Subject: Re: several messages

From: Matthias Leisi <[email-masked]>
Date: Tue, 11 Nov 2008 07:28:55 +0100

[trimmed the Cc: list]

Dean Anderson schrieb:

> In fact, the people who use these DNSBL blacklists do so only for a
> short time, until they get burned and stop using them. That's what

Where do you get this "fact" from? I'd be very interested to learn about
this, because I see overwhelming evidence of the contrary - that well
managed DNSBLs are used by all but a minority of email receiving systems.

> happens routinely with SORBS.  I call a few people a month about SORBS.  
> Very little mail is actually blocked by most of these lists. But what
> little that is blocked is blocked in error. 

Can you back up this statement with some data?

> In the 1990s, I found ORBS and Osirusoft scanning for open relays and 

We have 2008. I don't think that some misguided individuals back in the
1990s have a lot of significance to the Internet of today.

> But DNSBLs can't solve the problem when spam is sent via botnets. By the

The Spamhaus XBL and Spamhaus PBL are pretty useful in denying
connections from botnets. You should try them - in the arsenal of
spam-fighting tools, they are the probably most effective ones.

-- Matthias

_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Steve Linford <[email-masked]>
Date: Tue, 11 Nov 2008 09:12:35 +0000

Ehm, I don't think I want to enter into the 'issues' in Mr Anderson's  
post, but I do like his "I hate John Levine" web page, I think all of  
those who become graced with their own "I hate you" ranting web page  
have verifiably achieved greatness (well done John ;)

This bit though I can elaborate on:

>>> Unlike you, I don't see "overwhelming community consensus for
>>> this mechanism".
>>
>> Aw, come on.  There's a billion and a half mailboxes using the
>> Spamhaus DNSBLs, on systems ranging from giant ISPs down to hobbyist
>> Linux boxes.
>
> This 1.5billion number is just more unsubstantiated BS.

Actually that is user numbers we have signed contracts for (i.e:  
contractually-declared numbers of end users of the Spamhaus Datafeed  
service), the actual figure being 1,425,440,000 users currently. I  
would  say that is a level of usage that strongly suggests  
"overwhelming community consensus for this mechanism".

   Steve Linford
   The Spamhaus Project
   http://www.spamhaus.org

---

From: Peter Dambier <[email-masked]>
Date: Tue, 11 Nov 2008 15:11:55 +0100

Hi Steve,

sorry to mention spamhaus again,
but that is the reason why many german and especially austrian
mailoperators had to give up blacklisting completely and turned
to graylisting.

Greylisting is mostly the same as blacklisting except you dont
depend on somebody else to maintain the list.

As one of my clients has put it:

"The makers behind a blacklist feel like god because they decide
live or death of an email address. The users of this list believe
it too and that is why they never understand how a blacklist could
ever see the end of its live. God is eternal and so must be his
blacklist. As happened once and again mailers break their sysop
breakes too and nobody knows who ever turned their mailers to use
this particular blacklist."

When we could not exchange emails with atnic for quite some time
we had to very quickly switch from blacklist to greylist. We did
not have a reason to switch back.

The girl who runs the mailer is mostly the girl who empties the
wastepaper baskets and sweeps the court. She does not live long
enough in a company to touch that mailer more than once. The next
girl who comes to touch the mailer has not even heard about
blacklists.

Kind regards
Peter

Steve Linford wrote:
> would  say that is a level of usage that strongly suggests "overwhelming
> community consensus for this mechanism".
> 
>   Steve Linford
>   The Spamhaus Project
>   http://www.spamhaus.org
>  
>  

-- 
Peter and Karin Dambier
Cesidian Root - Radice Cesidiana
Rimbacher Strasse 16
D-69509 Moerlenbach-Bonsweiher
+49(6209)795-816 (Telekom)
+49(6252)750-308 (VoIP: sipgate.de)
mail: [email-masked]
http://www.peter-dambier.de/
http://iason.site.voila.fr/
https://sourceforge.net/projects/iason/
_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Steve Linford <[email-masked]>
Date: Tue, 11 Nov 2008 15:27:08 +0000

On 11 Nov 2008, at 15:11, Peter Dambier wrote:

> mailoperators had to give up blacklisting completely ....

I do not think it is productive to use this [email-masked] list for  
personal rants which have nothing to do with either the IETF or DNSBL  
technologies.

   Steve Linford
   The Spamhaus Project
   http://www.spamhaus.org

---

From: Keith Moore <[email-masked]>
Date: Tue, 11 Nov 2008 10:42:49 -0500

> personal rants which have nothing to do with either the IETF or DNSBL

perhaps not, but if an organization can make assertions about the
quality of its services in support of a standardization question, then
surely it's also okay for users of those services to state their own
experiences.

Keith

---

From: der Mouse <[email-masked]>
Date: Tue, 11 Nov 2008 00:40:44 -0500 (EST)

> happens routinely with SORBS.

If SORBS is your idea of a best-of-breed DNSBL, I can understand your
scorn.  But it's not.  You want to see a DNSBL done right, go look at,
say, the Spamhaus lists.  Their Zen list is one of the best available,
perhaps even _the_ best, for general-purpose use.

