Email Servers Will Choke, Says Spamhaus

Rub3X writes, "The legal battle between antispam organization Spamhaus and e360 Insight is heating up. Spamhaus has a user base of around 650 million, and its lists block some fifty billion spam emails per day, according to the project's CEO Steve Linford. Spamhaus CIO Richard Cox says the immediate issue is that if the domain is suspended, the torrent of bulk mail hitting the world's mail servers would cause many of them to fail. More than 90% of of all email is now spam, Cox says, and he doubts that servers worldwide would be able to handle a ten-fold increase in traffic." Others estimate Spamhaus's blocking efficacy as closer to 75%; by this metric spam would increase four-fold, not ten-fold, if Spamhaus went unavailable. The article paraphrases CIO Cox as saying that the service will continue "even if there is a short-term degradation."

Comments

Re:Someone please tell me they have an alternative

[Solder Fumes]

There is no alternative. As soon as any method becomes popular enough to be useful, spammers will move in. Sure, you could use IM, but spammers are there already. You could set your IM client to only accept messages from known users, but you might as well go back to email and set up a whitelist.

Let's get to the very root of this problem: spammers can send as much email as they want, with very little penalty in cost. This problem could be solved if some kind of postage system was applied to email. It's been said before, and it's always beaten down in this community because it appears to fly in the face of Free ideals. Well, everyone here is already paying for their internet connection, for their computer, for the power to run it. I'm sure some method for postage could be devised that still maintains a level of privacy.

And to be honest, I'd be interested to see what effect this would have on supposedly valid emails. Perhaps that weekly newsletter would have a little more thought put into it. Maybe Aunt Patty wouldn't forward the same joke that's been going around since 1997. Corporate internal email would be unaffected, unfortunately.

Re:I say let the spam come

[misleb]

It would be interesting if all email server admins suddenly opened the flood gates for a day or two. Maybe then the general population will gain a better appreciate of the scale of the matter.

I think most internet users still remember what it was like before spam filtering became common. Wait a few more years. Then users will take the filtering for granted.

-matthew

Use the UK server name!

[samfreed]

Use the UK domain system, e.g. http://www.spamhaus.org.uk/ . It works, and it's not subject to US law.

Re:Use the UK server name!

[Digital Vomit]

...it's not subject to US law

It's sad how this statement is becoming more and more associated with freedom nowadays.

Re:Someone please tell me they have an alternative

[rar]

Easy. We just need to set up a protocol where an ISP is charged $0.01 per email sent. That will kill the spammers without having any real effect on people sending email.

Actually, the problem is not this simple. Spammers today send their emails from millions of hacked computers worldwide. They will just continue to do so, and these charges will drop on the clueless users whose computers are used to send the emails.

As long as computer security is as bad as it is today, there just is no easy solution to spam. All hyper-clever ideas about encrypted network id:s, black and whitelists, hashcash, etc, are just temporary solutions --- they only serve to drive the spammer to more intensly use the fact that a hacked computer also gives access to an online identity.

Interesting legal argument.

[cperciva]

I'm starting to wonder about the sanity of Spamhaus' lawyers -- or if they really have lawyers at all. So far their arguments seem to have been

1. This case is at the wrong court, it should go to a federal court instead.
2. (to the federal court) We agreed that you had jurisdiction over this, but we're going to pretend that we didn't say that.
3. What? You've decided that we broke the law? Well, you shouldn't punish us because we're really nice people.

While I do not doubt Spamhaus' credentials as really nice people, this is hardly relevant to the case in question.

Re:Interesting legal argument.

[Anonymous Coward]

Wow, ignorance comes in many shapes and flavours. In this case, the flavour is 'mind-boggling'.

You appear completely oblivious to what the concept of 'jurisdiction' means. It is indeed true that the word can be defined in several ways, and _one_ way of defining it is 'you have jurisdiction over whoever you say you have jurisdiction over'. That should however be tempered by the fact that most legal systems specifically limit jurisdiction to acts related to that country or its inhabitants, and it is false to imply that the default jurisdiction of any court in any country is whoever the judge in question feels like exercising judgement over on that day. For the sake of record, I don't know the US rules for jurisdiction, but I do know that Spamhaus is a UK company with no employees nor operations in the US. I will therefore assume for your benefit of argument that US courts do indeed have jurisdiction over anything in the world.

