Slashdot Mirror
Osirusoft Blacklists The World
NSXDavid writes "Earlier today our site mysteriously ended up on Joe Jared's Osirusoft SPAM blacklist which is used by lots of antispam software (like SpamAssassin and sendmail). Since he is currently under a serious DDoS attack, there was no way to appeal this decision. We contacted Mr. Jared by phone who informed us that 'everyone needs to stop using Osirusoft and that he's going to be shutting the service down.' Then he says he's going to blacklist 'the world' (aka, ban *.*.*.*) to get his point across. Later on this evening, he apparently went ahead and did just that. Succumbing to lawsuits and DDoS, a once great blacklist is dead. SpamAssassin is removing it from their config in the next release (rc3) and email admins around the globe are reconfiguring their mail servers."
It may take a little more work, but the only solution to spam is the whitelist.
The non-communication only breeds rumours.
This isn't any different from any time spews blacklists anybody; They've never claimed to not blacklist legitimate people. And, it's impossible to contact spews to get yourself removed if unfairly blacklisted. Everyone in the world, who has been blacklisted unfairly by spews is now celebrating. Hopefully now, people using spews will realize that spews really is a poor solution to the problem, that causes more harm than it prevents.
get 0wned. irc.w30wnzj00.com
AC comments get piped to
I'm sorry, but this guy is a true blue asshole. My condolences for being DDoSed, but by banning "the world" to try to tell people to stop using his service ASAP, plenty of legitimate non-spam email got blocked, meaning that people may have to resend, and in some cases may not even know their email was missed. That's worse than spamming, people.
Oh, I forgot, the standard propaganda line from these SPEWS.ORG type anti-spam fundamentalists is "we didn't block your email, the ISP using our service did, blame them."
It's nice that they tried to fight spam, but when your lists interfere with legitimate business, it's time to back down.
Assholes.
The coolest way we could stop spam from being distributed is to require mail servers to register with a trusted signer, and do the delivery over ssl. anyone distributing spam via a trusted mailhost would be promptly identified by their ssl signature, and anyone sending mail from an untrusted source could be rejected. there is already enough infrastructure in place for this to occur now. verisign and friends as trusted signers, and smtp-ssl. the only other thing required is the will to put it to work.
If you learn anything by past occurances, all this means is that the next generation of blocklists will be even more BOFHish.
That has been a consistent development since MAPS RBL became d***less. Every single blocklist that followed another one that went down, was more strict than the one it replaced.
Whoever is doing the DDOSing the nameservers of SPEWS and osirusoft is pretty achieving nothing in the end.
In Soviet Russia, I ruled you
I'm willing to bet the big news carriers would give an account to any legitimate operators of such a service. Sign every post from trusted list creators with a public key to ensure validity, and it would be nearly impossible to ddos the service.
Ooooh... what about making the list itself a p2p app? Perhaps this could be a great excuse to motivate some big corps to install some freenet nodes...
How about, instead of contacting your ISP to get you off the list, you contact them about not allowing spammers on their networks in the first place and/or terminating their accounts before the spammer lands the ISP and their customers on a blacklist?
They want you to get flamed to death as further punishment.
"Switch ISPs." So if a major residential cable modem ISP's mail server gets blacklisted, then how is anybody in any of the towns serviced by that cable company supposed to send e-mail to users of ISPs that use SPEWS?
Will I retire or break 10K?
ISPs are in the business of transmitting data. When you start forcing them to inspect the data they transmit you are asking for a whole host of larger problems than SPAM.
SPAM is a tough problem, but that doesn't mean the solution is to blame or attach --which is what you are suggesting-- anyone.
My point exactly. You hit me to get me to complain. Did you ever think that I don't want to take that active of a role in your war? Did you even bother to ask me if I wanted to participate? Are you, or anyone who uses the list offering to help me out with the costs of forcing me to be your soldier?
