Slashdot Mirror
On Futureproofing Spamhaus
BMcWilliams writes "Spamhaus director Steve Linford announced a new funding plan Tuesday. According to Linford's announcement, large ISPs and big corporate users of the Spamhaus zone transfer service (renamed the Spamhaus Data Feed Service) will be required to pay an annual subscription fee ranging between $190 and $14,500.(The free public-query mirrors will continue to exist.) The point of the new plan is to ensure that 'the millions of users who rely on our anti-spam systems can be assured we'll be here for as long as spammers plague the Internet'."
Maybe they should send an email to everyone requesting those $$$ :)
Won't these costs just be forced down onto the customers? Sure, it funds Spamhaus, but why is this a good thing for a user who doesn't have to deal with spam? I get maybe one spam e-mail a day.
Wheel in the sky keeps on turnin'.
Is this a Self-Elimating Business Model?
The point of the new plan is to ensure that 'the millions of users who rely on our anti-spam systems can be assured we'll be here for as long as spammers plague the Internet
As they eliminate spam, spam becomes less profitable, thus decreasing the need for them. Not only that, but the less spam, the less people will request their services, as they can do it in-house. What do you guys think?
Lets get it out of the way now....
1. Block spam
2. ????
3. Profit.
There. Are you trolls happy?
Since when has this country used intellectual elite as a pejorative term?
Aren't they all?
Make it a paid for service, so you can't sue for being on the list
or to provide money as a cushion against suits? and hurt in one, if you're a corporate bulk user (not bulk like that) you'll pay, for something that saves your company money.
Blah blah sig blah blah blah irony blah blah
In the meantime, thanks largely to ineffective spam laws passed by governments, we're having to step up the fight against spam with more resources....
Not that the gov't can do much anyway, but, it could do more. I think the fees are reasonable and I hope they are accepted and paid graciously.
Happy Trails!
Erick
http://www.busyweather.com/
...in a country that doesn't care about spammer's complaints? Something like Somalia or Afghanistan? That way they could never get sued.
This story makes me think of GRsecurity. Remember? It's dying because the developer didn't have any funding? Maybe Spamhaus caught wind of this, and is trying to avoid a similar fate.
Only the purest of souls seek enlightenment. Everyone else just wants power.
I think these guys would like to be put out of a "job".
Just as soon as this $54Mil bank transfer goes through for this poor Nigerian widow.
If Spamhaus eliminated Spam, Steve Linford would be the first one dancing. He'd probably get a knighthood, but I think he'd prefer a good night's sleep.
MS claims that Hotmail receives 2 Billion spams a day. (That's 2x10^9 to you friends across the puddle). I don't see that going away, more's the pity.
********* sig: If you don't like the law, get filthy stinking rich, and buy a better one.
I'll admit that I don't know how Spamhaus operates. However, it doesn't detract from what I said. Costs will still be forced upon me for something that I may have no use for. The government does it, but now it may be done from the private sector?
Wheel in the sky keeps on turnin'.
Spamhaus advises organizations set up a zone transfer if they're receiving 200,000+ e-mails per day. I doubt the average user (or small organization, corporation, etc.) will be receiving that much e-mail in a day (at least for now...)
Don't they mean, as long as e-mail exists; in it's current form, anyway?
Isn't my ISP a company that may use Spamhaus to filter e-mail?
Wheel in the sky keeps on turnin'.
It's logic. Big companies have no problem lying to their customers and making up fees. How about all those new fees you found on your phone bill with official looking names? Don't you think costs to customers will go up because of "Unwanted E-mail Filtering Services" and because it costs our ISP so much money to maintain, they'll "have to" raise prices by $2.95 every month.
Wheel in the sky keeps on turnin'.
Any way to stop this rampant trolling?
Wheel in the sky keeps on turnin'.
Even then a lot of businesses may actually save money through reducing bandwidth costs due to spam. I hope they don't force those savings onto you... :)
Q.
