Slashdot Mirror
Dutch ISP Files Police Complaint Against Spamhaus
judgecorp writes "Dutch ISP A2B has filed police complaints against anti-spam project Spamhaus, calling its CEO 'nuts' and accusing him of blackmail. Spamhaus added all A2B's addresses to a spam blacklist, when A2B did not obey the letter of its demands in blocking a spammer."
A2B DID block the spammer, they blocked his ip. What Spamhaus wanted was stop routing traffic for the whole CyberBunker (who route traffic for The Pirate Bay etc) who are not spammers. They had a single customer that spammed, and A2B as upstream provider blocked that ip instead. What they didn't do was block the innocent CyberBunker completely, and after that Spamhaus added A2B - completely third party - to their blacklist. That's complete bullshit and blackmail.
GO!
Seriously, anti-spam organizations tend to be as self righteous as born-again and on the wagon alcoholic evangelists.
Isn't it time to kill email?
Spamhaus publishes their Opinion about who are spam problems. It's a lot like Slashdot posts, which are the various contributor's Opinions. You can individually choose to believe, or not believe, any post(s) that you wish. And other ISP's can choose to accept, or reject, Spamhaus's Opinions about who and where troublesome spammers are. An Opinion is a very long way away from the accusation of Judge, Jury, and Executioner and only a fool would have made that unwarranted leap.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
. . . and exactly how is that a bad thing? :P
I read TFA and all I got was this lousy cookie
Yes, ISP's need to be responsible and take action against spammers, and yes, ISP's who continually fail to do so on a significant scale over a long period of time are fair game to block, but in this particularly instance it sounds like Spamhaus's actions may have been abusive and rather arrogant. I use Spamhaus's blocklist myself, but organizations like Spamhaus and Cisco SenderBase need to take some responsibility to ensure that they are not unduly effecting legitimate businesses and networks. Taking large-scale blanket actions that effect many legitimate sites undermines the anti-spam industry as a whole, because it makes it more difficult for people to rely on anti-spam products/services.
Every time you post an article on Slashdot, I kill a server. Think of the servers!
seems like an interesting question here. Spamhaus in essence can withhold an ISP's goodwill in the community, which is arguably a part of an ISP's "property" (and of any business, really). if that theory holds up, what Spamhaus is doing could be considered extortion. A2B could also seek some sort of libel claim against Spamhaus, but how likely would such a claim be enforced over international borders?
is there anyone watchdogging Spamhaus' watchdog efforts?
Yeah, they blocked one IP used by a spammer. How many spammers use one IP address? They use one IP address, then when that is blocked, switch to another, and another, and another....
Fight Spammers!
Please think of the colleratar damage.
1 spammer down, and an entire datacenters services.
Choosing to use and trust Spamhaus is a completely voluntary activity by companies that don't wish to receive spam. It is usually only one of many strategies people use to try to block spam. Most use it simply as advice for scoring, some us it to block smtp from hosts completely. Whatever.
If spamhaus gets it wrong too often (and they do make mistakes) then people will stop using it. There's little any authority can do about it though. Spamhaus publishes its opinion and others choose to follow it. Are they going to make laws against publishing opinions? The only way really to fight this would be to show that spamhaus is failing somehow in its mission. Personally, I suspect that if spamhaus says it's a spam haven, that it very probably is. If it is not, they'll eventually get delisted. End of story. My ISP has been listed before. It was not a mistake on their end, but on mine. It was a simple matter to fix the problems and get delisted. At the end of the processes I was thankful for the free opinion publishing service they provide.
Imagine if you weren't allowed to use roads because a bus company complained about your driving 3 times. --skunkpussy
You're right, they should just block 0.0.0.0/0 and block all spam 100%!
If Spamhaus is using its currently intact credibility as leverage, that very much is not appropriate.
And tough luck for A2B and Cyberbunker? I'm sure news of Spamhaus's demise will cheer them greatly at their own bankruptcy hearings.
ARE there alternatives?
They are hugely annoying to deal with if you send any volume of mail at all. I worked at a job in which we sent tens of thousands of order status emails per day (were there upsell attempts? Of course there probably were, but the thrust of the mail was "thanks for ordering, have a confirmation number"), and all it takes is a couple of people marking them as spam to get Spamhaus to start blacklisting you, your upstream ISP, your dogwalker's busdriver's cousin's hairdresser, etc.
I know they claim that they only blacklist IPs which send to honeypot email addresses, but I find that claim to be dubious at best, considering the IPs I've had blacklisted in the past.
