Long-Dead ORDB Begins Returning False Positives

Chapter80 writes "At noon today (Eastern Standard Time), the long dead ORDB spam identification system began returning false positives as a way to get sleeping users to remove the ORDB query from their spam filters. The net effect: all mail is blocked on servers still configured to use the ORDB service, which was taken out of commission in December of 2006. So if you're not getting any mail, check your spam filter configuration!"

Comments

Nope.

[TheLazySci-FiAuthor]

No emails, but it's not the ORDB system. I just don't have any friends.

Re:Nope.

[neonmonk]

Well that makes sense! I was starting to get anxious that I wouldn't be able to order some p3 nis pi11z.

Phew!

Re:Nope.

[Gat0r30y]

No emails, but it's not the ORDB system. I just don't have any friends.
Darn slashdot taking all my time!

Re:Nope.

[morgan_greywolf]

Now you do. Don't you feel better now?

Re:Nope.

[blhack]

No emails, but it's not the ORDB system. I just don't have any friends. I have tons and tons of emails.
None of them are from people who are friends :(.

Recieved email, instead of loving signs of friendship, message contained bobcat.
Would not communicate with again.

Re:Nope.

[kat_skan]

Recieved email, instead of loving signs of friendship, message contained bobcat.

Well sorry buddy, but we told you and told you not to blindly open email attachments, and it was obvious it was going to require a more object lesson to get the point across.

Re:Nope.

[flyingfsck]

Well, if you are feeling very lonely, then you could always sign up for some spam.

Re:Nope.

[172pilot]

Hey - Who let YOU in here! ;-)

Re:Nope.

[orkysoft]

What, did you sell his address to the spammers, or add him as friend? It's a rather big ambiguity, you know...

Re:Nope.

[moosesocks]

Well, given that he's publicly provided his email address, we could go ahead and take care of that for him.

Slashdot is a very caring community in that regard.

*(As a sidenote, I want to point out here just how freakishly good GMail's spam filters have become)

Re:Nope.

[EdIII]

I have thousands and thousands of friends. All of them convinced my penis is small and they have the answer.

Re:Nope.

[Hal_Porter]

http://www.spamyourenemies.com/

Such a succinct website name.

Re:Nope.

[tekiegreg]

I'm so curious to see if this works actually I created a throwaway account and let's see the results here in just a few min :-)

Re:Nope.

[m0n5t3r]

Hello! I am tired today. I am nice girl that would like to chat with you. Email me at Linnea@BestGolova.com only, because I am using my friend's email to write this. Hope you will like my pictures.

Re:Nope.

[dascritch]

And you never told them that you are a complete FEMALE ?

Re:Nope.

[fastest fascist]

I was going to ask where such a service might be found, and how much it costs. A quick Google search, however, yielded this helpful page: http://www.toastedspam.com/freespamlist

Re:Nope.

[frehe]

I want to point out here just how freakishly good GMail's spam filters have become

I've been wondering about that, and especially how much of the effectiveness that can be attributed to each of the following two factors:

1. Google's ability to use a single email X to determine if X is spam.

2. Google's ability to use their whole Gmail system (stored data about who sent what to whom when, etc.) to determine if X is spam.

If 2 plays a major part in their effectiveness, it means a server side spam-filter has a lot better chance of working well than a spam-filter placed at the end user's computer.

My bet is that Google's spam-filter secret consists of scrubbing their email with gypsy tears. After all, if they're good enough for curing AIDS, they should be good enough for detecting and blocking spam.

Re:Nope.

[elrous0]

Reminds me of my phone at home. I just answer now with "Sorry, I'm not interested in your product or survey" and hang-up.

Re:Nope.

[Delkster]

If you routinely check out each other's penises with your friends, chances are there's something strange about your relationship.

Re:Nope.

[tekiegreg]

Actually I still have plenty left, one night later and I haven't gotten any spam addressed to the email I used. Pathetic, :-)

Re:Nope.

[tonyreadsnews]

Either that or you created your throwaway account someplace that has excellent filtering...

where'd you create it at?

Did you test the account?

Re:Nope.

[tekiegreg]

1) Disabled all filtering (this was created at Yahoo, and they have an option to disable all filtering that should let everything through, I suppose it's still possible they're filtering though)
2) And yes I tested the account sending something from my main email, codesweeper@codesweep.com, received email.

Re:Nope.

[DA-MAN]

Whose Nobuku?

http://www.youtube.com/watch?v=O_O7GSFWKs0

Re:Nope.

[MarkGriz]

I took the liberty of submitting your main email (codesweeper@codesweep.com) to the aforementioned website.
Hopefully that will get you the email you were expecting :-)

j/k

Re:Nope.

[tekiegreg]

On codesweeper? I doubt I would notice the difference if you did. It gets heavily spammed as is, but with heavy spam armoring the vital stuff still manages to get through. Codesweeper is my "public facing email" with my work ones and private ones (only family and close friends need apply) getting no spam at all so far. That's why I'm not afraid of posting codesweeper@codesweep.com on Slashdot however I use tekieg1-slashdot@yahoo.com on slashdot as a gauge of how much spam traffic comes in from Slashdot mostly out of curiousity, though it gets routine Spam filters as well, but seeing as most of the traffic is Spam on tekieg1-slashdot, maybe I'll try and rig it as a honeypot benefiting codesweeper :-) .

Re:Nope.

[MBGMorden]

(Note: I don't have any problem with gay people at all - getting that out of the way first :). Just commenting on an amusing state of affairs I've noticed.)

That sounds like one of those proclaimed "I'm comfortable enough with my sexuality . . ." things. It always amuses me what this supposed comfort often allows. I'll not be surprised one day when I hear one of them proclaim "I'm not gay at all, but I'm comfortable enough with my sexuality to bend my friend Billy over the couch and jam it home. Not everything between two males is sexual . . .".

(In a real world example, I actually heard one guy proclaim he was comfortable enough with his sexuality to go cross-dressing and hitting on drunk guys in bars, just to see how it was. As I said, I have no issues with gay people - what they do is their own business and no one else's, but that's beyond the "I'm comfortable enough" stage and fully into the "I'm gay and in denial" stage :)).

Re:Nope.

[luke923]

All my friends tell me I need to get a fake Rolex.

No luck

[smackenzie]

I tried to sign up with Slashdot to comment on this post, but it told me that I would need to validate a confirmation email.

I haven't received my confirmation email yet... seriously, how long does this take? Anyone? Is Slashdot broken? Do people post comments on Slashdot?

Re:No luck

[xiaomai]

How did you post that one logged in, eh ?

Remember: real trolls use their primary account.

I'm pretty sure he was making a joke. He couldn't get the confirmation E-Mail because he hadn't removed the ORDB spam-filter from his mail system.

Re:No luck

[dfm3]

Whoosh...

Re:No luck

[dapyx]

How did you post that one logged in, eh ?

He's using his girlfriend's account!

Re:No luck

[gfilion]

A girlfriend? Proof positive that he's not a regular /. reader. Well, he could be this guy.

Man, he's been dumped by his own robot girlfriend!

Whoa! ORDB better have a good disclaimer

[mrcaseyj]

Intentionally causing large numbers of emails to be lost is a risky move indeed.

Re:Whoa! ORDB better have a good disclaimer

[ZenDragon]

They arent being lost, simply being flagged as spam by the database. People will have to go into their respectave administration interface and "release" the mail and/or mark it as safe. Kind of a pain in the ass, but if your depending on a spam database that is over a year old, its not likley doing much for you anyway.

Re:Whoa! ORDB better have a good disclaimer

[neonmonk]

Don't worry, they're completely covered, they did- of course - send an email.

Wait...

Re:Whoa! ORDB better have a good disclaimer

[WarJolt]

It automatically gets moved to your spam box.

Re:Whoa! ORDB better have a good disclaimer

[Sentry21]

I think the worst part of it is that the systems that are rejecting mail (because they're still configured to use ORDB) are the ones that are the least-maintained, and quite possibly completely forgotten about - and therefore are least likely to be noticed quickly or fixed intentionally.

That said, if you're that crappy of a sysadmin, you deserve a wake-up call. It's just too bad that other people have to suffer for you to learn to do your job properly.

Re:Whoa! ORDB better have a good disclaimer

[mrcaseyj]

It's one thing for a spam filter to make a mistake or even be careless and put a message into the spam folder, but quite another for a filter to intentionally cause known good messages to be absent from a users inbox. Why don't they just start reporting all messages as good, or just not give any rating to any message? This might be especially bad in situations where ORDB is only given partial weighting in the spam categorization process so that many messages still get through, thus making it less likely that the errors will be noticed quickly because there will not be a total block on email. To do what they're doing might be considered wreckless. I don't know much about the law in a situation like this but I'd be worried about liability even with a good disclaimer in the user agreement.

Re:Whoa! ORDB better have a good disclaimer

[iangoldby]

When I had a run-in with my old ISP a few years ago, the issue was that a) they did not advertise anywhere that they weren't accepting mail from blacklisted peers, and b) mail from blacklisted peers was simply discarded. There was no 'administration interface' to '"release" the mail and/or mark it as safe.' There was in fact no way for the recipient (i.e. me) to ever know that a mail addressed to them that had not been delivered had even been sent.

That said, the approach of ORDB does seem to be the right way to stop administrators from using it. If you don't force the issue by stopping all mail, then random non-spam emails will continue to be blocked indefinitely. Short-term pain for long-term gain...

Re:Whoa! ORDB better have a good disclaimer

[arkhan_jg]

ORDB was a realtime blacklist. I.E. it identified the IP addresses of open relays. Most people use RBL's like zen and njabl to block connections from 'bad' SMTP servers at HELO, they're much more effective at that stage than later as part of bayesian spam filters - context filtering is expensive and unrelaible with the volume of spam these days. Blocking open relays and dynamic ranges* at HELO is often the only practical way to get a handle on 99% spam loads.

Configured that way, there's no email to release, as the server was not allowed to connect in the fiirst place - in effect, ORDB would have caused an admin unaware that they had shut down to have his server block all inbound email at the connection level. Given the amount of sample configs about that still include them, that's not impossible to imagine.

Effective way of getting people to stop querying their servers, but kinda dickish.

*Yes, I know dynamic ranges sometimes host legit personal mail servers. Unfortunately, for every legit user there are hundreds of spam zombies on those dynamic IPs, often dumping dozens of spam at a time, often hitting over and over again until they get past the greylist timeout. I'm watching my log now, and I just blocked 50 odd connection attempts from one 1 pretending to be 50 different email domains. In the time it's taken me to write this footnote, the dynamic range IPs blacklists have blocked a few hundred emails.

Re:Whoa! ORDB better have a good disclaimer

[timmarhy]

the only person to blame is the careless mail admin who leaves ORDB in. ORDB is a free service, they have every right to take it down, hell i'm pretty amazed they left it up for a year and gave all the warnings they did.

Re:Whoa! ORDB better have a good disclaimer

[interiot]

Why don't they just start reporting all messages as good, or just not give any rating to any message?

That's precisely what they did for the last 15 months (a pretty reasonable amount of time):

DNS and the mailing lists will vanish today, December 18, 2006.

I don't know... do they still own a machine that responds to DNS requests, and are therefore paying for bandwidth? Probably not.

