ORBS Forks 249
Noxxus writes: "Wired is carrying this article about the shutdown of Alan Brown's Open Relay Behavior-Modification System, more commonly known as ORBS. Brown, of New Zealand, closed his operation after two local companies won legal injunctions against him for listing them."
It seems the list of 94,000 open relays will be maintained by:
"Open Relay Black List of Phoenix, AZ, Open Relay Block Zone (ORBZ), of Basingstoke, England, and the Open Relay Database (ORDB), of Aarhus, Denmark."
We've gotten a zillion ORBS submissions since the day
its website
went down, but this is the first post-ORBS story with enough info to be worth a mention. Guess the dust just needed to settle.
We're obviously in the minority, but I think the EFF's John Gilmore has cut to the chase:
For Gilmore, spam blocking should occur at the recipient level, not at the level of self-appointed upstream censors.
"I noticed years ago that the community tends to go 'mob' and lose its morals and principles when it comes to spam," Gilmore says. "Free speech, interoperability, inclusiveness, tolerance, privacy, anonymity -- all go out the window when they get in the way of killing off those damn spammers."
I wonder if he'll get added to spam lists now, like I do every time I post a story critical of anti-spam activists. Yeah, subscribe me and Rob to more mailing lists under the handle "Spamlover." That's real mature.
Re:Three things... (Score:2)
Censorship vs. censorship? (Score:2)
Let's do some logic to find out who the censors are. What does Mr. Brown do?
- He probes mail servers to find open relays. (This is the only "questionable" activity of which I would accuse Alan.)
- He compiles a list of these open relays.
- He publishes this list to those who specifically ask for it.
Now, what word would you use to describe someone who forcefully stops Mr. Brown from publishing his information?Think for a second....
Riiiiiight....
Censorship? Bullshit. (Score:2)
Calling a blacklist of open relays "censorship" is like calling a virus-scanner censorship. Hey, just the other day I got some email with the "Mawanella" VBS trojan in it.. and goddamn McAfee VirusScan deleted it!! That's censorship!! It's a violation of my first amendment rights!! (never mind that McAfee isn't a government body, and I'm not in the USA anyway, it's still a violation of my first amendment rights!!)
Come on, open relays are flat out misconfigured, broken and harmful to the internet as a whole. In a perfect world, if you didn't know how to set up a mailserver, then your mailserver simply WOULD NOT WORK. Unfortunately this is not a perfect world, and there are ways in which people who don't know how to set up a mailserver can end up with something which APPEARS to work, but is, in fact, broken and harmful. These people should NOT have their mail successfully delivered until they fix their problems.
However, just in case I seem too rabid, I will add that of all the responses I've gotten to my spam complaints (all of which involve open relays being raped by spammers), those from the postmasters of said relays are invariably more polite and friendly than those from the ISPs hosting the spammers.
Re:Make a decision, folks (Score:2)
Censorship is bad.
Rejecting spam is not censorship [*].
[*] although it might be censorship if you use a position of power (eg, postmaster at an ISP) to reject spam sent to your users, without their knowledge and/or approval.
Re:Make a decision, folks (Score:2)
This assumes, of course, that the lists actually do what they're intended to do: prevent unresolved problems from hurting other people. Ideally, you would only end up on such a list if you were running an open relay, you would be notified, and you would be able to get off the list as soon as you fixed your mail server. The censorship issues have been with people getting on such lists when they were not, in fact, running an open relay, or not being removed from the list when they fixed it. That sort of thing, in addition to being generally bad for freedom, also reduces the effectiveness of the lists.
Re:Make a decision, folks (Score:3)
That'd look more accurate.
=)
Email is not a public forum (Score:2)
Would you call it free speech if somebody pasted a sticker detailing human rights abuses in China to your car?? I call it defacement, and and forcing me to use MY resources (not free) to remove and repair their damage.
It doesn't matter what the message is, you do not have the right to force it on someone else. There is no double standard, just idiots who don't understand the meaning of the word freedom.
Re:And good riddance! (Score:2)
Re:Make a decision, folks (Score:2)
Go you big red fire engine!
Re:Make a decision, folks (Score:2)
Oh please. Do look up "fallacy of excluded middle" on your favorite search engine then come back with an actual argument.
--
A man's home is his castle (Score:2)
An e-mail box should be treated the same way, although I expect that a supreme court decision will be required to make this happen.
This isn't censorship, this is cutting through all the marketing bullshit.
Re:You twisted the question though. (Score:2)
Hello? Not everyone has broadband access to the Internet. Not everyone has untimed access to the Internet.
In many countries, there is a per minute charge for dial-up connections. Every second spent downloading spam is directly costing the user money.
I'm sorry, but you need to get a clue.
If the end user chooses it isn't censorship (Score:5)
One could argue that personal email is not a public forum, such as USENET and places like slashdot, and that any form of filtering, at any point along the way, is not censorship in the real sense of the word.
In any event, as long as the end user is informed, and has a choice, it isn't the kind of institutional censorship so often, and so correctly, decried here, it is merely voluntary filtering of what those who subscribe to it view as noise, as is their right.
As for slashdot being united about anything, a quick perusal of any discussion, on any topic, should dissuade you of that erroneous assumption.
Re:And good riddance! (Score:2)
If they *were* trying to get me to buy something, then it'd be spam.
Cheers,
Tim
Re:Free Speech? (Score:2)
Of course, spam is not a free speech issue; Freedom of Speech does not cover freedom of making others pay for that speech. Spammers are still free to stand on a street corner and tell passersby of their wares, or even pay for their advertising.
