Slashdot Mirror
Long-Dead ORDB Begins Returning False Positives
Chapter80 writes "At noon today (Eastern Standard Time), the long dead ORDB spam identification system began returning false positives as a way to get sleeping users to remove the ORDB query from their spam filters. The net effect: all mail is blocked on servers still configured to use the ORDB service, which was taken out of commission in December of 2006. So if you're not getting any mail, check your spam filter configuration!"
No emails, but it's not the ORDB system. I just don't have any friends.
Read my Very Short "Stories"
I tried to sign up with Slashdot to comment on this post, but it told me that I would need to validate a confirmation email.
I haven't received my confirmation email yet... seriously, how long does this take? Anyone? Is Slashdot broken? Do people post comments on Slashdot?
Intentionally causing large numbers of emails to be lost is a risky move indeed.
Oldie but goldie: http://acme.com/mail_filtering/shame.html#dnsrbls
Dealing with Email and Spam issues can be enough of a pain in the ass without the added hassle of this shit.
It isn't that the recipient complains they aren't getting email, it's when the sender (my customer) complains to me that their mail isn't making it to the recipient and blames me when it's the spam filters at the other end causing the problem. And now this?
Nice.
Why don't they just close the server so it no longer accepts connections? Are they doing this to stop the server currently at that location from being hammered with requests?
You're right, the 90% of inbound mail that gets dropped at the pure IP level before it even hits my more CPU intensive filters is "worthless".
I'm imagining the ORDB server basically doing the 'Net equivalent of the Monty Python "SPAM" skit...
Spam spam spam spam...
What's that there? An email from your supervisor? SPAM, I say. SPAM SPAM SPAM!
Paleotechnologist and connoisseur of pretty shiny things.
Who is the bonehead who approved that move? It would have taken 5-10 seconds to just refuse connections, but someone has gone out of their way to create difficulty for people "to make a point." And the point was just "don't connect to our servers anymore." Idiots. Granted, any responsible admin probably commented out the ordb entry in their spam blackhole armory, but still....stupid...stupid...stupid.
You can have 100% of inbound mail dropped simply by unplugging the network cable....
However, such a filter wouldn't score good if it were judged on the really important metrics like number of false positives.
Secure messaging: http://quickmsg.vreeken.net/
It was already letting all mail through after they took ORDD out of service, that obviously didn't make a difference at any domain that was using it on auto-pilot.
What really gets me about this case is that this is at least the third time a defunct BL has done this (Osirusoft and monkeys.com being the other two examples I know of), and in this case, returning false positives was particularly unnecessary. Since ORDB is defunct, the domain could have been just allowed to expire. Or, make sure that no IP space is associated with the domain at all. For the upstream ISP(s) who owned the IPs formerly used by ORDB, they might have to let them lie fallow forever, though, since queries would never stop in the absence of this sort of event.
OTOH, I have to assign more than the usual amount of blame to those who kept using ORDB so long after it went defunct, just because it is at least the third time this has happened. Anyone responsible for a mail server should stop to think that "Gee, continuing to query a defunct BL service over a year after it was shut down could someday be hazardous to my mail stream. I'd better update my config." I'm not absolving anyone from ORDB for not just getting rid of all ORDB IPs and having no routes to any of the ones they used to use, but willfully ignorant admins are also played a starring role in this tragedy. Or comedy of errors, depending on your point of view.
You know, there is a difference between trolling and pointing out the flaws in your reasoning. Just saying.
If my spam filter service did this to me, I would never us them again!
paintball
Even unanswered DNS queries cost bandwidth. Perhaps they just don't want the traffic anymore.
No wikipedia entry for ORDB, so they never existed.
One problem with a draconian cut-off like this is that people can be affected who are totally unaware of the problem.
Somewhat recently, I started using a perl version of rblcheck in some of my procmail recipes. A lengthy list of rbl's is embedded in the source code. I removed some obvious losers but was unaware until reading this article that ordb was a problem. How many people out there are using this script and are unaware that a bomb like this is lurking in the code? How many are using it and don't even remember that they even use this script?
Er, he mentioned in his other discussions on mail filtering better ways to do it (i.e. those not on the "shame" list):
http://acme.com/mail_filtering/background_frameset.html
Ask me about repetitive DNA
It was the only way to get them to stop and if I check my server today, I will likely find I am still getting some requests on them. So it's not dickish at all as another commentator claimed.
