UUNet Is The Number 1 Spam Host

Spam doesn't matter to me by (1337)+God · 2004-03-01 12:00 · Score: 0, Insightful

Thanks to Mozilla + Bayesian filters.

Seriously, my life has changed for the better thanks to Open Source. I don't know what I'd do without it.

--

Background: 28/M/Bi-Sexual; Owner of a Linux company; MBA Harvard 2003; B.S. Comp Sci MIT 2000

Re:Spam doesn't matter to me by MikeCapone · 2004-03-01 12:05 · Score: 5, Interesting

It's indeed possible to catch most of it with good filtering (I get over a hundred a day and catch about 95% of it -- but I'm using a webmail account so I don't have control over the filtering), but it's still clogging up the net and wasting everybody's bandwidth.

Sometimes I wonder if we'd "feel" a big difference in net responsiveness (browsing, file transfer, latency in online gaming, etc) if all spam stopped suddenly. Probably.

--
Treehugger? Treehugger... Treehugger!
Re:Spam doesn't matter to me by ssbljk · 2004-03-01 12:11 · Score: 5, Insightful

problem is when it catchs important mail and then you have to check for 1 good in hundreds of bad ones

--
/ss
Re:Spam doesn't matter to me by sporty · 2004-03-01 12:12 · Score: 3, Insightful

Until the spam takes up so much bandwidth for you to download and filter.

--
-
ping -f 255.255.255.255 # if only
Re:Spam doesn't matter to me by bizpile · 2004-03-01 12:15 · Score: 0, Redundant

i had that very conversation with a friend today
Re:Spam doesn't matter to me by ceejayoz · 2004-03-01 12:17 · Score: 3, Insightful

The spammers seem to be able to circumvent the Bayesian filters nowadays - about half the spam now gets through Mozilla Thunderbird's. :-/

I suspect it's the practice of putting random words at the end of the e-mails that does it.
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 12:25 · Score: 3, Funny

Background: 28/M/Bi-Sexual; Owner of a Linux company; MBA Harvard 2002; B.S. Comp Sci Dartmouth 1999
<sarcasm>Thanks for sharing.</sarcasm>
Do you believe that being boastful in your sig has anything to do with real credibility? You should check your vanity and leave your background to your user page where it belongs. And start using your sig for inane jokes, strange quotes and unusual observations like a typical slashdotter.
"Plaque is a figment of the liberal media and the dental industry to scare you into buying useless appliances and pastes." --Master Shake
Re:Spam doesn't matter to me by fembots · 2004-03-01 12:31 · Score: 5, Interesting

Yeah, spammers are also using HTML tags, eg viagra, which in a HTML-enabled email client will just show viagra, but this kills a lot of filter. these guys are trying out another approach to deal with this though.

--
Rock that crushes, Paper & Scissors that don't matter.
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 12:31 · Score: 0

Seriously, my life has changed for the better thanks to Open Source. I don't know what I'd do without it.

Yeah, you might only have had the time to get one degree, and only fuck women!
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 12:33 · Score: 3, Funny

Everybody loves this guy's sig. You're like the millionth person to bitch about it. I think it's cool, myself. What else are internet forums for, but boasts that cannot be disproven? Check out how badass *I* am:
Background: 25/M/Asexual(spores); Ninja Master, Superspy, and Fry Cook; Diploma, Shaolin Class of '93; PhD in Ass-kicking, BMF Correspondance School, 2001
Re:Spam doesn't matter to me by ackthpt · 2004-03-01 12:36 · Score: 3, Interesting

problem is when it catchs important mail and then you have to check for 1 good in hundreds of bad ones
Sunday: 429 emails, 1 valid. It's not often like that, some days I get as many as 10 valid for about the same overall volume.

--

A feeling of having made the same mistake before: Deja Foobar
Re:Spam doesn't matter to me by Pig+Hogger · 2004-03-01 12:43 · Score: 5, Insightful

Spam doesn't matter to me
Thanks to Mozilla + Bayesian filters.
Are you sure? All your bayesian filters do is automatically "press delete" for you. But you **STILL** have to download the spam, and you **STILL** have to pay for the extra-bandwith you use to do so, and you **STILL** have to pay for the ISP's extra-bandwidth to carry all that spam for you in the first place, and you **STILL** have to pay for the disk space and your computer ressources that's are used to store the spam you don't see, as well as the ISP's ressources eaten-up by the spam.
Filtering is **NOT** the solution. Blocking spamsources at the origin **IS**.
Re:Spam doesn't matter to me by orkysoft · 2004-03-01 12:46 · Score: 5, Funny

Hehheh, at the bottom of that page:

This site is protected by The Do-Not-Slashdot ACT 1996

--

I suffer from attention surplus disorder.
Re:Spam doesn't matter to me by Alan · 2004-03-01 12:48 · Score: 1

Use imap if possible, if it's not, bitch at your ISP to either make it available or filter the spam at their end. If you're lucky enough to have your own server setting up imap and procmail and a spam filter is pretty easy.
Re:Spam doesn't matter to me by koreth · 2004-03-01 12:50 · Score: 4, Insightful

And without spam filtering, you'd still have to check for small numbers of good messages buried in a mountain of bad ones, only you'd have to do it every single day rather than just occasionally. This to me is a step forward, not a reason to avoid filtering.
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 12:57 · Score: 0

The guy can have whatever sig he wants but it does negatively affect his karma. Take a look at his previous posts. Moderators regularly punish him for that sig.
"What we got here is failure to communicate. Some men you just can't reach. So you get what we had here last week. Which is the way he wants it. Well he gets it."
Re:Spam doesn't matter to me by timothv · 2004-03-01 12:58 · Score: 5, Funny

You **CAN** convey **EMPHASIS** with just bold or CAPITALS.
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 12:59 · Score: 0

It's a Bayesian filter. You can train it. I've never had any of the spam that has random words at the end of it get through thunderbird's filter.

Use the tool given to you! Mark that stuff as junk and it'll stop getting through! Complaining about it otherwise is pure laziness.
Re:Spam doesn't matter to me by RoadkillBunny · 2004-03-01 13:04 · Score: 1

Hotmail did that to me. Most of my important mail ended up in Junk and all spam in Inbox. I just turned off the filter and setup fex filters in evolution. Now when I download my email with hotwayd, I get all the email I need.

--
Cheers,
RoadkillBunny
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 13:04 · Score: 1, Insightful

So how do you tell when you've gotten a good email that has been filtered? You still have to check.
Re:Spam doesn't matter to me by cuban321 · 2004-03-01 13:13 · Score: 2, Informative

My experience is that Thunderbird's spam filter is unfinished (as it is an alpha product). Spambayes catches 99% of all spam for me. It's proven better than even spamassassin. It will even work with Thunderbird.

Daniel
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 13:29 · Score: 0

The Harvard MBA just about wipes out the cred from the Dartmouth comp. sci degree.. IME, Harvard MBA's are trained to be IBM middle-managers in the 1960's.

A Stanford MBA, on the other hand, I would consider a plus.
Re:Spam doesn't matter to me by leviramsey · 2004-03-01 13:32 · Score: 1

Use spamassassin's Bayesian filter. It combines the Bayesian method with old school regex matching. I get maybe two spams a week that don't get marked as spam.

I'm not sure if SA does this, but I think the ideal approach is to take the Bayesian approach and, in addition to going from tokens, use Bayesian methods on the regexes matched. Thus, you could use a huge number of regexes that would work at a higher level than simple tokenizing (they could discern the bogus HTML code that's used to confuse naive Bayesian scanners).
Re:Spam doesn't matter to me by RaymondRuptime · 2004-03-01 13:34 · Score: 5, Insightful

I agree that blocking is preferable to filtering. Filtering is like solving gun violence by improving emergency room medicine.

However, as an interim step, it's better than not to have Bayesian filters and well-staffed ERs.
Re:Spam doesn't matter to me by ssbljk · 2004-03-01 13:40 · Score: 4, Insightful

all I want to say is that you can't trust filters 100%
it does not matter much to people who use e-mail to forward chain letters if they miss some message - but there are also people who run business which depends on e-mail (hey I don't mean on spammers) :) and they can't let themselves to miss it.

--
/ss
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 13:48 · Score: 0

My Military Science teacher in high school used to say that for any defense that can be made, there can be made an offense to defeat it. Spam is a losing battle. They will always win in the end because spammers always have the initiative. All filters can do is sit back and hope spammers won't think of new and different ways to attack. And they will.

Untill there's some outrageous penalty-to-profit ratio for spamming, nothing will change. Perhaps if spammers were executed for their crimes or better, if they were forced to use the products they pushed...

As a wise man once said, "Evil will always triumph over Good because Good is Dumb."
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 13:56 · Score: 0

I agree to blocking spam at the source, but I disagree with the "had to download it". I use a filter that uses IMAP (instead of POP) to get the headers for the emails, then filters based on from and subject. This takes care of about 80% for me, the other 20% I stillhave to download to allow the other filters to do a content filter on it.

Over all, most I do not download.

I would like a way to auto re-direct email from my hotmail account so I can filter it better, but I'll just keep wishing (I use win2k, not *nix on my main machine)
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 14:08 · Score: 0

Yahoo does the same thing. Legitimate mail usually gets marked as spam, and the most -obvious- spam gets through.
Re:Spam doesn't matter to me by buddydawgofdavis · 2004-03-01 14:12 · Score: 0

Same here -- Mozilla + Bayesian filters.

It is so effective that I no longer advocate action against the spammers. I believe that Moz + bayz =solution.
Re:Spam doesn't matter to me by AndroidCat · 2004-03-01 14:28 · Score: 1

I hate Outlook, but there are a number of bayesian plug-ins for it, and there's an extensive COM interface for rolling your own plug-ins and external apps to connect with it. What exact advantage does open source give you over a published interface in this case?
It's a Devil's advocate question. Source is good, but my time available for diving into a huge app, making changes, and maintaining my changes over new versions, is limited.

--
One line blog. I hear that they're called Twitters now.
Re:Spam doesn't matter to me by AndroidCat · 2004-03-01 14:34 · Score: 1

Does your setup have a warning to let you know how much of your bandwidth and resources are used to pipe spam to /dev/null?

--
One line blog. I hear that they're called Twitters now.
Re:Spam doesn't matter to me by hashinclude · 2004-03-01 15:11 · Score: 1

Because Thunderbird Just Works (r)(tm)(other crap) . All that is required is to enable spam filtering on the specified account.

For Outlook/Express, you have to google for the plugin, ensure that it is free (or can be cracked, which shouldn't be done in a business environment anyway) or pay the $PRICE for it, install it, and hope it works.

And who said you have to <quote> diving into a huge app, making changes, and maintaining my changes over new versions </quote>? Thunderbird is a simple ZIP file which you dump into your C:\Program Files or wherever you please.

Here is one place where Thunderbird "Just Works" - why not try it?

--
US is now divided as the "Red" and "blue" states. Red States = communist countries. Coincidence? I think not
Re:Spam doesn't matter to me by Pig+Hogger · 2004-03-01 15:20 · Score: 1

YES, I know; but it is not as **EFFECTIVE**
Re:Spam doesn't matter to me by AndroidCat · 2004-03-01 15:26 · Score: 1

Yes, but that doesn't answer my question of how open source relates to that. (Before anyone else jumps in, please read my original question.)

--
One line blog. I hear that they're called Twitters now.
Re:Spam doesn't matter to me by gklinger · 2004-03-01 15:28 · Score: 4, Insightful

Sometimes I wonder if we'd "feel" a big difference in net responsiveness (browsing, file transfer, latency in online gaming, etc) if all spam stopped suddenly.
I was thinking about that the other day. Then I got to wondering how much CPU-time I was spending on spam filtering which led to my thinking about how much electricity I was using to filter spam. Then I started to think about all the electricity being used by computers moving the mail and routers between network points and so on. It didn't take long before my mind boggled.
Spam is often touted as being better than physical junk mail as it doesn't use all that paper. There are however, other costs. All that electricity has to be generated and that can't be good for the enviroment.
The next time someone says spam is a hassle but doesn't really cost them anything, remind them what went into getting that spam to them.
Re:Spam doesn't matter to me by Czmyt · 2004-03-01 16:08 · Score: 2, Informative

Yes, true, but I think it's possible to throw away the stuff that is most definitely spam (SpamAssassin score of 10+), leaving just the very likely spam messages (SpamAssassin score from 5 to 10) for you to check occasionally in your Spam folder. Personally, I throw away anything that's 6+ and move the 4-6 stuff into a Spam folder for end-of-the-day review.
Re:Spam doesn't matter to me by jfengel · 2004-03-01 17:18 · Score: 1

To be slashdotted, you really need to have the link in the main story, because an awful lot of people really do try to RT(F)A. You don't get slashdotted just because you're in somebody's comment, even a well-moderated one.
Re:Spam doesn't matter to me by misleb · 2004-03-01 19:25 · Score: 2, Insightful

all I want to say is that you can't trust filters 100% it does not matter much to people who use e-mail to forward chain letters if they miss some message - but there are also people who run business which depends on e-mail (hey I don't mean on spammers) :) and they can't let themselves to miss it.
I'd say I run about the same risk of accidentially deleting a non-spam message in a fenzy of spam deleting. You can't trust yourself 100% either. Alls I can say is that I love my Bayesian filter. :-P

--
"THERE IS NO JUSTICE, THERE IS ONLY ME." -Death
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 22:26 · Score: 1, Interesting

The difference between the electricity you use when your machine is idle vs. filtering spam, and likewise for the route it reached you via is probably not that large, and considering the amount of time your machine is idle or performing other tasks vs. filtering spam, and likewise for the route.

If spam increased the usage of computing resources by tens of percents, that would be significant, but I'm pretty sure that it makes less than 1% of a difference. Getting rid of spam would save much less energy than focusing on making the computing devices themselves consume less energy - because electricity is relatively cheap, the only devices optimized for energy consumption are those that rely on batteries (e.g. laptops).

I'm not defending spam, just trying to put your argument into perspective.
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-01 23:39 · Score: 0

I agree that blocking is preferable to filtering. Filtering is like solving gun violence by improving emergency room medicine.
Sounds like the American Way then...
Re:Spam doesn't matter to me by wheany · 2004-03-02 00:44 · Score: 1

Popfile strips out any invalid tags and increments the pseudoword html:invalidtag for every such tag.
Re:Spam doesn't matter to me by Zeriel · 2004-03-02 01:30 · Score: 1

Y'see, that's never bothered me. I'm fortunate enough to have a machine that's the mail server for my domain, and it filters literally 99.5% of the spam before I see it. Since it's co-lo'ed on a free pipe, I don't care about its bandwidth, and since it's not doing anything but being a mail server, I don't care how much CPU time spamassassin takes up. =P

Your mileage may vary, of course.

--
"America has done some terrible things. But I know that Americans don't cheer when innocents die." -Dave Barry
Re:Spam doesn't matter to me by Zeriel · 2004-03-02 01:33 · Score: 1

Well, mostly because Outlook is a dog, and Thunderbird works.

That, and the price is right for Thunderbird (I don't get Outlook free, just OE which is measurably inferior IMHO), which is the advantage of Open Source in this instance. That, and the fact that to my knowledge Thunderbird has never randomly executed malicious code in an e-mail, as Outlook has been known to do on occasion.

--
"America has done some terrible things. But I know that Americans don't cheer when innocents die." -Dave Barry
Re:Spam doesn't matter to me by AndroidCat · 2004-03-02 02:43 · Score: 1

Lots of non-open source mail programs are free, are better at filtering spam than Outlook or OE, and don't randomly execute malicious code.
I'm still wondering how the open sourceness of mozilla has changed the OP's life. I'd make a case for an open review process being good for catching bugs, tapping talent outside the core team, features and functions not being dictated by a marketing dept that doesn't understand security, stuff like that. But so far replies have mainly been "Open source good, must have open source, open source shiny!" (I'm exaggerating for retorical purposes here, sorry. ;) Hey, I like open source, but I doubt it'll ever be a life-changing experience.

--
One line blog. I hear that they're called Twitters now.
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-02 07:13 · Score: 0

Can I suck your cock? I'm a straight male, but, fuck, "Owner of a Linux company" just gets me so damn hot and horny!
BTW, you're probably the 354560th person to say "Thanks to Mozilla + Bayesian filters" in reply to a spam story. How 2003. Should be modded redundant.
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-02 10:59 · Score: 0

Anything with HTML tags increases the probably-spam score in my filter.
In fact, if it's an HTML email from someone not in my explicit "approved" list it end up in the junk folder.
In fact, that rule is by far the most effictive one in my virus filter.
Re:Spam doesn't matter to me by kidlinux · 2004-03-02 11:05 · Score: 1

You've got to teach your filter what new spam looks like. Spamassassin has a program called "sa-learn" which updates the stats databases to identify spam and ham messages.

Each user on my system has an imap folder where filtered spam is saved so it can be reviewed for any false-positives. They can then save that spam to a publicly shared imap folder. I have a daily cron job that runs sa-learn on all the spam collected in that public folder. I think my filter catches about 99% of the spam, and never has any false-positives.

You can also run sa-learn on your "ham" messages (ie: regular, legit mail.) This makes it even easier for Spamassassin to separate the bad from the good. It's a great system.

--
-kidlinux.
Re:Spam doesn't matter to me by ceejayoz · 2004-03-02 11:19 · Score: 1

You've got to teach your filter what new spam looks like.

Duh?

Thunderbird does just that, although it's client-side instead of server-side (which can be handy). You just click the "Junk" button and it gets added to the database, then deleted.

In short - I'm not that much of an idiot. :p
Re:Spam doesn't matter to me by Anonymous Coward · 2004-03-02 12:39 · Score: 0

that's a good point, the filtering is wasted sometimes

I've started to look at where the spam comes from, and add iptables filters to refuse connections to my mailserver from those hosts. That way, I don't waste any cpu cycles looking for patterns, or anything else from those people. It just stalls out their mailer while it timesout because I drop their packets as if my ip was not even available.

eventually, they remove my address from the list as non-deliverable and that source of spam slows down.

sort of off topic, but why do people from Taiwan keep sending unicode messages to the US? I can't even read these messages, so I'm not about to go buy something from them! Sometimes they look nice with japanese or chinese lettering all nicely formatted, but again, what does it say??
ha ha

Largest ISP? by fewnorms · 2004-03-01 12:00 · Score: 4, Insightful

Could this probably be because UUNet in my understanding is one of the largest ISP's?

--
Veni, Vidi, Velcro!

Re:Largest ISP? by Anonymous Coward · 2004-03-01 12:04 · Score: 5, Informative

UU carries 50% of the US's total Internet traffic and 90% of its e-mail. It makes an easy target.
Re:Largest ISP? by ackthpt · 2004-03-01 12:07 · Score: 2

Could this probably be because UUNet in my understanding is one of the largest ISP's?
UUNet is now part of MCI (formerly WorldCom^Hn) do you think they care?
"Johnson, why are our revenues down?"
"We kicked off some spammers, in accordance with company policy, Sir."
"Well, put them back on, dammit, we need every cent we can get, it's a tough economy!"

--

A feeling of having made the same mistake before: Deja Foobar
Re:Largest ISP? by Anonymous Coward · 2004-03-01 12:10 · Score: 5, Insightful

That may be part of it, but back when I worked as an abuse admin (in 1998) they didn't care much (we had a deal with them for our dial up customer to use their POPs in areas where we didn't have any) and near as I can tell that hasn't changed a bit. It's PC to have an anti-spam AUP, so they have one (and had one back then, too) but it's not profitable for them to enforce it.
Re:Largest ISP? by the1brian · 2004-03-01 12:12 · Score: 0, Troll

MCI was never WorldCom. Common misconception. WorldCom attempted to buyout MCI, but the FTC blocked it before it ever happened, hence MCI was never a part of WorldCom. Also, I don't think he was refering to whether they care or not - he was refering to that since they're one of the largest, if not the largest providers, naturally, they're going to have the most spam.

--

~Brian
Re:Largest ISP? by ackthpt · 2004-03-01 12:19 · Score: 5, Informative

MCI was never WorldCom.
Check again. When WorldCom filed for bankruptcy they changed the name back to MCI.