Cheers,
Tim
Re:Three things... (Score:2)
The main problem is that it's the spammer's computer that decides ( theoretically based on MX records ) which mail server to connect to. The only way to make this happen is to use multiple hostnames for users, eg. x@open.domain.net vs. x@orbs.domain.net, instead of vanilla x@domain.net. You'd need the servers configured with lists of users they should accept mail for, and some way for users to maintain that list. I'd prefer headers myself, but I'm a firm believer that if an ISP doesn't do procmail I don't want to use that ISP for mail.
Three things... (Score:4)
ORBS is free speech, spam is theft (Score:2)
I run several mailservers. I need them to be at least profit-neutral, preferably profitable.
Why? So I can keep running them. I don't get government grants, and I have a spouse & kiddies to support. If I am to continue to contribute to the Internet community, I must not only survive, I must be able to pay for my links.
Spam, generated with the help of people who insist on open relays, finds my users and clogs their mailboxes. They (the users) no longer receive optimum value from time spent interfacing with my mailservers. This in turn impacts profitability.
State-supported academics and wealthy ideologues can rant as they please, but stifling the right of anti-spam zealots to list open relays is pure censorship - the suppression of someone's right to speak out. In contrast, spam is the theft of disk space and bandwidth - and whenever I try one of those "opt out" things the spam load noticeably INCREASES, incidentally.
Open Relay blacklists let me continue to feed my family while doing work that helps the Internet as a whole. Spam eats my time and other resources and robs the Internet of any potential fruit of those lost resources. My preference should be obvious.
--Charlie
PS- All the things the open relay advocates claim they need to do can be accomplished without the use of open relays. Except spamming and mailbombing.
The problem is that mail gets MIXED UP (Score:2)
If all mail servers fell precisely into one of these two categories:
- sends mail that people do not want to receive
- sends mail that people do want to receive
then the situation would be simply solved by not accepting mail from servers that send what you don't want. The problem comes into play when a mail server, usually as the result of misconfiguration (which itself is usually the result of an incompetent or ignorant system administrator, or the management above them restricting what they can do), mixes up legitimate mail with the spam. What many people who run clean mail servers then choose to do is to just not accept the whole lot.Gilmore is certainly well intentioned. Anti-spam measures do pose a risk to true free speech, which unfortunately due to the way society and its leadership tends to react, must often be done anonymously to avoid risks of retaliation. However, he has the mechanism all wrong. Once unwanted mail has been accepted at a server, the damage is already done. Now processing cycles must be used to analyze it to filter it out by other means, and storage is occupied over time to hold on to what then takes up human time to read it (usually because of a misleading subject like "oh, I forgot to mention" which could cause almost anyone to read it thinking it might be legitimate mail). The real practical solution is to use mechanisms that are the most efficient at discovering the most accurate level of unwanted mail and separate it from the wanted mail. And one of those mechanisms to choose from are the various lists of mail servers that are discovered to be sources of generally unwanted mail called SPAM.
Different people do vary in their belief in the benefit of losing unwanted mail like SPAM versus the cost of losing wanted mail. One could think of it as a ratio. How many pieces of SPAM would a scheme need to be able to get rid of to make it acceptable to lose one piece of legitimate and wanted mail? Some people will say there is no acceptable number. They won't be filtering SPAM at all. Others consider it acceptable to lose some legitimate mail to reduce their costs of processing and the time taken to read the junk. When it is realized that the senders could move on to a different network services which carries out actual and effective measures to ensure their mail server is in the 2nd category above, then for many people it is acceptable to lose some mail because they know the sender can remedy the situation.
I use the MAPS databases in blocking spam coming in to my servers from various classes of known spam sources, including open relays. I review the logs and have found that so far it has been very effective in blocking spam while not blocking legitimate mail. It's not as effective as desired in being comprehensive in blocking all open relays. But I have found that if I also block mail arriving from mail servers which have no PTR record available at all (reverse DNS) for its IP address (reversed in the in-addr.arpa zone), the blocking is nearly as effective as MAPS. In fact it blocks more SPAM than MAPS does, although there have been 3 cases of apparently legitimate mail being sent in and lost (one of those being from OSDN itself ... heads up Kurt!).
In general there appears to be a very high level of correlation between servers misconfigured to allow SPAM to be relayed and servers misconfigured to not have functional reverse DNS. It's not perfectly 100%, but it is well over 99%. Most of the open relays seem to be the rapid growth of businesses connecting to the network, especially outside of the United States (the US having done most of its initial connection growth already). This is probably made worse by the fact that most of the documentation is in English, and English is not really universally understood. That doesn't mean that when a new mail server comes online in China as an open relay that the administrator intended this to be so. More likely they are not getting good documentation in their own language to explain to them the importance of making sure the server is closed for relaying, and the steps needed to do it. Another problem that is probably contributing is a very high use of pirated software, which tends to be older versions of Microsoft Exchange server, and limits the ability to get service packs for it.
Where's there smoke there's often fire. If the server lacks reverse DNS it most likely is also an open relay (or worse, a direct spammer).
Still, the fact that an administrator would not want to relay SPAM does not in my mind mean I should go ahead and accept SPAM from them. So I find it perfectly acceptable to use at least some of the databases of SPAM sources out there, and even additional techniques, to block the unwanted and costly mail. It's my server. And my customers can move on to someone that lets SPAM in if they so choose. And I am now setting up a 2nd mail server with NO anti-SPAM measures (it won't relay, but it will take mail from all sites to be delivered here) and let customers choose which they want their incoming mail to go through. I wonder which one they will choose. I wonder how long it will be until they go back.
And BTW, I did test out using a context based mail filter for my own mailbox once. It killed more legitimate mail than I found acceptable; far more than my current methods do.
Re:How I dealt with my spam... (Score:2)
They added you to their list. You added them to your list. Sounds fair enough to me. They finally deleted you from their list, so you in turn deleted them from your list. Still sounds fair enough to me.
