPEWS? Instead of complaining to your upstream providers to try to get your measly little IP off of SPEWS, complain to the mail administrator's boss, to get them to stop using SPEWS. If that does you no good, then you have to accept that your intended recipient doesn't want your e-mail, and quit whinging.

Three Hotmail Rules

[__aaefwa8304]

I've found these Procmail rules to judge Hotmail very effective.

# Hotmail addresses never start with a number:
:0 H
* ^From:.*\<[0-9][^ ]*@hotmail\.com\>
{
LOG="Hotmail_numstart "
:0
$SPAMDIR
}

# Hotmail addresses never have a host part:
:0 H
* ^From:.*@[^ ]*\.hotmail\.com\>
{
LOG="Hotmail_hostpart "
:0
$SPAMDIR
}

# Hotmail messages have Originating-IP, except mail from abuse/policy.
:0 H
* ^From:.*@hotmail\.com\>
* ! ^From:.*\<(postmaster|abuse|policy)@hotmail\.com\>
* ! ^X-Originating-IP: \[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\]
{
LOG="Hotmail_noIP "
:0
$SPAMDIR
}

SPEWS Works

[Detritus]

One of my old ISPs got blocked when their upstream ISP started selling bandwidth to spammers. The situation was bad enough that my ISP, and many similar ISPs, were forced to change providers. The upstream ISP lost most of their customers and sold what was left to another ISP, who shot spammers on sight.

and the Somethingawful.com kids didn't like it

[Anonymous Coward]

It's kinda funny that the week after somethingawful was complaining about being blacklisted and not being able to rectify it that SPEWS gets handed their ass. Don't mess with immature geeks with too much free time would be the moral of this story. I'm not saying that it was a somethingawful fanboy. Just that it appears to coincide with somethingawfuls complaints. Hmmmm?

Re:and the Somethingawful.com kids didn't like it

[Anonymous Coward]

[Lebowski] You said it man. Nobody f***s with the Jesus. [/Lebowski]

mod parent to troll!! ,.. mod this post too!

[Anonymous Coward]

I'm pretty sure if you use your awesome mind powers you will be able to surf to various dictionary websites. You might notice that the definition of censorship only implies authority, not government. If my ISP uses SPEWS it gives spews the authority to remove or supress email it thinks is objectionable. If you restrict people from voicing their opinion on your network it IS censorship. But you have every right to censor them because you are a private entity.

It works?

[Anonymous Coward]

If it really worked, would you have the same companies with TONS of legitimate customers, such as RackSpace, continuing to remain on SPEWS lists? There are plenty more examples. All SPEWS does is block spam by increasing your false-positive ratio enormously.

No more confused am I

[I Have No Moose]

I was wondering why postfix was complaining:

blocked using relays.osirusoft.com; Please stop using relays.osirusoft.com;

My brain was starting to hurt (more than it usually does).

Postfix users comment out:
maps_rbl_domains = relays.osirusoft.com
And remove reject_maps_rbl from smtpd_sender_restrictions etc.

being black and your list

[kraksmoka]

truly, white listing and bayesian filtering (Mozilla Thunderbird or Mac Mail) is the way to go. those guys running the blacklists wear black hats just like the spammers. for every spammer that they've stopped (spam increases every year exponentially ) there's a new one to replace them and an innocent company that eats shit by accident because of black lists. good riddance.

Why not use egress-like filter for INcoming email?

[Anonymous Coward]

Many ISP have Egress filters for OUTgoing email to make sure that none of their clients are spoofing/faking their sender's email address.

Why not do the same for INcoming messages?
-If the DNS address is bogus ==> it must be spam
-if the IP it came from and its DNS address do not corrolate ==> it must be spam.

Heck why not even check the reply-to address too!

No blacklist required!
Yes, this will chew up lots of CPU cycles and require its own DNS server but it will stop a good 50% of SPAM. And maybe, just maybe, it might make bogus email addresses a thing of the past.

EXACTLY!

[Anonymous Coward]

You are dead on. SPEWS -- please die a painful death. (Coming from an innocent bystander that got hit.)

An alternative

[fmaxwell]

Yes, let's kick blind people off the net!

That's unnecessary. Just hide their keyboards instead.

That would explain SpamAssassin this morning.

[cyclist1200]

This morning SpamAssassin tagged the daily cron email as spam.

Whiner....

[DaGoodBoy]

My company was collateral damage on SPEWS last month and I kicked the *^&^#$* out of our ISP for hosting Global Travel on our netblock. They got booted and we got cleaned off the list. Bada-bing bada boom.

RBL's are like a fever. They tell you when something it wrong and only a dork blames the fever when the problem is the disease. Get your ISP to whack the spammer or change ISP's.

Google Thread

Get to the root cause

[zornorph]

Every time the subject of spam comes up here on SlashDot, everyone rushes to come up with a technical solution to the problem. In the case of spam, I think the solution is not a technical one, but a social one. Spammers are driven by greed, and do their 'bulk marketing' on behalf of other companies. Instead of targeting the spammers, target the companies that are sponsoring these campaigns. I'm sure that some negative publicity will cause them to think twice about using this method to get their message out. Once people don't want to use spammers to send out bulk mailings, the spammers will move on to some other get rich scheme, and the spam will at least subside somewhat.

Instead of shooting the messenger (the spammers), go after the one who is paying to have the spam sent.

There are lots of filters but it still costs $$$

[marcos de san juan]

The simple fact is that big bandwidth providers profit from spam and viruses because metered customers like us have to accept the packets, bounce them or filter them, but it all adds up to bursting up to the next price bracket and can easily double the cost of bandwidth. Blocking is good and filtering is good too but they both use my bandwidth and that costs me money.

Good.

[Anonymous Coward]

I hope at least SPEWS doesn't come back online. They've become pretty well-known in the last month or two for wrecking huge numbers of people's ability to send mail without any accountability at all. My favorite part of their site is the part that says, "If you're not an ISP and you're trying to get your IP removed, you're wasting your time. If you ARE an ISP trying to get IPs removed, you're probably wasting your time too, unless you've stopped all avenues for spam." Allowing machines to CONNECT TO THE INTERNET allows spam! What, is every ISP going to add a clause, "Thou shalt not run sendmail?"

Re:Global RE: people who are glad osirusoft is dow

[Anonymous Coward]

Sounds like heaven ;) If only it were half that good, though.

Wouldn't this fail if it became common?

[porkchop_d_clown]

After all, if spammers saw a lot of it, wouldn't they just learn to send the same spam several times at one hour intervals?

Re:Wouldn't this fail if it became common?

[jdunlevy]

wouldn't they just learn to send the same spam several times at one hour intervals?

But it'd have to be the same "triplet" each time. Same sender, same recipient, and same mail server doing the sending. Having to do this would at least raise the cost for the spammers.

Re:Wouldn't this fail if it became common?

[Elwood P Dowd]

Wouldn't this fail if it became common?

After all, if spammers saw a lot of it, wouldn't they just learn to send the same spam several times at one hour intervals?

If you check the paper... that's the point. If spammers had to resend all their mail like that, they would have to increase their bandwidth & cpu usage, and that would reduce their profit margin.

Spamhaus down too?

[The Asmodeus]

I can't even do a lookup on sbl.spamhaus.org. Did they get Spamhaus also?

Aw, too bad

[Jack Auf]

The anon admins that run SPEWS should simply do what they told us to do when we were unfairly blacklisted due to an alleged spammer on a class C eight class C blocks away from ours - Just change ISP's or IP blocks.

What's that? It's a huge PITA that would be highly disruptive to your business? Well maybe the DDOSers have a newgroup you can post to and be either a) ignored or b) ridiculed.

Looks like SPEWS is 'collateral damage' in the spam war. Yeah, sucks doesn't it.

Re:Global RE: people who are glad osirusoft is dow

[Phil John]

What happens if you a locked into a 1 year contract with this landlord (ISP)? If you move out you a liable for the rest of the rent for the remainder of your contract period.

That sucks. Osirusoft is responsible for tens of millions of dollars worth of collateral damage, that in my mind makes them worse than the spammers.

Wasn't there a big to do recently

[porkchop_d_clown]

when SPEWS blacklisted somethingawful.com?

Freenet or Bittorrent

[agentk]

What about distributing signed spam lists through Freenet or Bit Torrent or something similar?

Do you think that would work?

