Subject: RE: [Asrg] draft-irtf-asrg-bcp-blacklists-00

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 5 May 2004 07:16:04 -0700

> Because you probably won't continue to block their messages, once they
> (for example) start spewing through the zombie armies.

It is completely illogical to block mail from a provider because
they have a zombie on their net. There is not a single ISP in this
country who could guarantee that they did not have any.

The way to deal with zombies is to have a better response protocol
to put ISPs on notice that they have a problem with a particular
address. Most ISPs do not want to be hosting zombies on their net 
and they will kill them the moment they find out about them. That
is if the comunication reaches the right part of the company.

Blacklisting zombies is certainly legit. But blacklisting every other
user of that ISP is not.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Devdas Bhagat <[email-masked]>
Date: Wed, 5 May 2004 20:34:54 +0530

> country who could guarantee that they did not have any.
Practically no one does that. Responsive ISPs are whitelisted, or at
least not blackholed.

> address. Most ISPs do not want to be hosting zombies on their net 
[email-masked] is designated for that purpose.

> is if the comunication reaches the right part of the company.
A lot of ISPs do not kill infected PCs. That is the part of the 
fundamental problem with zombies.

> Blacklisting zombies is certainly legit. But blacklisting every other
With dynamic IPs, I don't know what IP the zombie has next time. So I
just hit the /24. It seems to work quite well. (And I whitelist my
frequent senders so that there are no DNSBL lookups done for those
hosts).
Would you rather that the smarthosts provided by the ISPs be
blacklisted?

Devdas Bhagat

---

From: Seth Breidbart <[email-masked]>
Date: Wed, 5 May 2004 12:31:40 -0400 (EDT)

> country who could guarantee that they did not have any.

However, there are some who take action to block and clean the zombie,
and others who don't.

> and they will kill them the moment they find out about them.

For a rather small value of "Most ISPs", at least based on the content
of my mailbox.

> That is if the comunication reaches the right part of the company.

I don't have time to throw a brick through the CEO's home window with
the IP written on it for every zombie spam I get.

Merely sending a complaint to the published abuse address often leads
to no action at all, beyond perhaps and auto-ignorebot response.

> Blacklisting zombies is certainly legit. But blacklisting every
> other user of that ISP is not.

Since when do you get to define "legit"?  My toys, my rules; blocking
whatever I feel like blocking is legit, and if you don't like it feel
free not to buy service from me (as if you could in the first place).

Taking action to move the pain back to the non-responsive ISP is
legit and appropriate.  If you don't want that to hurt you, don't be
(a customer of) such an ISP.

Seth

---

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Wed, 05 May 2004 12:33:36 -0400

On Wed, 5 May 2004 07:16:04 -0700, Hallam-Baker, Phillip wrote:
>they have a zombie on their net.

As a first step, yes, it is inappropriate, and that should be part of
the practice.

>There is not a single ISP in this

Not relevant.  The issue is not "any"; it is one of continued patterns
of abuse after proper notification

>and they will kill them the moment they find out about them. 

Yes but as you admit some do nothing.  Those are the ones
who need to be blacklisted into action (or bankruptcy, because
they are profiting from the environmental-polluter business model.)

>That is if the comunication reaches the right part of the company.

In some companies there is no 'right part' because the management
decides to dump their problem on the spam/trojan/virus/worm victims,
rather than fixing it inhouse.   Management chooses to be a
polluter, and they should accept the consequences.   We should

>Blacklisting zombies is certainly legit. But blacklisting every other

Like all other complicated human situations, it depends on the 
facts of the situation.

Jeffrey Race

---

From: Bill Cole <[email-masked]>
Date: Wed, 5 May 2004 21:55:47 -0400

At 7:16 AM -0700 5/5/04, Hallam-Baker, Phillip wrote:
>  Most ISPs do not want to be hosting zombies on their net

That may be true in a trivial sense (because there are more small 
ISP's than big ones) but it is not true that the ISP's hosting the 
largest numbers of zombies act that way. I know for a fact that at 
least one of the largest broadband providers in the US does NOT do so 
as a matter of intentional considered policy because they do not have 
the support resources to handle all the calls they would get if they 
cut off zombies as fast as they can identify them. This seems a very 
likely business condition for most of the similarly situated ILEC and 
cable providers who act as if they have an obligation to service 
customers no matter what, much as they may be legally required to do 
in their older lines of business. Whether that tendency is really a 
legal issue (as some ISP abuse staff of dubious legal credentials 
have implied to me) or is a matter of not wishing to trigger a legal 
test or is simply an issue of corporate culture, I cannot say.

-- 
Bill Cole
[email-masked]

---

From: "Dr. Jeffrey Race" <[email-masked]>
Date: Thu, 06 May 2004 08:30:41 -0400

On Wed, 5 May 2004 21:55:47 -0400, Bill Cole wrote:
>I know for a fact that at 
>cut off zombies as fast as they can identify them. 

You have precisely stated the Environmental Polluter Business Model: 
internalize the profits; externalize the costs.    These are the firms which
must be motivated to reform, or else driven out of business.

Jeffrey Race