AT&T Moves Toward Mail-Server Whitelist

Gunfighter writes "In an apparent attempt to quelch the amount of incoming spam, AT&T has asked their customers, partners, and business clients to provide them with IP addresses of their mail servers. All other mail will be discarded. To quote the message: "... In order to continue to allow email to AT&T you need to provide the IP addresses of all your outbound email gateways. If you do not respond immediately, your access may not continue.""

Comments

I work for AT&T!

[Anonymous Coward]

And it's been blocking email I send to my work account! Now I understand what's going on.

Re:I work for AT&T!

[Anonymous Coward]

I was just reconfiguring Outlook after getting my laptop fixed, and I assumed it was so quiet because of something *I'd* done wrong :-)

Re:I work for AT&T!

[smittyoneeach]

Which raises an interesting question:
How can companies do things like this filtration, while informing legitimate customers, so no time is wasted chasing bogus errors, while at the same time preserving the integrity of the policy?
This seems like a good thing, until a spammer gets ahold of 'legitimized' addresses, and starts hacking their packets.
Requiring a micropayment for each email seems initially a Good Thing, as a requirement for profit would seem to kill off the casual spammer fairly soon, but that, too, seems hackable, so that you penalize legitimate users and achieve nothing.
There is probably a solution, but we'd have to know the precise value of pi to implement it...

Re:I work for AT&T!

[Steve Franklin]

I canned ATT when I realised they were an ad-supported service. They are the last people in the world who should be waving the anti-spam flag.

Re:I work for AT&T!

[jayackroyd]

This, and all other spam "remedies", won't work unless there is widespread mail authentication. And if there is widespread mail authentication, this, and all other spam "remedies" would be superfluous. It wouldn't take much either. AOL and MSN already have authentication information for each of their users, through their credit card subscriptions. AOL and MSN simply have to announce that by January 1st they would issue a digital signature for each subscriber, and include that signature on all outbound mail. At the same time, they could offer the capability to block all unsigned mail as of, say, March 1. That'd be enough to force everyone else to get a signature. And that would be the end of spam. However, MS is a pretty active spammer, and I suspect AOL is as well.

Re:I work for AT&T!

[carolchi]

Is this really true? They did not think to include their employees in their whitelist?

And how do prospective customer get in touch?

Oh well.

[Doktor Memory]

SMTP email was nice while it lasted.

Semaphore, anyone? Smoke signals?

Re:Oh well.

[CaptBubba]

While this isn't the overall solution, a list of known non-spam servers could be a very important part of a spam filtering system.

Re:Oh well.

[rf0]

Two tins and a piece of wet string is all I need

Rus

Re:Oh well.

[anthony_dipierro]

SMTP email was nice while it lasted.

No it wasn't. Barely adequete, perhaps, but not nice.

Re:Oh well.

[KarmaPolice]

While this isn't the overall solution, a list of known non-spam servers could be a very important part of a spam filtering system.

That's a great idea. Why hasn't anyone done that??

Re:Oh well.

[Anonymous Coward]

No it wasn't. Barely adequete, perhaps, but not nice.

I don't know about that. SMTP, like a lot of things these days, worked just fine until a bunch of retards came along and worked to abuse the system for their own personal gain. How much spam did the Internet actually see before 1994? 1 or 2? We're talking over a decade of use before the Internet became popular with no problems. Then the idiots came along with their make money fast ideas because they're fucking criminals and should have been locked away with strict sentences up front to show that the con-artist behavior would not be tolerated in the new medium.

Re:Oh well.

[Anonymous Coward]

X.400, with bilateral agreements between MTAs? =)

Re:Oh well.

[Anonymous Coward]

Those aren't lists of known non-spam servers, they're lists of known spam servers or potential spam servers. There is a world of difference, in usefulness as well as practicality.

Re:Oh well.

[kryzx]

No, those links you list are to blacklists. What AT&T is doing is exactly the opposite, a whitelist. Rather than making a list of spam servers to block, they make a list of trusted mail servers that are allowed to send to them.

This is the future of mail, and the only reasonable way to solve the spam problem. In the future you will have the ability to specifically grant email addresses or mail servers the right to send you messages, denying all others.

Re:Oh well.

[letxa2000]

This is the future of mail, and the only reasonable way to solve the spam problem. In the future you will have the ability to specifically grant email addresses or mail servers the right to send you messages, denying all others.

That'd no longer be email. Once email is no longer open to anyone that wants to send you email or once email starts costing money the email we've known for decades is history. It'll be a burned out shell of the useful and powerful thing that has been email to date and which has caused worldwide communication like no other technology.

I wish more people and companies would start taking approaches to spam that truly target spam rather than saying, "I'd rather not communicate than get spam." We need to get rid of spam, but if we lose the benefits that made email popular and useful in the first place then it's a scorched earth policy.

In other words, what good is implementing some anti-spam idea if it doesn't just get rid of spam but also gets rid of valid communication? These ideas should be non-starters.

Re:Oh well.

[jo42]

We use fibre here in Canada instead - much more hi-tech. Problem was moose guts wouldn't stretch far enough...

Re:Oh well.

[ePhil_One]

This is the future of mail, and the only reasonable way to solve the spam problem.

Hopefully the meta-mods will knock this nonsense down. What this is proposing is barely a step above unplugging from the internet as a way to controll the virus problem. I figure it will be about a week before VP Bob can no longer email his buddy VP Joe dirty jokes and the whole thing is backed out.

Re:Oh well.

[kaoshin]

Amen. My company just started using spamassassin for email filtering. The thing is they consider it an "acceptable level of risk", and that the incredible flood of spam just can't be tolerated anymore. Hope the mail that they DO lose isn't a really important one that costs the company big bucks. Personally I don't have any problems removing spam. I've said it before and I'll keep saying it. Whitelists and challenge response are the future of email. Yeah people may hate the hassle, but they hate voicemail options too and that is the most effective on telephone.

Re:Oh well.

[Archfeld]

How is this gonna stop SPAM ?!?! 85% of it, *pulls figure from his colon* is coming thru pirated unsecured servers, how is this gonna address someone compromising a so-called trusted host and flooding the isolated starving little "protected" part of the web. How many customers, business and vendors will they screw, and AT&T is gonna manage this mail list in real-time without heinous errors and then continue to keep a list active, follow up on wether hosts have retired ? NOT BLOODY LIKELY...I forsee this crumbling under the weight of the administration process, but we all know AT&T is still living in the 1920's anyways...

Re:Oh well.

[letxa2000]

Whitelists and challenge response are the future of email.

Don't get me started on challenge response. That "solution" is just about as evil as spam because it, by design, *contributes* to the spam problem.

If some spammer sends a spam to a user with challenge/response and forges the return address (which is par for the course), the challenge/response will send a challenge to the purported email address. That will be some poor innocent person who had nothing to do with anything, yet he is receiving the challenge. For him, that's spam. So now instead of a single spam being sent and silently filtered upon receipt, a total of two spams have been sent on the network.

If the return address of email were somehow authenticated then I'd have less of a problem with using challenge/response, although I still don't think it's the best solution. But as long as email is anonymous and the return address can be forged I think challenge/response is as obnoxious as spam itself. You are saving yourself from spam by filling up innocent third parties' mailboxes with your challenges.

Re:Oh well.

[kaoshin]

In the three years I have been working with CR systems I have heard this argument hundreds of time. It is however a valid concern, and here is my response. Use flood protection on challenge responses to prevent using CR systems as a mailbomb attack. Earthlink (my only corporate example of this spam prevention method) does this. Any system can be exploited if you are lax on security. Yes there is an amount of overhead but by nullifying the usefulness of spam completely on a global level the network activity would actually be reduced greatly. The autoreplies can have filters applied to them to prevent you from getting ones you shouldn't be getting. This will work one day when people will wake up and realize it is possible, quit being scared of tackling real problems, and stop bandaiding the problem with pattern filters.

Re:Oh well.

[Jesus 2.0]

Yahbut, in order to be valid, your argument needs the assumption that spammers will continue to spam even though their spams don't get delivered due to challenge/response.

Re:Oh well.

[afidel]

the email we've known for decades

A bit of hyperbole methinks. I've probably had an email address longer than 99.99% of even slashdotters and I've only had mine for a single decade. Spam is becoming such a problem that even old stalwarts like me are taking drastic action, just recently I added a procmail rule to route all email not addressed specifically to me into the bit bucket, it breaks BCC but dropped my spam by ~90%.

Re:Oh well.

[Just Jim]

From the nature of spammers, it would seem that they'll continue to spam just out of spite. See for example the recent DDOS against people who would like to keep email useful (also known as 'anti-spammers').

So what's to prevent..

[dr ttol]

..the spammers to get AT&T to whitelist their IPs?

Re:So what's to prevent..

[YouHaveSnail]

Well presumably, any gateway that delivers significant amounts of spam to AT&T will be removed from the white list and added to the black one.

Their whole approach may or may not work, but it's an interesting idea. The PGP "web of trust" concept never really caught on among the general public, but creating a web of trusted mail servers would seem like a simple and effective defense against spam. AT&T's move might be the first step in that direction.

The next step, of course, would be either a new protocol or an extension to an existing one that would let one mail server ask another "Hey, smtp.xyz.com wants to exchange mail with me, but I've never heard of him. Do you know him? Do you trust him?" If VeriSign really cared about innovating and improving the net, this is the sort of thing they should be working on.

Re:So what's to prevent..

[Anonymous Coward]

Verisign? The only company that caused more troubles than spammers, by their attemp to get everyone to visit their website and see their ads.

Re:So what's to prevent..

[Anonymous Coward]

If VeriSign really cared about innovating and improving the net, this is the sort of thing they should be working on.

I think you just found the solution to the spam problem: What if mail servers needed to have a PK certificate before mail server would relay mail for them? Also allow mail-admins to specify what CAs they trust certificates from...

Re:So what's to prevent..

[coolmacdude]

Well presumably, any gateway that delivers significant amounts of spam to AT&T will be removed from the white list and added to the black one.

And how exactly is this different from the current system?

Re:So what's to prevent..

[moonbender]

The vast majority of servers will be caught by the white-list. The very few who are smart/dumb enough to register on it can easily be handled by the blacklist - and, since assumedly the whitelist registration contains contact information, possibly be held responsible for their spamming.

Re:So what's to prevent..

[Anonymous Coward]

It should not be a big problem to set up parallel mail systems.
A white list, a regular email, the black list, on users' ends.
Or in a system.
I rarely check my ISPs junk mail trap. I suppose you could set a regular mail expire, and most people would sooner or later give up on non-whitelist mail, treating it mainly like a spam trap for junkmail. Whitelists would naturally evolve this way. Rather than being mandated. Whitelists boxes should be heirarchal. 1 is Boss, your ISP, Mom, Wifey, all email from Cheabytes and Newegg about orders in progress to whitelist 2, all other whitelist email to three.

Re:So what's to prevent..

[tius]

So, either way, what was an inexpensive universal service becomes one of rising costs and reduced availability.

Here's a business scenario: what if I'm not an AT&T customer and try one of the following:

1) Contact to enquire about services? Ok, they'll likely have some form of a hole for this...perhaps a web form.

2) I search the net and come up with technical article by an AT&T employee, it includes their email address. I have some comments on their article and wish to correspond.

O well, another day where commercialization continues to kill the net.

Re:So what's to prevent..

[4of12]

I like that idea.

Instead of a binary choice of black list or white list, where trust is all or nothing, a degree of trust should be established with keys signings from servers that endorse the level of trustworthiness of other servers. Perhaps the host keys used by SSH would be a good start on such a system.

Since trust would be collectively measured and each individual server manager would be in a position to selectively weight trust from various other servers, spammers couldn't easily bomb the system by providing unreliable endorsing servers.

Users will still get a trickle of spam, but every piece they get and use to feedback into the system (this IP address sent me trash) will quickly help sort out all the spam spewers.

It would be a shame, however, if there were no way for some trusted server to be used for anonymous email, which has its uses apart from spam. Maybe anonymous re-mailers could work again, as long as inbound messages come from a trusted server.

Re:So what's to prevent..

[swordboy]

"Hey, smtp.xyz.com wants to exchange mail with me, but I've never heard of him. Do you know him? Do you trust him?"

Its a mail server... not a male server...

Re:So what's to prevent..

[CowboyMeal]

More innocent victims.

Re:So what's to prevent..

[YouHaveSnail]

Instead of a binary choice of black list or white list, where trust is all or nothing, a degree of trust should be established with keys signings from servers that endorse the level of trustworthiness of other servers. Perhaps the host keys used by SSH would be a good start on such a system.

Right. The role that I was thinking VeriSign (and many others, I hope) might want to play would be analogous to that of a credit reporting agency. If smtp.xyz.com contacts your server to send mail, you'd first determine for yourself whether you trust that server. You might do this just by looking at your own black and white lists, or you might just accept all mail, or you might ask one or more servers that you trust how much they trust xyz. For extra credit, the protocol should be designed so that you can ask a server not only 'do you trust xyz?' but also 'who trusts you?'.

It would be a shame, however, if there were no way for some trusted server to be used for anonymous email, which has its uses apart from spam. Maybe anonymous re-mailers could work again, as long as inbound messages come from a trusted server.

It didn't occur to me until you mentioned it, but anonymous re-mailers could work better than they ever did before. Once a re-mailer establishes itself as trustworthy, other mail servers should be satisfied that that server won't send spam, and will likely accept any mail it wants to send. There might be other reasons that the server chooses not to trade mail, but spam won't be one of them as long as the re-mailer can effectively police its users and enforce its 'no spam' policy. The same thing works to prevent child pornography and other illegal stuff.

Some ISP's might initially balk at the prospect of having to detect violations of their no-spam policies, but if they do it, they'll be rewarded with a huge reduction in the amount of mail that they have to transfer and an increase in available network capacity.

Re:So what's to prevent..

[John Hasler]

SPF: Sender Permitted From

spf.pobox.com/

Re:So what's to prevent..

[GreyPoopon]

The role that I was thinking VeriSign (and many others, I hope) might want to play would be analogous to that of a credit reporting agency.

Absolutely not. We need a "for profit" company (particularly VeriSign) to have this kind of power like we need a hole in the head. Have you EVER dealt with one of the credit reporting companies that mysteriously had a black mark on your credit record and tried to get it removed? This would be even worse. How much would you have to pay (supposedly for the background check) to get your server white-listed? How much extra would you have to pay to make that process happen in something less than six months?

All it takes

[lingqi]

is a few span servers to get on the list, and a few legit servers to get hacked and taken off the list (and tries to get on again) before there will be hell and ATT would have to abandon the plan, wasting all these time and resources used to instate this plan in the first place.

Great shame, really...

Re:All it takes

[HBI]

The servers will be now identified by customer.

The incoming spam will then have an owner tied to it, who will be held accountable. It's a very workable system actually and not as prone to failure as you are alluding.

Re:All it takes

[seanadams.com]

The solution is pay-per-mail. I set my price at $1 per email. The charge is forgiven if I reply. You spam me at your expense - I'll happily accept the $100 per day.

Re:All it takes

[lingqi]

The servers will be now identified by customer.

and if a popular server is identified by many customers? like, say, hotmail?

and there ARE cases where somebody might want to send email to a person with no prior contact - the "long-lost HS friend" is overused, but take other examples - say I am active on a mailing list and somebody want to ask me something, or if somebody is replying to my advertisement on ebay. there are TONS of problems with a whitelist-only approach.

Re:All it takes

[l810c]

And what the recourse for the Customer? Call or email the ISP to get xxx.com on their whitelist?

Here's some samples:
'I just signed up for fatanalhos.com and they emailed me my password. I didn't get the email. Could you please put fatanalhos.com on your Whitelist?'

'I just ordered some penis enlargement cream, but I didn't get my email conformation. Could you please Whitelist myphatcock.com?'

'I'm expecting a large sum of money from Nigeria and I can't get my emails...'

Re:All it takes

[platipusrc]

It doesn't seem like this plan will affect servers like Hotmail, but rather it will only affect those mail servers that are using ATT's internet service to send outgoing mail. Rather than filtering each email, it will only let whitelisted mail servers send mail, period. If a server is on ATT's bandwidth, and it isn't on the whitelist, then it won't be able to send mail at all, so there won't be any worries about what you said. In other words, it only filters servers that are sending mail from within the ATT network, not incoming servers, and not particular users from those servers.

Re:All it takes

[rc.loco]

Um, while I'd like to believe you, it doesn't look that way to me.

dig mx att.com

then telnet to port 25 for each MX host

I get no response from any of them.

It's a crying shame we've gotten to this point, I've been waiting for it for at least a year or so. All because of a bunch of greedy lowlife spam-spewing bastards who decided to capitalize on a resource to which NONE of them likely ever contributed anything of any value.

The IETF really needs to re-engineer SMTP, a la djb's model or something akin to it. Make these spam bastards pay for their putrid abusive ways!

Re:All it takes

[bareminimum]

And who is foolish enough to ban customers from communicating with him? You can impose strict rules on vendors, but you'll always be your customer's bitch.

Re:All it takes

[platipusrc]

Wow, ok it looks like I was mistaken. I also get no response when I try to telnet there. I also get no response from the University of Georgia computer science department's mail server. Hmm. But how does this work? It looks to me that the only effect this will have will be to anger customers because they can't receive mail from most locations. It would really suck to be a student at UGA and have ATT's service right now during registration and miss some fairly important emails that the registrar's office and others send.

Re:All it takes

[KindAloysiusX]

I don't think this scheme is scalable. What if you and I want to have a conversation? Do we have to exchange mail forever?

Re:All it takes

[bobv-pillars-net]

dig mx att.com

then telnet to port 25 for each MX host

I get no response from any of them.

Keep trying. According to my logs, about 30% of the time, they DO respond. I don't know if they're overloaded 70% of the time or if their IP-filter breaks 30% of the time, but if you keep trying long enough, you will get through.

Re:All it takes

[Anonymous Coward]

This is a form of the Byzantine Generals problem. The summary of the problem as I read it (and this was someone analyzing how to attack P2P networks trying to keep forgeries (eg. RIAA planted fake songs) out) Essentially, the problem's solution was such that so long as 2/3 of the 'generals' or hosts on the network are 'good', ie. in our case not spammers, the spammers lose. You can search the slashdot archives if you want, I'm too lazy.

I fundamentally believe that this is the real solution to the spam problem, (although Naieve-Bayes filters are pretty good) but nobody has started to create the list.

Yes, I know under this scheme you can't easily send mail direct from your leet home xchange server. Proxy it through your ISP's mail server. Thats not exactly rocket science.

Re:All it takes

[Anonymous Coward]

Oh fuck, that's funny... bwahahaha

Re:All it takes

[Anonymous Coward]

Yeah... You're right. So why don't you get offline and take a course in ENGLISH?

Re:All it takes

[silentbozo]

Apply game theory. He who stops replying first gets to keep the extra dollar (assuming that he did not initiate the exchange.) Thus, the only way to win, is never to e-mail anyone!

Re:All it takes

[AKnightCowboy]

And what the recourse for the Customer? Call or email the ISP to get xxx.com on their whitelist?

Switch ISPs apparently. AT&T doesn't want to be in the ISP business anymore from the looks of things. Next thing you know they will block everything except outbound port 80/tcp to their "premium content servers". Run away very fast from idiotic ISPs who do shit like this to screw their customers.

Re:All it takes

[Anonymous Coward]

I will say, fuck them;)

Re:All it takes

[matth]

Seems to work fine for me!

[matth@mercury matth]$ telnet email.pct.edu 25
Trying 12.23.198.9...
Connected to email.pct.edu.
Escape character is '^]'.
220 email.pct.edu Novonyx SMTP ready $Revision: 3.16 $
quit
221 email.pct.edu So long, and thanks for all the fish

AT&T WorldNet Services ATT (NET-12-0-0-0-1)
PENNSYLVANIA COLLEGE OF TECHNOLOGY PENNCOLLEGE-198 (NET-12-23-198-0-1)

Re:All it takes

[kwpulliam]

Folks - This is att.com that is doing the whitelisting. Att.com is the business. Att.net is the ISP.

Re:All it takes

[Slamtilt]

Workable? Hardly. If lots of companies did this, I would have to remember each one that I'd sent the mail server's IP to. And if I had to change the mail server's IP (I can think of a hundred reasons why I might have to do that), I have to remember to inform them of the change.

Now bear in mind this change breaks ad-hoc emails of the "Why don't you ask foo@att.com about that? I met him once and he had some interesting things to say" sort. Your e-mail to foo is not going to be received without prior legwork, which makes it less likely you'll send it in the first place.

Now multiply that effort by every company and individual that chooses to implement this system, and you've got a system that requires a lot more work in order to be a lot less useful.

AT&T could have at least used something unrelated to IP address for their whitelist, like, oh, public keys or something.

(But apparently they don't understand things like that. Maybe the original had it, but I wouldn't have believed the letter as linked either, no signature or anything.)

Re:All it takes

[sglines]

Of course if I'm a would be new customer I can't e-mail ATT asking to join some plan I('ve heard offered on TV. lets all watch as ATT's market share dwindles even more.

Re:All it takes

[Anonymous Coward]

The IETF really needs to re-engineer SMTP

Yeah, because SMTP is the reason that spammers think they can get something for nothing. (/me looks at NNTP, laughs.)

Make these spam bastards pay for their putrid abusive ways!

Of course! Let's punish the spammers by coming up with an unworkable plan for email! That'll show 'em!

Re:All it takes

[Anonymous Coward]

I'm an att home customer. Our church is hosted by Radiant, and ATT has blacklisted all Radiant mail. So I can't get mail from church. I call ATT, and they say that I as the customer can't have a mailserver whitelisted (???!!!) It has to come from the mailserver admin. Hmmm, so the paying customer can't control what's black / white listed! ATT may be losing this customer

Re:All it takes

[sphealey]

Now bear in mind this change breaks ad-hoc emails of the "Why don't you ask foo@att.com about that? I met him once and he had some interesting things to say" sort. Your e-mail to foo is not going to be received without prior legwork, which makes it less likely you'll send it in the first place.

As a person who has been using open address/open mailbox e-mail since the late 1970s, that saddens me greatly. But at this point the spammers have essentially destroyed the usefullness of open transmission e-mail. Personally I am just waiting it out, using my real address and hoping it gets better in another year or two. But in my corporate support position, where spam now outnumbers legitimate mail 5:1, I fully understand why a large company would do this.

sPh

Re:All it takes

[Macgruder]

ATT.NET's mail server (mailhost.worldnet.att.net and postoffice.worldnet.att.net) are behind filter. Unless you are coming from an AT&T IP address, they will not respond.

All others have to use their 'open' servers with an SSL connection

Re:All it takes

[screwballicus]

Okay, admit it. Which of you just checked to see if fatanalhos.com or myphatcock.com actually existed? That's right. It's okay to cry.

Re:All it takes

[kaoshin]

I know they modded this as funny but it brings up a serious question regarding challenge response systems. How can two people with challenge response systems communicate without bouncing autoreplies back and forth forever. This question was answered me in so many words by someone from Earthlink in a previous slashdot article about Earthlink implementing a CR based spam prevention system. Send CR mails using a null envelope and (at least temporarily) whitelist addresses you send to and this problem will be prevented.

