Subject: [Asrg] Blacklist blackmail

From: Kee Hinckley <[email-masked]>
Date: Thu, 27 Mar 2003 20:34:22 -0500

We are now getting RBLs who will remove your host from their 
blacklist for a fee.  (See http://www.blars.org/errors/block.html for 
an example.)

And yes, people actually subscribe to these.  And yes, they do block 
non-spamming ISPs.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: wayne <[email-masked]>
Date: 27 Mar 2003 22:14:36 -0600

In <p06000d07baa9567f9e7a@[192.168.1.104]> Kee Hinckley <[email-masked]> writes:

> We are now getting RBLs who will remove your host from their blacklist
> for a fee.  (See http://www.blars.org/errors/block.html for an
> example.)

If by "now", you mean within the last year or so, then ok.  The
last modification time on that web page was about a year ago.

And if by "blackmail" you mean charging money for services rendered
rather than the traditional dictionary definition of "blackmail", then
I guess that is ok also.

> And yes, people actually subscribe to these.

So what?  Can't people do what they want with their own machines?

>                                               And yes, they do block

So what?

If you send email to someone and it is block because they use Blars
DNSBL, you have three choices:

1) Don't bother sending that person (or ISP) email anymore.

2) Try to convince the person (or ISP) you sent email to that they
   shouldn't be using that DNSBL, but understand that they are under
   no obligation to change.

3) Try to convince Blars DNSBL to remove you.  In this particular
   case, you will have to put down a sizable deposit and if Blars
   decides that you were correctly listed, you will probably end up
   paying that deposit to him.

DNSBLs are like restaurant reviews.  Yeah, some of them like the
NYTimes reviews can make a significant impact on the restaurant, but
that is only because they are well respected.  Anyone can create a
restaurant review if they want, but it is unlikely that many will be
interested in it.

Personally, I doubt that many clueful person (or ISP) use Blars DNSBL
to block email and I would almost certainly choose option 1.

-wayne

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 00:43:20 -0500

>last modification time on that web page was about a year ago.

First I've heard of it.  So for me it was "now".  Your point?

>rather than the traditional dictionary definition of "blackmail", then

I think that advertising a RBL, getting people to use it, adding 
innocent ISPs to it, and then charging them to get off is pretty 
close to blackmail.

>So what?  Can't people do what they want with their own machines?

Certainly.  I was simply trying to point out that there are serious 
problems with some of the RBLs.  Your point?

>So what?

Oh, nothing.  I thought we were trying to solve problems on this 
list.  Sorry, must have been a wrong number.

>1) Don't bother sending that person (or ISP) email anymore.

Thank God the phone system doesn't work that way.

>    shouldn't be using that DNSBL, but understand that they are under

I'm sure my father would figure that one out on his own.

>    paying that deposit to him.

You're assuming that "I" am someone who runs their own mail server.

Please get real here.

Your father (or grandfather, as the case may be) gets an email bounce 
with some nonsensical garbage in it about being blocked.  He 
complaints to his ISP.  His ISP tries to solve the problem and 
discovers that it's going to cost them several thousand dollars to 
fix the problem.

Now tell me which part of this system is working well?

>to block email and I would almost certainly choose option 1.

In this case, the RBL is used by another RBL.  Osirusoft. Do you 
suppose that people who subscribe to Osirusoft's RBL are aware that 
they are aiding this kind of thing?
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 27 Mar 2003 23:17:19 -0700 (MST)

> We are now getting RBLs ...

It would be better to say "blacklist," "blocklist," DNS blacklist,"
or something else other than "RBL" or "Realtime BlackList" unless
you are talking the real RBL.  It's not only that "RBL" seems
to be a registered trademark or "servicemark" of MAPS, but that 
the other blacklists differ significantly from MAPS's RBL or RBL+.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Esa Laitinen <[email-masked]>
Date: Fri, 28 Mar 2003 12:05:57 +0200

> innocent ISPs to it, and then charging them to get off is pretty 

Sure. And your proof of innocent ISP's getting listed is exactly where?
Notice that proof of listing is not enough. Let us know the IP's
involved so others can decide for themselves if the listing was
justified.