Insert Signature Here
homer: Ooh, I see. Get us addicted then jack up the price!
it is only after a long journey that you know the strength of the horse.
If a corporate IS department is running their own mail servers, it would be wll worth the money. Transfer the lists into the server and check all incoming mail instantly instead of the latency caused by going to Spamhaus. The bandwidth and time saved for someone like GM, GE, Siemens,..... Thats a lot of money saved. $14,500 is pocket change to them anyway, and if it saved $50,000 over a year, thats a good return. I'd bet it would save a lot more than 50K though.
The fact that it keeps Spamhaus a viable concern is another plus.
Professional Politicians are not the solution, they ARE the problem.
.... having the people who are combatting spam effectively reduce the over al global bandwith load that spam represents, plus helping in another oblique way be getting more people aware of spam and maintaining their own computers in a safer manner. It's a win for everyone who's on the net-except the spammers.
I benefit, I guess. Not directly, as far as I can see. I'm not spammed badly enough for me to need a filter. However, as stated in a different reply by me, this could provide companies an excuse to raise fees by some unreasonable amount (i.e. more than $.25)
Wheel in the sky keeps on turnin'.
I may be an idiot, but it seems to me that most organisations could justify any of the amounts listed by doing some simple cost benefit analysis.
My understanding is that Spamhaus allows you to blackhole IP blocks that are known to tolerate\encourage spam.
If you step back and work out the cost of bandwidth to accept all of that spam, versus the cost to pay Spamhaus to blackhole it, it probably works out in favour of paying for Spamhaus.
Here in
There is nothing wrong with charging for access to a spam black list. You could even charge on the basis of the bandwidth that the customer used. So big customers that hit the database a lot pay, people who it it only a few hundred times a day pay little or nothing.
My impression however is that Spamhaus is compromised by their association with IronPort, which provides a system for high speed mass mailing. Yeah I know that these are only supposed to be used by "the good guys". But that assumes that we agree on what a "good guy" is.
Perhaps I'm being too hard on Spamhaus and IronPort. But like many you, I get hundreds of spams a day. It has gotten to the point where having domain based email that comes to my Linux shell exacts a cost, even with my spam filter in place. So I don't look kindly on anyone who supports mass e-mail, whether they are IronPort or some spammer in the Bahamas. Given this view, I don't look kindly on those who associate with spammers (ah mass emailers), and that includes Spamhaus.
At the very minimum Spamhaus fails the "Caeser's wife" test. They support a spam blacklist database and they are owned by a company that sells mass mailing services. Seems like a built in conflict of interest.
"$190 and $14,500"
This takes the sound bite "prices may vary" to a new level.
the byproduct of years of oppression by the white man
Do you buy insurance? You may never use it. It's private sector.
"Do not drill any holes in your cat - it will not like it."
-- Nick Davies
You are confusing Spamhaus with SpamCop...
Spamhaus has no affiliation with IronPort!
Several people have posted that I've confused Spamhaus with SpamCop. Sorry. It was careless on my part. My appologies to Spamhaus.
Just move to a state that has anti-spam laws, like North Carolina. North Carolina statures allow for 10 dollars per spam. California allows for 500 dollars per spam. Either way, with millions of pieces of spam per day intercepted by their service, they should stand to gain quite ludicrously on the deal. If they can track down 20 of the top spammers, and one of them has insurance, SpamHous will suddenly have far more money than it will know what to do with. Sadly indentured servitude is not a viable option for the other 19, as the US has bankruptcy laws. Still, assuming the congress hasn't passed any laws saying that people CAN SPAM, the plan is perfect.
The ______ Agenda
SMTP has a security hole: any connecting client can assert any sender address. This flaw has been exploited by spammers to forge mail. The result: your mailbox fills up with bounces to messages that you didn't send. Close the hole, and we can easily block spammers by sender domain.
SPF closes the hole by using a DNS record that says which hosts can send email with a from address in the domain. The record is a simple TXT record that looks something like this:
What most of you don't know is that this is a Microsoft technology. Remember when Bill Gates said that he'd solve the spam problem in two years and you all laughed? Read this for the all the technical details. As it is an internet draft, this is completely patent free and anybody can use it.