Was it criminal for you to add them to your list when they didn't want to be added? If yes, then it would be the same for them as well, right? I think so.
Good job!
Re:Honestly... (Score:2)
If you want someone else to do the filtering for you, would you be satisfied by using an ISP that used MAPS/ORBL/ORBZ/ORDB to block spammers? Or would you be complaining that the ISP is "messing with your mail"?
Re:Honestly... (Score:2)
Some spam does indeed have the filtering. Some does not. In fact most does not. Most are from throw away or even non-existant accounts, usually mangled to bypass the filters. The only safe way is to have a list of everyone that can send you legitimate mail and block everyone else. But then, you'd miss out on some mail anyway.
Re:Spam is *not* free speech! (Score:2)
Which is one of the reasons I blocked the entire country of Korea. I'm lucky that I can do this because I have no legitimate mail coming from Korea. Taiwan and China are similarly blocked, though I might have to unblock some of Taiwan since there are businesses there I might end up working with. Even Japan is a huge source of relayed SPAM, and I'd like to block it as well, but I get a lot of legitimate mail from there so it's not an option (I just block the networks that happen to send SPAM).
Then there is that guy who has 500 dots in his PTR receord (so he must be using some static IP) that causes mailers to overflow their header and hide his IP address. I had to block "9netway.com" to get rid of that guy. And he may even be forging that.
An alternative idea (Score:2)
Right now the various MAPS/ORB* type databases are hard to get removed from. In my experience the bulk of open relaying (as opposed to direct spam, which is in a separate list now anyway) comes from places that won't even try to do anything about it, much less try to be removed from the list. My idea is to have the usual method of detecting open relays, but making it easy (an easy to use web form) to be removed from the list. The web form will use an email verification by sending the usual verification code to the provided email address, and then once verified on the web page, automatically remove the specified address. Those places that continue to relay spam are going to end up back on the list anyway, probably real soon, too. Oh, they can go through the cycle of having themselves removed again. If the web form is structured to make automated bots filling it in not viable, it should be effective. This way anyone who thinks they have been placed on the list inappropriately can just remove themselves.
Oh, and there would be an opt-out "would you like to receive our newsletter" selection for those whose email address is used more than 10 times :-)
Since when is helplessness a virtue? (Score:2)
Sheesh. I understand that not everyone has the time and talent to write their own mailfilters and admin their own servers, but why sneer at those who do? Got something against taking responsibility?
You say that as if these were bad things. Why not indeed?
Re:Since when is helplessness a virtue? (Score:2)
Oh, how silly of me. Of course, I should have realized that since I am unable to build my own computer out of sand and copper ore, that any attempt to exercise some modicum of self-sufficiency is doomed to be hypocritical.
No doubt the fact that when I make waffles from 'scratch', I haven't ground my own flour from wheat that I've grown myself, churned my own butter from my own cow, and gotten the eggs from my own chickens proves my hypocrisy as well. I should just be a good little corporate consumer and serve my family Eggo [eggowaffles.com].
Thanks for setting me straight. I'll make sure to stop trying to write my own software and uproot those tomato plants in my back yard so that I won't be a hypocrite for failing to be entirely self-sufficient.
Re:Make a decision, folks (Score:2)
Re:Make a decision, folks (Score:2)
And there is now a huge freaking difference between the actions of ORB.*/MAPS and "closing open mail relays."
They do a lot more than just that, and some suspicion has fallen on the motives of some of the shutdowns that have been instituted, with no right to petition for redress.
It's not just for Open Relays anymore.
I suppose in some idealistic sense, (Score:2)
SO what if the ISP blocks it? THEY are then eating the cost of that incoming traffic, they just aren't forwarding it on to you, so you pay for it with higher fees.
The reality is, spam doesn't really cost us that much, we just don't like it.
Spam is not Theft of Service, I'm sorry. You have an email box which anyone can send email to, whether you like that mail or not. They have not 'stolen' any service from you by sending you mail, just as when you go to a web page and get a big graphic you didn't expect.
By the super-idealistic mentality people use, I could say that NO service has been stolen from you, because your POP client CHOSE To download those messages from the mail server; you could have left a few out.
This is not someone walking into your house and ransacking it. This is someone leaving junkmail in your mailbox.
Maybe, if you pay per-message for your email, you'd have a point.. similar to why telemarketers can't call cellular phones... because it costs the receiver.. but...
Can you show how an unwanted email address cost you money? Would Your or I have more money to show for it if we didn't get 200 some pieces of spam a week? I doubt it.
Get them for deceptive advertising, fraudulent communications, or harassment... but not for 'theft of service'. By your logic, when the Jehova's Witnesses knock on my door and waste my time, that would be 'kidnapping'.
Re:I suppose in some idealistic sense, (Score:2)
Where is it stated that nobody can send you snail mail without approval?
Where is it stated that nobody can phone you without approval?
All I'm saying is that, yes, in an idealistic sense, they are wasting your resources in a way they should know is unapproved, but realisticly, it's NOT costing you anything appreciable. If it is, please show me how you have more money if you don't get spammed.
If someone were to use the resources your are paying for without your permission, by hooking up to your home network and abusing your connection, that's akin to trespass, I agree.
As for your ISP, they have a server that accepts smtp-compliant email from anywhere else on the internet. When I spam you, I don't send the mail to your house, YOUR COMPUTER goes out and fetches it. It's no more 'theft' of your services than when you go to a web page and it's not what you thought it was, or it's 10x the size you thought it was....
The other thing is, are you paying for bandwidth? What about someone who sends you mail without asking you for permission? If I'm your friend, I still can't break into your house and use your shit, that's illegal.. but it would be okay for me to mail you without asking for permission? Get real.
A few discussion points. (Score:2)
1) Spam sucks.
