In article <telecom24.166.9@telecom-digest.org>,
John Levine <johnl@iecc.com> wrote:
>> Ok, this guy contracted for high speed internet connectivity from
>> someone or another.
> That would be MCI.
>> Why did anyone else accept any packets from this organization?
> Good question. They're consistently #1 on the Spamhaus hit parade.
> [TELECOM Digest Editor's Note: Then why are they not getting cut off
> from the rest of the world until they make an effort to get rid of
> their spam traffic? Is it possibly because your superiors at ICANN
> and their mouthpiece Vint Cerf are so well funded by MCI that they do
> not allow (by heavy pressure or otherwise) anyone to put a permanent
> halt on MCI's traffic? Why is ICANN so silent on the volumes of spam
> the rest of the net has to endure day after day? Is it because ICANN
> and Vint Cerf are actually more interested in appeasing the spammers
> and commercial interests rather than the vast majority of the netizens?
Nope. it's because it is, quite simply, *NOT* ICANN's job to do so.
Of the various organizations (ICANN, IAB, IETF, etc.) that are the
'authority' for specific functionalities of the greater Internet,
_none_ of them have any authority with regard to the 'content' of
packets.
And *nobody* on the 'net wants it any other way. (Well, except for
folks like the government of mainland China, that is.)
Not to mention that there is _nothing_ that ICANN can actually _do_
that would affect matters. They can't revoke the IP addresses MCI
uses, those addresses were issued by ICANN to ARIN. They can't revoke
the domain-name(s) MCI uses, those names are part of
properly-executed _contracts_ between MCI and the domain registry
operator. And the operator's contract (with ICANN, or the appropriate
'national' authorizing authority) requires _them_ (the registry
operator) to publish *all* properly contracted domains.
Those are the *only* aspects of the Internet that fall under ICANN's
'area of responsibility'.
> John, instead of answering a question with the statement 'good question'
> why is no one (in authority on the net) actually, physically cutting
> off MCI by refusing to accept any or all of their traffic until the
> spam stops? PAT]
Because: (a) there is *NO*ONE* 'in authority'. The net runs by anarchy.
(b) some people _do_ block all MCI traffic. Unfortunately
they are personal/'vanity' networks.
(c) last I knew, MCI had something like a _40%_ share of the U.S.
Internet market. It simply isn't practical for any
'significant' player to write off that big a chunk of
the potential customer base.
(d) in general, anybody doing 'broad brush' blocking of MCI ends
up hurting *themselves* worse than they hurt MCI.
Unfortunate, but _true_.
This is reality. One can "wish" that things were different, but you still
have to deal with reality.
In article <telecom24.167.7@telecom-digest.org>, John Schmerold
<john@katy.com> wrote:
> No one likes spam, however, there are great solutions they are all
> available without cost due to the opensource movement. Looking at my
> own statistics, since 4/1, I've received 5,607 emails, of which 1,177
> were forwarded to my inbox, of these 169 were SPAM. All of the 169
> could have been eliminated if I chose to use TDMA which whitelists
> good senders.
> So, long story short, quit belly aching and do something about your
> spam problem.
> John Schmerold
> [TELECOM Digest Editor's Note: But I cannot run a white list here
> unless I want to turn this Digest/newsgroup into a very exclusive
> place for _me and my friends_ . I like to get _legitimate_ mail from
> legitimate users. I do not like the idea of excluding new users just
> because they have not met some arbitrary standard on the messages I
> will accept. PAT]
There are various ways of "coping" effectively:
You can use _different_ e-mail addresses for different functions
(e.g., one for the newsgroup moderator 'submission' address,
a different one for submission "acks", another one for
outgoing Telecom-Digest mailings, and yet another one for
"personal" communications.)
You can then apply _different_ rules for each address. e.g.:
You can whitelist everybody that is subscribed to Digest mailing-list.
You can auto-accept any message that is a "reply" to a newsgroup posting.
You can whitelist other "known" correspondents.
You can auto-accept any message that has a certain "magic word" at the
beginning of the subject line.
You can then, fairly safely, _reject_ messages that lack the 'magic word'
in the subject line, *with* a notice telling the sender that the
magic word (and what it is) is required for message acceptance.
Doing these things 'right' requires some fairly close integration with the
mail-server itself.
BUT, when done right, can be _very_ effective.
