Subject: [Asrg] 6. Proposals - DNSRBLs

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 28 Aug 2003 17:30:50 -0400

Just to follow up on the previous post regarding the shutdown of OsiruSoft, 
the Boston Globe is reporting 
(http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_blockers/) 
that a distributed DDOS attack that targeted OsiruSoft and SPEWS, is 
targeting many other black-lists as well.

Yakov 

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Hector Santos" <[email-masked]>
Date: Fri, 29 Aug 2003 00:22:23 -0400

I hope the FBI is on the case.   This is the worst 2-3 weeks I have ever
seen!   We are not a "RBL" but our software has it been in and we have over
60,000 customers world wide!  We are getting hit hard and many customers are
reporting the same!    I just installed a honeypot to begin complete data
collection.  It is REALLY BAD out there!

With that said, I personally always view the RBL to be a double-edge sword.
While it help stop spammers, at the same time, the database was an open
source for spammers to easily find open relays and proxies.  In other words,
if I wanted to become a spammer tomorrow, all I need to do is get the RBL
database (which is downloadable at some sites) and easily find thousands of
relays/proxies with little or no effort on my part.

I have discussed this some of the spews people.  We agreed that is an
problem, however, the hope is that as more and more systems begin to use
RBL, then the spammers having the database isn't so much a problem.

I agree with that idea and quite possibly with the recent news more of the
"big boys" including Microsoft, AOL, YAHOO, etc to begin using RBL systems,
the spammers felt it was time to go on the offensive by attacking the sites
NOW.   They have tried to stop them legally and that has failed.

--
Hector Santos
WINSERVER "Wildcat! Interactive Net Server"
http://www.winserver.com

----- Original Message ----- 
From: "Yakov Shafranovich" <[email-masked]>
To: <[email-masked]>
Sent: Thursday, August 28, 2003 5:30 PM
Subject: [Asrg] 6. Proposals - DNSRBLs

> the Boston Globe is reporting
(http://www.boston.com/news/nation/articles/2003/08/28/saboteurs_hit_spams_b
lockers/)

---

From: Esa Laitinen <[email-masked]>
Date: Fri, 29 Aug 2003 12:03:14 +0300

> relays/proxies with little or no effort on my part.

I don't think spammers have had any problems in finding abusable 
systems, be it proxies, open smtp servers or broken cgi-scripts.

And if being on a bl means more spammers use the system, well, that is 
only for the better: the system is more likely to get fixed if it gets 
overrun by spammers.

esa

-- 
PGP Fingerprint: 8C4D 4F5C 1094 5E00 D575  11B2 9412 AD93 7F78 EF7E
Public key at: http://iki.fi/laitinen/pubkey.html
YIM: reunaesa ICQ: 160631289 AIM: punkkinen MSN: [email-masked]

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 29 Aug 2003 12:31:15 -0400

As somebody has mentioned before, having local copies of a DNSRBL's 
database might something that is needed to counteract this problem. The db 
can be posted to NANAE for example.