Earthlink and AOL

[porkchop_d_clown]

both consider my little website a spammer for the simple reason that it uses dynamic dns. The only mail that leaves my site is replies to mail sent to the webmaster (me) and to do registration e-mails for YABB.

Re:And in other other news ...

[porkchop_d_clown]

contradictory, obsolete and conflicting versions of SPEWS flood the internet, including one containing an MP3 of Madonna saying "WTF are you doing?!?"

Web Form as a pseudo white list..

[nurb432]

Make all your 'non white list' users ( i.e., customers ) use a web form to send email with.

While its true that could be manipulated with a script.. at least it would buy you time.

Several companies do this now for tech support.. they don't accept raw email. you MUST use their web form to submit issues to them.

My property, my rules

[KalvinB]

If I invite you to my house and your friend stops by and I send them away, I'm under no legal obligation to let you know they even stopped by.

If I'm throwing a party and you paid a cover, you paying me in no way grants you the right to tell me who I can and can't have on my property. I can still turn your friends away without telling you they even stopped by. They're more than free to contact you later by another means.

An ISP is no different than an other server that hosts e-mail accounts. That's why they can legally block spam all day long. The "accuracy" of their blocking is irrelevant from a legal standpoint.

You have no legal right to use another person's property. It's a privilage that person grants you. Either by charge or free. By using their property you agree to abide by their rules.

They're under no legal obligation to tell you who came to the door and was sent away. If someone sends you an e-mail and it doesn't get through it's up to THEM to find another way to contact you. The ISP or e-mail host has no legal obligation to forward any of their information to you.

Just because they granted YOU the priviage of using their property doesn't mean they granted all your friends, and everyone else who wants to contact you, the right to.

Ben

Ding Dong the Witch is Dead!

[FooDog]

Good Riddance to BAD rubbish!

I'm sure it's been said previously...

[tilleyrw]

My favorite idea is to implement a White List.

If a mail comes in from someone not on your list, it is moved to a spam folder.

Periodically check the spam folder for valid messages and make any changes to the list as needed.

People should ACTUALLY IMPLEMENT SMTP!

[gorzek]

Something a few people mention but no one ever seems to get into their heads is that SMTP already accounts for most of the ways people can spam you. A decent MTA is supposed to strip off the domain name of the originating address and ask that server to verify that the user exists on the domain. For instance, if you receive a mail from me@mydomain.com, your MTA will ask mydomain.com if "me" is a real user there. If so, it next checks the sender's IP address--does the address match up to the same IP as the mail server? If not, the address is real, but was spoofed. Those two things right there--validating addresses and IPs--would eliminate the vast majority of spam. The only people who'd still be able to spam would be people who got a REAL email account on a REAL ISP and used that--and those are easily shut down.

Bullshit, Plain Bullshit

[CrackersnSoup]

Ive had my isp be blacklisted with warning. Im sorry I dont hop on down the office at 3 am and take are of John Q Public that is hit with the latest worm proxy.

Re:Bullshit, Plain Bullshit

[Dimensio]

Who blacklisted you?

The Truth About SPEWS and Osirusoft

[lx805]

I don't have much hope for this post getting very much attention, seeing as this thread has already been taken over by crackpots an thinly disguised bulkers, all spreading their FUD.

But that ain't gonna stop me from trying...

Let me just start out by saying that I don't agree with what Joe has done with the list. I would be more inclined to support him if he were to just 'killall -9 named' and be done with it.

First: Osirusoft is *NOT* SPEWS. Joe Jared simply provided, free of charge, a copy of the SPEWS zone file via his RBL DNS server. He did not at any time have any influence over the content of the SPEWS list. People here complaining about talking to Joe and not getting a response obviously never read the FAQ on his site which clearly states this.

Second: SPEWS is *NOT DEAD*. There's another group out in Australia (I think) that offers a copy of the SPEWS zones, but I can't think of the name off the top of my head. Even so, it's only going to be a matter of time before three or four DNS servers pop up to take over for Osirusoft.

Third: SPEWS does *NOT BLOCK E-MAIL*. They simply provide a list. It's entirely up to system administrators to do what they wish with that list. Admittedly, though, I've seen some sysadmins do some really stupid things with SPEWS.

(IMHO, anyone who uses SPEWS (or any other blocklist for that matter), (a) should have an out-of-band contact method for people who are blocked, and (b) should maintain a whitelist of IPs that have a legitimate need to exchange mail but are blocked.)

Fourth: Nobody here seems to grasp the concept of private property. My server, my rules. If you don't like it, FOAD. It costs me money to maintain a mail server, and I've got every right to try to protect it from being slammed by spammers. If you are blocked as a result, that's just too bad. If you're someone I want to talk to, you can contact me out-of-band and I'll whitelist you.

Fifth: Imagine for a second if Microsoft decided it was going to DoS /. because they didn't like some of the articles posted here. A little far fetched, but that's exactly what has happened to Osirusoft. It distresses me that more people haven't caught on to this yet.

So, I hope this clears a few things up. Joe Jared deserves a lot of credit for having supported such a controvercial project such as SPEWS, and it's disappointing to see him taken down like this. It's equally disappointing to see so much FUD being tossed around in this thread.

Let this be a lesson to anyone who doubts what lengths a spammer will go to in order to protect their livelihood.

SpamBouncer config

[xleeko]

If you happen to be using SpamBouncer, the settings to disable Osirusoft and SPEWS checks are as follows:

OSDIALCHECK=no
OSHAVENCHECK=no
OSOOLCHECK=no
OS OPSCHECK=no
OSORCHECK=no
OSSHRCHECK=no
OSSPAMCH ECK=no
SPEWSCHECK=no

Note that the SpamBouncer homepage declares these to be the default values, but looking through the latest sb.rc file, it appeared to me that OSDIALCHECK was actually defaulting to "yes"

Dumb Admins !

[wtarreau]

Admins are really dumb ! why do they think they will block smart spammers with dumb tools ? It only requires a few minutes for a brain to know how to bypass such a stupid system as BLs. Spammers are not affected by BLs, because they are not interested in their crap being delivered to the few thousands people being "protected" by BLs, but by the money they get from selling their services to companies who pay for their mails being delivered to tens of millions of people. You see it ? Even if BLs can block 1% of their mails, what's the problem for them ? Now if BLs make you lose 1% of your legitimate emails, it is a real problem for you.

Some argue that they simply have to make the ISP close their access. That's BS !. Do you think that a spammer which is able to send 100 millions mails a day is stupid enough to rely on only one access ? With the money he earns, he can easily dedicate two persons full time to search new providers every day, and keep a 100% service availability despite a few blockings.

I'd prefer admins stop harrassing end-users, and let them get all the spams so that it is the end users who realize how many spams are really sent on the net. These are the persons who will finally vote for the one with a project of law which will make it very hazardous to be a spammer. I don't think that much of them would continue what they do if they were facing 20 years in jail or even death penalty in some countries. At the moment, they only risk to pay a small fine, which is already projected in their total cost of operation. Here is the problem !

Willy

Outstanding!

[HopeOS]

Extremely well put. It need not even be considered satirical; it's simply accurate. Bravo! -Hope

Spews and Kazaa

[KalvinB]

Kazaa isn't responsible for the actions of those who use the service but SPEWS is?

It's a "bad idea" is a valid argument but claiming any kind of legal basis to take them down is ludicrous. Nobody is forcing anybody to use their lists.

Personally, I don't care to have my server wasting time using their massive list. I block on an "as it comes" basis. I'm also moving to a better mail server which allows better filtering to use on top of the blacklist.

My property, my resources. No one has any expectation of the PRIVILAGE to use those resources. On my list? Find another way to contact your customers or friends or whatever.

Ben

Why Sobig is bad for privacy and AV vendors

[Anonymous Coward]

from The Register

http://www.theregister.co.uk/content/56/32510.ht ml

Why Sobig is bad for privacy and AV vendors

By John Leyden
Posted: 27/08/2003 at 12:00 GMT

Eight years ago when I first used the Internet, while doing support work in a Manchester cyber cafe, email was a joy.

I could contact my friends, even when they were on the other side of the world, on the click of a mouse. It was so much easier and cheaper than the alternatives - snail mail or the phone.

Email is still enormously useful as a journalist (not least as an important source of news leads) and but the increased prevalence of spam and viral messages is undermining this.

Drowning in malicious code

Email services firms such as MessageLabs and Brightmail will tell you that one in two emails is now junk email. At The Register this figure is more like four in five emails, and that was before the recent outbreak of Sobig-F.Currently the ratio of legitimate email to malicious junk is approximately two in 100. Clearing out my email inbox is becoming a near Herculean task.