Here's the deal I am willing to make: if you are going to block an entire C block that I am part of, send me an email and let me know and then I will happily complain to my ISP until I am red in the face. I am willing to make that promise.
But... if you want to just slam me on a list without any regaurd for the costs it will incur for me, then don't expect me to be a happy little soldier. It's just not going to happen.
Although the vast majority is filtered, I get as many as 2000 spams per day, personally (the downside to having the same email for 8 years). And I am NOT sorry to see SPEWS go. There's no question SPEWS was effective at getting spammers kicked off their networks. Likewise, arresting everyone in a town every time a crime was committed would probably be effective at stopping crime. That doesn't mean it is a good idea. When a blackhole list has something like a 100:1 legit-mai:spam ratio for blocked messages, the ends no longer justifies the means, in my book. I've had more legitimate mail blocked to or from me or companies I've administered servers for by SPEWS than any other cause in the past few years.
Now, let's continue to turn our attention towards methods of stopping spam that don't involve dropping 100x as much legitimate mail.
maybe you should have found out about it months ago when Jared announced the fact in various online forums -- forums that any responsible person calling themselves an admin should take it upon themselves to read, especially when they are using an RBL whose policies are not under their control. hell, you could have just bothered to occasionally read the news updates on his website.
blocking the world is what happens to clean up the idjits who are still using a DNSBL weeks or months after it's been announced that the list is shutting down.
jeez.
if i did business in those countries, i'd do selective white listing. Since i dont, I plonk the entire countries and be done with it. Every mail admin will blacklist what he needs to nuke as needed . As far as american spam, you should see my firewall, its LOADED with entries for XO, CW, level3, qwest, etc. I terminate all spammers, be it foreign or domestic. And if the network they come from is just a spam network, then the whole network goes, be it American or foreign
Lawyers, MBA's, RIAA? A jedi fears not these things!
I have been with my ISP for years. They have a strict spam policy. They get rid of spammers as soon as they are discovered. They also get rid of anyone that is generally causing any pain to their other subscribers. I know this because I have seen it happen a few times.
Did it ever occur to you that a spammer does not walk up to an ISP an annouce that they are a spammer? What exactly would you suggest an ISP do? Background checks? Get a note from the spammer's mom? This may come as a surprise, but spammers sometimes tell lies.
And again, how fricking presumptive of you to think that you can fight your war at any cost, including costs you force upon me. The big problem with spammers is that the email they send costs the world way more than it does themselves. The ironic thing is, the same goes for the blocklists.
This is bull. relays.Osirusoft.com was mainly a composite zone - data from other sources (eg SBL, SpamHaus, SPEWS) made available via a convenient DNSbl service. Joe had little to do with the content, only with hosting it, at considerable expense to himself.
I use Friend/Foe + mod-point modifiers as a karma/reputation system.
What about local blacklists? Am I under some legal obligation not to use a blacklist on my server which I use to host e-mail accounts? What's the difference between my local blacklist and SPEWS?
Idiots need to learn that no one is obligated to allow others unrestricted use of their private resources. You don't have a legal right to tie up MY CONNECTION and MY HARDDRIVE with YOUR CRAP.
Can't send an e-mail to my server because I blocked your domain? Too f-in bad. Contact your "customer" with a letter or by phone. The first amendment doesn't override my ability to mark you as trespassing on my property if you attempt to tell other people who reside on my property how you like to suck on a horse. In fact I have a right to ban people who wear funny hats from my property if I so choose. It's MY PROPERTY. I CHOOSE who can be on it.
Blacklist == restraining order.
Last I checked those were still legal. You don't have a first amendment right to talk to your ex wife who you beat and banned you from comming near her.
People who try to pretend the first amendment grants them some kind of right to my resources needs to go back to kindergarten and start the educational process all over again.
Ben
Work Safe Porn
Somebody call the waaaaambulance.
