RE: Attn MCI/UUNet - Massive abuse from your network

>

[ SNIP ]

this discussion anyways, is access to the internet. When the
actions of a
downstream damage that product(IE more and more networks
nullroute UUNet
traffic),

[ Operations content: ] Do you know of any ISP's null routing AS701?

-M

ISPs? Not of the top of my head. I know several businesses who have, and a great many people who have blocked UUNet space from sending them email, either by using SPEWS, the SBL, or mci.blackholes.us .

~Ben

Do these people know how much legitimate email they're missing, for every
spam message that's blocked?

I noticed that from my personal mailbox (which I do filter with spam
assassin), for every one legit mail that gets blocked/tagged by SPEWS,
there's maybe 1-2 junkmails. Thats not a very impressive ratio...

I think that is a bit irresponsible for the simple
reason that MCI has many co-lo clients and any of
their machines could be vulnerable, I think also that
needs to addressed so that blanket statements are
supported by fact and not the need to competitively
break a company down in hopes the you can steal away
it's customer base....

-Henry

I seldom post here because the couple of times I have followed-up to correct wrong statements in nanog regarding Spamhaus, such as the above, I have each time been told by nanog's admin that I will be removed from the nanog list if I respond to any question in nanog regarding Spamhaus again. But, here goes:

The statement by Ben Browning: "I know several businesses who have, and a great many people who have blocked UUNet space from sending them email ... by using ... the SBL" is false, the SBL has never blocked UUNet/MCI IP space that wasn't directly in the control of spammers. If Mr Browning does indeed know "several businesses and a great many people" whose UUNet/MCI IP space has been blocked by the SBL, then Mr Browning knows several spam outfits and a great many spammers.

Steve Linford wrote:

I seldom post here because the couple of times I have followed-up to
correct wrong statements in nanog regarding Spamhaus, such as the
above, I have each time been told by nanog's admin that I will be
removed from the nanog list if I respond to any question in nanog
regarding Spamhaus again. But, here goes:

Why would you be removed from the list for posting corrections about Spamhaus?

Can the list admin or other responsible person please explain the reasoning?

It only seems fair that if someone is misrepresented by a posting on this list, they should be free to correct such misinformation.

Jon Kibler

I looked back through the archives, and I did see one post which was
fairly inflammatory, but I wasn't really that excited to read
everything....

The big deal is that spam complaining/etc is not operational content, and
there are several other lists to handle that sort of thing.

but then, individuals get 1 free shot at saying things that are in
some cases not true about spamhaus, and Steve is prohibited from
attempting to correct them.

hardly seems fair,
  richard

Steve can correct whomever he wants off list.
If he wants to do it on list, it better be for a good reason, no?
If the person posting the untrue information is not posting with
operational content, they should be censured as well...

A simple "these statements are untrue, please contact me off list for the
truth" is hardly unreasonable.

:
: A simple "these statements are untrue, please contact me off list for the
: truth" is hardly unreasonable.
:
:
:
Unfortunately a restriction such as that on this list defeats the atmosphere of
openness and education for those who may be reading, but not necessarily
posting to the list. Educating users, even if some of the subscribers are the
choir should be our collective goal. In my case not all the conversations
(threads) on this list are pertinent to my operations but I still read them
all, and am educated from time to time as well, which makes it worth the
effort. IMHO.

What I don't like to read are personal attacks or arrogance to the extreme.

Doug

Steve Linford wrote:

The statement by Ben Browning: "I know several businesses who have,
and a great many people who have blocked UUNet space from sending
them email ... by using ... the SBL" is false, the SBL has never
blocked UUNet/MCI IP space that wasn't directly in the control of
spammers. If Mr Browning does indeed know "several businesses and a
great many people" whose UUNet/MCI IP space has been blocked by the
SBL, then Mr Browning knows several spam outfits and a great many
spammers.

Let me rephrase: I know several businesses and a great many people who
block *parts* of UUNet by the SBL and *larger* parts of it by means of SPEWS, blackholes.us, et al.

Regardless, the SBL does block *some* UUNet space, much of which(according to responses here) no longer belongs to the spammers.

Sorry for any confusion my poor choice of words may have caused.

From Ben Browning, received 29/6/04, 9:56 am -0700 (GMT):

Steve Linford wrote:

The statement by Ben Browning: "I know several businesses who have,
and a great many people who have blocked UUNet space from sending
them email ... by using ... the SBL" is false, the SBL has never
blocked UUNet/MCI IP space that wasn't directly in the control of
spammers. If Mr Browning does indeed know "several businesses and a
great many people" whose UUNet/MCI IP space has been blocked by the
SBL, then Mr Browning knows several spam outfits and a great many
spammers.

Let me rephrase: I know several businesses and a great many people who
block *parts* of UUNet by the SBL and *larger* parts of it by means
of SPEWS, blackholes.us, et al.

I obviously read more into it than you meant, sorry (I though you were implying we were blocking MCI IPs above and in addition to IPs belonging to spammers, something we try hard not to do).

Regardless, the SBL does block *some* UUNet space, much of
which(according to responses here) no longer belongs to the
spammers.

That's correct. At a guess I'd say possibly even 20% of our MCI listings are stale, and we don't know which ones. Without illegally scanning the MCI IPs to see what's running there we have very little way of knowing which spammers are departed or not, because MCI/UUNet Abuse will not tell us.

Unlike listings of normal providers which tend to manage themselves, MCI SBL listings continue to grow in number and are removed either because they've reached their time-out setting or because someone higher up yells and the Abuse guys get their fingers out. We see things start to happen when Christopher Morrow gets involved, but they soon revert if he's not chasing them. Vint Cerf is now aware of the situation so perhaps more might begin to move and we may soon see those MCI listings drop down, and maybe a refresh of MCI's AUP enforcement.

Thanks for voicing your opinion with MCI.