Outsourced security

To get around the junk mail overload, home users can use tools such as Spam Assassin or Mailwasher while small businesses can use managed services like MessageLabs, Avecho.com, intY and the rest.

With Spam Assassin - the most accurate anti-spam package we've found so far - you still have to download email, so if you get sent in excess of 3,000 copies or bounced messages over the weekend (a real figure for us here) that's still a problem.

And if you use managed services (which alleviate the bandwidth headache) then privacy is undermined. By definition you have to trust a third-party - an undesirable consequence of using services that do reduce the signal to noise ratio of email traffic down to sensible proportions.

The emerging breed of anti-virus firewalls and all-in one security appliances enable larger businesses to tackle the problem in-house but these are prohibitively expensive for home users and many SMEs.

Internet moves to an ex-directory model

As well as the expense, the increased prevalence of malicious and nuisance emails creates an uncomfortable dilemma for news services and Net-facing email firms.

In response to Sobig-F, many firms will be forced to make their customers jump through more hoops (Web-based forms being one of the more elegant approaches) to get in touch with them. Some will be tempted to abandon existing email addresses as hopelessly compromised.

Although Sobig-F is, at least for net-facing firms, an order of magnitude worse than anything we've seen before, things have deteriorated over the last three years or so.

Every day, in every way, it's getting worse and worse

Starting off with the Love Bug and moving on through the Anna Kournikova worm, Nimda, Klez and the rest each new worm is more ferocious. Virus writers have upped their game in terms of social engineering tricks and propagation techniques; the ability to scour hard drives for email addresses and spoof viral-laden messages are examples of this.

In particular the speed at which viruses take hold is outpacing the capacity of AV firms to develop fixes for users to deploy them. The critical path has gone critical.

Managed services firm MessageLabs reckons that at the height of the Sobig outbreak one in 17 emails were viral.

Rival firm intY, which specialises in providing services to SMEs, reckons smaller businesses were particularly affected by the prolific worm. At the height of the outbreak last week, intY was blocking one in three emails. Even now one in seven emails that intY analyses are viral.

According to Paul Richards, development manager at intY, the higher rate of virus interceptions among its user base is accounted for because smaller businesses were disproportionately targeted by the worm. Smaller businesses generally have a wider diversity of email contacts and this too helps

Hey, looks like I'm psychic

[Brendan Byrd]

I just posted this post, saying to stop pretending to be URBL (which blacklists the world on purpose), and lo-and-behold, they go about and pretend to be URBL.

Maybe I can pretend to be surrounded by Swedish blondes next :)

That's irrelevant where lawsuits are concerned.

[Meat Blaster]

In this country at least, when you're offering to provide a service in exchange for money you're obligated to actually provide that service.

Many individuals using these ISPs that spam-block are most likely unaware that any measures are being taken on their behalf to filter their mail. Most would probably be quite happy to discover that if they realized there was a torrent of spam that was being diverted from their account. But all it takes is one that is thoroughly pissed at not getting a job because a potential employer was being ignored for a week (because he's on a blacklisted ISP without knowing it) to pop a hole in your private property argument as defense.

People would have no problem with spam if it was opt-in only... hell, that'd defeat the definition. I'd have no problem with spam filters if they worked the same way. But many of these anti-spam individuals -- people with whom I think I share a great deal of ideology about the problem -- think it's OK for these filters to be fobbed off onto individual users by sysadmins. Obviously, administrators have a choice whether or not to apply the filters, but the unknowing users are subject to injury by such an action. Surely an intelligent argument cannot be made that the users have a choice if they aren't even aware of the problem.

Re:That's irrelevant where lawsuits are concerned.

[Cecil]

Consider this assertion:

Some executives think it's OK to raise the price of their broadband services when they add worldwide roaming dialup service for when you're away from home. Obviously the executives have a choice as to whether or not to add extra services, but the users who never need the extra services are subject to injury by such an action.

Admittedly a price increase is significantly more opaque to the end user than a lost email, but often that is not the ISP's fault. I've seen several ISPs which very clearly state that they use spam filtering blacklists and such. If you aren't paying attention to this when you sign up, well whose fault is that? It's not the ISP's fault, I'll tell you that much.

Bittorrent to distribute a RBL

[Anonymous Coward]

The weak link in using any of the current RBL's is that your email server has to send out a connection to lookup every IP address, every time email is smtpd to your server. Anyway, it seems like the solution has already been found. Bittorrent was designed to distribute distribution of large files amongst many servers. You could setup your email server to download via bittorrent the current RBL every day, or week, whatever works for you. Then you do your lookups locally.

Then again, keeping with maintaining the RBL locally, you could use rsync or diff's. By keeping the RBL's centralized at one address it forces everyone to keep connecting and creates the weak link.

BS..

[Anonymous Coward]

Like the brain dead trolls and their moronic followers at something retarded have something to do with this. I say it is spammers and not some brain dead script kiddy.

Besides, they are not so innocent. Just look at each awful link of the day, even though they deny it, just about every single one is used to encurage their users to abuse said link. They always make sure to point out the site runners email, message board, large files, with the intent for having their users harass said site. All they do use their "humor" angle to hid the fact that they are a troll site that trolls for flamewars, as well as encurages and supports DoS attacks and abuse. They also claim to be resposible for their viewers if they act abusive, but that is just a big lie.

Still don't belive me? See the anti-spews rant Zack wrote. He essentaly ecuraged readers to find info about spews so that he could sign them up for spam, as well as implying for them to fight the something awful way of abuse. Also the something awful forums brats were encuraged to spam and flood complaints to anti-spam newsgroups.

No one posted the fix for SA? Here it is...

[numbski]

Modify /etc/mail/spamassassin/local.cf

# Osirus has blacklisted the world by mistake.
score RCVD_IN_OSIRUSOFT_COM 0
score X_OSIRU_OPEN_RELAY 0

Stop and start spamd.

See ya...

[jbrayton]

I have had very good luck with some blacklists. SpamCop, in particular, is extremely effective at keeping spam off of my server. And it has not yet generated a single false positive that I am aware of. But I am not sorry to see Osirusoft/Spews go.

I tried using Spews for a while, and found it generating false positives, so I stopped using it.

For a while, my server was blacklisted by Spews because of the ISP at which it was hosted. The fact was that my ISP (like most, I am sure) had indeed been the source of spam, but reacted reasonably to stop it. And Spews blocklisted all of the subnets belonging to the ISP rather than the actual spam source IP addresses.

I found it strange, and grossly irresponsible, that there was no way to contact the blacklist operators except for using the news.admin.net-abuse.* newsgroups. When did it become normal to use public newsgroups as the way to communicate with a private organization?

Their last act of blacklisting the world just seems so typical. Rather than giving time for people to reconfigure their servers, they just blacklist everyone and force people to reconfigure their servers under the gun. I could see doing that months down the road after everyone has had time to update their servers. But doing so this quickly was as irresponsible as the rest of their actions.

Re:See ya...

[Anonymous Coward]

Umm, SPEWS does give people time to reconfigure their servers and react since they start with the spammer's IP. They only increase it if the ISP ignores complaints and continues to support the spammer. Since the site is being DoSed, here is a faq that sums up how they act:

"It starts with just the IP space of the spammer, and over a period of time, puts more and more financial pressure on $BADISP by listing more and more of their IP space until $BADISP gains clue..."

And if you want to know why the group responds the way it does, read the start of that faq.

Where there really no warnings about this?

[nutznboltz]

I'm trying to find out if any warnings were sent out. I look though the google USENET archive and only see some indications that there we techinical problems with osirusoft.

If anyone can offer a pointer to a warning message about the impending doom of osirusoft I would appreciate seeing it.

Re:Where there really no warnings about this?

[ccoder]

I agree. I, through my employer, had offered to host some of the DNS and possibly site for relays.osirusoft.com, but they only needed DNS at the time. We were never added, and the zone (all 50+ mb of it) was too large to handle easily anyway.

Has anyone ever written warning systems for this type of shit? It is REALLY annoying that none of us got email (and he had my email, if he cared to notify people who he knew were running that list).

The junk mail folder

[Per Abrahamsen]

It takes a lot less time and energy to acan a junk mail folder a couple of time a year, than to manually sort your inbox several times a day. It is a lot less aggrevating too.