--

A feeling of having made the same mistake before: Deja Foobar
Re:Largest ISP? by koan_72 · 2004-03-01 12:26 · Score: 5, Insightful

They probably are, but resources that deal with abuse should grow proportionally with size, if you try to cut corners in that department, as in the case of UUnet, you end up with a bad reputation, and hopefully, a whole lot of IP address blocked. I know from experience when I was manually reporting spam, back in the day when the amount still permitted it, they took months of complaints sometime to drop a spammer, and it was usually due to being blocked by Spamhaus or Spews. Aren't the internet arm of Worldcom anyway? You see where they get their code of ethics.

Spam would not be a problem if all ISPs dealt efficiently with open proxies and spamvertised sites.
Re:Largest ISP? by jrockway · 2004-03-01 12:40 · Score: 1, Troll

I know nobody likes spam, but if UUNet carries 90% of spam, it's their own bandwidth that they're wasting. And if it were truly being wasted, UUNet would kick the wasters off. But it's making them money. So they don't care.

Look at it this way. The spammers are financing you slashdot/pr0n habits. So who cares? You're not really hurt personally. (I know, I know. Spam is such a HUGE waste of time. You know what? Nobody has a gun to your head forcing you to use email. Sorry.)

--
My other car is first.
Re:Largest ISP? by JeremyALogan · 2004-03-01 12:42 · Score: 4, Informative

Could this probably be because UUNet in my understanding is one of the largest ISP's?
You are correct... they are North America's largest ISP. The problem lies in that, whether you realize it or not, you are probably one of their customers. Back in the day it was common for a company to buy one of their T1s (or T3s, or OC3s, or OC12s, or OC48s, or whatever), a couple phone lines/modems and WHOLLA... instant dial-up ISP. I'm not sure, but I wouldn't be surprised if this doesn't still go on (not everyone uses AOL and Earthlink, ya know). At my last job we had one of their T1 lines and, so far as I can tell, they didn't really cared what we did with it. The only time we ever heard from them was when they couldn't ping our router and then it was just to make sure everything was okay.

And yeah... why do they still use that name? They've been owned by MCI/Worldcom for years now... eveen says so on their front page.

--
Jeremy Logan's Website.
Re:Largest ISP? by the_mad_poster · 2004-03-01 12:55 · Score: 1

Random interjection riiiiight... aboooout.... now:

Your name reminds me of Calvin and Hobbes.

--
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
Re:Largest ISP? by Anonymous Coward · 2004-03-01 13:09 · Score: 0

Reminds me of Bill the cat.
Re:Largest ISP? by AnotherBlackHat · 2004-03-01 13:09 · Score: 1

UU carries 50% of the US's total Internet traffic and 90% of its e-mail.

Interesting if true.
The best source I've seen claims that UUnet is responsible for about 11% of the internets traffic, and only about 9% of the worlds email.

Anyone know of a reliable way to determine the real numbers?

-- this is not a .sig
Re:Largest ISP? by the_mad_poster · 2004-03-01 13:24 · Score: 1

Yes, yes! Definitely that too. Calvin sneazes like Bill always sounds!

--
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!
Re:Largest ISP? by ComputerSlicer23 · 2004-03-01 13:39 · Score: 1

Those statistics aren't mutually exclusive. One of them, concerns specifically "US traffic", the other makes no specific limitation to "US Traffic". So if the US represents 22% of the worlds Internet Traffic, the, and about 10% of it's e-mail, it would appear that both are accurate.
If you misquoted the statistics out of context (innocently, or as in lie, more lies and statistics). It could differentiate between "generated on", or "passed thru". I'd be relatively surprised if 50% of all packets that cross a US ISP, doesn't at some point touch UUNet's network. 90% of all e-mail might be a reach.
The other thing, is that the 50/90% stat is a quote I remember seeing for years. It might be that it's very much out of date.
In terms of ways to tell, there isn't really much of a way of figuring it short of asking various ISP's to post a lot of internal information. I'm pretty sure most of those types of statistics are guesstimates based on network layout and major traffic flow.
Kirby
Re:Largest ISP? by slash-tard · 2004-03-01 13:46 · Score: 5, Informative

The MCI / UUnet thing is mostly internal politics but also a little bit business related. You can get 2 internet circuits or 2 frame relay connections from the company and have it go over 2 different networks for diversity. One would run on the MCI network, the other would run on the UUnet network. This gear is supposed to be completely separate.

Also they dont monitor your traffic, can you imagine the logs that would create. They only contact you about spam (or whatever else) if someone complains to them about something coming from your IPs.
Re:Largest ISP? by Anonymous Coward · 2004-03-01 14:05 · Score: 0

What does WHOLLA mean?
Re:Largest ISP? by Paradise+Pete · 2004-03-01 14:17 · Score: 1

What does WHOLLA mean?
You know, it's like, PRESS TOE!
Re:Largest ISP? by etLux · 2004-03-01 14:42 · Score: 0

Because they're the largest ISP?
No.
Because they'd host Jack The Ripper and throw in a free Ginsu knife, as long as the bill is paid.

Bush wants gay marriages banned because he thinks it will stop homosexuals from breeding.
Re:Largest ISP? by chromatic · 2004-03-01 14:45 · Score: 2

You're not really hurt personally.

They're wasting my bandwidth, my CPU cycles, my disk space, my time, and, occasionally, they're forging my domain on spam sent to other people. How is that not hurting me?

--
how to invest, a novice's guide
Re:Largest ISP? by fermion · 2004-03-01 14:49 · Score: 1

Let me give you two examples of why this matters, both of which have a negative impact on the vendor and customer.
First, i use bigfoot for email forwarding. Have used them forever, even since before many of the people on this site had email addresses. They are also a big spam target and may facilitate spam. I have in the past paid them money for my account so I would not run into the limits on email. The problem is that on paid accounts, all the email gets through, including spam, which eats up most of the benifit of paying them email. They cannot seem to afford to pay for all customers to have a filter, and I cannot afford even a modest fee on a spam account. Therefore, a very good service gets demolished because of spam. Bad for both sides. I am not paying for bandwidth, but why should I pay to recieve spam? Hotmail does the same thing. Even with the filters, the amount of SPAM coming in would tend to encourage users to pay for Hotmail so as not to accidently get other email deleted.
A more fundemental issue is that all ISPs bill out bandwidth. They have to. Otherwise they would not make a profit. It is likely that they bill the spammer for thier bandwidth use, as well as extra costs associaated with complaints, but it is unlikely that UUNet bills enough to cover the cost of bandwidth of the targets. Therefore those costs, however slight, get included in month access fees.
In short, this is unlikely to be a US postal service scenario in which commercial mail subsidizes other mail. It is much more likely that the ISP likes spam because it maximizes the email, therefore justifies higher prices. Spam, like the virus ridden MS OS, also spawns software projects which may result in the diversion of resources from other more important projects.
And, of course, email is now neccesary. No one is holding a gun to our head to drive a car, or use a phone, or shit in a toilet instead of your living room. But we are civilized people.

--
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Re:Largest ISP? by Arker · 2004-03-01 14:51 · Score: 2, Insightful

(I know, I know. Spam is such a HUGE waste of time. You know what? Nobody has a gun to your head forcing you to use email. Sorry.)

EXCUSE ME? No one gave you permission to spam my email. It's theft, pure and simple. Theft of resources I've paid for, I own, and you have no rights to.

UUNet and Abovenet have been spammer friendly for ages, this is no news. The fact is they think they're big enough they're above the law, and act accordingly. They think they're too big to black-hole, and unfortunately they're right. If they aren't cut down to size the spammers will all end up at a handful of these huge companies and email will become completely unusable for any purpose. In the long run that will get rid of the spam problem, of course, but the cost is a bit high. Anyone who has a usable plan on how to cut these bastages down to size needs to speak up, and soon.

The internet infrastucture is far too important to allow any single entity to control such a huge chunk of it that they're immune to consequences.

--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Re:Largest ISP? by gcaseye6677 · 2004-03-01 14:54 · Score: 1

It would be interesting to see what would happen if SPEWS and other organizations blocked all of UUNET. Not that I expect this to happen, but they may have a different attitude if their customers all of a sudden started getting mail blocked.
Re:Largest ISP? by Anonymous Coward · 2004-03-01 15:19 · Score: 0

It would be the death of spews. Linford for years has said he was going to list all of UUNET's corp. mail servers. Well we are still waiting for it to happen. It's now been 3 years steve. When is it going to happen? Linford is afraid of UUNET.
Re:Largest ISP? by tsvk · 2004-03-01 15:21 · Score: 1

What does WHOLLA mean?

It probably is related to WALLA.
Re:Largest ISP? by zangdesign · 2004-03-01 15:34 · Score: 2, Insightful

There is one other solution.

Block UUNet.

Give'm the death sentence. Sure, it's painful, but if enough people stop accepting traffic from UUNet and explain why, it should force them to enforce their policies.

--
To celebrate the occasion of my 1000th post, I will post no more forever on Slashdot. Goodbye.
Re:Largest ISP? by chromatic · 2004-03-01 16:04 · Score: 2, Insightful

You should have said straight out that you don't believe that I have the right to decide who can use my property. It would have saved time.

--
how to invest, a novice's guide
Re:Largest ISP? by Arker · 2004-03-01 16:11 · Score: 2, Insightful

It's not a slippery slope at all. Spam is email which is both bulk and unsolicited. The email system was never designed to accomodate such, and indeed cannot survive if it is allowed. If your email to me is unsolicited, that's fine - as long as it's not a bulk message being sent to thousands or millions of people at once. If it's a bulk message, that's fine too, as long as it's sent only to those that have solicited it. But when you combine both properties, sending in bulk to folks that have not explicitly requested to be on a mailing list to receive it, then it's spam.

Your numbers are, of course, incorrect. Spam mailers almost never pay for their bandwidth, the fact that you're trying to figure on that shows that you aren't actually familiar with the problem. They steal outgoing bandwidth almost without fail, and that's something pretty well impossible to stop. A spam-friendly ISP isn't one that allows them to send (this is not needed and rarely offered - spammers rely on throw-away accounts and zombied boxes taken over with trojans at no cost,) it's one that continues to host websites that are spam-vertised.

--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Re:Largest ISP? by yulek · 2004-03-01 17:52 · Score: 1

mod: -2 stupidest post ever

--
in this age of communication i'm just not getting through
Re:Largest ISP? by Anonymous Coward · 2004-03-01 18:10 · Score: 0

WorldCom did buy out MCI. I know this because I work for the UUNet portion of MCI (formerly WorldCom before we changed out name after the bankrupsy).
Re:Largest ISP? by ackthpt · 2004-03-01 18:16 · Score: 1

Bill the Cat (yes, that was my plate while I lived in Michigan.)

--

A feeling of having made the same mistake before: Deja Foobar
Re:Largest ISP? by El+Torico · 2004-03-01 18:32 · Score: 0, Redundant

Aren't the internet arm of Worldcom anyway? You see where they get their code of ethics.
Please don't assume that UUNet (now MCI) somehow inherited WorldCon's ugly behavior. I used to work in the UUNet NOC and we hated what WorldCon did to UUNet, MCI, Brooks Fiber, MFS, and all of the other good companies that were poorly assimilated.
The most likely reason that UUNet/MCI is accounts for so much spam is simply that they are so large and interconnected that they make an easy target for spammers. Here is the current AS Internet graph showing AS 701 as the most globally connected AS.
http://www.caida.org/analysis/topology/as_core_net work/pics/ascoreApr2003.gif
When you take into account the size of and scope of UUNet, the downsizing that has gone on for 4 years now, and the number of UUNet/MCI customers who may have compromised networks, then the degree of malice is not that great. Yes, I agree that it does take a long time for UUNet to pull the plug on a misbehaving customer, but it also takes a long time for other ISPs to do the same (I also worked for Qwest, so I know.)

--
In the land of the blind, the one-eyed man is usually crucified.
Re:Largest ISP? by Anonymous Coward · 2004-03-01 18:55 · Score: 0

actually I think you are thinking of when WorldCom tried to buy Sprint
Re:Largest ISP? by JeremyALogan · 2004-03-01 21:34 · Score: 1

So I'm normally annoyed by people correcting my grammer (spelling, etc), but this thread actually made me laugh (albeit at myself). If I had mod points (and the system would permit) I'd give em to ya.

voila!

--
Jeremy Logan's Website.
Re:Largest ISP? by Anonymous Coward · 2004-03-01 21:40 · Score: 0

Uh... There are lots and lots of people forced to use email in their daily workplace.

Also, my email (that I got way back when spam wasn't a problem) is currently spread to hundreds of business contacts, friends and the occasional woman. I simply cannot stop using it without suffering major social and economical damage.

I can't believe I wasted this time responing to a stupid post.
Re:Largest ISP? by GerritHoll · 2004-03-01 23:21 · Score: 1

It's not a slippery slope at all. Spam is email which is both bulk and unsolicited. The email system was never designed to accomodate such, and indeed cannot survive if it is allowed. If your email to me is unsolicited, that's fine - as long as it's not a bulk message being sent to thousands or millions of people at once. If it's a bulk message, that's fine too, as long as it's sent only to those that have solicited it. But when you combine both properties, sending in bulk to folks that have not explicitly requested to be on a mailing list to receive it, then it's spam.
I disagree. I think another aspect of spam is that it's commercial. If a professor sends an e-mail to all his students, it's unsolicited and bulk, but not spam. Not all UBE (Unsolicited Bulk E-mail) is spam. Most is, though. But it is a slippery slope: I sometimes get e-mails from political groups where I'm absolutely not sure whether I should classify it as spam or not (and thus happily leave it in my 'unsure' folder)
Re:Largest ISP? by Anonymous Coward · 2004-03-01 23:44 · Score: 0

Yeah, all the statisics aside, they do fuck all about spam abuse on their network
Re:Largest ISP? by RMH101 · 2004-03-01 23:45 · Score: 1

"How much is a CPU cycle worth, anyway?"
Well, if I'm an ISP paying a large amount per month to keep my infrastructure running, and spam accounts for 30% of my network traffic, the answer is "quite a lot, actually".
Re:Largest ISP? by Arker · 2004-03-02 01:27 · Score: 3, Insightful

I respectfully disagree. It doesn't matter one bit if it's commercial or not. It doesn't matter if I agree with the message or not. The key is it that it's unsolicited and bulk. This is key because once you allow unsolicited bulk emailings, you create a system where there is little to no extra cost to send to extra people, and it makes sense to send to as many as possible, Carry that somewhere near it's logical conclusions. Every business in the US sending one message a year to every email address is enough to destroy email as a useable media. Every nonprofit doing the same would have essentially the same effect. The point is that once you allow the use of email for unsolicited bulk mailing, you create an incentive to send so much email that no one will ever be able to find the messages they actually have their email accounts to receive.

I've been spammed by the Republicans, and the Democrats, by the Libertarians, by the Green Party and the Reform Party and the Socialist Workers Party and even by some group in Portugal whose dispatches I find difficult to decipher.

Some of these groups had my deepest sympathy. I still made sure each and every one felt the pain that comes with spamvertising. Why? Simple. If there isn't a consistent and reliable pain to be anticipated anytime you spam, commercial or not, then there is every incentive to send ads to everyone as often as possible until email becomes completely unusable. But, as long as some of us stand on our right not to be spammed, complain about it and insist politely but forcefully that those who spam us pay the price as outlined in the AUPs they agreed to, then the cost of Spam is not zero and this does not happen.

So no, I don't agree at all. UBE is Spam. Period. I don't care if they're political, commercial, or trying to raise money for crippled orphans. If you allow UBE you create the incentives that end e-mail as a usable system very shortly afterwards.

The trouble when you come to UUnet and Abovenet is that when you complain, they ignore you. Normally that means go to their upstream - well guess what, they have no upstream, for all intents and purposes they're it. If everybody else on the planet got together and blackholed them, it might work, but it would cause the rest of us almost as much pain as them. They're that big. They know it, and so unlike all the other ISPs they don't give a flying f$ck what their customers do, or what you think about it.

Got a solution to that problem? I'd love to hear it.

--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Re:Largest ISP? by melonman · 2004-03-02 03:44 · Score: 1

This thread seems to have gone off in all sorts of slashdot-like tangents, but no-one seems to have picked up on what I assume was the original point, namely that bigger ISPs are always going to have worse spam records, simply because they have more customers. The spam vigilantes seem to count numbers of complaints rather than complaints as a percentage of customers, so of course the big guys come off worse!

If we all act on this logic, the only people allowed to send mail will be students with email servers in their dorm rooms, and, guess what, half of them will end up hosting spammers.

Before all those spam vigilantes flame me, could they provide some figures comparing ISPs that take into account the size of their customer base? If not, the figures are about as useful as the last byte of the ISP's nameserver's NIC MAC address in terms of dealing with spam.

--
Virtually serving coffee
Re:Largest ISP? by Anonymous Coward · 2004-03-02 05:34 · Score: 0

It's grammar, not grammer, dumbass.
Re:Largest ISP? by mysticalreaper · 2004-03-02 06:28 · Score: 1

Not really. AT&T is also huge, so is qwest, and sprint. There are pleny of large ISPs, plenty. And most of them aren't on this 'we host spammers' list. Which customers you serve is a concious choice by the company, and it's easy to be spam-friendly, or anti-spam.

HOWEVER, i think your point about bigness does affect their ability to not care without repurcussions. Typically if a company is hosting spammers and won't listen to advice, the response is to block that IP block utterly. This works fine for small webhosts and teh like, but who can block worldcom? No one, cause it's too huge. But you could block a small icelandic ISP (for example). In that sense, they are able to hide behind their bigness.

It parallels with MS. It's very hard to say "screw MS, i don't care it works on windows", because they've such a strong market position.
Re:Largest ISP? by melonman · 2004-03-02 06:38 · Score: 1

But do Quest or Sprint offer the kind of hosting options used by spammers, ie leased machines in server parks or cheapish broadband connections? It's an honest question, I don't know the answer, what bothers me is that no-one seems to think that the answer matters...

--
Virtually serving coffee
Re:Largest ISP? by ClioCJS · 2004-03-02 08:41 · Score: 1

They may not monitor the content of your traffic, but they certainly keep track of how much data was sent. To the byte. The justice department required a full report down to the last byte (of course like 0.1% of traffic was unaccounted for) for MCI to merge with WorldCom. (I had to stay late that day). (Moderators please mod this redundant and off topic.)

--
-Clio
Karma: Bad (mostly from not giving a fuck)
Blog: http://clintjcl.wordpress.com
Re:Largest ISP? by minas-beede · 2004-03-04 12:38 · Score: 1

The trouble when you come to UUnet and Abovenet is that when you complain, they ignore you. Normally that means go to their upstream - well guess what, they have no upstream, for all intents and purposes they're it. If everybody else on the planet got together and blackholed them, it might work, but it would cause the rest of us almost as much pain as them. They're that big. They know it, and so unlike all the other ISPs they don't give a flying f$ck what their customers do, or what you think about it.

Got a solution to that problem? I'd love to hear it.

Years ago, when all were saying that same thing about uu.net, I got a spammer terminated. I had to send a second message (I'll admit that) but I never had to raise my voice, never had to make threats. I just laid out the facts that I could prove: their customer was attempting to relay spam through a university server. The customer disappeared. Later, he appeared again, on uu.net. Again, two messages were all it took.

Above.net I don't know - I never sent a complait to them that I can recall.

In 2003 Michael Tokarev notified uu.net that a spammer was attemtping to relay email through his server, in Moscow. Michael notified uu.net more cleverly: he sent the URL (http://www.corpit.ru/cgi-bin/h0n5yp0t) for a web page that reported the IP sources of recent spam. No surprise: after a while (and I think after a second remineder) uu.net started terminating spammer accounts. Then they'd refresh the page and see if a new throwaway account at uu.net was in use. If so, that account got terminated. and so on.

The spammer got thrown off three ISPS that way in one weekend and had to shut down for a while. Alan Ralsky is the spammer's name: the spam was coming from Ralsky's server farm in Dallas.