I'm an anti-spam nazi, and SPEWS gave us all a bad name. I'm glad SPEWS is dead, and it needs to stay dead. It did nothing good for the anti-spam movement, only exacerbated the situation. With no appeal process and the total lack of caring for innocents leaves me with nothing but happiness to see this travesty of justice get blown into oblivion.
Sometimes, the enemy of my enemy is my friend...
Goodbye Spews... we won't miss you, you hulking piece of ill-thought out crap. Let me wave goodbye with my middle finger.
Now, maybe System Admins without a clue will be forced to take real steps to protect their users from spam, instead of playing the lazy asshole and taking the Hail Mary approach that is SPEWS and hoping for the best.
I feel greasy, now... to have agreed with spammers. I think I'll go take a shower.
A blacklist is like the death penalty
Not at all, it depends how you use them. You have 3 choices:
1. Use them to block at the server or
2. Use them to tag incoming email or (the one I favor)
3. Use them as part of your spam scoring system.
The last is a built-in feature of SpamAssassin and works well.
The real "Libtards" are the Libertarians!
I would guess it will take no more than three months for another blocklist, very similar to SPEWS, to rise from the ashes. Remember that SPEWS, and the anonymous group of admins that made it up, are still Out There -- they're just without DNS at the moment.
One important point to remember is that Joe Jared himself was NOT SPEWS. No one ever knew who they were (at least no one that will admit to it). He merely acted as a reflector for their listings.
Another thing to remember is that a DDoS attack -- ANY DDoS attack -- is a criminal act. If the release of the recent incarnations of the SoBig worm and the DDoS attacks against SPEWS are indeed related, then it only proves that spammers are indeed criminals.
For my part, I've already seen an increase in spam as the result of losing access to the SPEWS DNSBL. I've had to update our local blocklist six times today, and that's really unusual for my setup. I suspect I'll be fairly busy over the next couple of weeks, doing a little of the same each day.
Spammers may have won a battle today. They're a LONG way from winning the war.
Bruce Lane, KC7GR,
Blue Feather Technologies
They're now resorting to theft of services since they can't find legit connections anymore...
Spam is always theft of services. They're just doing it more blatantly now.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
SPEWS starts out with a listing of JUST the IP address that is spamming. It gets wider only if abuse reports are repeatedly ignored. It takes many steps to get as wide as you are describing. I suspect you are greatly understating the magnitude of the spam flowing from your ISP or the upstream providers.
I can't email several friends
Email them from somewhere else and ask them to whitelist you. If they are on an ISP that doesn't support whitelists, then either they have to move, or you have to move.
Please tell me more about these ISP-critical machines that don't affect innocent users. But then why are they critical?
As for narrowly listing spammers, it's been tried. Sleazy ISPs move the spammers around to evade such blocks.
Logical depends on how you look at it - the problem is that if he simply takes it down, people dont deconfigure their systems to query his map and he continues to receive a flood of DNS queries - relays.osirusoft.com was high traffic, in excess of 300 queries/sec per server (at a time when there were 6 of them).
In order to stop the traffic he has to *force* people to deconfigure.
Does it seem more logical now?
I use Friend/Foe + mod-point modifiers as a karma/reputation system.
Then be part of the solution and start fighting network abuse in your country.
BTW, what have you done to fight abuse in the US?
To me personally, spam blacklisting is a much bigger problem than spam itself because many organizations abroad (like some departments of my former Uni) with whom I sometimes have to communicate (I live in the US right now) blacklist all major US ISPs (MSN, AOL, Yahoo, AT&T) and justify this behavior with the arrogance of US sys-admins that tend to block all foreign mail. This tit-for-tat behavior does not benefit anyone and if anything pisses me off it's the arrogant attitude of sys-admins who for some reason forget their place and think they have absolute power to decide with whom the people in their organization may communicate with and with whom they cannot.