I appreciate your (back-handed) point about the need of political action to stop spam, but meanwhile we have to make mail useable again, which it isn't for a lot of us.

rant-o-rama

[hypovex]

man, that's a damn shame. oh well, at least we can all say for a little while that "TEH INTARWEB WAS FREE OFS TEH SPAMMERS!!" thanks to the wanton chickenhawks at Spews.org and all of the whiney asshats on n.a.n.a.e. who have nothing better to do with their lives than refresh their nntp browser, looking for the next person requesting removal they can jump in and flame (read: GET A LIFE).

Let me paint you a picture:

Some bottom feeding marketing contractor rents a crappy, darkly-lit, 1-room office in some crappy part of town, orders a cable line, 3 or 4 dsl connections and maybe a fractional t1 to boot. He buys a list of a few million email addresses and begins spamming like mad over one of the lines. After x amount of warnings, gets shut down, moves operation to another line, reorders service on the one that got shutdown under a different name, and keeps going. This is a very typical scenario of a spam gang. I've seen/dealt with it many times. So taking cause/effect into account: what protection against spammers does a blacklist offer in this capacity? Nothing. At all. Spamming is a completely mobile enterprise. Only the isp gets hurt. Spammers aren't the least bit concerend about spews.org, or any other blacklist for that matter.

They don't sweat getting shutdown by the isps because they have other connection mediums waiting in the wing, and actually budget the service costs into their overhead without thinking twice, because the money they make is incredible.

I don't work for, nor have any association with brightmail, but they have a great product (if only my ISP would cough up the scratch and buy it...), but I think the mentality of spews could be summed up in their product review of brightmail (paraphrasing here, as the site is down and I can get an actual quote):

"only stops spam in real time, does nothing
punitive against the spammer".

HELLO???!?!! Missing the point a little?? If you're not getting the spam, who gives a crap about the spammer?

It's pretty clear that these people and their associated usenet scene whores are just looking to skewer people, anybody really, over alleged spam. In this method of blacklisting, you're only hurting the ISPs. Nearly all (not all unfortunatley) isps in the US will shutdown a spammer if enough people complain. killing email for (in some cases) up to 65536 other non-related ips doesn't help. If it did, spews (or any blacklist for that matter) would have been more successful. In the last year, we've had more active blacklists to utilize than at any other point in the history of the internet and spam has only gotten worse, not better. Spews & Osirusoft are a shameful failure.

Solutions: Whitelisting is an excellent option on an individual email account level. On a grander scale, make your representatives pass laws, put you're money where your mouth is, and sue the spammers. They're in it for profit, when it becomes a greater liability, they might find a more worthy means of revenue.

Re:rant-o-rama

[Slartibartfast]

Dude. Whoah. You really need to lighten up a little. You have some valid points, but you also have some (almost incredibly so) invalid points. We put up RBLs about two months ago, and the stuff our Bayesian filter catches dropped by (are you watching closely?) _97%_. Terribly sorry, but I call that results. What you outline is indeed what many of the spammers do, but, apparently, nowhere near the majority. So lighten up, admit that black lists -- while an imperfect solution -- DO work, and move on with your life. Sheesh.

Re:rant-o-rama

[hypovex]

Well-run, well-maintained, public blacklists are at best, moderatley effective. At one point on my personal server, I was subscribed to orbz, ordb, spamcop, and osirusoft simultaneously, with MAYBE a 30% reduction overall. I'm sorry but I'd hardly call that effective. Something you maintain yourself, for your own network, can be extremely effective as you are directly blocking spam that is relevant to what is inbound to your network. I know that many spammers operate that way because I've had to contend with them in many instances (i.e. shut them down). Do all work this way? absolutely not. Some sit around on dialups scanning for open proxies, some colo boxes off-shore or in countries with no spam laws to speak of. IMHO, bottom line:I think any isp that relies on 3rd party information (worst of all, ip ranges accused of spamming) to block spam like that is lazy and overall irresponsible. Get on with my life? What makes you think I'm not? A: contending with poorly managed rbls has been a part of my job for some time now and as such a part of my life. B: I've been a member here for a couple years now and this is my only post here.

hey there

[XO]

Something that seems to be missing from the first 500 posts or so:

Osiru is NOT SPEWS. SPEWS and Osiru are entirely different.

The best idea I've heard is sender stores email

[Mustang Matt]

The thing I don't like about the idea you listed above is that it takes out some of the ease of emailing. If I want to send someone something I want to send it right then before I forget. If I have to wait for permission things will never get done.

I kind of like the idea of the sender storing email on their server. Then ISPs could easily control spam by using smaller quotas for outboxes.

Then the mail sits there until the recipient accepts mail from the sender.

Also, there are a few valid reasons to spoof domains from time to time so that's a no go either.

Not a nice idea.

[Nijika]

I'm sure he could have come to some solution whereby mail didn't bounce all over the place, and he could have saved himself the bandwidth. How about removing the A record for relays.osirusoft.com? Not impacting the whole TLD, and the queries would have dried up quick as SMTP installs started complaining.

No, this seems like a final flip-off to me. It's great that he decided to provide this service in the first place, but he had people's trust, and he burned them. Nice. I can't excuse that, personally.

where did it say or even imply he's an ISP?

[bani]

who said he was providing a service in exchange for money? the way i read it, he was talking about his own personal PC with his own personal accounts (or accounts for his personal friends).

you have no legal right - period - to intrude on personal private property in order to sales pitch.

I want MTA "Received" header - based blocking

[melstav]

Blacklists are great, but they've got strictly limited utility - The originating IP needs to be listed with some blacklist maintainer for it to do you any good.

But I noticed something about the spam that makes it past the blacklist - my mailserver happens to be the only one listed in the headers. That is, the email went from the spammer's workstation directly to my mailserver, and into my inbox.

All of the 'legitimate' email I receive either goes through one or more mailservers before it reaches mine, or comes from an IP address that I have explicitly told sendmail is OK to relay.

What I'd like to see happen when a computer tries passing off an email is:

1) do a DNS lookup on name the computer gave in its HELO to make sure it matches the machine's actual IP address.
2) If it does, check to make sure that there exists a valid MX record for it somewhere. If so, THEN check the RBLs, and block or allow as appropriate.
3) If not, check to see if relaying is explicitly allowed for that IP. If not, block it.

HEH!

[randy_harvey]

There were some definite fatal flaws in a blacklist that posts a "sample" spamtrap (blockme@relays.osirusoft.com) address on their homepage making it public knowledge and still blocks lists where this email address has been subscribed (in most cases maliciously).

Not a joke

[Anonymous Coward]

I get hundreds of double-bounced spam in my postmaster-for-90-domains mailbox. chello.se is high on the list of spam sources. I try to leave legit mta's unblocked, but when I get 20 or 30 double-bounces from one, it's gone. And I loathe and detest PacBell and AT&T for sprinkling a few legit domains in the middle of a DSL block. Sorry about that, guys, bitch to them and get your IP numbers reassigned. Brazil and Mexico send nothing but spam, same with HongKong and Taiwan. And I don't know anybody in Poland or Italy or France, so as long as they keep sending me spam I'll keep adding the offending class C (and sometimes class B) blocks to the shit-list. I haven't shut down any x.*.*.* blocks yet, but honest to gawd it's getting real close. I do have several x.y.*.* blocks gone, tho. Why do people think I'd want larger firmer breasts *and* a bigger dick? And why are so many people concerned with the size of my dick anyway?

Re:Not a joke

[Troed]

Well then I consider you to be almost as stupid as the spammers. Myself I get 1 or 2 spams a week, thanks to spamassassin. I block no domains.

Cutting mail does not help against spammers.

easier way to do this

[spamchang]

someone tell me why he couldn't leave a txt msg on his website and just pull the plug on his blacklist machine. no wonder i haven't gotten any of the emails i've been expecting this morning...

Email Protocols are Flawed

[RAMMS EIN]

One reason spam is so ubiquitious is that it is ridiculously easy to send it, due to deprecated email protocols and irresponsible usage of email addresses.

First off, there are SMTP servers which will relay mail for any domain (the so-called open relays). You can send mail to any recepient with any From address through these.

Then there are SMTP servers which blindly assume you are who you say you are. All you need to do is obtain one email address that that server allows relaying for, and you can send email seemingly coming from that address.