I like music
I would love to hear from Cyberbunker on why they are providing hosting to a spammer. Oh wait, I just found their AUP that's linked from their website:
I'm sure glad they are up front.
Spamhaus seemed like one of the less shady and even more trustworthy blocklists(blacklist, whaterver). I have seen some (maybe it was backscatter) that wanted $100 to get off the list sooner than the standard 30day TTL, usually you don't have to worry about anybody using these lists. However, one time I did run into somebody that subscribes to a service that enlists multiple blocklists and was using one of these shady ones, luckily it was only a single client.
FTFY: What you're actually saying is that Spamhaus should be allowed to destroy multiple senders and receiver's email capability without law enforcement intervening.
The thing is, they have no right to do this, and nowhere to GET a right to do this -- and THAT is why law enforcement should be provided with a means to show up at Spamhaus's door and arrest the lot of them.
I never signed up for Spamhaus to be my "Internet Mommy." They're presumptuous abusers of other people's rights. Just as bad as spammers, and for the same reason: direct interference with my email.
I've fallen off your lawn, and I can't get up.
Spamhaus don't list people unless they've got a very good reason - that's why the majority of email providers, and likely your mail feed is using SBL. Steve is not crazy, and incidentally, business details are not subject to data protection provisions under the EU directive, so it is absolutely fine to say you kicked a spammer.
Lie down with the dogs, get up with the fleas. Woohoo, you made your sales quota, but don't expect me to accept your email.
I rent a server and a /29 in the cyberbunker, as far as I'm concerned spamhaus is trying to strongarm my my upstream providers upstream provider. I had nothing to do with any of this, but I stand to lose my ip range and services THAT I PAID FOR.
It's NOT reasonable from spamhaus to expect an entire ISP to be blackholed for ONE spam complaint 2 levels below.
Fighting for peace is like fucking for virginity
Ah, you say you work for Spamhaus?
I think we've pushed this "anyone can grow up to be president" thing too far.
Here's what these people seem to say.
When it comes to piracy - "ISPs shouldn't be policing the internet!"
When it comes to spam - "ISPs should be policing the internet!"
You're blaming the wrong entity. If you're concerned with this, you should be complaining to your ISP _whom_you_pay_ that they use Spamhaus. You have control of your service, go buy it from someone who doesn't use Spamhaus. Spamhaus isn't screwing with your Inbox, your ISP _whom_you_pay_ is screwing with your Inbox by their choice to use Spamhaus.
Don't get me wrong, I think Spamhaus is one of the best things since sliced bread. Why does your ISP _choose_ to use Spamhaus? Because the extra cost and resources involved with NOT using Spamhaus would impact their bottom line and they would have to charge you more.
Before all the botnet takedowns, RBL's used to account for blocking about 80-85% of inbound connections. Now it's down to less than 50%.
$ emailstats
Webmail System Statistics for 2011-10-12
TotalIncoming: 187662
RBL: 100601
Spams: 19439
Viruses: 192
Accepted: 67430
LocalDelivered: 53243
Forwarded: 14187
PercentGood: 35.9316
Considering only the information readily available via. summary and article, how is this any different from what the DHS are/were doing with ICE, taking out ... was it 86,000 sites to hit one target? When that happened Slashdot was up in arms about the insanity, was that just because DHS is loathed and Spamhaus generally isn't? Am I missing some important detail (other than DHS = Government, Spamhaus = vigilante freelancers) that puts this all in perspective?
-=This sig has nothing to do with my comment. Move along now=-
You don't realize how SMTP or the Internet works, my friend. A2B is about to suffer from a death by a good number of admins simply adding their network addresses to private firewall and routers settings. You see, what I do at the border of my network is my business. I consult Spamhaus for their opinion regarding the reputation of email traffic. My mail sever is set to query the Spamhaus DNS servers whenever another mail server connects to deliver mail. It's not by default that my server is set that way; I took action to make it so. Spamhaus is simply a consultant in this relationship. They watch for spammy mail. It's their list and if A2B didn't follow the requirements to be removed, then others like me may have problems receiving your email, again by our choice. Now, I'll take a few minutes to ensure that A2B's network blocks are listed in my own border router's rules file so that any traffic received there is simply tossed on the floor, not that I would expect much traffic. But then, that's just me. I can't predict the behavior of any other system admin out there. Your move.
Yup, pretty much. Spamhaus is simply a service that admins may use for advice on what to block.