When men used to be men
A major flaw with your stance, and the stance of many people responding to this article, is that you assume end users have free will when it comes to ISPs. Due to regulatory bullshit, there is exactly one ISP available from my apartment. One. I have a choice to either accept their policies, or not use the internet. My father, due to his remote location, has exactly one ISP available at his house. One. Neither of us had the choice to approve of the ISPs' methods of doing buisness. We either accepted it or didn't use the internet. If either of our ISPs gets blacklisted, we no longer communicate. Neither of us have any appeal, neither of us have any choice. The ISPs don't have to care (though, thankfully, they are small enough that they do) a bit about our complaints. They know we have no where to go to. So how does preventing me from emailing my father help other people not recieve spam? I'm sure some of you think that it's still the ISP's fault, that I can always choose not to use their service, but if my ISP is blacklisted I cannot communicate, and if I refuse to use the ISP then I cannot communicate. Tell my how blacklisting with "collateral damage" helps a god damn thing. Hey, explain biological warfare is a good way of making nations behave while you're at it.
It appears in fact SPEWS are just a bunch of bigots and childish censors. Their fanatical anti supposed spam zelotry shows they are persons with ill minds and serious power triping issues. If I find a system administrator at my companies using this list they will be fired. I don't like getting sued for the acts of stupid persons whom are paid to do a good job out of my wallet.
Your job to administer the systems given unto your care. Using SPEWS kind of list is lazy. If you need such a list to do your job I will pay for it. Meaning you will be expected to prepare it your self or I will purchase it for your use. Other wise I am paying for the bandwidth. This is a service company. We rely on email from all over the world to stay in that business. Your use of this list precludes our making money from addresses you block when using this kind of list.
Do your fucking job or find another.
The Boss.
In a pigs eye. I understand where they are comming from, really I do. However Spews's mision statement of attempting to encourage real users to move from their spam infected ISP just didn't work. If all the real users left, and only spammers remained, it does jack shit for discouraging that form of behavier. If all the real users just switched to hotmail, again it does jack shit to discourage the behavier. The only way that their mission would be successful if their list was in wide spread use cutting off the spammers income and making it a pointless business venture.
While quite a few people actually used spews, mailadmins whom i've spoken with pretty much didn't want the headache complaints generated both spammers and legit users attempting to get e-mail out.
There is no sanctuary. There is no sanctuary. SHUT UP! There is no shut up. There is no shut up.
I'm not sure it can be correctly called censorship - that requires a governmental entity.
That is a fucking myth, and I am sick and tired of hearing people parrot that nonsense. Saying a business can't censor because it isn't a government is akin to a black man saying he can't be racist because he is black. These are both examples of the same logical fallacy: just because a behavior is traditionally associated with one entity or group doesn't mean it is impossible for another entity or group to begin behaving in exactly the same behavior.
Obviously, anyone of any ethnicity is capable of becoming a racist, just as anyone with any power or influence over others is capable of engaging in censorship.
Responsible parents routinely censor what their kids see and hear. We as a society, by and large, find this to be an acceptable form of censorship.
Many religions routinely censor what their congregations are and are not allowed to see and hear (the Catholic church has had a censorship office for centuries, but they are hardly alone. The Mormons censor what they deam inappropriate for their membership, just as the Jehovah's Witnesses do, and I really don't need to cite example after example for Islam, do I?).
And finally, yes, many, many companies engage in censorship, both the obvious 'media' companies that bury stories they don't like or can't be bothered with, as well as other more subtle businesses (like Monsanto pressuring Fox News into not running a news story on how their hormone saturated milk was actively harmful to the health of children, an action that resulted in Fox News firing two reporters who refused to disavow their story, and said reporters winning a lawsuit against Fox News under Florida's whistleblower laws).
Anyone with any form of power over another, be it parental, religious, corporate, or governmental, has the power in some capacity to censor information available to those less powerful. It is a telling, and appalling, commentary on our culture to observe just how common this sort of censorship is, and how eager we have become to silence those with opposing viewpoints, rather than to argue the counterpoint (as I am doing here, for example).