2) Even though it may not cost that much in ISP fees, people argue that TIME=MONEY. I'll grant that.
3) The average anti-spam activist spends far more time whining on the net about spam and/or configuring anti-spam systems than it would to simply delete their spam every day.
If time=money, why not simply take the quick route, delete those spams, and get on with your day?
Wow.. put words in my mouth. (Score:2)
I think there are several legal avenues by which we can reduce spam.
My point was that, currently, far more time is spent working on anti-spam systems (which also only treat the symptom, not the disease) than would be simply ignoring/deleting spam.
I'm not saying don't work on them either... simply that some kid who whines about how 'valuable' his time is so he spends it working on his anti-spam system to save him time is being a hypocrite.
I also think that, the reason spam persists is because SPAM WORKS. As long as people respond to spam, then there is a reason to spam. And if spam is working for some people, who are we to block it from them? We're better off to educate people and have people refuse to do business with companies who spam... when spam no longer gets a response, it will stop.
Re:You twisted the question though. (Score:2)
Most poeople, however, who are whining about spam are NOT living in those countries, funny isn't it?
I don't dispute that spam is bad... just that people need to make a better and more convincing case for it.
Re:You twisted the question though. (Score:2)
I'm not implying that bandwidth is free, only that the amount lost to spam by end users is negligible.
Thank you. (Score:2)
Yes, I can appreciate that spam will cost you money.
What about a protocol that lets you choose which messages to download? I mean, that's what I do.. the beauty of imap.
You are still making the choice to download eachindividual message, even if you simply chose to download them all.
I still maintain that the bulk of people who whine about spam are just whining for the sake of whining; it's not costing them anything.
Once again... (Score:2)
BUt I'm not talking about the abuse of a mail server by brute-force spamming, I have no problems seeing how that should be illegal.
I'm talking about Joe Average who checks his email now and then, online, because that's who whines about spam the most.
You are talking about the mechanism used to deliver the spam, I'm talking about the end users actually fetching the mail.
Re:You twisted the question though. (Score:2)
I live in europe, I know full well how the fees work.
My point is that so many of the people who whine about spam are people who spend far more time trying to block it from entering their mailbox than they would simply deleting it.
Cool. (Score:2)
As you have this information readily available, can you give a good guestimate as to how much extra money you paid last month because of spam?
You twisted the question though. (Score:3)
Yes, time is money, but please show me how you actually would have earned more money had you not had to delete, let's say, 20 pieces of spam a day.
Now.. a mail relay getting hacked or otherwise used for bulk spamming, THAT Is theft of services, no doubt about it. That's not what I was talking about. I'm saying that, when you, as the end user, get some spam, it is NOT 'theft of service'. You're mixing up two different aspects of it.
I'm not in favor of spammers, I think there are several legal avenues to persue regarding making email sane again, I just don't think end users claiming 'theft' of services is the way to do it.
I understand what unsolicited means.
My time is worth a great deal to me (and those who pay me), but I'm realistic. Most spam whiners spend FAR more time whining about spam and setting up filters than they would simply deleting the spam. I know deleting the 30+ pieces I get a day takes me LESS THAN 2 minutes a day. I spend more time than that going to the watercooler and back. Get real.
Re:You twisted the question though. (Score:2)
But it's not. It's intentionally disguised to look like non-spam email.
I'm on a few mailing lists, and have a bunch of people contacting me from places like Slashdot, Kuroshin, etc. Not to mention potential clients.
A lot of them send me mail with subjects like "Hi!", "Re: posting", or "We talked at COMDEX"... I can't just whip through and delete spam, I actually have to look at every message.
This takes probably a minute for every five messages I get, because some of my potential clients actually send me gaudy HTML email.
For 75 messages then, spam costs me about $45, my billable rate for general consulting. It's time I spend on work-related matters, for which I can't actually bill.
And 75 messages of spam is fairly common, sometimes I get many more.
Re:Make a decision, folks (Score:2)
Actually, it's like leaving the door unlocked. I expect you to go away if I ignore you. If I go a step further and tell you to go away, I don't expect you to sell my address to a thousand of your mates who will knock on my door because they know I'm at home.
My phone number is in the phone book. That doesn't give everyone in the world the right to make collect calls to it (particularly not from Korea).
--
Spam will destroy email if not stopped (Score:2)
How many of them have something to sell? What if it's only one person in a thousand?
People who naively say "spam is free speech, just delete it" are fundamentally missing the point. If you get six million spam messages in your inbox daily (and based on the above "one person in a thousand has something to sell", that's what you'll get if spam is "OK")then email has ceased to be a usable communications medium.
I am postmaster@the.company.I.work.for, and I see a continuous flood of spam - dozens of emails a day - to the address of one person who left the company over ten years ago. For ten years, this email was all bounced "No such user", but since the return addresses on the spam are forged, they never see it, and the address remains on all the spam lists. (I'm now using his old address as a "spam poison pill" address.)
The postmaster mailbox gets hundreds of megabytes of "no such user" bounces a day. In an ideal world, I would scan the "no such user" bounces and facilitate legimate senders of email getting their mail to its intended recipient. In the spam world, all I can do is procmail all "no such user" mail into a separate mailbox that is deleted daily, and never looked at. (No, I am *not* exaggerating when I say "hundreds of megabytes per day.")
Contrary to Gillmore's naive ideological purist anarchism, spam is not a trivial problem, and the volume is such that it constitutes a Denial of Service attack. It must be treated as such.
Re:Spam (Score:3)
Because my delete key wore out.
I can delete a couple of spams a week, but the current several hundred? Get real.
Oh damn, I just responded to a troll.