Re:All it takes

[GreyPoopon]

Send CR mails using a null envelope and (at least temporarily) whitelist addresses you send to and this problem will be prevented.

Are they saying that the mail system of the originating mail should temporarily whitelist replies coming from the destination? I hope so.

Re:All it takes

[kaoshin]

Yes, that is correct.

Re:All it takes

[Anonymous Coward]

check out the outside the inbox compilation -- all the song titles are taken from Spam-mails

Re:All it takes

[Schmucky The Cat]

Um, you're connecting to a server that uses ATT bandwidth, not an ATT server.

Re:All it takes

[dissy]

> > The servers will be now identified by customer.

> and if a popular server is identified by many customers? like, say, hotmail?

Hotmail does not buy dialup or broadband from AT&T...

> and there ARE cases where somebody might want to send email to a person with
> no prior contact

Did you even read the article?
Inbound mail will not be effected by this at all in no way shape or form. Why even bring it up?

But to answer your question, *IF* hotmail gave up their many many OC-3 and faster links and decide to go with a 1mbit DSL or 56k dialup for their hosting, *AND* they choose AT&T as their dialup/dsl provider, then yes hotmail will need to register their mail servers with AT&T before those servers can send mail to the rest of the internet. And if hotmail, as one of AT&T's customers at this point, tried to send out spam, im sure they will be removed from the whitelist.

If your long lost friend in your example became an AT&T customer, and chooses not to use AT&T's mail server but one of their own running on their AT&T internet connection, and they choose not to register, they cant email you or anyone else and this is their problem to fix, not yours.

> but take other examples - say I am active on a mailing list and somebody want
> to ask me something, or if somebody is replying to my advertisement on ebay.

So then they email you.
If they happen to be AT&T customers that dont register their mail servers IP, they cant send mail to anyone.
If they arnt AT&T customers, then it totally doesnt matter to them.

Re:All it takes

[dissy]

> Workable? Hardly. If lots of companies did this, I would have to remember each
> one that I'd sent the mail server's IP to.

Try reading the article or something.

You have your one mail server on your AT&T dsl/dialup. You KNOW its IP.
Why would you want to run many mail servers on multiple IPs on your side of your AT&T internet link? That is not only stupid, but sounds exactly like what a mass-mail sending person would need, and fortunatly these are the people AT&T is trying to block.

This is for allowing mail OUT of AT&T's network.
If you dont like it, use AT&T's mail server, or dont run your mail server on an AT&T dsl/dialup line and it wont effect you one bit.

Oh, you were talking about incoming mail whitelists instead?
Good for you.. maybe when there is an article on that topic, your post will make sense.

Re:All it takes

[pmz]

Do we have to exchange mail forever?

First you exhange e-mail repeatedly...then you fall in love from your growing mutual awareness...then you meet at a diner...fall more in love...then you get married and start a family.

So, don't reply unless you are really committed.

Re:All it takes

[Tackhead]

> But to answer your question, *IF* hotmail gave up their many many OC-3 and faster links and decide to go with a 1mbit DSL or 56k dialup for their hosting, *AND* they choose AT&T as their dialup/dsl provider, then yes hotmail will need to register their mail servers with AT&T before those servers can send mail to the rest of the internet. And if hotmail, as one of AT&T's customers at this point, tried to send out spam, im sure they will be removed from the whitelist.

All of which is a long way of saying that AT&T should just block outbound SMTP connections from their clueless fuckwit DSL and cablemodem customers (but I repeat myself) in 12.0.0.0/8.

Ironic, no? "AT&T: There's so much fucking spam coming from our own customers that even we block traffic from them!"

Re:All it takes

[Slamtilt]

Try reading the article or something.

I did. I responded on the basis of the mails as linked.

This is for allowing mail OUT of AT&T's network.

Perhaps you'd like to point out where in the linked e-mails it says that? The thrust of it appeared to be that if you are sending a mail to an address at att.com, AT&T would need to know the IP address of your sending server before you send your mail. Now we know the mail was sent in error, which might explain the fuzzy wording of it.

That doesn't excuse your rudeness, of course.

Re:All it takes

[dissy]

> > Try reading the article or something.

> I did. I responded on the basis of the mails as linked.

> Perhaps you'd like to point out where in the linked e-mails it says that?

http://www.sosdg.org/attmail.html
This is the only email I see linked from the article.

In it, 4th paragraph down:

Therefore, we need to know which IP address(es) are
used by your outbound e-mail service so we can selectively permit them.
Please send this information to the following e-mail address
(rm-antiattspam@ems.att.com).


This email is sent to AT&T customers. They use the word 'your'.
They are talking about their own customers mail servers.

> That doesn't excuse your rudeness, of course.

Granted, but seeing 90% of slashdot complain about something that isnt even happening, but they dont realize it because noone reads the articles, and responds based on the almost certain incorrect description slashdot provides, tends to do that to a person :P

I do appologize for the rudeness, but now that you know what this whitelist is really about, go back and read the slashdot comments, even at +4, and you can see why posting anything factual on this article is an almost impossible thing to do.

Re:All it takes

[Anonymous Coward]

... but if you keep trying long enough, you will get through.

Butthead: Huh huh, he said "you will".

Beavis: I want to reach out an touch someone. Heh heh.

Butthead: Pipe down, Beavis!

Re:All it takes

[neuron132]

That's what I don't get: most (all?) of the spam I've recevied makes claims so preposterous or contains scams so well known that I can't figure out what the payoff is. Do even 1/100 of 1% of recipients fall for this stuff? Oops, gotta go: it looks like someone wants to take me on a blind date...

Since spam sucks so much bandwidth

[zymano]

Why don't the operators of the internet just sue these clowns and their product manufacturers and put a stop to this stupidity.

It would be nice if some VOICE speaking for the INTERNET would just say "Were not taking this shit anymore and were gonna nail you little bitches! ".

I don't think there is anything difficult in stopping it. Just clueless management.

And please don't tell me that the internet is not managed by a few companies because it is.

Re:Since spam sucks so much bandwidth

[Anonymous Coward]

Shut up!11111!!!! I'm going to report you to aol and you will get kicked off the internet!

Re:Since spam sucks so much bandwidth

[dacarr]

Why don't the operators of the internet just sue these clowns and their product manufacturers and put a stop to this stupidity.

There is no one central operator of the internet. ARPA is long gone, and the closest you have to anything remotely resembling central control are the root servers - and their sole purpose in life is to attach names to numbers.

I wish they'd turn this around

[Webmoth]

I had an "unpublished" landline phone number, and chose a third-party carrier for my long distance service. AT&T called me every week as long as I had that phone line, trying to sell me long distance service, no matter that every time I called, I said "no" and told them to never call again.

It seems that AT&T thinks that if you don't want to do business with them, then they automatically deserve to be on your whitelist.

Voice spam is just as bad as email spam. Even worse, since you can't deal with it on YOUR time.

Re:I wish they'd turn this around

[Anonymous Coward]

You might be interested in this site.

Re:I wish they'd turn this around

[Sir Runcible Spoon]

You should call your telco and get the caller's number blocked :-)

Re:I wish they'd turn this around

[FroMan]

Mozilla gives me an "unknown certificate authority" warning here? Any reason for that?

Re:I wish they'd turn this around

[thedillybar]

Okay, so they don't deserve to be on your whitelist. How is that their problem?

If you don't want them calling you, it's YOUR responsibility to setup your own filter (somehow). Don't blame them just because they've figured it out and you haven't.

They're not going to bitch if you filter their calls. It's a problem for YOU to fix!

Re:I wish they'd turn this around

[terrab0t]

Although you really can't auto-filter incoming calls, and they ARE far more annoying than email SPAM, a lot of people waste valuable time and concentration by actually responding to the phone spammer rather than just putting the phone down. Don't give a phone spammer any more attention than you give an email before you hit "delete".

If you aren't expecting any calls, you can also say "Hang on a sec I'll be right back" and then put the phone down leaving it off the hook. This will at least waste some of their time.

huh ?

[minaguib]

So I, random customer or investor X, wish to contact AT&T by email, and I can't becasue my ISP's mailserver is not on AT&T's allow list ?

Sounds like the cure is worse than the problem. Why have a mailserver at all then ?

Re:huh ?

[endeitzslash]

Outgoing.

Re:huh ?

[ComputerSlicer23]

It sure doesn't sound that way. They say you won't be able to send e-mail to ATT.com.

What AT&T is asking is for you to help AT&T to restrict incoming mail to just our known and trusted sources (e.g., business partners, clients and customers). Therefore, we need to know which IP address(es) are used by your outbound e-mail service so we can selectively permit them. Please send this information to the following e-mail address (rm-antiattspam@ems.att.com).

I'd think it was cool if they said, look nothing on our mail server is going out over port 23 unless you register with us.

Kirby

Re:huh ?

[SimGuy]

For reference, port 23 is telnet. SMTP is port 25.

Re:huh ?

[ComputerSlicer23]

Yeah, I'm a tard. I screw that up all the time. They shouldn't let you telnet, or SMTP off their network.

Kirby

Re:huh ?

[Sir Runcible Spoon]

So in summary:

Please email us with the IP of your mail server. Until you do so, you will not be able to send us email.

Isn't there a slight catch here?

Re:I don't care

[scrote-ma-hote]

Until they also ask AT&T to whitelist them, spammers work on sheer volume, and could simply ask to be whitelisted en masse. It will either have to be automated and they win, or they'll flood the network with requests and screw it up for everyone else who tries to white list.

Personally, I can't see this working very well.

Somehow ...

[RWarrior(fobw)]

... this doesn't surprise me.

On the other hand, there are other approaches just as destructive.

I run an outbound SMTP server for my own personal use, in part because my ISP's SMTP server sucks.

At times, it could take 30 or more minutes to relay an email to myself.

One of the problems with this is that apparently I got listed on some kind of dial-up user block list, and my mother's ISP blocks those users from sending to its users.

The downside is that my mother's ISP also blocks my ISP's SMTP server.

Isn't that useful.

Re:Somehow ...

[Rick the Red]

You must be a spammer. That's the ONLY way your SMTP server could get blacklisted. Oh, and your ISP must harbor spammers, too, otherwise there's NO WAY they could be on some blacklist by mistake. OH, NO, the spam vigilanties NEVER make mistakes and blacklist an innocent party. NEVER.

Really, never. Just ask them.

Re:Somehow ...

[mackstann]

You must be a spammer. That's the ONLY way your SMTP server could get blacklisted.

No it's not. I run a mail server on my home cable line, and I once got a message saying that I was blacklisted - the reason cited was that it was a residential broadband address, that shouldn't be sending mail. I told Postfix to use my ISP's mail server as a relay for outgoing mail, and voila, no more problems.

Re:Somehow ...

[CerebusUS]

Slashdot really needs a tag

Re:Somehow ...

[mikiN]

Well, congratulations! You've just used it

Re:Somehow ...

[brianosaurus]

No he didn't. He just said there should be one.

(how long can we keep this going?)

Re:Somehow ...

[rf0]

You an just get a remote server and setup SMTP-AUTH or POP before STMP

Rus

Re:Somehow ...

[Agent R]

Chater is on several blocklists I'm afraid. Due to the lack of response regarding complaints of spam being relayed through dozens of trojaned/open proxies on Chater, several ISPs had to take their own action towards stopping this.

Unfortunately the regular users get stuck in the middle of this.

Re:Somehow ...

[mackstann]

My fault for posting before waking up :P (people always make excuses for posting dumb stuff, but it's the truth, I swear ;)

Re:Somehow ...

[Erik Hensema]

Both charter and rr are MAJOR sources of spam, so I'm not suprised.

The amount of spam coming out of rr.com is about equal to the amount of spam coming out of korea. At least for me it is. Charter isn't as bad, but it's a major source too.

Re:Somehow ...

[DuSTman31]

Carefully used, italics will do the job.

eg: Wow! that post was just so insightful.

Re:Somehow ...

[AKnightCowboy]

The amount of spam coming out of rr.com is about equal to the amount of spam coming out of korea. At least for me it is. Charter isn't as bad, but it's a major source too.

The trouble with spam is, we're all complaining about it, but most of the time it isn't illegal! Until spam is illegal than blocking it through technical means and blocking IP address ranges carpet-bomb style to try to prevent it hurts legitimate users more than it hurts the spammers. The spammers will just be moved by their spam-friendly ISP to an unblocked range and resume their activity while leaving a scorched earth of address space behind them. That's the problem with all these god damn blacklists, especially ones like SPEWS who actively seek to punish everyone getting service from an ISP for the sake of hurting a couple of people.

Re:Somehow ...

[Cyno01]

Oh yeah, cuz thatd be a real useful tag...

Re:Somehow ...

[Russ Nelson]

Why do you bring the subject up? Was that posting sarcasm or something?
-russ

Re:Somehow ...

[CerebusUS]

Nono, but the one above it was...

Unless your posting was sarcastic, too.

Where's that damned tag?

Re:Somehow ...

[Rick the Red]

What, so now the blacklisters are enforcing your ISP's Terms of Service? Does your ISP pay them for that, or what?

Seriously, this sucks. All I want from my ISP is an IP address; I'll register a domain and run my own servers, thank you very much. Of course, that's not what I get. I'm not allowed to run my own servers. Well, that's crappy, but that's between me and my ISP -- the blacklisters are once again sticking their noses in where they're not wanted.

Re:Somehow ...

[Anonymous Coward]

Good blacklists post evidence, and leave the decision to the receiver. If you want a reasonably conservative filter, I recommend using the Spamhaus SBL blacklist or shell out for Brightmail.

Re:Somehow ...

[eaolson]

The trouble with spam is, we're all complaining about it, but most of the time it isn't illegal! Until spam is illegal than blocking it through technical means and blocking IP address ranges carpet-bomb style to try to prevent it hurts legitimate users more than it hurts the spammers.

Whether or not spam is legal is not relevant. Blocking mail isn't illegal.

The spammers will just be moved by their spam-friendly ISP to an unblocked range

Yes, and that's what blocklists like SPEWS are for. If you're using a spam-friendly ISP, you shouldn't get to send mail to me. You make it sound like the spammer here is entirely at fault, and the spam-friendly ISP is somehow innocent. In this hypothetical situation, they chose to take a known spammer and assist them. Not kick them off their network once they found them, but help them spam.

That's the problem with all these god damn blacklists, especially ones like SPEWS who actively seek to punish everyone getting service from an ISP for the sake of hurting a couple of people.

SPEWS seeks to punish no one. SPEWS lists IP addresses of spam-friendly ISPs, in order to quarantine them. Any email coming from such an ISP has a higher-than-average probablity of being spam, and therefore some people may choose to block it. Once the spammer is gone, the SPEWS listing goes away.

It's exactly the same as a boycott. You may not choose to do business with some company because of some less-than-ethical business practice they use; SPEWS allows one to identify less-than-ethical ISPs and avoid accepting mail (er, spam) from them.

Re:Somehow ...

[mackstann]

They're not doing enforcement for ISPs, they're doing what they're supposed to do - identifying likely spammers.

Re:Somehow ...

[Rick the Red]

"identifying likely spammers" is not their job. Of course, identifiying actual spammers also is not their job (that's why they're vigilanties), but at least that's an argueably honorable activity. They go too far when they cross over into this "future crime" crap. Being stuck with Road Runner or Comcast or some other clueless corporate giant as your ISP does not make you a spammer, nor does it make you a "likely spammer."

Now, if your computer is hijacked and turned into a spamming zombie, that's different -- but in all likelyhood your PC will be using your ISP's mail server to do the spammer's bidding, so this "likely spammer" arguement fails again.

Fucking vigilanties.

Huh?

[Aurix]

This can't be right... Most businesses have no idea what an IP address is, let alone the IP addresses of people who send them email... It sounds like an utterly stupid plan. What's to stop spammers sending them IP addresses of their mail sending boxes or open relays?

Re:Huh?

[Anonymous Coward]

I don't think an IP-address would be enough. Along with the IP-address, they would have to provide a company name and contact person. So, when Mr. spammer spams the next time, they know exactly who to beat up.

Re:Huh?

[Evilive]

Did you even read the link to the email that AT&T sent out?
"What AT&T is asking is for you to help AT&T to restrict incoming mail to just our known and trusted sources (e.g., business partners, clients and customers)....If you need assistance determining what these IP addresses are, please contact your company's administrative e-mail server support / network administration personnel." (emphasis mine).

Re:Huh?

[Anonymous Coward]

This was sent to DNS administrators, by invitation only. I got the mail as well.

Hrm

[autopr0n]

Hopefully RMX will get off the ground soon, so we can all do this automaticaly.

two wrongs do not make a right

[nomad63]

spam is bad and wrong.

but asking everyone to white-list their mail servers is even more wrong.

Can't I send an email to my friends working at AT&T using my yahoo mail account because it is widely used by spammers ? Or god forbid hotmail ?

Looks like s**t-for-brains was on duty at the giant telco again.

Wondering how long this grand-idea is going to last.

Re:two wrongs do not make a right

[Anonymous Coward]

yahoo and hotmail are not "widely used by spammers". Did You Know that spam email almost always has a false From: field? So that spam you "got" from 26sga7a@yahoo.com has absolutely nothing to do with yahoo. Try having a look through the headers to find out where it really came from.

*hint: Make sure you ignore the faked initial headers the spammers put in. They are not hard to spot usually.

Re:two wrongs do not make a right

[stray]

yo

i don't think either yahoo mail or hotmail are widely used by spammers to actually *send* e-mail.. rather we just see forged reply-addresses from these services, or even existing reply-drop-boxes.

i guess it wouldn't harm their plan too much to add yahoo's or hotmail's outgoing mailservers to their whitelist.

or did i get that wrong?

They should've go one step further

[apankrat]

They should've gone one step further - accept only authenticated (TLS'ed) SMTP
connections and manage whitelisted certificates instead of IP addresses. This would require
gradual implementation and will take time longer to setup, but once deployed the management
would involve significantly less headache than with IP whitelists.

Five emails

[poptones]

That's how many "spams" I've received in the last three months. And three of them came just today because two days ago I stupidly obliterated my mozilla profile and the (few) mail rules I had set up were lost.

I wonder how the people on AT&T's ISP networks are going to feel about not being able to communicate with mom and dad in Singapore? And all those folks (or those few folks, I suppose, depending on who you hang with) running personal SMTP services from their homes for the added privacy it buys them.

Yes, there's a lot of trash spam out there. It's NOT impossible to stop, but solutions like this one are not going to substantially help. If AT&T closes off its mail network to the world outside, those broadband customers running open proxies just become that much more valuable - then ATs own customers become the conduit of the spam they are trying to squash. There are thousands of "questionable" usenet posts that originate from roadrunner and AT&T and pacbell and earthlink usenet servers that are proxied there through their own broadband customers. Even locking those customers down to port 80 access won't stop trojans and backdoors, so logically I guess this is just the first step to AT&T closing off its network from the internet entirely?

Maybe they'll just firewall all their customers in and dish out the DMCA approved web pages through proxy farms... that'll teach those evil spammers!

Re:Five emails

[mgarriss]

I feel you pain.

They're just trying to sell the "no spam with our service" line better the other giants I'm afraid.

Re:Five emails

[c4ffeine]

What I find amazing is that I practically never get spam at the account I use for /.(by the way, it IS legitimate). Actually, I ge 2-3 a day total, and my spam filter (default yahoo filter) catches most of them. I've heard that a lot of spiders crawl slashdot... why haven't I been smapped to death?

Re:Five emails

[poptones]

That was kinda my point as well. I have a subdomain and I use a different email address for each service - ie slashdot has "slashdot@" etc. About the only company that sends me spam is LA Times, and I tolerate that only because they have good hollywood coverage abd their spam policy is "if you read ourt site we are gonna send you spam." Of course, since the address they send to is "latimes@" they're right easy to killfile.

I think of spam the way I think of pornography or any other offensive speech: if you don't like it, don't fucking listen. But don't infringe on other's rights to expression. Yes, much of what spammers do is illegal - but every single spam is sent representing someone who wants money. No spammers are going to send out 100,000 emails hyping penis enlargment pills out of the goodness of their hearts. So hold the people making the money responsible for the actions of the people they contract to represent them, and you got it nailed. Meanwhle, any ISP gateway that decides to take on responsibilities that should be left to its customers should well be prosecuted when they fail in those responsibilities - ie when my eight year old gets porn spam in her mailbox, someone's heads should hit the basket at my ISP. It's a precedent that hasn't yet been set, but damn well should be; ISPs have no business taking upon themselves the role of censor.

Re:Five emails

[Anonymous Coward]

Wait, you set up spam filter rules for FIVE spam e-mails per month? Isn't that overkill? And how did the spammers know that you lost your filter rules?

Re:Five emails

[oakbox]

To the parent, let me say that I get about 100 spam messages a day. If you aren't feeling the pain, good for you. Some of us ARE.

someone's heads should hit the basket at my ISP. It's a precedent that hasn't yet been set, but damn well should be; ISPs have no business taking upon themselves the role of censor.

Are you saying that an ISP should never look at your mail AND be held accountable for the contents of that mail?

I think of spam the way I think of pornography or any other offensive speech: if you don't like it, don't fucking listen.

I agree right up to the point where the offensive speech is blaring at me from a bullhorn in my living room. If there were one or two innocuous messages a week, I could simply not 'fucking listen'. This isn't one or two messages a week. This is a mountain that even POPfile has trouble staying on top of. Spam is not free speech. Spam is advertising. Advertising is not covered under the first amendment, there are rules for commercial speech that are separate from private speech. -Oakbox

Re:Five emails

[poptones]

Spam is not free speech. Spam is advertising. Advertising is not covered under the first amendment, there are rules for commercial speech that are separate from private speech.

And, as I already pointed out (and as we all knew anyway) there are already LAWS regarding the matter. It is not the responsibility of the ISP to determine for me what mail I should receive and what I should not. And, if they should decide to take upon themselves that responsibility without my behest, they still must be held accountable when they fail it.

Re:Five emails

[silentbozo]

About a year ago I was hitting 100 spam messages per day. That's when I started getting serious about using bayesian rules with SA (I already had SpamAssassin installed from when I was getting about 30-40 spams a day.) Today I get over 250-300 pieces of spam a day, with a leakage rate of anywhere from 5 to 20 messages that actually land in my mailbox, depending on what new tactic the spammers are trying to avoid SA rules.

Just wait long enough and you'll get more than your fair share too...

Re:Five emails

[AKnightCowboy]

I think of spam the way I think of pornography or any other offensive speech: if you don't like it, don't fucking listen. But don't infringe on other's rights to expression. Yes, much of what spammers do is illegal - but every single spam is sent representing someone who wants money.

Would you have a problem if I would instead send hard-core pornography, penis pill advertisements, and credit schemes directly to your children via snail-mail instead of over e-mail? "Hey look daddy, this postcard is shaped like a big penis and says I can add 3" of girth and 4" of length within a month... do I have a penis?" I'd probably go to fscking jail if I did through postal mail what spammers send through e-mail. It's outright fraud. Prosecute them based on the fraud they send though, not the act of sending it.