Your Libertarian Newspeak definition of censorship is plain wrong. You may have the right to censor what comes across your network, and you may chose to excersize that right, but don't think for a moment you aren't engaging in censorship, or think you can convince the rest of the world (a few gullible moderators aside) you are not simply by trying to spin your verbiage.
And lest there be any doubt as to what censorship is:
censorship
n.
1. The act, process, or practice of censoring.
2. The office or authority of a Roman censor.
3. Psychology. Prevention of disturbing or painful thoughts or feelings from reaching consciousness except in a disguised form.
censor
1. A person authorized to examine books, films, or other material and to remove or suppress what is considered morally, politically, or otherwise objectionable.
2. An official, as in the armed forces, who examines personal mail and official dispatches to remove information considered secret or a risk to security.
3. One that condemns or censures.
4. One of two officials in ancient Rome responsible for taking the public census and supervising public behavior and morals.
5. Psychology. The agent in the unconscious that is responsible for censorship.
tr.v. censored, censoring, censors
To examine and expurgate.
(source: dictionary.com)
You will notice, that with the exception of historical references to Rome, none of these definitions presuppose governmental authority over just plain authority, indeed, quite the contrary.
The Future of Human Evolution: Autonomy
truly, white listing and bayesian filtering (Mozilla Thunderbird or Mac Mail) is the way to go. those guys running the blacklists wear black hats just like the spammers. for every spammer that they've stopped (spam increases every year exponentially ) there's a new one to replace them and an innocent company that eats shit by accident because of black lists. good riddance.
"You never want a serious crisis to go to waste." - Rahm Emanuel
After all, if spammers saw a lot of it, wouldn't they just learn to send the same spam several times at one hour intervals?
Clear, Dark Skies
I agree with most of your post, but this part bears some discussion:
There was an informal poll held in NANAE (network.admin.net-abuse.email) on how mail server admins block all of 200.0.0.0/8. And dozens if not hundreds of people replied they do block all of it. How long before it becomes thousands of networks block your country for spam abuse?
From all appearances, those on NANAE are seen as grouchy, stubborn, drunk-with-power, vindictive nerds by most of those outside the list. Don't go thinking you're going to impress anybody with informal polls or whatever done by them.
Ok, as far as I am concerned, if you personally want to use a spam block list, great. Have fun. I have no problem with that.
What I have a problem with are the system admins and management of ISPs that are making the decision to use these blocklists to bounce email for all of their customers, including the ones that don't want their email blocked. Yes, it is easy to say that the customer should simply change ISPs, but in many areas, especially when it comes to high speed options, there are no other ISPs available.
Additionally, many of my clients have been with the same local internet provider for years and only recently has that provider started using the block lists. The cost of changing internet providers can be tremendous. Consider simple things like emails addresses printed on business cards and letterhead (they had their internet provider long before they had their own website).
I think many responses that put spam block lists in a positive light are not considering the huge costs they place on actual real businesses. Often times the effects are worst on small businesses that simply cannot afford the additional costs of trying to figure out how to get off the lists.
So I wonder, if you were working for a company that was struggling a bit, and was affected by inaccurately being placed on SPEWS list, costing them thousands of dollars, how would you feel about taking a partial pay or time cut to make up that money? Would your reverence to the list stay so high? The reason I ask is because, as a business owner, I had to take a pay cut, at least temporarily, as a result of inaccurately being placed on SPEWS' list.
If an ISP wants to use an IP blacklist, fine, but they need to take responsibility for its use, use it in an intelligent way, and really consider the quality of the list that they are using. SPEWS has a reputation for being far from the highest quality list, and that reputation has grown from their own actions.
The problem is that many people, for a variety of reasons (geography being one) can't change ISPs, and many ISPs (mine included) did nothing in response to my complaints (because they knew I wasn't going to move).
Or in many cases the spammers are paying the ISPs far more per month than the $19.99 dial up guy who's complaining about spam.
Who do you think they're going to bend over backwards to serve?