Subject: RE: [Asrg] Lets Fix Mailing Lists

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 9 Mar 2003 08:21:11 -0800

> Search news.admin.net-abuse.{sightings,email} and you'll find reports
> about mail that was not forged in any sense and by people who do not
> seem to have a habit of lying.

No, you made the assertion. It is up to you to supply the evidence.
Go search some mailing list is not a valid means of supporting such
a claim.

> >                                     on what evidence I have no
> > idea. ALL the spam purporting to come from hotmail that I have
> > checked has been forged. That is 100%, not 10%. Same for yahoo.
> 
> How do you check to see that a message with Hotmail or Yahoo envelope
> or header From value is forged?  That the IP address of the 
> SMTP client
> sending the message is not Yahoo's or Microsoft's does no 
> imply anything
> about the question.  That the IP address is that of an open relay or
> proxy also does not say whether the headers are forged.

Ah I get it, you think that Microsoft would engage in an easily 
detected criminal activity and nobody would have reported it to
the press by now. That does not seem very likely to me.

I have seen more plausible stories on alt.conspiracy.

More likely is that something like what this 419 fraud reporting 
site describes is going on:

[SPAM-FREE SITE
We do NOT spam. Various multi-level marketers and other criminals have
recently sent out spam impersonating us, and having our return e-mail
address, so that people would complain about spam and cause us to be shut
down (a/k/a "joe job"). These multi-level marketers and other criminals have
engaged in this form of cyber-terrorism because our telling the truth about
their fraudulent schemes was hurting their ability to sell to new victims.
Fortunately, our ISP now recognizes that these fake spams are bogus and
ignores them, and additionally we are duplicating this site on numerous
other servers (including "hardened" servers as well as our own proprietary
servers) so that we cannot be harmed by these multi-level marketers and
other criminals. Death to Spammers!]

>   - "SPEWS recently listed the whole of UUNET."

Sorry, that did actually happen. One of the servers hit by that blacklisting
was one of our own servers that hosts a bunch of IETF mailing lists out of
VeriSignLabs. People were demanding that we move to an ISP that was not
blacklisted. We sent out messages telling people to stop using a blacklist
run by anonymous cretins.

	Phill
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 9 Mar 2003 10:01:34 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> Go search some mailing list is not a valid means of supporting such

So I'm required to prove my statements but your false statements
not only don't need support but should go unchallenged?  Ok, here
is a sample report:
http://groups.google.com/groups?selm=as0jbj%246ot%242%40rainier.uits.indiana.edu

> I have seen more plausible stories on alt.conspiracy.

That is a gross and knowning misrepresentation.

> other criminals. Death to Spammers!]

That also happens.  That it does happen does not disprove my claim
that most so called header forgery is nothing of the sort.

> run by anonymous cretins.

Why should I believe that statement without independent support?

You surely know that many Verisign domain names are blacklisted because
of Verisign's long history of sending unsolicited commercial advertising
bulk email.  (I've records of Verisign spam sent to my addresses.)
It seems more likely that someone expanded a blacklist of Verisign
domains or addresses to cover VeriSignLabs.com.

Please note that I do recall hearing that the people running SPEWS have
made errors that blacklisted large chunks of the IPv4 address space
for hours by getting netmasks wrong.  However, because UUNET has so
many numerically or netmask-unrelated addresses, I doubt those errors
affected "the whole of UUNET."  Moreover, they were quite temporary.

Note also that I'm not a fan of SPEWS.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg