Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article

From: Alan Monaghan <[email-masked]>
Date: Mon, 11 Aug 2003 08:30:00 -0400

So don't use their list. All of the block lists have problems. Some worse
than others. 
If Spews did give any contact information, they would be out of business in
a week as people try to take them to court for any number of things just to
make them spend all their money and time. 
The Register Article did not present any balance in the information nor did
it show that the ISP in question is a problem for everyone. 
Spews is working the only way it can right now. Again, if it doesn't work
for you, don't use it.

       Be like water my friend ...
Alan G. Monaghan
   MCSE+I - Win4.0; MCSE - Win2k
    BJCP # C0389  (Recognized)
Gardner Publications, Inc.
Internet Administrator 

?  Phone	1-513-527-8867 
?  Fax		1-513-527-8801 
?  Cell		1-513-378-0919  
? E-mail	[email-masked]
? URL		http://Bullwinkle.GardnerWeb.Com/

 -----Original Message-----
From: 	Yakov Shafranovich [mailto:[email-masked]] 
Sent:	Sunday, August 10, 2003 6:00 PM
To:	[email-masked]
Subject:	[Asrg] 7. Best Practices - DNSBLs - Article

Here is a Register article describing a site being blacklisted by SPEWS.org 
and how they are dealing with it:

http://www.theregister.co.uk/content/6/32231.html

Also see this Politech Bot post:

http://www.politechbot.com/p-05013.html

The site in question was blacklisted for using an ISP that has been known 
for hosting spammers in the past. SPEWS.org does not provide contact 
information nor are their operations audited by anyone.

The problem with SPEWS.org specifically and other similar initiatives, is 
that they do not provide contact information and there is no way to gauge 
whether their internal operations are run properly. This is a problem with 
all anti-spam tools and is something that should be addressed in the BCP 
area. Additionally, mail administrators should be cautious when selecting 
or relying on a specific tool (this also goes into BCPs). Within the 
consent framework, these are SOURCE TRACKING COMPONENTs which should be 
selected carefully.

Yakov

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Tom Thomson" <[email-masked]>
Date: Tue, 12 Aug 2003 16:09:53 +0100

> From: [email-masked] [mailto:[email-masked]]On Behalf Of Alan
Monaghan
> Subject: RE: [Asrg] 7. Best Practices - DNSBLs - Article

than others.
> Spews is working the only way it can right now. Again, if it doesn't work

I agree, the Register article did show a lack of balance - it gave far too
much leeway to the bunch of irresponsible vigilantes that run Spews.

Other blacklists give contact information, and manage to keep their heads
above water. Of course the approach Spews takes to collateral damage (cause
as much as possible regardless of harm to their innocent victims, the end
justifies the means and screwing innocent parties is as good a means as any)
probably means they might be a bit more open to litigation than other
blacklists are.

I've never been quite 100% sure just how much truth that criticising Spews
often results in getting a large block of your ISP's addresses added to
their list - close, given the people who have told me that is what goes on,
but not quite 100%. Post hoc ergo propter hoc was never a valid argument and
there's always going to be at least one IP address in a /16 block that
someone's complained about sometime somewhere so maybe it's all just
coincidence after all.

Tom

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 12 Aug 2003 15:34:35 -0400

>someone's complained about sometime somewhere so maybe it's all just

The problem is that mail administrators manage to evaluate blacklists based 
on their effectiveness not their reputation. This would lead to the 
blacklists which block the most IPs, being the most effective. However, 
there is no evaluation done on whether any innocent email is being blocked 
as well. And leaving people in the dark about internal procedures of 
blacklists is not helping the situation. They do not have to give out 
contact info, just write up some clear guidelines and follow them.

Yakov

---

From: "Steven G. Willis" <[email-masked]>
Date: Tue, 12 Aug 2003 19:44:16 +0000

>contact info, just write up some clear guidelines and follow them.

We have had implemented a system for 6+ months now wherein we do have direct feedback from users to indicate what level of Spam to Not Spam we see for all of our RBLs.

We have been very slow and progressive in monitoring the results of each RBL that we do attempt to use, including one that we maintain internally.

I can say clearly that there are good RBLs out there. They tend to be those that follow the above recommendations.

For many others, though, we have found that there really are too many exceptions that end up blocking too many sources of what may be considered legitimate email by users.

The key piece of information here though is that we, as the administrators, make no determination of what is considered spam and what is not considered spam. We make certain that no email is directly blocked and is instead made available to user to then indicate to us whether it is spam or not.

For the two most reliable RBLs we have found, the positives for the system out 99.8+% correct, with only a very occasional incidence of blocking what the end user would end up considering to be not spam. This is still in my opinion not good enough, but much better than many others we have tested against (some of the worst were closer to 60% range of spam being blocked compared to the total blocked by the RBL).

I think it is clear that an RBL is not unto itself a solution. It can used as a part of a unified solution. But, unto itself, it does not provide enough of a functionally reliable solution to be worthwhile when standing alone.

Cheers!

================================================================
Steven G. Willis     [email-masked]       772.794.9494
Deep Sky Technologies, Inc.          http://www.deepskytech.com/
http://www.badchickens.com/         http://www.store-secure.com/
================================================================

---

From: "Chris Lewis" <[email-masked]>
Date: Tue, 12 Aug 2003 16:02:17 -0400

Yakov Shafranovich wrote:

> The problem is that mail administrators manage to evaluate blacklists 
> based on their effectiveness not their reputation. This would lead to 
> the blacklists which block the most IPs, being the most effective.
> However, there is no evaluation done on whether any innocent email is 
> being blocked as well.

That's a rather extreme assertion.  And wrong.  We certainly do this 
evaluation.  Continuously.  Otherwise, I wouldn't be able to tell you 
that the CBL blocks 78% of all of our spam, and has a .004% "whitelist 
rate" (meaning: we've had to whitelist .004% of the total CBL blocks 
that there would be).

There are a number of web sites carrying effectiveness/FP comparisons.

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 12 Aug 2003 16:02:19 -0400

At 03:44 PM 8/12/2003, Steven G. Willis wrote:
>...............
>I think it is clear that an RBL is not unto itself a solution. It can used 
>as a part of a unified solution. But, unto itself, it does not provide 
>enough of a functionally reliable solution to be worthwhile when standing 
>alone.

Within the consent framework, a consent system can use multiple sources of 
information. DNSRBLs are just one type of those sources.

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 12 Aug 2003 16:03:40 -0400

At 04:02 PM 8/12/2003, Chris Lewis wrote:
>>based on their effectiveness not their reputation. This would lead to the 
>>blacklists which block the most IPs, being the most effective.
>evaluation.  Continuously.  Otherwise, I wouldn't be able to tell you that 
>the CBL blocks 78% of all of our spam, and has a .004% "whitelist rate" 
>(meaning: we've had to whitelist .004% of the total CBL blocks that there 
>would be).
>

Mea Culpa. Is there any data out there that can tell us what percentage of 
sites actually do these types of evaluations?

Yakov

---

From: Brad Knowles <[email-masked]>
Date: Wed, 13 Aug 2003 01:20:22 +0200

>  There are a number of web sites carrying effectiveness/FP comparisons.

	Do you have any links?  I'd like to see them....

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)