Sadly, Michael turned the honeypot off in July of 2003. but it was good while it lasted.

More recently Ron Guilmette had astounding results with his small network of open proxy honeypots. He, too, has shut down.

Make the right complaint and the ISP will listen. Or so it seems to me, from the evidence.
Re:Largest ISP? by Arker · 2004-03-04 15:09 · Score: 1

But, as I said already, I'm not talking about sending spam. You can play whack-a-mole forever and they'll just keep getting throw aways, or as is more the style these days, using trojaned computers. The point is whacking the websites where the spammers actually make their money.

--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Re:Largest ISP? by minas-beede · 2004-03-05 01:05 · Score: 1

"But, as I said already, I'm not talking about sending spam."

I could have sworn you were. You said uu.net and above.net ignored complaints and asked for a solution to the problem. I gave a solution, based on actual experience that shows it works.

It's not illegal or abusive to have a website - even if the spammer generates leads for that website by committing abuse. How are you going to get the ISP to nuke the website?

As I've said, the ISPS (even uu.net, that perpetual bane of complaints) nuked spammer accounts when they were pointed out to uu.net as sources of abuse.

Ask for a solution, get a solution. Reject that solution and ... I dunno. But you're not alone. For some strange reason based on the imponderable quirks of the human mind people want spam to be stopped only if it is done using the techniques that have so far failed to stop spam. They think being tough about open relays should end spam so they insist that the solution include being tough on open relays. That in spite of the clear wording in RFC 2505 that says (correctly) that securing open relays is not and will not be a successful strategy for ending spam. It's far more effective to open the relays a bit: let the spammers access them, deliver the spammers' test messages. Best is to set up a system for that purpose alone, one that doesn't handle any real SMTP traffic. Then the operator knows the SMTP traffic to it is suspect - and the operator can do whatever he wants to that traffic secure in the knowledge he is hitting spam and spam alone. That's about as simple as anything can be - but you'd have a very hard time getting even 10% of system operators to even think about it, let alone approve it. It's not what they think will work so they reject it, preferring to stay with what flat-out doesn't work. I don't say how to attack the spammers' web sites so you say "It's not what I want."

OK - next time make sure the question specifies that the solution must be taken from the body of things that have failed. Then you won't be bothered by any replies at all - there isn't any such solution. I'll keep trying to find people that actually want to end spam and will look at facts long enough to see how it can be done (but the evidence is getting strong that I'm pursuing yet another failed path - there are no such people.)
Re:Largest ISP? by Arker · 2004-03-05 02:00 · Score: 1

If you go back up the thread a couple posts I did make it clear what I was talking about.
It's not illegal or abusive to have a website - even if the spammer generates leads for that website by committing abuse. How are you going to get the ISP to nuke the website?

Illegal has nothing to do with it. This is a world governed by contracts and customs, and one the law isn't generally capable of dealing with effectively anyway. It is certainly abusive however. And cutting them off is the only way to really address the spam problem - they can keep getting throw aways and zombie-ing puters to send forever. When you play whack a mole with the sending accounts, you're just wasting your time, 99 times out of 100 they've already been abandoned by the time the first complaints hit anyway. Spammers learned that the accounts they send from will be tracked down and nuked a long time ago, and adapted to that.

In order to put a crimp in the spam problem you have to hit them where it hurts - and that means tracking down how they're making money off the spam, usually a website, and nuking it before they can collect.

Contrary to your statemen that this is impossible, I've gotten plenty of websites nuked. Reputable hosting companies won't host websites that spamvertise, and disreputable ones back off pretty quick when it starts generating problems with their upstream. Even if they pop up two days later at another address, you've caused them considerable expense in terms of time, money, and missed business from prior spam runs. This actually reduces spam. Whacking throw away accounts does nothing.

How do you do it? The same way you get sending accounts canceled, you complain, politely but firmly, you document your case thoroughly, and if you don't get action you escalate upstream until you do.

Best is to set up a system for that purpose alone, one that doesn't handle any real SMTP traffic. Then the operator knows the SMTP traffic to it is suspect - and the operator can do whatever he wants to that traffic secure in the knowledge he is hitting spam and spam alone.

That's a good idea (not a new one, but still a good one.) You still need to be able to use that data to whack their websites, though, or you'll be only a very minor inconvenience to them.

--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Re:Largest ISP? by minas-beede · 2004-03-05 02:47 · Score: 1

That's a good idea (not a new one, but still a good one.) You still need to be able to use that data to whack their websites, though, or you'll be only a very minor inconvenience to them.

I know it's not new: I was saying it years ago. If someone said it before me I'm not in the least surprised: it's all simple and logical. The surprise is that it isn't being done (complex and illogical is the well-worn anti-spam path.)

Getting an entire spamming operation shut down (for a while) isn't a "minor" inconvenience, getting the feed pulled to the servers in the spammer's $750,000 house isn't a "minor" inconvenience. Getting spammer accounts nuked is just part of the goal: educating the ISPs to be able to find the spammers on their own, without honeypot help, is the greater goal. Then the ISPs will clean themselves and their neighbors and the problem will be gone. (If the neighbor doesn't clean himself rapidly enough, block the offending traffic at the ISP level.)

Don't paint this as simple "whack-a-mole" - it's much more.

However, I don't really care if anyone ever again uses a honeypot. ISPs, if they'd simply do some intelligent traffic analysis (and then take appropriate action), could accomplish far more than a thousand honeypots could. The traffic from a few billion spam messages per day isn't exactly invisible. The ISPs should find the suspect trafic and act on what they find (and quit screwing around - spam is a big nuisance.) Do they not have the right to reject offensive traffic (in the US, at least)? It's about time they took steps to find the offensive (spam) traffic and to reject that - and I do not mean wait until it comes to the destination server (an approach that works creakily at best.) A dumb old obsolete workstation running an MTA that is so old it doesn't recognize EHLO can trap and reject spam - it doesn't take proceesor power or sophisticated recognition techniques (I ran such a dumb old workstation: a Vaxstation 4000/90.) There are free honeypot packages available - those are smarter than that MTA that didn't recognize EHLO - but not particularly more sophisticated. Until the ISPs do the smart traffic analysis there's room for honeypots - lots of them. Even there the truth is that after the first several hundred to thousand of them (if that were ever to happen) the rest might trap almost nothing - the spam would be gone. That neglects spam zombies - there full honeypots and traffic analysis are the more powerful approaches. See much about either being proposed? No - the emphasis is still on floundering around at the receiving server. That stops spam to that server (when it works) but it doesn't work to stop spam period.

What comes around... by rf0 · 2004-03-01 12:00 · Score: 5, Interesting

...goes around. I'm sure when spam block become so vicious that ISP's like this are blocked off they will either go under or change their mind

Rus

--
Cheap UK and US VPS

Re:What comes around... by orion024 · 2004-03-01 12:06 · Score: 5, Interesting

That's a valid point. Or... we might help accelerate that process. What if filtered spam was "returned" to the sender? Granted this would put extra load on all of our own ISP email servers, but it would put a MUCH greater load on the ISP's who host the spammers. It's one thing to send out 1million spam messages on your server, but to have to deal with all of those emails coming right back at them...
Re:What comes around... by taustin · 2004-03-01 12:16 · Score: 2, Insightful

Unfortunately, UUNet is Worldcom, and they handle something like 50% of all internet traffic at some point. They could block the entire rest of the internet easier than we could block them.
Re:What comes around... by taustin · 2004-03-01 12:19 · Score: 5, Insightful

Or... we might help accelerate that process. What if filtered spam was "returned" to the sender?

How do you identify the sender? The From: address is forged, the envelope MAIL FROM: is forged, the Reply-To: if forged, and in most cases, the originating IP address (the only one you can count on) is a virus infected zombie.

Granted this would put extra load on all of our own ISP email servers, but it would put a MUCH greater load on the ISP's who host the spammers.

No. All it will do is bombard some innocent victim (probably somebody who complained about spam to the spammer's ISP) with thousands - or millions - of emails that they were not reponsible for. That means that you are part of the attack,, part of the problem.

It's one thing to send out 1million spam messages on your server, but to have to deal with all of those emails coming right back at them...

Which is precisely why spammers forge all identifying information they possibly can, and why your plan will make spam worse, not better.
Re:What comes around... by alienw · 2004-03-01 12:20 · Score: 1

In case you haven't received spam lately, spammers usually use some random person's email address as a return address (i.e. a joe-job). So the ISP that sent the spam would not get any messages bounced.
Re:What comes around... by chimpo13 · 2004-03-01 12:30 · Score: 4, Insightful

I love, love, LOVE getting tons of messages bounced back from when one of my domain names gets used as the From in spam. Or when I get MS virus' bounced back saying "You sent a virus" even though I'm not running microsoft.

But it does sound good on paper.

--
riding round the world on an old motorcycle
Re:What comes around... by Zebra_X · 2004-03-01 12:36 · Score: 1

The FROM address is almost always forged. The result, the returned spam goes to another e-mail address found in their spam list, YOU for example. When/if you ever get a bunch of return to sender mail responses for no reason, you will have found yourself a victim of this tactic.
Re:What comes around... by Anonymous Coward · 2004-03-01 12:40 · Score: 0

somewhere along the line the connection was made from an smtp server.

hit it there.
Re:What comes around... by robogun · 2004-03-01 13:04 · Score: 1

Filtering on RBL's and regular expressions (using Spam Pal for WIndows) kills 99.0% of my spam without need for Bayesian. And I get weird spam (foreign langiages, Argentianian, etc) in addition to the usual mortgage, enlargement and viagra spam.
If you're into Bayesian there is a plug-in but only recommend for people who like to tinker. Spam Pal works well enough OOB to waste time on that.
I used to be against RBLs but they work so well, it's a beautiful thing. I have had one false positive in the last month (out of 3000 total mails), and fished it out, nothing lost.
In my mind ostracizing their IP's is the only way to bring these rogue ISP's into line.
Re:What comes around... by pinheadcelt · 2004-03-01 13:04 · Score: 2, Insightful

!THWACK!

No, you weren't paying attention. Nowadays, lots of spam comes from zombied machines. While these tend to be run by idiots, they're still an innocent third party.

OTOH, I can see sending this back to the corporate mail servers of some of the large ISPs hosting these zombied machines and refusing to cut them off from the 'net.

I've seen zombied machines left on the net for *months*. I'm still seeing my servers hit from machines that were infected *last year*. This is pure laziness on the part of the ISPs hosting these morons. Their accounts should have been yanked long ago. I won't mention names (**comcast** cough cough), but this smacks of gross negligence.

--
-- The pinhead celt
Re:What comes around... by orion024 · 2004-03-01 13:25 · Score: 1

That is certainly a very valid point. My fault was my assumption that, if we knew that these certain ISP's house spammers, we must have known because spam was originating from their servers... and how do we know this? I guess I assumed this knowledge came from the originating IP informaiton, which would give us a direction to return the spam to.
Re:What comes around... by Penguinshit · 2004-03-01 13:28 · Score: 1

All that would do is create the SMTP equivalent of a smurf ping attack. The poor spoofed (or zombied) victim would be crushed, and not the actual spammer.

--
I have something in common with Stephen Hawking...
Re:What comes around... by orkysoft · 2004-03-01 13:31 · Score: 1

What does the body do to virus-infected cells? It kills them.

We are the T-cells of the internet. From now on, Slashdot should provide links to virus-infected computers. As a result, the virus-infected computers will melt. Problem solved.

Just kidding, of course.

But seriously, what do you do to Jehovah witnesses? Because those virus-infected computers are a lot like them, only they preach Make Money Fast and Herbal Viagra, and they won't listen if you tell them to go away, instead, there'll be hundreds at your doorstep every day.

I think the owners of those virus-infected computers should be held responsible. That's the only way those people will be motivated to solve the problem. They might even try to sue MS for selling vulnerable software while lying it is secure.

</rant>

--

I suffer from attention surplus disorder.
Re:What comes around... by ag0ny · 2004-03-01 14:56 · Score: 1

I was the victim of a joe-job like that a few weeks ago. Details here. Some guy from Philippines started sending spam using email addresses in my domain, so during almsot two weeks I was receiving a constant flood of several hundred thousand returned mails a day. They're still coming, and a much slower rate.

Their ISP didn't even care to reply the email I sent to their abuse@ address. :-/

Oh, and the spammer was stupid enough to send his 'From' list as an attachment on many of the emails. I got many copies of the list in the returned emails.

--
My site
Re:What comes around... by Anonymous Coward · 2004-03-01 16:50 · Score: 0

Err...

I send an e-mail to you from joe@example.com with the spam messege, you "return" it to the wrong address becoming an open relay?
Re:What comes around... by gowen · 2004-03-01 20:43 · Score: 1

How do you identify the sender?
Last IP address before your own in the Received: section. Essentially unforgeable (without a severe network hijacking), since that's whats used to establish the SMTP connection.

--
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
Re:What comes around... by poot_rootbeer · 2004-03-02 04:17 · Score: 1

All it will do is bombard some innocent victim [...] with thousands - or millions - of emails that they were not reponsible for.

If the email was sent from a box you own, you are responsible for it.

If you make the conscious decision to connect your computer to a network, you are responsible for it.
Re:What comes around... by taustin · 2004-03-02 07:00 · Score: 1

Last IP address before your own in the Received: section

Which is often a virus infected zombie that isn't running an SMTP server anyway.

And if it's not, it's the main mail server of a zombie's ISP. Mail bomb them, and you won't have to worry about spam any more after they have you put off the 'net entirely. Or take your advice, and return the favor. Do you really want AOL cc'ing you on all their spam?
Re:What comes around... by minas-beede · 2004-03-04 12:51 · Score: 1

How do you identify the sender? The From: address is forged, the envelope MAIL FROM: is forged, the Reply-To: if forged, and in most cases, the originating IP address (the only one you can count on) is a virus infected zombie.

Correct. An open relay honeypot to which I have access trapped 1458 spam messages with 140658 recipients on Feb 16, all from 211.38.34.203, but that's probably just an open proxy or some other abused IP. Openrbl.org seems to agree.

It was diploma spam, with contact made by phoning 1-212-208-4551. Spam still being sent: it has recent hits in news.admin.net-abuse.sightings. If you didn't get yours maybe you were one of the 140658 (or one of the thousands others protected from the same spam that came to the honeypot through different IPs.) If you figure it up as 97 recipients per spam you'll find the count is off. The remaining messages were to the spammer's own dropbox alone - and he finally paid attention to the fact he wasn't getting his copies and stopped using the honeypot to relay spam. Which, of course, never happened (the relaying, that is.)

why? by .silG.00 · 2004-03-01 12:01 · Score: 2, Interesting

why would the competition would have luck by hosting SPAMMERS? get payed because of all the traffic?

--
------
mmmm round and soft...

Re:why? by justMichael · 2004-03-01 12:33 · Score: 2, Funny

When a spammer finds a "spam friendly" ISP they generally pay a premium for their access. Which is why the ISP is spam friendly in the first place.

Disclaimer: NO I am not a spammer. If you want I'll supply the "XL Humungous Butt Plugs" to give to spammers as a gift, you are going to have to deliver it yourself. With dimensions of 5" x 9", most folks are not gonna like it, unless the gaotse guy is a spammer.

I know not by ackthpt · 2004-03-01 12:02 · Score: 4, Insightful

I know not where it comes from, but I know where it goes. About 500 pieces of it each day, most of it filtered. I have to wonder aloud, with such a deluge, do any of these fools pushing junk actually believe such an onslaught will generate business?

--

A feeling of having made the same mistake before: Deja Foobar

Re:I know not by Kenja · 2004-03-01 12:05 · Score: 5, Insightful

"I know not where it comes from, but I know where it goes. About 500 pieces of it each day, most of it filtered. I have to wonder aloud, with such a deluge, do any of these fools pushing junk actually believe such an onslaught will generate business?"
It DOES generate buisness, thats one of the problems. Stupid people are out there on the internet trying to make there "members" larger.

--

"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Re:I know not by pangian · 2004-03-01 12:14 · Score: 5, Insightful

Yes. They do. Therein lies the rub. Either:

1) Spamming does make money, because some idiots actually buy things from spammers;

2) People don't actually buy directly from spammers, but for marketers of some products (illicit, low yield) mainstream media just isn't an option, so the only way to make people aware that these products exist is through spam. (i.e. I may not buy herbal viagra, or dental insurance or an MBA directly from the people flooding my inbox, but now I know that I can buy these things online. If me and 100 of my neighbors search for these products later, at least a few will buy from the original spammer.

3) Professional spamming shops are doing a good job of convincing retailers that 1) and/or 2) are true.
Re:I know not by autopr0n · 2004-03-01 12:15 · Score: 1

I know not where it comes from, but I know where it goes. About 500 pieces of it each day, most of it filtered. I have to wonder aloud, with such a deluge, do any of these fools pushing junk actually believe such an onslaught will generate business?

Uh, if it didn't generate revinue, then people wouldn't do it. A huge amount of my spam gets filtered, but not enough for me. (I just updated my baysian filter yesterday, and it works much better now, but spammers aren't stupid and know how to get around filters).

I just wish they would enforce that new law. The federal government took the time to make most harsher state laws moot, and now they arn't even doing anything to enforce their bullshit laws.

It's really fucking irritating.

--
autopr0n is like, down and stuff.
Re:I know not by ackthpt · 2004-03-01 12:16 · Score: 1

It DOES generate buisness, thats one of the problems. Stupid people are out there on the internet trying to make there "members" larger.
I had some thoughts on the bombardment last week as I was looking at a Junk Fax pinned to the wall. Business must be awful. The spammers must be trying to get to new addresses, but don't cross off old addresses that never generate anything (If I'm Alan Ralsky, I probably don't give a rats butt, I charge per spam wherever it goes.) CWMS or something like that has been pushed for weeks in the Pump and Dump, via Fax and Spam. That it takes them so long to find enough suckers to buy in tells me the impact of the average spam is low and probably getting lower as the volume increases.

--

A feeling of having made the same mistake before: Deja Foobar
Re:I know not by Jack+Schitt · 2004-03-01 12:17 · Score: 1

I know not where it comes from, but I know where it goes. About 500 pieces of it each day, most of it filtered. I have to wonder aloud, with such a deluge, do any of these fools pushing junk actually believe such an onslaught will generate business?

Actually, it does generate business. The actual number escape me right now, but I'll put it like this:

<hypothetical>

In one day, the spammer will send out approx. one billion spams.

If 0.5% of spam targets (1,000,000,000*0.005=5,000,000 people) purchase a product worth $50, that's $250,000,000 gross income.

Let's assume the profit margin of the product is $5.00, the company would make a profit of $25,000,000. Let's also assume that the company gives the spammer a 1% commission off profit. In one day, the spammer makes $250,000. (Or $91,250,000 a year, if he runs it 365)

I made $8,750 last year (that's what I told the IRS, anyway). This spammer just made 10,429 (give or take a few tenths) times as much as I did, just for having a couple of T1 lines going to his house.

</hypothetical>

Remember, I don't have actual numbers. These are all numbers I made up which I think might be close to the actual numbers.

--
This message brought to you by Jack Schitt's Previously Shat Shit
Re:I know not by ackthpt · 2004-03-01 12:25 · Score: 2, Insightful

I just wish they would enforce that new law. The federal government took the time to make most harsher state laws moot, and now they arn't even doing anything to enforce their bullshit laws.
As one critic voiced it, on the BBC this morning, the current administration doesn't do anything until it's crisis. I wish that weren't true, maybe they are actually gathering up a pile of this trash and getting ready to haul in about 500 people, which should scare the bejeezus out of most of the rest. If Bush wants votes, this would probably be a good way to demonstrate how much he cares about the average american. [some figure in the news today puts the number of americans on the internet at 150 million, how many of that do you believe think spam is a problem?]