That definition of jurisdiction is however a misleading one, as it excludes the concept of 'control' and 'power'. A US civil court giving a default judgement against a UK company is equally potent as a Nigerian court giving judgement against Microsoft - or even myself, that I bestow upon myself the power of jurisdiction over you. I could sit here on my couch and find a judgement against you - 'asshattery on Slashdot' - punishable by death - and the enforcement of the judgement would in your bizarre words solely be a practical matter!

Maybe it would be an assistance in your mind if you replaced 'The US' and 'The UK' respectively with 'Nigeria' and 'The US'? In this case, that a Nigerian court in which a US company did not bother to show found the US company guilty of something which is fully legal in the US (for the sake of example, let's say they are found guilty of 'depicting the Prophet Muhammed') to the tune of $500M. The US company would simply ignore it completely. It is bizarre and frankly completely inunderstandable that you can argue such a question is simply a matter of 'practical enforcement rather than legality' - for the main reason that in the United Kingdom THEIR ACTS ARE NOT ILLEGAL. US civil courts are equally irrelevant to the UK as Nigerian, Mongol and Congolese courts, and in this case the removal of the domain name is simply an illustration of the impotency of the court, as it futilely orders the demolition of millions of 'Yellow Pages' catalogues with the company's name in them because there is nothing else it can do.

I realise that this appears to be a lot of babble to you, all 'blah blah Jurisdiction blah blah Doing the crime but not wanting the time blah blah', but in reality it's not. This is why you lose, because what you discount as immaterial is actually material. Ultimately if the court do go ahead with this, there will simply be created an internet authority outside of US control, and the 'legality' of US judgements will be equally 'legal' and relevant to the world as the crazy ravings of an asylum patient in a third-world padded cell.

Re:Interesting legal argument.

[cpt kangarooski]

I disagree with your analysis. It's entirely possible to successfully argue that the case should be dismissed for lack of personal jurisdiction. Of course, jurisdictional arguments aren't guaranteed to win on their own merits. For example, the mere fact that Spamhaus is based in the UK isn't really relevant here; what's more interesting is if they work with entities in the US, how much they do this, etc. But in any event, if you don't follow the right procedure for bringing this issue up, you waive it, and so personal jurisdiction ends up existing for a certainty.

As for the courts, yes, they are entirely capable of deciding that a case doesn't belong there, dismissing it, and suggesting that the parties refile in a different court, possibly even in a different country. Happens all the time. But it takes the right kind of case, argued the right kind of way, to get to that point.

Re:Interesting legal argument.

[giafly]

You're actually agreeing with GP. You're both saying that anyone who is clearly not subject to US law nevertheless has to represent himself before a US court to establish this, which means everyone is in effect subject. And anyone who disagrees risks huge damages.

Re:Hysterical claptrap

[deepb]

Spamhaus has no idea how many spams it actually blocks.

It's an estimate based on their query volume. That's certainly not going to produce an exact number, but it's way beyond having "no idea".

Suggestion to spamhaus

[rar]

Why don't spamhaus just remove the e360 adresses from their regular spam lists and add them to a new list named "addresses no longer blacklisted becuase we were sued and ordered to remove them"?

That list would then serve as a perfect permanent black list for all sysadmins who happen to think that people who sue spam lists might not be the kind of people who send worthwhile emails.

I would actually recommend even higher priority to that list in the spamassassin config file than spamhaus' regular blacklists :)...

Re:I say let the spam come

[TapeCutter]

"I think Spamhaus is trolling after making an ass out of itself in court."

Ummmm, they didn't go to court and they have not accepted anything, Spamhaus are demonstrating their view that the court does not have jurisdiction, Spamhaus seem to have a clue what they are talking about but the judge isn't listening since they refused to recognise the court by showing up. And if push really did come to shove then Spamhaus would probably just "reboot the company" in a different country.

I've been in front of a few judges in my time and IMHO many of them are the most arrogant people you could possibly imagine. I know very little about the US court system but I am guessing a district judge is not very high up the judicial foodchain and would have a hard time shutting down the internet no matter how hard he bangs his gabble. Meanwhile the rest of the planet will treat an unenforcable court order from this judge about as seriously as they would a court order from the judge in this case.

