Stealth Blocking

The material mentioned was first referenced in the following article:

<A HREF="http://slashdot.org/yro/01/05/21/1944247.shtml">http://slashdot.org/yro/01/05/21/1944247.shtml</A>

which refers to MAPS and Abovenet blackholing Macromedia.

It appears as a slashdot sequel to 'MAPS RBL is now Censorware' (Dec 2000)
by Jamie McCarthy. Notice the ACLU signature.

You will find details on how they squeezed my company and our stand at

<A HREF="http://www.dotcomeon.com">http://www.dotcomeon.com</A>

Mitch
NetSide

Umm... yes. You run an open, abused mail relay, got listed in RSS and
whine about it rather than fix it.
http://mail-abuse.org/cgi-bin/nph-rss?query=205.159.140.2

Could you be more clueless?

If you want to whine some more, news.admin.net-abuse.email is over there ->
and spam-l is that way <-

HTH HAND

Umm... yes. You run an open, abused mail relay, got listed in RSS and
whine about it rather than fix it.

I have posted two URLs, one was to a slashdot article describing a stealth
assault on Macromedia. So as to clarify the provenance of the URL
previously given by others in full context. Don't see your comments
there. Why? Perhaps the ACLU and those other do-good organizations
command more respect than an ISP? But they're talking about the same
thing!

The latter was to explain our position. Let's make several things clear.
First, what is the difference between an open relay and a free email
account somewhere? None, absolutely none. You could subscribe as Michael
Mouse today, and the emperor of China tomorrow. Yet such service, with no
credit card or implant chip to validate your true identity, giving away
free resources to the world, is perfectly legit in your judgement.

NetSide maintains its own access control list. If a particular ip or ip
range didn't abuse our servers, we feel no need to lock them out. And
certainly not because you say so. Not to mention that all instances of
abuse can be traced from logs to someone's ip, and there is a venue of
complaint with the abuser's provider. We have a valid reason for doing
so: locking our servers would prevent our customers from roaming, and we
would also lose a good part of our non-local client base, some of them
subscribed since 1995, who couldn't make full use of their accounts
anymore.

Second, open relays were the norm until Paul Vixie decided you should do
otherwise. And in many cases, he convinced thy by brute force that his
way is the right way is the only way. But it wasn't the legal way. Most
providers bent over and silently took the punishment. We won't. Do I seem
to whine here?

Third, the new 'rule' MAPS just came up with now is that you must keep your
server open to their 'testing', or they'll blackhole you. See for yourself:
http://www.dotcomeon.com/nph-rss-remove-blocking.html
That is the reason given for blocking us the second time around. No new
'evidence', just open wide for inspection and say ahhh...

Could you be more clueless?

That's just about what I was going to ask you. This is not about the
merits of some technological implementation over another. It is about
basic rights and freedoms shamelessly trampled upon by those that can
thump their chests the loudest and have Daddy Warbucks bankroll their
operation. Say you fall out of grace with the 'in' crowd tomorrow, could
it be your turn?

If you want to whine some more, news.admin.net-abuse.email is over there ->
and spam-l is that way <-

And you, John Payne, are here. And clearly on the side of the network
operator that's deliberately destroying the connectivity of other networks.
This problem won't just go away, as much as you want it swept under the
rug.

--Mitch
NetSide

Okay, I don't want to perpetuate this lil battle more than it needs
to however I do have a few observations that are blindingly glaring to me
and perhaps been overlooked...

Mitch Halmu was said to been seen saying:

> Umm... yes. You run an open, abused mail relay, got listed in RSS and
> whine about it rather than fix it.

I have posted two URLs, one was to a slashdot article describing a stealth
assault on Macromedia. So as to clarify the provenance of the URL
previously given by others in full context. Don't see your comments
there. Why? Perhaps the ACLU and those other do-good organizations
command more respect than an ISP? But they're talking about the same
thing!