Re:Five emails

[Brandon Hume]

This might come as a shock, but the reason an ISP would start filtering spam IS BECAUSE THEIR CUSTOMERS DEMAND IT.

An business is not a charity, they don't do anything out of kindness or some sense of community. They do things because they think they can make money, or prevent the loss of money.

I manage mail servers at a university. I have implemented spam filtering at said university, because the *users* were becoming so completely innundated with spam that they were giving up use of their accounts completely. Others were filing complaints with the university itself because of the explicit nature of some of the porn spam.

Normal Slashdot replies do not apply here. The users don't know where the spam is coming from; all they know is that the university's equipment is delivering it to them, and they want it to stop.

"Throw away" accounts are not a useful suggestion. These email accounts are the official point of correspondance for students/staff/faculty. They cannot give them up.

So, for the sake of everyone's sanity, I spam filter. I don't block the mail, but I mark it. Because the user wants it, and they need it.
(And let me tell you how very, very tempting it is to just flat-out block such email, especially when I'm seeing our primary outgoing relays melting down under the weight of unnumerable thousands of bounced spam.)

And please, don't be so quick to wave around the fact that there are laws. Yes, there are. Please, try to apply them! Get the officials involved! Let me know how well it works for you.

Spammers consider themselves above the law.

Re:Five emails

[schon]

I think of spam the way I think of pornography or any other offensive speech: if you don't like it, don't fucking listen. But don't infringe on other's rights to expression.

Spam is not speech of any kind. It's harrassment, and it's theft.

Spam filtering does not infringe on _ANYONE'S_ right to 'expression' - they are perfectly free to express themselves in any way they want, but they are not allowed to force anyone else to pay for their right to 'express' themselves.

ISPs have no business taking upon themselves the role of censor.

As an ISP, I am not 'censoring' anything - I am protecting my bandwidth from people who are stealing from me.

Re:Five emails

[tbuskey]

A business with thousands of users each getting 5 spams each is alot of mail. That all has to come through the mail gateway which needs to be beefier as a result. Client side solutions won't reduce that cost.

Re:Five emails

[Anonymous Coward]

any ISP gateway that decides to take on responsibilities that should be left to its customers should well be prosecuted when they fail in those responsibilities - ie when my eight year old gets porn spam in her mailbox, someone's heads should hit the basket at my ISP.

OK, so what happens when YOU implement filtering, and "fail" in that responsibility? Should you be prosecuted for corruption of a minor? If not, why should an ISP be held responsible when you are not?

Oh yeah, it's because you're a hypocrite.

Re:Five emails

[pmz]

Spam is not free speech. Spam is advertising.

It is probably more accurate to say that spam is theft or, at best, trespassing.

Re:Five emails

[poptones]

As an ISP, I am not 'censoring' anything - I am protecting my bandwidth from people who are stealing from me.

Do you not have any customers? An ISP with no customers surely cannot stay in business very long.

If you have customers, it is your customers who are paying for that bandwidth. Now, perhaps your customers are asking you to decide for them what they see an what they do not - and that's fine. But whether your customers demand it or you just take that responsibility upon yourself without question, you are still putting yourself in the role of gatekeeper. Ergo, when you fail in that role - when someone's 8 year old opens up her email and finds an animation of some turgid member spewing jism all over some generic porn starlet - that means you have failed in your elected role as gatekeeper of all that is blessed. And that opens you up to liability.

The reason ISPs fight against this in courts is because they DO NOT want that liability. And by taking upon themselves this liability in the name of "spam" they are playing right into the hands of those who wish to break every foundation of the internet - that is, the corporations - to whom unlimited personal communications represents a great threat.

Users don't know what to do with this . . .

[actappan]

I'm oversee an it department. While we're lucky enough to have a highly technical user base there are still users that need a little help. And some of them will have to write at&t.

"Solutions" like this do little to stem the tide of spam, they only shift the burden to others. Now, in order to ensure that my users can send email to the customers and contacts they need at att&t, I have to keep them up to date with our whereabouts on the net?

Earlier this year we had to deal with a spat of denied messages cause when a number of large organizations blocked our entire address block because they believed it was a DSL block. This was the only reason. Not that spam originated from any of these addresses,

The only way to stop spam is to stop the spammers. The only way to stop the spammers is to stop those that pay them or otherwise make money trough the spam.

Re:Users don't know what to do with this . . .

[Anonymous Coward]

I'm oversee an it department.

I can tell - you can't spell for shit.

Re:Users don't know what to do with this . . .

[Anonymous Coward]

You need to learn the difference between spelling and grammar dipshit.

Re:Users don't know what to do with this . . .

[zerocool^]

At Netmar, we have an ongoing debate about whether or not to implement a specific rule in sendmail's config file.

It takes the hostname of the server that the email was received from, and checks to make sure that the hostname has a valid reverse DNS zone configured.

This honestly stops a lot of spam. Exceptions being exchange servers set to world relay, but the amount of spam is drastically cut down.

What sucks is all the little mom and pop ISP's and offices with their own internet who don't know how to configure a reverse zone. It gets a lot of false posatives.

We still haven't found a solution. And we've reached the 50% mark for spam.

~Will

Re:Users don't know what to do with this . . .

[stray]

hi

a rather big cable ISP in switzerland did this a couple of weeks ago.

it caused a bit of a ripple through the hostmaster-community, but it seems after a couple of days, almost everyone managed to fix their reverse entries... now, if more big isp's would do it, making them unpopular for a day within the rest of the admin community, it probably would lead to better maintained PTRs and then everyone could go and implement that :-)

i got hit by the change too, because at a client's site we use two outgoing mail servers (more or less redundant) that both claim to be "smtp.clientsname.com", but obviously one of them isn't really.

anyway, i think it could well become a standard setup to check forward vs reverse resolution.

Re:Users don't know what to do with this . . .

[Anonymous Coward]

Hey Mud-For-Brains:

Learn:

1) English
2) to spell
3) to type

Then welcome back.

Re:Users don't know what to do with this . . .

[Anonymous Coward]

Hmmm... what *is* the difference between a spelling dipshit and a grammar dipshit?

Oh yes, grammar dipshits don't use commas.

Re:Users don't know what to do with this . . .

[AllUsernamesAreGone]

"The only way to stop spam is to stop the spammers. The only way to stop the spammers is to stop those that pay them or otherwise make money trough the spam."

Actually, I can think of several inventive and above all painful (for spammers and friends) methods to stop them. Permanently. The problem is that it requires you to catch the spammers and transfer them to a Secure Processing Facility..

Re:Users don't know what to do with this . . .

[GigsVT]

Why don't you all run spamassassin?

I know your custom filters have blocked my Bugtraq subscription many many times in the past.

Re:Users don't know what to do with this . . .

[RedHat Rocky]

Any FILTERING is a non-solution, the spam still hits the mail server, still uses bandwidth and still takes up space in the user's mailspool. And the user still has to check the spam bucket now and again for false positives.

Now if spamassassin really worked like its name...:)

Re:Users don't know what to do with this . . .

[Koatdus]

It takes the hostname of the server that the email was received from, and checks to make sure that the hostname has a valid reverse DNS zone configured.

I had a similar rule set up on our email server for a couple of weeks. Unfortunatly many of our customers could not seem to get their reverse DNS records set up right. Sometimes they would reverse and sometimes they would not and I would bounce their mail.(COME ON FOLKS ITS NOT FRICKEN ROCKET SCIENCE!) After several user complaints and a couple of frustrating weeks dealing with these InDUHviduals I finally took the rule off. Yes, they are nitwits, but they are also customers and we need to exchage email with them.

Now, excuse me while I go order some generic vicoden on line......... where did I put my credit card?

Re:Users don't know what to do with this . . .

[Anonymous Coward]

What sucks is all the little mom and pop ISP's and offices with their own internet who don't know how to configure a reverse zone. It gets a lot of false posatives.

What sucks even worse is large scale ISP's, like the one I worked for (Conversent) who don't know how to configure a reverse zone. This resulted in a LOT of customer complaints...and the worse part was, 98% of the techs didn't know how to figure out it was a reverse zone problem, so the issues would go unsolved for months at a time.

Re:Users don't know what to do with this . . .

[pipingguy]

I have to wonder if a million man (anti) spam march might work (in the town of a known spammer).

Maybe they'd move on to owning a nightclub or something.

Why not?

[autopr0n]

I don't think spammers care that much about getting AT&T employees while they are at work to try to hack this en masse.

Re:Why not?

[Dimensio]

Spammers seek to send mail. They also seek to route around any means to filter their mail. They don't care that their mail is unwanted or going to addresses that have no chance of being read by an interested party.

Spammers are incredibly stupid. They don't understand that "barriers on our inbox" means that their junk e-mail isn't wanted.

Re:Why not?

[Anonymous Coward]

The spammers aren't that stupid. They know full well that the response rate on the spam really isn't worth it, a few well publicized stories aside.

The people sending spam aren't ripping of the recipients of spam. They are ripping off the people who paid them to send it. They need to have a steady supply of suckers willing to pay them $1,000 to send spam that will get $800 in orders. To do that, they need the public illusion that spam works. They don't really need spam to work.

Re:Why not?

[eric76]

I've been told that some spammers-for-hire get paid by the response.

If you complain or try to "unsubscribe", that counts as a response and increases their fee.

This is just wrong in so many ways...

[Fnkmaster]

So if each big company decides to do this, they will all end up with slightly different lists of whitelisted SMTP servers. The Internet will degenerate into a fragmented, unreliable system where you never know who will receive your email. In fact, you'll be strong armed into using particular ISPs and using email addresses like shithead@att.net in order to get your email through to anybody. The Internet is thereby de-democratized and rolled back 10 years.

This is really a lose-lose situation and it's disappointing to see this. If there's going to be a concept of trusted mail servers, we need to use a technological solution that allows easy, open, and transferable trusted participation in the network - maybe for once an application where a web-of-trust would actually function. Even the current system with centralized, subscription-based blackhole lists is far better - at least you only have 5-10 different places to go if you end up on somebody's shit list.

In the dark world of the future you'll have to fight your way through bureaucracy and stupid sysadmins (and yes, the vast majority of sysadmins are fucking idiots, though I know that's not a popular opinion around here) for each and every company, organization or domain you want to send email to. That sounds like an infeasible, unmaintainable system to me.

Personally, I find the spam filtering on my fastmail (www.fastmail.fm) account to be incredibly reliable and effective, and I've found that if I bounce back every piece of true spam I get, over a few weeks or months, my rate of incoming spam seems to decrease substantially. We can do better, and we will beat the spammers, but we don't need to throw out the baby with the bathwater.

Re:This is just wrong in so many ways...

[bigberk]

So if each big company decides to do this, they will all end up with slightly different lists of whitelisted SMTP servers. The Internet will degenerate into a fragmented, unreliable system where you never know who will receive your email. In fact, you'll be strong armed into using particular ISPs and using email addresses like shithead@att.net in order to get your email through to anybody. The Internet is thereby de-democratized and rolled back 10 years.

Spot on, mod this guy up. He hit the nail on the head.

I've found that if I bounce back every piece of true spam I get, over a few weeks or months, my rate of incoming spam seems to decrease substantially

Except for this bit. Never try to bounce spam, it just goes to the wrong destination and further pollutes the Internet.

Re:This is just wrong in so many ways...

[Anonymous Coward]

NO! You fucking retards, try reading the goddamn article before karma whoring, it's for AT&T Business customers, this is like GiantCorp, who owns Mail.GiantCorp.com, all outgoing mail (on AT&T's network) must be whitelisted. This just prevents spammers from using AT&T as their ISP. Woo! and that was just from reading the comments, dipshits.

Re:This is just wrong in so many ways...

[Anonymous Coward]

Really? Then why can't I do any of the following successfully?

telnet almsi1.att.com 25
telnet ckmsi1.att.com 25
telnet ckmsi2.att.com 25
telnet almsi2.att.com 25
telnet kcmsi2.att.com 25
telnet kcmsi1.att.com 25

Re:This is just wrong in so many ways...

[eggnet]

Mod this guy up.

Re:This is just wrong in so many ways...

[eggnet]

shit... I can't either, and I run a medium sized ISP... tried connecting directly from my mail server too. For those less technically savvy, the parent listed the MX records for att.com.

Re:This is just wrong in so many ways...

[jred]

Slashdotted? :)

Re:This is just wrong in so many ways...

[statusbar]

The internet's email is already an unreliable system. A friend on earthlink has an open-source project and a list of 500 people who want to know about new updates. He sent one email to all of them and earthlink suspended his account. Another email server blocked a real email, marking it as spam just because the subject line was similiar to a known worm's typical subject line - even without an attachment. Luckily the server was "mis-configured" and actually DID send the bounce - otherwise I would not have known that the email never got there. And it is just going to get worse unless smtp servers start making a real trust network.

--jeff++

Re:This is just wrong in so many ways...

[haggar]

and using email addresses like shithead@att.net in order to get your email through to anybody

How would that circumvent AT&Ts policy?

Re:This is just wrong in so many ways...

[Chmarr]

I think you're mistaken. When he says 'bounce spam' he doesn't mean composing a new message and sending it to the 'envelope from'.

He means ensuring the spam message gets a 550 code, or something similiar, rather than 'accepting' it and trashing it later.

Re:This is just wrong in so many ways...

[whereiswaldo]

The Internet is thereby de-democratized and rolled back 10 years.

I would love to see the Internet rolled back 10 years (or say, 6-7), aside from the bandwidth losses. It was a much more free system then.

Re:This is just wrong in so many ways...

[Halo1]

Maybe because their incoming mailservers are:

att.net. 6H IN MX 5 gateway2.att.net. att.net. 6H IN MX 5 gateway1.att.net.

Or are you a client of AT&T that must send his mail through their outgoing mailservers?

Re:This is just wrong in so many ways...

[lardi]

Working as the sysadmin for our company I would like to tell you ablout the latest UCE complaint that has hit my inbox.. We run a community website that sends out newsletters to our customers. This newsletter is sent out if the users does not uncheck the box "Yes I want too recieve newsletter......bla bla" A couble of weeks ago mail from our server bounced from AOL due to AOL customer UCE complaints. As it turns out one single UCE complaint from an AOL customer will get the ip of the sending smtp server banned for a period of 12 hours, but if the server has a PTR record the server will need to generate a lot more complaints before being blocked. Apart from the time i spent resolving this issue, not counting waiting to get thru to the postmaster group, this easy step would weed out at least a large portion of the spam. Everybody agrees not to recieve mail from domains without a valid PTR record ? :)

Re:This is just wrong in so many ways...

[AKnightCowboy]

In the dark world of the future you'll have to fight your way through bureaucracy and stupid sysadmins (and yes, the vast majority of sysadmins are fucking idiots, though I know that's not a popular opinion around here) for each and every company, organization or domain you want to send email to. That sounds like an infeasible, unmaintainable system to me.

We're probably all over-reacting a bit since the first time the CEO of AT&T misses an important e-mail message because his ISP blocks the incoming mail, this will go away. I would say by 2pm on Friday at the latest. This is one of those idiotic things to do on the scale of Verisign's Sitefinder "service".

Re:This is just wrong in so many ways...

[shri]

Did you have to deal with X.400 gateways, UUCP connections? Incompatibility between Compuserve and the rest of the world? 10 years ago was 1993 ....

Re:This is just wrong in so many ways...

[lseltzer]

>>we need to use a technological solution that allows easy, open, and transferable trusted participation in the network - maybe for once an application where a web-of-trust would actually function

If it's easy and open it will be abused by spammers. In fact, as others have pointed out, just because a server is on the whitelist doesn't mean that all other mail is on a blacklist. I dealt with this recently in a column. There might also be a blacklist, but all other mail should go into a queue from which it is given greater scrutiny and aggressive filtering. By whitelisting the servers of those with important relationships with the company they greatly decrease the possibility of false positives on any of that mail.

Re:This is just wrong in so many ways...

[bigberk]

I think you're mistaken. When he says 'bounce spam' he doesn't mean composing a new message and sending it to the 'envelope from'. He means ensuring the spam message gets a 550 code, or something similiar, rather than 'accepting' it and trashing it later.

You're mistaken. I use fastmail as well and know that he's referring to the Mail Bounce feature, which is an unfortunate feature in an otherwise perfect mail service. When the user hits that button it basically forges a mailer-daemon error, and bounces it back to the envelope from. Not good practice.

Re:This is just wrong in so many ways...

[Russ Nelson]

It's a great idea; the problem is forgeries, not sending bounces. If you solve the wrong problem, your solution won't make people happy.
-russ

Re:This is just wrong in so many ways...

[graxrmelg]

But doesn't returning a 55x code end up resulting in a bounce message, if the spam is coming through an open relay or otherwise not coming directly from the spammer's software to your server? Now, in that case you might say that it's the open relay's fault that an innocent person gets hit with bounce messages, not yours, but it's still a problem.

Re:This is just wrong in so many ways...

[Fnkmaster]

After reading the article again, I still don't know how you extracted that information from it.
To quote:

What AT&T is asking is for you to help AT&T to restrict incoming mail
to just our known and trusted sources (e.g., business partners, clients
and customers). Therefore, we need to know which IP address(es) are
used by your outbound e-mail service so we can selectively permit them.
Please send this information to the following e-mail address
(rm-antiattspam@ems.att.com).

I suppose this could be read several ways, but everybody else at least seemed to read it the way I did. Maybe you're right, but it certainly doesn't mean we're all fucktards, it means the AT&T people who wrote this email are fucktards.

Re:This is just wrong in so many ways...

[Fnkmaster]

Your theory about bouncing is interesting. I realize that much of the time, headers may be forged, and bounces may go to bad places. On other occasions, that doesn't seem to be the place. However, my (admittedly non-scientific) study showed that if I (A) never opened spam as HTML mail, thereby loading images and the like to confirm email addresses and (B) bounce spam mail back to the source, be it correct, or some unfortunate person who got spoofed (and I do feel for them). The results of my experiment are that I get about 1/10th the volume of spam now that I did a few months ago.

Maybe it's just chance, but I'm going to keep bouncing spam - if it's some poor, unfortunate shlub, he's already been inundated, and his email account has been toasted. But it lowers my spam volume and solves a long term problem for me, which is wasting my time and energy dealing with a huge volume of spam.

Re:This is just wrong in so many ways...

[JuggleGeek]

The Internet will degenerate into a fragmented, unreliable system where you never know who will receive your email.

That's already happened. Filters, blacklists, and human error when sorting real mail from spam already mean that you can't be sure that any given email you send will reach it's destination. In addition, people have a tendency to hide their email address, since making it available in public usually means getting more spam. Spam has already led us to where email is unreliable.

I don't believe that the ATT system as described is likely to work for various reasons. But I do believe that whitelists of trusted sites should be developed. If Spamhaus, for instance, were to create a list of whitelist sites, and share it similar to the blacklists, I would expect that to be quite useful.

Personally, I use whitelisted addresses to make sure that most of the mail I want skips right through the rest of the spam filtering. I might miss a legitimate mail the first time someone contacts me, as their mail is mixed in with the spam. But normally the first time I receive mail from someone not already whitelisted, their address is added. It saves me a ton of time. It's also a completely different beast from running an ISP and whitelisting IP's.

I've found that if I bounce back every piece of true spam I get, over a few weeks or months, my rate of incoming spam seems to decrease substantially.

I can't imagine why. 90% of the spam I see has fake email addresses in the From and ReplyTo fields. Spammers like to hide. (It seems a bit illogical. They fight to get their name/website/message across to millions of people who don't want it, and at the same time they hide who they are and make it hard to contact them. It's a weird way of thinking about advertising.)

I suspect that by bouncing all of your spam, mostly you just add to the bandwidth and annoy people who's email addresses have been forged in the spam.

Re:This is just wrong in so many ways...

[JuggleGeek]

We run a community website that sends out newsletters to our customers. This newsletter is sent out if the users does not uncheck the box "Yes I want too recieve newsletter......bla bla"

So you're tricking people into signing up, and you're surprised that people complain about you sending spam. You could save yourself some trouble by having them check that box if they want the newsletter. That way, only people who realy want the newsletter get signed up. "OptInByTrickery" isn't a good plan - for an honest business, at least.

Re:This is just wrong in so many ways...

[whereiswaldo]

10 years is farther back than I was introduced to the 'net, but my point was freedom, not ease of use. ;)

Re:This is just wrong in so many ways...

[k12linux]

How long until AT&T customers start getting fed up with not getting e-mails that "everybody else on the list received"? While I'd love to get 0 spam messages/day, I'd quickly jump ship from a company where I couldn't fairly well trust that I'd receive e-mail sent to me.

Re:This is just wrong in so many ways...

[BSDorBSOD]

I think you're mistaken. When he says 'bounce spam' he doesn't mean composing a new message and sending it to the 'envelope from'.

He means ensuring the spam message gets a 550 code, or something similiar, rather than 'accepting' it and trashing it later.

Who's mod'ing this stuff. This is not insightful. Hasn't anybody learned yet that spammers lie! None of the 'from' addresses are likely to be legitimate. So where does the 'bounced' message go? Either to (1) someone who did not send the message or (2) (most likely) a non-existent email address where it is AGAIN bounced wasting additional bandwidth or server resources or (3) (least likely) back to the spammer where it is thrown away. Do you really think spammers take the time to look at bounced messages and throw away 'bad' addresses. No! They want their servers to spend 100 percent of available processing power spewing out their garbage, not processing incoming rejects.

Re:This is just wrong in so many ways...

[Chmarr]

Issuing a 550 will typically generate a bounce message, yes, but it's not YOUR machine generating the bounce message, it's the MTA that's currently talking to YOUR MTA.

If it's the spammer (or, say, a compromised machine) sending to you, then it's likely that no bounce is detected. Instead its POSSIBLE that your name will be removed from a list because the sending MTA thinks that a) the address doesn't work anymore, or b) you're using something like spamcop, making your address 'poison'. (see below)

If it's a open relay talking to you, then the sending MTA will generate a bounce and attempt to send it to the 'envelope from'. This will also likely bounce, and then the message goes to the open relay administrator's mailbox. And that, in turn, should give that admin a real big hint that their server's an open relay.

(I've found that since using spamcop, the number of spams that are sent to me - before the filters - has actually gone down. I suspect that some spammers try to determine which addresses are likely to cause a spamcop notification, and avoid those addresses... pure speculation, but it's the only one that could explain the drop in spams, rather than gain)

Re:This is just wrong in so many ways...

[Chmarr]

If its the spammer talking directly to you, then issuing a 550 gives you at least the chance that the spammer will remove your name from the mailing list as 'non-functioning'.

Additionally. its the quickest way to shut up the sending MTA... otherwise you're reciving all the data unnecessarily.

Re:This is just wrong in so many ways...

[graxrmelg]

The problem I envision is with the times when the envelope FROM address actually exists, so the bounce doesn't bounce. Thus instead of alerting the admin of the open relay, it annoys some innocent third party, much as virus bounces do. It seems to me that that would be a frequent occurrence, but I don't have a solution.