Then there are the slightly smarter servers which require you to authenticate first (for example by checking mail over POP3). With millions of users checking their POP3 mail periodically, using plaintext passwords for authentication, sniffing a password should not be all that hard. Voila, now you can send mail as the unfortunate user whose credentials you have obtained.

There are other ways, like writing virii that will infect a computer and use that computer to send out mail, but a spammer needn't even go there.

Then there's the question of how to obtain email addresses. Again, this is ridiculously easy. One possibility is sniffing, which was mentioned above, but there's an even easier way. Many email addresses can be found on publicly accessible websites (including but not limited to blogs, forums, personal webpages, contact information) in usable or trivially mangled form.

Another method that has enjoyed particular popularity with virus writers is harvesting MS Outlook Express address books. I remember my indignation when someone accused me of having sent him an email virus, which turned out to actually come from someone else, who had been infected by said virus and happened to have me in his address book.

The alternatives are out there. Something as simple as connecting through SSL could help a lot, by both giving sniffers a hard time and allowing proper authentication of both server and client.

BSMTP, IMAP and running a local mail server each allow mail to be pushed to the recipient instead of polled, resulting in quicker response times (checking mail every minute versus immediate delivery) and fewer authentication sequences (which tend to be uniform and thus prone to sniffing even through SSL).

IMAP could be used for sending mail, which would put everything nicely in one protocol (instead of having SMTP for sending and POP3 or IMAP for reading) as well as allow for authentication.

In summary, if we want to avoid spam there are two things we should do:

1. Be careful with our email addresses. I have some addresses that I use for personal communication but that are not published anywhere, and I have never received any junkmail on those (apart from what came in through the catch-all). Related to this point is that we should shun programs or services that are known to reveal addresses either willingly (e.g. many free services on the web) or through well-known exploits (e.g. buggy software).

2. Migrate to protocols that more adequately reflect contemporary reality, rather than the utopistic model that worked fine in the academic settings it was developed, but not in the Real World.

I reckon I've earned my two cents with this. :-)

All you fsckers are missing the point.

[Anonymous Coward]

Those of you saying "Use C/R, or use Filtering, etc" Are all missing the point. When you only take care of spam by filtering it at the receiving end, you are still letting the spammer abuse your resources and those of every other network on the internet. The only way to stop this is to *stop the spam from being sent in the fist place*. The only way to do *THAT* is to punish the ISP's that allow this trash to be spewed from their networks.

what innocents?

[Yorkshire]

SPEWS hurts people who give money to spam supporting ISPs, they're only innocent until they find out they're listed.

If someone posts a timescale for moving out of listed space, SPEWS has been known poke a temporary hole in a listing for them. This indicates that they don't want to block real innocents, just people who give financial support to spammer-friendly ISPs.

Spammers are also hurting innocents by bombarding everyone with spam in an attempt to force a party totally unconnected to the victims to accede to their wishes.

You want a terrorist analogy? Spammers are terrorists, spam friendly ISPs are obviously terrorist umbrella organizations, and your 'innocents' are financial sponsors of terrorism.

The truth of the matter is that SPEWS is just a consumer boycott by people with a different definition of innocent to yours.

Re:Spews was really effective

[pqdave]

An ISP needs legit customers. I'd be amazed if there are enough spammers to pay the overhead at an ISP. If an ISP has nothing but spammers, they will absolutely be blacklisted and manually blocked. They will have a hard time getting bandwidth--They need at least plausable deniability.

If they have spammers, they need people to say "Don't punish me because my ISP supports spammers! Wah!"

Those mom and pop business site you block.

[RevSmiley]

The business of selling things from a web site. What a concept a person makes a purchase on a secure site and has that purchase confirmed by email. The are business that haven't spammed a soul in their entire existance. These transactions happen a few million times a day. Wake up SPEWS is bad. It hurts these people.
These people are NOT spammers. Yet Spews will block entire IP ranges and hurts these folks.

But I seen now Spews and it's supporters don't give a fuck about anyone but themselves. I keep seeing this "my servers" shit. I doubt very seriouslty 99% of the people spouting this are actually the leagal owners of the so called mail servers they administer. They work for other people who pay them so they can send and recieve email. Blocklisting totally breaks email by throwinhg the baby out with the bath water.
you religous argument about Spews are bull shit.
Allowing a secret group to deterimine who may send email is bull shit. The childish way they go about this showd they only want to break things not fix them.

Question has anyone ever been removed from Spews blocklist?

Finally you admins that claim you "own" the servers and get to decide with to do with them.
Are people paying you to host their POP accounts?
If so where do you get off possibly blocking mail they wish to recieve are the paying you for getting? If they are you are fucking your customers and are as bad as any spammer ever will be. If these server soley server your personal self you can do what you want. If you are a business you are blocking mail that may be directed at you by persons you do business with. What an impression you must leave when you bounce their mail and accuse them of being a spammer or supporting spammers.

Spews is a secret group of little kids who are bigots and censors who intentionally are breaking the internet in ways that spam never will.

SPEWS is NOT dead!

[KC7GR]

Or, to put it another way, the rumors of SPEWS demise have been greatly exaggerated.

Here's what's going on. Joe Jared opted to take down Osirusoft.com's MIRRORING of the SPEWS database, and also chose to stop providing his relays.osirusoft.com DNSBL.

The SPEWS DNSBL listings, I'm happy to report, are still very much alive and well. SysAdmins desiring to resume using this resource can point their MTA's DNSBL lookup to l1.spews.dnsbl.sorbs.net. Other mirrors are available as well, and a polite query in the newsgroup news.admin.net-abuse.email should provide all the info one would need.

So, in summary, to the spammers who blew a whole $1.49 on that bottle of cheap wine at your local Circle-K or 7-11 to celebrate -- sorry! Looks like you wasted your money. ;-)

Re:SPEWS is NOT dead!

[Anonymous Coward]

Anyone who trusts spews has obviously not run a webhosting business, and dosent care about their clients. Spews is the most irresponsible group of chilren this world has seen, and frankly, I hope they get wiped off the planet. We have had nothing but constant problems as a result of a spammer who was not on our IP block. If you think that getting off of spews is possible, you might be right. But from experiance, its not probable.

but you already knew this...

SPAM CAN BE AND SHOULD BE SORTED ON THE CLIENT END.

Suggestion: cloudmark.com
They dont block on an IP basis, only a per-email basis. Their network is based on complaints by their users, therefore, everyone gets a couple spam emails that get though, but if you, and a couple other people request block, nobody else gets them. It uses humans to block email, not monkeys with sticks that point in directions.

Re:Blacklists and reality (less domain spoofing)

[WuphonsReach]

There are currently (at least) 4 different proposals that I know about to end the process of domain spoofing (which is part of the battle).

RMX proposal

SMTP+SPF proposal

DMP proposal

DRIP proposal

moot point

[GunFodder]

No system is secure if key to the lock is compromised.

SWIPS?

[jms1]

I've spent the last nine years building and running ISP's in the Orlando area, and have done more than my share of tracking down the owners of IP blocks to make sure that when I block an IP block, I don't block too many people close to the spammer.

One problem I have always run into is the lack of information about the owners of these netblocks. The spam situation is one of the reasons ARIN maintains a SWIP database, showing who owns each particular block of IP addresses. Whenever SWIP information is out there, I use it as the basis of how big a block to add to my list, especially if the owner of the smallest block is "ABC Internet Marketing" or something similar.However in many cases the information just plain isn't there.

For example, I have received 257 spam messages from 204.127.131.(111-133) over the past three weeks. The SWIP database shows this as part of a /16 block belonging to AT&T, but there is no further information available.

I had to GUESS and block 204.127.131.0/24, but I may have blocked others in the same class c by mistake. If AT&T would make specific netblock information available through SWIP or an RWHOIS server, I wouldn't have to guess and I wouldn't be running the risk of accidentally blocking people who don't deserve it.

Maybe if the ISP's would actually publish their SWIPS like they were supposed to, this type of collateral damage wouldn't have to happen. (Are you listening, AT&T?)

Wow....

[Anonymous Coward]

Boy, what great logic you have there. By this reasoning I assume you are a rabid teenaged acne scarred fanboy from somethingretarded.

I have determened from their site that they are terroists who engage in and encurage their cult of morons to comit illegal acts(i.e. DoS attacks, harassment, breaking into computers, etc). I say they are a threat to the security of the internet and need to be investigated by the FBI.

Godwin!

[Anonymous Coward]

Hi spammy! You are going to hate this, but SPEWS is still alive.