--

A feeling of having made the same mistake before: Deja Foobar
Re:I know not by ackthpt · 2004-03-01 12:33 · Score: 2, Insightful

A couple points of your hypothesis I'll contest.
1) I think the number of emails going out to generate the same return is going up as most people are wise to it.
2) The agent (Ralsky as one example) charges for the spam, probably could care less or is simply unable to meter success. All transactions are cash up front.
As the volume needs to increas and blocking comes into play there should be a cap. As my spam volume is still increasing, but the rate of increase is slowing I think we're approaching that cap.

--

A feeling of having made the same mistake before: Deja Foobar
Re:I know not by Fnkmaster · 2004-03-01 12:37 · Score: 2, Insightful

I think you're right. Even if nobody buys Viagra from a spam email, the first place anybody thinks of to get Viagra is online - why bother going to see a doctor, you can just Google for Viagra and buy online! It's interesting, the real benefit from a lot of spam would seem to be for the manufacturer who benefits from the brand-building and the awareness of an online market created (thus also benefitting those who rank high in Google results).

In fact, it would seem possible that some of the egregious violators may just be setting up phantom shops to spamvertize, which can be easily shut down, renamed, etc. while they keep a separate "clean" operation for harvesting search hits.

Or maybe spam just works and people really are buying from spammers.
Re:I know not by Fnkmaster · 2004-03-01 12:42 · Score: 1

The only thing worse than stupid people buying from spam is stupid people with small dicks buying from spam.
Re:I know not by myowntrueself · 2004-03-01 12:42 · Score: 1

This is what puzzles me about the whole spam 'problem'.

In order for spam to make a profit there must be a way to get money from the spam recipient to the spammers client.

There must, surely, be a way to send something other than money to the spammers client, something that they would rather not receive.

One has to make buying the services of a spammer more trouble than its worth.

If one in a million spam recipients forking out cash is enough to make spam profitable, then 999,999 out of a million spam recipients 'forking out' something undesirable would surely be enough to make spam unprofitable?

--
In the free world the media isn't government run; the government is media run.
Re:I know not by pipingguy · 2004-03-01 13:05 · Score: 1

3) Professional spamming shops are doing a good job of convincing retailers that 1) and/or 2) are true.

I think 3) is the case. That, or there is something more nefarious afoot.
Re:I know not by heavilyarmedgorilla · 2004-03-01 13:14 · Score: 1

Spot on. Association is how we as humans operate, and if nothing else, a daily deluge of spam has formed within us a seemingly irrevocable link between viagra and the internet.
Re:I know not by Jack+Schitt · 2004-03-01 14:52 · Score: 1

how about a spammer who is instructed by the client to put a specific url that includes GET data other than the uri (for the lay reader, all the stuff after a "?" in a url)?

It's quite probable that the client could then meter the success of their advertising campaign. that is, however, contingint on whether the client WANTS to meter the success...

In response to the first part, though... just spam people on AOL. The very fact that they PAY for AOL means that they'll pay for just about anything...

--
This message brought to you by Jack Schitt's Previously Shat Shit
Re:I know not by generationxyu · 2004-03-01 15:23 · Score: 1

Think of it this way. If you run a telemarketing agency, you have to pay for every phone call, you have to pay for every hour that the 16 year olds working for you work, and you get very little turnaround.
Now imagine this. You crawl the web, IRC, Usenet, etc, for email addresses. You get hundreds of thousands a day. This costs you bandwidth. Max of about (liberally) $1000 a year. Then you send email to all of those addresses. It takes about an hour. Max of about another $1000 a year. Do this every day. The company/people paying you to spam pay you, let's say, $.01 per email. That's $1000 a day. If 10 of those hundred thousand people buy the product, the company's making profit. You, the spammer, are making insane amounts of profit.
I hate spam as much as the next guy. But it's a good investment. (Although I've heard you can make more money selling your soul to Satan, and it's not as evil).

--
I mod down pyramid schemes in sigs.
Re:I know not by cdrguru · 2004-03-01 16:12 · Score: 1

I think you are missing the point. Spam isn't something that Jr. Viagra Distributor, Inc. sends out trying to get new customers - it is something that Spam-Is-Us sends out. Spam-Is-Us then sends a bill to Jr. Viagra Distributor for the email that was sent out.
Spam-Is-Us cares not how much was delivered, opened, read or anything else. Maybe - just maybe - they send out HTML email so they can track how many are opened. These "opened" are either then reported or billed at a higher rate.
Note: Outlook preview accesses the HTML picture, so therefore counts as "opening" the email.
The problem is that Spam-Is-Us sends out spam they don't care about, and Jr. Viagra Distributor thinks paying for spamming will get them some customers. After a while, Jr. figures out it isn't working but SuperSizeNow has contracted with Spam-Is-Us for selling their Viagra and we perceive no net difference - we're still getting Viagra spam written by the same person at Spam-Is-Us.
This makes it look like it must be selling because we keep getting the same message over and over again.

ATTBI.COM!!!!!! by ErnstKompressor · 2004-03-01 12:03 · Score: 0, Offtopic

If I get another bogus e-mail from "anyone@attbi.com" I'm gonna snap!!! They are no more! Kill it in the registrar...

--
We apologise for the fault in this post. Those responsible have been sacked. -- Signed RICHARD M. NIXON

Re:ATTBI.COM!!!!!! by ackthpt · 2004-03-01 12:11 · Score: 3, Interesting

If I get another bogus e-mail from "anyone@attbi.com" I'm gonna snap!!! They are no more! Kill it in the registrar...
263.net/263.com bombs me pretty consistently, I think it's chinese. It suggests pretty strongly to me that a lot of this "Chinese censorship" stuff is crap. If you've got the dough, then you can do as you please in the PRC.

--

A feeling of having made the same mistake before: Deja Foobar
Re:ATTBI.COM!!!!!! by drinkypoo · 2004-03-01 12:22 · Score: 2, Insightful

Comcast is a joke, and not a funny one, hence many people have not been transitioned from attbi.com addresses to comcast.net ones.

--
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Re:ATTBI.COM!!!!!! by Anonymous Coward · 2004-03-01 13:05 · Score: 0

The Chinese government couldn't care less about spam sent outside of the country. It's only the spam sent internally that they want to stop.
Re:ATTBI.COM!!!!!! by AaronW · 2004-03-01 15:10 · Score: 1

I'm pissed off because I have an attbi account (now Comcast) which I still use. It seems that I must have pissed off a spammer (easy, since I use Spamcop to report them) and they're forging the from address as my address for some of their spams and I get the bounces :-/ Worse, someone keeps spewing out viruses forging the from address as mine and the antivirus software keeps sending me nastygrams. This is not possible since I don't run Windows.

--
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
Re:ATTBI.COM!!!!!! by AaronW · 2004-03-01 15:16 · Score: 1

I'm a former attbi and now comcast user. They transitioned me all right, but I'm pissed off I lost my main email address to some godawful long address. Because of that, I still use my attbi address and when that's gone I'll switch to my own domain name, which I'm already doing to some extent. I'm sick of one ISP buying out another and losing my email address in the process. First @Home->Attbi, then Attbi->Comcast.

-Aaron

--
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.

How to stop spam. by laymil · 2004-03-01 12:03 · Score: 5, Funny

The easiest way to stop spam is as follows:

Step 1: Buy an aluminum baseball bat.
Step 2: Find spammer.
Step 3: Beat spammer with aluminum baseball bat.
Step 4: Sell what is left of spammer to Hormel, makers of spam.
Step 5: Deposit money into legal fund for defense against spam. (Baseball bat Distribution center)

Re:How to stop spam. by corris · 2004-03-01 12:05 · Score: 1, Funny

no, step 5 should be

Step 5: Profit!
Re:How to stop spam. by laymil · 2004-03-01 12:10 · Score: 5, Insightful

On a slightly more serious note:

While I advocate extreme violence against spammers, I do feel that it is the responsibility of an ISP to stop spam at the source.

However, if the spammer is merely leasing an IP/Dedicated connection from the ISP, this involves placing restrictions on the actual line - which isn't called for.

In essence, if you are leasing directly from an upstream provider, they aren't so much an ISP in that case. If the customer was grandfathered in under an old contract, the provider could be left without any legal recourse against the person.

However, if a customer is in violation of their AUP and the AUP was agreed upon at the initiation of the transaction (leasing the line, buying the connection, etc), then the ISP should be held to enforcing that, be it by terminating service or installing filters, etc.

I suppose the most difficult thing is when someone leases a line to run a dedicated server serving legitimate mailing lists, etc.

This becomes a case of "How Draconian do you want your ISP to be?"

I know I can deal with the spam. I hate it, but I'd rather deal with spam than be incredibly restricted by my AUP.
Re:How to stop spam. by FattMattP · 2004-03-01 12:13 · Score: 4, Funny

I know that everyone is going to read the parent post and think what a funny and great idea it is. Well, it's not. A nice solid wood bat is the right way to go. It'll be heavier and will get your point across in much less swings.
:-p

--
Prevent email address forgery. Publish SPF records for y
Re:How to stop spam. by alexdm · 2004-03-01 12:15 · Score: 0

slashdot the spammers!
Re:How to stop spam. by donutz · 2004-03-01 12:38 · Score: 1

Step 4: Sell what is left of spammer to Hormel, makers of spam.

Makers of Spam, not spam.

And I suspect that thousands of Hawaiians would not take kindly to being involuntary cannibals. But then, I have had incorrect suspicions in the past.
Re:How to stop spam. by Anonymous Coward · 2004-03-01 12:54 · Score: 0

Makers of Spam, not spam.

The Hormel trademark is SPAM. All caps.

We do not object to use of this slang term to describe UCE, although we do object to the use of the word "spam" as a trademark and to the use of our product image in association with that term. Also, if the term is to be used, it should be used in all lower-case letters to distinguish it from our trademark SPAM, which should be used with all uppercase letters.
Re:How to stop spam. by dj245 · 2004-03-01 13:47 · Score: 1

I know that everyone is going to read the parent post and think what a funny and great idea it is. Well, it's not. A nice wooden Telephone Pole is the way to go here. It'll be heavier and will get your point across in much less swings, provided the person using it can wield it properly.

--
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
Re:How to stop spam. by Anonymous Coward · 2004-03-01 15:41 · Score: 0

I know that everyone is going to read the parent post and think what a funny and great idea it is. Well, it's not. A nice solid wood bat is the right way to go. It'll be heavier and will get your point across in much less swings.

Less swings? I think the more swings the better - make those spammers suffer as long as possible.
Re:How to stop spam. by cdrguru · 2004-03-01 16:21 · Score: 1

As to just buying a T1, I assure you that most of the time it comes with no AUP. I have had two companies providing a T1 and neither had any policy about use, any abuse handling or anything that indicated they were interested in the traffic on the T1.
If I was a minor-league spammer, I would find this relationship just fine for business. There is no "ISP" relationship here - the company provides zero service other than a data connection.
Re:How to stop spam. by laymil · 2004-03-01 17:49 · Score: 2, Informative

That is essentiall what I was trying to say. A lot of connections via UUNET are made without an ISP relationship - so even though they own the block of IPs, etc - it's not their responsibility.
Re:How to stop spam. by Anonymous Coward · 2004-03-01 18:24 · Score: 0

I think you should replace Step 5 with what i see on here some often... Step 5. Profit! ;]

Mirror? by Anonymous Coward · 2004-03-01 12:04 · Score: 0

Does anyone have a mirror? I can't seem to load the page.

Re:Mirror? by Anonymous Coward · 2004-03-01 13:42 · Score: 0

Good old Google to the rescue.

I just cancelled my subscription to UUNET by Anonymous Coward · 2004-03-01 12:05 · Score: 0, Funny

After reading this, I'd rather go with AOL than some bastard ISP that allows spam to exist. Screw you UUNET.

Clue by Cranx · 2004-03-01 12:05 · Score: 5, Informative

Spammers can sneak into even the most STRINGENT anti-spam ISP network. A stolen credit card that works only once gets a spammer an account that can deliver many thousands of letters before they're shut down. UUnet isn't spam-friendly anymore than Rackspace is spam-friendly. Spam is going nowhere until good authentication techniques are implemented internet-wide.

Re:Clue by nmoog · 2004-03-01 12:11 · Score: 1

Well acording to the "Top 10" lists at the bottom of the article, UUNet IS more spam-friendly. Perhaps UUNet should ask Rackspace if there maybe possibly could be something that they might change to drop a coupla rungs.
Re:Clue by neiffer · 2004-03-01 12:13 · Score: 3, Insightful

This is what makes acts like the CANSPAM act so silly. Does anyone really think we'll be able to deal with it, legally or otherwise, until we have the technology implimented to do so?
Re:Clue by taustin · 2004-03-01 12:13 · Score: 0, Flamebait

One spammer might sneak on to a network. Two spammers might sneak on to a network. Ten spammers might sneak on to a network.

But more spammers than any other ISP will not sneak on to a network with one-use stolen credit cards.

UUNet is a spamhaus.

And you are an idiot.
Re:Clue by eaolson · 2004-03-01 12:24 · Score: 4, Informative

Spammers can sneak into even the most STRINGENT anti-spam ISP network. A stolen credit card that works only once gets a spammer an account that can deliver many thousands of letters before they're shut down.
The question isn't whether or not spammers get on the network. Any system that allows people to sign up automatically with a credit card is vulnerable to that. The question is whether or not UUnet is willing to do anything about a spammer once he's brought to their attention. Although some of the SBL records for UUnet appear to be out of date, some spammers dating back at least to April 2003 are still present on their network.
UUnet isn't spam-friendly anymore than Rackspace is spam-friendly.
It's amusing that you mention Rackspace. I understand they appear to be cleaning up recently, but previously, they were more than happy to host spammers, so long as they paid their bills.
Spam is going nowhere until good authentication techniques are implemented internet-wide.
You'll excuse me if I don't hold my breath. IMHO, so long as there is a China, there will be spam. Until then, I'm going to keep using Spamcop and SPEWS.
Re:Clue by Monkelectric · 2004-03-01 12:44 · Score: 4, Informative

The problem with that statement is its unqualified, when you see statements that say "more then ..." someone is trying to manipulate you.
Here's why -- UUNET is a *HUGE* ISP they have more spammers then anyone else because they're bigger then anyone else. What you need to know is if they have a higher spammer/customer or spammer/site ratio than usual.
You always hear this same stuff about crime statistics. I just heard on the news that crime in california is down 50% and they were credting the 3 strikes law. Of course it means nothing, because if you look at population statistics you'll find out that theres a dramatic drop in population of young people who statistically are most likely to commit crimes. So crime is occuring LESS (total number), but the crime rate is more or less the same.

--
Religion is a gateway psychosis. -- Dave Foley
Re:Clue by LostCluster · 2004-03-01 12:50 · Score: 2, Informative

The only thing that can truely take care of spam is a protocol for the provider upstream of a user to be able to revoke an e-mail that passed through them. It means moving to an e-mail system that doesn't trust home e-mail servers that don't pass through a trusted company anymore.

Right now, any IP address holding computer has the ability to become a mail server, so any IP address holding computer has the ability to spew spam.
Re:Clue by AndroidCat · 2004-03-01 13:04 · Score: 1

Rackspace has been "cleaning up" for years. They used to sacrifice a few token spammers every couple of months on nanae, but that just seemed to be the cheque-bouncers. If they've started to delete spammers faster than they sign up, that would be a nice change.
At least with Spamcop and SPEWS, they stand a chance of getting out for good behaviour. They must be in a lot of private lists for life (of the universe).

--
One line blog. I hear that they're called Twitters now.
Re:Clue by nchip · 2004-03-01 21:46 · Score: 1

Here's why -- UUNET is a *HUGE* ISP they have more spammers then anyone else because they're bigger then anyone else.

nope.

They have more spammers than anyone else because they care less than anyone else.

They still allow send-safe.com in their IP space, even thou send-safe.com has been kicked out from Russian, Chinese and Indian ISPs. They landed on uunet, and found a place to rest. For over 6 months now. And th T1 buyer hosting send-safe.com now was identified as a spammer over year ago.

uunet says, here is a T1 line, do whatever you want with it. Scan for vulnarable machines? no problem. Rape proxies araound the world? No problem. Send mail directly from the IPs we gave to you instead hiding the IP using proxies like all the other spammers? Please dont, that would make us seem spam-friendly.

Unfortunatly for uunet, spamhaus doesnt list only those ips used dircetly in sending. They list all ips that owned by spammers.

--
signatures pending - ansa@kos.to - (dont mail there)
Re:Clue by Cranx · 2004-03-02 07:11 · Score: 1

Any ISP of sufficient size is going to be accused of being spam-friendly because there's simply no way to ensure that any given new customer is NOT going to spam. There's simply no way to ensure such a thing.

It's a numbers game. The only way to NOT host a spammer is to close your doors and go out of business. EVERY ISP has to close their doors, because as soon as UUnet and Rackspace do, all their customers are going to host at your favorite ISP that you think is responsible and doesn't host spammers. You will find, soon enough, that they indeed DO host spammers when they show up using fake credit cards and sign up for new accounts and start pumping spam. When you suddenly can't deliver email anymore because SPEWS has decided that your favorite ISP is spammer-friendly, don't come crying to me...you have to be tough on those spammer-friendly ISP's after all!
Re:Clue by Cranx · 2004-03-02 09:00 · Score: 1

Yes, but all things being equal, the ratio should not be expected to scale evenly. How well-known an ISP is to their potential market influences the make-up of their market. That is to say, the percentages of "types of customers" doesn't stay the same as an ISP grows/shrinks. If a small ISP with a customer base of 50% geeks and 50% non-geeks grows to 100,000, that 50% geek rate is going to drop dramatically.

Basically, the ratio you're talking about is, itself, affected by UUnet's size and age.
Re:Clue by minas-beede · 2004-03-04 13:02 · Score: 1

"UUnet isn't spam-friendly anymore than Rackspace is spam-friendly."

Did you choose a particularly bad example on purpose? There is only one ISP that ever telephoned me to tell me a lie ("The spammer is being disconnected" - pause - "right ... NOW!") No, he wasn't.

That call came from Rackspace.

It's all about the allmighty dollar by teutonic_leech · 2004-03-01 12:06 · Score: 2, Insightful

... or does anyone really think that these guys are NOT aware of this?

Wow, there's a surprise. by James+A.+H.+Joyce · 2004-03-01 12:06 · Score: 5, Interesting

Big ISPs which can afford to lose customers talk shit and do nothing. You know as well as I do that it's going to be us, the end-users, who have to be proactive about this. These ISPs don't give a fuck. They're probably run by cable school drop-outs.

Re:Wow, there's a surprise. by Anonymous Coward · 2004-03-01 15:03 · Score: 0

Jesus, slashdotters, quit modding up any variation of James Joyce. Look at the trolling history of any of this guy's user names.

Not likely to happen anytime soon... by Saeed+al-Sahaf · 2004-03-01 12:07 · Score: 5, Insightful

...goes around. I'm sure when spam block become so vicious that ISP's like this are blocked off they will either go under or change their mind

I think it's pretty much been proven that this is wishful thinking. When a provider starts blocking large stretches of IP blocks owned by a particular ISP like UUNet, average users scream bloody murder. My prediction is UUNet will do nothing, and nothing will happen to UUNet. Sad but true.

--
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck

Re:Not likely to happen anytime soon... by ilctoh · 2004-03-01 12:18 · Score: 5, Insightful

Correct. It is the ISP's responsibility to prevent SPAM at its source, not merely block users from it. Users are also responsibile for using available filtering technology, and being careful about giving out their email address (especially on personal web pages). Perhaps the most useful thing that any ISP can do right now is to provide an easily accessed and located "Anti-Spam Information Page", with instructions and suggestions for users of that ISP to control SPAM.

--
How many slashes would a slashdot dot, if a slashdot could dot slashes?
Re:Not likely to happen anytime soon... by Herkum01 · 2004-03-01 13:12 · Score: 1

I think what it is will come down to is a lawsuit.

Basically if an ISP gets a denial of service attack via SPAM, they lose business. They look at UUNET(source of the source), and say "HEY, you have AUP but you are not enforcing it!" They shrug their shoulders, and ignore them. A big time lawyer shows up and says, "I am filing a class-action lawsuit against you for not following your own policies, which caused damage to my client."