> they are aiding this kind of thing?

How is Osirusoft's bl using blars (pointers, please)? Sure, the www
lookup on Osirusoft's site queries blars as well, but I fail to see any
information regarding Osirusoft's bl using blars.

Yours,

esa

-- 
"I'm really excited by George Bush's latest reason forbombing Iraq: he's
running out of patience. And soam I! For some time now I've been really
p1ssed offwith Mr Johnson, who lives a couple of doors down thestreet."
http://radio.weblogs.com/0114406/2003/03/11.html
YIM: reunaesa ICQ: 160631289 AIM: punkkinen MSN: [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: wayne <[email-masked]>
Date: 28 Mar 2003 08:20:37 -0600

In <p06000d14baa98f13e128@[192.168.1.104]> Kee Hinckley <[email-masked]> writes:

> >>  We are now getting RBLs who [ ... ]
> >
> >If by "now", you mean within the last year or so, then ok.  [ ... ]
> 

My point is that people have been expressing their opinions about spam
sources via DNSBLs for a long time and many of those opinions haven't
been worth the bits they were printed on.  Contrary to your
implication, this is not something new.

> innocent ISPs to it, and then charging them to get off is pretty close
> to blackmail.

I don't think it is at all close to blackmail.  First, Blars isn't
threatening to expose information if you don't pay him money, he *is*
exposing information.  Secondly, there is nothing wrong with charging
people money when those people ask you to do some work.  Third, my
take on his "fees" is that he doesn't want to hear from anyone about
how he runs his blacklist, but it is more effect to say "I will ignore
you unless you pay me big bucks" than "I don't want to hear from you."

> problems with some of the RBLs.  Your point?

I guess the thing that triggered my to respond is that we get enough
proposals to solve spam to this list as is and many of those proposals
have serious problems.  We don't need to bring up every example of
spam "solutions" that are badly implemented.  Shall we start
discussing all the bogus spam content filters that are out there and
somehow use them to imply that all content filters have serious
problems?  What about ISPs that don't enforce the TOSs and AUPs?

Bringing up this DNSBL, implying that it is "new" and calling it
"blackmail" is very close to flame bait.

> Thank God the phone system doesn't work that way.

Uh, the phone system does work that way.  If I call you and you tell
me you don't want to hear from me, I better stop or I will find police
at my door.

> I'm sure my father would figure that one out on his own.

Well, yeah, but the same goes for all other spam filter systems.  

> You're assuming that "I" am someone who runs their own mail server.

I am "real" here.  These are your choices.  Well, I guess I should
have also included "4) switch ISPS".  If some of the choices are too hard
for you, then you need to choose a different one.

Sending email to someone is not a right.  Your ISP probably restricts
you from sending mass mailings to random people.  If you don't like
this restriction, you basically have the same four choices.  If the
destination email address has restrictions, whether DNSBLs or
otherwise, then again you have those four choices.

> they are aiding this kind of thing?

Ok, I was not aware that Osirusoft was using Blars DNSBL, however,
this really isn't that important to me.  My testing of particular
Osirusoft DNSBLs that I actually use show very low false positive
rates.  So, either Blars DNSBL isn't used by those particular
Osirusoft DNSBL, or Blars doesn't block very much valid email.

-wayne

---

From: "Scott Chasin" <[email-masked]>
Date: Fri, 28 Mar 2003 08:44:06 -0700

Does a post-Palladium world provide another perspective on the
successful execution of SMTP-NG?  Is the TCPA (Microsoft) vision of
filtering out unsigned messages relevant to the successful execution of
a new protocol?

"Microsoft claims that Palladium will stop spam, viruses and just about
every other bad thing in cyberspace - if so, then the antivirus
companies, the spammers, the spam-filter vendors, the firewall firms and
the intrusion detection folk could all have their lunch stolen." 
-- http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

..Scott

---

From: [email-masked]
Date: Fri, 28 Mar 2003 10:59:20 -0500

> -- http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html

If there's a buffer overflow in IIS, it will still quite happily execute
in the IIS security context, just as it does now.  What Palladium is REALLY
for is to support DRM - so you can't open your own files unless the vendor's
app says it's OK.