Re:Spews was really effective

[zakezuke]

An ISP needs legit customers.

No, an isp needs customers, legit or otherwise.

Under the Spews model, there is no reward for corrected behavier. So while an ISP may get blocked for supporting spamers, there is no motovation to stop if there is no reward involved. If they loose all their legit customers due to blocking, guess who pays their bills? *The Spammers*.

This has been noted many times when legit people pick up blacklisted IP addresses. They are stick stuck with the legacy of prior abuse whether their intent is legit or not. This ends up being counter productive because an ISP holding these blacklisted blocks can't get legit customers.

The idea should be to encourage ISPs to conform to a set of rules regarding spam, rather then blanket blacklisting. Without an acceptable procedure to address legit customers the "Don't punish me because my ISP supports spammers! Wah!" crowd wins. ISPs who are actually concerned with getting legit e-mail would have second thoughts about adopting a Spews like standard for fear of loosing legit customers.

Ok...

[Anonymous Coward]

How many of these "FUCK blocklists, T3hy T3H SUXXORS!!!1LOOL" anonymous cowards are either one person, a wacked spammer, or several wacked spammers?

BTW, this is just like the RIAA situation. When one method of killing spam gets killed, several popup to replace it. From what I have read it looks like there are a lot more people who want to pick up from where Joe left off.

not all RBLs created equal

[Anonymous Coward]

List shopping? Choose by philosophy, methodology, and listing/de-listing policies. Here are the ones I use:

• Distributed Server Boycott List (list: list.dsbl.org)
• Open Relay Database list: relays.ordb.org
• Spamhaus Block List list: sbl.spamhaus.org

DSBL and ORDB list open relays. They have a clear (i.e. programmatically implementable) listing/de-listing process. Spamhaus actively investigates spam gangs. Their policy is not programmatically implementable, but it's pretty clear.

DSBL even has three flavors to choose from:

• list.dsbl.org "single-stage relays tested by trusted users"
• multihop.dsbl.org "the outputs of multihop relays, tested by trusted users"
• unconfirmed.dsbl.org "everything else, including tests done by anonymous users, people could potentially sign up their own ISP's mail server to this list"

I have a relatively small and spam-free system (only six domains, very few email addresses that are not publicly visible), so for the last 7529 emails (since I configured to use these RBLs) processed by Postfix the server has rejected:

• 103 via list.dsbl.org
• 1 via relays.ordb.org
• 8 via sbl.spamhaus.org

The frequency can probably be largely attributed to the order I chose: maps_rbl_domains = list.dsbl.org relays.ordb.org sbl.spamhaus.org

If you're griping about collateral damage, then don't choose a wanton list, and advise others not to use one. Just don't go maligning all RBLs like ignorami.

They are not that innocent....

[Anonymous Coward]

Ignoring the fact they picked a bad host, their recent actions are more to blame.

On his site claims the same old tired suff the news group advises one not to do. He also encuraged his fellow mononic troll followers to find every thing the can about SPEWS so that he could sign SPEWS up for spam.

He claimed to have posted in the group, when he never did so. He has now resorted to writing FUD "articles" about SPEWS.

His moronic troll follower flooded the news group, which unlike the other geocitties type sites they encurage their followers to abuse, it was a bad idea to pick a fight with NANAE because they could fight back. This got them in perminit local blacklists they will never get out.

well, since you asked...

[alizard]

I would like some serious talk about just what exactly we ARE supposed to do about spam. Government moves too slow to pass an effective law, and the spammers don't abide by the law anyway. Filters don't work effectivly, blacklists are not working either apparently. Does anyone have a usefull suggestion about how to fix this problem?

Unfortunately, the only real solution is going to have to be a legal one. Spam technology is moving too fast, and anti-spam tech is either ineffective or does entirely too much collateral damage.

• Make people and businesses responsible for damage their machines do, whether they relay spams or viruses, and whether they were an open relay or let their machine get Trojaned. $100 USD/spam seems a reasonable amount via Federal law.
• Make the organizations that profit from spam responsible for damage. $100 USD/spam seems reasonable.
• Allow suing of spammers and/or spam/virus relayers in small claims court, in the same lawsuit if both can be located
• Require due diligence on the part of the person bringing legal action to prevent people not too clear on the concept from simply using the From: address as the target for lawsuit.
• Allowable defenses: 'first offense' (use a national database to track this) and "best practices"... that's probably as far as it's reasonable to go, how many of us can cope with a "zero-day exploit"?

Sounds like DMP Protocol

[gfecyk]

> Spam.com: Hello, [mta.com], [realhost.com] has mail to send.
> Mta.com: (resolves 'realhost.com')
> Mta.com: Hello, [realhost.com]; you have mail to send me.
> Realhost.com: [Mta.com], I don't have any mail to send you.

Sounds like DMP:

http://www.pan-am.ca/dmp/

This has been in development for five months and will be submitted to the RFC editor later this week.

Re:Blacklists and reality - what are you talking?

[Anonymous Coward]

• ultra-aggressive attitude of SPEW
  
  this is probably subjective, but imo that term is quite harsh and very unspecific at the same time.
  all they did, was to publish a list of IPs and netblocks saying that these were associated with spammers and/or spam supporters. they are|were probably free to do so. they can't be blamed for the fact that other people configured their servers using that information. so what gives you the right to use a word like "aggressive"? aggressive towards whom? the user? the worst that can happen, is silently dropped mail, though most servers are kind enough to reply with an error. besides the possibility of using some kind of send_ack_at_receive (to lazy to lookup the name) in case both ends of the chain support it, there is no way you can be sure an email reaches someone else. if you mean, you get aggressive, when you notice that you can't send mails: relax; meditate on the perpetual goodness of life; open a free webmailer in a browser or relay that mail through another account.
  
  
• a private entity is allowed to restrict content... choose
  
  this depends on your local interpretation of law and ianal. here, a witness to a crime has to speak (with exceptions), a private company has to publish certain stats (annual earnings...) and the government should (in theory) have a plausible explanation about where all the money went. this reaches the other end of your faulty 'no government => no censorship' logic, which already has been bashed to pieces.

Re:Complain to administrators, not upstream provid

[Anonymous Coward]

And that admin knows exactly what he/she is doing if he/she is currently using SPEWS. The point is that you can cry to them all you want, doesn't change the fact that you are paying money to an isp that doesn't mind polluting the net.

Greylisting Will Help..

[BaronVonBlubba]

I and my partners run an email hosting company called geekmail.cc. We're presently testing a feature called greylisting which seems to be effective against approximately 90% of spam overall.

The great thing about greylisting is that spam never makes it to the user's folder, there is no possibility of false positives, and it's impossible for spammers to detect that we're using the feature.

This takes a lot of the workload away from SpamAssassin (which we consider to be a rather blunt weapon that generates a lot of false positives) and doesn't upset the users.

-BvB

My 2 cents...

[NiTRiX]

I think the best solution would be to use some sort of p2p blacklist system to elude such problems. Much like has done to elude tracking and offer an alternative to centralized file sharing.

These same companies could create software that would *all* have black lists in them, and all blacklists would be available to anyone using *any* piece of software with the required protocol written into it. Each client software would then ricochette their existence off several other hard-coded (myabe another way) server, and retrieve the blacklist from another client. These black lists would be updated by some mysterious power. It could easily be checksumed or encrypted or key'd somehow so clients wouldn't download 'fake' blacklists... I dunno.. just a thought.

If every single person who used sendmail, also allowed a way of someone getting a list off them.. the blacklist would probably never have such DDoS issues. That's why kazaa and such is still around.. can't DDoS every single kazaa user..... can you?

Without wading through 7 billion posts...

[TaranRampersad]

Has someone yet thought of how simple this all really is? Spammers advertise a PRODUCT. A COMPANY. Don't worry about blacklisting, whitelisting and all that other happy horse shit. Ban the company.

Bayesian filtering does that in an imperfect way right now. The images have to come from somewhere, the links have to go link to something.

Re:Without wading through 7 billion posts...

[Anonymous Coward]

Fully agree! Why build up defences? Defence is a strategy in which you follow another.

Attack is the strongest defence, because you take the initiative. Force them into bankruptcy!

Re:Good riddance to bad rubbish (You LIE)

[Anonymous Coward]

Lies like this are claimed all the time. Prove it... What's your Class C block.

Stop your lying you spammer.
(I'm not SPEWS and I don't know who SPEWS is.)

