Slashdot Mirror
Why Blacklisting Spammers Is A Bad Idea
Roland Piquepaille writes "For the last two months, an eternity in Internet time, I was unable to reach -- and to contribute to -- Smart Mobs, the collective blogging effort around the next social revolution initiated by Howard Rheingold. Why that? Because an unknown customer of Verio decided it was a spamming site and asked the company to blacklist the site. Verio complied -- probably without even checking it -- and my problems started. It took me dozens of e-mails and phone calls and two visits to the headquarters of my french ISP, Noos, to fix the situation. More about this horror story is available here."
And other RBLs require usually multiple reports from multiple sources. And you have fairly straightforward way of getting de-listed, too.
What's with the current boo-hoo over blacklists? Do we have some kind of spammer astroturf going here?
Break into the lobby of the ISP, guns in hand, and force them to remove the site from the blacklist. It's what I do when I'm pissed.
And why did you staple the trout to the RAM?
This article should have been called...
"Why it's important to have good policies and procedures in place when blacklisting spammers"
"blacklisting" in this article refers to completely block an ip address. This is not a "bad idea", but complete nonsense. First time I've heard of something like that. This is not to be mistaken for using an open relay blacklist or similar, which only blocks mail from a certain address. I bet those "network administrators" clicked on some fancy "block site" button, not knowing what they were doing...
RTFA. Verio was doing blacklisting on ALL PROTOCOLS for this ISP. The guy could not even GET TO THE SITE.
Verio blocking HTTP access to other people's spam pages? I have I wandered into another universe again?
One line blog. I hear that they're called Twitters now.
The fact that a strategy (such as blacklisting) can be mismanaged and that it is not invulnerable to abuse does not necessarily make it a "Bad Idea". It just means it needs to be managed more carefully, and better secured from abuse.
Why is the blacklist being done on a domain level. Spam is usually email....so block the email address. That is simple enough to do with intrusion detection systems, some application level firewalls, and if your really bored....an access list on a router. Whoever decided to block ftp or http to stop spam was not all there. They should have stopped smtp traffic from there instead and been done with it.
Black listing of spammers is a good idea, we just have to make sure we are only blocking them and not innocent bystandards.
Stop signs are only Suggestions
Use some common sense editors when presented with a story that seems unusually slanted please take it at face value. This is why corporations such as verio need to be made aware of their policies not working not that black lists do not. Blacklists are the only thing that works against spammers and they know it. So how do they fight back by using the blacklists against regular sites to try and disrupt users service so that people might think twice about using them.
Instead this article should be title "Why Blacklist Do Work" and what spammers are doing to try and disrupt them.
Quoting from the article:
Maybe it is a good time to change ISP?
From the article: My ISP has a partnership with Verio to handle its traffic in the U.S. When Verio blacklisted Smart Mobs, any request from Noos went unanswered -- sorry, there was the (in)famous 404 error.
I want to be sure I understand this correctly. Verio wasn't (only) discarding mail from Smart Mobs, because they thought it was spamming site, they were refusing to pass through http (or other) connections to it?
Discarding mail is one thing, but blocking an IP address is quite another. What's the justification for this? To prevent the (supossed) spammer from profitting from the spam, by preventing anyone from connecting to it to (presumably) buy the product touted in the spam?
Discarding mail from a spammer can be justified, by, among other things, the argument that spam mass-mailings strain system resources. But connecting to sites happens all the time -- an ISP should should be set up to handle that traffic, and can traffic to sites touted in spam really increase the volume that much?
To me, this seems like a dubious policy on Verio's part -- even without the problem of mis-identifying sites as in the case of Smart Mobs.
Opinions on the Twiddler2 hand-held keyboard?
I left an HTTP proxy on on an open port - on the same machine that does SMTP. I didn't even know that spammers could relay via an http proxy using a PUT to the local SMTP server. mea culpa.
I fixed it in 3 days (too long, I know).
I contacted mail-abuse.org and submitted a removal request. It took them 2 weeks to take me off the list.
It frustrates me that their site is so unresponsive to removal requests, and that they fail much of their process. They were supposed to send email at several stages, which they did not do. The email they did send was badly formatted (broken urls, urs that weren't relevent).
I won't ever use an RBL because they just don't seem responsible.
Yeah, I know - pot kettle black. But I'm not supplying a service to thousands of users.
Someone anonymously submitted our MS Exchange server (I don't blame em *grin*) as a spam relay, despite the fact that it is not. As said in the original post, they didn't even check the server they just blacklisted it.
:(
The first thing we know about it is when members of staff come to us and complain that they are getting error messages such as 'denied' when trying to email important people.
Sigh.. in fact I have that very same problem waiting to be tackled when I get back on Monday morning. And its always such a ballache to get your mail servers removed from these block lists...
"Hey! Unless this is a nude love-in, get the hell off my property!!"
First of all, the idea of Verio blocking spammers is laughable. They have always been a haven for spammers and everyone here probably already knows that.