The latter was to explain our position. Let's make several things clear.
First, what is the difference between an open relay and a free email
account somewhere? None, absolutely none. You could subscribe as Michael
Mouse today, and the emperor of China tomorrow. Yet such service, with no
credit card or implant chip to validate your true identity, giving away
free resources to the world, is perfectly legit in your judgement.

NetSide maintains its own access control list. If a particular ip or ip
range didn't abuse our servers, we feel no need to lock them out. And
certainly not because you say so. Not to mention that all instances of
abuse can be traced from logs to someone's ip, and there is a venue of
complaint with the abuser's provider. We have a valid reason for doing
so: locking our servers would prevent our customers from roaming, and we
would also lose a good part of our non-local client base, some of them
subscribed since 1995, who couldn't make full use of their accounts
anymore.

Second, open relays were the norm until Paul Vixie decided you should do
otherwise. And in many cases, he convinced thy by brute force that his
way is the right way is the only way. But it wasn't the legal way. Most
providers bent over and silently took the punishment. We won't. Do I seem
to whine here?

  Point blank open-relays are not a good idea, they may have when
the technology was not there to do otherwise but come on, with SMTP AUTH
and TLS capabilities in most "reputable" mail servers there is absolutely
no excuse for it. If you remove the open relays you remove a good bit of
the fscking spam that pollutes the net and annoys the hell out of most
people. And SMTP AUTH and TLS would not prevent your roaming customers
from sending and receiving and would actually HELP you verify it is them.

<snipped what I felt didn't need further encouragement>

  Respectfully,
  Jeremy T. Bouse

This is *so* bass-ackwards it isn't funny.

Open relays were the norm until people realized that they were getting abused.
The clueful were already closing their relays back then. Vixie started
providing the MAPS service because clueful people wanted to protect themselves
against idiots.

Incidentally, I'm pretty sure that both ORBS and the now-defunct DorkSlayers
databases actually pre-date the MAPS project. So obviously there was
a demand for the service before Vixie started it up.

And as was already pointed out, spam-l and news.admin.net-abuse.email are
probably more appropriate fora for this discussion...

> Umm... yes. You run an open, abused mail relay, got listed in RSS and
> whine about it rather than fix it.

I have posted two URLs, one was to a slashdot article describing a stealth
assault on Macromedia. So as to clarify the provenance of the URL
previously given by others in full context. Don't see your comments
there. Why? Perhaps the ACLU and those other do-good organizations
command more respect than an ISP? But they're talking about the same
thing!

If you believe everything you read in slashdot, you're either incredibly
naieve or unbelievably clueless.

Just the smallest bit of research in a relevant mailing lists archives
would yield the reasons why macromedia was RBL'd and why the listing was
removed. (Macromedia runs unconfirmed mailing lists, mailing lists get
people added who don't want to be on the list, people complain to Macromedia,
no response, people nominate Macromedia to MAPS, MAPS contacts Macromedia,
no response, MAPS adds Macromedia to RBL, Macromedia contacts MAPS,
Macromedia promises to cleanup act, MAPS removes Macromedia from RBL)

The latter was to explain our position. Let's make several things clear.
First, what is the difference between an open relay and a free email
account somewhere? None, absolutely none. You could subscribe as Michael
Mouse today, and the emperor of China tomorrow. Yet such service, with no
credit card or implant chip to validate your true identity, giving away
free resources to the world, is perfectly legit in your judgement.

Most free e-mail services aren't being abused. The spam with hotmail or
juno or whatever return addresses are not being sent through hotmail or
juno or whoever, they're being sent through open relays like yours.

NetSide maintains its own access control list. If a particular ip or ip
range didn't abuse our servers, we feel no need to lock them out. And

Bully for you. In the meantime the rest of us have to eat up the spew
coming from your server until you decide that they've reached whatever
abuse threshold you set.

certainly not because you say so. Not to mention that all instances of
abuse can be traced from logs to someone's ip, and there is a venue of
complaint with the abuser's provider. We have a valid reason for doing
so: locking our servers would prevent our customers from roaming, and we
would also lose a good part of our non-local client base, some of them
subscribed since 1995, who couldn't make full use of their accounts
anymore.