Re:I say let the spam come

[Tim C]

It would be interesting if all email server admins suddenly opened the flood gates for a day or two. Maybe then the general population will gain a better appreciate of the scale of the matter.

And what exactly can we do about the problem? I'm part of the general population in this case, how can I help? I secure my machines (so no spam zombies for me), I don't buy from spammers or companies advertised by spam, and I'm not within the court's jurisdiction so I can't petition it (even assuming they'd listen, which they probably wouldn't and arguably shouldn't).

(I also appreciate the scale of the problem; I own a domain and thanks to some scum sucking low life using it in their forged From: headers, I get in excess of 1000 junk mails, bounces, etc per day.)

So what would you have me and the rest of the "general population" do?

The Day Without Immigrants was a plea for help

[m0llusk]

After the failed attempt of the illegal alien crowd to shut down the USA by telling immigrants to march on one day (they don't differentiate between illegal and legal), ...

This is garbage and as such damages any argument you might try to make regarding the subject being discussed (spam). The goal of the Day Without Immigrants protest was to call attention to both the plight and the influence of immigrants. Apparently you are uptight about being part of a system that explicitly relies on undocumented immigrant labor? Perhaps a bright future awaits you in the agricultural or travel industries? There was no attempt to shut down the US, and during the protests it was common to see expressions of patriotism including displays of the flag and replicas of the Statue of Liberty.

Absolutely everyone differentiates between illegal and legal. That is the whole point. In order to become a legal immigrant there should be a process. The existing process typically takes in excess of ten years simply to review an application, never mind actually approving one and letting someone in. Many of these people who wait for ten years or typically more may do quite a bit of productive work in the interim. While the rules for entrance get endless argument Americans show they want immigrants by hiring them and endorsing the products that are associated with them by forking over money.

Perhaps you might be able to kick start your empathy if you moved away from the focus on illegality and thought more about the criteria involved. If someone is willing to work hard and has skills that are valued, does a waiting period of at least ten years make sense as an initial barrier before other barriers are introduced? Hint: There would be fewer undocumented workers if the process for documenting them functioned at all, even functioned as designed, better yet functioned by more common criteria.

Re:Someone please tell me they have an alternative

[Anonymous Coward]

I am so ready to walk away from cars. I just need someone to point me to a workable replacement.

Never owned a car in my life. It's called a bicycle, and public transport. Yeah, yeah, so you live in the USA where those hardly exists. Sucks to be you.

I am so ready to walk away from television. I just need someone to point me to a workable replacement.

Been doing without for four years. No ill effects, lots of extra free time. DVDs are watched on my computer.

I am so ready to walk away from radio. I just need someone to point me to a workable replacement.

Been doing without for six years. No ill effects, my music-ripped-from-CD collection is large enough to offer much better variety than any radio station ever did, and I'm completely free of annoying jingles.

Don't see the need to walk away from life or my legs just yet, but I'm sure that if you really want to, you'll find a way

Re: Okay... Postage... But?

[gbulmash]

Who collects the postage? Who does it go to? Are they obligated to use it for something constructive, or would the penny-per-e-mail just fatten the bottom line of AOL and Nerflink?

All we need to do is two things:

1: Link spamming to terrorism. Convince people that when they do business with spammers, they're funding global terrorism.

2: If Bush can put a "wanted dead or alive" price on the heads of top terrorists, then we can have a spam czar using the penny per e-mail tax to put a price on the heads of top spammers.

Suuuure, it's worked so well to get Americans to give up their SUVs and take public transit to slow the flow of all the oil money that supports terrorists. And those bounties have helped us get Osama Bin Laden in custody. Right?

Re:Trying to block spam is like...

[Anonymous Coward]

We should go to the source - those businesses who pay spammers. Right now they weasel out like "we don't spam, we just pay our associates for marketing services". That way they stay apparently clean. There should be a law that prevents such responsibility decoupling. Those who pay and are advertised MUST be responsible for their advertisments. They must be prevented from feeding money to spammers. Furthermore, those who buy goods offered thru spam should be persecuted. There should be a law against buying services or products advertised over spam and police should do like they do when hunting customers of prostitutes - send fake spam and arrest those who answer it. Then this small subpercent of "paying customers" would shrink further and spammers business model would choke.