Re:This is just wrong in so many ways...

[BSDorBSOD]

Hi Chmarr. I don't know if you will get this but if you do, here is the answer.

If you are running your own mail server and are not relaying through your upstream ISP, great; bounce messages to your hearts content. Just be aware that nine out of ten bounces will not be going to the spammer and may be going to an innocent third party for whom it will be more spam. And you would then, in essence, be the spammer. This wasted bandwidthand and server resources causing further loss of Internet resources due to spam.

For the remaining one in ten, nine times out of ten the sender's servers will block connections or the message will be quietly thrown away. If you have to relay through an ISP or upstream provider and the spammer's servers are blocked, the message will queue up on the upstream server until it is removed or times out after many days and delivery attempts. The operators of these upstream servers do not like this. I know I don't.

That leaves one in one hundred that actually gets back to the sender. It has been my experience that this one percent (or less) is not spam in the strictest sense of the word. There is legitimate marketing material sent to persons who have an existing business relationship with the sender. Some of these businesses are clueless or evil and do not provide their customers with a way to "opt out" of their mailling lists. This small fraction of the one percent are the ones for whom the 'bouce' might be effective.

Spammers often operating in violation of their ISPs use policies and do not want to lose any time processing returns. They have a finite amount of time before they are discovered and booted off the network. For those professional spammers operating with a nod and a wink from their ISPs, they do not process incoming email because it leaves them vulnerable to outside attacks or bounce floods from DNS or other black lists. They aquire and validate their mailling list using other methods.

Re:This is just wrong in so many ways...

[Chmarr]

Yep, got it :)

I agree with your assessment in part. However, there's an 'extra level'.

9 times out of 10 its the spammers MTAs (or MTAs in the spammers control) that are contacting your local MTA, so... issuing a 550 straight after the RCPT entry will deny the mail AND not cause a 'bounce message' to be generated. (And, has the bonus of closing the connection a lot earlier)

In the times that it's not (ie, spammer sends to MTA, which then forwards to you), the bounce message will go to the sysadmin of the intermediate MTA (Ie, I 550 the message. Intermediate MTA then generates bounce and attempts to contact the enveople sender, which fails) which in turn encourages the intervening MTA administrator to put in similiar anti-spam measures (for example, every filter I put in I also forward to my upstream MTA, so that the blocks appear THERE rather than bounces messages appearing at the intervening MTA)

So... it's not as all bad as you make it out to be.

Re:This is just wrong in so many ways...

[BSDorBSOD]

Hi Chmarr. I agree. When taken out of the context of generating a bounce, issuing a failure code to the connecting MTA does usually drop the connection sooner and eliminate the issues with bounces. However, I have also noted a significant number of spamming MTAs that fail to properly close the session after receiving a failure code. This means that the session must time out before the MTA closes the connection. It has become necessary to firewall some of these jerks off completely.
In the context of the original post which you replied to, we had a subscriber who was forging 'user unknown' bounces to spammers. The results of his efforts have already been covered. He eventually discovered on his own that this was ineffective and move on to other methods. His choice.
Anyway. thanks for the discorse. Spam blocking is a complex subject for which I have not as yet seen a solution. I do not believe legislation will be effective. Years ago when I was getting two or three spams a week, I remember thinking that the lack of a way to control spam would be the achilles heel of the Internet making email all but unusable. Time has not proven me wrong. I await the day the magic bullet is developed. That will be a good day for the Internet.

Re:This is just wrong in so many ways...

[Chmarr]

Well, the client isn't SUPPOSED to drop the connection after receiving a failure code :)

Actually, I don't think there's a code for the server to say "I'm going away now"; the server always waits for the client to drop the connection, or issue a QUIT.

(And, personally, I think the '5c, refundable, to send a mail' idea is the only one that's going to work.)

Go read about mail transfer agents

[csoto]

You send email to your ISP. Your ISP's mailhost is on the list. Your email gets through...

This might be a dumb question.

[DAldredge]

But, if you wish to become an ATT customer, how do you contact them?

I have no wish to phone them so they can get my phone number, which they will use to call me every 5 days trying to get me to switch my ld to att.

Re:This might be a dumb question.

[Anonymous Coward]

1) Get a hotmail account and email them.

2) Did you know that when you sign up for something over the web, chances are good that you won't get past the basic info form without entering a phone number? Or are you one of those paranoid types who enter bogus info for everything, trying to keep under the radar of the man?

Power, brother!

Re:This might be a dumb question.

[zeath]

You could always use a calling card. onesuite is pretty cheap. It's the phone equivalent of a proxy server and does its job just as good. Just hope they don't put you on hold for too long.

Strange how we have legislation for do-not-call lists and laws against automated sales calls, but we still have to resort to personally-enforced whitelisting to avoid spam. Imagine how different this would be handled if AT&T had problems with excessive phone calls and were requesting specific numbers or exchange codes from their customers and agencies to avoid random, recorded telemarketing.

Re:This might be a dumb question.

[Anonymous Coward]

As far as most companies know,

I live at:
123 Candy Lane
Utopia, SC 29208

My e-mail is Noone@nowhere.com
And phone number is 843-555-5555

I say, f#$% the marketing people and their stupid tracking services. The zip code and area code are enough to get my local content if I need it & make sure it passes whatever basic logic thier database has for entering data :-)

Re:This might be a dumb question.

[Natal VC]

The measure is for their business clients who run their own mail servers on the AT&T network. If you want your mail server to keep functioning, send them an email with your IP adres. This doesn't affect all other mail servers on the net, only the ones on their network. It's to stop the spammers which might be using the resources on the AT&T network.

Some much for my mail server

[mgarriss]

A week ago I decided that it would be interesting to setup my own mail server, hell, fun even. Interesting yes, fun no. I started with sendmail and ended up with qmail.

I was so proud of my new server, it was so, well, new. I go to send out a test mail and alas earthlink would not accept it, hmm. Then I sent one to my yahoo account, nope. Hotmail? You guessed it. What's the deal I asked. Googled a bit, found that slashdot discussion (http://yro.slashdot.org/yro/03/04/13/2215207.shtm l?tid=120).

I started to realize that email is no longer a tool of the little guy. I send my mail through my earthlink server which works but now I must watch my volume (no mailing lists hosted here I'm afraid) because of my 'terms-of-service'. Something about being a little guy or something like that.

Now the last barrier is up. I wonder if ATT would put me on their list?

Re:Some much for my mail server

[Anonymous Coward]

Part troll.

Only AOL is doing this.

Re:Some much for my mail server

[Anonymous Coward]

Welcome to the segregated internet. Guess who is the nigger ?

Something like slashdot could never get started today. Malda started slashdot in his dorm room, but today that would violate the terms of service. You need $90 a month (speakeasy or business class Road Runner) to be a real citizen of internet. Random pie in the sky ideas can't simply be tried out for the time in setting them up.

Re:Some much for my mail server

[bigberk]

I started to realize that email is no longer a tool of the little guy. I send my mail through my earthlink server which works but now I must watch my volume (no mailing lists hosted here I'm afraid) because of my 'terms-of-service'. Something about being a little guy or something like that.

I've said it before and I'll say it again. We'll watch the Internet divide among corporate/smallguy lines. All us small guys will still be able to communicate (provided our ISPs don't start filtering TCP packets based on port) amongst ourselves but will have to cross over into corporate territory to reach hotmail, yahoo, etc.

Re:Some much for my mail server

[Anonymous Coward]

Why are you complaining? You are not supposed to relay you dolt! Get another ISP and setup reverse DNS and everything else.

Everything you described is a good thing to protect people from idiots like you that could be relays for spammers.

I can't believe you can't see this through your dumbass post!

Re:Some much for my mail server

[andih8u]

since I run a mail server at home I know that most places won't let you through unless you have RDNS lookup which doesn't point your ip to user-1-22-33-456-local-dsl-ip.com

Which, like someone already said, you usually can't get RDNS mapping from your ISP unless you have the mecha expensive business account.

Blocking on this method seems kinda silly since most of the spammers have ips and hostnames in China and have no problem getting around this protection anyway. At least if you got spam from a user-1-22-33-456-local-dsl-ip.com account it would seem a lot easier to track them down.

Re:Some much for my mail server

[Umrick]

I have to use Earthlink for a dialup at this point. My company also cohosts at a location for email services. Earthlink (pinheads) allow you to fetch email from pop3 servers but NOT send email (they block port 25 excepting to their own).

So for earthlink to send email:
1) Must be on their network (fair enough)
2) Must NOT try to send mail through another smtp server (bogus)
3) The from addy must be a valid account on their system (so no using their smtp servers for work email).

Solution? A shell account with ssh ability. A quick:

sudo ssh -g -C -L 25:servername.com:25 -L 110:servername.com:110 username@servername.com

Point the email servers to be localhost (or the machine ip you ran it on) and email away. The -C compression also makes a big difference if you're over slow dialups.

Re:Some much for my mail server

[Dax Kelson]

Earthlink is not alone in doing this. I travel alot and I've found many hotel broadband companies do the same thing.

My solution was to have my mail server listen TCP 2525 in addition to the regular 25.

On my laptop, I just set my outbound mailserver to mail.gurulabs.com:2525

I use SMTPAuth+StartTLS configured in Postfix and in my mail client (Evolution) for secure, authenticated relaying no matter what IP address my laptop has.

Dax Kelson

Re:Some much for my mail server

[grahammm]

Try a different ISP. For my home DSL line I have full control of both the forward and reverse DNS via the ISP's web interface. Using that same interface I could, if I wanted to, set the DNS server to anywhere I want, including delegating the reverse DNS, but I am quite happy for the ISP to host the DNS for me.

Re:Some much for my mail server

[Anonymous Coward]

I've said it before and I'll say it again. We'll watch the Internet divide among corporate/smallguy lines. All us small guys will still be able to communicate (provided our ISPs don't start filtering TCP packets based on port) amongst ourselves but will have to cross over into corporate territory to reach hotmail, yahoo, etc.

Well, we've got to start somewhere. Maybe the little guys should just migrate to a new network encapsulated on top of the old one. Setup a bunch of peer-to-peer ipsec connections and do whatever we want. Until our ISPs block IP protocol 50 as not part of their terms of service.

Re:Some much for my mail server

[Eunuchswear]

That should be 587, not 2525.

(Or 465 for broken clients that start TLS without
doing a STARTTLS command).

Re:Some much for my mail server

[Cyno01]

Dont put "Penis Enlargment" in the subject and your e-mails wont get blocked. :p

Re:Some much for my mail server

[SIGBUS]

The other way to deal with port 25 blocking is to make sure your SMTP server supports TLS and SMTP AUTH.

You will then need to configure your client to send a login and password for authentication. The connections are encrypted, as a bonus. The server can allow authenticated users to relay from anywhere, without hacks like POP3-before-SMTP.

It's also not a bad idea to run POP3 over SSL for your inbound mail.

Re:Some much for my mail server

[Anonymous Coward]

You can do it from home. I've been doing it for three years on comcast/attbi/whoever the hell it was before that. I'm still waiting for my cease and desist letter. Honestly most ISP's seem to be of the 'We tell you you cant do anything so we don't have to support it. But if you can do it intelligently without causing us to receive complaints and don't bother us when you cannot figure out how to make it work, then you can do it.' type. Which is fine. Because who wants to be supporting a bunch of no talent home grown 'server admins'

Anyway for some domains you do need to do something like: aol.com smtp:mail.attbi.com in your transport/transport.db file in postfix. I'm sure qmail has a similar mechanism. Just goes through attbi mail server and then over to aol. There are other domains that you need to do this for as well. netscape.net ssmb.com (i forget what this even is...) citigroup.com and rr.com

As for ISP blocking port 25 even that can be worked around. For $40.00 a month no-ip.com will do a mail reflector for your domain. They will listen on 25 and pass to whatever port you say on your system. Or you can try for free the tricks people listed here and see what success you get.

Like I said with the exception of having to set up a transport file for ~6 domains I have had no problem hosting DNS, HTTP, SMTP, secure POP3 just fine for quite some time on a home user broadband connection.

Re:Some much for my mail server

[mgarriss]

I also have no problems with DNS, HTTP, SMTP, secure POP3 other then the fact that my IP is listed as 'dynamic' (it's static) so earthlink and the others I mentioned in the post won't take mail from me. Thus I relay it through earthlink's server. Not a prob excpect that they could pull my plug legally if the traffic is too high.

Re:Some much for my mail server

[Anonymous Coward]

Hehehehe

Re:Some much for my mail server

[RedHat Rocky]

Perhaps you missed the point. By using a non-privledged port, it is unlikely his mail server will EVER be blocked by an ISP. And the way this is configured, the port number is arbitary.

Re:Some much for my mail server

[scrytch]

> I started to realize that email is no longer a tool of the little guy.

You are correct. Spam killed it. Fortunately there's HTTP, IRC, and legions of file sharing networks to get your messages across.

Note that most ISP's won't screw around with port 587 connections, leaving you to do whatever you "little guys" do with endpoint mail servers.

Re:Some much for my mail server

[bruthasj]

Just use a Smart Relay. I'd rather the inconvenience be upon those setting up email servers than on me getting the associated emails, thanks. Who is to say that you patch and setup your mail correctly as not to allow spammers to relay through you?

Re:Some much for my mail server

[mgarriss]

actually i checked my server with a outside service, i'm not a relay acording the them.

I do use smart relay through earthlinks server but i still have to watch my usage.

Re:Some much for my mail server

[elemental23]

So for earthlink to send email:

3) The from addy must be a valid account on their system (so no using their smtp servers for work email).

Number 3 is incorrect. You can use any From: address you want when sending mail through Earthlink's SMTP servers. The only requirement is that the domain in your return address actually exists. I send mail out via Earthlink on a daily basis with From: addresses belonging to a couple different networks and have never had a problem.

Re:Some much for my mail server

[elemental23]

I send my mail through my earthlink server which works but now I must watch my volume (no mailing lists hosted here I'm afraid) because of my 'terms-of-service'.

Earthlink has no restrictions on the volume of outgoing mail you can send through their SMTP servers. The only requirement they have for outgoing mail is that it's not spam (ie, unsolicited bulk mail). Legit mailing lists are not a problem.

Re:Some much for my mail server

[Angst Badger]

I started with sendmail and ended up with [something else].

You'd be surprised how often this happens. No, wait, you started with sendmail, so I guess you wouldn't be surprised. ;)

I send my mail through my earthlink server which works but now I must watch my volume (no mailing lists hosted here I'm afraid) because of my 'terms-of-service'. Something about being a little guy or something like that.

I have the same problem with my local ISP. Outbound packets to port 25 are filtered unless they go through my ISP's smtp server. From a practical standpoint, this wasn't much of an issue -- I just set postfix to use the ISP's smtp server as a relay host. OTOH, as a matter of principle, it annoyed the hell out of me. Getting pissed at the ISP -- in my case, it's actually a dinky little local ISP, not a Giant Corporate Entity -- is missing the point. They're just trying to prevent their consumer broadband services from being abused by spammers, which gets the ISP in trouble with its peers, as well as drives up costs.

Spammers must be stopped. Since attacking the suppliers has failed, maybe it's time to attack the customers. Make responding to a spam a felony. Cheap v1agra is not worth a visit from Herr Ashcroft.

Re:Some much for my mail server

[Anonymous Coward]

Until our ISPs block IP protocol 50 as not part of their terms of service.

Too late. It's been done (have to upgrade to "business class" to use a VPN client). That's why lots of VPN clients now have to encapsulate IPSec over UDP.

Re:Some much for my mail server

[Anonymous Coward]

Another point, for those unable to use another solution.

There is an authenticating stmp server for Earthlink:

smtpauth.earthlink.net

It is useful for those who cannot use SSH or for those traveling using Earthlink dialup who want to send their work e-mail with using their work e-mail address.

All you need is an e-mail client which supports STMP authentication.

Hope that helps someone.

SMTP is already "broken"

[BeerMilkshake]

I have my own domain and run a MTA on my Linux box that is on DSL and gets its IP via DHCP. The IP almost never changes since the server is always on. I bet this is the same configuration as other /. readers.

Anyway, I am starting to get bounces from certain organizations (AOL, Primus) that seem to think my messages are spam. Seems to have something to do with coming from an IP that is known DHCP. This kind of sucks; whitelists and spam filters may seem good at first, but they are screening out some legitimate traffic.

Re:SMTP is already "broken"

[Anonymous Coward]

I am also in this situation. Mail to Road Runner addresses also bounces. I am sure it will get worse before it gets better. The worst part is, the people I know who use AOL aren't technical enough for me to expect them to complain about the issue. I just tell them "AOL's anti-spam stuff has some bugs, that's why I send you email from the yahoo.com address instead of the real one."

Right now I make no attempt to get around it other than using the yahoo web mail to send the occasional message. Eventually, I will pay up to sdf.lonestar.org enough that I can use there smtp server, and I will configure my local exim to use that only when going to the misconfigured ISPs.

Re:SMTP is already "broken"

[flatface]

I have the same setup here. The problem is the realtime blackhole list I believe.. It blocks out IP addresses from dynamic sources, and that DOES include DSL and cable, even if the IPs hardly ever change. Workaround? Use the ISP's smtp servers with sendmail.

My ISP just recently blocked the port we use for incoming e-mail. Our workaround for this is to get another box to use as a relay, set up a MX record in our DNS, point it to that box, then use that box to forward it to our port 5555 (example). Wish I knew how to do this with qmail. Oh well.

Re:SMTP is already "broken"

[Anonymous Coward]

I operate my own mail server (on which I pay for a static IP), and I block email from DHCP blocks. It works extremely well; I stop a large amount of spam, and very few legitimate emails.

If you're going to operate a server, fork up a few dollars a month for a static IP. If your provider doesn't offer static IPs, get a different provider. You can't expect to operate a server on DHCP any more than you can operate one on a part-time dialup connection.

Re:SMTP is already "broken"

[flyboy974]

I had a local ISP bounce my mail on this "DHCP" exception. Even though my IP hasn't changed in about a year. I host a number of mail domains for friends, and use a dynamic DNS provider to take care of my updates. Their domains just MX to my dynamic host name.

This is a direct quote:

"We block mail from known dialup pools and other dynamic IP blocks, due to the ever present risk of "direct to MX" spam originating from spammers running bulkmailer software equipped with smtp engine capablities, and "remailer" virii such as Sircam and Klez, which have their own smtp engines to remail copies of themselves."

Geee.. Really... So looking at my headers in my e-mail, couldn't you tell it's not a Klez or some other worm? Grow up. Spam filtering needs to start at the content level, not at the IP level. That breaks everything that the Internet was founded on.

Re:SMTP is already "broken"

[Buran]

I already can't send to a friend who uses AOL because AOL thinks I'm a spammer just because I use Postfix on my OS X laptop to send mail so I can send mail from anywhere using any of my (all legitimate) return addresses. I could spoof my return address and be a spammer, but I'm not.

AOL doesn't even try to test my messages for spam content. They just ... vanish.

Consequently, I've told this friend that until she gets an ISP that follows standards like the rest of the net does, I won't even bother to try sending her mail. I think I was told once that I was being a twit, but am I? I don't think so. I'm providing incentive to dump an ISP that is intentionally causing harm to a vital resource of the net.

Re:SMTP is already "broken"

[Anonymous Coward]

Unfortunately, content-filtering is prohibitively expensive in CPU time for an organization like AOL. Furthermore, they would rapidly get into a war of escalation with spammers smart enough to defeat the content filters.

And the Internet was not "founded on" the idea that cheap-o home connections were full freight providers, so please, spare us.

Re:SMTP is already "broken"

[AKnightCowboy]

You can tell where this is leading. Today it's e-mail, tomorrow it will be web traffic. If your web traffic isn't proxied through your ISP's web proxy then you will be blocked from visiting web sites at some other provider. Only major providers' web proxies will get added to the other providers' firewall rules to allow incoming web traffic. Corporate America just took a little longer to fuck over the little guy on the Internet. Now they're full steam ahead, and the anti-spam crusaders are their spearhead.

Re:SMTP is already "broken"

[Kronovohr]

Most implementations of qmail I've seen use hooks in inetd/xinetd for receiving mail. All you have to do is create a pseudoservice (xsmtp for example) in /etc/services on a different port:

xsmtp 5555/tcp

then copy the line for qmail's SMTPD in inetd as called from that pseudoservice (i.e. xsmtp rather than smtp) (or file in many default xinetd configurations), restart xinetd/inetd, and you're all set -- qmail is listening on two different ports simultaneously.

HTH

Re:SMTP is already "broken"

[kindbud]

I got one word for you: mailertable.
If you're running qmail, the word is: smtproutes

Re:SMTP is already "broken"

[kumokasumi]

Remind me how you can spoof your own email address or how it would magically be spamming if you did.

Yeah, you're being a twit. Just because it's broken doesn't mean you don't have to deal with it.

Re:SMTP is already "broken"

[Buran]

I have to deal with it, and I choose to deal with it by not supporting the practice by not conforming to it and providing incentive to use ISPs that do not filter mail this way without user consent.

Anyway, running my own smtp server set to "relay localhost" means that any message I send through it can have any originating address I want it to have, because I set it that way.

Re:SMTP is already "broken"

[kumokasumi]

As you wish. If you can afford to shoot yourself in the foot like that, be my guest. Does it suck? Yes. It sucks a lot. Is being passive-aggressive to their end users really the way to fix it? I don't think a "your ISP is broken, switch" attutide will get very far with most AOL users.

And I'm well aware that it can have any originating address you please. That's not /spoofing/, and taking advantage of it hardly makes you a spammer.

Re:SMTP is already "broken"

[Buran]

Who else is going to put pressure on them to fix it? They don't get any money from me, so they aren't going to listen to me. But users saying "My contacts won't send me mail, or can't, because of your policies, so I'm going to stop giving you money" is more likely to do something. I see it as shooting yourself in the foot by NOT doing anything about it.

Re:SMTP is already "broken"

[thadeusg]

But users saying "My contacts won't send me mail, or can't, because of your policies, so I'm going to stop giving you money" is more likely to do something.

You're assuming AOL actually *cares* about loosing a few users here and there because of that..seriously, you're kidding yourself.

Re:SMTP is already "broken"

[Buran]

Like I said. Not doing anything will DEFINITELY not get anything done.

You're deluding yourself if you think otherwise. Seriously.

Re:SMTP is already "broken"

[thadeusg]

Absolutely. But, doing what you suggest will also definitely not get anything done.. ;)

It's like saying that converting 1000-ish people to veganism is going to put McDonalds out of business...you're no more likely to accomplish this than you are to accomplish making AOL give a shit, or the vast amount of their users, for that matter, simply because you won't email them anymore.

What I'm saying is that refusing to continue to attempt emailing your friend on AOL simply b\c of AOL's filters, is a bit, well...mean, but whatever... ;)

Re:SMTP is already "broken"

[Buran]

And it's ridiculous to expect me to change my working-well setup just for one head-up-ass ISP. So I'm not gonna do it just because one person can't be bothered to use a better service. At least the person seems to be intelligent enough thus far to realize this.

Maybe a better solution .....