The real issue, however, seems to be this guys ISP. I mean honestly, what the hell is wrong with them? If I had called Speakeasy with this sort of problem, it would have been taken care of that day.
-sirket
I have an earthlink.net account and a couple of weeks ago I was issued an IP address in the dreaded slashdot BANNED! file. Pity poor me, getting the big orange screen telling me about the terms of use and how, as a BANNED! IP addy, I was unable to even read them. Fortunately, the evil orange BANNED! page quoted me a few of the offenses that might have gotten 'my' IP banned. I must have spammed the input queue or posted a PWP (page widening post) or somesuch.
/. never forgets.
/. -- can you imagine the suffering that such a fate would cause *you*??!
Of course, it wasn't me. It was some other Earthlink customer who, sometime in the past, was issued that same dynamic IP address and committed the unpardonable offense. That customer has moved on to a new IP, but
It was hell. I spent *hours* unable to access
Eventually, I was issued a new IP address from earthlink and was back online as the ageless Sun Tzu once more. But I still live in fear that someday, perhaps when I least expect it, the evil orange BANNED! page will return to haunt me. This is the personal hell that I inhabit and it is here that I shall remain, until I get a clean static IP address of my very own. I live for that day.
--
Send us your Linux System Administration articles
Geeky modern art T-shirts
So the question presented by this article would be "WHY is blacklisting spammers a bad idea?" Unfortunately, it doesn't answer the question.
The blurb mentioned by the article submitter is the entire coverage of any such activity. The rest of the piece then goes on to complain about the user's ISP. Those who haven't RTFA'd can feel comfortable in skipping this one.
I'm sure this submission will provide nice fodder for expressing annoyance over spamming and horror stories of "collateral damage". But then - we've had plenty of those before. It would have been nice if an article had provided some framework around this kind of conversation.
This article doesn't.
The good it does is far outweighed by the bad. Just like everything else in life, mistakes will be made. You can have a problem with the process to correct mistakes, but advocating RDNS blacklisting should go away doesn't make sense.
To get kicked from Verio, you have to burn down a network center or something like this. About 500 mails from users to abuse@verio.net for one spamvertized website netmails.com and no action taken ==> They do nothing against spam. They tolerate spam.
.
Check for yourself: Verio's Listing
I use blackholes.us to block (port 25) entire countries (cn, kr, tw) and ISPs (Verio, interbusiness.it...) that do not qualify (in my standards) for connecting to my mailserver.
NSG
Grundgesetz * 23. Mai 1949 - 30. November 2007 - http://www.vorratsdatenspeicherung.de/
I dare you to try and contact the Earthlink Network Abuse department. At my work, we are a (legal) online betting site and were getting pounded by several Earthlink IPs grabbing our free odds.
With megs of apache logs for each IP address, Earthlink network abuse must have taken the week off. 17 Emails and 8 calls. With NO answer, NO response on anything.
We cannot just block all of Earthlink's dynamic numbers because of ten insipid users. I wish death on all the sysadmins at Earthlink and I curse their children with webbed genitailia.
((Before replying with suggestions to do on my end, they have been tried. mod_throttle wasn't an option, dynamic temp bans had to be watched, blah, blah, blah.))
When modding "Informative", please make sure it both has a source and IS actually informative.
"Why Blacklisting Spammers is a Bad Idea: It Takes Up Valuable Time that Could Be Spent Tracking Them Down and Killing Them"
First, it's obviously a bad idea to block all IP traffic for an entire netblock (except under extreme circumstances -- attacks, for instance).
Spam is a huge problem, and there are some very effective DNSBL's (DNS blocklists) out there that can let a mailserver reject mail coming from a certain IP address. There are many different DNSBL's out there, and each has their own policies on what IPs they will list, how they will de-list, etc.
I don't like DNSBL's that list IPs based on non-spam related criteria. Examples include: country/continent of origin and service class (consumer vs. commercial). Blocks based on such criteria just divide the Internet, and don't even take into account where spam is coming from. I think it's a slap in the face of the Internet for a company to say, "I'm going to block all traffic from dynamic IPs, because they are not commercial connections".
Then there are the blocklists that block IPs that send spam. I like this approach because the lists are designed to block what I don't want; spam. sbl.spamhaus.org blocks regions of the Internet that perpetually send spam. blackholes.easynet.nl similarly list established spam sources. relays.ordb.org and list.dsbl.org block open relays and proxies that were found to be points of abuse.
Over the past 6 months, some 65% of spam (and spam attempts) that my ISP received came from less than 0.16% of the assigned IPv4 address space.
Almost 2/3's of the spam we saw was sent over SMTP connections from one of 77 CIDR blocks (ranging from /16 to /30 in size).
These 77 CIDR blocks represent less than 1/6 of
1 percent of the assigned IPv4 address space.
BTW: The CIDR list growth factor is not much when you move from the 65% level to the 90% level.
Spam is truly a world wide problem. Those 77 blocks, by national/region, break down as follows:
"Yes, Virginia", a few IP address blocks do transmit most of the spam.
chongo (was here)