Should You Trust MAPS?

patrick42 asks: "Recently, my co-location facility was hit by a massive blacklist by an over-zealous 'investigator' at MAPS. 180,210 IP addresses in total are included in the blacklist -- and all because of a few spam complaints that weren't dealt with quickly enough. To make matters worse, they put this in effect either late Friday night, or early Saturday morning -- hours during which MAPS is not available for contact! (Mon-Fri, 9-5 only) How do people deal with MAPS and other RBL services who will not cooperate or be reasonable? And on a broader front, are you really prepared to trust a company like Kelkea, Inc. (owners of MAPS) to decide what emails gets to you without really knowing how they operate and deal with resolution processes?"

"I spent all weekend long trying to get a hold of the people at MAPS, as they don't bother telling you when they are open. When I finally got a hold of someone on Monday morning (not an easy task, mind you!), they told me that they are not open on the weekend, so it would have been *impossible* to resolve this issue quickly. And because I was only a customer of the company who owns these IPs, they would not unblock my subset of IPs. Despite the problem originating from a handful of IP addresses, MAPS saw it appropriate to block over 180,000 IP addresses just before the weekend! I had already made several phone calls and emails to my co-location facility, and they told me they were doing their best to get a hold of someone there. Several emails had been sent, and just as I first experienced, they could not reach anyone at MAPS by phone. When I finally talked to someone at MAPS, he told me that he would not be proactive in the matter by actually phoning my co-locator to work this out.

These people at MAPS thinks themselves quite high and holy, and in some ways they are: many ISPs and the like will bounce emails just because MAPS tells them to. (I've since removed MAPS from my list of RBL servers to check.) As a small-business owner, MAPS can be very hurtful to a business and very uncooperative in helping resolve the issue. I gave them a couple subnets of mine to unblock, but they would not, even though my IPs were not involved in the original complaint.

This experience has certainly made me think twice about who I trust to decide the fate of my incoming email."

Comments

A sword that cuts both ways

[Space cowboy]

Whereas I have sympathy for the innocent bystander (as the poster appears to be), and whereas I agree that uncompromising behaviour can be frustrating, the SPAM black hole servers are somewhere between a rock and a hard place...

They can't just block small sections of netblocks (because a spam-happy ISP will just allocate new IP's to their paying spammer customer) - the only way they can police the offence is to ban the block.

They can't just add people back in when they've been blocked either - there has to have been some resolution of the problem, and that has to come from the ISP, at least IMHO. A customer running a website will say anything (especially if they're a scum-of-the-earth-spammer-type customer) to get back online. AN ISP who lies knows their next block will be more permanent...

OTOH, Being unavailable out of hours is ... frustrating. In the end, that will reduce the value of the service, and perhaps MAPS will be overtaken by someone who perhaps charges a fee, but is in some what accredited and responsible for their actions.

The real problem though isn't MAPS and their attitude, it's the spammers. Get rid of the spammers and you get rid of the need for MAPS. These lowlife internet-scum are where any ire ought to be directed, again IMHO.

A Sony NDA I once signed said that in the event of disclosure of anything under NDA, Sony would seek damages, and that financial reparation may not be sufficient penalty. The point being that the penalty *ought* to have teeth, and atm, the spam penalties do not. If you want less spam on the 'net, you're going to have to accept more regulation of the 'net. Another double-edged sword...

Simon

Re:A sword that cuts both ways

[AKAImBatman]

They can't just block small sections of netblocks (because a spam-happy ISP will just allocate new IP's to their paying spammer customer) - the only way they can police the offence is to ban the block.

Doesn't this suggest that the MAPS approach might be the wrong one to take? i.e. Have you ever tried swatting a fly with a shotgun? You could chase it around all day, and all you're likely to do is destroy your own house.

Re:A sword that cuts both ways

[Malc]

It's not the spammers who are really getting hurt here. The collateral damage caused by MAPS' brain-dead sledgehammer approach is not justified.

You mentioned an operation similar to MAPS that could charge a fee. Who would pay this? The spammer, or the victim, or the person signing up for the service? That sounds so open to abuse and extortion if it's the victim who has to pay to be unblocked.

I've had to deal with other RBLs and they're a holy pain in the arse. They're not worth the service they provide. They might save a couple of people from recieving some spam, but they're costing others time, money and stress in the process. To make it worse they invariabley have a terrible attitude. They're no better than vigilantes in most cases, and are normally a good demonstration of why vigilantes aren't tolerated in the real world.

Re:A sword that cuts both ways

[tricops]

Uhmm, wouldn't blocking an entire block of 180,000 IPs be more akin to swatting a fly with a square mile sheet than a firing at it with a shotgun?

Re:A sword that cuts both ways

[dillon_rinker]

Godwin's law and all that...but your analogy is flawed. We're not trying to kill a fly. If we were, someone would have built a flyswatter by now.

Rather, what we're engaged in is the unconditional surrender of Nazi Germany. Sure, all we REALLY needed to do in WW II was fire a single bullet into the brain of Der Fuhrer, but getting to that point required the invasion and destruction of much of Europe. Once the menace was gone, the Continent was rebuilt.