[Anonymous Coward]

would be for AT&T to send an email telling everyone to fix their screwed up mail servers. That would help all of us, instead of screwing with us.

Seems a bit drastic

[Shimmer]

Does this mean that Joe Public surfing the AT&T web site can't shoot them a question via e-mail? If so, I can't imagine that's going to be good for their business.

RTFA?

[fo0bar]

FYI, this seems to be from AT&T Business Services, IE backbone and ip operations. So their customers (the people they are asking) in this case are other ISPs, datacenters, etc, and the whitelist is for sending email to AT&T itself. This has nothing to do with other AT&T services (remember, "AT&T" is essentially about a hundred different companies that happen to share the same name), so this should not affect some grandma trying to send to an attbi account. That being said, whether what they're doing is good remains to be seen.

(Interestingly enough, I *DO* work for a datacenter that has IP and transit services through AT&T, and have not received one of these emails yet...)

Re:RTFA?

[trelanexiph]

attbi is owned by comcast, and thus is not a part of AT&T, however worldnet it appears, having talked to a customer will fall under these blocks, judging by the mailprofile I saw on an account there today, and not by any actual previous notice (verisign anyone?). Btw the only link in that add is hosted on the DSL I'm posting this reply from, I've got less than 100ms lag. So either noone cares, or more likely our site doesn't use large sucky images. PS: Check out the AHBL (abusive hosts blocking list, soon to be released)

Re:RTFA?

[Anonymous Coward]

Right, but what does this mean for Joe Blow who runs his own website, has his own email server and sends email to his users to notify them of certain activities.

As an example, let's say a guy runs a moderately successful blog-news type site with about 50,000 subscribers. Let's say these users want to know when certain things happen on the site and they have asked to be notified (for example, when someone responds to a post of theirs). And lets say this guy runs his own email server so that he can send email from @someblogdomain.com.

Does this guy have to email AT&T and say "my tiny little non-profit fun website's email server needs to have its IP added to your white list"?

And if so, then why did AT&T only send this out to their customers? How the hell am I supposed to have known about this change so that I could do something about it to prevent my users who do have accounts with AT&T from being able to get my system's automatic emails?

Re:RTFA?

[Anonymous Coward]

and have not received one of these emails yet...

Put AT&T on your whitelist.

Good grief

[Micah]

I've said it before, and I'll say it again. We need to dump SMTP and switch to something like Internet Mail 2000. The sooner we do it, the better. Some people here have voiced concerns, but I'm convinced that this proposal is well thought out and will work. Any inconvenience (which would be minor, and only for a small fraction of users) would be trumped by its benefits, by a wide margin.

Anyone know if anyone is actually coding up a sample server and client for IM2000? A google search for "internet mail 2000" comes up with some proposals that go beyond Bernstein's site, but I haven't seen any evidence of code yet. It really shouldn't be that complicated and, yeah, I'd be willing to help!

Re:Good grief

[Anonymous Coward]

Bernstein is a loon. No one can use the software he writes because of his license, which specifies you can't change it and have to keep the binaries in /var. And did you read that link in your post ? The guy has no idea how to do what he wants.

Re:Good grief

[johnnyrocket22]

there's an XMPP/Jabber Implementation at jabberstudio.org . it's called ngmp ( next generation mail protocol)

Re:Good grief

[Doktor Memory]

Bernstein is a loon. No one can use the software he writes because of his license, which specifies you can't change it and have to keep the binaries in /var.

In addition to being an anonymous coward, you're a fucking idiot who apparently can't read.

Bernstein's "license" (it's actually an explicit disavowal of a "license" and a statement of your existing rights under copyright law, but whatever) lets you do any damn thing you want with his software under your own auspices: you can install it in /usr/local/shut/the/hell/up/ac/idiots, you can rewrite components in C# and Visual Basic.

What you can't do is redistribute a version of it with your changes pre-built in. This is annoying, but far from the end of the world: if your changes are actually useful, publish the patch. Hundreds of people do.

And did you read that link in your post ? The guy has no idea how to do what he wants.

It's a proposal. Criticising a proposal for not being an implementation is rather missing the point.

Re:Good grief

[Lectrik]

there's an XMPP/Jabber Implementation at jabberstudio.org . it's called ngmp ( next generation mail protocol)

I'm waiting for the perpetually improving mail protocol (PIMP)

Re:Good grief

[Anonymous Coward]

IM2000 is a whitepaper, not software. Maybe if DJB ever gets around to coding it, people might consider switching to it, otherwise it's a waste of time to even talk about it.

Re:Good grief

[evilviper]

Any inconvenience (which would be minor, and only for a small fraction of users) would be trumped by its benefits, by a wide margin.

Not true at all. It has all the disadvantages of e-mail, along with all the disadvantages of the WWW...

You can't download all your messages, and read them later (well, you can, but that would defeat the single advantage of it).

You can no longer archive your messages. It becomes a serious hassle to send e-mail to anybody. You can no longer batch-process messages (a serious disadvantage for those with lots of traffic), your IP address will be instantly exposed to whomever sends you messages. Worst of all, the speed with which you can go from message to message, depends on the sender's bandwidth, meaning that e-mail from your friend in Barbados is going to take forever to load, etc.

With all the disadvantages, and only one, small, potential advantage, it is never going to gain popularity, and for good reason.

I would personally welcome a new and better protocol, but I'm certainly not going to push for an awful, half-assed solution that causes more problems than it solves.

Re:Good grief

[kcbrown]

SMTP itself isn't the problem. It actually provides all the information you need to determine whether or not the sending system should be authorized to send the email in question:

1. The IP address of the sender
2. The domain the sender is sending on behalf of

What's lacking is DNS support. DNS currently doesn't have a record type indicating which systems are authorized to send email on behalf of the domain, but if it had that then you'd have everything you'd need to know whether or not a given system was authorized to send on behalf of the domain in question.

Now, that's good, but of course it's possible for the spammers to buy tons of domains and spam from them. But the above gives you a solid gold defense.

What defense? Well, imagine how many orders of magnitude more powerful Vipul's Razor would be if you could block entire domains based on whether or not the email in question was reported as spam by more than, say, two independent entities.

Winning the war against spam requires being able to identify and reject spam sources more quickly than those sources can come into being. If spammers are forced to buy a new domain whenever they're blocked in order to get the spam out, they'll lose: getting a domain will almost certainly be a slower process than blacklisting a domain based on reported spam because getting a domain requires a financial transaction, setting up authoritative DNS servers, etc. And the spammer would have the domains, lots and lots of domains, in his name (or at his address, or with his email contact, or something that is common to many of them) for an entire year, which may make it easier to identify spammers.

It amazes me that we haven't already put this system into place. How hard can it be?

Re:Good grief

[cortana]

Check out SPF. Was posted on Slashdot a couple of weeks ago.

Re:Good grief

[deathmolor]

Come on. That is the most idiotic proposal I have ever seen. It can never work for one simple reason. PUSH is better then PULL.

Re:Good grief

[deathmolor]

Well we do have that in place. Problem is the smtp servers don't check the dns record. Mail servers for a domain are recorded we just have to start rejecting the ones not in the DNS record. Then that will force ISPs to porperly record their nodes in the DNS record. Looks like this would be simple, but it requires people to cooperate. That is easy to do if the big ISP's get on the bandwagon.

Re:Good grief

[Micah]

> IM2000 is a whitepaper, not software. Maybe if DJB ever gets around to coding it, people might consider switching to it, otherwise it's a waste of time to even talk about it.

Which is exactly why I was asking if someone knew of any actual code ...

Re:Good grief

[Micah]

No way.

> You can't download all your messages, and read them later (well, you can, but that would defeat the single advantage of it).

Of course you'll download your messages, and it won't defeat anything.

The way I see it working, when you click "Check Mail," your mail client will fetch all the tokens from your ISP's mail server. It will then fetch all the messages in a multithreaded way.

That wouldn't defeat the purpose, because if someone sends a large block of spam, the server would likely already be blacklisted by the time you clicked "Check Mail" and the spam would never be downloaded.

> You can no longer archive your messages. It becomes a serious hassle to send e-mail to anybody. You can no longer batch-process messages (a serious disadvantage for those with lots of traffic)

I have no clue where you got that idea. Messages would still be saved locally. Sending e-mail will be as simple as clicking "Send email." Your MUA will automatically stick it in your ISP's out-box. Batch-processing would work the same way. In fact check the link, it has MANY advantages for listservs. Other legitimate mass mail should work fine, as long as it doesn't get tagged as spam by too many people. Personally, I think there should be a separate priority level, stored in the token that sent for message notification. That way, bulk email from web sites and stuff can be downloaded last.

> your IP address will be instantly exposed to whomever sends you messages.

Well, that could be proxied if it's a problem. I doubt most people will care.

> Worst of all, the speed with which you can go from message to message, depends on the sender's bandwidth, meaning that e-mail from your friend in Barbados is going to take forever to load, etc.

You're assuming the messages will be loaded when you click on the header in your MUA. I believe they should all be loaded at once when you click "Check Mail."

> With all the disadvantages, and only one, small, potential advantage, it is never going to gain popularity, and for good reason.

No serious disadvantages. And the advantages go quite a ways beyond less spam. Especially for listservs.

Re:Good grief

[Micah]

Hmm, cool, that's actually a good idea that we could perhaps try before moving to IM2000. But IM2000 still has a potentially significant advantage: it would allow blocking messages based on *individual users*, not just domains. Obviously for Joe Sixpack's domain (on which he has root) that won't matter, but for a large ISP it could be a huge advantage. If one bozo on AOL or Earthlink is sending out crap, he could be individually blacklisted by the community, or the ISP could delete his outgoing mail before some of it is retreived.

Re:Good grief

[AKnightCowboy]

Come on. That is the most idiotic proposal I have ever seen. It can never work for one simple reason. PUSH is better then PULL.

That's why that intarweb thingy never took off and Pointcast now dominates the online arena.

Why is Karma Whoring rewarded at Slashdot ?

[zymano]

Why do people that have legitimate topics get censored as 'Flamebait' when talking about microsoft or comment on KDE and GNOME being more bloated than Rosey O'donell as a 'Troll'.

Why do people that CUT AND PASTE news article get rewarded by the IDIOT moderators of this website
with a +5 informative moderation ??

Does anyone else wonder about these mysterious subjects ?

Who in their right mind would pay money to Slashdot ? Very bizarre.....If you got cash to burn , how about giving it to the needy instead lazy millionaire Commander Taco.

Re:Why is Karma Whoring rewarded at Slashdot ?

[heapacreep]

Why do people that have legitimate topics get censored as 'Flamebait' when talking about microsoft or comment on KDE and GNOME being more bloated than Rosey O'donell as a 'Troll'.

Because posting regarding such "wars" raises the zealots on both sides of the issue, and as such they cloud the story's comments with their smoke from the battle. Okay maybe it is not that bad, but comments should regard the stories, not the rant of the day.

Re:Why is Karma Whoring rewarded at Slashdot ?

[sl0ppy]

there are stories?

Re:Why is Karma Whoring rewarded at Slashdot ?

[zymano]

Isn't that just life.

Isn't this a messageboard ?

Half the articles on Slash are about Microsoft so if people are passionate about the subject why aren't they allowed to discuss ?

This is not a free speech forum as most of you would think. It has become a place where people play GAMES to satisfy egos raise karma points for self indulgence.

It's getting to the point of stupidity.

Re:Why is Karma Whoring rewarded at Slashdot ?

[metroid composite]

Your post is off topic but...

Why do people that have legitimate topics get censored as 'Flamebait' when talking about microsoft or comment on KDE and GNOME being more bloated than Rosey O'donell as a 'Troll'.

Because it is a troll. Trolling is all in the wording; metaphors and hyperbole are usually signs of trolling, for example: "FF7 has the IQ of a tadpole; it's so stupid that anyone who played it would colapse and vomit then go into multiple convulsions and die from a stroke." This is quite different from pointing out legitimate objections such as "FF7 really just borrowed a lot of gameplay from FF6, reducing the complexity and the difficulty drastically, and the early polygons were really a downgrade in graphics (barring FMVs)."

We want details, not poetry. Spare us your literary devices.

Why do people that CUT AND PASTE news article get rewarded by the IDIOT moderators of this website with a +5 informative moderation ??

We're too lazy to search for the stuff ourselves. That involves sifting through useless links, and not all relevant links will show up on the first 5 pages Google.

Re:Why is Karma Whoring rewarded at Slashdot ?

[Anonymous Coward]

Why do people that have legitimate topics get censored as 'Flamebait'

Why do some people constantly confuse (or pretend to confuse) moderation with censorship? It's still there, still visible to anyone who would want to browse through it. It's just been marked by random members of the community as something that someone might not want to browse. If there's any disagreement about that marking, other random members of the community are able to correct it.

Just because some people choose to not read posts that are modded down does not mean you're being censored in any way. They have as much right to ignore you as you have to speak.

Re:Why is Karma Whoring rewarded at Slashdot ?

[PasteEater]

No offense, but if you want to see EVERYTHING, browse at -1.

Problem solved.

Re:Why is Karma Whoring rewarded at Slashdot ?

[Anonymous Coward]

Good one.

The original memo

[morelife]

I read between the lines as:

Greetings Customers and Partners,

There is too spam, so we fired everyone in IT. We've got some temps, led by secretaries, who will now rebuild and maintain all AT+T messaging platforms. Please send your IP addresses as we will need to ping you next week to see if you're still a Parntner/Customer.

Best regards,

"

Re:The original memo

[Anonymous Coward]

I read between the lines as:

Greetings Customers and Partners,

There is too spam, so we fired everyone in IT. We've got some temps, led by secretaries, who will now rebuild and maintain all AT+T messaging platforms. Please send your IP addresses as we will need to ping you next week to see if you're still a Parntner/Customer.

Best regards,

"

Replace the temps and secretaries with cheap Indian labor and you probably got it right.

Re:The original memo

[Anonymous Coward]

Can anyone say Smells like ALL of IT is about to be outsourced? signed, a teeny birdie caught inside the cage

sendmail +PPEMAIL

[heapacreep]

We could all just use sendmail and live with it...oh nt wait a minute, then I would have to built a brick wall around my house and bolt everything to the floor again. I am not sure that a pay-per-email system would work though as then the question of WAN/LAN e-mails comes up as some networks could be in the middle. Then comes the matter of payment, and what if one just wants to send a quick email and it is not their computer and they have not an account online. Also, different mailing lists would suffer or at least be royally screwed as most are free and that is their advantage, and as such, they would lose that advantage. Overall, PPEMAIL, not a very sensible plan, however something needs to be done...

Shock and disbelief....

[ComputerSlicer23]

Uhhh, I do business with people on the AT&T network. At least I'm reasonable sure the 1000's of clients who use e-mail to contact me use it. I wonder what I need to do to get on the list.

Complete shock and disbelief at the first e-mail (the dreadfully short message at the bottom).

Has anyone actually called and confirmed with the 1-800 number that this truely is AT&T, and it really is what they are saying? I'm not sure I'll believe it until I see the e-mail actually start bouncing. That's clinically insane. Do they seriously believe they'll be able to pull this off? You mean ever time a small company creates a new mail server they'll have to contact AT&T with the outgoing SMTP servers? If this starts a major trend, you mean I'll have to contact lots of major ISP's to send mail to them?

Assuming this it to stop SPAM (what else could it be?), what's to stop a spammer from just calling up and saying I'm a legit mailer set me up? What do I do when I get assigned the IP from the old spammer? What will there policy be on setting you back up? Will there be an official form? How can they tell the Spammer just isn't dupping them a second time with a fake business?

This sounds like a terrible idea, and like their security people haven't really thought this through. About the only thing I like about it, is that it is a sign that major ISP's are starting to play hardball. I'm curious if one of their net admins was behind some of the major black lists that just got DDoS'ed off the net. I hope they accept e-mail from anybody with a legitimate MX record at least. At least for a little while. I can't believe they aren't going to do a black list instead of a white list.

What's the over-under on how long this takes to get pulled the plug on? There's no way this will last. It'll be a world class disaster. My guess is it won't last 15 business days.

Kirby

Re:Shock and disbelief....

[Anonymous Coward]

It's true. I've had about a half dozen emails bounce so far, and we have dual t3 links from AT&T. I wasn't the tech contact on our DNS records, so I didn't have a clue about what was going on until I saw a posting to NANOG. Now that we've added our IP ranges to their whitelist, everything works. The best part is our SE's and account reps don't have a clue that this is in place. Rude awakening when their clients start calling them.

Re:Shock and disbelief....

[Anonymous Coward]

Oh, the terseness of their email is due to that it's an emergency notification system. I'm guessing that's what ems in ems.att.com means.

Re:Shock and disbelief....

[Anonymous Coward]

And you can't even dial a US 1-800 number from outside the US. How many non-US customers does AT&T actually have?

Re:Shock and disbelief....

[Anonymous Coward]

Nope. ems.att.com is AT&T's Exchange Mail System.

Root servers.

[zymano]

Why not set up some control station just for SPAM ?

It can be done but they wont do it.

Re:Root servers.

[dacarr]

Perhaps you can explain to us how it can be done then, in a cost effective fashion?

This is not going to work

[bigberk]

After a few months of operation, it will become obvious that this plan is a disaster. Spam-friendly ISPs (and there are many with legit customers too) will still get on the whitelist, so incoming spam will not cease. But in the meantime, smaller ISPs around the world will get mighty pissed because their mail is rejected.

However, if you run your own mail server you will get quite annoyed, but all hope is not lost. Here is a brilliant solution for postfix that will let you deliver mail specifically bound for, say, attglobal.net through your ISP's hopefully whitelisted customer-use mail server instead of direct delivery. So AT&T will see your ISP's mail server connecting for this mail, while all your other mail can be delivered direct.

I'm mighty disappointed in AT&T. This move further commercializes Internet connectivity by giving big business the green light to send any mail while blocking all the small guys. Seriously.

Don't they need to keep doing business?

[fatray]

Most big corps have an army of salesmen, tech guys, whatever, roaming around the world handing out business cards with an email address printed on them. The idea is that potential customers or potential partners with actually email us and we'll do things with them that make money for the corporation. Cutting off that communication sounds like a very bad idea.

This seems pretty odd. Is this just a small division somewhere that is trying this or THE AT&T.

A Hoax?

[davburns]

It seems to me that, if AT&T wanted a list of mailservers which send them email, they would probably start with their own maillogs. That is going to be much more complete, and they won't sound as stupid to all their contacts.

Even if they did come up with a complete and accurate list of non-spammer mailservers, they still need a way to continiously update it. What would they want? Everyone in the world sending them email whenever a mailserver comes or goes? (oops, no... because the new server wouldn't be on the list either.)

AT&T cannot be this stupid. I have to think that this is a hoax. The long message vouching for the credibility of the earlier, terse message supports this idea.

Why not use the MX?

[droleary]

AT&T has asked their customers, partners, and business clients to provide them with IP addresses of their mail servers.

Call me dense, but why not simply accept mail only from registered mail handlers? I would also do the filtering based on the connecting server's domain MX and the From header's domain MX; neither is registered, you give a 550 error. That would stop 99% of the spam (that I get, at least) right there. Especially the virus spam that tries to turn any random Windows box into an SMTP server.

Re:Why not use the MX?

[morelife]

Why not use the MX?

In large mta deployments the mx is hardly ever the sending mta.

Re:Why not use the MX?

[houghi]

the mx is hardly ever the sending mta.

Would it be possible to add information about the sending mailserver, just like the MX record? Perhaps too late for now, but it might be possible for IPv6. Another positive thing is that if such a thing is implemented in IPv6, providers and large companies might be willing to switch over towards IPv6 faster.

I understand that it will not completely solve spam, but it could be easier to trace and to punish. What people are asking is a 100% solution. That is like asking a 100% guarantee that people will not steal. It might not be possible to completely make spam impossible. It might work enough to reduce spam to 1% of what it is now.

Re:Why not use the MX?

[Russ Nelson]

So? Add an MX record pointing to the SMTP client. "Can't do that; an MX record is supposed to point to a host running an SMTP server." What do you want? Political correctness or less spam? Sheesh, give the record a higher MX distance.
-russ

Re:Why not use the MX?

[morelife]

So? Add an MX record pointing to the SMTP client.

But that's not what MX records are for.

an MX record is supposed to point to a host running an SMTP server

It should point to a host that receives mail for a domain. That is not to say that this host also sends mail.

Political correctness or less spam

Has to do with neither!!

give the record a higher MX distance

If you mean MX preference number, those mean something only in relation to each other and little else. Spam is arriving at all domain MX hosts regardless of pref. Shit, I've even seen spammers sending a HELO of my MTA's IP Address!

Magic words

[Phroggy]

"Please add this number to your do-not-call list."

Document all the info you can (date, time, name of person you spoke to if possible, etc.), and the next time you get a call from them, complain.

Re:Magic words

[nolife]

I had similar problem that the OP had with AT&T on my unlisted/unpublished number.
My first attempt to say "Do not call again" was treated with a hangup by them. I called ATT CS and reported the issue, of course they blamed it on a third party contracting company which is probably true but they need to realize that company is representing them. I was added to the "Do not call" list and sent a written later that I will not be called again. So far it's been trhee years without a call from them. But... They have my address now and I recieve constant mail from them. Funny as I gave them the wrong spelling of my first name and it's obvious where this junk mail is coming from.

Re:Magic words

[FroMan]

Yeah, I have had this also. ATnT is the worst for telemarketing. I have had where I tried to get the information that they aer required to give and was hungup on before I could ask to be put on the do-not-call list, not just once, twice. Both times I called ATnT and talked with someone who said it won't happen again, you are added to the DNC list and everything.

How are you supposed to stop these guys if they won't give you their name/company information? What do you do, call the FCC and complain? Yeah, I had someone call and I don't know who it is, tell them not to call again please? Yeah, that will go over real well.

Re:Magic words

[Phroggy]

What do you do, call the FCC and complain? Yeah, I had someone call and I don't know who it is, tell them not to call again please?

That might not be as crazy as it sounds; the phone call may be traceable.

Re:Magic words

[cyberformer]

You can report criminal telemarketers to three different enforcement agencies: The FCC, FTC and (sometimes) your state attorney general. All have Web forms, and the FCC's even has a drop-down boxes with a list of common offenders (eg. AT&T, SBC) and crimes (eg. failing to put you on the do-not-call list)!

NOT FLamebait....Stupid Moderators!!!!

[zymano]

Slashdot is starting to suck.

go to some other sites like techdirt.com

Webforms?

[kscd]

Wouldn't it be easier for them to just handle their email through webforms? Now, I may be completely wrong here, but I rarely get Spam at addresses that aren't posted somewhere on the Web/Usenet. Using a webform to email alleviates this problem.

Re:Webforms?

[Anonymous Coward]

Wouldn't work. The AT&T reply is not going to be through a webform, but by e-mail. And the customers reply to that...

Hypocritical--ATT is a major Spam Service Provider

[dananderson]

I find this very hypocritical. ATT is a major service provider for spammers, mostly through their broadband service. I know because I have my own blacklist and there are hundreds of Class C blocks with ATT. ATT is very lax with enforcing any AUP they may have.