It's up to the admins to agree with what they do and not use them if they get out of line.
That said, any admin that does use Spamhaus is a complete idiot. But, it's quite within their rights to be a complete idiot about administering their own mail servers.
Spamhaus does not have any credibility anymore. They have been doing this shit for years. Back when similar operating lists were new, they were decent. Now they are not. They were removed from my mail filtering systems years ago because I got tired of the lying bullshit they pulled.
It's not a consultant if your server is set to blindly follow whatever they say. And if you've ever tried to remove yourself from Spamhaus without spending lots of money, then you wouldn't understand how unreasonable they can be.
Then don't use spamhaus. It's a voluntary service after all.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
If Cyberbunker refuse to terminate spammers, then it should be blocked. This is like the porn affiliate program PerfectGonzo who ignored spam lawsuits, did not terminate a spamming affiliate until over a year after being brought to their attention, and only terminated one account of the spamming affiliate, not the 14 others. If Spamhaus blocked 1 IP address, how long would it take to change to another IP address? The failure to show Cyberbunker's record for dealing with spam is very telling -- if they promptly terminated spammers, it would have stated so.
Fight Spammers!
This story really rubs me the wrong way. They make it sound like Spamhaus has their fingers on the Internet's routing tables and at any whim can block or unblock networks that they don't like. This is simply not the case.
Spamhaus is no different from an op ed journalist or a food critic: All offer opinions about varying matters of public interest. Spamhaus, in this case, publishes an opinion in the form of a list of IP network ranges. In their opinion these networks can or may be responsible for transmitting spam or malware on the Internet.
PEOPLE ARE FREE TO USE OR NOT USE THIS INFORMATION AT THEIR DISCRETION.
But why is it that when the nutters at the Westboro Baptist church want to prance up and down the street and hold viotriolic hateful signs that all of a sudden we're so quick to point out that free speech is so vital for our society? Instead of bikeshedding over whether someone has a right to form an opinion about some Dutch ISP, how about instead we talk about how the spammers are themselves infringing on the propery rights of others by crapping on the internet? Lets stop pretending that the Internet is a public resource, it's a collection of private networks.
In any case, I have been a Spamhaus subscriber for scoring mail on my network and I appreciate the work that they do. I'd hate to imagine what the spam fighting landscape might look like today without Steve Linford and Spamhaus' efforts.
It's true no man is an island, but if you take a bunch of dead guys and tie 'em together, they make a good raft.
Well, except for the small percentage on IPv6.
FTFY: What you're actually saying is that Spamhaus should be allowed to destroy multiple senders and receiver's email capability without law enforcement intervening.
The thing is, they have no right to do this, and nowhere to GET a right to do this -- and THAT is why law enforcement should be provided with a means to show up at Spamhaus's door and arrest the lot of them.
I never signed up for Spamhaus to be my "Internet Mommy." They're presumptuous abusers of other people's rights. Just as bad as spammers, and for the same reason: direct interference with my email.
The problem with that approach is that the only power that Spamhaus devolves from the ISPs and server operators who use it. They don't directly block anything. They can't, that's not how it works. They're playing a dangerous game: if they make themselves too risky to use, admins will stop using them and whatever "power" they have will disappear.
The higher the technology, the sharper that two-edged sword.
Indeed. One email to a spamtrap, ever, gets an IP listed forever. There are no thresholds, volume limits, or expiration times. And they offer zero proof. The only way to be delisted is their nice money-laudering-esq, quasi-extortion "charity donation" scam. No reputable charitable entity will even speak their name.
Almost everyone running a website, including me, has run into problems with spamhaus. Spammers change IP addresses and move on. Spamhaus does not monitor their block list to determine whether an IP is no longer a source of spam. The result is, every time I upgrade my server, being assigned a new IP address, I must once again lose hours of my time appealing to Spamhaus and their ISPs to unblock my IP address. Well, I'm done with it.
My website publishes public information. Every month, thousands of business owners create an account so they can update the information related to their business. When an account is created, my system sends a verification email. If that email is blocked, the business owner is unable to activate the account and, consequently, can not update their information. Currently, that is exactly what happens to everyone in ATT territory (everyone in several southern states). And as far as I'm concerned, it's not my problem. They chose ATT, which chose to use an inaccurate block list. Let them spend their time fixing their problem.
If you use an ISP with an inaccurate block list, don't be surprised if the only mail being blocked is legitimate mail. The spammers move on to other IP addresses, it's the legitimate business owners who don't have the time or inclination to do so for the few customers that don't get their mail.