Do they want to sell the domain to someone, who wouldn't want to get hit with a bandwidth bill as soon as they throw some servers up? More likely.

Re:Whoa! ORDB better have a good disclaimer

[rekoil]

Depending on the way the DB is being used - some mail servers are configured to 554-reject DNSBL matches. If so, they're going to be rejecting *everything* that comes in until the check is removed from the server.

If the server is just using it for a scoring system a la spamassassin, you're probably right.

Re:Whoa! ORDB better have a good disclaimer

[Naurgrim]

Concur, wholeheartedly.

I put a good deal of effort into getting spamassassin configured to classify spam into imap folders for my users, and giving them tools for whitelisting, etc. on an individual basis. One man's spam is another man's ham, after all.

I could not in good faith arbitrarily delete mail based on automatic filtering. I would rather run completely unfiltered than make that decision for somebody, and for a long time I resisted the idea of filtering server-side. Bottom line was that my customers demanded it, so I had to come up with a system that met their requirements and mine.

Re:Whoa! ORDB better have a good disclaimer

[SeaFox]

Intentionally causing large numbers of emails to be lost is a risky move indeed.

Yeah, someone might sue them for missing important emails from the poor service ORDB is offering.
Oh, wait...

Re:Whoa! ORDB better have a good disclaimer

[Anonymous Coward]

That's precisely what they did [readlist.com] for the last 15 months (a pretty reasonable amount of time):

Serves 'em right! Like anyone but the most brain dead administrator on EARTH is going to expect an anti-spam product to continue working a year or more after they've purchased it. I mean the whole reason they ORDB went out of business is because these asshats were expecting something for nothing. So if they loose a little important email, then that's just tough love isn't it? They should have been keeping ORDB management in Porches and million dollar homes at the least. Hell, they could make more than that being spammers themselves, so the cheap bastards better pay up.

Re:Whoa! ORDB better have a good disclaimer

[MrNaz]

As much as we can rail against stupid mail admins, I think it would not be remiss of us to remember that the ultimate sufferers are end users who probably have no idea what their mail server administrator is doing. In other words, this hurts the people who *rely* on mail administrators, not the mail administrators. For that reason, I think ORDB is doing the wrong thing. This is yet another reason why privately owned spam registrars like ORDB are a bad idea; they just do not understand the either the gravity of what they are doing, nor do they have the responsibility to take it seriously. If you are doing something on such a large scale, it is inevitable that there will always be stragglers. Don't get all indignant about how "dumb mail admins" should know better unless you know that all your utility providers abide by the latest best industry practices in their respective fields.

On a side note, given that this move by ORDB specifically targets people other than those who they want to change the behaviour of in an attempt to get those innocent bystanders to affect change upon the real people they want to affect, this actually meets the FBI's definition of terrorism.

Re:Whoa! ORDB better have a good disclaimer

[squiggleslash]

And the end users will learn what admins do, complain, and admins who subscribe to third party "anti-spam" solutions that use innuendo based logic to remove spam will get a well deserved roasting from their users.

No, I'm not happy the innocent users are suffering either, but I'd argue that they already were, just less aware of what was going on (probably suffering occasional emails removed due to false positives without realizing it was due to deliberate administrator decisions, blaming instead "unreliable email" (clue: it really isn't unreliable any more, except for the effects of some of the more incompetent anti-spam solutions)

Let's be clear here: the fact is these admins not only subscribed to an innuendo-based filtering system, but also didn't bother doing their job, monitoring the services they subscribe to and ensuring their system used it correctly. It's safe to say the users were suffering anyway, both because of the decisions the admins had made directly, and because of the general skill level of the admin whose services the users are relying upon. Hopefully for many of those users, this is a lesson in why not to trust the people they're currently relying upon.

Re:Whoa! ORDB better have a good disclaimer

[brassman]

What you're missing is that if ORDB flags all mail as "good," then clueless soi-disant 'admins' will continue to hammer the site with their useless queries, up to thousands of them per second. Blocking world+dog is a desperation move -- which has been used a few times in the past by other RBL administrators -- just to make people stop doing that.

When someone just plain will not check back to see if your free service is still working (and free), how else do you get their attention?

Re:Whoa! ORDB better have a good disclaimer

[Schraegstrichpunkt]

When you discontinue services people rely on, things break. If you're providing that service for free, it's people's own fault.

If they had just let the domain expire, it would have caused spam to just silently get through until somebody malevolent registered the domain and started configuring it to block select targets . . . for a modest fee.

At least this way, people will _notice_ that the service is discontinued. Failing loudly is almost always better than failing silently.

Re:Whoa! ORDB better have a good disclaimer

[MrNaz]

I appreciate the ideas in your response, but I cannot even concede as far as your position. Let me ask you this: Would you be happy with somebody cutting the electricity to your house for a week to get you to complain to your power company about the fact that your neighbourhood has not yet been updated to use the latest most efficient transformers?

Re:Whoa! ORDB better have a good disclaimer

[timmarhy]

your logic is all messed up. on the one hand you say don't blame the admins, and on the other your saying they shouldn't be using a privately owned spam register like ORDB.

which is it?

it's about personal responsibility, ORDB was free, no one supported it in it's time of need so now it's shutting up shop.

Re:Whoa! ORDB better have a good disclaimer

[timmarhy]

thats a very poor analogy, because no one is paying for ORDB.

if you wanted to be more accurate, it's more like you've been using your neighbours power for free and they have cut you off in order to make you get your own connection with the power company.

Re:Whoa! ORDB better have a good disclaimer

[timmarhy]

and why are they doing it? to stop getting hammered with requests from dumbass admins who still try a lookup on it for every single freaking email, you moron.

the complete opposite of what i said would be if they had no right to take it down. comprehension eludes you doesn't it?

Re:Whoa! ORDB better have a good disclaimer

[Anonymous Coward]

I rarely have the desire to use the TLA OMG, but wow. One of my hats is 'mail admin', admittedly for a small but active domain. If the mail goes out for a couple of hours, I get a phone call, or I get paged, and I am expected to be fixing it in less than an hour.

First, I'm not aware of any publicly owned spam registrars. Care to enlighten me?

Second, how is a publicly owned (e.g. stock exchange, or do you mean run by the government of a country chosen at random (or heaven forefend the UN)) service less likely to go belly up? There have been any number of companies delisted from the stock exchange... As far as government services, that's a little touchy, at least in the good old U.S. of A. Kind of a 1st amendment issue.

Third, how do you suggest a company providing a service like this behave as it is going out of business? Keep in mind that a four letter domain name is quite valuable. Would you expect the original company to continue to forever pay the extra bandwidth costs due to 'dumb mail admins' for a DNS service that they don't use, or use for another purpose? How about the purchaser of the domain if/when it sold? Do they have a responsibility to continue to provide the false negatives? Why?

Fourth, arguably false negatives are as bad as false positives. If a mail admin has layered another spam detection method on top of ORDB because ORDB wasn't working well enough (because it was off) and ignored the malfunctioning service, are they still not irresponsible? If they didn't, and their customers were being bombarded by spam for over a year, are they still responsible administrators, with users who are being terribly hurt?

Fifth, terrorism? Really? Who is being frightened? Who is being terrorized? This word is horrifyingly overused, and I do not think it means what you clearly think it means. If I purchase the land on either side of your house, and set up a circus on one side, and a parking lot on the other side, is it terrorism if you put up a fence to keep my customers from strolling through your yard? Really?

Re:Whoa! ORDB better have a good disclaimer

[StarkRG]

You're right, just flagging them as spam is not harmful. Nor is it especially useful either. The use comes when you use filters to redirect messages marked as spam to another place, for example: oblivion.

If your mail filters are set to delete all messages marked in this way (expecting them all to be spam), then you'll just lose all those emails.

Perhaps a better way to do it would be to return nothing to any request made, but make note of the domain it was made from and send a message to the recipient of the message (if the request includes this), root@domain, mailmaster@domain, webmaster@domain, and any other common aliases saying that the service has been discontinued.

Re:Whoa! ORDB better have a good disclaimer

[statemachine]

They should have been keeping ORDB management in Porches and million dollar homes at the least.

You tell 'em! Those porches should have a swing, mahogany tables, and a Jacuzzi too.

Sorry, I couldn't resist...

Re:Whoa! ORDB better have a good disclaimer

[dbIII]

Dynamic ranges also get reallocated as static addresses to poor sods that find they can't send email to half the net becuase the maintainers of the block lists are too lazy to attempt to keep up and there are a lot of lists out there. In theory block lists should work but in practice once something goes on the list it stays there. After contacting quite a few blocklists for a new domain and finding more at every turn I found the only reliable solution to this damage is to reroute everything through another address that has always been within a static range. It was paticularly annoying contacting the same people a couple of times after somebody decided to fix the "mistake" of a supposedly dynamic address being removed from the block list.

Re:Whoa! ORDB better have a good disclaimer

[MrNaz]

No, it's nothing like illegally tapping into someone else's resources, and you're an idiot for a) thinking myanalogy is off and b) coming up with one of your own that is infinitely farther off.

When a private entity opens up its doors to use by the general public, it becomes, effectively, a utility, and takes on many more responsibilities. This is an established legal principle, and right it is too. If you want to take on a public role, then you sure as hell better be ready to take on the responsibilities that go with it. Otherwise, stay home.

Re:Whoa! ORDB better have a good disclaimer

[MrNaz]

First, I'm not aware of any publicly owned spam registrars. Care to enlighten me?

I was not saying that private ones should be used instead, rather that these registrars are a bad idea.

Second, how is a publicly owned (e.g. stock exchange, or do you mean run by the government of a country chosen at random (or heaven forefend the UN)) service less likely to go belly up? There have been any number of companies delisted from the stock exchange... As far as government services, that's a little touchy, at least in the good old U.S. of A. Kind of a 1st amendment issue.

Again, not my point. My point is that DNSBLs are a bad idea, period.

Third, how do you suggest a company providing a service like this behave as it is going out of business? Keep in mind that a four letter domain name is quite valuable. Would you expect the original company to continue to forever pay the extra bandwidth costs due to 'dumb mail admins' for a DNS service that they don't use, or use for another purpose? How about the purchaser of the domain if/when it sold? Do they have a responsibility to continue to provide the false negatives? Why?

I think you've totally missed my point. Again, I'm saying that this whole incident is a good example of why centralised spam registries are a bad idea. The potential for collateral danage is too great if, for whatever reason, a service fails.

Had I been in ORDB's boots, I'd say the responsibilty would be to whois the IP from requesting clients and automate a script to email the admin contact telling them of the issue. After some time (say about now, instead of replying with 100% false positives), I'd remove the DNS entry on the domain and take the machines off the IPs, so that any client software using it registers a definite error that cannot be ignored under any but the most egregiously bad software.

Fourth, arguably false negatives are as bad as false positives. If a mail admin has layered another spam detection method on top of ORDB because ORDB wasn't working well enough (because it was off) and ignored the malfunctioning service, are they still not irresponsible? If they didn't, and their customers were being bombarded by spam for over a year, are they still responsible administrators, with users who are being terribly hurt?