Gee, that's funny...

[buss_error]

In an apparent attempt to quelch the amount of incoming spam, AT&T has asked their customers, partners, and business clients to provide them with IP addresses of their mail servers. All other mail will be discarded.

When I read that, I laughed so hard I nearly spotted. In case you did hear, AT&T was the first Tier 1 ISP to have been confirmed to write a pink contract. To be balanced about it, AT&T corporate stated that the contract had been modified without permission of their legal department.

"If any of your IM team is captured or killed, the state department will disavow any knowlege of your actions. This tape will self destruct in 10 seconds. Good Luck Jim."

Re:Gee, that's funny...

[Anonymous Coward]

pink contract

SMTP blues

[ratfynk]

I know this sounds crazy but the protocols are the problem. As long as there is no way to certify return addressing spam will happen. Solicitation lists just do not work for this very reason. I personally do not reply to or even consider spoofed mail. I never use html links that come in mail even if the reply address is authentic. If the person sending me mail cannot give me their real address they can go suck wind. I just wonder, if e-mail dies what will replace it? Ask Bill he has the answer, fascist style computing. Maybe this is why we have the MS worm, virus, software security problem. What a wonderful way to sell secure computing and make so called 'trusted computing' mandatory. Kill of e-mail as we know it first with Windows style security. Na ..no one could be that underhanded. Brilliant idea though and not that far from happening. Either the guy is really that brilliant or just shit lucky. It sure would cement the future of MS computing.

The best dual boot problem solver is; dd if=/dev/urandom of=/dev/hda1 ..then cfdisk /dev/hda1 etc..

:-( too bad I have my wife won't switch yet. I have always wanted to use that command!

Re:SMTP blues

[Russ Nelson]

Not only does it sound crazy, it *is* crazy. Most Nigerian spam is sent by ordinary people paid a penny per email message. They cut-n-paste it into the email window on the current web-based email system while sitting in an Internet cafe drinking a latte' (or the Nigerian equivalent). How is a different protocol going to help you distinguish between a Nigerian sending spam that way, and your sister sending email from her Peace Corps stint in Malawe?
-russ

Re:SMTP blues

[ratfynk]

Simple because if all internet mail could be back traced the spam friendly servers could easily be black listed. Unfortunately it has come to this, e-mail cannot become a medium for junk advertising or it becomes useless. The other solution is another protocol, thereby creating two free internet mail services, one for real correspondance and the other for would be junk advertisers.

Re:SMTP blues

[greenhide]

Simple because if all internet mail could be back traced the spam friendly servers could easily be black listed.

Spam Friendly Servers? You mean, like Yahoo or Hotmail?

If I understand the parent correctly, they just pay people to set up fake e-mail accounts and send out a quantity of messages. By the time that the abuse department at Yahoo or Hotmail gets to them, they can easily send out 300+ of the these messages. Then they can go ahead and create a new account when it's shut down.

There's no real solution to the e-mail problem as I see it. Spammers can always bypass whatever rules are set up, because basically normal e-mail needs to remain responsive and efficient, so it has to have an automated component.

Re:SMTP blues

[ratfynk]

This is why the idea of a second ( legitimate correspondence only protocol ) is the only real solution. It is something that could make e-mail usefull again. MS Longhorn is just that with "trusted computing". They know this and could care less about HotMail, or current e-mail protocols. The .NET VB C# framework is just a way to ensure that certificate verification of content and correspondance becomes a standard that is under their control.

Re:SMTP blues

[greenhide]

This is why the idea of a second ( legitimate correspondence only protocol ) is the only real solution.

No, this would suck.

The great thing about email is, it's a way for people who don't know you to contact you without you having to tell them somthing really personal like your phone number and name.

So I want my e-mail address available to someone I don't know, because maybe they're an old friend of mine who runs across my e-mail address somewhere and decides to see how I'm doing. Or maybe it's a friend of a friend who heard I was interested in forming a Jug band and knows how to play the fiddle.

Whatever the reason, I can't always know who is going to e-mail me. So e-mail has to be open. And if it's open, then why bother using the second protocol? If I use a closed protocol only, then I'll never get either of those messages.

And if you make the new protocol in such a way that strangers can e-mail me, then the 1c an email scammers in Nigeria will figure out how to do it. It might take a little longer to gather addresses and send e-mails, but ultimately they'll determine some way to automate it.

The one idea I've heard tossed around that I like is requiring some sort of certificate-based connection from a mail server before a message could go through. Spammers would quickly have their certificates revoked once their spam limit exceeded a certain amount, and you could specify which certifying authorities you were willing to trust. This would prevent things like DSL and other fly by night SMTP servers from being effective.

I'm not sure if you'd need a whole new protocol; you'd just need some way of adding the possiblity of a secure SSL connection for SMTP (not that bad of an idea, since it could provide at least a little security for the messages being sent through). Once that was set up, the rest of the protocol could behave the same as it has before.

Just because...

[sillypixie]

you whitelist some servers does not have to mean that you have to blacklist all the others. If AT&T really means to do this, they will learn the hard way when their business suffers.

There are several initiatives underway to use DNS to authenticate SMTP transactions: this seems like a good way to avoid the nastiness described by the parent poster...

• http://spf.pobox.com/draft-mengwong-spf-01.txt

• http://www.pan-am.ca/draft-ietf-asrg-dsprotocol-00 .txt

• http://www.ietf.org/internet-drafts/draft-danisch- dns-rr-smtp-03.txt

The article really does sound like this request is an emergency response to a specific threat - The intent seems to me to be more of a temporary bandaid solution than an attempt to alter the very fabric of email as we know it (-:

Pixie

SMTP Servers sending from their networks

[Anonymous Coward]

Just so that this is absolutely clear. It is my understanding that they are asking customers on their IP networks for this information. That is: they want to know the IP addresses on their IP nets of SMTP servers to whitelist incoming and outgoing mail for. I believe this mail went out to their large (enterprise?) customers which includes many downstream ISPs.

Could anyone tell me if this letter also went out
to customers that manage their own IP nets but buy upstream connections from AT&T. For example, ISPs that are LIRs for their own nets.

one step further the AT&T way

[frovingslosh]

They should've gone one step further

Heck, the next logical step beyond claiming that they can white list every legitimate e-mail server on the planet that might ever send a valid e-mail to an AT&T customer would be to simply demand that everyone register all the actual e-mail that they will ever send to an AT&T customer. Then they could check incoming e-mail against everything they had on hand (or even just the md5 checksums of same) and reject any e-mail that wasn't already on file, since it must be spam. Might even be more useful; I could register a half dozen simple mesages now for an AT&T user I know; but I have no way of being sure what IP addresses my service providers might be on six months from now and be sure they were white listed with AT&T.

I hate spam, but I expect the AT&T move will do a lot more harm than good.

I nearly did that myself

[Greyfox]

I was hunting around for some info on how to set procmail up to only allow the 4 domains that I get legitimate mail from when I ran across tmda. I decided to give it a shot instead and I haven't seen a spam since. I know that technically they're still coming in, but I went from 30-40 spams a day in my inbox to 0. Now I can ignore the problem until they start slipping through or they start consuming a significant portion of my bandwidth.

Re:I nearly did that myself

[Anonymous Coward]

I know that technically they're still coming in, but I went from 30-40 spams a day in my inbox to 0.

How'd you sign up for slashdot?

Re:I nearly did that myself

[KnightStalker]

Back when we signed up, spam didn't exist yet because you had to toggle your emails in one at a time, bit-by-bit on the front of the machine.

I've got a great IP they can block

[Sir Haxalot]

127.0.0.1

Third time I've seen this (still Offtopic)

[jokkebk]

Are you the same guy who posted two earlier posts with the same text? Last time it was 4AM and the
time before 3AM..

Some creativity would be required when posting these again and again, next time change a few wordings and add more superlatives?-)

Can't use MX (someday maybe RMX...)

[Nonesuch]

morelife writes:

Why not use the MX?

In large mta deployments the mx is hardly ever the sending mta.

Yes, Morelife is exactly correct. My "outbound" mail firewalls have no TCP listeners on them at all, only a PF rules to return RST for TCP/113 (to avoid the AUTH query delay), so listing them as MX hosts for inbound mail would be a bad idea.

There *was* a IETF draft for "RMX" (Reverse MX) published by the IETF's Anti-Spam Research Group (ASRG), but it's not really ready for prime time.

Re:Can't use MX (someday maybe RMX...)

[morelife]

Hardly nobody on here knows shit technically speaking yourself excluded Nonesuch /GRIN/, and are ready to slit your throat if you say one wrong (read: probably true) thing about Apple.

The guy talking about TLS whitelisting and certificate mgmt by trusted orgs of each other's certs is probably the crystal ball guy in the bunch. I'll check out the ASRG thing... I hadn't heard about it so thanks.

The colossal false premise in all of this is that SMTP is going to do the job of messaging into the future. That is has lasted this long is a miracle -- already the effort going into maintaining it is beginning to outweigh the benefits.

RMX and SPF:Sender

[RT Alec]

The biggest problem is ATT will have to administrate this. If a (legitimate) domain switches IP addresses on their outgoing SMTP server (it happens), ATT will have to deal with it by setting up some kind of structure to accomodate such changes.

Forcing domains to declare from what SMTP host legitimate mail will come from is actualy a good idea. It has been proposed before, in the form of SPF:Sender and RMX. Either would do the job (technical quibbles aside), and would accomodate the end goal ATT is trying to achieve.

Re:RMX and SPF:Sender

[AKnightCowboy]

The biggest problem is ATT will have to administrate this. If a (legitimate) domain switches IP addresses on their outgoing SMTP server (it happens), ATT will have to deal with it by setting up some kind of structure to accomodate such changes.

A bigger problem is this is a stupid idea if they expect third-party mail servers to contact them and get added to a whitelist before they can send to them. 95% of the servers aren't going to bother, mail will bounce, and they will cause more headaches. If this idea catches on, everytime I want to send mail out I need to go make sure AOL, AT&T, MSN, Earthlink, etc. all have my SMTP server in their whitelist so I can send shit to my family? If it isn't automated through SPF:Sender or something then I can't see this as being workable for more than a couple days until they take major flak from their customers for blocking their e-mail.

Re:RMX and SPF:Sender

[ViolentGreen]

I agree that this is agood idea. Instead of blocking all mail that is not on their list what about just taking a cue from the current spam filtering technologies and put "[unverified]" in the subject line. That way the user could have a choice of whether or not to block all mail from unverified domains.

Pah. Spam is here to stay.

[philovivero]

This scheme will last as long as it takes for one of the Brand New Spam Viruses to infect a billion computers across the internet that use these whitelisted servers.

As long as our governments are only willing to enforce the laws that make them money, the problems that plague our society will continue.

Seriously. Call up your local police office and report the 50 spams you got. Call the FBI. The FCC. The FTC. Call as many government offices as you care to until you're blue in the face. They all have some law that they should be enforcing that Spam breaks, but they're not interested.

Fix the problem, people, not the symptom. If you elect some leaders that will actually enforce laws that make the average citizen's life better, Spam will go away, along with a litany of other problems just like it.

That, or just keep voting for the same politicians that are in the pockets of the corporations, and these problems will persist.

Re:Pah. Spam is here to stay.

[davejenkins]

As long as our governments are only willing to enforce the laws that make them money, the problems that plague our society will continue.

*sigh* Your table is waiting, Mr Guevarra. Governments enforce the laws based on their percieved priority in keeping the population happy and general economic wellbeing. Laws that don't fit into this category are usually thrown out.

Seriously. Call up your local police office and report the 50 spams you got. Call the FBI. The FCC. The FTC. Call as many government offices as you care to until you're blue in the face. They all have some law that they should be enforcing that Spam breaks, but they're not interested.

Good. I would rather they concentrate on finding terrorists, burglars, rapists, counterfeiters, and embezzlers (note I didn't say pot-smokers). Here again, my taxes pay for the cops, and I want them working on shit that _really_ matters.

Fix the problem, people, not the symptom. If you elect some leaders that will actually enforce laws that make the average citizen's life better, Spam will go away, along with a litany of other problems just like it.

I see. so, enforcement will fix spam? how? what are these other problems that will magically go away when the cops start poking around?

That, or just keep voting for the same politicians that are in the pockets of the corporations, and these problems will persist.

Huh. So spam is a tool of major corporations and crooked special interests? I thought the article explained how it was a major cost burden to them. Or did you just want a place to grind your axe about post-industrial society and free trade?

Re:Pah. Spam is here to stay.

[Anonymous Coward]

Pah? PAH?? It's "BAH", bitch!

Re:Pah. Spam is here to stay.

[jez9999]

I see. so, enforcement will fix spam? how? what are these other problems that will magically go away when the cops start poking around?

Actually, I think enforcement against businesses that advertise through spam would work excellently. If only all (rich) countries were willing to do it...

Re:Pah. Spam is here to stay.

[HiThere]

Start doing that, and there will be a nifty new way to sabotage your competition.

The rest of the e-mail

[Stonent1]

If you do not respond immediately, your access may not continue...
Please foreward this e-mail to 10 of your closest e-mail servers and you will get a free Cracker Barrel gift certificate and little Mary-Lou will get her wish of getting e-mail from every American before she dies of Lukemia. If you do not, you will have bad luck for the next 20 years!

Re:The rest of the e-mail

[Anonymous Coward]

"Lukemia"? Get a spell-checker, asswipe.

Seems like an odd way to hoax.

[Nonesuch]

I'm not sure that this is stupid -- my own Fortune 500 employer has been considering implementing a similar "whitelist" for incoming mail, giving preference to known vendors and customers.

Only real difference is that most companies don't have the balls to send this kind of broadcast mail message...

AT&T cannot be this stupid. I have to think that this is a hoax. The long message vouching for the credibility of the earlier, terse message supports this idea.

I've received both the original short message and the longer followup message. The long message includes contact information at the end, names and a 800 number. The names given are actual AT&T employees.

It looks legitimate to me, the reply email address is given as rm-antiattspam at ems dot att dot com (bot-proofing added by me). I haven't actually responded yet, but other role accounts at AT&T also take the form of rm-something@ems.att.com.

RMX is RIP?

[Nonesuch]

Autopr0n writes:

Hopefully RMX will get off the ground soon, so we can all do this automaticaly.

That's what I was thinking, but it looks like RMX is dead in the water, the link to the memo from the IETF ASRG website goes 404.

Looks like TLS (SMTP over SSL with client and server certificates) is our only hope. I was at a recent Open Group messaging conference (formerly X.org) where the main topic was spam, and there is definitely interest in this approach.

Re:RMX is RIP?

[__past__]

Sorry, I still don't get how certificates would make anything better. It is either the same kind of capitulation like this whitelisting is if you manage the certificates you trust yourself, or mostly useless if you depend on some root CAs - given that about 85% of the spam I get comes from machines that are technically allowed to send mail to me, but are an open proxy or relay or simply cracked, certificate validation buys you nothing.

It would be a useful defense if spammers would routinely try to impersonate legitimate hosts by IP spoofing or something, but alas, they don't.

/. becomimg a forum for idiots, not nerds.

[Anonymous Coward]

I gotta say, there seems to be a growing number of uninformed idiots commenting on stuff they have no idea about.

This topic is one perfect example, no one reads the article and no one seems to understand SMTP mail. /. is becomimg a forum for idiots, not nerds.

Re:/. becomimg a forum for idiots, not nerds.

[Anonymous Coward]

That's what happens when you start an Apple section on your site.

Cognitive Dissonance...

[krystal_blade]

Gee, our Slashdot readers literally pine for a similar setup within the community to combat spam, using items such as "trusted" lists, etc...

The whims and ideas of a these slashdotters still doesn't account for the fact that most of the load from SPAM still has to be handled by the carrier. First to store it in the mail server, then to delete it. AT&T is simply negating the need for those two steps.

Of course, some mail might not make it through. And of course some SPAM might make it through.
But, given that spammers routinely forge headers, a simple query can block them.

For instance, Joe Spammer, who has an account at www.taiwanopenspam.com (or a cracked server) starts kicking out mass emails. He can't keep it up for long without forging his headers. When he does, a simple DNS lookup for www.forgedheader.net will either return a negative value (in which case the mail is blocked) or an IP address that does not show up on the whitelist, and is therefore, blocked.

krystal_blade

Gee, sounds like SPF.

[Inoshiro]

Sender Permitted From, a handy little concept whereby DNS servers for domains publish lists of what servers are vouched for, so to speak. By only accepting email from servers which implement SPF, you reduce spam a lot. With SPF, if anyone is doing spam, it's very traceable and prosecuteable. You also cut down on people trying to fake identities.

If everyone implements SPF, it'd solve this problem in a fairer way.

please add my IP address:

[Anonymous Coward]

10.0.3.47

Whitelist?

[Nonesuch]

I can't believe they aren't going to do a black list instead of a white list.

AT&T has had their own private blacklist running for months, I hear it doesn't work too well. Too many false positives and false negatives.

Another thought is that perhaps AT&T EMS is planning to subscribe to Vixie's RBL+, and want to first whitelist all of their customers, to prevent legitimate customer email from getting blocked by an overly broad stroke of the dynamic blacklist...

Re:Good grief Mod Parent UP!

[ratfynk]

Right on, that is the best description I have read about the whole premise of OSS security, through source transparency!

SOLUTION.

[Anonymous Coward]

All you need is...

One Mail Server to rule them all.

One rules list to filter them by.

One DNS server to bind them in MX records.

I say to hell with all these independent mail servers... all the Internet email should flow internally in one server to all users. Yes this is truly ridiculous on a technical/political level but it would stop spam quickly.

abuse@att

[Anonymous Coward]

From: MAILER-DAEMON@dontspam.com
To: complainer@dontspam.com
Subject: failure notice

I'm afraid I wasn't able to deliver your message to the following addresses.

abuse@att.com:
12.20.58.70 does not like recipient.
Remote host said: 550 Your IP is banned and we do accept spam
from you, please contact AT&T by phone for assistance.

--- Below this line is a copy of your message.

Return-Path: complainer@dontspam.com
From: complainer@dontspam.com
To: abuse@att.com
Subject: SPAM COMPLAINT
Date: Wed, 22 Oct 2003 06:14:35 +0000

Dear Sir/Madam,

Attached is a spam message which appears to be sent from
IP addresses allocated to your company. We have received
over 1,000 of these messages in the past week.

Please take action and stop spamming our site immediately!

The Postmaster.

----- Original Message -----

Received: from mail.bogus.com ([211.110.179.73])
From: "haggett" 02yrpelaf@thredrkinet.net
To:psmith@dontspam.com, fbloggs@dontspam.com,
tjones@dontspam.com, abuse@dontspam.com,
postmaster@dontspam.com, everyone@dontspam.com
Subject: ~do not overpay for calls LWEK
Date: Wed, 22 Oct 2003 01:13:20 -0400
X-Mailer: Bulk Super Mailer v2.1a

PaYiNg ToO MuCh 4 LONG DISTANCE PHONE CALLS? AT&T
CAN SAVE YOU **BIG** MONEY. CALL NOW, DON'T DELAY.

This is a one time mailer and you do not need to unsubscribe.

DISCLAIMER: This E-mail is not SPAM under the Federal Regulatory
laws of the United States. This message is being sent to you in
compliance with the proposed Federal Legislation for commercial
e-mail (H.R.4176-SECTION 101 PARAGRAPH (e) (1) (A)) and Bill
s.1618 TITLE III passed by the 105th US Congress.

If you have received this email by error, we sincerely apologize
for any inconvenience.

Which AT&T customers got the letter?

[Nonesuch]

Could anyone tell me if this letter also went out to customers that manage their own IP nets but buy upstream connections from AT&T. For example, ISPs that are LIRs for their own nets.

I believe that AT&T customers who only use AT&T for transit (have their own AS and portable IP blocks) also received the letter. Only other way I could have gotten it is based on some old DNS registrations delegated to AT&T...

Took me a bit to figure out what "LIR" (Local Internet Registry.) refers to, since I've been out of the retail ISP game for many years. Turns out, "LIR" is not very clearly defined, it just means an ISP to which IP space has been allocated?

HP as well

[Anonymous Coward]

HP is blocking email from all kinds of servers, including some quite large ISPs. The result? HP staff are relying more on private email accounts. Banning them from using private accounts at work will not succeed because of hot desking. So the risk of crap getting in via a remote notebook attached to a VPN goes up.
And these are the companies that are supposed to have a clue. What about the rest?

Get real

[FutureShoks]

It really bugs me when a whole lot of SlashDotters turn around and say: "we need to dump this and switch to this" or some other stupid notion. There is no way we can suplant SMTP - it's too pervasive. We can help cut down a large proportion of spam but actually using what we already have properly:

[1] Configure your reverse mappings for your Internet-facing machines properly. That way we can start checking on reverse lookups which would stop Joe Lusers Windows box on DSL being turned into an SMTP engine.

I know that people can trivially configure their own DNS servers and spoof the forward and reverse mappings, but at least there needs to be an administrative contact on the SOA record and on the WHOIS information; which is something

[2] Get rid of the un-needed use of HTML emails. There is no need for half of the formatting and dross in emails. ASCII does just fine, and provide a link to a website if you need to woo people with eye candy.

[3] Undo some of the supposed "intelligent" behviour of email clients. They should display text first, and do everything else (play sounds, render HTML) as a user-invoked extra

[4] Make it a "must manually do" option to allow SMTP servers to allow relaying from anything other than their internal interface and IP range. Too many products come too open out of the box

[5] Use the TXT record or something similar for SMTP servers to list which domains they serve. That way receiving servers performing a forward/reverse lookup for verification will also be able to see if the domain in the email has been spoofed.

Snoogins

[Channard]

It would be nice if some VOICE speaking for the INTERNET would just say "Were not taking this shit anymore and were gonna nail you little bitches! ".

Hang on.. that sound familiar. Jay of 'Jay and Silent Bob' is in charge of the internet? That explains a lot.

It's probably for mail to employees, not ISP mail

[Anonymous Coward]

I'm guessing from the names in the announcement that they're not talking about sending email through AT&T the ISP att.net, but sending mail to employees and other email addresses at AT&T the company, att.com , and that they're about to do something to their spam filters that will trash lots more mail than before.

Disclaimer: I'm an Anonymous Coward impersonating an AT&T employee, and this is the first *I've* heard of it.

I've said it before...

[zantolak]

Here.
It's beginning.

Too late!

[jarran]

We're already there. I've been running my own mail server on my ISP connection for a few years. A few months ago this became completly untennable, and I had to go back to my ISPs slow, unreliable server.

Why? The sheer number of servers that were refusing mail from me because my IP was from an ADSL pool.

The Internet has already been de-democratized, long ago.

As long as I get spam from or profiting by...

[Anonymous Coward]

mypharmacydirect.net, who use nameservers with names such as ns1.spamhaussucks.com and ns2.spamhaussucks.com, and the registrar, JORE-1 (?) allows this...

How much did Chinanet and the Hunan Data Communication Bureau No.9 get paid to house a spammer?

Is it any wonder that it is a good idea to block all ips coming from China? And any other countries in Asia/former USSR/similar that you don't normally do business with or correspond with?

