Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article

From: Jason Steiner <[email-masked]>
Date: Tue, 12 Aug 2003 09:48:17 -0700

"Yakov Shafranovich" <[email-masked]>
> 
> Any kind of auditing or control over the inner procedures of a black
> list would improve the situation. 

I dispute this. Blocklists have reputations, even if that reputation is 
no reputation at all, and anyone who does a minimal amount of 
research can find out what that reputation is. If you don't like a 
blocklist's reputation, don't use it. 

Do we really need an auditing organization to tell us that SPEWS
has no contact information and lists more than just the spammer?
Of course not. So what is the real goal of proposals for auditing 
organizations? 

To make sure that every blocklist follows the same standards, which
just so happen to be the preferred standards of the person making
the proposal! But that defeats the whole purpose of having multiple
blocklists. And it would be far easier to start a new blocklist that 
actually embodied those standards than it would be to start a
organization intended to enforce those standards on other blocklists
that might well disagree with them.

> A rating system would not be sufficient since it has potential for 
> abuse. We would need someone to audit the blacklists, 
> something like the Truste seal program for privacy. Or perhaps 
> just a reliable auditor like a major accounting or security company, 
> maybe even ISO 9002 (although with Enron and Arthur Andersen 
> story that might not be reliable enough).

Exactly. And Truste's reliability isn't all that great either.

> All we need is that a third impartial party has examined the procedures
> of  the blacklist. Unfortunatly that is not being done today.

Where are you going to find a truly impartial third party, and who's
going to make sure that they stay impartial? Where will we find these
angels to rule us?

I submit that any anti-spam proposal that requires some centralized, 
incorruptible, and totally impartial authority is fundamentally unworkable.
They do not exist, and even if they did, a centralized organization would
be too big a target to escape eventual corruption.

jason

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Wed, 13 Aug 2003 00:32:14 +0200

>  blocklist's reputation, don't use it.

	That assumes that everyone knows the full reputation of all black 
lists.  This is not a valid assumption.  Even experienced e-mail 
practitioners may not know the reputation of even just the majority 
of the existing black lists.

>  Of course not. So what is the real goal of proposals for auditing

	To help the people find out the necessary information more 
easily.  Hell, we were using SPEWS at ntp.org, until I found out that 
they cast their net too wide.  But it took collateral damage for me 
to find that out.

	I shouldn't have to suffer collateral damage or do excessive 
amounts of investigation in order to determine the reputation of 
major black lists.

>  that might well disagree with them.

	No one is talking about enforcement here.  We're talking about an 
independent third party (or parties) that survey the available black 
lists, try to come up with some sort of list-neutral form where they 
can all be compared, and then present that information to the public.

>  going to make sure that they stay impartial? Where will we find these

	This is where I was hoping a community-based effort might do us 
some good.  Any one person or group of people might be biased one way 
or the other, but hopefully we could structure the effort as a whole 
so that these biases would tend to balance out.

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

---

From: Brad Knowles <[email-masked]>
Date: Wed, 13 Aug 2003 03:30:11 +0200

At 8:47 PM -0400 2003/08/12, Yakov Shafranovich wrote:

>  Would you and anyone else like to participate in researching the
>  possibility of such effort and perhaps some BCPs for mail
>  administrators re: blocklists?

	Sure.  I was thinking about throwing together my own PHP/MySQL 
based solution of this sort regardless, and I'll be glad to 
participate in efforts to try to regularize this.

---

From: Walter Dnes <[email-masked]>
Date: Sun, 17 Aug 2003 14:58:21 -0400

On Wed, Aug 13, 2003 at 12:32:14AM +0200, Brad Knowles wrote

> amounts of investigation in order to determine the reputation of 

  Have you ever heard of "RTFM" ?  Did anyone ever come to you whining
that they shouldn't have to suffer collateral damage to determine the
effects of "rm -r *" ?  Anyone who uses an unfamiliar tool without RTFM,
or at least asking about it on appropriate forums is asking for problems,
and should not expect any sympathy.  If you had read questions 5 and 6
at http://www.spews.org/faq.html (or even better, the entire FAQ) you
would've known what you were getting into.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

---

From: "Tom Thomson" <[email-masked]>
Date: Mon, 18 Aug 2003 11:33:09 +0100

> would've known what you were getting into.

Unfortunately the spews website is now quite thoroughly misleading on the
subkect of collateral damage - claims it is very rare, and doesn't explain
that they use it as a weapon against the ISPs they don't like.  Reading it
as it was many moons ago would have helped, but maybe he got bitten after
the website was toned down.

Tom

---

From: Brad Knowles <[email-masked]>
Date: Mon, 18 Aug 2003 19:53:24 +0200

At 2:58 PM -0400 2003/08/17, Walter Dnes wrote:

>    Have you ever heard of "RTFM" ?

	What part of "I read the FM" don't you understand?  What part of 
"I've been using them for years, and thought they were some of the 
good guys" don't you understand?  What part of English don't you 
understand?

---

From: Walter Dnes <[email-masked]>
Date: Mon, 18 Aug 2003 17:34:19 -0400

On Mon, Aug 18, 2003 at 07:53:24PM +0200, Brad Knowles wrote
> good guys" don't you understand?  What part of English don't you 

  Quoting from your original message...

> Hell, we were using SPEWS at ntp.org, until I found out that they
                                        *****************
> cast their net too wide.  But it took collateral damage for me to
> find that out.

  No two interpretations about it.  You used SPEWS and then found out
about its policies.  By "we" I assume you meant "corporate we".  You
also say "until I found out", which implies that you were able to turn
SPEWS on/off at your site.  It's right there in black and white at
http://www.spews.org/faq.html

Q5: Why are network addresses listed if no spam has originated from
them?

A5: They are listed because they have been set up by known spammers and
spam support operations, most with a demonstrable repeated history of
spamming or spamming services. They are also listed if they host
websites advertised in spam, as this too falls under spamming services -
these listings normally occur if the owners of that network address
range do not remove the offenders.

Q6: How did "I" get into SPEWS?!

A6: Normally it is not "you" who was listed but your ISP or host. They
may have been listed due to spam originating from their section of the
Internet or due to their hosting or providing services for known
spammers. The SPEWS bounce page covers this in more detail. Now if you
are a spammer, or spammer supporter, yourself, you were listed for that
reason.

A7: We want to list any identifiable network block that is owned or run
by the spammers or spammer supporters themselves. This way we can lessen
their effectiveness at spamming. Even if the spam doesn't come from
there, they may use it to host spamvertized sites or use their network
connection to harvest email addresses from Internet webpages.