Spammer? No. I remember them wanting me to do this or that that was fairly expensive for a small hosting service. Not paying money to them, but it costing us more money than we could reasonably spend. In the end, we updated our server and then got a new static IP. The only emails we ever sent out were opt-in to a subscriber list of 3,000 or less.
Just a point of clarification.
Spamhaus runs several DNSBLs: SBL, PBL, XBL.
I use their XBL. It works great. Don't be confused thinking there's just one "spamhaus list", saying things like "anyone who uses spamhaus is a <insulting term>".
People should know what they're getting into when they subscribe to a DNSBL. DNSBLs are best used as part of a scoring system, rather than as an ultimate authority.
Regarding Spamhaus's SBL:
I believe Spamhaus knows what they're doing, and it's not simply escalating netblocks to create and enlist collaterally damaged networks to bring pressure. I bet Cyberbunker is complicit in providing a haven to spam operations. And -- this needs confirmation -- I hear that A2B gave Cyberbunker new addresses after Cyberbunker was listed, which makes A2B complicit.
I do not send spam emails, I never have once in my life. Yet I cannot get my netblock removed from spamhaus RBL because they don't like my ISP.
Also, I *know* that spamhaus has taken money from other parties, ISPs, to make sure that this type of 'escalation' would never happen to them. This will be presented during the court case in Holland.
Fighting for peace is like fucking for virginity
That is all nice and good, until they start pressuring upstream providers to STOP ROUTING, this is not about being on some spamlist but about removing a datacenter/ISP from the internet entirely.
They use the pull they have by being used by 2/3rds of the internet's email servers to blackmail ISPs to comply.
Fighting for peace is like fucking for virginity
Wow...so I forgot a little bit of what they wanted done. I'm really bad about picking out trolls here, but what do you have against me and why are you assuming I'm lying?
Computer power has nothing to do with sending out email. And you actually misquoted me. I didn't have to upgrade my hardware. I think I had a backscatter problem (trying to stay RFC-compliant) that once fixed via a software update/upgrade, they wouldn't take us off the list without going through something like senderscore or something. I don't remember the details. I just remembered it being far easier to get a new IP than dealing withthem.
Why do you support an ISP that supports spammers? By doing so, you're helping to keep spam alive.
Drop them, and move to a more respectable ISP.
I never signed up for Spamhaus to be my "Internet Mommy."
Then what are you complaining about? If you don't use Spamhaus as your internet mommy, then you can still receive all the spam you want.
I think in the entire history of Slashdot, only one post was ever removed. I forgot if it was due to a lost lawsuit or a lawsuit that would likely be lost and be very expensive.
Because their spamming customers are the ones who send the spam.
It is clear, from their own admissions, that Cyberbunker is a spam supporting service. Its no matter what service means that when Cyberbunker receives spam complaints, Cyberbunker will ignore the complaints.
See the Cyberbunker "Mind your own business" policy:
http://cyberbunker.com/disaster-free-hosting.html
"Most of our customers desire to stay anonymous. In some cases we do not even know who our customers actually are. We have no idea and we
simply do not care. Who ever you are, it is our business to keep you online."
---
"CyberBunker does not poke around on your servers. Customers are allowed to host any content they like, except child porn and anything related to terrorism. Everything else is fine. CyberBunker has adopted a policy not to mind our clients business. Our famous "Mind Your Own Business" policy."
Fight Spammers!
Spamhaus, and the other similar site, do more than "just" block IP addresses. A few years ago, when I lived in Chicago, one of them blocked not my IP, but the ENTIRE RANGE of my ISP - that is, they blocked the mailhost for RoadRunner Chicago, which was *the* major ISP for all of the city of Chicago. Frequently, on the CentOS mailing list, my email bounces, because my email, coming out of my hosting provider, is blocked. My provider - hostmonster/bluehost - has *thousands* or tens of thousands of domains' email coming in and out of a given named mailserver, which asserts one IP... and if one or more of those (usually WinDoze) folks get infected and send out crap, *everyone's* mailserver is blocked.
Their approach is *wrong*, It imagines that everyone has a static IP, and their mail coming out of that, not the reality of today.
mark
I don't see their "abuse policy" that you post.