Absolute rubbish.

Second, open relays were the norm until Paul Vixie decided you should do
otherwise. And in many cases, he convinced thy by brute force that his
way is the right way is the only way. But it wasn't the legal way. Most
providers bent over and silently took the punishment. We won't. Do I seem
to whine here?

Yes

Third, the new 'rule' MAPS just came up with now is that you must keep your
server open to their 'testing', or they'll blackhole you. See for yourself:
MAPS RSS Remove Request
That is the reason given for blocking us the second time around. No new
'evidence', just open wide for inspection and say ahhh...

Uhhh... so how do you propose that relays are tested to make sure they're
closed before being removed from the database?

> Could you be more clueless?

That's just about what I was going to ask you. This is not about the
merits of some technological implementation over another. It is about
basic rights and freedoms shamelessly trampled upon by those that can
thump their chests the loudest and have Daddy Warbucks bankroll their
operation. Say you fall out of grace with the 'in' crowd tomorrow, could
it be your turn?

Oh, I'm constantly falling in and out of ORBS and peoples killfiles.
Do I particularly care? Nope... people have a right to block whatever traffic
they want from their machines.

> If you want to whine some more, news.admin.net-abuse.email is over there ->
> and spam-l is that way <-

And you, John Payne, are here. And clearly on the side of the network
operator that's deliberately destroying the connectivity of other networks.
This problem won't just go away, as much as you want it swept under the
rug.

I'm in both those places (and more) as well. If you want to stalk me at
least do others the favour of doing it where your whines stand a chance of
being ontopic... and if you're really lucky you might pick up a friend or
two on the way.

>
>
> > Umm... yes. You run an open, abused mail relay, got listed in RSS and
> > whine about it rather than fix it.
>
> I have posted two URLs, one was to a slashdot article describing a stealth
> assault on Macromedia. So as to clarify the provenance of the URL
> previously given by others in full context. Don't see your comments
> there. Why? Perhaps the ACLU and those other do-good organizations
> command more respect than an ISP? But they're talking about the same
> thing!

If you believe everything you read in slashdot, you're either incredibly
naieve or unbelievably clueless.

Conversely true for anything else you may read. I am not particularily
endorsing any opinions but my own. Yet they seem to have scored with that
article, judging from the majority of the supportive comments I read.

Just the smallest bit of research in a relevant mailing lists archives
would yield the reasons why macromedia was RBL'd and why the listing was
removed. (Macromedia runs unconfirmed mailing lists, mailing lists get
people added who don't want to be on the list, people complain to Macromedia,
no response, people nominate Macromedia to MAPS, MAPS contacts Macromedia,
no response, MAPS adds Macromedia to RBL, Macromedia contacts MAPS,
Macromedia promises to cleanup act, MAPS removes Macromedia from RBL)

And you think that justifies the brute force approach? Interestingly, MACR
seems to have the means to take them on legally. And perhaps also curious
was the hush-hush way it was handled. Were it not for some clued spirits...

> The latter was to explain our position. Let's make several things clear.
> First, what is the difference between an open relay and a free email
> account somewhere? None, absolutely none. You could subscribe as Michael
> Mouse today, and the emperor of China tomorrow. Yet such service, with no
> credit card or implant chip to validate your true identity, giving away
> free resources to the world, is perfectly legit in your judgement.

Most free e-mail services aren't being abused. The spam with hotmail or
juno or whatever return addresses are not being sent through hotmail or
juno or whoever, they're being sent through open relays like yours.

Have you ever heard of a dropbox? Would you like several tens of thousands
of examples?

> NetSide maintains its own access control list. If a particular ip or ip
> range didn't abuse our servers, we feel no need to lock them out. And

Bully for you. In the meantime the rest of us have to eat up the spew
coming from your server until you decide that they've reached whatever
abuse threshold you set.

The 'rest of us' have a traditional venue, and that is asking politely
the ISP in a documented email complaint. How many complaints did you sent
us? We're not in China, you know...