When a company looks at a couple hundred million dollars in damages, and bad publicity for allowing those Viagra, Penis Enlargement, Breast Enlargement SPAM they really do get worried. It is just sad that it would take a major lawsuit to do it though.
Re:Not likely to happen anytime soon... by dodobh · 2004-03-02 07:19 · Score: 1

Filtering is not a good solution in monetary terms. If you have to filter, you are paying for that spam anyway. Your ISP could offer you a better solution by allowing you to run your own mail server instead of using theirs.
With respect to blocking spam at source, ISPs like UUnet do nothing. blocking them until they clean up their act seems to the best solution available currently.
Which is why I use SPEWS on my mail server.

--
I can throw myself at the ground, and miss.
Re:Not likely to happen anytime soon... by minas-beede · 2004-03-04 12:58 · Score: 1

"Perhaps the most useful thing that any ISP can do right now ..."

I fervently disagree. The most useful thing ISPs could do right now is pay attention to their traffic: do traffic analysis. Billions of spam messages don't travel without a trace. If the ISP would look in the proper manner (just watching source and destination IP and port numbers) the ISP would find enough spam traffic to make life hard for the spammers - if the ISP was suffering any spam traffic. If the ISP is clean it can just sit back and smile - but remember that somewhere out there is a spammer who will be checking that ISPs cusomers for vulnerability very soon again.

No, not watch all traffic all the time: break it down into achievable chunks.

Individual users can run honeypots -even very rudimentatary ones. Llss than that but stilll useful is to look at the software firewall logs and find the events most likely to be spammer activity and then report those to the originating ISP (if it seems the ISP is not a full-fledged spammer enabler.) Port 25 activity and proxy port activity. If the user knows no good reason for the traffic then reporting it will probably be correct, even if the perpetrators aren't all spammers.

Re:grasping for customers by MikeCapone · 2004-03-01 12:08 · Score: 4, Insightful

UUNet is probably just trying to get as many customers as possible.

I'm not sure if this reasoning is sound if we're talking about regular accounts, unless spammers are paying for their bandwidth (a thing I expect they avoid doing at all cost).

A regular customer who checks email once a day should be a lot more profitable to a ISP than someone who sends spam all day long.

Of course things are probably different with commercial accounts... I'm not familiar with UUNet so I don't know if they are a commercial only ISP.

--
Treehugger? Treehugger... Treehugger!

Re:EV1servers.Net by Anonymous Coward · 2004-03-01 12:10 · Score: 0, Funny

What, are you training to be an editor here? All you need now is some trollish editorial at the end of your link, some misspelling, and you'll be well on your way!

http://slashdot.org/article.pl?sid=04/03/01/181820 1&mode=thread

We do not welcome... by Howard+Beale · 2004-03-01 12:10 · Score: 0, Funny

our new spam overlords...

So why are there still customers? by lavalyn · 2004-03-01 12:12 · Score: 2, Insightful

Large portions of UUNet have been listed by the various anti-spam blacklists, such as Spamhaus, and all of UUNet is blacklisted in SPEWS. These providers are the scum of the Earth. They will delay, misdirect, and outright lie to keep their sweet large contracts with the spammers, at the expense of all their other customers.

Do you want to put your faith in a business that is indirectly lining the pockets of spammers?

--
Doing the Right Thing should not be preempted by making a buck.

Re:So why are there still customers? by Anonymous Coward · 2004-03-01 12:20 · Score: 2, Interesting

because the reality is: 1. every person who buys hosting just cant afford to deal with being "politically correct" when choosing providers. Its not practical to change ISP's every 3 months because their current ISP pisses off some vocal minority who represents some whacko cause (take porn, for instance, whom hosting providers get a lot of flack from Christian groups) 2. Sometimes financial constraints force you to go with one provider alone 3. If an ISP shuts down spammers, some other ISP will be happy to make the lost profits that that ISP didnt want to make 4. The SPEWS people are generally regarded as a bunch of hypocritical zealots. Very few people use them and very few people care what they say.
Re:So why are there still customers? by NerdSlayer · 2004-03-01 12:48 · Score: 0, Troll

Well, Spamhaus is one thing, but SPEWS is quite another. It's basically a bunch of retards with too much time on their hands thinking they're Magnum, PI. The routinely block up to 10%+ of all possible IP ranges of the internet, which isn't too useful if you want to receive any real mail at all. Almost every legit sender is sitting close IP-wise to someone shady.
Re:So why are there still customers? by Pig+Hogger · 2004-03-01 13:08 · Score: 2, Insightful

4. The SPEWS people are generally regarded as a bunch of hypocritical zealots. Very few people use them and very few people care what they say.
Only a spammer would talk like that.
Re:So why are there still customers? by AndroidCat · 2004-03-01 13:10 · Score: 1

The routinely block up to 10%+ of all possible IP ranges of the internet
That's an interesting factoid. Too bad it's wrong. Where did you read that whopper?

--
One line blog. I hear that they're called Twitters now.
Re:So why are there still customers? by boobsea · 2004-03-01 13:11 · Score: 1

Only a spammer would talk like that.

Where have I heard this line of argumentation before?

Oh, yeah...

"Either you're with us or you're with the terrorists" - Bush

not to mention Senator McCarthy and others...
Re:So why are there still customers? by Anonymous Coward · 2004-03-01 13:16 · Score: 0

I dont know about the actual figure, but SPEWS blocks entire countries..

so I would not at all be surprised at the 10% figure.

thats what you get for such overzealous blocking
Re:So why are there still customers? by AndroidCat · 2004-03-01 13:40 · Score: 2, Insightful

Entire countries, where the country has an ISP monoculture. Besides SPEWS is only a tool. You can either whitelist ranges, or you can add them where you think SPEWS isn't firm enough.
I see the 10% figure waved frequently by sock-puppets on nanae. I also see an amazing pulse in the anonymous coward posts on spam issues. Interesting.

--
One line blog. I hear that they're called Twitters now.
Re:So why are there still customers? by Anonymous Coward · 2004-03-01 13:52 · Score: 0

So you would participate in the censorship of entire races and cultures in the name of SPAM blocking?

If that doesn't prove how SPEWS really is an extremist organization, I dont know what else you could possibly want..
Re:So why are there still customers? by rizawbone · 2004-03-01 14:09 · Score: 1

Only a spammer would talk like that.

Blanket statements like this are ignorant. Open your eyes.

I'm not a spammer, from working with an abuse department I can safely say working with the people in news.admin.net-abuse.email is like talking to a bunch of stuck up children.

I hate spam, I hate SPEWS, the existance of both has caused equal inconvenience in my life.
Re:So why are there still customers? by NerdSlayer · 2004-03-01 15:08 · Score: 0

It's not wrong. I think it's even conservative. Unfortunately I'm struggling to find the nanae post I'm looking for.

Here's a sample of these terrorist idiots at work though here
Re:So why are there still customers? by AndroidCat · 2004-03-01 15:39 · Score: 1

You trust a site run by Netside? That's less reliable than Al Ralsky. (I trust Al to lie reliably.) They have quite a record of abuse.
I just hope you're not looking for a post on nanae by Jamie or another kook.

--
One line blog. I hear that they're called Twitters now.
Re:So why are there still customers? by Anonymous Coward · 2004-03-01 15:53 · Score: 0

So you would participate in the censorship of entire races and cultures in the name of SPAM blocking?

Sure. Who gives a fuck what inferior races have to say?

Let them live in their cess pools but I need not be obliged to acknowledge their existence. Live and let live, and let the Prime Directive take effect and isolate our little brown brothers.
Re:So why are there still customers? by Geoffreyerffoeg · 2004-03-02 11:57 · Score: 1

Yes.

I do not want to block all of AOL, Earthlink, and myriad local ISPs by blocking UUNet, /the/ major backbone that another post says carries 90% of all e-mail, just because UUNet by itself allows spammers.

(I think AOL uses UUNet as their backbone, am I right?)

Homophobia? by Anonymous Coward · 2004-03-01 12:12 · Score: 0, Flamebait

So what that he is bisexual? Really now, what part of that merits that he should be modded down?

Time for ISP's to take responsiblity. by aldridge · 2004-03-01 12:13 · Score: 5, Funny

Its time for ISP's to take responsiblity for the shit that they host. Didint Gates say that spam will be dead by 2006? ( http://www.cbsnews.com/stories/2004/01/24/tech/mai n595595.shtml). Time to start breaking down doors Bill. I guess he could just use a backdoor in to the spammers running windows.

Re:Time for ISP's to take responsiblity. by gcaseye6677 · 2004-03-01 15:10 · Score: 1

Add that to the list of things that Gates predicted which were, to say the least, a little inaccurate. Remember 640K is enough for anyone? How about viruses being obsolete with Windows XP?
Re:Time for ISP's to take responsiblity. by Anonymous Coward · 2004-03-01 17:48 · Score: 0

Time to start breaking down doors Bill

!?!?

Do they use stolen credit cards regularly? by enosys · 2004-03-01 12:14 · Score: 5, Insightful

Do they use stolen credit cards regularly? I wouldn't think so. You can get away with spam a lot of the time without legal conseqences but credit card fraud is another matter. Wouldn't any spammer that did this sort of thing get caught fast? Or do they go through chained proxies to do it all and regularly get away with it?

Re:Do they use stolen credit cards regularly? by elemental23 · 2004-03-01 16:19 · Score: 3, Informative

You'd be surprised. I work in the abuse department of a large ISP and we see spammers setting up throw-away accounts with unique stolen credit card numbers daily. Spammers are no longer just sending bulk e-mail; now they also frequently traffic in stolen CC numbers and create viruses that install proxy servers on home users' Windows machines for the purpose of covering their tracks.

I guess they figure the reward is worth the risk. Plus they're stupid.

--
I like my women like my coffee... pale and bitter.
Re:Do they use stolen credit cards regularly? by ddent · 2004-03-01 16:50 · Score: 4, Interesting

Apparently your not familiar with the plight of most internet merchants these days. Credit card fraud is basically ignored, and is the merchant's liability. Sad, but true.

--
SSL Certificate

Give spammers their own IP range by KalvinB · 2004-03-01 12:14 · Score: 4, Interesting

UUNet should give known spammers on their network their own IP range. If you spam, you get moved into that range. Those who don't want their crap can then easily filter it out by blocking those allocated spammer IPs. And the ISP still gets paid.

Customers who are running legitimate mail servers can stay out of that range as long as they don't break the AUP. The ISP doesn't even have to kill port 25 on the spammer IPs. They could simply limit the amount of bandwidth that can be used to something like 10MB per day on port 25. Which is reasonable. There's no incentive to out and out ban those IPs if no massive amount of junk can come out of them. The spammer is just forcibly restricted until they can behave themselves. At which time they can go back to a less restricted IP range.

I don't think there's any law that says ISPs can't selectivly put people in certain IP ranges. I don't think spammers have any way to fight it under current anti-discrimination laws. If you can even call it discrimination since it's would be based solely on the actions of the person and not who they are.

Ben

--
Work Safe Porn

Re:Give spammers their own IP range by bigberk · 2004-03-01 12:33 · Score: 4, Insightful

UUNet should give known spammers on their network their own IP range
Are you kidding me? UUNet should boot known spammers from their network. Sheesh. ISPs get bad reputations precisely because they do what you describe (tolerate spammers and try to manage around them).
Re:Give spammers their own IP range by LostCluster · 2004-03-01 12:36 · Score: 1

I don't think there's any law that says ISPs can't selectivly put people in certain IP ranges.

Yes. It's in the laws of physics. ISPs allocate IP blocks in geographic segments, otherwise you'll break routing as we know it. Simply put, the bigger the subnets, the less entries you need in the routing table. Having a subnet mask of 255.255.255.254 is just plain a path that leads to chaos.
Re:Give spammers their own IP range by ebrandsberg · 2004-03-01 12:55 · Score: 1

This idea will be attacked by everybody, spammers and anti-spammers alike. Why? Spammers won't allow the IP's to be changed because it would be the same as being kicked off. Why pay for service when you can't do anything. Anti-spammers will attack it for not getting it off the Internet completely. Either way nobody would like it. Other than that, great idea!
Re:Give spammers their own IP range by Sylver+Dragon · 2004-03-01 13:03 · Score: 2, Insightful

Actually, the idea is a great one, which will never work. Stick all of the spammers in a known IP range, great. Now everyone simply rejects all mail from that IP range, and the world is happy. Problem is, eventually, some ISP is going to get it in thier head that they can squeeze a few more dollars out of the system by offering a "premium" spamming package. This gives the spammer an IP outside the listed spammer range, and allows them to spam to thier black heart's content.
As good as it sounds to put all of the spammers in a box, which we can each shut the lid on, it won't hold. The ISP's will see too much money to be made from allowing spammers outside the box, and then we end up back where we are now.
Nope, the only solution to this problem is going to be a technological one. Fortunatlly, the technology we need has been around since the first days of man, the club. Applied liberally about the head and sholders of every confirmed spammer in the world, we should see a drop in the amount of spam we see.

--
Necessity is the mother of invention.
Laziness is the father.
Re:Give spammers their own IP range by Pig+Hogger · 2004-03-01 13:05 · Score: 1

UUNet should give known spammers on their network their own IP range. If you spam, you get moved into that range. Those who don't want their crap can then easily filter it out by blocking those allocated spammer IPs. And the ISP still gets paid.
This is not necessary, since UUNET is already blocked to the hilt by many blocklists.
Re:Give spammers their own IP range by pinheadcelt · 2004-03-01 13:15 · Score: 1

"Problem is, eventually, some ISP is going to get it in thier head that they can squeeze a few more dollars out of the system by offering a "premium" spamming package." Too late. Ever heard of a "pink contract". Some time ago, one of these got leaked from AT&T. They sold one of these contracts to a spammer. Spammer pays a premium and in return, AT&T won't boot them off. Pink contracts are common as weeds nowadays. This is at the root of the spam problem these days. If large ISPs (UUNET, Comcast, etc) could be held responsible for the truckloads of spam spewing from their networks, the spam problem could be cut by orders of magnitude overnight. Sure spammers would move overseas, but that just makes them easier to block. Foreign spam havens (like China) will find themselves blocked into oblivion if they continue to assist spammers. So, UUNET hosts lots of ROKSO spam gangs and charges them premium rates. They make money hand over fist while the rest of us are buried in their spam. And, you guessed it, (You) CAN SPAM did nothing to address this problem.

--
-- The pinhead celt

Um, are these results weighted? by netik · 2004-03-01 12:16 · Score: 5, Insightful

Before this debate gets too out of hand, has anyone weighted amount of spam vs. size of network?

UUNet is a large, large carrier with many networks globally. Are they the worst spammer because they have the most network entry/exit points, or are they unfairly attacked here because they are just large?

Re:Um, are these results weighted? by Jayjay75 · 2004-03-01 12:52 · Score: 4, Informative

Did we RTFA?

"UUNet hosts more spammers than any other ISP. It has 151 listings on the Spammers Block List (SBL), including 34 known spam gangs with ROKSO records, according to the anti-spam organisation Spamhaus' records for February 2004."

They host 34 known professional hard-core spam-gangs. Size has nothing to do with it.
Re:Um, are these results weighted? by Mesaeus · 2004-03-01 12:56 · Score: 5, Insightful

UUnet is not being attacked because of the number of spam originating from its networks, but because of the large number of KNOWN spamgangs STILL residing on their network after literally thousands upon thousands of complaints. Some of the spammers haven been there for over TEN MONTHS now.
This leaves us with two possible scenarios to explain this :

1) UUNet is a spamhaus and will host spammers as long as they pay.
2) UUNet is dead set against spam, however somehow their abuse department has never read all the complaints, including ten month old ones. Maybe they got "lost in traffic or stuff". Or maybe those poor abuse department people are overworked ? Or just plain DEAD ? After all this silence you start to wonder...

UUNET is largely innocent by Dezsr5 · 2004-03-01 12:19 · Score: 4, Informative

The reason UUNET is known as a facilitator of the largest amount of spam is that they are the largest ISP. And many of their customers have what is called an open relay. Since most UUNET customers send thier outbound mail through mail.uu.net (UUNET's mail relay), spammers that find an open relay send email that looks as if it is coming from a UUNET customer (and UUNET's mail relay.) This is a problem that UUNET tries to remedy, but educating a I-D-10-T customer )not to mention 10,000 customers) about his/their own mail server's open relaying capabilities is difficult to say the least. If a spammer tries to use UUNET's mail relays directly, it does not last long and eventually he is told to take his buisness elsewhere. The people that think that UUNET is using spammers to make more money are just plain ignorant.

Re:UUNET is largely innocent by Pig+Hogger · 2004-03-01 13:10 · Score: 1

This is a problem that UUNET tries to remedy, but educating a I-D-10-T customer )not to mention 10,000 customers) about his/their own mail server's open relaying capabilities is difficult to say the least.
No it's not difficult at all. You just plug the plug on them until they fix their servers. They will fix'em pronto!
Re:UUNET is largely innocent by Dezsr5 · 2004-03-01 13:57 · Score: 1

Usually it's not necessary for such a drastic measure. customer are ussually willing to help. the problem is may times they lack the knowledge of how to fix the problem or even how to start. (onligatory Windows bash - Thank you Mr. Gates)
Re:UUNET is largely innocent by Anonymous Coward · 2004-03-01 22:15 · Score: 0

In other words, you are saying;

"I did not RTFA, and I have no idea how spamhaus ranks spammer friendly ISPs. I havent updated my spam knowledge in the last 5 years, and I still think open relays are a problem"

spamhaus does not list open relays. They list ips allegedly owned by spammers.

They also have a proxy/trojan blacklist, but that nothing to do with open relays either.

You're paying for it by ZakMcCracken · 2004-03-01 12:21 · Score: 5, Interesting

At issue is the business model for interconnection agreements between carriers. When an IP carrier interconnects with another, the basic metric to see who pays whom and how much is the download/upload ratio of the connecting carrier. Peering (at-cost interconnects) is only granted to carriers with whom there is a level upload/download ratio.

So if you're an IP carrier with no or little hosting on your network, you mostly download from your interconnects. Therefore you pay more to interconnect with the big IP backbones like UUnet.

If you're UUnet, there is an economic incentive for you to host spammers, because it boosts your upload; therefore you pay less (or, in the case of UUnet, get more money) on interconnects.

If I was UUnet, I don't see why I would waste money on fighting spammers who (1) are my customers and (2) increase my bottom line by boosting upload at interconnects.

By considering all packets to be equal on the backbone, you're averaging "unwanted" traffic vs. "useful" traffic such as web traffic (aka porn). The side effect of this is, you're paying for spam with your Internet connection.

Re:You're paying for it by themusicgod1 · 2004-03-02 00:14 · Score: 1

"increase my bottom line by boosting upload at interconnects"
all the ISPs in my province(except the one i'm on...and even they are queasy about it) are afraid of giving customers any upload bandwidth, 1MByte down/8Kbyte up is pretty much the standard(DSL) and mabye a little better for cable... because we are considerred as consumer/cattle. they completely miss the point of the entire world-of-ends nature that builds the very fabric of the internet.
please explain to me how i can convince my isp and others that having poeple on their networks who upload (non-spam/crap)content to other isps in virtue of interconnect uploads.

--
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.

Advertisements for bulk e-mailers by Gurezaemon · 2004-03-01 12:26 · Score: 5, Funny

Oh the irony...

I particularly enjoy the "Ads by Google" in the banner at right of the article, for
Bulk Mailer
Reach 500,000 opt-in recipients

and Bulk Email List
Low Cost Bulk Email Marketing Full Email Reports.

Re:Advertisements for bulk e-mailers by Lord+Bitman · 2004-03-01 12:41 · Score: 1

I personally don't find that the least bit funny. Slashdot should NOT be doing business with such people. If it's true, it's fucking obscene.

--
-- 'The' Lord and Master Bitman On High, Master Of All
Re:Advertisements for bulk e-mailers by Anonymous Coward · 2004-03-01 12:46 · Score: 0

Err you mean Google shouldnt be doing business with them...