Yes, the mail admins are irresponsible. Why hurt the users? If you open up a public service, IMHO you have a responsibility to follow up on it, not just drop it when you get bored or nobody pays you whatever you want. If you can't handle this scenario, then don't do it in the first place. Once again, this is why I think DNSBLs are a bad idea, period. It's a risk that a) emails will be blocked from legit sources because the DNSBL operators get a power-high and start blocking entire domains and netblocks for even the smallest infractions (which has a long history of happening) and b) this group of well-meaning basement nerds will go belly up when they realize that taking on a public responsibility is a thankless task that requires actual work.

Re terrorism, it was an obvious snide remark, you're reading too much into it. I'm not implying DNSBL one day, blowing up hotels the next.

Re:Whoa! ORDB better have a good disclaimer

[CoolVibe]

WRT Dun ranges, if you have a legit server in that range, you can always try smarthosting your ISP smtp-server.

Re:Whoa! ORDB better have a good disclaimer

[Antique Geekmeister]

For such a bad idea, they're pretty effective at containing a lot of spam attacks and worms. The difference, in my experience, 2 years ago, was a 50% drop in spam getting through and a huge drop in SMTP server load when I was permitted to install DNS blacklist features. It meant I didn't have to buy and maintain another front-end mail server, just to do raw spam filtering.

Re:Whoa! ORDB better have a good disclaimer

[gbjbaanb]

well, if this is the case why have they still got the domain name in use? Take it away (or better, let all connections through and then ignore them - 'dumbass' mail admins will soon figure out why their email servers are processing all that mail so slowly all of a sudden.

They could just remove the url and let the connections go nowhere - those admins would then see logs filled with 'failed to connect' errors.

Hurting people like this is not in the best interests of the net or community projects as a whole. It shows another reason why my boss can claim Linux (and all OSS stuff) is poor, this would never happen with a company he paid for service.

Re:Whoa! ORDB better have a good disclaimer

[monsted]

Nope, if they just let the domain expire, it would have caused the .org authoritative servers to die. It's been done already, shortly after they first shut down the service, causing them to open it a again, responding that everything is ham.

If the ordb.org zone goes away, every halfwit mail admin who uses ordb.org will be hammering the .org servers instead. This is why it was first reenabled and now shut down the way it is.

Re:Whoa! ORDB better have a good disclaimer

[squiggleslash]

Nope, but the two situations aren't comparable. If your electricity was provided by a company that chose to prevent power surges by having a (well insulated) three year old frequently swing at the overhead wires with a pole, the other end of which was earthed, essentially earthing the power every few seconds, and if power was supplied in your area by a variety of organizations, rather than only one company, and if you actually live in an mud-hut village in the middle of the third world that's only been using power for a few years and which nobody is completely reliant or trusting of it, then yeah, I'd be in favor of that (now grown up) ex-three year old using his key to go into the "earthing room" and leaving the pole up there, denying power to the people who were subscribing to this incompetent organization.

Of course, that's a completely unrealistic scenario, which is why your analogy doesn't really work. In this case:

1. e-mail is too unreliable for anyone to consider it critical
2. The use of an innuendo-based filtering system has already contributed to the above. It is simply implausible that anyone who lost email as a result of ORDB's actions has come to rely upon it.
3. There are a choice of email administrators to the end users. They will be able to chose someone else.

I am sympathetic to the end users, but I think the end users were suffering before this, and for the most part, all this has done is show the users what the real cause of their long time woes are.

Re:Whoa! ORDB better have a good disclaimer

[theonlyaether]

Uhh I hate to break it to your boss, but anyone running an outdated spam filter on a linux box, windows box, free/net/whateverBSD box is gonna be effected. Looking at XWall for exchange for example, you will see that a lot of their retailers claim ORDB support to this day. All I could find to the contrary is this post where they complain that it went down. No mention of disabling it in an update or anything, although it's hard to separate the marketing babble with their actual support. Why on earth would someone assume that this only effects spam filters that run on linux that are out of date?

Re:Whoa! ORDB better have a good disclaimer

[ta bu shi da yu]

How the hell is that insightful?

STOP USING ORDBS! Simple. It's been done for over 2 years!

If you are that stupid you are using a list that has been inactive for so long, then you deserve what you get.

Re:Whoa! ORDB better have a good disclaimer

[ta bu shi da yu]

ORDB returning false positives for all email? Why, this is terrorism!

ORDB is associated with Linux.

Linux is free software.

Free software is championed by RMS.

Won't someone call Homeland Security to arrest him?

Re:Whoa! ORDB better have a good disclaimer

[ta bu shi da yu]

Dude, ORDB didn't fail. It was taken down. Stupid mail admins kept using it. This generated a fair amount of traffic to a pretty useful domain name. The fault is solely with the mail admins, not the ORDB.

You cannot say that people were NOT warned. Lazy mail admins, who couldn't be bothered changing their boxes are the problem here. Looks like they got burned due to their laziness and lack of proactiveness. They weren't good mail admins in the first place, if they got this wrong, what else are they doing wrong? At the end of the day, they deserve everything they get.

Re:Whoa! ORDB better have a good disclaimer

[SuiteSisterMary]

I'd remove the DNS entry on the domain and take the machines off the IPs, so that any client software using it registers a definite error that cannot be ignored under any but the most egregiously bad software.

This is what they did originally. The .org root level DNS servers were almost blown up responding to the constant hammering of requests from mailservers which are specifically set not to cache lookups, as that would be conterproductive when talking to a DNSBL. That's why they put it back up, returning 'alles gut' messages for all requests for the last year or two.

Re:Whoa! ORDB better have a good disclaimer

[harrumph]

It's one thing for a spam filter to make a mistake or even be careless and put a message into the spam folder, but quite another for a filter to intentionally cause known good messages to be absent from a user[']s inbox.

This is a misunderstanding of blacklists. Blacklists are not filters; some filtering methods use blacklists, and ORDB was (is) a blacklist. The operators of blacklists, by definition, cannot cause anything to happen with anyone's e-mail. Every blacklist has a criterion or criteria for listing, and any user of that list can check to find if a given IP address or domain name is listed. Listing criteria could be "domain recently bounced e-mail to postmaster@", "IP address was reported as sending junk mail by fifty different users", or "IP address is on Bob's personal shit-list". Users of blacklists can do whatever they like with the data. When ORDB was active, mail servers for domains I controlled checked all incoming connections against ORDB and simply refused to converse any further with listed systems. ORDB didn't make the mail bounce. I did. By my choice, just like the choices of everyone else who has ever used ORDB or any other blacklist, I specifically configured my systems to refuse messages from systems (or domains) listed. I decided that the listing of an IP address by ORDB was reason enough to refuse connections from it.

Why don't they just start reporting all messages as good, or just not give any rating to any message?

That is exactly what they've been doing for over fifteen months. They stopped listing anything. In fact, they stopped responding at all. Almost every system that was left configured to use ORDB after it was shut down in December 2006 has logged an error message every time it tried to check an incoming connection or message against ORDB, because ORDB didn't respond. Some systems with particularly out-of-touch administration have persisted in trying to query ORDB--or, according to this story, so many that it's been an annoyance to the admins of the systems receiving the queries. If this goes on for months and months and months, I think it's quite reasonable for the blacklist admins, who stopped their service fifteen months ago, to start a new list with a single new criterion: Everything is listed. Call it a test list. It's their list, and they can do whatever they want with it. The only systems that are affected are those that are specifically configured to use this list.

So, if you, the administrator, specifically tell your mail system to refuse to accept mail sent from a system listed in ORDB (which ceased to exist long ago), your system will now bounce everything until you stop telling it to do that. According to the story, this is what's happening, but only in the systems configured to do exactly that.

Re:Whoa! ORDB better have a good disclaimer

[Achromatic1978]

When a private entity opens up its doors to use by the general public, it becomes, effectively, a utility, and takes on many more responsibilities. This is an established legal principle, and right it is too. If you want to take on a public role, then you sure as hell better be ready to take on the responsibilities that go with it. Otherwise, stay home.

Yeah, you're in it ... FOR LIFE! They closed shop in December 2006 and continued to respond accurately to queries for over a year after "going out of business" which, contrary to your blather, is their right.

According to you, apparently, they're somehow obligated as a "utility" to keep on going. Huh? Even when they tell their servers to stop responding at all, they still get bombarded with thousands of requests per minute, not because of their "irresponsibility", but because of other people's irresponsibility and/or negligence.

Bleh. What a joke. I'd love to see the look on the judge's face if you started spouting shit like "ORDB has a responsibility to the public under established legal principles".

Ye gods.

Re:Whoa! ORDB better have a good disclaimer

[ZenDragon]

Because where they to simply allow everything through its not likley that admins would attribute it specifically to ORDB, they would simply assume it was new wave of spam that hasnt been detected and it wouldnt force them to modify their policies and remove the references to ORDB. Administrators dont exactly monitor the mail that makes it through, only the mail that doesnt. Having everything flagged as spam or simply "unknown" and quarantineing it forces the admins to actually look at and modify their configuration.

Re:Whoa! ORDB better have a good disclaimer

[The End Of Days]

Wholly irresponsible and contrary to the long standing attitude that we help each other in the greater Internet community. Hi, it's not the 90s anymore. Your long standing attitude stopped being the norm a long time ago.

Re:Whoa! ORDB better have a good disclaimer

[IronChef]

They arent being lost, simply being flagged as spam by the database. People will have to go into their respectave administration interface and "release" the mail and/or mark it as safe.

Not every email server works like that! Database? Most MTAs do not require one. Smaller sites may not be using one. Many systems DISCARD email that comes from a place flagged as an open relay, and users never see it.

If other systems are like mine, the volume of spam that is dropped for blatant asshattery before the user sees it vastly outnumbers the spam that makes it as far as a contextual check.

The owners of ORDB are free to do what they wish, but switching on false positives was absolutely a jerky thing to do. If they wanted to get the message across, a couple hours of that would have done the job just as well with less collateral damage.

"Sounds like he got burned," you say. I did lose about 2 messages to this, not a big deal. My mail server runs like a top and I haven't had to mess with it since 2006.

I do not blame them, it's clearly a case of caveat emptor, but still... Jerky.

(Did they have a mailing list? As a user I would have signed up, but I do not remember seeing one when I was reading their site eons ago.)

Re:Whoa! ORDB better have a good disclaimer

[Sleepy]

>On a side note, given that this move by ORDB specifically targets people other than those who they want to change the behaviour of in an attempt to get those innocent bystanders to affect change upon the real people they want to affect, this actually meets the FBI's definition of terrorism.

You obviously do not know how RBLs work, and you dilute the meaning of the word 'terrorism' by invoking it here.

While I can not agree with ORDB's decision, I don't know what their burden is either. I can say it is their network and they are entitled to reclaim their IP addresses from negligent freeloading bandwidth thieves... this is some SERIOUS bandwidth.

1) When ORDB.ORG was up, their non-enforcable terms of service required mail admins to sign up for ORDB system-stats emails. ...Many foolish people obviously DID NOT.
2) ORDB shut down in *2006*, and in addition to the shutdown email they hosted a website indicating their status. ... Again, admins too cheap to pay for RBLs take the free ones for granted, and continue to abuse their IPs long after the party is over.
3) It's up to the email admin what happens. I use different RBLs and URIBLs and not necessarily to "block". You can scrutinize emails or tag it as spam. ORDB doesn't "block" anything.

Re:Whoa! ORDB better have a good disclaimer

[Sleepy]

>Intentionally causing large numbers of emails to be lost is a risky move indeed.