I've been running a custom-developed system (along the above lines)
for roughly the last year. In that time, I've had mail from _three_
people get "erroneously" rejected (one required filter revisions --
*too* paranoid;, one was a family member with multiple accounts,
including one at Netscape, and got their mail-client "confused", so
that it was sending messages with a from of "@netscape.net", but going
through the cable-company's mail- server to do so; the third was
somebody I haven't heard from in years, who apparently found my
address from USENET postings, and tried to mail -- and apparently
couldn't read the error message telling them how to send mail that
would go through, no real loss), and a grand total of _eight_ pieces
of spam get to my inbox.
I have a few domains (e.g., AOL, Yahoo, HotMail) for which I accept
mail _only_ from servers in their domain.
I have a few (right now 3) overseas freemail providers that are totally
blocked -- they account for less than 1% of (pre-rejection) message
volume, however
I have one address-range blocked -- A space allocated to Nigeria.
I have one persistent spammer blocked by domain-name. they _do_ send
consistently from their own server, and identify properly, so it's
effective against this particular idjiot.
I have several forms of remote mail-server identity 'forgery' blocked
(e.g. if they HELO with _my_ IP address as _their_ identity. :)
I have blocks for headers indicating a couple of specific mail-sending
programs that are routinely abused by spammers, and that do not
provide enough information to back-track.
I have a _handful_ of content-based filters that catch things:
HTML-only email is not allowed
messages in character-sets I can't deal with -- most notably Pacific
Rim ones -- are not allowed.
I have a batch of body-content filters (about 50), *NONE* of which have
caught anything in the last 6 months.
Anything with what even "looks like" an MS-executable or 'zipfile'
attachment is not allowed, except by special arrangement. (This
one is permanent -- eliminates any need for the overhead of
Any of various URLs or mention of a few specific drugs, etc.
NOTE: I see a fair number of virus-delivery attempts _every_ day, but
they all fail earlier checks _before_ getting to the 'executable'
detector. The situation is probably similar with the other body-
check filters, but it's much harder to tell. I'm probably going
to remove all those 'non-executable' checks, cuz they don't seem
to do any good -- no sense wasting CPU cycles. <grin>
I 'whitelist' some mailing-lists I'm on, and the 'moderator' address
of some moderated newsgroups.
Now, admittedly, the rulesets here are tailored for the needs of _my_
users, but they *are* effective. I post to this newsgroup (and a number
of others) with an valid,_unmunged_, "reply-able" address. Not a _single_
piece of spam has been delivered to that address in the last year.
For those who remember Dave Hayes, I may not have a psychic newsreader;
but I've got the next best thing to a 'psychic mail-server'! :) It can
tell -- with _very_high_ reliability -- whether a mail message was composed
inside a newsreader or not. It's not absolutely perfect -- a couple of
people who were curious _how_ it worked, did some experimenting and figured
it out. Regardless, it's demonstrably "good enough" for the real world.
[TELECOM Digest Editor's Note: There is far, far too much stated above
to even begin responding. I will just address one point of yours,
which was 'how cutting off MCI would really hurt the rest of the net.'
Oh, boo hoo, let me cry about it tomorrow or whenever I get more
time. And you say, a net that is presently 80-85 percent spam is going
to be irreparibly damaged by calling their bluff and cutting them off
until they are willing to talk seriously about the spam issue? Gee,
that's really something. Seems to me if nothing else it would clean up
the spam problem a lot. Let's test it out and see: John Levine, since
you run the telecom-digest.org alias, do me a favor please. Block any
and all traffic via MCI coming here. Let's see if tomorrow and the
next day I don't have just as many messages as I do now, but far less
spam to deal with. Just cut it all, return to sender or whatever you
wish.
People also told me regards the bunch of crooks in New Jersey I should
not tell people to withhold their monthly payments, 'that by doing so
I would cause the people to get sued'; remember that? That was a big
laugh also; no one got sued and the Attornies General in many states
made the leasing companies back off. So my suggestion this month is
do yourself and the rest of the net a big favor: start refusing
traffic from MCI, as I just now above asked John Levine to do for me.
Check with me in a few days and I will let you know how much I miss
getting all those fabulous offers in Spam and all those viruses. PAT]
Robert Bonomi (bonomi@host122.r-bonomi.com)