And I'm am incredibly pissed to receive emails that are touting make money through AdSense, AdWords etc. Sure they arent directly from Google, but Google benefits.
Re:Advertisements for bulk e-mailers by elemental23 · 2004-03-01 16:37 · Score: 1

1. You understand that there is such thing as legitimate bulk e-mail, don't you? See also: "opt-in".

2. You understand that Slashdot is doing business with Google for those ads, not bulk-email companies, right?

--
I like my women like my coffee... pale and bitter.
Re:Advertisements for bulk e-mailers by Lord+Bitman · 2004-03-02 04:20 · Score: 1

2 is irrelevant.

--
-- 'The' Lord and Master Bitman On High, Master Of All
Re:Advertisements for bulk e-mailers by Lord+Bitman · 2004-03-02 04:29 · Score: 1

2 is irrelevant, and it's related to 1 being bullshit.
Google uses keywords for its targeted advertisement. If it's deciding to link the keyword "spam" to its so-called 'legitimate' bulk mailer ads, well, that's not exactly legitimate, is it?
It means that google is dealing with spammers and using words like "opt-in" to throw off the dogs. The ads are triggered by the word "spam", this is NOT an ad for something to run your mailing list off of.

A company which would do this kind of thing is NOT the kind of company slashdot should be doing business with.

--
-- 'The' Lord and Master Bitman On High, Master Of All

no, Al is the way to go... by Anonymous Coward · 2004-03-01 12:26 · Score: 0

it makes that nice "Ping" upon good contact with the kneecap, and no pesky splinters get formed that could be traced back to the original bat...plus, no worries about breaking, just swing away, and watch your spam go down the drain...

How To Identify Them? by Anonymous Coward · 2004-03-01 12:26 · Score: 0

Is there a reliable way to identify the origin (ISP-wise) of an email in the content? I'm using Spamoo, and I would like to tell its moderators which IPs are definitely spams.

Nowadays Sender/From fields are useless!

Re:grasping for customers by clymere · 2004-03-01 12:27 · Score: 3, Informative

I thought that UUnet was just a backbone? I know that my ISP is a small local cable company, and that in turn they get their connection from UUnet. I'm not sure that a regular home user can get an account there. And yes, it is by far the nation's largest ISP, this probably has something to do with the problem in more ways then one. It's the MS syndrome: if you are big enough, you're going to be the most-targeted for lots of malicious things. At the same time, being the biggest means not worrying as much about taking care of your customers: where else are they going to go?

--
once you go slack, you never go back

Arguments on SPEWS if anybody cares by Anonymous Coward · 2004-03-01 12:28 · Score: 0

Posted anonymously, no karma whoring

It's not about spam, it's about trust

hahaa, rooted spammer by ph43thon · 2004-03-01 12:28 · Score: 3, Interesting

A domain of a spammer listed for level13 was rooted. OR did a spammer root all of this users domains and use them to spam?

p

Re:grasping for customers by Dezsr5 · 2004-03-01 12:30 · Score: 2, Informative

This is just untrue. UUNET sets limits on the amount of email a customer sends out. If they want to send over that limit, they have to document why and confirm that the emails are actually wanted. If it is determined that someone is spamming they are warned once. Then thier service is cut off and they are told to take thier business elsewhere. The problem is open relays as I explained in my post lower down in the thread.

how about blacklisting until they clean up by MoFoQ · 2004-03-01 12:33 · Score: 3, Interesting

of course, I've used blacklists and whitelists on my acct (from softhome.net). They also have a thing called greylisting (some opensource guy came up with the idea; sry, don't have linkie) which is like the telezapper I have on my phone; it holds an email and doesn't tell the sender's server if it was successfull or not [timeout] then waits for the sender's server to try again and since most spammers use a mass-mailing program that uses a "take it or leave it" tactic, it catches most spam.

Of course, I've added ppl I know to a whitelist so there's no delay and added IP ranges (typically uunet or above.net and some from the UK, china, korea, etc.) [Class B and Class C] to my perma-blacklist. Being able to blacklist IP ranges {or even mail that doesn't have a sender address regardless of IP) is very useful. I don't get spam that's mailed directly to me anymore (still get some spam that's sent to a mailing list like sourceforge's MLs, though).

One odd thing I've noticed is that softhome's implementation of one of the blacklisting options has changed and effectively blocks all email that's not ok'd by me (the blank sender address filter that is). But it's ok, most ppl I know get placed on my whitelist or if I'm sending to some company, I make sure I add the companies domain(s) to my whitelist as well. Hey, it's a small price to pay for lack of spam.

Also, if someone legit tries to email me and gets blocked, they get an error from their host that reports that "the server doesn't like them". Good for those pesky relatives...hehehe

Re:how about blacklisting until they clean up by jonesvery · 2004-03-01 13:05 · Score: 2, Informative

[...] it holds an email and doesn't tell the sender's server if it was successfull or not [timeout] then waits for the sender's server to try again and since most spammers use a mass-mailing program that uses a "take it or leave it" tactic, it catches most spam.
Link to more information here, just to make sure that people don't get the wrong idea: a greylisting server will respond to all attempted deliveries from unknown sources with an RFC-compliant deferral, which should cause the sending MTA to queue the message for later delivery. The theory here is that most spam (as well as viruses) is sent by crap software which doesn't understand how to attempt a true "retry." No retry on a deferred message, no delivery for messages from the sending server.
I don't recall having seen any data on effectiveness -- would be interested in hearing from anyone actually using this approach in the wild.

--
* * *
It is a dada story -- it has no moral.

Nice to see Abovenet on the list... by winkydink · 2004-03-01 12:34 · Score: 1

At least they are bigger than Exodus & Level3 in one way. Bill LaPerch is doing such a great job at Abovenet, you'd never guess that he's such a gravy-sucking pig.

--

"I'd rather be a lightning rod than a seismometer." -Ken Kesey

Does anyone remember by Anonymous Coward · 2004-03-01 12:35 · Score: 2, Troll

Does anyone remember when UUNet was black listed? Or when Rogers was blacklisted?

Those were the days... but the age of activist sys admins is gone... we have been replaced with dot bomb drop outs who care about nothing more than a few $$$.

We are finished.

And think about it... what antispam technique can you think of that is more effective than filters and less intrusive (IE less clicking) to the users?

Loads of things are effective but all make the user work harder than they would by just deleting the spam.

Think of spam as an advert in your newspapaer or a commercial on TV. You're fucked and nothing can be done about it. Get a TIVO and suck it up.

E.

Re:Does anyone remember by Unnngh! · 2004-03-01 12:44 · Score: 1

You may just be trolling, but I'd agree. We can bitch and moan and make block lists and pass legislation ad nauseum, and it _will_ reduce the amount of spam in many people's inboxes. The inevitable conclusion however is "legitimate" spam that advertisers pay more for that is still opt-out but gets around spam legislation and technology. Who are the new spammers? Those who are willing to pay for advertisements to ISPs, etc. It will be like TV. Just too cheap/convenient a medium to pass up.

I'm not seeing it... by chriskenrick · 2004-03-01 12:41 · Score: 4, Informative

I run a report daily that tells me where my Bayesian-identified spam came from (IP address and host name via reverse lookup).

Out of the approximately 16 daily reports in my inbox, only two addresses are uu.net. I'm seeing comcast.net (37 occurences) and adelphia.net (29 occurences) a lot more, by comparison.

Re:I'm not seeing it... by humankind · 2004-03-01 12:44 · Score: 3, Interesting

Comcast is my number one source of domestic spam as well. My largest source of foreign spam is coming from Wanadoo.fr. That's after I was forced to refuse connections from the plethora of Chinese IPs that seem to solely exist to promote penis-enlargement and home mortgage scams.
Re:I'm not seeing it... by Lost+Race · 2004-03-02 06:10 · Score: 1

RTFA! It's not about spam coming out of UUnet IP addresses, it about UUnet hosting spammers. Those spammers relay their spam through 0wn3d PCs on Comcast and Adelphia. But the spammers themselves are getting their connectivity through UUnet.

UUNet the Home of Spam by csk_1975 · 2004-03-01 12:42 · Score: 5, Interesting

My experience with UUNet:-

1. In 2000 a spammer in Louisiana forges one of my domains in spam runs sent via UUNet - I get tens of thousands of bounces and hundreds of complaints.

2. I complain to UUNet - no action.

3. I phone UUNet security as the runs are being sent - no action.

4. Every weekend for 2 months this happens and I get sick of it.

5. I start to autobounce all this junk back to abuse@uunet.com.

6. Spammer sends a run using a different ISP.

7. UUNet gets really pissed that I bounce 1000 mails to abuse@uunet.com which didn't originate from their network (with some justification).

8. UUNet block all access from my class C to their servers.

9. The spam runs sent via UUNet continue....

Forward to 2004, I still can't send mail to uunet.com!

Re:UUNet the Home of Spam by filekutter · 2004-03-01 12:57 · Score: 1

I know this won't work for you admins.. much, but for the rest of you... I use comcast, but I DO NOT use my comcast email. I use an independent mailer, and also have two extra spam-mail-accts, just for registering software, or any other stupid thing I just HAVE to put an email on that isn't a friend. My mail is clean, and no spam. Just clean out the spam accts every once in a while, and laugh at the stupid subject lines.

--
I call computer-illiteracy job security
Re:UUNet the Home of Spam by Anonymous Coward · 2004-03-01 13:48 · Score: 0

do you not think you should have been running those IP addresses through some kind of checklist?
actually... that gives me an idea! does anyone have a list of ISP IP ranges and the abuse email address? it shouldn't be hard to construct a simple procmail filter to attach identified spam on to a default complaint template and send the spam on to the abuse@ISP contact address iff the IP falls in the range of a known ISP. logging the emails should be easy enough as well. has anyone ever done that setup? the ISP should get into trouble for blocking you if you are only sending abuse complaints about their own customers! and you have the logs to show that you only emailed them legitimate complaints!
Re:UUNet the Home of Spam by Anonymous Coward · 2004-03-01 14:01 · Score: 0

That works for a little while until a "friend" then puts your email address into the form of a certain website that emails you a greeting card or whatever then in addition to that adds you to their spam lists.
Re:UUNet the Home of Spam by Anonymous Coward · 2004-03-01 14:05 · Score: 0

What if the ISP only accepts spam complaints via a web form?
Re:UUNet the Home of Spam by platipusrc · 2004-03-01 15:31 · Score: 2, Interesting

Speaking of online spam-only type accounts, have you received a bunch of email lately with no subject and no body? It seems weird to me. Is that some group testing out open relays or something? My Yahoo account had about 20 of those from the last 5 days, and they weren't flagged as spam.

--
And the muscular cyborg German dudes dance with sexy French Canadians
Re:UUNet the Home of Spam by YellowSubRoutine · 2004-03-01 18:16 · Score: 1

Yep, I've got those empty messages.

The open relay testing hypothesis sounds very plausible to me...
Re:UUNet the Home of Spam by Electrum · 2004-03-01 18:54 · Score: 1

7. UUNet gets really pissed that I bounce 1000 mails to abuse@uunet.com which didn't originate from their network (with some justification).

8. UUNet block all access from my class C to their servers.

[...]

Forward to 2004, I still can't send mail to uunet.com!

You willfully sent them 1000 spam messages that had nothing to do with them to their abuse role account, so they blocked you from mailing them. Sounds reasonable to me.
Re:UUNet the Home of Spam by csk_1975 · 2004-03-02 03:29 · Score: 1

You willfully sent them 1000 spam messages that had nothing to do with them to their abuse role account, so they blocked you from mailing them. Sounds reasonable to me.

In the circumstances, blocking me was so hypocritical as to be unreasonable.

Because UUNet can't control their customer, I should suffer? They abused my domain. I got tens of thousands of bounces. My domain got added to local blocklists all over the Internet. I got hundreds of irate people saying stop sending them porno spam. etc, etc.

The other ISP was very pro-active and shut down this spammer immediately when I phoned them up.

But with UUNet it took threats of legal action before the spam stopped.

And UUNet can't cope with a few misdirected bounces?

Boo hoo poor wittle uu net.

We -can- protest by SuperBanana · 2004-03-01 12:47 · Score: 1

When a provider starts blocking large stretches of IP blocks owned by a particular ISP like UUNet, average users scream bloody murder.

Yes- but the funny thing is that these days, ISPs are so competitive that there is little to no way to differentiate between them; even the slightest advantage/disadvantage can have wide-ranging consequences.

In fact, one of the largest factors is reliability, both locally and long-range; you don't want your T1 to go down, and you pretty much expect to be able to get to anything on the internet. UUnet is widely regarded as one of the most reliable. Wouldn't it be a shock if, gee whiz, UUnet customers suddenly found their mail bouncing back to them, they couldn't get to websites(and their customers couldn't get to -their- website), and so on?

The very fascinating part is that it doesn't take much to make this sort of thing effective; the mere chance that your site might not be accessible to people is enough to make you want to switch, or not go with UUnet at all.

The problem is that you have to hurt them more than spam is helping them. Yes, helping. For every byte of a spam that gets delivered, who makes money? Not the spammers, directly. If SMTP traffic were unbillable, UUnet would be all over spam like a dog on fleas. But, it makes them money and makes up more and more of their business, quite frankly. I'm sure they -love- spam. Too bad that such a vision is remarkably shortsighted- if spam gets bad enough, people will be driven away from email just like they were driven away from usenet(I used to read usenet daily- I haven't fired up a news reader in probably 10 years, because all of usenet is just spam, spam, and more spam).

I think it's time we reinstituted the usenet death penalty, only for routers, webservers, and email servers. Participation from businesses is unlikely, but there are plenty of sites still run by individuals willing to make a point. Heck, you don't even have to block them, you can just trigger a blurb on every webpage("Hi there, you're a UUnet customer. UUnet supports spammers. If they keep doing it, you won't be able to view this webpage") based on their IP, for example.

--
Please help metamoderate.

What a shame, maybe it is their open roots by donheff · 2004-03-01 12:54 · Score: 2, Interesting

It is really to bad to hear such negative things about UUNET. They are one of the early pioneers of the Internet providing the east coast Unix to Unix (UU) network of universities. Maybe their early academic roots of open, unfettered access kept them from seeing the need to clamp down in later days.

Don

This is a problem with all top-tier providers by humankind · 2004-03-01 12:54 · Score: 5, Insightful

I am a UUNet/Worldcom customer and have multiple pipes to my network from their backbone. I think they have one of the best-performing backbones on the Internet.

Unfortunately, while I am happy with UUNet's performance and stability, I am even more unhappy with their apathy towards their network being clogged by spam traffic. And at least 40% of the bandwidth I pay for is consumed by unwanted UCE, so they actually profit from this crap. As a result, there's not much incentive for them to address it. And I have to grudgingly pass these expenses on to my customers.

But UUNet is not any different from other top-tier ISPs. They hide behind the "common carrier" metaphor, using it as an excuse to justify a large portion of the bandwidth they sell to others which is unuseable due to spamming.

I can't help but think if I ordered a telephone line, and 40-60% of the time I had "noise" interfereing with my ability to communicate, that the phone company would be obligated to resolve the situation. Unfortunately, with ISPs, there doesn't seem to be anyone at the top that really gives a damn, nor any incentive on their part to address the situation.

Re:This is a problem with all top-tier providers by legomad · 2004-03-01 13:04 · Score: 2, Informative

Sounds like you have a shared T1/T3. I suggest getting a dedicated one.

Your sig by DigiShaman · 2004-03-01 12:56 · Score: 1

Change your sig, otherwise your just asking to be marked at a troll in anything you post.

I'm not saying that I agree or disagree with it, just being giving you some friendly advice.

--
Life is not for the lazy.

Re:Your sig by filmsmith · 2004-03-01 13:14 · Score: 1

That's your opinion. In my opinion, he's free to express HIS opinion. And looking at his last 24 comments, I don't see one Troll mod. Seems he's doing just fine.

My $0.01

fs
Re:Your sig by ceejayoz · 2004-03-01 13:17 · Score: 2, Informative

In the couple weeks I've had this sig, I have yet to receive a single troll mod.

So, no, not going to change my sig, as it quite nicely explains my feelings for both Bush and Kerry.
Re:Your sig by Anonymous Coward · 2004-03-01 13:49 · Score: 0

Why do people say that John Kerry has more wartime medals then Bush? What medals does Kerry have??!!! ...Ohhh...those medals. The ones he fucking threw over the fence. Kerry is a coward for doing such an act. No honor at all. Sad really.

Vote for Kerry and vote for a coward that wants to turn the US over to the UN.

Vote for Kerry and enact the TCPA bill thanks to "Frits" Hollings.

Say NO to TCPA!!!

http://www.againsttcpa.com/what-is-tcpa.html
Re:Your sig by Anonymous Coward · 2004-03-01 14:43 · Score: 0

(OT) What's wrong with Kerry? Did you support any of the Democratic nominees?
Re:Your sig by Anonymous Coward · 2004-03-01 14:46 · Score: 0

Well, jeez. That's just your opinion too. And in my opinion, your parent poster is free to express HIS opinion that your grandparent poster's opinion might result in a troll mod. Of course, you're free to express YOUR opinion about your parent poster's opinion.

Point being, no shit it's his opinion, since he said it. Are we all happy now? Good.
Re:Your sig by Anonymous Coward · 2004-03-01 14:47 · Score: 0

So let me get this straight;

Kerry is a coward because he was brave enough, unlike bush, cheney and co, to go over there and fight, he gots medals because he did a really good job, then when he came back he was brave enough to stand up and speak for what he believed in (and what most people believe now, that this war was a huge mistake), and he's a coward because.. well, uh, oh, right, you don't have a point.
Re:Your sig by Anonymous Coward · 2004-03-01 14:56 · Score: 0

He was a soldier at the time in war. Those medels stand for bravory and commitment to a cause...even if it's deamed unjustified later in life.

When the threw those medels over the fence, he turned his back on the very civilians he was supposed to protect. And, he dishonored those that fought with him along side in the war.

If he was truely brave, he would read off each name on the Vietnam Memorial Wall live on TV and tell the world why each of the fallen were wrong to server their country. But, he would NEVER do that, because he is a yellow-bellied COWARD...and a man with no honor.

http://thewall-usa.com/
Re:Your sig by frost22 · 2004-03-02 01:31 · Score: 1

I'm not saying that I agree or disagree with it, just being giving you some friendly advice
That was "friendly advice" of the "yo nigger, if you don't want get beaten up in this town, you better stop staring at white women" kind.

I.e., a thinly veiled threat.

Looking from afar, things like that seem to happen more often over there recently. Why do many conservatives feel this urgent need to eradicate "liberal" (in the US sense off that word) points of view from the public perception ? Isn't that the opposite of public discourse ?

--
...and here I stand, with all my lore, poor fool, no wiser than before.
Re:Your sig by Pope · 2004-03-02 04:18 · Score: 1

Why do many conservatives feel this urgent need to eradicate "liberal" (in the US sense off that word) points of view from the public perception ? Isn't that the opposite of public discourse ?
Because the laziest/easiest way to not respond to critical viewpoints is to simply shout down your opponent. In the same manner that one could criticize Clinton all one wanted for 8 years, but if you dare suggest Bush did something wrong, you're a dirty, unpatriotic terrorist who needs to go back to Russia.
It's pathetic, really.

--
It doesn't mean much now, it's built for the future.
Re:Your sig by DigiShaman · 2004-03-02 06:07 · Score: 1

Wow!! What a hyperbole on your part. I was NOT bashing liberals you shumuck.

My point is that people hold onto political ideology much like religion. So regardless if his sig was in favor of right-wing or left-wing, the chance of getting modded because of it is equally possible.

I gave that advice because I found the parents post to be informative. But I fear it might get modded otherwise because of his sig.

--
Life is not for the lazy.
Re:Your sig by ceejayoz · 2004-03-02 14:54 · Score: 1

I liked Dean. Kerry just seems like business-as-usual - nothing about him particularly enthuses me.
Re:Your sig by Anonymous Coward · 2004-03-02 17:29 · Score: 0

Interesting. I personally found Dean's supporters to be a little idealistic for my tastes (the Doctor himself was all right, maybe a little clueless). Whatever. As long as you don't vote for Nader or otherwise support his masturbatory candidacy.