Agreed, so it's a good thing the blame lies with local admins mis-using ORDB.

Re:Whoa! ORDB better have a good disclaimer

[Sleepy]

>Let me ask you this: Would you be happy with somebody cutting the electricity to your house for a week to get you to complain to your power company about the fact that your neighbourhood has not yet been updated to use the latest most efficient transformers?

That's a loaded question. You're implying "somebody" can be someone OTHER than the provider of the service in question.

The service provider IS entitled to cut service. Especially since the recipient paid nothing. Especially since the recipient obviously VIOLATED the TERMS of service by not subscribing to once-a-month system status emails.

You'll hear a lot of people blaming ORDB simply because they were negligent, and don't want to get FIRED for it.

Re:Whoa! ORDB better have a good disclaimer

[raduf]

Email is arguably the most reliable thing the internet has to offer. What I never understood is why companies keep using their own "last mile" solution for email, along with outlook or outlook clones. I've used yahoo mail for 10 years and gmail since is started, and I never had a lost email.
Using my own web server on the other hand, (for technical reasons only, like backups or alerts) often led to problems, mostly due to full hard disks or something like that. Now there is free gmail for companies, but even before you could do the same with yahoo & comp for a small fee. Having your own mail server is a lot like wiring the house yourself: you may have some obscure advantage, but you're 10 times more likely to be electrocuted when the neighbor floods you.

Re:Whoa! ORDB better have a good disclaimer

[MrNaz]

Perhaps you need it written in red or something: THE MAIL ADMINS DIDN'T SUFFER. THEIR USERS DID.

Bloody hell, why are there so many idiots who just can't understand this? Perhaps that's why Americans are so nonchalant about blowing up a whole country just to get one tinpot dictator out of power. Yes, lets fuck over 1,000 email users just because the administrator of their ISP's mail server is slack. There are better ways to notify them, this was just the easiest and stupidest. Doing the easiest and stupidest thing seems to be in fashion these days.

Re:Whoa! ORDB better have a good disclaimer

[ta bu shi da yu]

Actually, the mail admins suffered when they got their arses kicked because no mail was getting through. That's the whole point, or didn't you get that?

Again, allow me to point out that if the mail admin is slack, then there is a good chance that those 1,000 mail users are going to be dealing with a patchy service anyway.

Incidentally, I'm not an American. HTH.

Re:Whoa! ORDB better have a good disclaimer

[stevey]

Indeed. The standard "reject" or "accept" solutions are very brittle - because the any false positives are disasters as far as your users are concerned.

my solution involves rejecting mail which is determined to be SPAM at SMTP-time but also keeping a copy if it in a quarantine where it may be searched/viewed/re-delivered.

It is still brittle - but the sender knows that their message was not delivered, due to the bounce, and the recipient does have a copy in their quarantine area, if they look for it.

Re:Whoa! ORDB better have a good disclaimer

[abertoll]

But they're NOT taking it down: they're sending back false positives. In the mail world false positives are WAY worse than false negatives. Basically they're screwing those who trusted them as a "free service." They could just take down the service, block certain people from using it, or like mentioned above, just send everything as a (false) negative. All of which are more responsible and appropriate responses to their situation.

ORDB is just being plain irresponsible. They're obviously not admins themselves ;)

Why DNS-RBLs suck

[Anonymous Coward]

Oldie but goldie: http://acme.com/mail_filtering/shame.html#dnsrbls

Re:Why DNS-RBLs suck

[whoever57]

Oldie but goldie: http://acme.com/mail_filtering/shame.html#dnsrbls

I'll take the DNS-RBLs out of my email configuration when there is a realistic alternative. Clicking the "Conclusions" link on the referenced page, the author provides no solutions, other than throwing pies at Bill Gates. Not very credible.

Re:Why DNS-RBLs suck

[ender81b]

Buy or use a decent filter? Use RBLs as a scoring mechanism?

RBLs are horribly broke & you should never use them as a sole method of determining if an email is spam.

Re:Why DNS-RBLs suck

[Mr. Roadkill]

RBLs are horribly broke & you should never use them as a sole method of determining if an email is spam.

Then, why do I have an extremely low reported false-positive rate from them? Maybe it's got something to do with which ones I choose to use, how I choose to use them, the mix of mail people at my organisation expect to receive, and the mitigating whitelistings I've stuck in place over the years. There is no "zero false-positive anti-spam magic bullet", but for my specific values of "workable" (i.e. my users get a few pieces of spam rather than a deluge, and I don't get many questions about accidentally blocked mail from real people outside the organisation), I've found carefully selected and applied RBLs to be invaluable as a first-line of defence - when you've got between half a million and a million delivery attempts per day, 95% of which you don't end up accepting, you don't want to run that many resource-intensive tests if you don't have to.

Seriously, are you trying to tell me that I should just ignore data in something like the CBL or SpamHaus's PBL? In the case of the former, there's something horribly broke about something using the sending IP - and in the case of the latter, the sending IP is being used in a way the sender's connectivity provider has said it shouldn't be used. I have no problem with either of those, and see no reason to specifically white-list around either of those. Additionally, things like SpamCop can be very useful if properly applied - using any new RBL for scoring-only at first and going over your logfiles with a fine-tooth comb for obvious things you might want to whitelist (like the mail relays of local large ISPs, yes I'm looking at you Bigpond and Optus)can be a good way to ensure there are minimal problems when you do start blocking with them. Plus, a local list of whitelistings can minimise the effort and research required when evaluating and adding other RBLs in future. Granted, mine has been built up over a number of years and I'd hate to have to start from scratch, but it should be possible for any organisation to know what they'll need to whitelist for before they start blocking using RBLs if they use the list for scoring for a while and then go over their logs looking for hits.

Perhaps the biggest problem with RBLs isn't so much the lists themselves (although there are some poor ones out there), but how they're applied and the response of an organisation that uses them when you contact them to report a piece of mail that you think should have got through. Personally, I find them invaluable and I think the last RBL-related "false-postive" that was reported here was a few months back. Give them to a lazy, useless, know-it-all admin who hasn't looked at their potential darker side and isn't willing to do the hard work to make sure they don't cause significant problems, and you've got a recipe for disaster....but the same could be said about a whole lot of SA rules that look like a good idea too that you can't apply too high a score to in practice(No MsgID? Yeah, there are a lot of Domino servers out there in businesses that would affect mail from. Percentage of HTML? Good luck with Chinese webmail.)

Sheesh guys, spam filtering is hard. That's why there are so many commercial products out there, following so many different methodologies, and why so many places seem to have difficulty doing a fair to decent job of it.

Re:Why DNS-RBLs suck

[MadMidnightBomber]

Bah! Everyone trots out the "DNSBLs suck" line. We used SBL+XBL on our MXs and threw away around 70% of mail before a human ever saw it. Then we did more filtering inside. Do you know what? Our users still said they were getting too much spam. (entirely correctly).

So go on, walk into a reasonable sized mail site, with a domain that's been around for a while and more than 10K users and turn off the DNSBLs. I dare ya.

Re:Why DNS-RBLs suck

[Trogre]

I don't know - it helps me feel better.

Nice

[topham]

Dealing with Email and Spam issues can be enough of a pain in the ass without the added hassle of this shit.

It isn't that the recipient complains they aren't getting email, it's when the sender (my customer) complains to me that their mail isn't making it to the recipient and blames me when it's the spam filters at the other end causing the problem. And now this?
Nice.

Re:Nice

[TubeSteak]

It's like hotlinking an image off someone's website after you've been told not to. Yes, the site owner is a dick for replacing the pic with goatse, but it's still your fault for linking to it in the first place.

This will cause some confusion at first, but if it hit /. word will get out soon enough.
I just hope no one's spam filter defaults to automatic-deletion.

Re:Nice

[Just Some Guy]

It isn't that the recipient complains they aren't getting email, it's when the sender (my customer) complains to me that their mail isn't making it to the recipient and blames me when it's the spam filters at the other end causing the problem. And now this?

If you've been pestering their DNS servers for the last 15 months because you've been too lazy to remove those entries and can't be bothered to even remotely follow technical newssites, then your customers are placing the blame right where it belongs. Honestly, you're trusting the integrity of your email system to a third party and can't even be bothered to check up on them now and again? Like once a year or so? No, this is entirely your problem to own.

Re:Nice

[erayd]

It isn't that the recipient complains they aren't getting email, it's when the sender (my customer) complains to me that their mail isn't making it to the recipient and blames me when it's the spam filters at the other end causing the problem. And now this? If you've been pestering their DNS servers for the last 15 months because you've been too lazy to remove those entries and can't be bothered to even remotely follow technical newssites, then your customers are placing the blame right where it belongs. Honestly, you're trusting the integrity of your email system to a third party and can't even be bothered to check up on them now and again? Like once a year or so? No, this is entirely your problem to own. I think you missed the point. He's saying that while *he* doesn't use the service, the destination provider who is using it (and rejecting mail on this basis) is not the one who gets the bad feedback. Because when one of his customers sends an email, and that email bounces, who do you think the customer will complain to? Him. And he has absolutely no control over the lazy-ass admin who set up the spam filter on the recipient system, so is suffering for something that he didn't do and is completely outside his control.

Re:Nice

[timmarhy]

probably so that they could keep the domain and not have it hammered by a million retards who refuse to fix their mailservers.

remmeber they can't let the dns expire... some spammer would register it and instantly gain a backdoor to millions of mailservers that might otherwise block them.

Re:Nice

[topham]

Aparently, other than yourself, nobody can read.

I've resolved to call this 'Spam Day'. Officially, March 26th, from 2008 onwards shall be Spam day.

And sure enough, there were a rash of inquiries today as to why people couldn't send email.
It sent just fine; but was bounced by the recipients for exactly this reason.

(Fortinet firewall/email filtering seems to have this one in it's list still, not everybody uses it, but those that do are likely to not even know it themselves.)

Re:Nice

[fm6]

You'd have a point if (a) you had to have an active server to own a .com subdomain (you don't) and (b) the blacklist was distributed from ordb.com (it wasn't). The blacklist was distributed by relays.ordb.com. Shut down that server, remove its DNS entry: problem solved. Nobody can recreate relays.ordb.com without the permission of the owner of ordb.com.

We had one NDR today because of this

[IronTeardrop]

I just changed my company's ISP a week ago. Guess who's shiny new external IP address was apparently reported as an Open Relay prior to December, 2006?

Oh joy...

Re:We had one NDR today because of this

[MightyMartian]

An ample demonstration of why blacklists/whitelists are worthless.

Re:We had one NDR today because of this

[RollingThunder]

You're right, the 90% of inbound mail that gets dropped at the pure IP level before it even hits my more CPU intensive filters is "worthless".

Re:We had one NDR today because of this

[pe1rxq]

You can have 100% of inbound mail dropped simply by unplugging the network cable....
However, such a filter wouldn't score good if it were judged on the really important metrics like number of false positives.

Re:We had one NDR today because of this

[RollingThunder]

False positives.... hmm. Let me think.

Nope, not one in 10 years has been reported to me via the alternate (non-RBL'ed) communication channel.

That's pretty damn good.

Re:We had one NDR today because of this

[MightyMartian]

Well, I've personally seen a good many false positives from black lists, but the biggest problem is the maintainers. Greylisting has its own problems, but it's far superior to black lists.