Mitigate Your Damages

[lx805]

Publishing a list which identifies my ISP as a spammer is slandering my ISP unless it is true. Facilitating others in blocking my email by intentionally inflicting harm on ME is a tort. Filing one suit when I have been harmed is NOT barratry.

Well, let's look at this for a sec: is it your ISP listed, or their upstream? If it's the upstream that's in SPEWS, your ISP definitely has a case for being sold faulty goods, breach of contract, etc.

If it is your ISP that is listed, and they can stand in front of a judge and state under oath that they have never facilitated in the sending of spam, they might have a case. A quick google search will yield anything thats been posting to news.admin.net-abuse.sightings all the way back to 1997 I think... search for your ISP and see what you find. You may be surprised.

And as far as chosing an ISP, perhaps you should try to understand that many people have exactly ONE choice in a high speed ISP.

In other words, my choice is to cease practicing my profession from my current office, or use this ISP.

And that's unfortunate that your only ISP choice happens to be a spam sewer. In an effort to mitigate damages, it would be very easy to make arrangements with a third party to smarthost your mail through their mail server (which is hopefully not blocked).

Don't get me wrong: collateral damage sucks. The only thing that sucks more though is half-cocked irrational responses. If people would be a little more rational, and would put a little thought into working *WITH* the blocklists and not *AGAINST*, we'd all be a lot better off (i.e. less spam *AND* less collateral damage).

Using RKL (Real-time Known List) to stop spam, etc

[Anonymous Coward]

Stopping spammers requires cooperation, something that's long been prevelant on the 'Net and needs to continue. The only way to stop spam is for legit mail server admins around the World to come together & make some major changes to smash it out. One of the biggest problems with stopping spam is there is no accountability. You force accountability you know the actual sender & can thus enforce rules. Rules determined by law-abiding netizens. Many pieces are already in place, but a few things need/should be changed:
- A database of mail servers should be created. To be on that database you must submit proof of who you are & sign an agreement to abide by the rules set forth including no unsolicted email. If you messages come from your IP you are warned & should enforce the rules to their users. Repeat offenders are removed from the list. Period.
- This database could be utilized as a sort of RKL (Real-time Known List) similar to RBL's such as spamcop, etc. Of course this would be optional, but for obvious reasons mail admins would probably want to make use of this info in determining if a message should be accepted or not.
- This database of servers in conjuction with other rbl's would force force spammers to go through the hassle of registering, providing confirmable contact information in order for servers utilizing this RKL to accept mail from them to just be blacklisted & banned rather quickly by the RBL's. This would put a tremdous hurdle in front of spammers & therefore cut down or eliminate spam.
- A side effect of this RKL is it would almost eliminate email-bourne worms & viruses unless a mail server or other machine behind NAT/Proxy on same IP as a RKL'd server gets infected because most IP's will not be on the RKL & therefore would only be able to spread to servers not utilizing the RKL.

Of course there would be many required to implement this, but with the cooperation of all good netizens I believe it would work & stomp out virtually all spam & email worm/viruses.
I welcome comments & suggestions but mostly action by all those who want their email back.

A concerned netizen

So, Taco: Care to list this assholes headers?

[Anonymous Coward]

Kill the spammers, one by one;
It's a better woeld when we're done!

You can hide, but when we find you.....

Re:Global RE: people who are glad osirusoft is dow

[Anonymous Coward]

The quickest way to find out if your isp is a spam haus, go here.
http://www.spamhaus.org/sbl/isp.lasso

Unfortunately, _every_ isp in my area providing broadband services is listed...

Great analogy on blacklists, BTW.

All unsolicited mail is junk

[Anonymous Coward]

I don't spend lots of time filtering since I regard ALL unsolicited mail as junk. This means that any message not from a friend is ignored. If someone wants to mail me I add their address to the list of acceptable ones. That way these scum don't waste my time. I also don't waste my bandwidth as this process takes place before I download anything.

Spam Motel

[pwarf]

Looks like another great service. I like the fact that replies are automatically stripped of your real e-mail address.

The only reason SpamGourmet made me nervous was that I was afraid the company might fold. It looks like this might be the case with this company as well. Also, I need professional-looking e-mail addresses to give out when looking for work or sending out resumes.

Re:Anti-spam goals do differ and complicates thing

[minas-beede]

"There are actually two different anti-spam goals."

I go for the BIG GOAL: end spam. Why settle for less?

If you limit the goal you limit the range of solutions that can be tried.

Waht I actually aim at is spam sent by abuse, not all spam (so spam sent directly by the spammer to the recipients isn't included. That's a small portion of the spam.) There's two closely-related tools to do this: open relay honeypots and open proxy honeypots. Both accept spam directed elsewhere, both keep that spam from being delivered. If the initial source of the spam can be identified (as it frequently can be for open proxy spam) then the ISP can be notified of the abuse by the customer. Many ISPs will boot the spammer on the basis of that evidence. If the spammer gets a new account but spams in the same way he'll get caught again, get booted again.

These are real good, but what I've described is single-IP honeypots. If ISPs would watch for abuse traffic coming in (particularly proxy port traffic) they could run ISP-wide honeypots. The ISPs could strike a significant blow against the spammers and fairly quickly cause the spammers to leave their IP space alone. If spammers feared they'd get caught and punished when they sent spam they'd lose a lot of their motivation. Being booted is a weak punishment but even that could, if repeated, get the spammer thinking about no longer sending UCE.

Re:Anti-spam goals do differ and complicates thing

[Skapare]

I go for the BIG GOAL: end spam. Why settle for less?

That's what my 2nd item is, when everyone has that goal.

If you limit the goal you limit the range of solutions that can be tried.

I do have the goal to eliminate spam. But to do it, everyone has to also have the goal and co-operate.

Waht I actually aim at is spam sent by abuse, not all spam (so spam sent directly by the spammer to the recipients isn't included. That's a small portion of the spam.)

What the hell are you talking about? ALL spam is abuse. That includes spam sent directly by the spammer (assuming you mean not bouncing it via open relays or open proxies). My mail server logs are full of connection attempts, and subsequent refusals, by spammers connecting from their own high speed access lines or colocated servers. That's abuse, too, because it uses up some bandwidth and server resources to fork the SMTPD process, receive the MAIL and RCPT commands, look up the reverse DNS of the connecting host, and send back a 55X error response if they are not whitelisted and either have no reverse DNS, or it fails a forward verification, or their domain name is blacklisted, or another DNS blacklist lookup shows them to be a spammer. At least I keep my costs to a minimum by not accepting the DATA and not running some content analysis on the message body and not trying to save what looks like spam in a separate folder.

There's two closely-related tools to do this: open relay honeypots and open proxy honeypots. Both accept spam directed elsewhere, both keep that spam from being delivered. If the initial source of the spam can be identified (as it frequently can be for open proxy spam) then the ISP can be notified of the abuse by the customer. Many ISPs will boot the spammer on the basis of that evidence. If the spammer gets a new account but spams in the same way he'll get caught again, get booted again.

A great many ISPs refuse to terminate their big spammers. And I'm talking about spammers that colocate or rent dozens to hundreds of servers. These are big revenues sources to the ISPs, so they often look the other way.

Even the small time spammers, who seem to be the ones you focus on, can get lots of spam out over and over through the use of multiple accounts. By the time the ISP does discover there is spam going out, and terminate the account, it's been 24 to 48 hours, and the spammer has usually quit using that account (it's generally considered you can get 12 to 24 hours of spam run out of one dialup/ISDN account, when spamming direct, and a bit longer when going through safe open proxies).

If ISPs really wanted to stop these kinds of accounts from spamming, they would block outgoing connections to port 25 or any proxy ports (except port 25 would still be allowed to the ISP's smart host mail server ... which needs to have quotas limiting the volume of mail from any one customer to say about 30 per hour).

These are real good, but what I've described is single-IP honeypots. If ISPs would watch for abuse traffic coming in (particularly proxy port traffic) they could run ISP-wide honeypots. The ISPs could strike a significant blow against the spammers and fairly quickly cause the spammers to leave their IP space alone. If spammers feared they'd get caught and punished when they sent spam they'd lose a lot of their motivation. Being booted is a weak punishment but even that could, if repeated, get the spammer thinking about no longer sending UCE.

What about having ISPs also watch for abuse traffic going out from their own customer base?

Running honeypots isn't even necessary for this. They can block incoming ports for open proxies either at the border routers, or in the customer RADIUS profiles, and blocking incoming port 25 in the RADIUS profiles (except for those authorized to run a mail server). Same for any ports eventually discovered to have been deployed by viruses.