EZ
Re:Make a decision, folks (Score:5)
There is a huge freaking world of difference between censorship and closing open mail relays. This is *not* a free speech issue. The people using open mail relays are not legitimate businesses. They are hijacking other peoples 1)ignorance or 2) goodwill in order to hide their origins and make it impossible for the *end user* to block these unwanted messages. If people want to send spam, fine. All the best of luck to them. But they should at least be honest about it. This has absolutely nothing to do with free speech.
Re:And good riddance! (Score:2)
Maybe you missed it -
We're obviously in the minority... and I wonder if he'll get added to spam lists now, like I do every time I post a story critical of anti-spam activists.
jamie is on your side. It's just that you're both wrong. You may have a right to free speech, but you don't have a right to force the television news to broadcast your message, and you don't have a right to force me to listen to you. With the ORBkins, it's like having a news director at the TV station - yes, sometimes important things don't get covered (at which point some people will complain, and perhaps something will get done), but most of the time, it's just raving loonies who get ignored, and no one but the loonies gives a damn.
Until it's government mandated, or public institutions start requiring its use, there's no censorship issue involved. When the Southern Poverty Law Center [splcenter.org] maintains and publicizes a list of suspected hate groups [splcenter.org], that's not a violation of civil liberties (although if they're wrong it might be libel). When the FBI does it, it's a different issue.
Re:If the end user chooses it isn't censorship (Score:3)
I get very tired of people who think their opinions are valuable when they haven't ever researched the damn issues, and want to impose this on others!
------
Re:Make a decision, folks (Score:3)
------
It's not censorship, it's protecting your property (Score:2)
MAPS and the various ORB* systems are not censoring my email. I am doing so myself, on a conscious decision that those who send or facilitate spam are not welcome to send to me. Nobody else has the right to question my decision in the matter.
I believe that ISPs have the right to determine who can use their property. They should disclose fully what filters, if any, they use to their customers, so that those customers may make an informed choice, but the decision of what to filter is theirs alone, influenced only by market pressures.
--
Re:Make a decision, folks (Score:5)
Re:Make a decision, folks (Score:2)
And yes, I've heard all the arguments about how the cost of receiving an email is miniscule. However there is still a cost, and that's all that matters. It may only cost a cent for me to receive an email, but if I get 20 spams a day, that's 20 cents a day, $5 a month, $60 a year. These things add up, and the point is not that I have to shell this obscene amount of money out, it's that I shouldn't have to pay for someone else's advertising. You hear griping about junk mail (postal), but you don't see the pure hatred that you see for spam. Why? Because they're paying to send it out. The costs are in the right place.
So while I agree that you can't have it both ways, you also have to concede that there is a difference here. If spammers were paying to send out their ads, it would be a different story. However it can't just be a matter of them paying their provider to send out the ads, they have to *remove* the cost of receiving it from us.
-Todd
---
Gilmore doesn't get it (Score:2)
His analogies simply don't wash: the guy on the street corner, and the bulk-mailer leaving ads in my postbox, are bearing nearly all of the transmission costs. That's not how it works on the Internet. Bulk-mailers have no right to consume my resources without compensation. It's really that simple, and I don't understand how pseudo-libertarians and bulk-mail supporters can't grasp this simple concept. And while it would be great if every 'net user understood how to write procmail filters, most don't (and won't), and it's unreasonable to expect them to.
The censorship argument doesn't wash, either. Private networks have the right to decide what data to carry through their wires and servers. Whether they make morally or ethically sound decisions on what to censor can be debated, but their fundamental right to do so cannot be abrogated.
To make matters worse, Gilmore is willfully choosing to remain part of the problem by running his own open relay. He doesn't get that his rights end where others' begin. Maybe he will never get it.
Re:And good riddance! (Score:3)
This is false. The Constitution prevents THE GOVERNMENT from regulating such speech. It does not prevent me or any private third party from doing so, nor does it obligate me or them to use my private resources to forward on an endless supply of mindless chatter. And it most certainly does not stop us from sharing information on who we think is irresponsible enough to privately block.
In fact, it is an exercise of free speech (and property rights) for me or them to put a privately owned mail server on the internet and choose not to forward mail designated by whatever source I choose to. If you don't like it, too bad. You are free to start routing your own mail with your own resources, but I'm free to block whatever mail I feel like from being transferred by my private property.
Everyone should have a right to tell people about events.
They do, but not with the assistance of private resources of those who oppose their message or editorial style.
procmail recipe (Score:3)
* !?
SpamCop (Score:2)
Re:And good riddance! (Score:2)
I agree that preventing someone from speaking is wrong, however, this is not quite that cut and dried... In the case of product based spam, it is restricting them from speaking anonymously. They are still free to send their message without using an open-relay. If they truly are trying to sell a worthwhile product they believe in, why are they often hiding their identity?
Re:SpamCop (Score:2)
I agree that this is the wrong thing to do when it's a legit mailing list, especially when it's an opt-in list. And the SpamCop instructions explicitly ask users to try unsubscribing first.
The problem is when I get 52 copies of "Buy Viagra Now!" emails where the sender/reply-to/remove addresses are completely unrelated to each other or the URL for purchasing. And if I did reply to the remove request address, I bet I'd only get an undeliverable error because some poor schmuck has been bombarded with 50,000 unsubscribe requests for a product he's never heard of and has overflowed the mail limit set by his ISP.
That's what SpamCop is designed for, and where it should be used. You can't guarantee a tool will be used properly every time, but that shouldn't prohibit you from making the tool available.
Default Deny (Score:2)
Since we're talking about SPAM, I will plug once again for a spam tax. Allow spam. For a per-copy fee. Then make sending unsolicited bulk
Stop mis-using First Amendment! (Score:2)
First, I definitely think that ORBS-style blacklisting at the ISP level is bad for consumer choice, and blacklisting at the recipient level is where it should be done.