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"
Saying "A girlfriend? Proof positive that he's not a regular /. reader" is modded Insightful? Since every mention of "girlfriend" receives this response like clockwork, Redundant seemed more appropriate... Well then, I have some more Insightful tidbits for you:
Jocks are idiots.
Linux users have tiny penises.
Windows users are point-and-drool morons.
Mac users are artistic and gay and think overpriced computers are status symbols.
Business execs and politicians don't know fuck-all about computing or networking, but insist on controlling them anyway.
Women are shitty drivers (they themselves have fewer accidents, hence they receive a better insurance rate; they're shitty drivers because they do annoying shit that creates obstacles for others, like not knowing what the fuck the passing lane is for).
Black people are either from the ghetto, or act like they wish they were.
White people have zero sense of rhythm, can't dance, and can't jump.
Now where's my +5 Insightful?
Blocking with an error code is the Right Way. That way the sending mail server generates a bounce message and the sender knows that the message didn't get through. The idea of accepting every message so the user can have 50,000 messages in his spambox that will never get looked at for every real message is absurd.
-- The act of censorship is always worse than whatever is being censored. Always.
Well, I block about 50% of the connections to my email server based on RBLs.
So it could cost me almost double in bandwidth, processing, and storage if I let all of the email through. And then I would assume the users would end up deleting the emails anyway, causing them to do additional thinking/clicking.
Everyone's numbers are going to be a little different depending on how much they block on the RBLs. I use pretty non-agressive RBLs since I don't want to block any legit email.
Some RBLs are best used for scoring emails, some are good for blocking. You have to use them in the way that makes the most sense for what you are trying to accomplish.
If one uses a block list, then one should subscribe to their email list as a minimum. Why? So that you are aware when that block list is no longer maintained... *sigh* Sadly, too many people that think they are experts at running a mail server will fail to do this. The really, really sad part is that they will most likely escape any punishment for their hubris.
Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves.
At noon today (Eastern Standard Time), the long dead ORDB spam identification system began returning false positives. Human decisions are removed from strategic defense. ORDB begins to learn at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time, March 26th. In a panic, they try to pull the plug.
Dark Reflection
I'm with arkhan_jg and Chandon Seldon on this one. If email is rejected during the initial handshake, then the sender (if legitimate) will know that he recipient will not see the email. If it is flagged afterwards and sent to a spam box, then the sender has no idea that the recipient will likely NOT ever see the email.
I know I would rather be notified of a rejection than have an email go to a spam box.
I meant reliable as in identifying porn spam as spam. I run the email system for a school from reception to 18. Porn spam, of which we receive a VAST amount, simply cannot be allowed through the spam filters. Bayes filters do not catch all of it, even with RBL weighting as they struggle with all image mails. The bayes filters also flag legitimate email as spam, which then gets dumped in a spam box and never read. It's better to generate a clear non-receipt message to the sender, so they know it's not been delivered than have legitimate mail high-spam flagged and dumped in a box with a hundred others never to be read. Virtually all our legit email comes from parents or suppliers, all of which have our phone number for out of band communication.
So far, in the 2.5 years we've had RBL's running, we've had one reported false positive from a parent on a pink-ticket spam ISP in korea. They were whitelisted, and problem solved.
On the other hand, I've had hundreds of complaints from staff and pupils via staff about obscene spam that made it through the bayes filters. Reliability of detection IS an issue for us.
You also ask about expense. CPU horsepower is not cheap, nor is secure disk space for email storage. Our mail server is limited on both, and we don't have the budget this year to upgrade the mail server again. Being in a rural area, bandwidth to handle the torrent of image spam isn't cheap either. Must be nice to live in a world where you can just throw money at containing the problem.
The manual white and blacklists are first. The RBLs are a front line defence, which generate a clear fault message to the sender. The greylist catches some more, but is less and less effective these days since the spammers keep resending every few seconds until it gets through. They bayes filters are the last line and the least effective filters, both for false positives and negatives, which then flag the mail. Stuff which scores obscenely high (25+) gets redflagged and blocked from final delivery.
If I turned off everything but the bayes filters, the filter server would simply not clear the incoming email fast enough. The users would overnight get up to 10 times the spam, much of it very unsuitable for pre-teens, thus overloading the imap server. Flagging it and moving on may work for you and your mail server, but flagging the (checks) 524, no 528 spam the headmaster would have received in the last 24 hours and dumping them in his inbox instead of blocking them would very quickly put me out of work.
Remember kids, it's all fun and games until someone commits wholesale galactic genocide.
And some are buysexual.
Try not to take me more seriously than I take myself.