In fact, direct marketing should be illegal alltogether, for all networking (spam, telemarketeering) and environmental (junk mail - all that paper, ink, fuel for postal vehicles) reasons. No society or civilisation can sustain all businesses sending personal notes to each person. It is not just annoying, it is insane.

Not a valid defense...

[kula.shinoda]

It is _not_ a valid defense to say that something would break without you - while you might be right, that is the wrong argument to be pushing here.

Would slashdot give Microsoft so much slack if they were put on trial for monopolistic behaviour, and said the world's computers would become vulnerable if they were put out of business?

Re:law

[purple_cobra]

Doesn't really matter if the land in question is a foreign land, does it?

Re:It could be worse

[geminidomino]

If Spamhaus goes down, then the difference will be semantic once the crapflood hits.

Re:Truth at last

[Tim C]

Spam is not a Microsoft problem, spam is a clueless user problem. It's just as easy to write a trojan spam bot that works under Linux or OS X as it is to write one that runs under Windows. All you need to do is trick someone into installing it as root/admin. Right now that's unlikely, as there are (relatively) so few Linux boxes and the maintainers and users are (relatively) so much more clued-up about this sort of thing. If the masses ever migrate away from Windows, they'll be just as clueless and likely to root themselves on their new platform.

I'm not defending MS (who have worked quite hard to make PCs easier to use, with the side effect that the more clueless user can use them) or denigrating Linux. I'm just pointing out that actually spam is a social problem; the average user doesn't know enough to keep their machines clean. A lot of users don't even care, as long as their machine works for them, they don't care who it might be working against.

Education is our only hope. Personally, I think we're doomed.

Re:I say let the spam come

[DoomfrogBW]

RTFA

I think you are terribly mistaken. Spamhaus screwed up. They could of ignored or sent an attorney as special counsel to the case without acknowledging the jurisdiction of the Illinois court. Because they asked it to be moved to Federal, they pretty much acknowledged that the judge now has jurisdiction over the case. Then, because they don't like the judgement, they go ahead and try and ignore it. Instead of not showing up, Spamhaus could of done a better job in front of jury. Because they didn't, the judge didn't have much choice as the plaintiffs win by default.

You do not win a fight in the U.S. court system .

[WhiteWolf666]

. . . by threatening judges with impending doom.

Really. It doesn't work, unless, of course, you are the President, warning judges about terrorists.

Still, I've argued this point before; there's at least a few points of dispute regarding jurisidiction, and spamhaus should have showed up in court.

It doesn't matter if they are ultimately right; what matters is that it is not 100% clear cut, and as such, a judge will give a plaintiff a great deal of leeway in a default situation.

Re:Spamhaus have their problems

[ObsessiveMathsFreak]

I work for an ISP providing dedicated server hosting & colocation. Recently a couple of our customers contacted us saying that they had appeared on the Spamhaus blacklist, and were consequently having trouble sending e-mails. They claimed that they had not involved in any spamming activities, and that this listing was therefore incorrect. We found out that Spamhaus had blacklisted a range of our IP addresses (specifically a /27 subnet), and their explanation was that we were hosting someone from their ROKSO list.

Buddy, believe me, as a long time victim of spam when I say; Fuck You, and Fuck Your Customers. Your story is an example of Spamhaus doing its job, and doing it right. If your ISP loses customers and goes under, it'll be one less spammer firendly host. I say, good riddance.

Re:I say let the spam come

[CastrTroy]

But at least with Yahoo, it ends up in the spam box. Hotmail puts it in your inbox. Unless you turn on the option to only receive mail from your contacts (Whitelists are stupid) then just about everything ends up in your inbox with Hotmail. I have accounts for both, and as of now, I have 927 spam messages in my spam box from yahoo. With hotmail I have I have 2700 message in my inbox, 14 of which are from my contacts; I have 12 messages in my junk mail box. So, hotmail is terrible at blocking spam, while Yahoo, at least puts it in a separate box for you, so it doesn't clutter up your inbox.