But PLEASE stop mis-using the First Amendment.
When you prevent someone from telling people about their issue or product, what ever it might be, in the United States, you are restriting their Constitutionally-guarenteed rights to free speech.
Here's the First Amendment of the Constitution of the United States, in FULL:
Does that say anywhere in it that ISPs cannot choose who or what to block from their networks? Let me repeat: ORBS at ISP level is bad business because it removes choice from the consumer. It is not, however, against the First Amendment. ORBS and ISPs are NOT the US Federal Government. They are NOT beholden to the First Amendment. They can do whatever boneheaded bad business decisions they want to do, with respect to controlling their own networks.
Secondly, the right to free speech does NOT mean that you have the right to be heard. If someone refuses to listen to your advertising message, that's their choice. You do not have the right to force them to hear your jingles or your offers for sexy hot teens.
It's such a short amendment, with such clear wording. Why does everyone mistake it so much?
Re:Make a decision, folks (Score:2)
Let me see if I can sum this up (Score:2)
Do you have a nospam in your user profile E-Mail address? Do you even list a user profile E-mail address? If so, you're a hypocrite and a troll. Why do you do that if you believe spamming is someone's constitutionally guaranteed right?
If you do have an unadulterated E-Mail address in your user profile, I'll hit all the porn sites in your name and see if you feel the same way about spam in a month or two.
2) The end user should filter the spam...
Once it's hit the wire, you've already paid for most of it. Actually once it's hit your provider's wire, you've already paid for most of it. The cost of all your users' data transfers are worked into the monthly bill one way or another. If your bill's dirt cheap, your ISP is probably massivly overcommitted on resources and you spend more time waiting for your files to come down or waiting for a line to open up. Don't think for a second that you're not paying for spam, even if it's not listed as a line item on your bill each month.
3) The user should run his own mail server...
See number 2. Not everyone can run a mail server either. In fact, most people can't. You need a static IP, a dedicated connection and an ISP that isn't an asshole about you running your own servers. You won't find a reliable provider who will give you all that on the $20 a month plan.
I'd like to see a revised mail server RFC that operates on the web of trust model. To talk to a server, your server's key would have to be registered with it. If mail admin Dan trusts mail admin Paul, anyone trusted by Paul's server would also get to talk to Dan. If Paul turns out to be a spam house, Dan just revokes his key and shuts everyone coming through Dan down. The mail log would list all relevant keys that allowed a transaction.
Re:And good riddance! (Score:4)
Re:And good riddance! (Score:2)
One of the major cases on this issue is Valentine v. Chrestensen. There is a short version of the relevant points here, [abuse.net] the full argument can be found by searching for "commercial speech" here [gpo.gov].
Furthermore, the first amendment only applies to the government's actions to restrict speech. "Congress shall make no law..." It has nothing to do with what individual companies or persons do to restrict speech. If an ISP decides they're not going to deliver or relay spam because it costs them money and resources to do so, that is their business and not a violation of the first amendment.
---
Re:Since when is helplessness a virtue? (Score:2)
To relate this to your complaint about wafers and boards: the PC hardware market is one of the best markets from a Chestertonian perspective because it's filled with tons of small shops and the customer has a lot of choice and control. I have more control over the composition of my PC than I ever had over the construction of a typewriter.
With regard to hypocrisy, Chesterton didn't sew his clothes, make his boots, brew his beer or grow his tobacco. And yet his dependence on tailor, cobbler, brewer and planter did not smack of slavery.
My reactions (Score:2)
In summary, I'm on neither side. I have little sympathy with spam-fighters, and none with spammers. I'm afraid MAPS is the only bandaid keeping spam in check for the time being, and it must be constantly watched for abuse.
Re:And good riddance! (Score:2)
--
Honestly... (Score:4)
Re:Good Riddance (Score:2)
I implement[ed] ORBS for my personal email account (rather than server-wide) and blocked 1563 "spams" from November 2000 through May 2001. 4 of those were legitimate emails.
"Noticable" is objective, but for me, the ORBS was cherished because that was a huge chunk of my inbound email.
Good Riddance (Score:2)
As far as I can tell, these are the chief results of ORBS:
- SPAM hasn't been reduced to any noticable degree.
- Many people have had legitimate mail blocked because their sysadmins naively trusted ORBS's blacklist.
- Many SMTP servers cannot accept mail for the domains for which they are listed as mail exchangers, because of broken relay-blocking code.
This is now a primary cause of failed mail for my mailing lists.
Misrepresentation of others (or for that matter, their SMTP servers) is not part of free speech, especially when it harms the operation of essential services such as email.Re:Honestly... (Score:2)
Re:Make a decision, folks (Score:2)
Re:Spam is *not* free speech! (Score:2)
Re:Make a decision, folks (Score:2)
I hate to say it but it's just too bad that you didn't ask for it. You have a address in a public medium, that means that anyone who wants can use it. You can filter it all you want, and you have every right to, but you cannot prevent, or ask anyone else to prevent access for you. That's like giving everyone in the world a key to your house and getting angry when people you don't want in there come in anyway. It's not someone elses responsibility to filter who comes in, it's yours. If you're so concerned with privacy only give keys to those you want to have access.
Re:Spam blocking (Score:3)
Organizations like this are GOOD, they allow freedom of choice on the personal level by providing information to anyone who wants it.
Spam is *not* free speech! (Score:5)
Saying "spam is free speech" is like saying "I, posing as you, using your neighbor's phone card, calling some guy in California to sell him a penile enhancement tool which he doesn't want" is free speech.
The best strategy I can see for limiting spam is ending the open relays. I don't see any legitimate use for an open relay. Anyone care to enlighten me?
Re:Spam is an ISP's headache (Score:2)
A responsible and level-headed version of ORBS is very possible and quite welcome to me.