What I do see on http://cyberbunker.com/disaster-free-hosting.html is:
"As long as your hosting fee is paid CyberBunker will do anything in its power to keep your servers up. In addition CyberBunker protects your servers also from others who might want to take your servers down like the DMCA, your competitors, authorities, burglars, governments and terrorists. "
Fight Spammers!
Once upon a time, your ISP was also usually your email provider. Hasn't been the case for a long time, though many people still find it convenient to use their ISP's mail for some purposes, but probably most people today either use a separate email provider for most of their mail, or use an ISP that outsources their email service to an email provider instead of running their own (e.g. mx.little-isp.net actually points to big-email-provider.net.)
So you either do or don't want to use an email provider that uses a specific RBL as part of their email filtering. Spamhaus has always had the reputation of providing high-quality conservative lists, as opposed to some RBLs that exclude all home IP connections (which are 99% zombie spammers and 1% home Linux users), or some lists that are extremely aggressive and non-responsive (e.g. SPEWS.)
My main email provider lets me choose a bunch of lists that can go into SpamAssassin weightings or just be used absolutely. For instance, I don't want any email from Nigeria or Korea, so those are on the hard-block list, but I do know people in South Africa and Japan, so those are only SpamAssassin weights.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Sure, in that case you would. But if you owned a bricks and mortar store, and the Better Business Bureau listed you as having a reputation for selling spoiled food or stolen goods, you wouldn't call the police on the BBB - you might sue them, or you might whine about how the BBB are a bunch of extortionists.
Calling the police is a more extreme reaction than sueing somebody. It's something you do if you think somebody needs to go to jail.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Spamhaus listed my work's IP, they indicated that it was due to detecting that one of our computers was going out to a C&C machine on HTTP to get orders. Not because of spam, because only our email server can send email, and it wasn't spamming, but because of a normal thing like a Trojan infection. If you are relying on these idiots, stop, they don't respond to spam, but the possibility of spam, which means they catch lots of legitimate corporations.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Untrue.
http://yro.slashdot.org/comments.pl?sid=2474962&cid=37716920
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Spamhaus is implementing the agenda of a whole lot of third parties - it's their customers, who don't like receiving spam.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
SPEWS's main problem wasn't that they got DOS'd, though it didn't help them. Their main problem was that they had a reputation for providing low-quality results, blocking way too much legitimate email, and it was nearly impossible to contact them in case you were inappropriately listed. So if you were an email mailbox provider using them as a direct blocking service, you'd be getting huge numbers of false positives, and have to track down complaints from your users about lost mail. At best, they were useful as input to SpamAssassin. (I don't know if they're still operating the same way these days; I gather Michelle sold them or something, but haven't followed the details.)
Spamhaus's reputation over the years has been that they're really conservative, and almost never have false positive problems. That doesn't mean that they don't occasionally list ISPs who have some spammer customers and some non-spammer customers, but they're not in the Nuclear Overkill business the way SPEWS was.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Spamhaus is a voluntary service. Here is a good one http://www.spamhaus.org/drop/ .
Nobody has EVER been forced to use Spamhaus and unless a law is passed tat makes it mandatory to use them, they will always be 100% voluntary. Allot of people choose to use Spamhaus because they are the best around.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
However, I should add that I don't recommend rejecting traffic on just Spamhaus alone. It's best to use multiple blacklist providers to help eliminate false positives. It also lessens the control of any single blacklist operator.
An SQL query goes to a bar, walks up to a table and asks, "Mind if I join you?"
>Backscatter
You get a backscatter problem when you send indiscriminate emails to addresses that do not exist with forged "from" headers. Because the bounces go not to you, but to random unaffiliated ISPs. That's the definition of backscatter.
Goddamn proof that you are a spammer or you sold to spammers. By your own words.
Read this. This is Steve Linford's reply to all this.
http://www.spamhaus.org/news.lasso?article=673
Notice that it's entirely reasonable and that my original assumption that the Dutch ISP was catering to crime was spot on.
>dutch host affiliated with RBN
Yeah. Nice guys.
By the by, I have 642 spams over the last 2 days in my spam folder just for one account. Without the filtering based on Steve Linford's hard work and the hard work of others, my email would be useless.
I have a reason to be pissed at spammers.
--
BMO
>normal thing like a Trojan infection (on the mail server)
>normal
I seriously hope you're not a sysadmin.
--
BMO
If you say so then it must be true. Internet person with no authority.
I did not say the email server had a Trojan. It was a client machine, that because it was not an email server, could not send email. There was no spam, just a random desktop that got infected and because of proper firewalls was blocked from sending email.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?