The rather scary part of this analogy, of course, is that the subsequent peace on the continent was secured by the decades-long occupation of the continent by a foreign army (ie the Americans). THAT is my concern in the anti-spam wars. The cure may be worse than the disease. (See other comments in this thread about increased government regulation.)

It is unfortunate that geeks aren't better at forcing other people to play nice.

Re:A sword that cuts both ways

[killjoe]

I run a mail server at home to service a few domains I have. I subscribe to multiple RBLs and they help an immensely to cut down on the spam.

Honestly I don't care it you are an "innocent victim" of an RBL. My use of RBLs is completely voluntary. If you send me mail and I don't get it I don't see how it harms you at all. I am presuming of course that your email was so great and useful that it caused me tons of money not to have read it.

BTW my mail server has a bounce message that says you were in a blackhole. If you know me then you also know my gmail account and email me there so I can put you on my while list. Hell you could just call me too.

If I sent an email to a business and it bounced I would probably call them and ask them if there were alternative methods.

So sorry, no tears from me. My RBL list blocks hundreds of emails every day for that I am grateful.

RBLs are a failure

[MoxCamel]

There was a time that I supported RBLs wholeheartedly. In theory, they're a great way to approach the spam issue as a community. And for awhile, they even worked that way. RBLs were very effective in the fight against spam.

But in practice, the RBL community has been a bust. The maintainers are often militant and, IMHO, too emotionally attached to the problem. They don't provide a service anymore--they provide a surgeon with a chainsaw. While it's extremely easy to get a site on an RBL, it's often difficult or impossible to get off one. There are exceptions of course, but in general you are a designated spammer until some random magic happens and you manage to get yourself off. (yes, there are procedures, usually on a website, but often removal requests will go unreplied to, and in some cases will error. Sometimes removal works and often it doesn't) And Goddess help you if the previous owner of your IP address was a spammer. (And no, I've never run an open relay.)

I hate spam, but I don't use RBLs anymore. It's too bad, really. They were a great idea, but have been poorly managed. I'm sure someone will post links to the "good" ones, but using them is like reaching for the few good apples in a barrel of rotten ones.

Mox

MAPS very flawed...

[raydobbs]

First, they want you to pay for the service. They will consider free usage occasionally, but take it from someone who has submitted five (5) applications for that kind of consideration - and have been flat out ignored - they are not a valid solution anymore, and are just looking to make money with the least amount of effort.

Similar thing...

[AusG4]

happened to my girlfriend's work, a charity, operating a clear, double-opt-in newsletter service about their ongoing work... some moron who clearly subscribed to their newsletter decided it was easier to use an automated "report as spam to ORBS" tool then it was to simply reply to the e-mail, click the "unsubscribe now" link, or re-visit the web site and opt-out via the very prominent, very obvious opt-out tool.

ORBS, in turns, blacklisted their mail server as an open relay, and then had the unbelievable nerve to tell my girlfriend that they would lift the ban in exchange for a "donation" so that they could continue to run their service.

While this isn't criminal, it's morally repugnant.

Bottom line, "blacklist" services like ORBS/MAPS are a horrible, misguided and idiotic idea. Case study after research project after real-life experience can attest to this.

Story has valid complaint.

[AtariDatacenter]

1. MAPS finds problem, discovers hosting by co-loc, bans entire co-loc.
2. Very shortly after ban, MAPS is unavailable for contact for 48+ hours.
3. MAPS refuses to unban innocent bystander.
4. MAPS refuses bystander's plea to contact co-loc.

Seems to me that MAPS has several problem. Aside from procedural issues, perceived arrogance, negligence, incompetence. Submitter is right. Overzealous, for sure.

I sure wish they were better. It hurts the users.

Re:No.

[rekoil]

Another time, we deduced that someone else had signed up the person in question (the person's last name was recorded in the database as "Assface").

You obviously didn't have a confirmed opt-in system in place then...if you had, the address in question wouldn't have gotten on the list, he would have gotten one email asking him to confirm his subscription, and nothing else if he didn't reply to it.

No, YOU get real (Was: Re:Get real)

[B747SP]

When Al Qaeda flew 737s into the world trade towers

No-one ever flew 737s into the world trade towers. ITYM 767s. The ones that landed in the pentagon and the paddock were 757s.

And anyway, WTF does any of this have to do with terrorism? It's a ridiculous link - a way to invoke Godwin without actually mentioning the 'n' word perhaps?

RBLs are advisory. RBLs do not block email. Which parts of this are y'all having so much damn trouble with. The operators of about 8 different RBL lists advise me (in response to a request for information that I initiate) that the MTA that has just contacted me is coming from an IP address that is known to have been used recently by a spammer. I choose to refuse to accept the proposed email delivery from that source on the strength of advice from one or more RBLs. (eight different ones, as it happens, on my home postfix server. It takes a full fifteen seconds for my smtp daemon to answer when you connect 'cos of all the lookups!!!).

Why is it so damn hard to grasp? Realtime Blackhole Lists do not block spam . Administrators and their policies block spam, and they've every right to choose what arrives on their boxes and what doesn't!

The original poster (article) has no right to get upset at anyone for my decision not to accept email from him. All he gets to do is F.O.A.D. Getting his royal whinge frontpage on slashdot is nice for him, but it's not a right or a guarantee.