One can wonder whether additional funding will have the effect of actually having the records reflect the realities. The trouble is that I know of at least one record (SBL6024) that is filled with errors and despite several attempts at having Steve correct them, all that happened was a bunch of insults in response.
/29 belonging to Wild Rhinos nameserver moved to their record (SBL14379) - or similar. I know it would not delist anything (that's not the issue) but it would correct the information and that's what's important here.
All content in that record except *one* line is completely wrong and/or severely outdated. The bad content reflects an old customer long gone (booted late 2002) whose IP-ranges were mixed up with Dynamic Pipe. All that remains valid is a single nameserver (freya.wildrhino.com) belonging to a different customer/alledged spammer: Wild Rhino.
If the info should be correct that entire record should be removed and the
But Steve does not want to admit his mistakes here, and one can wonder just how many other records in his system are equally flawed, mislisted or plain false. If the incorrectness is rampant throughout, one can wonder just what these businesses would be buying. I think Steve needs to learn a bit about humility and responsibility before he starts making money big-time on this. Because making money off lies and false pretenses has always been the domain of those he claims to hate the most: SPAMMERS.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
Part of the reason why you get so little spam is organizations like spamhaus.
Compare the top-end $14,500 cost of spamhaus to the $400,000 price tag for one of the highest-end routers. If Spamhaus saves MSN from buying 2 more intel servers, then they'll recover their costs.
For the largest ISP's (we're talking the likes of MSN, Yahoo, etc.) this comes to about 1/4 of a full person's salary (or about 1/10th if you include secondary costs). I have a friend who pays about that for some of his servers... (we won't even start looking at what some people pay for SUNs).
Even for the medium-sized ISPs who will be asked to pay $190.. they'll probably spend almost that much processing the bill. We're talking less than the price of an XP-Professional license.
For the smallest ISPs and single users (like me) they're promising to remain free -- in fact that's why they're doing this.
Free Software: Like love, it grows best when given away.
I've never publicised the email address.
More importantly the address is obscure. I've seen /.ers offer their so-called "obscure" email addresses and I've thought them all laughably likely to be hit in a dictionary attack.
Mine is 14 characters, mixing letters and numbers, as a sentence implying a certain head of state doing something naughty. Easy to rememebr, and not in any dictionary attack. :-o
And no spam!
I have to say those who claim to have got spam within minutes of opening an account and blaming Microsoft) need to adjust their tindoil, and learn what obscure really means when a computer is systematically working through a dictionary.
Recycle PCs and build a wireless community network www.hillsborough.org.nz
Gee, I leave my tinfoil hat off for just one lousy week and there's not just one but multiple world governments. I was just getting to grips with overthrowing a few national governments.
Do I get to choose which world government I'm under? Given the choice I, for one, would like to welcome my new illuminati overlords.
Recycle PCs and build a wireless community network www.hillsborough.org.nz
It's actually far cheaper than you calculate:
14,500 is the price for *UNLIMITED* users (in other words for the giant 'Hotmail/AOL' ISPs)
The price for 100,000 users is not 14,500, it's 6,500, which Spamhaus shows as $ 0.07 PER USER, PER YEAR.
I don't even want to be with an ISP that can't afford that or who wants to pass $ 0.07 a year on to me.
No need to add a new wrinkle to SMTP, just analyze the SMTP traffic to detect relaying by remote users and refuse to relay and force the local users to POP-BEFORE-SMTP to use the mail server. This is a simple 1-2 punch to stamp out a lot of spam
They already have access to all those emails desperately trying to give away $3.5M . They have all the funding they'll ever need....
I have no sig yet I must scream.
Imonna Live Forever!
I've got a 14-character alphanumeric obscure email address that I've never given anyone - but at least I don't get spam!
Do you get any email at all?
Spam is all about the signal to noise ratio, you know.