Now combine Palladium with the Kazaa "all your resources are belong to us" EULA,
and you have a distributed spam engine that the user CANT TURN OFF!!

Ouch.

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 28 Mar 2003 10:55:30 -0500

>involved so others can decide for themselves if the listing was

It's very odd that anytime anyone says anything negative about a 
blacklist they promptly get accused of being loose with the facts. 
Doesn't seem to happen on any other topic on this list.

The World. 199.172.62.105.  Do you think Barry's been spamming lately?

>information regarding Osirusoft's bl using blars.

I have seen the bounce message.  The sender was at The World.  The 
receiver said he was using Osirusoft.  Since Osirusoft's web site is 
down, and I don't know their DNS lookup addresses, I'm afraid you're 
on your own for the rest.

Of course, if we follow the typical course of these discussions, the 
IP will no longer be on the blacklist, and you can tell me that I'm 
wrong and that the message actually didn't bounce for that reason.
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 28 Mar 2003 07:04:47 -0500

> filtering out unsigned messages relevant to the successful execution of

  It only works if everyone buys in.

  As a hint to Microsoft: Not everyone in the world is subject to
U.S. laws.  Many people outside of the U.S. even refuse to buy
software or hardware from the U.S. which attempts to enforce U.S. laws
on them.

> every other bad thing in cyberspace -

  I fail to see how running Palladium on my machine will prevent
spammers from sending spam, or me from receiving it.

  Alan DeKok.

---

From: wayne <[email-masked]>
Date: 28 Mar 2003 15:03:03 -0600

> on your own for the rest.

I really don't think this is the place to discuss specific problems
with specific blacklists (or other systems).  However, in order to
help diagnose a specific problem, I would need more details, such as
the complete email of the bounce, including all headers.

Osirusoft runs several different blocklists, so I would need to know
exactly which blacklist the receiver is using.  In particular, if the
sender is using blocktest.osirusoft.com, then it is quite likely that
The World is on the list.

The Osirusoft website is not exactly down, but I have had to try about
10 times to get each web page.  I was able to confirm that
relays.osirusoft.com does not claim to use the blars DNSBL.

You can read Osirusoft's FAQ webpage via googles cache at:
http://216.239.39.100/search?q=cache:KPIM79Ow8X8C:relays.osirusoft.com/faq.html&hl=en&ie=UTF-8

In any case, making a claim that blacklists "are now" charging money
to be added or removed from blacklists is not something that is new.
Nor is this blackmail.  Nor did you explain that the reason you posted
your original email was because of a specific problem.

-wayne

---

From: Esa Laitinen <[email-masked]>
Date: Fri, 28 Mar 2003 23:25:23 +0200

> The World. 199.172.62.105.  Do you think Barry's been spamming lately?

Dunno. There are reports about spam coming from that address space (two
from this year in NANAS). I don't know if they've been too busy (or
unable) to deal with them (or some other, not mentioned in NANAS). The
response from blars bl is 127.1.0.33, which indicates spam sending
domain and hosting spammer web sites. I just wish blars gave more 
information about the listing.

Currently that address is not listed in osirusoft as far as I can tell, 
but it is listed in blars, so I think the reference to osirusoft is 
false.

I ran into a curious snippet of information: apparently Barry isn't too 
worried about a few false positives either, see 
http://www.internetweek.com/story/INW20021219S0003
QUOTE: "The one thing I won't do is spend a remaining minute of our time 
talking about false positives. If we all go down in blazes, I don't care 
any more," Shein said. 

Anyway, it seems that the listing is a bit extreme to my taste, but then 
again I don't have all the facts. But I would like to check into the 
mental state of a person that uses blars for blocking, after reading the 
listing criteria.

> wrong and that the message actually didn't bounce for that reason.

Notice, I didn't claim that you're wrong ;-). But it is quite feasible 
that the message that the bounce has has an error (not the first time 
this has happened).