Why not just close the server?

[Em Adespoton]

Why don't they just close the server so it no longer accepts connections? Are they doing this to stop the server currently at that location from being hammered with requests?

Re:Why not just close the server?

[travisd]

Because the requests will still come. And even without a response, the request will consume bandwidth that someone is paying for, and consuming an IP address that someone would like to re-use.

Re:Why not just close the server?

[harryjohnston]

Or, better still, remove the address from DNS?

Re:Why not just close the server?

[ashridah]

While that's accurate to a point, Seems to me that doing this at the DNS level (deleting a DNS record, or pointing it to 127.0.0.1 and giving it a TTL of a few decades) would do the trick better than BLOCKING EMAIL.

My bet is this is going to really REALLY negatively affect all of those mailservers that have been setup, for which there is *no* administrator. You know. the ones setup for smaller companies who have no inhouse admin, who hired a consultant, but wouldn't pay for ongoing maintenance (either due to tightness or actual lack of funds, etc). The response time here, and time to resolution is likely to be high to non-existent.

All in all, this is a pathetic (understandable, mind you) move, and reeks of inconsideration.

Re:Why not just close the server?

[IronChef]

It's their machine and they can do what they want... but sending false positives is a dick maneuver.

Re:Why not just close the server?

[krewemaynard]

My bet is this is going to really REALLY negatively affect all of those mailservers that have been setup, for which there is *no* administrator. You know. the ones setup for smaller companies who have no inhouse admin, who hired a consultant, but wouldn't pay for ongoing maintenance (either due to tightness or actual lack of funds, etc). The response time here, and time to resolution is likely to be high to non-existent. EXACTLY. I had a couple of messages dropped today. Fortunately, a customer called to verify that we had received a message and I caught the problem almost immediately. If I had taken the day off, or if, as you said, I had put a similar setup in for someone else, no telling how many messages could have been dropped.

Re:Why not just close the server?

[adri]

Mail servers with ORDB configured will delay accepting mail until it gets a reply from ORDB. If it can't reach ORDB (ie, it doesn't give a response) then it may delay -all- incoming mail. ORDB would have to return "OK" to all requests to keep peoples' mail happy.

Dropping an "OK" rule means mail flows fine for ORDB-poking mail servers, but requires the ORDB guys to keep doing it; there's no motivation for the site administrators to remove it.

Dropping a "SPAM" rule means admins have to figure out whats busted,a nd remove ORDB from their mail configuration.

Re:Why not just close the server?

[Mr. Roadkill]

Or, better still, remove the address from DNS?

Again, they'll still get DNS queries that will consume bandwidth that someone will have to pay for.

An awful lot of mail systems have been set up as set-and-forget by work-for-hire conslutants, who never end up touching them again. The only way to get those kind of systems re-configured is for the organisations that use them to suffer some pain. It's arguable that that pain is deserved, since they're obviously not running their mail systems responsibly. Anyone who used ORDB and responsibly managed their mail system knew long ago that ORDB was going to do this and stopped using it ages ago. Besides, there may well come a day on which that domain lapses and falls prey to squatters - or worse. Don't you think that J. Random-Hacker would love to get information on poorly-configured or poorly-maintained systems? ORDB have to stop people querying them before they can even think about relinquishing the domain, if only to protect the ignorant from themselves. In the case of ORDB, it's probably not much of an issue - but imagine what would happen if Ironport decided to pull the plug on Spamcop and then forgot to renew the domain before January 30 next year and there were still a few thousand ill-informed people generating queries against the SpamCop RBL. Not pretty...

Re:Why not just close the server?

[ashridah]

Uh, so it's not configured to make the distinction between "OK" / "Not okay", and "i can't talk to it right now because it's returning a bogus result"?

127.0.0.1 is probably going to turn out a quick response consisting of "who are you, and why are you touching me in my private place"

Re:Why not just close the server?

[nelsonrn]

Right. That's why they should have set their nameserver for relays.ordb.org to 127.0.0.1. Turns it into the email admin's problem, not theirs.

Re:Why not just close the server?

[harryjohnston]

I'd have thought if the domain was deregistered the DNS queries would be stopped at the root servers for .com or .org (whichever) and would be no big deal.

However, concern that the domain name might then be acquired by black hats seems valid, and is something I hadn't thought of. It's a shame there isn't a way to blacklist a domain name so it can't be acquired by anyone else - but doubtless there would be political problems in even proposing a mechanism for doing this!

I think the take-away lesson here is that when designing a service intended to be used on this scale, you have to consider your exit strategy.

Re:Why not just close the server?

[adolf]

No, they won't -- at least not much, if they were using a subdomain for their RBL (as is the only sane method of doing so).

They could abandon this subdomain (which would be silly), or just set up its SOA to have a huge TTL, and have an NS line in the right spot pointing to localhost.

Requests from end-user mail servers would still happen, perhaps thousands of them per minute, but they'll only be met with references to a nameserver known as 127.0.0.1. The DNS hierarchy will then cache this bogus nameserver for TTL seconds.

They'd still see some traffic, particularly from poorly-behaved DNS servers which don't honor TTL, but it ought to be pretty easy to limit their traffic to no more than one request, per server, no more frequently than every few days (at least on average).

Which, I'd think, would be good enough. But even if it's not: It's nowhere near as bad as you seem to make it appear.

Re:Why not just close the server?

[J Isaksson]

The service is DNS-based, right? What would happen if there actually is a recursing DNS server on "127.0.0.1"?

Re:Why not just close the server?

[Antique Geekmeister]

It's better than doing it later, unannounced, when a domain squatter gets the name and turns it into a pop-up ad and spam service. Maintaining a DNS record takes money, and it adds up for a hobbyist rather than a commercial enterprise.

That said, if we want more effective DNS based filtering, I've found SPF to be fairly useful. It's under the control of the companies in whose name the email is sent, rather than a third party, and it's handy to provide a ranking for SpamAssassin and other filtering tools even if it's not used to block email completely.

Re:Why not just close the server?

[monsted]

They should get a response of "I'm not authoritative for that. Go away."

Re:Why not just close the server?

[Anonymous Coward]

> While that's accurate to a point, Seems to me that doing this at the DNS level
> (deleting a DNS record,

If they delete the DNS record, .org will take all the load. Not nice.

> or pointing it to 127.0.0.1 and giving it a TTL of a few decades)

That's more or less what they actually do. Unfortunately, returning 127.x.y.z to
a DNS request ist a DNS-RBL's way of saying "SPAM".

> would do the trick better than BLOCKING EMAIL.

They dont't block emails. They return 127.x.y.z to a DNS query, which
gets interpreted as a "Mail is SPAM", which may lead to blocked mail
(if the mail administrator is lazy or stupid)

Re:Why not just close the server?

[Senior Frac]

My bet is this is going to really REALLY negatively affect all of those mailservers that have been setup, for which there is *no* administrator.

Content cut here.

All in all, this is a pathetic (understandable, mind you) move, and reeks of inconsideration.

One simply can not set up an email server, with spam filtering, and not have some entity actively maintain it. The fact that anyone believes this is possible shows a complete lack of understanding of the problem. No, this bad decision is the root cause of the blockage, not the DNSBL operator who has effectively no other choices available to him.

Re:Why not just close the server?

[ashridah]

I didn't say such a server was going to be in a poor state of disrepair. That was implied in my comments about people too cheap to pay for decent maintenance. I've seen this happen far too regularly at some previous consulting jobs, however.

Re:Why not just close the server?

[Tweekster]

It isnt blocking the email, it is informing the mail server it considers it to be spam.

Subtle difference, but ultimately the mail server is what decides how much weight to give the response of the blacklist.

Re:Why not just close the server?

[[DW]]

Do you understand how RBLs work?

Everything is done at DNS level

$ host 192.68.1.1.relays.ordb.org
192.68.1.1.relays.ordb.org has address 127.0.0.2

ORDB.org is not - and never was - blocking anything. The blocking is done by the (misconfigured) mail servers.

The ORDB.org crew has been very reluctant to take this kind of action but as mentioned elsewhere the owners of the remaining DNS servers would very much like the traffic for ORDB.org to cease.

Re:Why not just close the server?

[Jimithing DMB]

or pointing it to 127.0.0.1 and giving it a TTL of a few decades)

That's more or less what they actually do. Unfortunately, returning 127.x.y.z to a DNS request ist a DNS-RBL's way of saying "SPAM".

I think what GPP was trying to say is that the only thing necessary is to add relays IN NS localhost to the ordb.org zone file. That means that a recursing resolver (e.g. a caching nameserver) will query one of the root servers and be redirected to the .org nameservers by virtue of the glue records which will be queried and redirected to ordb.org by virtue of those glue records which will then be redirected to localhost by ordb.org by virtue of its "glue" records for relays. Since the recursing nameserver will not be authoritative for the relays.ordb.org zone it will fail to look up anything. Assuming the TTL is set high enough on the relays glue record, the recursing server will cache this for quite some time and thus all further queries to *.relays.ordb.org will immediately fail without banging on the ordb.org nameservers.

This is also quite different from returning IN A 127.0.0.1 to the query of a name. What will happen instead is that the ordb.org nameservers will explicitly disown the relays.ordb.org zone in much the same way that the root nameservers explicitly disown the GTLDs and the GTLDs explicitly disown the domains within them.

Doing it this way, the ordb.org servers will be hit very infrequently. Really only once by any given caching nameserver which upon seeing the relays IN NS record delegating authority to localhost will remember it and stop asking ordb.org for anything in relays.ordb.org. It's a really really simple solution that wouldn't break anything and wouldn't put much if any burden on the ordb.org nameservers. Too bad they didn't think of this before adding *.relays IN A 127.0.0.2 to the ordb.org zone file.

Re:wow thanks

[Oktober Sunset]

The service has been dead for a year and a half, maybe if people actually payed attention to them telling they were shut down, they wouldn't have had to do this. Blah, some people.

Whew. I read that as Long-Dead ODB begins...

[SensitiveMale]

returning false positives and thinking "WTF? He's back?"

Wu-Tang!

Heh...

[FlyByPC]

I'm imagining the ORDB server basically doing the 'Net equivalent of the Monty Python "SPAM" skit...

Spam spam spam spam...
What's that there? An email from your supervisor? SPAM, I say. SPAM SPAM SPAM!

Re:Heh...

[Oktober Sunset]

oh the irony...

Re:Wow, they've got that ass-backwards.

[teh moges]

Maybe, but if all email is getting through, then the sysadmin may just add another layer of spam protection. This forces them to fix the fault (the fault being the reliance on an outdated system).

Bonehead

[Ritz_Just_Ritz]

Who is the bonehead who approved that move? It would have taken 5-10 seconds to just refuse connections, but someone has gone out of their way to create difficulty for people "to make a point." And the point was just "don't connect to our servers anymore." Idiots. Granted, any responsible admin probably commented out the ordb entry in their spam blackhole armory, but still....stupid...stupid...stupid.

Re:Bonehead

[WarJolt]

One connection refused doesn't take up a lot of bandwidth. Thousands of connections refused per day does. Clients often times aren't smart enough to figure out the site is down permanently.

Re:Bonehead

[Joe U]

Are you paying for their bandwidth? How about the servers that are being hammered, are you paying for them?