Re:Someone please tell me they have an alternative

[AaronLawrence]

This famous checklist is a useful thing to have around, but IMO not a decisive answer to any spam suggestion. It is very likely that we will have to compromise on one or more of those ideals in order to make progress.

Re:Quantum mechanics.

[Andrew Kismet]

This post is probably the greatest use of "Post Anonymously" ever.

Re:I say let the spam come

[thc69]

Imagine the cost to the court systems.

Re:Spamhaus have their problems

[Anonymous Coward]

Sure that is really insightfull. Let's use a nuke instead of a bullet to shut down the spammer? WTF? And then lets not back it up with any facts that they did anything wrong. oh, one murder in the city, lets' nuke them all. Really smart.

Re:Spamhaus have their problems

[ajv]

(Mods: My last comment on Spamhaus was sent to "troll" land - my first ever negative comment on Slashdot in 10 years. Being pro-Spamhaus != good netcitizen and vice-versa. I am a good netcitizen, working extensively on Australian internet governance issues, such as being the technical dude who worked on auDA when we moved from monopoly to a regulated DNS environment, and secured Australia's second largest ISP and helped build and secure the alternative massive backbone, which carries all academic traffic as well as most ISP traffic. I was once the SAGE-AU President, and I still abide by their code of ethics. Therefore, if you mark me a troll or flamebait, you are a working against the best interests of the Internet. Read and decide for yourselves, but be v. careful when you hit the moderation button.)

This is happening to me right now. Spamhaus are acting like a wild west sheriff, but have no responsibility.

I host a number of websites, one of which has 5500 car nuts. I suffer *actual* financial loss directly because of Spamhaus' illegal blocking of my hoster's entire netblock. The spammer is gone, and yet we are still blacklisted. There is no way to get off this virtual death penalty.

New folks wanting to talk about VWs on my forum can't, and they leave, frustrated. I don't even know that they're stuck as my mail from the system is broken. Those few I do hear about - via the users being very persistent, cause me to spend 10-15 minutes per new registrant to get them on. If they lose their password, I can't help them. I spend an extra hour or two every night working on problems, and although I get a nice Google check once a quarter which generally comes close to paying the hoster, I'm suffering growth problems now - we moved from 2500 to 4000 members in no time, but our last 1500 members have dribbled in over the last 18 months. In the 18 months I've known about this problem, Spamhaus have cost me at least $4500 in lost wages at McDonald's rate (far lower than my actual hourly rate), and at least (and this is EXTREMELY conservative) $1500 in lost advertising revenue. I run my site out of a love for Volkswagens and as close to being a non-profit as I can whilst allowing for growth (we will eventually need more servers), but it's still coming out of my pocket. The loss to me is significant in time and money, but the loss of community is immense. Spamhaus are destroying my community, and many thousands of others with their negligence.

Spamhaus must:

* Provide a way to get unaffected netblocks off their list. This "block the lot" collateral damage is like mowing down an entire kindergarten of kids to get at the pedo jerking off at the fence.

* Acknowledge the financial harm they cause when they block domains that have NOTHING to do with spam. Even the spammer who used the netblock (before being kicked off) used it for pr0n, not spam. Netblocking the entire 64 odd class C's (in my hoster's case), blocking thousands of innocent customers just because one of them hosted pr0n for a short while before moving on did not in ANY way reduce the world's spam problem. I'm certain we are not the only site suffering this.

Totally unacceptable.

Do NOT mark me down as a troll - Spamhaus are not the protectors you think they are. I once thought they were, but they are not our friends, merely falliable people who see everything as black and white. I do not want them working for us any more. They must be put out of their misery. Hopefully, a replacement RBL will arise who aren't so arrogant, take some responsibility, carve out netblocks and /32s which make sense, and preferably be in the form of actual law enforcement. Spam is illegal in most countries, and citizens MUST not and indeed are NOT allowed to take the law into their own hands. Spamhaus are not the solution, and never have been.

Re:I say let the spam come

[SlackGirl]

Hell, if SA just detected animated .gifs and let me assign them 10 points, that would be fine with me. *Nobody* is sending me those legitimately. YMMV, etc.