Subject: SORBS blacklist

From: John Leslie <[email-masked]>
Date: Fri, 1 Jul 2011 07:48:34 -0400

Hey, folks!

   mail.ietf.org[64.170.98.30] got listed on SORBS for spamming.

   It's not that hard to get off... Fix it!

--
John Leslie <[email-masked]>

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 1 Jul 2011 09:09:22 -0700

>   It's not that hard to get off... Fix it!

It's also not that hard not to use poorly-managed blacklists. Just sayin'....

--Paul Hoffman

---

From: David Morris <[email-masked]>
Date: Fri, 1 Jul 2011 09:46:45 -0700 (PDT)

> It's also not that hard not to use poorly-managed blacklists. Just sayin'....

And from my own experience, I know it can be impossible to get removed
from SORBS if you are a small business subject to the whims of their
ISPs. AFAIK, no spam has ever originated from my networks but SORBS didn't
like something about my network addresses. I tried jumping through their 
hoops but it was impossible.

---

From: John Leslie <[email-masked]>
Date: Fri, 1 Jul 2011 12:59:12 -0400

> It's also not that hard not to use poorly-managed blacklists. Just sayin'....

   I'm _really_ poor at flame-wars, but Paul is begging here...

   It's exceptionally hard for folks to avoid poorly-managed blacklists
when the incoming-email setup isn't under their control. (Not true for
me, of course, nor for my customers if they think to ask.)

   IMHO, it's entirely reasonable to use even poorly-managed blacklists
as input to spam-assassin. And it's not up to _you_ to say what the
scoring algorithm should be for one of my customers.

   Also, it's really not rocket-science to log the 550 replies to
mailing-list distribution attempts: these _will_ accumulate quickly
if something the size of mail.ietf.org gets on a blacklist (poorly-
managed or otherwise).

   The state-of-the-art in spam-abatement is far short of what it
should be. Folks who receive 100 spams per day tend to ask for more
aggressive spam-abatement, and it's not good business to refuse.

   Also, poorly-managed is in the eye of the beholder. sorbs.net is
among the mainstream, alas; and while _I_ won't argue whether they're
well-managed, there are plenty of folks who will.

   I recommend against blanket "blame-the-receiver" policies. I have
customers that have received over 6,000 spams per day when I turned
off "all" spam-abatement for them: that's far beyond reasonable
"blame-the-receiver" territory. They _must_ do something, and I'm
not going to criticize what they do.

   Please, everyone, understand that recipients _can't_ do the whole
job on spam-abatement. Folks running mailing-lists for organizations
like the IETF need to do their part, and are in a better position
than some of my customers to bear the cost.

   (BTW, I did get a ticket in the system _well_ before my posting
here. I won't quote the reply; but I think it would be helpful for
the folks who process such tickets to post on this thread.)

---

From: John Leslie <[email-masked]>
Date: Fri, 1 Jul 2011 13:08:22 -0400

David Morris <[email-masked]> wrote:
>>... 

   A reasonable contribution to this discussion. Indeed, a number of
folks have complained similarly.

   Alas, that's not enough for me to refuse to use SORBS for my customers
who ask for it. (I hear other reports of success at getting removed --
in particular, I have been told that mail.ietf.org has succeeded.)

   But my actual reply is to repeat that receivers can't bear the entire
cost of weaknesses in spam-abatement. If you wish to run a serious
mailing-list operation, you need to do your part.

   (BTW, I've never had trouble "fixing" blacklisting here -- but I do
change IP addresses if the "response" isn't fast enough...)

---

From: Joel Jaeggli <[email-masked]>
Date: Fri, 1 Jul 2011 10:10:21 -0700

> than some of my customers to bear the cost.

the ietf has some of the more heavily and consistently moderated mailing lists on the planet. the notion that we're not doing our part or that the ietf lists are a source or relay for spam is patently false.

joel

> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Kurt Zeilenga <[email-masked]>
Date: Fri, 1 Jul 2011 10:39:13 -0700

On Jul 1, 2011, at 10:10 AM, Joel Jaeggli wrote:

> the ietf has some of the more heavily and consistently moderated mailing lists on the planet.

but how well does the IETF do in not producing email in response to SPAM?   Seems the IETF generates a lot of backscatter, and aside from scattering this to individual boxes all over the Internet, it's going to scatter into various spam traps… and that's likely to cause a listing in any services that use spam traps.  Those who implement spam traps do put filters on them, so that commonly produced bounces don't cause listing, but it's had to deal with the many custom bounce messages (especially ones which don't use standard headers to indicate they are auto-generated).

Has anyone examined all the various sorts of auto-generated messages the IETF produces to make sure they are reasonably detected as auto-generated messages?

That should be part of us doing our part to help deal with SPAM.

-- Kurt

---

From: Paul Hoffman <[email-masked]>
Date: Fri, 1 Jul 2011 10:58:09 -0700

>   I'm _really_ poor at flame-wars, but Paul is begging here...

Actually, no I wasn't. People in the email world who know me know that I leave flamewars about spam before they even flicker.

What I am questioning is the notion that the IETF should spend money trying to avoid damage being done by popular but poorly-run services of any type. We could be having this argument about the IETF web site and a browser that will put up a warning if the HTML on a page is not fully compliant. I think you and I simply disagree on where it is useful to put IETF resources.

> job on spam-abatement.

No one said they should. There is a huge difference between "recipients must do the whole job" and "recipients who choose poor tools should not expect the rest of the internet to try to work with their poor choices". It really is OK for us to say "there are better choices out there".

--Paul Hoffman

---

From: Joel Jaeggli <[email-masked]>
Date: Fri, 1 Jul 2011 11:04:15 -0700

> That should be part of us doing our part to help deal with SPAM.

I watch all the bounces for about half a dozen of  the high traffic lists.

One of the more annoying things I see is bounces from subscribed members due to the sender being listed somewhere. when this happens with frequency those particapants that bounce messages to mailman get ejects from the list... We don't have the luxury of just ejecting someone from list because the source ip they are using today is listed in spamhaus but if you recject enough mail from us you're going to fall off.

Honestly I think the backscatter is frankly rather low as a purportion of net volume but the volume is large.

A busy day on the ietf discuss list bursts out to a few hundred thousand messages however, for a single list.

---

From: Keith Moore <[email-masked]>
Date: Fri, 1 Jul 2011 14:33:30 -0400

> scoring algorithm should be for one of my customers.

blacklists are the email version of terrorism, holding people's email service hostage in exchange for arbitrary tribute.

Keith

---

From: "John Levine" <[email-masked]>
Date: 1 Jul 2011 18:36:49 -0000

> Alas, that's not enough for me to refuse to use SORBS for my
> customers who ask for it.

There are a few blacklists that are well enough run to be worth
expending effort to find out why you're listed and get removed.  SORBS
used to be one of those lists, but hasn't been at least since Michelle
sold it.

If your customers want to use SORBS, and as a consequence reject mail
from the IETF that they want to receive, that is their problem, not
the IETF's.

R's,
John

---

From: Joel Jaeggli <[email-masked]>
Date: Fri, 1 Jul 2011 11:38:37 -0700

This rathole does not require further exploration.

joel