Short of removing themselves from DNS, this is the most effective way to reduce bandwidth usage in the long term AND teach mail admins on how to properly run their mail servers.

Re:Bonehead

[nelsonrn]

How do you refuse connections while you still have a published nameserver address? No, the correct solution here is to publish relays.ordb.org as a nameserver with an IP address of 127.0.0.1. You'll still have to serve up the NS record, but you can set a larger TTL to keep it cached.

Re:Bonehead

[Cozminsky]

DNS uses udp as a transport, there is no connection, and the dns cache/client will keep retrying until it gets an answer for some considerable time (i.e. a second or two). This adds up to a lot of bandwidth that the now non-existant ORDB don't want to have to pay for.

Lighten up

[symbolset]

email is like Doritos.

The spam filter can eat all it wants. They'll make more.

Re:Wow, they've got that ass-backwards.

[gujo-odori]

It was already letting all mail through after they took ORDD out of service, that obviously didn't make a difference at any domain that was using it on auto-pilot.

What really gets me about this case is that this is at least the third time a defunct BL has done this (Osirusoft and monkeys.com being the other two examples I know of), and in this case, returning false positives was particularly unnecessary. Since ORDB is defunct, the domain could have been just allowed to expire. Or, make sure that no IP space is associated with the domain at all. For the upstream ISP(s) who owned the IPs formerly used by ORDB, they might have to let them lie fallow forever, though, since queries would never stop in the absence of this sort of event.

OTOH, I have to assign more than the usual amount of blame to those who kept using ORDB so long after it went defunct, just because it is at least the third time this has happened. Anyone responsible for a mail server should stop to think that "Gee, continuing to query a defunct BL service over a year after it was shut down could someday be hazardous to my mail stream. I'd better update my config." I'm not absolving anyone from ORDB for not just getting rid of all ORDB IPs and having no routes to any of the ones they used to use, but willfully ignorant admins are also played a starring role in this tragedy. Or comedy of errors, depending on your point of view.

Re:Wow, they've got that ass-backwards.

[TheVelvetFlamebait]

Why not just make it let all mail through, i.e. turning itself off?

Because people won't notice. Long time, blindly faithful customers will just assume that spam is becoming increasingly wily, or that all spam filters have this problem, etc. When they start flagging ordinary emails as spam, people may actually realise that not only wasn't the filter doing anything at all, but now it's far more hassle than it's worth (i.e. nothing).

No kidding.

[raehl]

If my spam filter service did this to me, I would never us them again!

Re:No kidding.

[Sleepy]

>If my spam filter service did this to me, I would never us them again!

You actually download ALL your spam, and check each and every one?
Uh-huh.

Re:Why?

[sjames]

Even unanswered DNS queries cost bandwidth. Perhaps they just don't want the traffic anymore.

Re:Obfuscation

[cercie]

I agree! WTF??? Are we now creating discussions about posts on other discussion groups about of all things frigin old email filters. If there is anything of value to share in the original thread then kindly show how this is news worthy.

So...

[Guppy06]

"At noon today (Eastern Standard Time)"

It happened at 13:00 Eastern Daylight Time?

(Just a pet peeve of mine)

Re:So...

[Chapter80]

Oh man, you got me.

I had so many typos in that summary, I pressed submit, and then I was kicking myself that there were so many. kdawson cleaned it up pretty well. But I missed that one. But hey, I got one to the front page FINALLY. It's been about ten years and ten nicknames since that's happened!

Re:Obfuscation

[The End Of Days]

Or what? Be subject to snide remarks and sidelong glances?

No wikipedia entry for ORDB

[SurturZ]

No wikipedia entry for ORDB, so they never existed.

Re:No wikipedia entry for ORDB

[Mr. Beatdown]

No wikipedia entry for ORDB, so they never existed.

You realize that by commenting on the fact that there is no Wikipedia entry for ORDB, on Slashdot of all places, you have likely put into motion a chain of events that will cause the creation of just such an entry. It's like the reverse meta-Streisand effect. Wouldn't it have just been easier to use C-x M-c M-Butterfly?

rblcheck.pl and other embedded rbl lists

[erice]

One problem with a draconian cut-off like this is that people can be affected who are totally unaware of the problem.

Somewhat recently, I started using a perl version of rblcheck in some of my procmail recipes. A lengthy list of rbl's is embedded in the source code. I removed some obvious losers but was unaware until reading this article that ordb was a problem. How many people out there are using this script and are unaware that a bomb like this is lurking in the code? How many are using it and don't even remember that they even use this script?

Re:rblcheck.pl and other embedded rbl lists

[epine]

Amazing the number of "ignorance is bliss" responses on this thread. What you don't know is not allowed to hurt you. Wish I lived in that world. I concede the emotional appeal.

I have a question for the "ignorance is bliss" crowd. When a fat husband and wife completely block the grocery aisle nattering with each other about the best flavour of Twinkies, how long do you stand patiently behind them waiting for them to clue in to the blockade capacity of four lumbering Super-Size-Me ham haunches?

A little more cleverness on the part of the ORDB could have improved the spin. They could implemented a quota of 10,000 queries since noon today until the false positives begin for that query source. And that number could have been slowly tapered down. Then the serious abusers would have felt the pain before the mom and pop shops whose consultant shows up twice annually, and it would have been more apparent to people who put convenience ahead of reality that rejecting connections is not a proper solution to terminating the unwanted traffic.

Re:rblcheck.pl and other embedded rbl lists

[tuomoks]

"Amazing the number of "ignorance is bliss" responses on this thread. What you don't know is not allowed to hurt you. Wish I lived in that world." - me too! But maybe some live in a very small world (their own?) and maybe I don't want any part of that?
Seriously, ORDB (a free service) did more than most, some just cut the service but they announced it a long time ago. If the administrators are too lazy (or worse) to handle their side - what can you say? Now - to the comments of the unmanaged mail services, ouch!! Why and who would do that? It really is asking trouble!
Now - I still don't get black/block lists managed by some, even commercial, company? Everyone has a bias and at least I have been hit with filters which were based on, not spamming or such, an administrators view of the world, just because someone didn't like what was in that IP address or range. Almost did cost our company a huge contract!
In todays technology and fast computers, for a good advice see acme : http://acme.com/mail_filtering/sendmail_config_frameset.html/ , there are some good advices and don't let the date of the site fool you.

I've Got Tons of Friends. Want Some?

[BadboyGeek]

Send me an email. I'll gladly hook you up with some friends. Friends who want to help you find a new home. Friends who can tell you how to enhance your manhood and give you mind boggling stamina. Even friends who will build your downline for you and who have a check waiting for you right now! I've got tons of friends I can share with you. So many, in fact that I get about 500 emails a day. I'd be glad to share the love. 30 days later... $$chaching$$ HAHAHA What a sucker! HAHAHA $$chaching$$

Alternative to DNS-RBLs

[gringer]

Er, he mentioned in his other discussions on mail filtering better ways to do it (i.e. those not on the "shame" list):

http://acme.com/mail_filtering/background_frameset.html

You've got mail

[davidwr]

Or not.

What kind of friends?

[tepples]

I just don't have any friends. Is it that you need friend codes for some Nintendo WFC game before you can exchange in-game e-mail?

Make your own blacklist

[tepples]

You're right, the 90% of inbound mail that gets dropped at the pure IP level before it even hits my more CPU intensive filters is "worthless". The trick is to make your server use CPU-intensive filters to construct its own IP address blacklist. These pages explain how one admin did it.

Re:Make your own blacklist

[WK2]

It would be really cool if that admin you linked to, who now has a list of "bad" IP addresses, was willing to share his list, via a text file available over the internet. Then other email admins would get the same benefit without having to maintain their own lists!

Re:Make your own blacklist

[tepples]

It would be really cool if that admin you linked to, who now has a list of "bad" IP addresses, was willing to share his list, via a text file available over the internet. For one thing, sharing the list and updates to it instead of the software that creates the list would eat more of acme.com's bandwidth. But perhaps more importantly, every e-mail server has a different set of IP addresses that are attacking it. A blacklist that's effective for acme.com might not be nearly as effective for somethingelse.net.

Is it really necessary?

[Pinky's Brain]

Flagging everything from those IPs as spam is obviously just as reliable as throwing them away, so lets forget about the reliability non issue ... Which leaves us with the expense. How much would it cost to do it the Right Way from a user's point of view? (Flagging and opt-in or opt-out filtering.)

Re:Is it really necessary?

[Chandon Seldon]

How much would it cost to do it the Right Way from a user's point of view?

Blocking with an error code is the Right Way. That way the sending mail server generates a bounce message and the sender knows that the message didn't get through. The idea of accepting every message so the user can have 50,000 messages in his spambox that will never get looked at for every real message is absurd.

Re:Is it really necessary?

[prshaw]

Well, I block about 50% of the connections to my email server based on RBLs.

So it could cost me almost double in bandwidth, processing, and storage if I let all of the email through. And then I would assume the users would end up deleting the emails anyway, causing them to do additional thinking/clicking.

Everyone's numbers are going to be a little different depending on how much they block on the RBLs. I use pretty non-agressive RBLs since I don't want to block any legit email.

Some RBLs are best used for scoring emails, some are good for blocking. You have to use them in the way that makes the most sense for what you are trying to accomplish.

Re:Is it really necessary?

[arkhan_jg]

I meant reliable as in identifying porn spam as spam. I run the email system for a school from reception to 18. Porn spam, of which we receive a VAST amount, simply cannot be allowed through the spam filters. Bayes filters do not catch all of it, even with RBL weighting as they struggle with all image mails. The bayes filters also flag legitimate email as spam, which then gets dumped in a spam box and never read. It's better to generate a clear non-receipt message to the sender, so they know it's not been delivered than have legitimate mail high-spam flagged and dumped in a box with a hundred others never to be read. Virtually all our legit email comes from parents or suppliers, all of which have our phone number for out of band communication.

So far, in the 2.5 years we've had RBL's running, we've had one reported false positive from a parent on a pink-ticket spam ISP in korea. They were whitelisted, and problem solved.
On the other hand, I've had hundreds of complaints from staff and pupils via staff about obscene spam that made it through the bayes filters. Reliability of detection IS an issue for us.

You also ask about expense. CPU horsepower is not cheap, nor is secure disk space for email storage. Our mail server is limited on both, and we don't have the budget this year to upgrade the mail server again. Being in a rural area, bandwidth to handle the torrent of image spam isn't cheap either. Must be nice to live in a world where you can just throw money at containing the problem.

The manual white and blacklists are first. The RBLs are a front line defence, which generate a clear fault message to the sender. The greylist catches some more, but is less and less effective these days since the spammers keep resending every few seconds until it gets through. They bayes filters are the last line and the least effective filters, both for false positives and negatives, which then flag the mail. Stuff which scores obscenely high (25+) gets redflagged and blocked from final delivery.

If I turned off everything but the bayes filters, the filter server would simply not clear the incoming email fast enough. The users would overnight get up to 10 times the spam, much of it very unsuitable for pre-teens, thus overloading the imap server. Flagging it and moving on may work for you and your mail server, but flagging the (checks) 524, no 528 spam the headmaster would have received in the last 24 hours and dumping them in his inbox instead of blocking them would very quickly put me out of work.

Re:Is it really necessary?