You're talking about RSS [mail-abuse.org], right?
RSS has the same stated goal as ORBS - to allow people to block open relays if they so choose. But RSS is run by different people and is run much more responsibly. They do not probe IP blocks looking for open relays. They wait until someone submits a piece of spam with full headers. Then they check the relay listed in the spam to see if it is indeed open. If so, a human looks at it and blocks it. Once the open relay has corrected the problem, the RSS people take them off the list.
I believe ORBS also blocks anyone who does not allow their probing. RSS is blocked by ORBS, for example. I've also heard people say that it is very hard to get off the ORBS list. None of this is true of RSS.
Make a decision, folks (Score:4)
Shameful Corporate Behavior and its Consequences (Score:2)
Anyone know which two local companies? I'd like to publicly shame them.
I Meta Moderate [slashdot.org] and I lose karma?
Scooped by The Reg weeks ago (Score:2)
ORBS splits into ORBZ and ORBL [theregister.co.uk]
ORBS now split into three [theregister.co.uk]
Re:Shameful Corporate Behavior and its Consequence (Score:4)
Free Speech? (Score:2)
TiVO (Score:2)
I will also presume that everybody who is for spam never turns the channels, or leaves the room when a comercial is on.
I don't want spam. why is my rights come secondary to somene who wants to sell something that 99% of the people the spam don't want? If there is something I want, I'll search for it.
The solution is really pretty easy. Make it illegal to:
a)use a false or incorrect return
b)not have a return
c)not have a standard solicitors identification.
those are the only way to protect the individule while still alowing companies to spam.
It is reasonable, protets all parties rights, and easy to impliment.
I know the spammers won't like it because they seem to think we're not allowed to chose what we want to view, and they seem to think sending repeated spam to everybody over and over again generates revenu for someone besides address sellers.
Next I'll be sued for not leaving my TV on all the time and blocking all those advertiser free speech.
Re:Make a decision, folks (Score:2)
You seem to have forgotten something called property rights. The church pays for their property, they get to decide how it's used. You pay for your mailbox at the ISP, you get to decide how it's used. Spammers claim violation of free speech rights to validate their violation of property rights, ignoring the fact that nobody's preventing the spammers from getting their own property (web site) and doing whatever they want to on it. Hypocrites. Thieves. No sympathy.
Chris Beckenbach
Spam is an ISP's headache (Score:3)
While there is no question that Brown was too often a bulldog, a service like ORBS noticeably helped cut down on spam for our ISP that services about 16,000 customers. Significantly.
Anyone who says that spam should only be blocked/fought at the recipient level doesn't have to run a mail server for thousands of customers. Spam bogs down our mail server often and we also have to respond to complaints from our customers, etc.
There is a lot of room between censorship and giving spammers free reign. A responsible and level-headed version of ORBS is very possible and quite welcome to me. For example, they can help notify us, and our customers who run their own mail servers, when a mail server allows open relays and we can try to get that blocked before a spammer compromises their machine and our bandwidth.
Spam doesn't only affect the mail boxes of end users, after all. Most spammers are reprehensible and a couple of procmail filters isn't enough to keep this in check. I just hope that one or more organizations will step up, learn from the mistakes as well as the successes of ORBS and help us no drown in spam.
Re:And good riddance! (Score:2)
Actually, it was an expression of free speech itself. It simply was someone saying "these ip addresses are used to send mass unsolicited e-mail"; ISPs and individuals could deal with that information how they saw fit. There is no free speech issue involved; I may have a right to say just about anything I want, but you don't have the obligation to have to listen to me.
--
Re:Honestly... (Score:2)
--
I hate to say this, but much spam comes from *.tw (Score:2)
its a damn shame. it sucks to have to blacklist a whole region of our world. but its been demonstrated again and again that most of the admins in china and korea don't seem to be 'white hats' (using the NANAE term; it means 'good guys') and that complaining to 'abuse@' and 'postmaster@' falls on deaf ears.
I'm now fine with filtering all email from .tw and .kr in my return error code (to the spammer), I include a web address that they could go to mail me, manually. if they really need to get hold of me, they can; but none have, so far - which means the spamblocking I'm doing based on country-code sure is working.
--
Re:I suppose in some idealistic sense, (Score:2)
in both cases, its their dime and if they choose to spend their own money on originating the mail or phone call, its their decision.
but in email, the bandwidth is mostly paid for by the guy closest down the line (eg, me). in this case, its theft-of-service when they send packets on my wire that I didn't accept.
non-username-protected web ports are, by definition, open to the public. email is not quite the same thing. contacting my machine is quite different than contacting me. in the first case, my machine doesn't charge the hourly rate that I do [g]. in the second case, the webserver doesn't get a flood of hits, over and over again, trying to probe for usernames to send the same stoopid messages to over and over. web hits are usually once; email hits aren't. this concept doesn't "scale" and is one reason why email is in a different catagory than any other kind of tcp traffic.
--
Re:Spam blocking (Score:3)
can't you see that that's too late?
by the time the packet has reached my wire, it has already stolen my resources. I can block on the Rx side all I want; but the PDUs will still eat up my precious wire bandwidth.
blocking at the source is the only way to stop theft of service. spam is TOS - no other way to look at it.
suppose you didn't lock your doors at home, so that any thief can come in and poke around your stuff. then, as he's walking out, you automatically snap a photo of him. what good does that do? he's already come in and messed around and had his way - 'protection' after-the-fact is totally useless once the crime has been committed.