And should Germany be thrown into the blacklist for joker.com, possibly part of the spamhousesucks.com ring?

Bounty list

[Squashee]

Forget the blacklists. We need a bounty-list.

People/organizations having trouble with spam can send money to increase the bounty on spammers. All we have to do then is wait for someone to "fix" the problem and cash the bounty.

What about signing emails (PGP etc)?

[iion_tichy]

Wouldn't that be the better/cleaner solution? I suspect ip addresses can be faked, so it's easy for spammers to make the whitelists useless.

Also, what's next, are we supposed to put our mail servers ip address on our business cards?

Re:What about signing emails (PGP etc)?

[Anonymous Coward]

PGP will never work. Even the simple e-mail interfaces are much too complicated for the average user.

What if this was opposite... And voluntary...

[oasisbob]

This may be a really bad idea, I've been trying to keep up with anti-spam tactics as long as I can remember, but I'm no expert in them. Nor do I claim to remember everything ever discussed about them. I think my idea is new though.

What if, instead of making an obligitory whitelist, one made a voluntary centralized blacklist. I work at a university, and we are having more and more problems with students sending spam from their no-longer-secure computer. We're working on several different solutions. (Education is the obvious one, but is futile for a certain percentage...) The bottom line is that the IP addresses on our student network should not be sending email. What if there was voluntary system where one could just enter in a range of IP addresses, convirm via email queried from whois records, and blacklist them? (We have more liberal policies, so we would allow students to opt-out.) Seems like that's already happening on a much cruder scale when mailservers blocklist DSL ranges.

Re:What if this was opposite... And voluntary...

[vidarh]

So why don't you just block outbound access to port 25 on your routers? Not exactly rocket science...

Balkanization?

[gothicpoet]

I'll admit to being a little surprised that there aren't more people who are concerned that this could be a big step toward the much vaunted "balkanization of the Internet"...

A lot of sort of unrelated things have been happening lately that indicate an instability in the philosophical underpinnings of the Internet. It used to be that the idea of sealing off access to areas of it would be completely anathema, as much as the idea of someone doing something like Verisign's recent Sitefinder profit-play.

We're reaching the point where it's no longer considered completely out of the question to discuss blocking access to non-offenders. It's gone from being okay to block SMTP traffic from "non-static IPs" to being okay to block traffic from "anyone who's not on our exclusive list" within a period of months.

Verisign has done the previously unthinkable by modifying major functions of the DNS system without so much as a "by your leave". And having gotten their hand smacked, rather than admit any wrong doing, they are politicking in the media to lay the ground work for efforts to wrest complete control of the process. What will they decide they have a right to do next? And if they get away with it, what are other (backbone providers/ISPs/you name it) going to try to see how much they in turn can get away with?

And it doesn't look like too many people are thinking ahead to where these trends will go if not arrested. The Internet has functioned as well as it has for as long as it has because by and large the big players have all followed the rules, customs, and generally accepted way of doing things. If they all start to do whatever they please at the moment, will there still be an Internet?

Fscking hypocrites...

[Eggplant62]

AT&T three years ago were caught out when a "pink contract" they held with Ronnie Scelson's Cajun Hosting was brought to light by anti-spammers on news.admin.net-abuse.email. Now they're going to do something about the spam hitting their user's inboxes.

Less spam would hit their user's inboxes if they were to sever all ties with their pet spammers. It's my own hog-fucking opinion that AT&T still has plenty of pink paper over there and are still helping spammers to stay in business. However, money still talks the loudest. Those spam contracts usually bring double or triple the going rate to ignore complaints.

AT&T corporate or AT&T ISP?

[gothicpoet]

Is this just for AT&T's company network or is it for all ISP customers?

I read the linked email but it didn't seem to clarify that point... Seems important.

Re:AT&T corporate or AT&T ISP?

[Anonymous Coward]

It was any mail bound for an att.com domain.

When do the lawyers arrive?

[The Mutant]

Given the response by telemarketers against the FTCs Do Not Call List, how long before the first lawsuits are filed against AT&T?

Little Extreme

[Bruha]

I believe this is for the corporate network. Cant believe they're having such a bad time with spam they're resorting to this. I work for a large 50,000+ company and hardly any spam gets through.

Though we still have idiot employees who send chainletters through the system. Usually showing them the length of a unemployment line and the fact if they do it again they will make that line longer keeps them in line. *kidding* good threat though.

finally

[Anonymous Coward]

The spammers is about to win. The internet will become isolated islands that you need to have some sort of clearance to contact. I remember when the Net was still open. Bloody bastards are everywhere, with the clear intent on ruining the fun for everyone. One of these days we will find the first cases of beaten up or even killed spammers.

Bah, obviously there is a better approach

[dnoyeb]

OUTBOUND emails should _automatically_ have their recipient mail server added to the OK list.

And if your still skeptical record the email of the person that added it.

Re:Bah, obviously there is a better approach

[sqlrob]

And exactly how do you propose connecting the inbound and outbound mail servers? They don't have to be the same box and are frequently *NOT*

Re:Bah, obviously there is a better approach

[W32.Klez.A]

Then all it takes is one asshole who works at AT&T that wants to make a buck.

From: Beufort@mobile.att.net
To: Fatassspammer@worldmarketingspamlove.com

H0 H0 H0 HERE IS THE EMAIL SO THAT OUR BEAUTIFUL EMAIL SERVER IS ADDED TO THE WHITE LIST

THEY WILL RUE THE DAY THEY MADE THAT WHITELIST, THE BASTARDS

Re:Bah, obviously there is a better approach

[agentk]

I'm afraid that wouldn't stop the open relays and spam servers.

Of course, this whole thing would make my mail server useless, and I have no way of getting most of my mail.

We are becoming slaves to upstream servers... how much longer before my PC is just an expensive TV?

Re:Bah, obviously there is a better approach

[CowboyMeal]

Alright "sql rob", how about hooking them up to a third um... "DB" machine of some sort?

Re:Bah, obviously there is a better approach

[sqlrob]

And that DB is filled how? DNS doesn't have the records for outgoing.

If you already have the addresses, you don't need to do any of the automatic stuff, IT'S ALREADY DONE!

Sounds like they're adopting SMTP+SPF

[isoga]

Sender Permitted From seems like a pretty good idea for reducing spam. It doesnt block spam per se, but rather provides authentication of the sender's domain. ie/ no more spoofed emails from billg@microsoft.com.

This should reduce spam as it will be easier to track the spammers and hassle them with legal threats or at least get their ISP to shut them down. (Or black list the ISP) See the link above for the full details

dave
--> stuff

AT&T mum on the issue?

[Sublimed]

recently the company i work for has been working on a large project with AT&T. Suddenly out of the blue we were no longer able to send them email, but we were able to recieve from them. We were able to send to all our other clients without a hitch. We called AT&T and they told us everything was fine on their side, so we went and brought in a cisco consultant since we were unable to resolve the issue. a couple thousand dollars later we still didn't have an answer... Looks like this could be the cause, but then why did AT&T not tell us about this when we called?

No, _you_ are wrong in so many ways...

[isoga]

Read what they are doing!

They are not creating a whitelist of everyone who sends email to AT&T Customers - You are right that would be a mess

They are whitelisting their customers SMTP servers so no one can send spam FROM AT&T's network.

They are implementing a Sender Permitted From type of system

dave
--> stuff

Good idea, worth expanding.

[elliotj]

I like AT&T's idea, but suggest that all ISPs go one further: when a customer registers an SMTP server with them, the ISP should be required to check it to see whether it is an open relay at least once a day. If it finds that it is, it should automatically shut it down.

By requiring organizations to apply for opening SMTP from their ISP, and requiring ISPs to test these hosts to see if they're open relays, I think a lot of the spam problem could be eliminated.

And this could be enforced across international borders by ARIN, ICANN or IANA. Whichever body gives out IP addresses to ISPs could require them to implement this practice and pull their IP ranges if they fail to comply.

Would kill business E-mail

[nurb432]

If you are a business you cant know all the incoming servers of your future customers..

This would kill the concept of customer service for said company.. " they wont respond to my email screw them "

Something has to be done I agree, but not this.

The dinosaur is about dead

[Nerd4News]

Couldn't ATT scan their current email base for this same info? Sure it's going to take 1+ sets of human eyes to make sure an IP is legit but that's going to be needed anyhow to review the incoming requests to be added to the whitelist.

Lets take this one step further. Six months down the road I, a future customer, business partner or supplier to ATT whom has never heard of this policy, send them some email wanting LD service for Humongous Corp, to supply widgets at half their current cost or whatever and has its mail bounce or go unanswered. ATT is the big loser. Must be nice to be a company that has no need for additional customers or suppliers.

More info on the deep thinkers at ATT and other big businesses can be found in the book "The Innovator's Solution: Creating and Sustaining Successful Growth," by Clayton Christensen and
Michael Raynor. A review can be found at the Washington Post here (some non-personal info may be required before reading) (Remove obligtory Slashdot Extra Space(TM)):

http://www.washingtonpost.com/wp-dyn/articles/A3 21 78-2003Oct15.html

A small excerpt:

(The book) offers a funny look back at how AT&T threw away $50 billion in just over a decade on doomed identity changes.

After exiting the local phone market in 1984, AT&T first tried to become a computer company, buying NCR for $7.4 billion only to sell it five years later at roughly half price. Next it entered the cell-phone market by acquiring McCaw Cellular for $11.6 billion and sinking $15 billion more into improvements. But when AT&T spun off its wireless business in 2000, the new wireless entity was valued at a mere two-thirds of its investment. Then came the disastrous cable bet: A few years after forking over $112 billion to buy TCI and Media One, AT&T unloaded those assets to Comcast for $72 billion.

Yup, the dinosaur is about dead.

Yeah.. that'll work...

[iceT]

The adminsitrative overhead along of customers/partners/suppliers changing ISPs, moving mail servers, and etc.. will pretty much insure that AT&T mail will NOT be reliable.

Sender Permitted From Anyone?

[WareW01f]

So here is an excellent chance to push SPF on the masses. It solves the problem of maintaining lists. Simply tell the customers that if they don't have the excepted mail servers listed in their DNS record, the mail will be refused.

Back to UUCP

[Avardan]

Heh, glad I still remember how to configure uucp. I'll just teach my mom and close friends how to use it and we'll have spam-free email courtesy of Ma Bell! /flex

Baloney. This is the future.

[kryzx]

I couldn't disagree more. This is the future of email. It's the only way to solve the spam problem. This is the way to control you own email; namely, to control who is permitted to send you messages.

Your pronouncements of doom and gloom don't wash. There is no reason to assume that if you are not *on* the whitelist you can't *get* on it. There are any number of ways to manage this sensibly.

Just as a couple examples, consider existing systems that it could be modeled after:

1) You want to join a mailing list. You send a "subscribe" message to the list owner. He looks at it and approves you, then you are able to mail to the list.

2) Many phone systems have a service where anonymous (caller ID blocked) calls hear a message saying that number doesn't accept solicitation calls, then they have the option to state their name, the name is then played for the recipient and they decide whether to take the call.

Just starting from these I can envision several ways to manage whitelists. Maybe anyone who sends a message and is not on the whitelist gets an automated reply (to the "reply" address) inviting them to send request to be put on the whitelist. The message could include some kind of text-in-image Turing test to make sure only a human can submit the right code. Valid requests would be presented to the recipient, who would decide whether to add them to the whitelist. These requests could easily be identified and treated different from normal emails.

Another interesting point is that you could start by getting a trusted whitelist from some organization, then customize it to your own needs - remove mail servers that seem to be problematic, add known trusted servers, etc. And any message you get would come with info about the mail server it came from.

If reasonable systems were set up to do this it would work. I'd used it immediately.

Fragmented, Unreliable System...

[Anonymous Coward]

The Internet will degenerate into a fragmented, unreliable system...

That pretty much describes what the Internet has always been since day one.

ATT says:

[Chatmag]

According to the recording at the 800 number supplied, this was a draft email that was sent out prematurely.

Quelch is not a word!

[nothingtodo]

Who writes these stories? The writer should have either used quench or squelch, but not try to make up one word out of two. Reminds me of people who get 'flustrated'. You are either frustrated or flustered, but not both.

Re:Quelch is not a word!

[Chatmag]

It may not be a word, but it is a name. John A. Quelch is the Lincoln Filene Professor of Business Administration at Harvard, and has an educational program on PBSyou TV.

Re:Quelch is not a word!

[rrgmitchell]

The most famous Mr Quelch was fat public schoolboy Billy Bunter's teacher in the (once) very popular series of stories by Frank Richards. See the 1950s TV show.

Re:Quelch is not a word!

[Principal Skinner]

The writer could have been thinking of "quell" when coming up with this word, as well.

The sad thing is, I myself submitted a story for Slashdot in the last 36 hours, with spotless grammar, clear writing, and cromulent vocabulary, and it got rejected, yet this guy's gets through.

Re:ok enough is enough!

[Anonymous Coward]

And you deserve to fucking die for being part of the problem, then telling us it's our own fault.

Thanks for using your realID at least, I'll be sure to add to my enemy list.

We do it, too

[wompa70]

My old company provides satellite access to the US internet backbone. The cost is way more than a US company would pay, but third world countries don't have the infrastrusture to match the speed. Anyway, because of the overabundance of spam, we require our customers to register their mail servers and SMTP is only allowed from those mail servers. This has cut down spam complaints significantly. That's not to say it doesn't happen, but when a complaint comes in, we know who to contact to stop it. If it continues, we cut all mail from that address.

I think that this is only for *outbound* traffic

[A.Gideon]

In reading the original message (included at the bottom of the later message), I think that this has nothing to do with inbound spam. Instead, I believe that AT&T is about to block its clients from accessing port 25 on servers other than those in a defined list.

This doesn't address the problem of AT&T users receiving spam (except indirectly). Instead, it is addressing the problem of AT&T users sending spam. More likely, this is addressing the problem of poorly configured and virus-infected machines belonging to AT&T clients being used as relays of spam.

This is likely in response to the "stealth spamming" that's becoming more popular: hijacking machines via virus for use as SMTP relay, DNS server, and web server. [For those interested, there's been a fair bit of NANOG discussion of this recently under the subject of "Wired mag article on spammers playing traceroute games with trojanedboxes".]

Parent is right

[swb]

If we only took the time and effort to enforce the pre-existing laws on the books against fraudulent business practices, selling schedule II and III narcotics without a prescription, securities fraud, piracy, etc spam would lighten tremendously.

Unfortunately our present administration is only interested in prosecuting "terrorism" and anything that vaguely represents business gets a pass.

Our government, unfortunately, has a long history of tolerating fraudulent business practices couched as "aggressive sales practices" -- frequency alone isn't the reason people are pissed at telemarketers, it's the government's total denial of the scope of fraud and sleazy practices and the piss-poor resources devoted to those agencies that actually try to do anything about it (and the resource squeezes are totally political, as industry lobbyists work to starve fraud enforcement "because it hurts business.")

Quelch?

[belchingjester]

I think he was looking for Squelch or maybe Quash. Quelch ain't real.

NEVER BOUNCE SPAM

[John Hasler]

> I've found that if I bounce back every piece of
> true spam I get.... ...You blast people like me whose domains are in the forged headers of the spam with bogus bounces. About 1/3 of my email consists fo such useless bounces.

_NEVER_ _BOUNCE_ _SPAM_. The headers are always forged.

The true cost of spam

[KMSelf]

Ain't that the truth.

There are a few "true costs of spam" I'm seeing. One is as you point out, Balkanization (and I'm still stuck by the AOL issue, though at least I can mail by a secondary route). One is people cut off from other groups by arbitrary blacklisting policies. And yes, many of us (/me raises hand) cheered the same action when used against foreign ISPs with large spam volumes, though I still maintain that there's an important distinction between strongly prodding ISPs to clean up their act, and arbitrarially shutting out large portions of the 'Net.

Another is that the typical user is rapidly getting chased off the 'Net. Exposing your address anywhere is an instant invitation to not only spam, but viral spew, which in my experience is many times worse. Even on bad days, spam is ~150 messages. I've had 2000+ viruses at peak of Swen and SoBig, friends report far more. POP mail over dialup is simply impossible in this situation. Most of your inbound mail bounces because your inbox is full, and you spend all day downloading crap. SMTP-time, user-controlled, accountable, accurate, and effective spam and virus filtering is no longer optional. I've been trying to drill this point in to my brain-dead ISP. Usenet discussions in their forums have been obsessed with Swen.

This also means that the likelihood for people to engage in open discussions, under their real identities, is being harmed. On the debian-user and other mailing lists we've seen endless discussions over the past several weeks by people who participate and then get flooded by spam. The lesson: don't participate.

And anyone with well-advertised, long-established email addresses.... Peter G. Neuman of the comp.risks archive runs SpamAssassin over list mail and still has 90% spam in the list mail, after filtering.

I still have hopes that we can dig out of the situation. As others note: when high-up execs start losing messages, I suspect AT&T's policy will slacken. AOL, as I've said, hasn't budged, however. Filtering is still largely effective, it just needs to be pushed further out to the SMTP transaction level. And I suspect that AT&T has a good idea, poorly implemented: MTAs themselves can keep track of spam and ham (non-spam) mail, and determine what mailservers they do and don't want to deal with. Current work with exim4+spamassassin integration is a long way toward this.

And yes, I'm the submitter of the AOL Bans Mail From DSL-Hosted Servers story.

Domain and IP changes.

[blanks]

What happens when a domain expires, and is picked up by a spammer?

Or when a domain is transferred to a new IP?

What about when a spamer sends spam through your mail server (using a exploit, worm, Trojan etc)?

What about spamers that send spam from AT&T accounts, to other AT&T accounts.

The article didn't really cover these pretty important questions. Ill have to see what my next statement says about this.

And new servers?

[Anonymous Coward]

That would really help people putting new servers up on the internet now, wouldn't it... I wonder how long it would be before anyone would actually accept your e-mail?

AT&T is pathetic

[gwhalin]

Yeah, this sounds like a great idea. I am beginning to believe that AT&T's net ops dept is filled with idiots. My office is subletting space off of another company and using their AT&T business DSL. Roughly 2-3 months ago, all ICMP out of our network stopped. So, I get on the phone with AT&T. After a lot of getting bounced around to higher and higher support people, I finally get a hold of someone who tells me that AT&T is now blocking all ICMP across their network "for security purposes". Brilliant. It is not as if ICMP is a useful protocol or anything. So much for any remote monitoring of our servers with a simple ping. So much for using traceroute or ping to debug simple network problems. Now they are intending to break SMTP. Seems that by 2006 AT&T will have blocked most all Internet protocols because they are "insecure". Can't wait until the brains at AT&T decide to block TCP/IP!

Cellphones Text messeges / email

[blanks]

This also affects Emails (and text messages) that are sent to your cellphone. ( With AT&T your cellphone you can have a email address that is your phone number).

shifting the burden to others ... the senders

[Skapare]

"Solutions" like this do little to stem the tide of spam, they only shift the burden to others.

Given that for every penny spent by spammers to send their junk, the cost imposed on recipients is several pennies (before even counting the costs of the time wasted just pressing delete if the spam isn't blocked), it is already the recipients who have the undue burden here. Of course senders really shouldn't be burdened, either, but then, we also shouldn't have spam but we do.

Spammers are constantly trying to make their junk look like legitimate mail. Senders of truly legitimate mail, however, will have to stay a step ahead of spammers and ensure that their mail is very distinguishable from spam. But as experience shows, things like the content of the message, and even that the sending mail server looks like a perfectly configured network, do not distinguish the sender very much at all. What AT&T is asking is that senders distinguish their mail servers to them at this point. By asking AT&T to whitelist your mail server, I presume they will grant you conditional trust. At this point, if you spam them, then they can remove you from the whitelist.

The real problem will be when every business, network, and even individual starts to do this. Imagine every time your IP address changes that you have to notify millions of other network administrators about it. What is needed is a central clearinghouse for this which is run by someone who can be trusted, and can be updated quickly. That would be like current spam blacklists, but inverted to be a whitelist instead. I've said as much as 5 years ago that we would be headed that way. It looks like AT&T has turned in that direction. Now we just have to make the whole thing manageable and scalable.

Are they really lax?

[Anonymous Coward]

I heard this all the time when researching RackSpace and other service providers. (Oh no, here come the hordes of knee-jerk anti-RackSpace folks who are treading in the past... spew your venom elsewhere, RackSpace is not the real point of my argument here.)

The main problem I found is just the sheer volume of spammers signing up for accounts. And the fact that these spammers also sign contracts with the providers that cannot simply be broken by the provider, there must be proof provided of spamming, due process, and the account cancellation. Otherwise the provider faces lawsuits.

And let me say this ... as a legitimate, non-spamming company that sends out huge volumes of email to our members that request this email (we manage many lists), I am *GLAD* RackSpace doesn't just "cut the cord and ask questions later." We have seen first-hand invalid spam reports against us. Either by pissed off competitors, or by clueless people that received a copy of our email from one of our members that was infected with a virus.

But I digress...

From the 'public' side, if RackSpace kills 5 spammers a day and 5 or more sign up a day, it appears that RackSpace is a spam haven, even though they are cancelling accounts left and right. What else can they do? The anti-spam zealots, frothing at the mouth, spew forth truth
and lies mixed together to paint the awful picture
that they want of any company that hosts any spammers whatsoever, irregardless of whether that company kicks them off.

(Can you tell we hate the blacklists like SPEWS?)

Should we legislate morality, also?

[Anonymous Coward]

As long as our governments are only willing to enforce the laws that make them money, the problems that plague our society will continue.

I am all for making spamming illegal -- it has a negative affect on people outside of the spammer.

But the argument above used is extremely weak, and is the kind of thing someone would say to prohibit alcohol consumption, keep gays from being legally married, ban abortion, etc...

Yes, a web of trusted mail servers is needed

[Skapare]

Yes, a web of trusted mail servers is needed. The problem is that there still needs to be some quick way to revoke the trust. You know spammers will set up decoy ISPs, get them whitelisted, and eventually use them to spam. However long the revokation process takes, that's how long they get to spam. And they won't stop at just one. Many spammers are known to have many colocation or high speed access accounts ready for when they get disconnected so they can rapidly shift over to green pastures and keep the pink blob rolling.

It looks like the day is coming where we "blacklist" 0.0.0.0/0 (the whole internet) and then whitelist what you trust, or what someone whom you trust trusts. DNS based whitelists may be where we go with this. But we do need to find a solution to the obvious problem of a whitelist which is that if the name servers go down (such as due to massive DDoS attack by spammers), mail stops flowing. While they did attack DNS based blacklists to cause them to either be unavailable so the spam would get through, or in some cases be permanently shut down, the could just as easily attack DNS based whitelists to make them something people won't want to use (because that attack cripples email entirely). Since DNS based whitelists are in a better legal position than blacklists, it may be easier to get a lot more companies on board and make it so widely distributed that DDoS attacks will be ineffective.

many tools out there

[cball2k]

Found that Xwall, stops most of the spam from reaching our servers. No need for another protocol, but I recommend not using the open relay list as part of the filter. So many of the recent viri have caused even lans without an actual email service, to be placed on the list. Cheap and easy to configure. I am sure others have tools that help on the server level.