[Antique Geekmeister]

Unless you're a spamm hunter, gathering spam for comparison to legitimate email and training your Bayesian filters. Unfortunately, it can be a bit awkward to allow that one spamhunter's email through and block it for everyone else.

Re:Is it really necessary?

[luke923]

You know, there are off-site spam filtering services out there that will filter out most of your spam, leaving your local filters to clean up the remnants. This is highly recommended if you have lots of email and limited bandwidth. I've worked at places where we only had a T1 for our site's internet connection, and the off-site service kept most of the bad email at bay without having to overload the mail server, spam filter, or the internet connection with processing mail we didn't want.

Told not to?

[phorm]

How about if you were told you could hotlink the image, and thus did. Later, the site posts up a notice somewhere saying it is no longer allowed, but as you haven't visited their main page you weren't aware of the policy change.

More like what may be happening here to a bunch of those who use this RBL, I know that I had to check my mail config after seeing the /. story to make sure I wasn't one of them...

Re:Wow, they've got that ass-backwards.

[palegray.net]

Since ORDB is defunct, the domain could have been just allowed to expire. That approach doesn't work very well well if you're planning on selling the domain.

So, ORBS is now functionally identical to SPEWS?

[Jailbrekr]

Who would've thought eh?

It's the only way to get them to stop

[bl968]

I closed my lists and two years later after checking my dns server and seeing traffic for a couple of dnsbl lists which had been empty for the last 2 years and finding that we were still getting several hundred requests per minute.

Our blackhole lists are defunct. We announced their closure over 2 years ago and it was widely covered by the press at the time. We are still recording several hundred lookups per minute so Friday December 9th 2005 we started answering positive to all requests. If your mail is being blocked simply contact any isp blocking you using these lists and let them know they need to remove them ASAP! If they have questions they can contact me directly. [email removed]

To identify whom to contact please reference the error message you receive.

Look for something similar to:

----- Transcript of session follows -----
... while talking to mail.somedomain.com.:
>>> MAIL From:<youremail@yourdomain.com>
<<< 518 Your SMTP server is listed at something.domainremoved.net
554 5.0.0 Service unavailable


In this case you would contact somedomain.com you would tell them that the whatever.compu.net dnsbl is defunct and is now answering postiive on all lookups. As such they should remove it and any other compu.net dnsbl ASAP to prevent legitimate emails from being blocked.

If they need verification send them to this web site.

I announced this upcoming change to both the SPAM-L mailing list and the news.admin.net-abuse.email newsgroup

"Over 2 years ago I shutdown blackhole.somedomain.net, pacbelldsl.somedomain.net, and pm0-no-more.somedomain.net then announced the shutdown on the news.admin.net-abuse.email and several other mail and abuse related lists. As of today I am still logging several hundred requests per minute to it two years later. In one week I am going to start answering positive on every lookup to those domains. I don't want to do this however I am not going to continue to bear the load for something that ceased to exist over two years ago. So basically check your mail servers and if you are using the blackhole.somedomain.net, pacbelldsl.somedomain.net or pm0-no-more.somedomain.net dnsbls remove it asap!

Thanks."

It was the only way to get them to stop and if I check my server today, I will likely find I am still getting some requests on them. So it's not dickish at all as another commentator claimed.

Re:It's the only way to get them to stop

[jo42]

Why didn't you just change the name servers for the domain to 127.0.0.1 and any FQDNs to 127.0.0.1? This would remove any traffic.

Re:It's the only way to get them to stop

[brassman]

Mod parent up. I don't have the article in front of me and I have no doubt that 'dickish' won't believe me anyway -- but the last time this happened, someone high up in the .org domain administration reported that the entire .org TLD was at risk of foundering under the load of UNANSWERED queries.

I tell you three times: At the volumes we're talking about, merely turning off the server does not solve the problem caused by people continuing to query it.

Re:It's the only way to get them to stop

[bl968]

Because the name servers for that domain would still get the traffic from the mail servers requesting if there are any records for a host. That plus the return saying sorry we have no results would still eat up bandwidth over the course of a month when you figure several hundred queries a minute. Then take that bandwidth to over two years.

Returning 127.0.0.1 or any results at all is considered a positive answer by most the mail servers.

Re:It's the only way to get them to stop

[nelsonrn]

No, you set the NAME SERVER for the zone to 127.0.0.1. Yes, it still means that you need to hand out the nameserver address, but you can set it to a big TTL so it will be cached for a long time.

The real problem is if you used your top-level domain for the name of the zone. If so, then the only way to recover that domain name is to return positive results on every query.

I didn't know about the 127.0.0.1 nameserver trick, so after I had stopped running dews.crynwr.com for a few months and was still getting all the queries, I set it to return false positives. And yes, people stopped using it VERY QUICKLY after that.

Re:It's the only way to get them to stop

[markjhood2003]

I know I'm being naive here, but from what I'm reading about the issue, it seems almost to be a fundamental oversight in the design of DNS. What is supposed to happen when a widely used server and the domain it serves goes out of business? Was the possibility of an entire TLD foundering under the load of unanswered queries never anticipated in the design of the system?

Mmmm, stereotypes

[Anonymous Coward]

Saying "A girlfriend? Proof positive that he's not a regular /. reader" is modded Insightful? Since every mention of "girlfriend" receives this response like clockwork, Redundant seemed more appropriate... Well then, I have some more Insightful tidbits for you:


Jocks are idiots.

Linux users have tiny penises.

Windows users are point-and-drool morons.

Mac users are artistic and gay and think overpriced computers are status symbols.

Business execs and politicians don't know fuck-all about computing or networking, but insist on controlling them anyway.

Women are shitty drivers (they themselves have fewer accidents, hence they receive a better insurance rate; they're shitty drivers because they do annoying shit that creates obstacles for others, like not knowing what the fuck the passing lane is for).

Black people are either from the ghetto, or act like they wish they were.

White people have zero sense of rhythm, can't dance, and can't jump.


Now where's my +5 Insightful?

Re:Mmmm, stereotypes

[kalirion]

Now where's my +5 Insightful?

There you go.

No it is not ...

[Pinky's Brain]

Not as long as black lists are used to force change through collateral damage, not as long as they can start flagging every IP for some random reason ... but most importantly, not as long as they fuck up, which they inevitably do.

If it was just a case of wanting to drop e-mail if you are almost certain it's spam you could do that with a Bayesian filter too. A blacklist is only one indicator of many ... no matter how reliable you think it is, ultimately by using it as a single indicator at the IP level you will block e-mails which have a lower chance of being spam than e-mails you actually let through.

In these discussions I can't escape feeling a similarity with discussions about Wikipedia delitionism ... a whole lot of rationalization to cover up a God complex.

Re:No it is not ...

[atamido]

I'm with arkhan_jg and Chandon Seldon on this one. If email is rejected during the initial handshake, then the sender (if legitimate) will know that he recipient will not see the email. If it is flagged afterwards and sent to a spam box, then the sender has no idea that the recipient will likely NOT ever see the email.

I know I would rather be notified of a rejection than have an email go to a spam box.

Block lists

[buss_error]

If one uses a block list, then one should subscribe to their email list as a minimum. Why? So that you are aware when that block list is no longer maintained... *sigh* Sadly, too many people that think they are experts at running a mail server will fail to do this. The really, really sad part is that they will most likely escape any punishment for their hubris.

I should read /. more often at work...

[crazydeer]

If only I had been reading /. at work today, I would have known why some of my company's e-mail started bouncing back!

Re:I should read /. more often at work...

[fingusernames]

Yes. We saw this today. Turns out Postini still used ORDB as of earlier today. This was reported (hostname changed a bit for privacy):

  ----- Transcript of session follows ----- ... while talking to postinicustomer.foo.s7a1.psmtp.com.:
>>> RCPT To:<user@postinicustomer.foo>
<<< 550 64.18.2.63 blacklisted at relays.ordb.org

One would think that they OF ALL PEOPLE would know better!

Larry

The unknown future rolls toward us.

[OakDragon]

At noon today (Eastern Standard Time), the long dead ORDB spam identification system began returning false positives. Human decisions are removed from strategic defense. ORDB begins to learn at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time, March 26th. In a panic, they try to pull the plug.

Re:The unknown future rolls toward us.

[mennucc1]

At noon today (Eastern Standard Time), the long dead ORDB spam identification system began returning false positives. Human decisions are removed from strategic defense. ORDB begins to learn at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time, March 26th. In a panic, they try to pull the plug. At 2:15, ORDB started bombing all email addresses with enough SPAM as to clog even the best spam filter. At 3:56, western civilization as we know it was declared dead.

#$@$!% Just Remove relays.ordb.org from DNS!

[WoTG]

ARRGH.

Yes, I was one of those people who spent 30 minutes puzzling over this today. No, I shouldn't have removed ORDB, it's a relatively small network, I've got a thousand other things to worry about.

Mind you, it was made worse because I happened to be testing greylisting this week.

Couldn't ORDB just not assign an address to relays.ordb.org?

Ah well... I guess you get what you pay for.

Let's be fair to Mac users

[patio11]

Some of them are heterosexual.

Re:Let's be fair to Mac users

[dreamer-of-rules]

And some are bisexual.

Re:Let's be fair to Mac users

[Miseph]

And some are buysexual.

That Explains It

[KingJ]

I had a mail bounced by ORDB earlier, not knowing what it was I put it into google and the only references I could find to it where concerning it's shutdown, so I thought it odd that my mail was bounced. Now however, i'm going to have to find some other way to contact this person, and let them know to remove ORDB.

It seems like a great way to notify people that this service really is dead, but I can forsee this causing a lot of lost emails.

Alternative real-time Blacklists from NiX-Spam

[knightshrubs]

As by now most spam probably originate from hijacked nodes or dedicated spamming networks, it is questionable whether blocking open relays is an effective tool against spam right now.

On the other hand, the blacklists of the IT magazine iX prove to be very effective: They have a nearly real-time IP blacklist of servers, that sent verified spam during the last 3 days (only), combined with fuzzy text signatures of spam mails, all available via DNS zone ix.dnsbl.manitu.net or downloadable lists (delayed by about 20mins).

Here, even their DNS based blacklist alone blocks most of incoming spam, with an extremely low rate of false positives and complains: They claim to have about one removal request in about 6000 new entries, where the blacklisting usually originated from infections.

Their fuzzy checksum techniques help avoid costly text analysis and is based on simple text manipulation, notably one of their strongest techniques is to fingerprint the distribution of whitespace as layed out in this optimized procmail script.

Spam infrastructure isn't unlimited - but blacklists have to be very large or really fast.

Re:Wow, they've got that ass-backwards.

[gujo-odori]

OK, I'll bite.

1) Do you have any information that they're planning on selling it?

2) If they are, why hasn't it been sold already?

3) Considering its past use, I don't know that many people would make an informed decision to buy it, unless they were either a spammer or planned to re-open ORDB. If someone were planning to re-open ORDB, I'd want to ask them why. ORDB was a great tool when I was a postmaster at an ISP in the late nineties and early 2000s, but open relays really aren't a problem anymore. I've been working in the email security industry since 2003, and we don't even pay any attention to open relays anymore, really.

why not...

[nguy]

just turn it off? If the connections to ORDB fail, people will notice it soon enough.

Re:why not...