GRsecurity is dying because it sucked.
and was full of shit..
and all the REAL security experts know it.
Won't these costs just be forced down onto the customers? Sure, it funds Spamhaus, but why is this a good thing for a user who doesn't have to deal with spam? I get maybe one spam e-mail a day.
You're the same kind of a**hole who complains that some of his taxes are going to subsidize medical care for blind, quadrapalegic veterans. 'It doesn't help me personally, so why should I pay for it?' Talk about self-centered!
But, since you are that type of person, I have a suggestion: Your ISP should turn off all spam filtering and then force you to personally pay for all of the additional bandwidth, storage, and servers necessary to handle the load. Oh, and when other customers leave the service because they are now getting spam, your monthly bill will increase by the amount that they were paying to cover the ISP's losses.
You have an AOL address. That means that you are probably paying well over $20 per month for dial-up service. If you're so frigging concerned about the $.000034 per month that AOL might pass on to you (yes, that's the real number assuming $14,500/year divided amoung 35 million AOL subscribers), then why aren't you using any of the under-$10 ISPs out there?
Fireproofing - protecting against a fire happening.
Waterproofing - making sure water can't get in.
Spamhaus is a GoodThing (TM) - is futureproofing it a good idea?
----
WWJD...For a Klondike Bar?
At least, all the sensible ones do. The one I wrote did, at least. You just program them to include &threshold=-1 in every URL.
nihirnighthawk@aol.com
1. one man's "-1 troll" is another man's "+5 funny" (and this AC owes me a new keyboard...apparently mine doesn't like cherry coke)
2. you had the balls to say "I only get one spam a day" and didn't think anything would happen? Puh-leeeeeease.
"Murphy was an optimist" - O'Toole's commentary on Murphy's Law
Bullshit.
Even if everybody (as in every ISP - everywhere) on the internet implemented SPF, IT WOULD NOT STOP (or even REDUCE) SPAM.
SPF does nothing to stop spam, all it will do is force spammers to not spoof their From: address as much, all the while reducing the utility of the email system as a whole.
There are *two* big flaws with the belief that SPF would stop spam:
First, spammers use trojaned machines to send spam. It's trivial to modify the trojans to use the provider's upstream SMTP server, and continue to spoof using the ISP's domain.
Second, it's *trivial* to buy a domain, set up SPF records for it, and spam away - and if/when people start blocking mail from your domain, buy a new one - in case you hadn't noticed, domains are CHEAP.
Combine this with the fact that it will reduce the utility of SMTP, and you have a whole lot of work, no gain, and a bunch of pissed off users.
If I want to use my home email account from work (say during my lunch break) and my ISP implements SPF, I'm screwed. I won't be able to do this anymore.
SMTP has _NO_ security hole. If you believe it does, then you're more stupid than I thought.
You're right, it doesn't make it patent free. Once an idea/invention is published there is a one year fileing period. After that it stayes in the public domain. Patent applications can stay in the approval process for several years though. I don't know how long this has been out, or whether it can be a "submarine patent".
IANAPL
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
Spamhaus is selling access to two lists.
One of them, the SBL, is a list used to apply pressure to ISPs. It doesn't stop that much spam. It's a political tool, just the same as the MAPS RBL was.
The other, the XBL, is extremely effective at stopping spam. But Spamhaus doesn't run the XBL. They're just downloading the (freely available) CBL and BOPM lists, then selling access to them for thousands of dollars a year.
Don't set up a public display address. Ever. Anywhere. If you have to, use a throwaway spamtrap like Hotmail or Yahoo that you can just forget about if things get out of hand.
According to Linford's announcement
Something tells me Lindows's new company name isn't going to last...
You know what's really funny? That guy's email is going to get indexed by Google, and it's all because of you. Since the default threshold is 1, posts at 0 or -1 don't get archived, but those at 1 or above do. Your post is at 2, so it gets archived.
The spammers thank you for your valiant service in the war on empty mailboxes.