Slashdot Mirror
Why Blacklisting Spammers Is A Bad Idea
Roland Piquepaille writes "For the last two months, an eternity in Internet time, I was unable to reach -- and to contribute to -- Smart Mobs, the collective blogging effort around the next social revolution initiated by Howard Rheingold. Why that? Because an unknown customer of Verio decided it was a spamming site and asked the company to blacklist the site. Verio complied -- probably without even checking it -- and my problems started. It took me dozens of e-mails and phone calls and two visits to the headquarters of my french ISP, Noos, to fix the situation. More about this horror story is available here."
And other RBLs require usually multiple reports from multiple sources. And you have fairly straightforward way of getting de-listed, too.
What's with the current boo-hoo over blacklists? Do we have some kind of spammer astroturf going here?
This article should have been called...
"Why it's important to have good policies and procedures in place when blacklisting spammers"
The fact that a strategy (such as blacklisting) can be mismanaged and that it is not invulnerable to abuse does not necessarily make it a "Bad Idea". It just means it needs to be managed more carefully, and better secured from abuse.
From the article: My ISP has a partnership with Verio to handle its traffic in the U.S. When Verio blacklisted Smart Mobs, any request from Noos went unanswered -- sorry, there was the (in)famous 404 error.
I want to be sure I understand this correctly. Verio wasn't (only) discarding mail from Smart Mobs, because they thought it was spamming site, they were refusing to pass through http (or other) connections to it?
Discarding mail is one thing, but blocking an IP address is quite another. What's the justification for this? To prevent the (supossed) spammer from profitting from the spam, by preventing anyone from connecting to it to (presumably) buy the product touted in the spam?
Discarding mail from a spammer can be justified, by, among other things, the argument that spam mass-mailings strain system resources. But connecting to sites happens all the time -- an ISP should should be set up to handle that traffic, and can traffic to sites touted in spam really increase the volume that much?
To me, this seems like a dubious policy on Verio's part -- even without the problem of mis-identifying sites as in the case of Smart Mobs.
Opinions on the Twiddler2 hand-held keyboard?
Speaking as someone who fights spam for a living, effective blocking requires a combination of techniques. You need to filter on sender (both envelope and From:), sender domain, sender IP, and content filters.
Your statement that whoever decided to block ftp or http was not all there completely misses the point, I think. If a site is known to spamvertise, blocking *all* traffic to/from that site is actually a pretty good idea. Why? Consider why spammers send spam: to generate traffic to a web site, an email address, a phone number, some way to contact that. Since they know any email address they use to spam probably won't last as long as fart in a room full of air purifiers, the contact link is usually URL, whether by domain name or IP address. If they spam and you put in a filter for that spam, they may never get that spam through again, but they may still get some buyers from among your (stupider) customers. However, if your policy is to block all traffic to/from that IP address, they get zero traffic and zero business from your netblock and you really hit them in the wallet.
Verio's idea is good, but someone dropped the ball on implemenation in this case by not checking the facts before blocking.
What I'd like to know, though, is why the author of the article uses an ISP as bad as Noos. They sound so bad they make even wanadoo.fr (gee, speaking of spam!) sound good in comparison. Someone at Verio apparently made a mistake, but if so many people at Noos weren't so incompetent (did the PHB character come from their, I wonder?) the situation probably could have been resolved in a day or two.
The good it does is far outweighed by the bad. Just like everything else in life, mistakes will be made. You can have a problem with the process to correct mistakes, but advocating RDNS blacklisting should go away doesn't make sense.