Subject: Abusive blacklist

From: Dean Anderson <[email-masked]>
Date: Tue, 11 Jan 2005 10:30:39 -0500 (EST)

Terry, you are using an abusive "blacklist".  SORBS, like ORBS, has no 
qualms about lying about those they don't like.

In our case, they don't like the fact that I revealed their secret spam 
support operations. (They scan for open relays and then give that 
information to abusers.)

Anyway, one can easilly see that 130.105/16 is not hijacked, nor is
198.3.136/21 hijacked.  Neither registrant is out of business.  The false
claims of hijacking came from Alan Brown (of ORBS infamy) who was found in
court to be a liar, engaging in defamation and false statements against
ISPs he didn't like, for he personal financial benefit.  Alan Brown and
Matthew Sullivan are not authoritative for the registrations and have no
authority to make any kind of statement about their registration.

People who are genuinely interested in anti-spam should shun those who use
such tools for personal attacks. (The Judge in one of the ORBS cases noted
also that Brown was using false ORBS listings as a personal attack, not
based on any genuinely held belief.)

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

---------- Forwarded message ----------
Date: Mon, 10 Jan 2005 14:44:29 -0500
From: Mail Delivery Subsystem <[email-masked]>
To: [email-masked]
Subject: Returned mail: see transcript for details

The original message was received at Mon, 10 Jan 2005 14:44:18 -0500
from dakota.av8.net [130.105.19.131]

   ----- The following addresses had permanent fatal errors -----
<[email-masked]>
    (reason: 553 5.3.0 <[email-masked]>... Message from 130.105.36.66 rejected - see http://www.dnsbl.us.sorbs.net/cgi-bin/lookup?IP= 130.105.36.66)

   ----- Transcript of session follows -----
... while talking to mail.ashtonwoodshomes.com.:
>>> DATA
<<< 553 5.3.0 <[email-masked]>... Message from 130.105.36.66 rejected - see http://www.dnsbl.us.sorbs.net/cgi-bin/lookup?IP= 130.105.36.66
550 5.1.1 <[email-masked]>... User unknown
<<< 503 5.0.0 Need RCPT (recipient)

Subject: RE: blowback, was A new SMTP "3821" [Re: FTC stuff...........]
From: Dean Anderson <[email-masked]>
To: [email-masked]
Cc: [email-masked], <[email-masked]>
Date: Mon, 10 Jan 2005 14:44:16 -0500 (EST)

On Sun, 9 Jan 2005 [email-masked] wrote:

> 
> Agreed, but near sighted.  If the sending MTA had done some sort of validation to ensure the message
> was not forged when it accepted it, then we wouldn't have a blowback problem.  You cannot blame
> subsequent MTA's in the path for detecting and rejecting bad email when its something the first hop
> MTA could (and should) have done in the first place!

And just what sort of validation would that be?

You are talking about a normal closed relay. It cannot use SPF to validate 
its own users.

> His point I think is that if the virus is trying to send directly to the MTA it would get rejected
> with no bounce back (because the virus wouldn't process a bounce).
> 
> If an MTA.1 accepted a virus message, and tried relaying it to MTA.2, when MTA.2 rejects it as
> forged, and MTA.1 processes a bounce, well, NO SYMPATHY FOR MTA.1, it should have taken steps to
> prevent the virus/forgery etc from being accepted by itself in the FIRST PLACE.

Your lack of sympathy for MTA.1 is unfortunate, but unrealistic.  Even
taking steps to prevent viruses does not catch all virues.  Even using
SMTP AUTH on a closed relay does not prevent forgery.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Arnt Gulbrandsen <[email-masked]>
Date: Tue, 11 Jan 2005 17:35:34 +0100

Dean Anderson schrieb:
> In our case, they don't like the fact that I revealed their secret 
> spam support operations. (They scan for open relays and then give 
> that information to abusers.)

Do you mean that they give the information to the general public, 
abusers included, or do you mean something else?

Arnt

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 11 Jan 2005 14:27:11 -0800 (PST)

> abusers included, or do you mean something else?

I think Dean meant that they scanned for open relays and compiled blacklist
and made that blacklist available for general public including by zone 
transfer (i.e. abuser could easily get entire list). That is not an issue
any more as almost nobody runs open relay any more and abusers have moved
to other ways to distribute spam (which are even worth - now instead of
simply using somebody elses resources without authorization to relay through
they are hacking and taking over somebody elses machine with specialized
viruses to do that).

-- 
William Leibzon
Elan Networks
[email-masked]

---

From: Dean Anderson <[email-masked]>
Date: Thu, 27 Jan 2005 21:19:17 -0500 (EST)

On Tue, 11 Jan 2005, william(at)elan.net wrote:

> transfer (i.e. abuser could easily get entire list). 

I thought it might have been unintentional leakage back in 1999. But I
don't think it was unintentional anymore, for a number of reasons.  On
several occassions, open relay abusers were tracked back to open relay
"anti-spammers". In one case, a particularly persistent abuser was fired
from his job as an abuse desk person at a large ISP. He posted his
diatribe to spam-l, blaming me for his termination.  Even after pointing
out their contibution to open relay abuse, Open relay blacklists made no
attempt to limit access to information Also, no genuine commercial
spammers were ever found abusing open relays. Open relay abuse was always 
nonsense: it wasn't genuinely commercial.

And the final clincher is that open relay abuse dropped off to almost
nothing after the open relay blacklists closed.  If people not associated 
with the blacklists were doing to the abuse, they would have found other 
sources. The abusers quit the same time the blacklists quit.  

> That is not an issue any more as almost nobody runs open relay any more
> and abusers have moved to other ways to distribute spam 

Actually, there are just as many or more open relays as there has ever
been. The change was that the open relay blacklists have shutdown.  The
decline of open relay abuse correlates with the shutdown of those
blacklists.