Re:Anti-spam goals do differ and complicates thing

[minas-beede]

"That's what my 2nd item is, when everyone has that goal."

I don't think everyone is needed. Significant effects have been seen from single systems. If I were going for everyone I'd say "Just Hit Delete." If you get EVERYONE involved then it's trivial.

"What the hell are you talking about? ALL spam is abuse."

Excellent point. Since you understand I'll rephrase it as targeting spam that can be targeted using a honeypot. If you're seeing the spammer connection attempts but stopping them how do you know they aren't looking for an open relay? In any case you get bonus points for seeing it - if more people watched then more reports could go to ISPs about the abuse. Even those ISPs who smugly harbor the spammers might change attitude if they saw even a small stream of ABUSE reports - not SPAM reports. I know I've gotten a spammer knocked off UUNET when all others were saying UUNET harbored them. I didn't have to "raise my voice" or issue threats: I just sent them the SMTP logs that showed the abuse, along with a sample spam. For that matter Michael Tokarev got Ralsky knocked off UUNET again and again, all in the same weekend. The spam stopped when Ralsky ran out of his then-current stock of throwaway accounts in his Dallas operation. More recently Ron Guilmette has gotten what appears to be Ralsky's own servers in his $3/4 million house near Detroit knocked off. This is easy stuff.

"Even the small time spammers, who seem to be the ones you focus on..."

With a honeypot you catch who you catch. See above: Ralsky is NOT a small-time spammer. I believe most spammers now use abuse (open relay abuse, open proxy abuse, Jeem-type abuse) to send spam. Direct spam is fairly easy to stop using blocklists. It's also fairly easy to trace. I don't think most spammers use it. Scelson has claimed he does but then Scelson has filed for bankruptcy.

"What about having ISPs also watch for abuse traffic going out from their own customer base?"

(Slaps head.) DOH! Why didn't I say that? You are absolutely correct. Both the ISP on the sending end and the ISP at the abuse end can look for the same traffic, using traffic analysis tools. I'm familiar with ntop - I'm sure there are others. Cable modem users could watch for spammers probing for open proxy ports on their cable segment using ntop (there's even a low-cost Windows version.) Until spam is gone I think all ISPs who could look for abuse should look for abuse (and not simply secure the ports subject to abuse - that is too easy on the spammers.)

"Running honeypots isn't even necessary for this. They can block incoming ports for open proxies either at the border routers, or in the customer RADIUS profiles, and blocking incoming port 25 in the RADIUS profiles (except for those authorized to run a mail server). Same for any ports eventually discovered to have been deployed by viruses."

Frankly, I can't understand why 99+% of ISPs don't do this automatically. Your point is an excellent one.

But I'd really love to see (as a good example) telesp.br start watching for and honeypotting spam traffic. Of course they could block it - I'd just like reading about the shock when the spammers discovered their abuse of that domain was failing 100% (even though it looked just the same form their end.) But that's my mean streak. [I don't, however, apologize for my mean streak.] The next step would be for telesp.br to tell other ISPs how they defeated the spammers abusing their space. Might that word spread fast?

Re:Anti-spam goals do differ and complicates thing

[Skapare]

"That's what my 2nd item is, when everyone has that goal."

I don't think everyone is needed. Significant effects have been seen from single systems. If I were going for everyone I'd say "Just Hit Delete." If you get EVERYONE involved then it's trivial.

True, not everyone is needed. What I was referring to is what the definition of my goal is. That 2nd goal is to prevent even so much as a DNS lookup to find my servers, and certainly not a SYN packet to try to make a connection (which can be stopped at this point with a border router access list, but still, that uses up some bandwidth and router cycles, which I should not have to pay for, but wouldn't have worried about had it stayed at a miniscule level). By extending my goal to "everyone", it eliminates all spam.

"What the hell are you talking about? ALL spam is abuse."

Excellent point. Since you understand I'll rephrase it as targeting spam that can be targeted using a honeypot. If you're seeing the spammer connection attempts but stopping them how do you know they aren't looking for an open relay? In any case you get bonus points for seeing it - if more people watched then more reports could go to ISPs about the abuse. Even those ISPs who smugly harbor the spammers might change attitude if they saw even a small stream of ABUSE reports - not SPAM reports. I know I've gotten a spammer knocked off UUNET when all others were saying UUNET harbored them. I didn't have to "raise my voice" or issue threats: I just sent them the SMTP logs that showed the abuse, along with a sample spam. For that matter Michael Tokarev got Ralsky knocked off UUNET again and again, all in the same weekend. The spam stopped when Ralsky ran out of his then-current stock of throwaway accounts in his Dallas operation. More recently Ron Guilmette has gotten what appears to be Ralsky's own servers in his $3/4 million house near Detroit knocked off. This is easy stuff.

They may well be looking for an open relay. I've seen those. I can tell because the recipient address is not one which would have led any normal MX-record-following SMTP client to my server. I have seen an "attack" by several hundred (worst case was a little over 23 thousand) such hits from the same IP, doing the relay thing. But that has only been on the server of one of my clients, who once many years ago did have an open relay there (and perhaps someone is running an antique list). My own have never seen any significant open relay attemps, so I suspect what I do see are test probes, either by spammers looking for lush new territory (didn't find it here), or by an operator of some open-relay blocking DNSBL. But the vast majority of hits on my servers are some combination of big colocated spammers (such as yourbigvote.com), and thousands of small time hustlers on cable modems and such. I've blocked both at the mail servers, so I see logs of attempts to deliver that fail. And they keep coming and keep getting 550 responses, and never clean their lists on the basis of that. The small time ones I can understand as they are running from some CDROM, typically. But the big ones could do this ... they just don't.

"Even the small time spammers, who seem to be the ones you focus on..."

With a honeypot you catch who you catch. See above: Ralsky is NOT a small-time spammer. I believe most spammers now use abuse (open relay abuse, open proxy abuse, Jeem-type abuse) to send spam. Direct spam is fairly easy to stop using blocklists. It's also fairly easy to trace. I don't think most spammers use it. Scelson has claimed he does but then Scelson has filed for bankruptcy.

You're still using "abuse" in a restricted venue. Relaying spam through someone else's server is TWO cases of abuse ... 1: the abuse of the open relay (IMHO, they got what t

Re:Anti-spam goals do differ and complicates thing

[minas-beede]

You're still using "abuse" in a restricted venue. Relaying spam through someone else's server is TWO cases of abuse ... 1: the abuse of the open relay (IMHO, they got what they deserved for having it open) ... and 2: abuse of the recipient. Lots of spammers do use the direct method, and lots of them are still in the USA (but lots of others have moved to places like Hong Kong).

Yes, I am. I could get technical and call it "3rd party abuse" (of which there could be and often is more than one) but that just makes the definition exact - it doesn't convey much information. (Many spammers hit the open relays through open proxies. That's why I see proxypots as having a high value - they may be the first 3rd party the spammers abuse. That reveals the spammer's IP. Are you familiar with Ron Guilmette's top 40 spammer lists in news.admin.net-abuse.email? All the IPs and IP blocks in the lists were learned using proxypots.)

And then there's the Hananet spammer who spams From Taiwan to Taiwan addresses, through US computers. Sometimes he sends spam to apparent relays strictly on the basis of his test message being accepted, not on the test message reaching its destination. He's been a real pest lot's of places.

I don't know of any use for a proxy port to go across the public internet.

Your whole discussion here is very sensible. If some ISPs would do what you advocate and report the success (if any) of doing it then I'd hope many more ISPs would have the simple good sense to do so themselves - if you are anti-spam there's nothing to lose. I'd like to see the spammers whacked (on the basis of honeypot operation) but if they just fade to nothing because the pathways get narrow and then vanish I'm not going to be upset. I'll rejoice. It does seem to me that having honeypots might speed the process (as opposed to blocking ports.) It's similar to the campaign to secure open relays - until the available abusable bandwidth drops below what the spammers need they aren't very inconvenienced. Honeypots, even single ones, can have an effect right away.

Reporting 3rd party abuse has more bang for the buck in terms of a complaint sent to an ISP. If the ISPs learn to give such complaints precedence they can nuke spammers quicker (pressure will have to be applied to the ones who don't want to nuke the spammers) and that should lead to the complaint level going down (no spammers, no complaints, of course.) Everyone wins except the spammers.