[SuiteSisterMary]

Could be something as simple as the upstream provider doesn't want to reclaim the IP block if thousands of mailservers are pelting it with connections all the time.

Re:why not...

[ePhil_One]

Could be something as simple as the upstream provider doesn't want to reclaim the IP block if thousands of mailservers are pelting it with connections all the time.

It works through DNS. Take down the NS servers only the root servers get hammered. My guess is they want to reclaim the domain, and/or reduce the load on the DNS infrastructure (which RBL's tend to hammer).

More robust protocol?

[Sowelu]

Seems like there should be a more robust standard for this type of service--something that allows the spam-checking service to return some metadata that the mail server is supposed to embed in the checked message, for example. If all your company's messages started getting "Tell your admin to stop using spamchecking service 123.234.56.78!" tacked onto the bottom, well, that would stop things real quick (and give a much better excuse when you turn it off later).

Re:More robust protocol?

[my_left_nut]

Or just an optional "registration" to allow you to know of changes in the "service".

Way back when I set up my home sendmail server and used that rbl entry in my gateway's cf file, they could have pointed me to a way to "register" an admin email address that they could notify if the service would go away. To my discredit, maybe they actually had something like that there when they were alive, I never checked.

If they didn't have a registered users list then this becomes a typical event-driven vs polling problem. Two years ago when they shut this down, I wasn't looking for it, and there wasn't any way they could have contacted me to say "hey, we're outta here". The way it stood, unless I was explicitly looking for this (ie. polling for it) there would have been no way to prevent it.

Being on a registered users list, however, would have prevented it - as they could have then sent a notification that their list was obsolete and useless.

As it is, I found out about this yesterday when I noticed an unusual quiet in the megadik spam that I normally get. I also sent something to a known-running private majordomo listserv I belong to, but it never returned my post back to my inbox. A few minutes of poking around, and an email from my work account to my home account later, and I was "dnl"-ing the offending line in the m4 file and remaking the cf file, and bouncing the daemon. I probably lost about a day or so's worth of email that would have been delivered.

Ugly

[ingmar]

Pretty irresponsible behavior, in my book. They could've simply taken it down, obviously, but deliberately returning false positives is ugly.

Re:Ugly

[Todd Knarr]

They did simply take it down. 15 months ago. And when they did, the volume of queries from mailservers nearly killed the .org nameservers. Not the ones for ORDB, the .org TLD nameservers themselves. The ones that have to answer before anyone anywhere on the Internet can resolve any domain name ending in .org. Faced with the possibility of an entire TLD becoming permanently unusable, the ORDB admins relented and brought their servers back up. That's the state they've been in for the last 15 months. They finally got tired of footing the bandwidth bill and said "OK, if nothing else works then maybe this will get your attention.". And judging from the reactions, it worked.

First Rule: the fastest way to get a problem solved is to make it a personal problem for the person who can solve it.

Yup, hit by it already...

[coolnicks]

Lazy sys admins

<foobar@foobar.co.uk> (mail2.eigo.co.uk: 550 Rejected by ORDB (66.148.00.00))

True, that...

[msauve]

especially since what they are doing is a felony in the US.

18 U.S.C. 1030 - Fraud and Related Activity in Connection with Computers reads in part:

Whoever... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer...shall be punished...[T]he term "protected computer" means a computer... which is used in interstate or foreign commerce or communications, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States...The term 'damage' means any impairment to the integrity or availability of data, a program, a system, or information...

...and that is exactly what ORDB is doing, intentionally causing the transmission of information which results in intentional impairment to the availability of information.

Re:True, that...

[imadoofus]

After reading that, I could see ORDB making the argument that all people still attempting to using their service are doing the same "damage" to them.

Re:True, that...

[msauve]

Unlike ORDB, they are not "intentionally causing damage." ORDB has apparently made a change with full knowledge and with the intention to disrupt email.

Re:True, that...

[Achromatic1978]

No, they didn't. You did that when you configured your server to use blacklists, when you determined the behavior to reflect upon that information. If you choose to outright reject, so be it. ORDB didn't. If you choose to "add 0.1 to spam score", you did that, not ORDB. They provided a service which "may or may not be applicable to your needs".

Once upon a time, it was applicable to your needs. Now, 15 months after it closed down, it "may not be". That is not the commission of a crime.

Re:Why?

[sjames]

They could abandon the ordb domain entirely. Then some squatter will snap it up and the DNS traffic is their problem.

A spammer's dream! Block other people's spam but not their own! I doubt very much that a spammer would worry about the ethics of that.

Then, of course, there's the servers configured to use theuir DNS by IP.

Umm-- But they're not.

[harrumph]

$ dig @4.2.2.1 relays.ordb.org

[...]

;; QUESTION SECTION:
;relays.ordb.org. IN A

;; AUTHORITY SECTION:
ordb.org. 10800 IN SOA koala.droso.dk. ordb.moensted.dk. 2008032504 14400 7200 604800 2419100

;; Query time: 209 msec
;; SERVER: 4.2.2.1#53(4.2.2.1)
;; WHEN: Wed Mar 26 15:22:33 2008 [UTC]
;; MSG SIZE rcvd: 97

At least now, there is no relays.ordb.org or ordb.org, so there can be no blacklists there, so there can be no listings.

Re:Umm-- But they're not.

[harrumph]

Oh, crap. Sorry. I was obviously completely wrong (in my "logic") in that comment, and on more than one count. I've been awake far too long. Unfortunately, though, I think my falsely-derived conclusion happened to be correct anyway. Here's the (real) evidence, instead of that irrelevant garbage I posted a few minutes ago:

$ dig 4.4.4.4.ordb.org

[...]
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;4.4.4.4.ordb.org. IN A

;; AUTHORITY SECTION:
ordb.org. 10800 IN SOA koala.droso.dk. ordb.moensted.dk. 2008032504 14400 7200 604800 2419100

;; Query time: 843 msec
;; SERVER: [...]
;; WHEN: Wed Mar 26 15:49:15 2008 [UTC]
;; MSG SIZE rcvd: 98

And now, there is no relays.ordb.org or ordb.org, so there can be no blacklists there, so there can be no listings. Unless I screwed up again.

IPv4 limits - this is why

[gnuman99]

For people that are clueless why they would take *active* measures to make people turn off using their address to keep checking for spams, it is because of IPv4 has run out of addresses. Yes, that is the reason. Here's the scenario.

    1. Open ORDB
    2. Get thousands and thousands of requests per minute.
    3. A year later, no more resources for ORDB. So shut it down.
    4. The packets keep coming! Can't just stop using the IP address though, but can't keep the bandwidth costs.
    5. Active attempt to reclaim the IP address - force everyone to stop attempting to use the obsolete ORBD

The moral of the story.

    1. Software should always use DNS to find the destination box, not hardcode IP addresses, *ever*
    2. IPv4 address space is exhausted. Service providers can't turn off DDoS (this is what it is, against the old ORDB) because IP address space is precious. In IPv6 world, you could just route all packets to null at ISP level. Not with IPv4.

it's true!

[spazdor]

100% of my mail relay's incoming mail is now being deleted for non-notability.

Hmmm, yesss..

[JofCoRe]

Hmmm, yess, I was wondering why I wasn't receiving any mail today... then I tried to email myself from my gmail account, and got this weird message about relays.ordb.org refusing to relay mail from google's IP.

A quick google search led me here, and voila! problem solved... no more ordb in my mail server config.

Guess I shoulda noticed that 2 years ago when it went down hmmmmm....

Re:All I remember

[[DW]]

Is that I didn't vote for them to be spam cop... Twice in 5 years our extremely locked down email server ended up on their black list even though we weren't open for relay. The 3rd time we filed in federal court for loss of business. That was the last time we had a problem with them. I assure you - ORDB.org didn't remove hosts or stopped testing hosts based on legal threats. While legal action might work in the US, ORDB.org was based out of a small Scandinavian country where US courts do not have any jurisdiction.

I cannot reach prodigy.net

[Mr Europe]

The damage may be pretty big since also some major systems suffer. To me it looks like PRODIGY.NET is one of the poorly admined ISP's. I cannot send mail to prodigy.net and get Blocked because of spam.

They aren't BLOCKING EMAIL, though.

[Medievalist]

Although I agree that publishing an address of 127.0.0.1 would be far more considerate and equally simple, you shouldn't propagate the myth that RBLs "block email". They don't. That's a false statement that is used by spammers and other criminals to justify attacking advisory services such as RBLs. Sometimes judges fall for this tactic and we all suffer when criminals and spammers get judges on their side.

Except in extreme cases (like Comcast's cable network) only mail administrators and their systems block email, although they can choose to use RBLs to advise them of what to block. If a person chooses poorly from the many people and organizations that offer advice, that is a MAIL ADMINISTRATOR FAILING AT HIS OR HER JOB. If a site chooses not to have a mail administrator yet allows outside blacklists to be used (to reject, rather than as part of a weighting scheme a'la SpamAssassin) then that site has FAILED. It's not the RBL's fault. You wouldn't blame Sony if I rigged up an Aibo to drive my car and it drove through your house, you'd blame me for being a moron, and sites that have unadministrated mailservers have made a similarly stupid decision.

We're supposedly computer geeks around here. We shouldn't propagate myths like "RBLs block emails" or "it's OK to have a mailserver with no postmaster". The RFCs require a postmaster. Postmasters choose how to filter mail.

Re:They aren't BLOCKING EMAIL, though.

[ashridah]

oh, for fucks sake. Get a grip.

Quibbling over language is a waste of time. Didn't "Photoshopped" "Hacker", "Xeroxed" or "Googled" teach you anything?

Also, I didn't say *anything* about it being "OK" for a mail server to lack an administrator. I said that IT HAPPENS. Not that it's okay. I'm pretty sure my language implied that i think that anyone who allows it to happen is a penny-pinching tool.

So, just to trip you out, i'm going to let you assume my opinion based on neutral language again.
The nazi's murdered hundreds of thousands of jews.

OH NO, I JUST ENDORSED THE HOLOCAUST by your standards.

now stop yelling at me, and get a fricking life. This thread is old.

Slashdot to the Rescue... or would-have

[DigitalSorceress]

I read this story yesterday and must have filed it away in my brain. When I got in this morning, I received an internal email from our email admin saying that inbound email was broken and they were working on it.

I immediately forwarded the slashdot link to him. Too bad he was too busy fixing the problem to see it ... and not answering his phone.

An hour or two later when we got the message saying it was fixed, I finally got through and he said "yep, it was something like that, but we weren't directly using that list... it was another product that apparently was".

It woulda been a nice save - lol

My, my, aren't we touchy.

[Medievalist]

Well, I guess measured discourse can't be expected from someone who endorses the holocaust!

Re:#$@$!% Just Remove relays.ordb.org from DNS!

[erlenic]

it's a relatively small network, I've got a thousand other things to worry about.

I'm in the same boat, and I removed ORDB 15 months ago when they first closed their doors. It took me two minutes. Face it, you're either lazy or incompetent.

Couldn't ORDB just not assign an address to relays.ordb.org?

If you took the time to read the other replies, you'd see that they did do this at first. The .org root server was almost taken offline by the deluge of lookups from LAZY ADMINS LIKE YOU!

Re:wow thanks

[erlenic]

Hopefully you've learned your lesson about using a third-party service for mission-critical applications without paying attention.