--
Re:I suppose in some idealistic sense, (Score:3)
just one example for you. my time is worth money. whenever I have to fix or upgrade my mail system cause some turkey found a way to get thru my spamfilters, that takes time away from actual work that I need to get done. whenever a third party relay gets jammed and those sysadmins have to spend time purging their queues from theft-of-service (you obviously don't agree, and this shows you've never had to admin a large ISP's mailsystem before - so your viewpoint counts for nothing in this context) THAT costs time and money.
stop being a jerk and start understanding what the word unsolicited means.
--
ORBS/MAPS has forced me to learn my mail system (Score:5)
some joker in mpinet.net just wouldn't give up - I had several hits PER SECOND on my home dsl line. quite the TOS attack.
I was forced to learn more about my mail system (qmail on openbsd) and the oh-so-useful tcp-wrappers. I also learned about the ORBS, MAPS/RBL/RSS servers.
in a few days I had hacked my qmail and tcpwrappers system to consult the RBL lists and if there was a hit, add the offender to a local cache (so that I can recognize him quickly next time).
since my site has very very few valid usernames, it was also easy to honeypot the spammers and when an invalid username was sent to, the source IP and username would be logged for future auto-blacklisting.
I've found that cutting the spammers off at the tcp-env level is quite effective in cutting down bandwidth. they can't even telnet to my port 25 anymore - I immediately shutdown the connection! no more megabyte-of-.doc crap, no more offensive spam, no more crapola, nada. just clean and quick tcp rejects ("connection refused").
the only shame is that I fear most mass abusers don't check the return codes of mail attempts and more than that, they engage the STOLEN use of open relays. so its the open relay that queues and retries and retries (I see it in my logs..) over and over. I almost wonder if I should let them complete their junk email exchange (only after hours, when I don't need my line) just to help purge their queues (?).
at any rate, the following scripts are quite useful in this battle:
rlytest.pl, checks (sends mail to) open mail relays [unicom.com]
blq.pl, checks the MAPS,ORBS,RSS,DUL realtime blocking lists [unicom.com]
--
Re:Spam blocking (Score:3)
Re:And good riddance! (Score:5)
Just out of curiosity, what's Gilmore's take on junk fax? I'm sure even he realizes that that's an issue...
/Brian
Re:Three things... (Score:3)
False. End users can check the IP addresses in the postmarks on the envelope. I do it automatically without root access. Anything that came through an open-relay gets automatically filed in a Spam folder, which I check rarely.
What it comes down to for me is... (Score:4)
...choice. I can choose to use ORBS [in a way, I do, since I use SpamCop [spamcop.net]], or I can choose not to use it. Using ORBS will block mail, some legitimate, from reaching me. But hey, that's my choice.
While the Internet is open [for the most part] territory, each of the ISP's are private entities and, if they so choose, can choose to use ORBS [or similar] to protect their customers from spam. Some will like it, some won't. The spam policy is one of the things I research about an ISP before I use them--and when they make changes in that policy, I sort through them. I have left an ISP because of a spam policy, and I won't hesitate to do so again.
If you don't like that Earthlink is using ORBS and its child processes, don't use Earthlink. It's as simple as that.
How I dealt with my spam... (Score:5)
The last time was when I was investigating an application for our company. I visited their website and downloaded the trial version. When I filled the online form I used a "spam" address that I use specifically for occassions like this. However, when I contacted one of their sales people for an extension on the trial period, the guy added my name to a newsletter. Incensed, I wrote the guy and told him to remove me ASAP. When it became apparent that he was either unable or unwilling to remove me, I reversed the situation. I began forwarding all of my spam to him... all of it... from 3 accounts, including my "spam" account, averaging 200-300 emails a day.
Knowing he was a salesperson and maintaining an unchanging email address was vital, I wasn't surprised to be contacted within 2 days by their administrator. At which point, I informed him that until I received a formal, snail-mail (I loved that part) apology from the salesperson, that it would continue.
Then I added the administrator.
Knowing my mail was probably getting blocked, I used several accounts on several machines, rotating the names daily, and religiously adding a header explaining the situation. All in all, I was contacted by 5-6 people on my "important" email address and each time I added that name to my forwarding list (checking the company overview page and adding some execs probably didn't hurt, either). It took under a week and I received a fedex letter from that salesperson. I promptly stopped my forwarding and have yet to receive a single email from the company.
I know this isn't the ideal way to stop spam, as most spammers are near impossible to reach, but it worked for me. Getting a taste of their own medicine never hurts.
Re:Make a decision, folks (Score:3)
Censorship is bad.
Making people responsible for their actions is good.
ORBS does not censor content. ORBS gives people the information they need to make an informed decision to filter traffic from incompetent idiots.
Is that clear enough, or do I need to use shorter words?
Re:Make a decision, folks (Score:5)
Look at the facts.
Now, I can see two possibilities (neither of which will ever happen) that could help with this situation. The first is for the headers of spam to contain an obligatory item indicating that the e-mail is commercial and unsolicited. This would allow ISPs to choose whether or not to route the e-mail. The second is to have a centralized list, similar to ORBS, that includes per-user registration. If a user "opts out" of spam, any subscribing servers could refuse to route e-mail from likely spam sources that have the opted out user as a destination.
Face it, this is not just a battle over censorship.
GreyPoopon
--
Re:Spam (Score:4)
Hence the name ORBS "Open Relay Behavior-Modification System". Modifying the behaviour of open relays by getting them to not BE open relays any more.
The filtering was a (nice) side-effect, or a means to get to the end.
Spam blocking (Score:3)
Now, I could be wrong here, but wasn't ORBS something that you used if you wanted to, and didn't use if you didn't want to? Doesn't that mean it qualified as 'at the recipient level'? I mean, it's not like ORBS forces you to block traffic from these sites, but it's a good resource to use if you _want_ to.
Re:Spam blocking (Score:3)
What I'm much more worried about is the fact that ORBS got shut down over a legal injunction, but the Wired story unfortunately doesn't go into that.