> then abusing them.  I discovered this by setting up open relays,
> logging TCP connections, and submitting the relay to the blacklist.
> After the blacklist scanned the relay, it began getting abuse with no
> further scanning.

How long was it between setup and submitting?  Between submitting and
abuse?  I regularly see attempts to abuse hosts that do not run mailers
and never have; I believe there is malware out there that is basically
trying random - or, occasionally, sequential - addresses to discover
open relays.  While I would be one of the last to defend a DNSBL that
"tests" hosts, I think what you saw is more likely evidence of the
relay being discovered independently than of a feed from the DNSBL to
the spammers.

> But DNSBLs can't solve the problem when spam is sent via botnets.

That's actually true, but not for the reason you imply.  DNSBLs can't
solve the problem _at all_; it's a social level problem and requires a
social level solution.  Wnat DNSBLs do is mitigate the damage so that
we have at least middling-usable email while solutions evolve at the
social level.

Furthermore, you appear to think that all DNSBLs are reactive in
nature.  This is not true; there are at least a few DNSBLs that
proactively list "large indistinguishable pool" addresses.  In at least
one case, the pools are submitted to them by the providers that run the
pools.  Using such a list puts a substantial crimp in direct-to-MX
spamming.

> If the sending site uses a static IP address that stays static long
> enough to be listed in a DNSBL, it probably isn't unsolicited spam.

"Probably"?  What is it you are saying the probability of is high?
(Precision is important; there are reasonably plausible interpretations
of what you wrote that are almost tautological and there are other
reasonably plausible interpretations that are nowhere near true.)

There aren't many addresses, as a fraction of the Internet, that are
statically assigned and send spam.  But the fraction is definitely
nonzero, and they tend to send a lot.  DNSBLs work very well indeed
against those.

DNSBLs are not a magic bullet.  But they are one of the more useful
tools - one of the few that is still useful even with large swaths of
the net using it.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 11 Nov 2008 17:17:51 -0500

> we have at least middling-usable email while solutions evolve at the

I should also point out that that his original reason (BOTs re-DHCP'ing
themselves too quickly for DNSBLs to be effective) simply isn't borne
out by experience.

Many ISPs force DHCP IP-affinity significantly, and it's kinda hard for
most BOTs to force their cable modem/access router/whatever (which is
the real holder of the DHCP address) to refresh.  But beyond that, it's
our experience that most BOTs emit from the same IP for at least a day
or two, and it's entirely common to see the same IP emitting from the
same BOT for weeks and in some cases for 6 months or longer.  Often
multiple BOT types at the same time, emitting different campaigns. etc.

We are using technology that detects many BOTs (eg: Srizbi, Storm,
Cutwail etc) in real time - about 70% of all "infected PC" spam is
identifiable in our implementation.  The CBL is purported to target the
same sorts of things.  It's been our experience that if we had been
forced to rely on the CBL alone and not our real-time detection, we'd
"miss" at most 10% of the BOT spam (ignoring all other detection
methods), and usually closer to 2-3%.  That's an impressive success
rate, and disproves any notion that DNSBLs are inherently too slow for BOTs.

[Our sample size is on the order of 20M-50M emails per day.  So I don't
think we suffer from being too small to infer useful results from.]
_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Mark Andrews <[email-masked]>
Date: Wed, 12 Nov 2008 09:42:40 +1100

In message <[email-masked]>, der Mouse write
> pools.  Using such a list puts a substantial crimp in direct-to-MX

	And the providers lie in those list.  I know my provider
	lies yet I can't get the list operator to remove the entry
	or the provider to provide truthful data.

	The address is listed as "not supposed to be sending email".
	The provider blocks port 25 outbound by default and has a
	remove block support that doesn't remove the address from
	the list when the port filter is removed.

	Mark
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: der Mouse <[email-masked]>
Date: Tue, 11 Nov 2008 17:54:01 -0500 (EST)

>> proactively list "large indistinguishable pool" addresses.  In at
>> least one case, the pools are submitted to them by the providers
>> that run the pools.  Using such a list puts a substantial crimp in
>> direct-to-MX spamming.
> And the providers lie in those list.  [...port-25-block removal which
> doesn't remove from the DNSL data...]

Time to switch providers, I'd say.  But in any case, that's the fault
of the provider in question, not of the DNSBL, or of DNSBLs as a class.
The DNSBL is doing just what it told its users it would do - list
blocks reported to them by providers - and your issue, as reasonable
and serious as it is, is between the provider and you, or the provider
and the DNSBL, depending on and who's made what claims to whom and
which way you prefer to squint your mind.

Unless that _isn't_ what the DNSBL tells its users it will do....

/~\ The ASCII				  Mouse
\ / Ribbon Campaign

---

From: Mark Andrews <[email-masked]>
Date: Thu, 13 Nov 2008 11:10:11 +1100

In message <[email-masked]>, der Mouse write
> of the provider in question, not of the DNSBL, or of DNSBLs as a class.

	It a fault of *both*.  The DNSBL operator should be trying to
	get good data and when it knows the data is bad it should pull
	the data and/or request the the provider fix the data it is
	sending.  Both parties need to be accountable.