That is because spamhaus ignores hotmail ... by GNUALMAFUERTE · 2004-03-01 12:57 · Score: 0

If they actually taked Hotmail into account, i am sure it's the main source of spam. May be not for the big spammers, they have their own smtps, but those spams are the easier to block, i mean, come-on, if it says viagra, no mother how obfuscated .. bayesians take care of it. But, let me tell you, lots of little spammers hurts more than one big, and those people uses mostly hotmail to spam. Besides this, I sysadmin, and let me tell you, once i did something like "grep -i hotmail maillog > hotmail; grep -v hotmail maillog > realmail; ls -lh"; let me tell you, the hotmail file was REALLY bigger than realmail .... Not only spam, also most of legitimate mail goes through hotmail.
I Know it can't be done, but banning hotmail would help a lot.-

--
WTF am I doing replying to an AC at 5 A.M on a Friday night?

Re:That is because spamhaus ignores hotmail ... by AndroidCat · 2004-03-01 13:26 · Score: 1

If you went by the actual source of the spam (Received lines) rather than the forged hotmail From, you might find that your numbers would be a lot smaller.

--
One line blog. I hear that they're called Twitters now.

MCI practically is the Internet by legomad · 2004-03-01 13:00 · Score: 1

They control 30% of the internet, they are like your ISP's ISP. So this statistic is really moot.

I bought viagra online. by www.sorehands.com · 2004-03-01 13:02 · Score: 4, Funny

I bought viagra online from a florida spammer. After I received the Viagra, I filed a lawsuit against the spammer, then settled for $7500.

--
Fight Spammers!

Re:I bought viagra online. by cardshark2001 · 2004-03-02 19:16 · Score: 1

I bought viagra online from a florida spammer
Are you sure you didn't buy V A 1 G R A?

--
WWJD? JWRTFA!

I just block domains by KalvinB · 2004-03-01 13:02 · Score: 5, Informative

nearly all spams contain a link to somewhere. I just filter out the domains those links go to since no legitimate e-mail will contain a link to those domains. You also can't hide the destination of a link if you don't leave the harvesting solely up to an automated system.

Takes care of most of the spam. And it costs spammers money every time they get a new domain so I can deal with what little spam gets through before the filter is updated. I've put hundreds of domains in my Mercury Mail filter which equals thousands of dollars worth of domains that are now useless for sending spam through my mail server. And it doesn't matter how distorted the header or body is. The domain can't be distorted or it won't work as a link.

Ben

--
Work Safe Porn

yeah, but grandparent poster is a tard by Anonymous Coward · 2004-03-01 13:03 · Score: 0

n/t

That's why blacklisting will not work by ZakMcCracken · 2004-03-01 13:04 · Score: 1

Blacklisting a whole network like UUNet, which -- that's the problem -- does not only host spammers, is exactly the approach that doesn't work, at least if you're relying on the Net for anything serious.

Imagine a company using black lists such as SpamCop: once in a while, they would happen to bounce customer email and the reason would be "you are spam"!! Not great customer care. Same goes for any communication of a company with the outside world (recruitment, PR, technical collaborations...).

That's why the solution cannot be blacklisting. You gotta find better than that!

Re:That's why blacklisting will not work by MoFoQ · 2004-03-02 07:41 · Score: 1

I disagree. It will force those bad networks to clean up or be left out in the cold (not just from the net but also from customers as they leave them for non-blacklisted companies).

Sort of like TrustE(r) or Verisign type of dealie....or a Bizrate for email.

I've used grey listing.. by msimm · 2004-03-01 13:05 · Score: 4, Informative

Although I'm not sure its the project you've described: Tagged Message Delivery Agent (TMDA), from their site:

TMDA is an open source software application designed to significantly reduce the amount of spam (Internet junk-mail) you receive. TMDA strives to be more effective, yet less time-consuming than traditional spam filters. TMDA can also be used as a general purpose local mail delivery agent to filter, sort, deliver and dispose of incoming mail.

The technical countermeasures used by TMDA to thwart spam include:

* whitelists: accept mail from known, trusted senders.

* blacklists: refuse mail from undesired senders.

* challenge/response: allows unknown senders which aren't on the whitelist or blacklist the chance to confirm that their message is legitimate (non-spam).

* tagged addresses: special-purpose e-mail addresses such as time-dependent addresses, or addresses which only accept certain kinds of communication. These increase the transparency of TMDA for unknown senders by allowing them to safely circumvent the challenge/response system.

I currently use bluebottle.com who just recently re-emerged after shutting their service down (siting DDOS attacks by spammers). Their service is basically what the TMDA site describes with a nice setup and a few extra features. Its a free service so if your thinking about trying something like this out, this is the one. I personally am not a fan of filter and to date this is my favorite option. Stuff that I need gets in.

--
Quack, quack.

Re:I've used grey listing.. by cardshark2001 · 2004-03-02 19:31 · Score: 1

Although I'm not sure its the project you've described: Tagged Message Delivery Agent (TMDA), from their site:
You: Blah blah whitelist blah blah blah trusted senders blahblahblah challenge-response bling bling.
Me: Blah blah Amazon sent blah blahblah blah automated email blahblahblah didn't get my tracking number crap crap.
Your reply: blah blah bleh seperate email for business and orders bluh blah blibity blah blah
My reply: (*cough*)hit.

--
WWJD? JWRTFA!

you mean, as long as there's a United States by rbird76 · 2004-03-01 13:07 · Score: 1

there'll be spam? (see previous /. articles)

Considering lots of it is advertising US products in US units, the US is either the target and/or producer for an awful lot of spam...

Re:you mean, as long as there's a United States by eaolson · 2004-03-01 13:29 · Score: 1

Considering lots of it is advertising US products in US units, the US is either the target and/or producer for an awful lot of spam...
I don't disagree. However, and speaking only for myself, the overwhelming majority of the spam I receive contains links to websites hosted in one of: China, Argentia, Brazil, Taiwan, Russia, or South Korea. Judging by Spamcop's statistics, I'm not the only one. The spam doesn't necessarily *originate* from there, but they are an integral part of the whole spam-support network.

Hillarious by Anonymous Coward · 2004-03-01 13:08 · Score: 0

Considering that these schmucks will not accept email from small fry. If you run a legitimate business on a DSL line, have a small allocation... fugetaboutit... You cannot send email to a UUNet hosted company. You have to go through your "DSL mail" provider (even though said provider is not your email provider).

So we are making life easy for ourselves by advising our client base to leave UUNet for better pastures. Not that hard when they and their parent are bankrupt. We simply note to them that a) business email is important, and it could represent lots of revenue, b) the kind folks at UUNet have decided a-priori who can and cannot email you, and c) they have been enabling so much spam, have ridiculous email limits, and their costs are far too high compared to their competitors. After that, the show-me-the-money types are quite happy to ditch them.

It's easier by KalvinB · 2004-03-01 13:16 · Score: 4, Interesting

to just automatically move an account over to a spam IP if port 25 traffic gets too much than to pull the account entirely. Cox Communications supposedly already has an automated system to redistribute IPs (mine's never changed). So it's not something drastic that would need to be implemented.

As other people have mentioned, relays are a big part of the problem. It's better to "punish" ignorant customers by moving them to a restricted port 25 IP than to cut them off entirely. By moving them there's no harm no foul since they weren't the ones directly spamming anyway and probably won't notice they were moved.

If they do notice and call then the ISP can tell them to do something about their excessive e-mail sending and point them at the AUP. It's all very quick and painless to resolve the issue since it's the customer that has to take action to speak with people and not the company making the calls. People who have to call when they know they broke the rules are far less likely to do anything.

Cox recently cut off incomming port 25. Probably because of myDoom. I'm not about to call and complain because I was trying to run a spam can on my home system. Outgoing port 25 has been blocked since I got the service. And it would be a waste of time and money for them to call me and yell at me. They quietly cut off my server and I just shut my mouth about it.

By having a no harm no foul automated system you can punish a spammer as soon as say X MB of e-mails get sent in Y amount of time. Versus finding out about it later after it's too late and gigs of e-mails have been sent.

Automatically kicking customers entirely is just asking for trouble because the ignorant (those who unknowingly relay) will be kicked which will result in bad PR where there should be none.

You can still kick the spammer entirely. It's just a matter of starting with a little punishment and then escelating only as nesseccary.

Kicking a customer should be the last resort when just limiting port 25 traffic is sufficient.

Ben

--
Work Safe Porn

Re:It's easier by poot_rootbeer · 2004-03-02 04:25 · Score: 1

It's easier to just automatically move an account over to a spam IP if port 25 traffic gets too much than to pull the account entirely.

If you're going to move a spammer to another IP because they're spamming, might as well just make it 0.0.0.0, no?

No one says the ISP has to remove the violator from their billing system. Just keep sending them bills!

This just in... by romper · 2004-03-01 13:16 · Score: 1

...from the "yeah, NO SHIT" department...

--
Right is wrong when left is right.

I work at a Data Center. by readpunk · 2004-03-01 13:21 · Score: 4, Insightful

The issue of spammers is fairly unrelated to the different major bandwidth suppliers. We have three different providers here and spammers rarely request or care which network we put them on. They just want to get their 1.5 day's of major spamming done before we shut them down. The issue is what is going on at data centers to stop spammers quickly and what is being done on the internet to make spamming unprofitable.

--

./revolution

Slashdotting spam domains ... by thrillseeker · 2004-03-01 13:29 · Score: 5, Insightful

nearly all spams contain a link to somewhere

Perhaps this would hurt spammers the only place that counts - in the pocketbook. When a message is confirmed as spam then have a filter extract all the urls from the message and place them in a file. Have an hourly cron job visit that list of urls and download using wget everything at that url and all of it's subfolders - and delete the files after downloading - and bypass the proxy if you have one - these are all wget options. Have the hourly cron job keep only the last 10,000 or so urls so that there is some semblance of only downloading current spam urls.

This process, if followed by millions of spam haters (perhaps we could have a public spam url website that would let people fetch a hundred urls at a time to work on that we could upload our own spam urls to), would apply the slashdot-effect to all the spammers. Bandwidth costs money for them - it's the only way to make 'em stop.

Re:Slashdotting spam domains ... by Jerf · 2004-03-01 15:10 · Score: 4, Informative

Your post advocates a (X) technical ( ) legislative ( ) market-based (X) vigilante approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.) (X) Spammers can easily use it to harvest email addresses ( ) Mailing lists and other legitimate email uses would be affected ( ) No one will be able to find the guy or collect the money ( ) It is defenseless against brute force attacks ( ) It will stop spam for two weeks and then we'll be stuck with it (X) Users of email will not put up with it ( ) Microsoft will not put up with it (X) The police will not put up with it ( ) Requires too much cooperation from spammers ( ) Requires immediate total cooperation from everybody at once ( ) Many email users cannot afford to lose business or alienate potential employers ( ) Spammers don't care about invalid addresses in their lists (X) Anyone could anonymously destroy anyone else's career or business Specifically, your plan fails to account for (X) Laws expressly prohibiting it ( ) Lack of centrally controlling authority for email ( ) Open relays in foreign countries ( ) Ease of searching tiny alphanumeric address space of all email addresses (X) Asshats ( ) Jurisdictional problems ( ) Unpopularity of weird new taxes ( ) Public reluctance to accept weird new forms of money ( ) Huge existing software investment in SMTP ( ) Susceptibility of protocols other than SMTP to attack ( ) Willingness of users to install OS patches received by email (X) Armies of worm riddled broadband-connected Windows boxes ( ) Eternal arms race involved in all filtering approaches ( ) Extreme profitability of spam (X) Joe jobs and/or identity theft ( ) Technically illiterate politicians ( ) Extreme stupidity on the part of people who do business with spammers (X) Dishonesty on the part of spammers themselves (X) Bandwidth costs that are unaffected by client filtering ( ) Outlook and the following philosophical objections may also apply: (X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical ( ) Any scheme based on opt-out is unacceptable ( ) SMTP headers should not be the subject of legislation ( ) Blacklists suck ( ) Whitelists suck ( ) We should be able to talk about Viagra without being censored ( ) Countermeasures should not involve wire fraud or credit card fraud (X) Countermeasures should not involve sabotage of public networks ( ) Countermeasures must work if phased in gradually ( ) Sending email should be free ( ) Why should we have to trust you and your servers? ( ) Incompatiblity with open source or open source licenses ( ) Feel-good measures do nothing to solve the problem ( ) Temporary/one-time email addresses are cumbersome ( ) I don't want the government reading my email ( ) Killing them that way is not slow and painful enough Furthermore, this is what I think about you: (X) Sorry dude, but I don't think it would work. ( ) This is a stupid idea, and you're a stupid person for suggesting it. ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

(Yes, it's pulled from here. The meta-point is, if we're going to progress in the war on spam we need to move past the solutions that have been proposed a million times with obvious holes in them. Either that, or face the possibility that the system we have now is already optimal.

Primary justification of the above snarky copy&paste job is that this patently obvious scheme has a patently obvious DDoS scheme built into it, left as an exercise for the reader.)
Re:Slashdotting spam domains ... by RyLaN · 2004-03-01 15:33 · Score: 2, Interesting

No, no no and no. Fighting fire with mass wget will just further clog the network. Think of it, some spammer finds out that you started this scheme. Next thing you know, they put your domain in a spam email and you get ddos'd to high heaven.

--
At least the war on the environment is going well
Re:Slashdotting spam domains ... by minas-beede · 2004-03-04 12:27 · Score: 1

"The meta-point is, if we're going to progress in the war on spam we need to move past the solutions that have been proposed a million times with obvious holes in them."

Yeah, well. It isn't just solutions that have holes - it's also implementations. Blocklists would (or would have) worked very well, would have ended spam - if they had been used widely enough. But they are used just by some. Those that use them get a reasonable benefit, but the effect on the spammers isn't severe enough to make them decide to quit. Same for filters.

I've long advocated honeypots. That's out-of-the box thinking (the box being the use only of measures implemented at or after the destination email server.) They really work, the few there have been have had impressive results, but not enough people use them. Why not? Good question. I'd say precisely because it is out-of-the-box thinking behind them. Try to get any anti-spam person to agree to accepting relay email messages, for instance - he won't. He's so convinced that open relays (and not spammers) are the source of the problem he cannot hear. Move to open proxies and its the same: he has a nebulous fear that somehow accepting a spam message as a proxy carries a tremendous risk - like that maybe it will sneak by, get delivered.

The IEEE Security & Privacy Journal has an article on "Honeypot Hunter" in the January/February issue:

http://csdl..orcomputerg/comp/mags/sp/2004/01/j1 07 6abs.htm
(abstract)

I can't quite figure it out but it may be the author is saying because one spammer has come up with one purported detection tool for open proxy honeypots the game is over for the honeypots. Watch me not be surprised that an effective tool will be rejected on such weak evidence after years of far more damning evidence being seen of effective spammer countermeasures against securing open relays, checksums, filters. Hash busters? Don't faze honeypots - honeypots don't care about content. Checksum busters? Same deal. Filter busters? If you don't care about content then nothing the spammers do with the content matters. So, OK, a spammer finds a honeypot - he'll stop trying to send spam through it. Next step, if things are done right, will be that he sees there's a bunch of honeypots in a particular net block and he'll stop trying to abuse any IP in that block - too risky. Note that word "stop" - that's an important word. Yes, he'll move on top other netblocks. That's not the problem - the problem is that the other netblocks have no honeypots to make him decide to stay away.

Or we can keep on flogging "solutions" at or after the destination server. What's the score, so far? Who is winning?

[I realize the rapid emergence of spam server zombies is changing the situation, making defeat of spam harder. For those a combinaiton of full honeypots (not the simple open relay/open proxy) variety will prove helpful, as will ISP attention to what's going on: traffic analysis. If there are billions of spam messages every day they will have a characteristic signature for the ISPs involved in the sending and delivery of the spam. If the ISPs would look they'd see. Seeing, they could act.

But it's that huge word "if" that's the problem - so far the ISPs won't, so far apparently most are unaware of the concept.]

Evil bit is better! by hta · 2004-03-01 13:34 · Score: 1

Natch. IP address range for spammers is not enough.
Insist that spammers turn on the Evil bit - RFC 3514.

(More seriously - RFC 3675, ".sex considered dangerous", gives a little more thinking about why this is a Bad Idea. This is NOT an Internet standard, but it's a well written document.)

Make having an open mail relay against the AUP by NotQuiteReal · 2004-03-01 13:36 · Score: 1

Make having an open mail relay against the AUP

How hard would it be for all ISPs to scan their own customers for open mail relays?

There, that ought to stir up more comments by those who know more than I.

--
This issue is a bit more complicated than you think.

Surprise Surprise by leviramsey · 2004-03-01 13:36 · Score: 1

Wasn't Paul Vixie, the creator of anti-spam vigilantes MAPS, the CTO of AboveNet?

Re:grasping for customers by slash-tard · 2004-03-01 13:40 · Score: 2, Informative

Just FYI, UUnet is now owned by MCI. UUnet/MCI also have a large amount of dial-up (modem) POPs, which is resold through other companies and used by end users. They also offer DSL in some markets.

All of this is in addition to them being the largest backbone.

Forget spamhaus by Ahlee · 2004-03-01 13:44 · Score: 0, Troll

What about legitimate companies who get listed by Dpamhaus, Spamcop, SPEWS, etc?

All these do is make it a hassle to get removed from the list, even when you take the necessary steps required (jumping through loops is an understatement for some, especially SpamHaus).

Yes I work for a web host company. Yes we have anti-spam AUPs. Yes we still believe people when they call for a sale (let's face it, cash is cash, and if a person calls you up asking for half a dozen servers you're going to be inticed, and if they fully know and agree to the polocies already in place and agree to abide by them, you really have to believe them and work with them a little).

Spamhuas even goes so far as to slander hosting companies who do have customers who send unsolicited email.

So what do we use? SpamAssassin. Kills a very good percentage of spam before our users see it, including our own accounts which have been in existance for what feels like eternity.

When Anti-spam products like these start to interfere with business, not only our own but that of our customers, I have to seriously question the merit behind them.

I NEVER get uu.net spam any more by sik+puppy · 2004-03-01 13:44 · Score: 3, Interesting

I was getting deluged by uu.net originated spam, and of course abuse@uu.net is ignored.

Finally I resorted to bouncing all uu.net originated spam to sales@uu.net and info@uu.net

make the sales scum suffer the same problem they inflict on everyone else by selling their pink contracts.

Some of the indignant replies from the sales staff were quite amusing. I guess they told their spammers to delete me from thier spam runs, as the volume quickly dropped and then finally stopped completely.

--
The first thing we do, let's kill all the lawyers. Shakespeare, Henry VI, Part 2, Act 4, Scene 2

Re:I NEVER get uu.net spam any more by rizawbone · 2004-03-01 14:15 · Score: 1

Solving the spam problem with more spam is a little dumb.
Re:I NEVER get uu.net spam any more by sik+puppy · 2004-03-01 18:46 · Score: 2, Interesting

not really - I just sent it back to its source. If pink contracts become more trouble than they are worth, maybe they'll stop getting written.

complaining to abuse@uu.net doesn't work. complaining to sales@uu.net and info@uu.net does work - the sales staff need the leads and inquiries generated, therefore they have to look through their inbox instead of just dumping it all.

--
The first thing we do, let's kill all the lawyers. Shakespeare, Henry VI, Part 2, Act 4, Scene 2
Re:I NEVER get uu.net spam any more by rizawbone · 2004-03-01 20:27 · Score: 1

Still missing where sending unsolicited mail to many people, when only one of them is possibly at fault for your suffering, is not spam.

You're becoming what you hate, I'd wager not everyone on the sales and info alias writes pink contracts.
Re:I NEVER get uu.net spam any more by sik+puppy · 2004-03-02 03:15 · Score: 1

It was a measure of last resort. Nothing else worked.