Re:Hypocritical--ATT is a major Spam Service Provi

[wantknowledge]

I thought the same thing but about their use of telemarketing or unsolicited phone calls. Apparently what is good for the goose is not good for ma bell.

Re:Hypocritical--ATT is a major Spam Service Provi

[obstreperousness]

I am network admin for an ISP, and I manually block many domains and IPs that I deem to be spam sources. Unfortunately one of the biggest offenders has been attbi.com, AT&T Broadband. At the moment, our mail server accepts no traffic from attbi.com. And I have gotten a handful of complaints from customers who can't get mail from Grandma or whoever. But what alternative? - there were times in the past when hosts in attbi.com would pump tens of thousands of garbage messages into my mail queue a day and seriously impact the delivery of legitimate mail. Multiple-hour or day-long delays for mail delivery is totally unacceptable. I tell people that their acquaintence using AT&T broadband needs to complain to AT&T. I know that if I find a customer of ours spamming, I not only disable their service, but verbally berate them. It's abuse of service, and AT&T needs to watch who plays in their pool too.

Re:Hypocritical--ATT is a major Spam Service Provi

[Anonymous Coward]

AT&T no longer has a broadband ISP. attbi is owned by comcast, and is not affiliated with AT&T.

Use dnsreport and check for errors...

[kandresen]

Usually if they don't accept your mail, it is because you have configured the mail-server wrong. You would be surprised to find how many mailservers that have wrong reversed DNS lookup routies etc.

Check your mailservers domain address with DNS report and act accordingly.

You also might want to follow up checking if your domain is blacklisted using the spam database lookup at .

Mailservers may are for certain getting harder to run, but the little guy can still play if he really want to go through all the now required steps...

inbound != outbound

[Corgha]

OUTBOUND emails should _automatically_ have their recipient mail server added to the OK list.

So you add mailin.mx.domain.com to your whitelist, but that domain sends all its outbound mail from mailout.mx.domain.com.

This is an extremely common setup on large sites, because inbound and outbound mail have totally different requirements. Once you need more than a couple of mail servers, it makes sense to separate them so you can use the right tools for each job.

Inbound mail servers need to accept SMTP connections from the Internet, need to filter mail, don't need to canonicalize or masquerade addresses, and need not to allow relaying or SMTP AUTH. They should probably be put in a DMZ, since it's accepting internet connections. They could probably benefit from fast spooling devices to handle sudden increases in incoming traffic.

Outbound mail servers need not accept any connections from the Internet, and need not filter mail (unless one wants to be nice). If they are accepting submissions directly from your clients (rather than that being delegated to a third set of servers), they need to perform address canonicalization, masquerading, and other header munging, and they need to allow relaying from a set of IPs and/or allow SMTP AUTH. They probably need more spool space, and possibly structured queues, to hold delayed mail.

It's a ridiculous assumption to make that servers performing these two distinct tasks would be using the same sets of IP addresses.

If you make that assumption, and start blocking mail based upon it, you will find that you are no longer able to receive mail from AOL, Yahoo, and other large mail providers. That's not going to make your users happy, and if you're a professional mail admin, blocking vast amounts of legitimate mail is a good way to be forced into a career change.

a value added service?

[Anonymous Coward]

Interesting feature of being connected through AT&T is the free firewall they provide. Unfortunate that it only applies to port 25, but hey .. you've got to start somewhere, right?

No really, this is not as much of a bad idea as it is a bad place to do it. These filters should be pushed out closer to the edge of the network where administrators can make the call about what is permitted into their own network. Yes, most sysadmins are painfully clueless and that translates into cost for their employers ... but you get what you pay for (to wit: slashdot).

attbi != att

[Anonymous Coward]

AT&T Broadband no longer exists, and attbi.com is not AT&T. It's Comcast.

Confusing, yes, but that's how things go these days of spinoffs, mergers, and acquisitions. (AT&T spun off their broadband division, which bought a bunch of people, got involved in the @Home fiasco, and was in turn bought by Comcast. The domain name is just there because of inertia -- all the attbi.com customers send their checks to Comcast.)

You can, BTW, block most spam from ATTBI while preserving most legit mail by blocking just client.attbi.com and client2.attbi.com, instead of the whole attbi.com domain.

Why whitelists won't work.

[AnotherBlackHat]

There are an estimated 10 million mail servers in operation right now.

The average life time of an IP for a server is approximately 1 year.

If the whitelist was comprehensive, it would require around 25,000 updates per day.

If updates are automated, then spammers can add themselves.
If updates are checked by a human, then you'd need a staff of about 100 people working full time doing nothing but verifying the IPs.

In the AT&T case, they might limit the list to 10,000 servers or so.
That's still a couple dozen updates per day, which means at least a part time employee who does nothing but update their white list.

Either employee's will start using their personal email addresses for work related email,
or AT&T will give up on this PHB idea.

-- this is not a .sig

Re:Why whitelists won't work.

[Nonesuch]

There are an estimated 10 million mail servers in operation right now.

The average life time of an IP for a server is approximately 1 year.

Please provide a source for your numbers.I find the above to be rather questionable.

In my experience, corporate and large ISP outbound mail gateways do not move around much, if at all.

Also, the AT&T whitelist effort appears to be targeted at their current existing IP connectivity customers, which is a much smaller pool of addresses and servers than the Internet as a whole.

Re:Why whitelists won't work.

[AnotherBlackHat]

There are an estimated 10 million mail servers in operation right now.

The average life time of an IP for a server is approximately 1 year.

Please provide a source for your numbers.I find the above to be rather questionable.

The 10,000,000 servers estimate was made by attempting to connect to 10,000,000 random non-bogon IPs on port 25.
Approximately 50,000 responses were received.
Ignoring bogons, there are approximately 2 billion IPs, for an estimated 10,000,000 servers.

While not perfect, (a sending mail server doesn't necessarily listen and vica versa) It's a reasonable assumption that IPs listening == mail servers.

Repeating the poll after one month later with the same set of IPs resulted in approximately 50,000 responses, but approximately 4,000 IPs that had previously responded didn't, and 4,000 new servers that did.

Hence, I conclude that the average life of a server is 1 year.
Obviously many servers will change more often, and many change less often.

If you'd like to repeat the experiment, I recommend you set syn retries to 1
(echo 1 > /proc/sys/net/ipv4/tcp_syn_retries on a linux system)
since the vast majority of IPs (even discounting bogons) do not respond in any way.

-- this is not a .sig

Re:Why whitelists won't work.

[Nonesuch]

In my experience, corporate and large ISP outbound mail gateways do not move around much, if at all.

Also, the AT&T whitelist effort appears to be targeted at their current existing IP connectivity customers, which is a much smaller pool of addresses and servers than the Internet as a whole.

Re:Hotmail isn't a problem

[thedillybar]

When is the last time you've gotten spam from hotmail.com, yahoo.com, or any other popular free service like this?

I've gotten plenty forged email headers that show hotmail.com and yahoo.com, but I've never gotten a spam message from either. Why? Because if 1 (ok, maybe 2) people report the account as spamming, it gets canned.

Accepting mail from these services will not pose a serious spam threat. At least until spammers can create a script to create the accounts and send the spam. Sites like Yahoo and Hotmail are actively trying to prevent these (to get their ads through to the real customers, if nothing else).

Prove this is ATT

[Anonymous Coward]

uh guys, how do you know that email comes from ATT? Don't you think it's a little ironic that here we are debating the problem of people faking emails and taking seriously some random email?

Go ahead and reply, you may end up putting your IP's on a Preferred Sucker list for some worm writer.

AT&T says they aren't going whitelist only

[sami_sdata]

Just saw this email.

Date: Wed, 22 Oct 2003 14:43:59 -0400
From: Steve Bellovin
To: nanog@nanog.org
Subject: Re: Heads-up: AT&T apparently going to whitelist-only inbound mail

AT&T STATEMENT - CURRENT SPAM ATTACK - 10/22/03

AT&T and a number of other large companies have seen a marked
increase in the amount of incoming SPAM in recent days. A team of
experts that includes members from AT&T Labs, Network Services,
and Corporate Security has implemented a number of procedures to
remediate this situation and minimize its impact on those trying
to send e-mail to "att.com" addresses.

As of this morning - Wednesday, October 22nd - the level of incoming
e-mail messages is returning to normal and the situation appears
to be well in hand. Although all AT&T e-mail servers are fully
operational at this time, some incoming messages are experiencing
intermittent delays as SPAM filtering continues at all network
gateways.

Customers who received e-mail bulletins from AT&T Monday and Tuesday
requesting specific information are advised to disregard those
messages. They were inadvertently sent out in error and we apologize
for any confusion or inconvenience they may have caused.

Network reliability is one of our top priorities at AT&T, so for
obvious reasons we will not be providing more detailed information
regarding the specific security procedures implemented to curb this
SPAM attack. We have no intention of helping those who generate
this type of computer and Internet mischief.

No problem, if ISP doesn't do its job, its fired

[Anonymous Coward]

If my ISP blocks any of my traffic, I'm switching to another ISP. If all ISPs block traffic, I'm going with wireless, packet radio, etc.

Using SSL(TLS) and signed SMTP client certificates

[Nonesuch]

Sorry, I still don't get how certificates would make anything better. It is either the same kind of capitulation like this whitelisting is if you manage the certificates you trust yourself, or mostly useless if you depend on some root CAs - given that about 85% of the spam I get comes from machines that are technically allowed to send mail to me, but are an open proxy or relay or simply cracked, certificate validation buys you nothing.

Encapsulating SMTP in SSL has other benefits (Carnivore-proofing, etc), the primary benefit of requiring a SMTP client present a valid certificate signed for that client source IP by a trusted CA is that the average open proxy or cracked desktop PC would not normally have a signed certificate available.

The use of certificates give a number of options -- you could trust the usual root CAs, and you could also choose to trust certificates that you yourself sign, or signed by some other trusted third party. Somebody like MAPS or SpamCop or AT&T could provide signing services, offering to sign for a fee, for a bond, or (getting back onto the current AT&T topic) only sign for their customers and partners.

It would be a useful defense if spammers would routinely try to impersonate legitimate hosts by IP spoofing or something, but alas, they don't.

However, spammers routinely do try to turn ordinary personal broadband-connected PC's into spam-transmitting SMTP clients, and these would be machines that would not normally have a valid "SMTP Certificate" assigned to a static IP (if they have a static IP at all), and thus would not pass even the most basic trusted client certificate check.

Hackers who build up a zombie army of hundreds or thousands of compromised Windows hosts are not likely to go out spend $$ to purchase a signed certificate for the (short-lived) IP address of each zombie.

Corporations who manage a couple (or a couple dozen, in the case of AOL) separate outbound SMTP gateways would likely not have a problem with paying a few bucks per server to have them "bonded" by one or more CAs. Abuse the privilege and you forfeit your bond.

Mandatory PGP/GPG signing is the solution

[Nonesuch]

Public key cryptography (PGP, GPG, etc) can address many of these concerns -- simply refuse to accept mail unless it is either:

• Encrypted with your public key
  -or-
• Signed by one of your "trusted signers" using their private key.

The first requirement allows any random stranger to send email to you, if they are willing to put in the extra work and CPU cycles to obtain your published key and encrypt with it. This knocks out the broadcast mass spam mailings.

The second requirement provides a workaround for legitimate mailing lists and other broadcast messages -- when you sign up for a mailing list or sign up for Aunt Martha's christmas letter, you can add them to your list of trusted signers.

The major problem remaining is how to get the Aunt Martha's of the world to start using PGP/GPG...

ATT has admitted they screwed up.

[JuggleGeek]

Quote from the article, link shown below for the whole thing.

Human Error Leads to AT&T's Anti-Spam Gaffe

Telco giant AT&T (Quote, Chart) on Wednesday rushed to withdraw two notices sent to business partners and customers asking for the IP addresses of all outbound SMTP (define) servers because of a "human error" gaffe.

With a significant increase in incoming spam over the past few days, AT&T sent out the notices demanding the IP addresses, presumably to create a white list of gateways from which e-mail will be accepted. But a company spokesman now says customers should ignore the requests.

"Those e-mails went out in error. They never should have been sent. We have apologized and we're requesting that customers disregard them," AT&T spokesman Dave Johnson told internetnews.com.

"It was an honest human error. Sometimes, folks makes mistakes," Johnson said.

Details here.

They were getting spam flooded for a couple days

[Anonymous Coward]

What they're now telling their customers is "Sorry, that message was sent by mistake, and we've decided to use other approaches to the problem". They were getting a huge spam flood that was overwhelming their spam filters (this was for incoming mail to the company, not for any of their ISP services) and real mail was getting delayed a long time and possibly lost. Apparently a lot of this was bouncegrams replying to joejob spam that was forged as from randomnames@att.com. So they evaluated a policy of whitelisting known customers and suppliers so they could handle mail from them immediately, leaving everybody else's mail getting extra processing from the spam filters which might still delay or drop them. Somebody wrote up a draft message to send to customers to get them on the whitelist, but they decided to take other approaches to solving the problem, but somebody had a failure to communicate and sent the message out anyway. Fortunately, the spam flood seems to be subsiding or squelched or both, though there's still some delay in delivering mail from outside.

Disclaimer: This isn't an official AT&T statement, I'm not a lawyer or even wearing a tie, and the *real* Anonymous Coward actually works at a different office.

Didn't Affect ISPs, just mail to ATT Employees

[billstewart]

While they decided not to implement this, and the message was only a draft (badly written, at that), it didn't affect inbound or outbound AT&T ISP mail. It only affected mail to AT&T employees and other addresses on AT&T's internal mail servers. If you're a business or consumer customer of AT&T internet service, it wouldn't have affected whether you could send or receive mail to other companies.

What it did was affect whether or not mail you sent to joe.random.employee@att.com got heavy spam filtering (on the mail servers that were getting pounded to death and might lose mail) or whether you got sent to one of the servers that did less spam filtering and wasn't getting pounded.

So even if a few spammers got themselves whitelisted, that wouldn't be a big problem because the filtering can handle them (plus they'd be coming from known IP addresses which could be blocked or de-whitelisted). But for some customers who are ISPs or email providers, it's a lot tougher to do the job right - they'd really want to

• permit email from sysadmin@bigisp.example.net to wholesale-fiber-sales@att.com
• deny forged email pretending to be from got.viagra@bigisp.example.net that really came from some hijacked Korean relay
• do some filtering on email from joe-random-user@bigisp.example.net to random-employee@att.com

and it's hard to do that really well.

I don't like RMX

[billstewart]

Unfortunately, it seems that the people who run my main email ISP seem to really like it. :-) There are some people who really always send email from the same set of servers, so it's ok for them to use RMX to indicate the fact, but for people who don't do that, it's likely to lead to lead to lost email.

Sometimes my laptop is at work and I want to send email from my home email account. So I tell Eudora to use the SMTP server at work and it works fine, but the mail gets sent from my company's DMZ outbound mail server, rather than from my ISP's outbound mail server. RMX would break that. Other times my laptop is at home, and I want to send email with my work IP address, but that's easy, because I use a VPN tunnel to connect to my office, so it gets sent from our usual email server. (Sometimes my laptop is at home on the VPN, and I want to send email from my home account - that case looks like I'm sending it from the office...)

Sure, I could use some lame webmail form at my ISP to send email from, but that's really annoying, especially if I'm replying to a message that I've received on my POP3 or IMAP email client rather than composing a new message.

Blacklists vs. Heavy Filters vs. Bandaids

[Anonymous Coward]

While it was apparently a bandaid that they were evaluating and decided not to deploy, the big problem was that the level of spam they were getting was overwhelming their current spam filters, so real email was getting dogged down into unreliability anyway. The alternative to blacklisting is to do heavier filtering on people who aren't whitelisted (and lightweight filtering or monitoring even on people who are...)

Article with AT&T Response

[Anonymous Coward]

Internet News Interview with AT&T Spokesperson titled "Human Error Leads to AT&T's Anti-Spam Gaffe".

"Those e-mails went out in error. They never should have been sent. We have apologized and we're requesting that customers disregard them," AT&T spokesman Dave Johnson told internetnews.com.

"It was an honest human error. Sometimes, folks makes mistakes," Johnson said.

Re:Using SSL(TLS) and signed SMTP client certifica

[__past__]

It would be a useful defense if spammers would routinely try to impersonate legitimate hosts by IP spoofing or something, but alas, they don't.

However, spammers routinely do try to turn ordinary personal broadband-connected PC's into spam-transmitting SMTP clients, and these would be machines that would not normally have a valid "SMTP Certificate" assigned to a static IP (if they have a static IP at all), and thus would not pass even the most basic trusted client certificate check.

They would either have one, or be otherwise trusted by their smarthost that has a valid certificate. If they wouldn't, they could not send legitimate mail either, and requiring $$ for a certificate for everyone that would want to use SMTP-talking tools like, say, Outlook, Evolution or mail-sending web forms would not be a very popular move (and would not help once everybody has paid). If you can send legitimate mail from a host, you can send spam from it once you have broken into it.

It might make it slightly easier to find the dork that had its box taken over to spammers, but simply using the IP address in the first Recieved-header usually works just as well.

The problem with this approach, and many others, seems to be that the goal is stated as "make life harder for spammers". That is easy. But the real goal should be "make e-mail usable again", without harming innocent users just as bad as spammers.

Sign your mail, stupid!

[jayackroyd]

I've read a lot of the traffic here, and I'm surprised that so many people still just don't get it.

The only way to deal with spam is to end its anonymity. Any method you choose: white list, black list, heuristic filter, blocking server names, blocking server types or Net access methods etc are all gonna fail.

First, some unsolicited email is welcome. So there has to be a way to get welcome unsolicited mail (the comments below about the ATT exec and ATT marketing people wanting to get blocked mail make that point.) So there will always be holes in the wall blocking spam.

Second, spammers are persistent, and can engage in nearly costless experiments to penetrate spam barriers. Actions taken to block the less persistent will breed fewer but more aggressive and persistent spammers. (That's also why laws can't work. They only work on the law-abiding. Only outlaws remain, routing through China.)

The only thing that will solve the spam problem is authenticating the sender. This could be over in a matter of months. If AOL and MSN were to provide digital signatures to their subscribers (they already have authentication information for them), and offered to block any incoming unsigned mail, everyone else would have to sign their mail in order to reach aol and hotmail accounts. In ATT's case, if they were to provide a digital signature to each users account, and only use the whitelist filter on unsigned, incoming mail, they would also foster the end to anonymous email, and, as night follows day, to spam.

In that environment, the various countermeasures actually work. Or you simply block any unsigned mail, and pursue any signed spam through laws or civil action.

The rub, of course, is that ATT, MS and AOL send out their share of spam......

Re:Sign your mail, stupid!

[Anonymous Coward]

I agree and I have had that same thought. Taking it one step farther, how do AOL, MSN, etc verify that the person requesting an account is a real person? They would have to ask for some form of ID. The problem is that there are probably a good number of ISPs that would sell accounts to spammers somewhere in the world. You'd have to get universal agreement to this from all ISPs to make it work. A big order... I do think that allowing accounts like zy23459pq@whatever.com is pretty blatant lack of concern on their part.

No way does any CEO get "important" email...

[mulp]

the standard thing in corporations is for email to be "look at me" or "cover my ass".

It reminds me when I worked for Compaq after being bought as part of DEC - the standard practice in Compaq was to send email and then call to ask if you gotten it and read it.

But then again, email at Compaq was very different from at DEC (although DEC had been devolving) in that it wasn't uncommon to get dozens of content free "action" memos a day addressed to a hundred people who had absolutely nothing to do with the issue other than being some form of manager, consultant, adminstrative staff,....

All my experience since indicates that email has truely replaced the interoffice memos that merely consumed forests. Of course, there are some people in corporations who have their admins print the email and file it. And best of all, neither the email or the paper copy is actually read....

I want to connect to the backbone

[mulp]

Why can't I just run a wire into AT&T's switch room and connect to the internet?

Instead I'm forced to deal with some ISP who already part of the internet core "club".

What AT&T is doing is simply forcing a similar structure on SMTP connections.

If you want to send mail to AT&T you either
1) go to the trouble of peering with AT&T
2) become an AT&T customer
3) be a customer of someone who peers with AT&T and send your email through their relay.

Of course this is the start of a system for charging for sent email. AT&T will allow its customers to send only x messages per month for a given service charge. Other ISPs will do the same.

What will be interesting is what happens at yahoo and MSN where certain email related services are still "free".

My guess is that yahoo has the critical mass to negotiate with the likes of AT&T - AT&T wouldn't want to piss off its customers by demanding a big fee from yahoo to accept email from yahoo, but AT&T wouldn't hesitate to demand payment from potential competitors to yahoo. This will strengthen yahoos hold on these services, making it impossible to bill yahoo for mail sent.

The likely outcome is the consolidation of the email system into a core set of relays and relays that accept messages only from affilliated relays - ie customers.

In any case, its unlikely that the change will have an adverse affect on 99.9999% of all internet users, just as the consolidation of the internet core to a small number of corporations has affected 99.99% of the users who were part of the internet before formation of and consolidation of the core.

Where are those who do know shit technically?

[Nonesuch]

Hardly nobody on here knows shit technically speaking yourself excluded Nonesuch /GRIN/, and are ready to slit your throat if you say one wrong (read: probably true) thing about Apple.

I won't try to argue with that.

But where do the people who *do* know shit technically hanging out now? Certainly not K5...

Sure, there might be a few actual cipherpunks hanging out chatting on SILC, but I'm more interested in message boards than in realtime chat. I'm on BOFHnet, but that's devolved to a social clique of bitten unemployed sysadmins.

Suggestions?

Re:Where are those who do know shit technically?

[morelife]

I still hang out here on /. because even though the modding is b0rked to the point that browsing "highest scores first" is no longer a guarantee of decent commentary, whatever news there is ( about Linux/BSD/DNS/Corporate Greed/techtoys/YRO) seems to end up here fastest...

I go to the NANOG list at

http://www.merit.edu/mail.archives/nanog/

if anything happens on the network, it's usually discussed within the hour there.. no stupid posts and important engineers post there.. and any discussions that end up being threads remain intelligent the way through.. I find that the postfix-users list is very intelligent as well.

Groklaw is the only other place I look, and also eff.org which I support, and mini-itx.com ... but anyway /. can be such a ridiculous time sink just wading through the bullshit. My recent passion is meta-moderating just about anything moderated funny as unfunny because most of the time that's the problem. There's no radio buttons I can push to alleviate my problem with MacOS9 people who think they're technologists.

-end of rant-

l8r!!

a chainsaw where a scapel is needed

[Anonymous Coward]

This is a perfect example of how to over-react to a problem. "Well I don't like the game, so I am just going to take my marbles and go home". "Anyone who I care about already knows me". Isn't part of the greatness of the Internet the openness? Isn't it about finding connections and people you didn't know existed? Cut off your nose despite your face. This approach from AT&T is too heavy handed. But I understand their frustration.