Subject: RE: [Asrg] Trustic anti-spam system closes down because it doesn 't work

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 5 Aug 2003 17:05:24 -0700

> 	I can imagine groups of kids getting together in IM chat groups
> and deciding to have some fun "shutting down Microsoft" by 
> having large
> numbers of people report their machines as a source of spam. The same
> sort of "community based" attack might be used to shut down the mail
> servers of the Democratic National Committee or some specific 
> political
> candidate shortly before an election... 

This action is a regular occurrence, not a possibility.

The moveon.org list is regularly blocked for this reason, fortunately it is
now large enough to be whitelisted in many places but a lot of sysadmins
with differing political views still block it using the blacklist entries as
an excuse.

I'll bet that symantec is on plenty of blacklists because there are people
who sell pirated symantec products using spam at prices that are a fraction
of retail.

		Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (Justin Mason)
Date: Tue, 05 Aug 2003 18:08:58 -0700

> with differing political views still block it using the blacklist entries as

Is it really, though?  As far as I know, there was an occurrence that
moveon's newsletter was being marked as spam by Razor -- but Razor has
a periodic problem of legit newsletters being marked, for quite a few
newsletters.

(BTW I actually subscribed to it after hearing about it from that
kerfuffle, so they also *gained* subscribers ;)

> who sell pirated symantec products using spam at prices that are a fraction

But I would doubt anyone sane is blocking Symantec themselves, same as
they're not blocking Pfizer ;)

--j.

---

From: Bill Cole <[email-masked]>
Date: Tue, 5 Aug 2003 23:08:50 -0400

>who sell pirated symantec products using spam at prices that are a fraction

Those are 2 very poor examples, given that both organizations have 
sent unsolicited bulk email (yes, real live spam) and so are 
absolutely reasonable to  include on any list of senders of spam. 
That they also send a lot of mail to people who have asked for it is 
of debatable relevance.

Both are also examples of 'targeting' being a wholly inadequate 
substitute for actual affirmative consent. In the specific cases 
where I am directly aware of both Symantec and MoveOn spamming, the 
targets were perfectly reasonable guesses as to what sort of people 
might be interested and open to their solicitations. The targeting 
was as good as could be except for the fact that the targets all 
wished to not get unrequested solicitations via email.

If it was possible to identify spam reliably by its senders and 
content, there would be no need for a research group on spam. 
Codifying existing tools could solve the whole problem. 
Unfortunately, entities like Symantec, MoveOn, Verisign, and a myriad 
of others send identical messages from the same places both to people 
who never consented to that mail and people who actively requested 
it. Fixing that problem is beyond any strictly technical solution.

-- 
Bill Cole
[email-masked]

---

From: Margie <[email-masked]>
Date: Tue, 05 Aug 2003 21:34:07 -0700

> This action is a regular occurrence, not a possibility.

There are over 400 DNSBLs that *I* know about. It would be completely
impossible for it to happen, even ONCE on the vast majority of them.
The criteria for listing on most lists are yes/no bits, such as "is
it an open relay?", "is it an open proxy?", "is it a dynamically
assigned IP address?", "is the IP space in the USA?", "is the IP
address in China?"... "does this mailing list do confirmations?".  

In May, your argument for the demise of DNSBLs was that the root
servers could be attacked because someone could joe them and get them
listed on a DNSBL, now it's censorship of the political lists.
Neither have any basis in reality.

DNSBLs are a tool, and a rather effective one.  I'm not quite sure
what the paranoia is here. IMO, there is as much, if not more, danger
in "censoring" mail with contect filters - particularly the "black
box" types.  Frankly, I don't see the problem with either, as long as
the owners of the server know what they are using and why.

We're here to develop technical solutions to the spam problem. From
where I sit, it's going to take every tool we have and then some to
even approach solving the problem. Speculation, innuendo and FUD
about any tool in the arsenal are counter-productive.

--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=
Margie Arbon                   Mail Abuse Prevention System, LLC
Director of Operations
[email-masked]          http://mail-abuse.org

---

From: "Bob Wyman" <[email-masked]>
Date: Wed, 6 Aug 2003 12:52:40 -0400

Margie Arbon wrote:
> The criteria for listing on most lists are yes/no bits, 
> such as "is it an open relay?", "is it an open proxy?"

	Whatever you may say about "most" of the lists, there remains an
issue with those lists that allow subjective measures to influence their
contents. For instance: a "community based" list which relies on votes
from users rather than objectively testable attributes of the server.
	If subjective opinions are allowed to influence what goes on the
list, then there is an undeniable risk of a "tyranny of the mob" being
established. It is likely that such actions could result in attacks on
political groups, etc. Phil was simply suggesting that such attacks have
actually occurred in the past. 

> IMO, there is as much, if not more, danger in "censoring" mail 
> with contect filters - particularly the "black box" types.
	You are, of course, correct. As you acknowledge, there is a
danger that DNSBLs will be used to "censor" traffic on the net -- one
may argue whether this danger is greater or less than the danger of
censorship that is presented by content filters, nonetheless, it is
important to acknowledge that the danger exists. Just as the dangers of
content filters have been discussed in this group, it is appropriate
that we should discuss the danger of censorship that can come from
DNSBLS. 

		bob wyman

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Margie
Sent: Wednesday, August 06, 2003 12:34 AM
To: [email-masked]
Subject: RE: [Asrg] Trustic anti-spam system closes down because it
doesn 't work

There are over 400 DNSBLs that *I* know about. It would be completely
impossible for it to happen, even ONCE on the vast majority of them. The
criteria for listing on most lists are yes/no bits, such as "is it an
open relay?", "is it an open proxy?", "is it a dynamically assigned IP
address?", "is the IP space in the USA?", "is the IP address in
China?"... "does this mailing list do confirmations?".  

In May, your argument for the demise of DNSBLs was that the root servers
could be attacked because someone could joe them and get them listed on
a DNSBL, now it's censorship of the political lists. Neither have any
basis in reality.

DNSBLs are a tool, and a rather effective one.  I'm not quite sure what
the paranoia is here. IMO, there is as much, if not more, danger in
"censoring" mail with contect filters - particularly the "black box"
types.  Frankly, I don't see the problem with either, as long as the
owners of the server know what they are using and why.

We're here to develop technical solutions to the spam problem. From
where I sit, it's going to take every tool we have and then some to even
approach solving the problem. Speculation, innuendo and FUD about any
tool in the arsenal are counter-productive.

-- =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=
Margie Arbon                   Mail Abuse Prevention System, LLC
Director of Operations
[email-masked]          http://mail-abuse.org