And I only bounced uu.net sourced material - when it stopped so did I

And it stopped fast - 3/4 of it within a week, the rest within a month. So someone knew something.

--
The first thing we do, let's kill all the lawyers. Shakespeare, Henry VI, Part 2, Act 4, Scene 2

a modest proposal by RaymondRuptime · 2004-03-01 13:47 · Score: 1

Other responders have adequately answered the question and demonstrated why--that spammers really do make good money this way. The question that lies past that one is: Why are people foolish enough to buy from spam, and what do we do about it? I have... a modest proposal.

Why don't we deal this problem the same way we deal with prostitution? Make buying in response to spam a crime, just like soliciting a prostitute is a crime? The commercial relationship is already quite similar, in that the consumer usually pays money and ends up getting screwed (and is more likely to get a virus).

Maybe if responding to a spam solicitation was illegal, people would show more discretion. It would at least add a little bit of needed chlorine to the on-line gene pool...

Spam is theft by Simonetta · 2004-03-01 13:48 · Score: 1

Although it is convienient for the individual, having a super fantastic spam filter is not a good solution to the problem of spam because it doesn't change the fundamental disbalance of spam.

Spammers are stealing the surplus bandwidth of the 'information superhighway' for their own benefit. No one has the 'right' to send hundreds of thousands of emails soliciting a financial transction for their private benefit (of the benefit of those who hire spammers) over fiber optic lines that they have not paid for. They have paid for non-commercial bandwidth.

If spammers want to have a dedicated channel to hundreds of millions of people that they can use for their private gain, then let them spend hundreds of millions of dollars to lay fiber optics in the ground and across the oceans.

Until they do that, then they are just thieves. And they should be treated as thieves. This is like a trucking company demanding two lanes on every interstate highway in the country for their own private use and paying no gas, weight, or highway use tax.

Plus spam programs by their very nature must examine every piece of e-mail that comes to you. Basicly you are surrendering your e-mail privacy to a program in order to avoid being inconvienced by thieves.

Better just to get rid of the thieves.

Re:Spam is theft by GAVollink · 2004-03-02 02:26 · Score: 1

I agree with most of your post, but would like to point out that the bandwidth they are stealing is not surplus. In fact, on a saturated network, SPAM still comes through just as fast, but I sure as heck can't download the SpamAssassin source code fast enough.
I block using ordb (doesn't help much). So, I need to filter content, too.

USENET death sentence?.. by Anonymous Coward · 2004-03-01 14:07 · Score: 0

Whatever happened to the idea of the 'USENET death sentence'? Seems like a similar idea, implemented against large-scale spamhauses, would be a good idea. Too hard to implement nowdays, or what?

Spamd?? by Anonymous Coward · 2004-03-01 14:09 · Score: 0

What about this here Spamd stuff I've been reading about with OpenBSD? Does it make spammer's lives a little more difficult? Tying up their resources while never sending any of their junk out?

Spam solutions by jonwil · 2004-03-01 14:11 · Score: 4, Interesting

Firstly, all ISPs (and corperations, schools, unis and so on) should block port 25 by default.
Those that want to run a mailserver for legitimate reasons can do so but anyone who hasnt speicificly said "I want to run a SMTP server on my connection" will be prevented from doing so (this would cut out 99% of the spam comming from spam zombie boxes)

Second, close open relays (if you need to have an "open machine" run some kind of SMTP authentication)

Thirdly, implement SPF for more hosts and more clients (if you want to run your own mail server with xxx@mydomain.com addresses but relay through mailservers at ISP, work etc, just add those SMTP servers to the SPF record)

And forthly, be more proactive in blacklisting ISPs that are known spam havens (if enough people block the IP ranges of bulletproofspamhosting.com, spammers wont be able to get their messages through and bulletproofspamhosting.com will go out of business when the spammers leave)
If its a regular ISP with non-spam customers as well, pressure from the non-spam customers (especially if those non-spam customers are big) might convince the ISP to dump the spamers.
Eventually, if this happens enough, ISPs will realize that hosting spamers means that they will be blacklisted.

Re:Spam solutions by detritus. · 2004-03-02 14:50 · Score: 1

Firstly, all ISPs (and corperations, schools, unis and so on) should block port 25 by default.
Those that want to run a mailserver for legitimate reasons can do so but anyone who hasnt speicificly said "I want to run a SMTP server on my connection" will be prevented from doing so (this would cut out 99% of the spam comming from spam zombie boxes)

Thereby blocking anyone who wishes to use a third-party, legitimate SMTP host?

If the zombie machines can't connect directly to other domain SMTP servers, like AOL for example, who blocks direct SMTP connections from consumer broadband netblocks, the spammers will simply use the SMTP server for whatever ISP the zombie system resides on. I did my own SMTP on my NAT box for quite a few years up until recently, when I noticed any e-mails sent to aol.com, etc. were being rejected.

The ultimate solution to this problem is to eventually get rid of the SMTP protocol alltogether. Implement a new secure protocol for sending/receiving e-mail amongst the major ISP's, and have them run it parallel with SMTP (for compatability). A deadline should be set for the transition, until it has been thoroughly tested and implemented in e-mail clients, etc.

I think that if the major ISP's get their heads together, they can have a very powerful influence over getting a new standard implemented. Eventually, If small ma and pa ISP's customers start to complain that their e-mail messages aren't getting through to AOL, Comcast, MSN, Charter, etc.. other ISP's will have no choice but to follow suit and adopt.
Re:Spam solutions by minas-beede · 2004-03-04 13:16 · Score: 1

Firstly, all ISPs (and corperations, schools, unis and so on) should block port 25 by default.

An hour or so ago I mentioned Michael Tokarev's Moscow honeypot that was getting spam from uu.net customers. To save time I fudged a little. The spam wasn't coming from uu.net, it only looked like it was (because the spammer made it look that way.) Uu.net at first thought the spam complaints were bogus, had to be. That's because uu.net did block outgoing port 25. blocking port 25 wasn't enough to keep the spammers away.

The spammer (Ralsky) sent spam from a high-speed connection somewhere (in Dallas, but the actual source never was discovered - not by IP, not by street address.) The spam spoofed the uu.net IP addresses, so the ACK packets went to those uu.net IPs, which were uu.net dialup accounts. There were enough dialups in use at any time so that the high-speed link could send flat-out, spoofing different dial-up IPs, probably rotating through them . The ACKs got returned to the system with the high-speed link (the characteristics of the dialup IPs was that of a Cisco switch) so the TCP/IP dialog was carried out just like it was a normal setup.

Bottom line: there's more to it than first appears - even to professionals like uu.net employs.

It's going to take more than any single-step-and-then-it's-Miller-time approach. To stop the spammers the enemies of spam will have to keep whacking until there's nothing left to whack - and then a bit longer. Just like killing off a bacterial infection.

Follow the Money by Anonymous Coward · 2004-03-01 14:16 · Score: 0

This whole spam thing should be easy to solve.

Look, spam just doesn't pay unless the spam actually points at an end destination; the person or company that actually profits most from spam. These people must be stationary and locatable otherwise, again, they couldn't profit from spam.

Many times, this should be enough. Does anyone here really believe that a pill will enlarge their penis? That's false advertising! Most of the ridiculous "deals" that are offered on popular, expensive software have been shown to be counterfeit AND loaded with trojans that allow more spamming. Why aren't governments around the world interested in stopping these activities, which have been declared illegal by almost every civilized country? Why isn't Microsoft/BSA attacking these clowns instead of prosecuting the poor sunuvabitch that just left a copy of Office on the hard drive when they moved the machine to production?

Now, once you locate the person or company that pays for spam, you can follow the money trail to the people who generate the spam and these people generally aren't respected or liked by anyone. Why the hell haven't they been shut down yet? As stated above, lots of counterfeit software has been loaded with trojans to promote more spamming; who profits from this? Why, the very spammers that everyone says they want to shut down anyway; so why isn't Microsoft/BSA threatening the countries who harbor these activities?

Something really interesting... by KingRobot · 2004-03-01 14:17 · Score: 2, Interesting

I've been running mimedefang alongside spamassassin and graphdefang to help catch my spam.

Something really interesting happened the other day. I noticed that > 90% of my spam was coming from the IP 206.46.164.23 | 22

So, I happily blacklisted the host.

Whereupon, I began getting complaints that users were unable to send mail to us from Yahoo!

I promptly made the discovery that Yahoo!'s servers are happily sending me over 90% of all my spam. It despicable.

Re:Something really interesting... by Anonymous Coward · 2004-03-02 02:51 · Score: 0

POP-Before-SMTP. Problem solved.

Without a POP3 account and password, sending email via the corresponding SMTP server is impossible.

Question for spam-busters. by eddy · 2004-03-01 14:20 · Score: 1

I have a domain which I've had for years (3+), before that someone else had it. To this day I'm recieving spam to users that doesn't exist on my system and which thus are directly rejected by my mailer.

Now my question is this; since we can be 99.99% sure that everything mailed to these non-existant users (which haven't existed here for years and no normal person would try and contact over and over again) are spam, where/how could I use this information?

I'd like to have a script (I run exim so if I could set up rules to trigger it directly that'd be great) which basically updated realtime block lists with the IPs of these spammers contacting me.

Not a good idea? I wouldn't mind using such a list.

--
Belief is the currency of delusion.

It's worth noting... by signe · 2004-03-01 14:24 · Score: 4, Informative

I know they're not anyone's favorite company, but it's worth noting that AOL is not anywhere on the top 10 list. Not so many years ago (less than 5), they used to top that list most of the time, and the rest of the time they were in the top 3 (not necc. Spamhaus's list, but Spamcop's definitely, back when they meant something).

Having been involved in the work, I can tell you that AOL was one of the first, if not the first, large ISP to implement tagging of outbound email with the true email address of the sender, regardless of whether or not they put it in there (the X-Apparently-From header that AOL inserted). Also close to the first, or the first, to implement outbound filtering of email for spam. When the second one was put into place, I watched the ranking and saw AOL drop from #1 to nowhere on the top 10.

-Todd

--
"The details of my life are quite inconsequential..."

Major Consideration in Choosing a Web Host by JeffHeatonDotCom · 2004-03-01 14:32 · Score: 5, Insightful

The spammyness of your web hosting ISP can be a major factor. When you sign up with a host company, either dedicated or shared, you are assigned an IP address from their "pool". If you get an IP from a former spammer life is not good!

I got an IP address that was blacked listed by SPEWS once. Much of my email would not work and the web host company would not change my IP. They suggested I contact SPEWS. I later learned that the host company was a spammer magnet and I was not alone. I switched companies and all is well.

Jeff

How ISPs make money from Spammers - Clarification by ZB+Mowrey · 2004-03-01 14:38 · Score: 5, Interesting

The major ISPs charge in a metered fashion. That means all their customers pay by the MB, GB, etc. A spammer who uses bandwidth to send spam is going to pay for all that data - but so will the end user in the ISP's system. The ISP knows that spam is an issue, but it provides them with zero-maintenance traffic, constantly running up the user's 'meter'. In a capitalist society, profit is always the motive. The ISP doesn't just charge you what the bandwidth costs them... They add a percentage that equals profit. [Begin technically inaccurate but wholly educational example] XISP has a fixed cost of 10 cents per Gigabyte of traffic, upstream or down. They charge 12.5 cents per Gig. Spammer_X sends out 20GB of spam. He pays the ISP $2.50 for that privilege. Since cost was $2, they made 50 cents. Now, assume that the mail is primarily directed at ISPs who lease lines from XISP, and who pay that same 12.5 cents per Gig. If they get 60% of the downstream covered, they'll be able to make another $1.50 off the traffic they originated. So for transferring 20GB across their own network, they made $4 on something that cost them $2. THAT is why the "Common Carriers" take their time getting rid of spammers. The longer they can let the guy spew his mail, the more 'incidental revenue' they can scrape together.

--

Self-referential sigs are rarely entertaining.

Two words: JOE JOB by Mal-2 · 2004-03-01 14:58 · Score: 5, Insightful

How do you know that the company or site named had any thing to do with the spam? If putting an URL in a mass-mailing is enough to get the owners of that URL punished (financially or legally), then you will see joe-job spam used as yet another means to harrass uninvolved third parties.

Mal-2

--
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.

Dial-up by phorm · 2004-03-01 15:05 · Score: 1

And if you're on dial-up, then is 10 times worse than that. My parents' ISP recently started blocking measures, but up to then it was 20-30 idiotic spam messages, sometimes with graphics. Of course, those stupid chain-letters are even worse...

Take it east by phorm · 2004-03-01 15:10 · Score: 1

Yes, but sometimes it just pays to take your time and enjoy yourself...

One has to wonder... by buss_error · 2004-03-01 15:11 · Score: 2, Insightful

The Register point out that ISPs like UUnet and Abovenet continue to host spammers despite advertising anti-spam AUPs."

Gee, isn't it deceptive trade to say one thing and do another? Is failure to enforce a published contract, saying that everyone has to abide by it fraudulant?

On the email servers I manage, UUNet, Level3, Shaw, Cox, and Above.net are all almost completely blocked. The bounce message says "This site does not accept email by default from your current ISP. Please call xxx-xxx-xxxx to request whitelisting."

I love it when spammers call and try to get whitelisted. Like I've never heard of SpamCop, SpamHaus, SPEWS or News.Admin.Net-Abuse.Sightings...

--
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.

Just wanted to point out... by Mal-2 · 2004-03-01 15:45 · Score: 1

For all of those missing their regular goatse.cx fix, it's back up at goat.cx instead.

Mal-2

--
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.

MOD PARENT SIDEWAYS by Anonymous Coward · 2004-03-01 15:47 · Score: 0

GROSS!

In other news... by dysprosia · 2004-03-01 15:57 · Score: 1

UUNet and Abovenet record a massive surge in the number of new accounts registered with their ISPs...

Way to make me feel guilty... by Tokerat · 2004-03-01 16:18 · Score: 1

...for watching porn all day. :-(

--
CAn'T CompreHend SARcaSm?

Boycott MCI by Charles+Dodgeson · 2004-03-01 16:24 · Score: 1

Since autumn 2002, I've been calling for people to Boycott MCI for exactly this reason. Note that UUNet is still part of the MCI group.

--
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky

They're part of MCI. by Anonymous Coward · 2004-03-01 18:51 · Score: 0

UUnet belonged to the defunct WorldCom.
So is this at all surprising?

Already happening by TekGoNos · 2004-03-01 19:20 · Score: 2, Informative

My ISP is blocking all outgoing port 25 connections.

More and more ISP's force this onto their home users and render the Internet less usable.
Granted, it gives them a little more control over the email traffic - it has to go through *their* mail-server, so they can set preciser rules (limit the number of emails per minute or so) - but it also limits my freedom to do with my connection what I want.

And this only because some idiots catch some Windows malware and turn into zombies.

Why am I pissed off? Sounds like a good idea?
Yeah, except that their SysAdmins, that dont trust me, arent good enough to keep their own mailserver running. And if I have to wait 1 hour to get my mail send, just because they prevent me from delivering it myself, I'm pissed.
And I really liked to read my error logs to find out instantly if there are problems with an email instead of waiting 2 days till my ISP sends me a : "I've tried several times and still wasnt able to deliver it"-message.

Finally, I dont like the whole : "let's protect our stupid lusers from themself"-strategy.
Educate them, instead of putting them in a cotton wool cage.

--
I have discovered a truly remarkable proof for my post which this sig is too small to contain.

What about Qwest? by mcbridematt · 2004-03-01 19:30 · Score: 1

Have we ever thought about the idots who actually bother providing the backbone connections to spammers in the first place. Qwest is one

Slashdots most wanted. by JollyFinn · 2004-03-01 20:50 · Score: 1

This is a lists of criminals, wanted by slashdotters. should be considered extremely dangerous and should be ping to death on sight.
Imagine a beowolf of slashdotters pinging of these down.

http://www.spamhaus.org/rokso/index.lasso

Query replace ping shoot.

disclaimer: I do NOT advocate people for actually finishing 200 individuals responsible for 90% of spam, this was supposed to be joke.

--
Emacs is good operating system, but it has one flaw: Its text editor could be better.

ARRRG! by wowbagger · 2004-03-02 00:59 · Score: 1

WHOLLA - ARRRRG!

Voila - French, meaning (roughly) "Look at that!"

Perhaps we should add that to the ongoing LOOSE/LOSE problem on /.

--
www.eFax.com are spammers

Re:ARRRG! by Anonymous Coward · 2004-03-02 05:36 · Score: 0

He also said "back in the day," which is a sure sign of not knowing exactly what he's talking about. Back in which day? No idea.

Greylisting by Anonymous Coward · 2004-03-02 01:26 · Score: 0

I don't recall having seen any data on effectiveness -- would be interested in hearing from anyone actually using this approach in the wild.

My university uses it, and it's extremely effective. I'd say it stops about 90% of spam, and worms too. Not that I agree with the method, but it works very well (since spammers haven't caught on yet).

vindictive moderators? by ErnstKompressor · 2004-03-02 05:59 · Score: 1

Wow, post an anti-fundamentalist screed in a different thread, and watch a +3 insightful post in a different topic drop to a -1 offtopic/flamebait...

Tough crowd...

--
We apologise for the fault in this post. Those responsible have been sacked. -- Signed RICHARD M. NIXON

Different opinion by Anonymous Coward · 2004-03-02 07:40 · Score: 0

I must beg to differ with this, but perhaps this varies with different countries or Europe/U.S. policy? I live/work in Sweden.

I once worked for a rather large customer of Worldcom. Some times a technician phoned us and helpes us track down open relays and other problems inside our network (which wasn't completely within our immediate control, but we always got rid of the machines one way or another).

Very helpful!

With Power, Require Responsibility by 4of12 · 2004-03-02 08:16 · Score: 1

Spam is going nowhere until good authentication techniques are implemented internet-wide.

Why not do what my ISP did to me when I established my account, paying by check.

Namely, I had to show them a driver's license.

It's the same principle, really. Before the authorities controlling the traffic let me out on the public road where I could do a great deal of damage I have to get tested and get a unique and authenticated proof that I've passed the test.

Why not the same for anyone capable of spewing IP packets?

And just as commercial drivers licenses give their possessors greater authority to drive large heavy dangerous vehicles, an IP-issuer license would be graded similarly based on how many MB/s your connection is capable of spewing.

Make Aunt Tillie learn a little more about viruses and worms a little more before she hooks that Windows ME box up to the cable modem...

--
"Provided by the management for your protection."

Re:With Power, Require Responsibility by Cranx · 2004-03-02 09:02 · Score: 1

I think because Free Speech > Spam Death.

Spam is a hot issue...but just because it's hot and the issue bugging you now, don't let that make you forget how important free speech is, and accessibility to the internet is probably the greatest free speech engine since Gutenberg's printing press.

Parent unfairly modded down. by readpunk · 2004-03-03 10:38 · Score: 1

My post about working at the data center and our experience get's a +4 but this person get's "troll"ed? That isn't fair.

My experience if I went more in depth would be to also include the fact that spam listing's like Spamhaus and Spews, hurt our business on a regular basis even though we are constantly fighting spam.

One spammer can cause tons of customers to be unable to send mail to anyone using Spews, Spamhaus or any of the other spam blacklists and this simply isn't fair to them. We need to fight spam intelligently and these blacklists are obviously not solving the problem.

--

./revolution

Re:Looks like you CAN get /,'d from a comment link by Helen+O'Boyle · 2004-03-04 17:44 · Score: 2, Interesting

Blockquoth the parent:

You don't get slashdotted just because you're in somebody's comment, even a well-moderated one.

9:35pm PST:
The spamoo link in the grandparent comment works. However, when I tried to learn "About Spamoo" on the General Menu in the page, it only produced the required page SOME of the time for me. I had to try several times before it brought up the requested page.

So, it may be that a link in a comment, in and of itself, won't get one /.'d, but apparently a link in a comment.... to a site whose functionality is partially implemented as aspx's ;-), is sufficient to earn one partial /.'ing. I wonder what their server's horsepower is, and if it's doing anything else this evening.....

Slashdot Mirror

UUNet Is The Number 1 Spam Host

346 comments