> certainly not because you say so. Not to mention that all instances of
> abuse can be traced from logs to someone's ip, and there is a venue of
> complaint with the abuser's provider. We have a valid reason for doing
> so: locking our servers would prevent our customers from roaming, and we
> would also lose a good part of our non-local client base, some of them
> subscribed since 1995, who couldn't make full use of their accounts
> anymore.

Absolute rubbish.

No kidding? Prove it is so. I think those arguments are rather valid.

> Second, open relays were the norm until Paul Vixie decided you should do
> otherwise. And in many cases, he convinced thy by brute force that his
> way is the right way is the only way. But it wasn't the legal way. Most
> providers bent over and silently took the punishment. We won't. Do I seem
> to whine here?

Yes

> Third, the new 'rule' MAPS just came up with now is that you must keep your
> server open to their 'testing', or they'll blackhole you. See for yourself:
> MAPS RSS Remove Request
> That is the reason given for blocking us the second time around. No new
> 'evidence', just open wide for inspection and say ahhh...

Uhhh... so how do you propose that relays are tested to make sure they're
closed before being removed from the database?

This is the very thing they considered abusive just a few months ago.
Wasn't it MAPS that blocked ORBS for scanning Abovenet's ports in the
first place? So now they took their rival's worst rules and made it their
own. Now it's my turn to say absolute rubbish.

> > Could you be more clueless?
>
> That's just about what I was going to ask you. This is not about the
> merits of some technological implementation over another. It is about
> basic rights and freedoms shamelessly trampled upon by those that can
> thump their chests the loudest and have Daddy Warbucks bankroll their
> operation. Say you fall out of grace with the 'in' crowd tomorrow, could
> it be your turn?

Oh, I'm constantly falling in and out of ORBS and peoples killfiles.
Do I particularly care? Nope... people have a right to block whatever traffic
they want from their machines.

ORBS is a foreign entity. Out of reach. Vixie is ante portas. American, like
you and me. Blackmailing American providers, breaking state and federal laws
with impunity. People that subscribe to the blackhole lists probably have no
idea who in particular they are blocking or to what extent. Or even why.

> > If you want to whine some more, news.admin.net-abuse.email is over there ->
> > and spam-l is that way <-
>
> And you, John Payne, are here. And clearly on the side of the network
> operator that's deliberately destroying the connectivity of other networks.
> This problem won't just go away, as much as you want it swept under the
> rug.

I'm in both those places (and more) as well. If you want to stalk me at
least do others the favour of doing it where your whines stand a chance of
being ontopic... and if you're really lucky you might pick up a friend or
two on the way.

Your mail server bounces my messages. Have you thought of that one yet?
I'm not stalking you, I'm simply responding to your comments. And if I
need a friend, I'd rather buy a dog. I'll name him Lucky.

--Mitch
NetSide

I like how MAPS is allowed to black hole your machines and their traffic. But if
you deny them access to your network resource as they are you are automatically
assumed a spammer. Wait you don't believe the same things we do, well you must
be the enemy.

I think we can all agree spam isn't a good thing, but where we drawn the line is
something we can't agree on. When you start black holing traffic to hosts and
making that choice for other people. MAPS does this with their blacking of
traffic. This type of power in the hands of a single person/organization is
wrong. I would propose a system whereas there are multiple representatives from
many viewpoints to make VERY SERIOUS decisions like this. I don't care how many
disclaimers you have in your contracts, it's not the right way to deal with this
problem....

Regards,

Rob Sharp

Mitch Halmu wrote:

  Okay, I don't want to perpetuate this lil battle more than it needs
to however I do have a few observations that are blindingly glaring to me
and perhaps been overlooked...

Mitch Halmu was said to been seen saying:

[snip]

> Second, open relays were the norm until Paul Vixie decided you should do
> otherwise. And in many cases, he convinced thy by brute force that his
> way is the right way is the only way. But it wasn't the legal way. Most
> providers bent over and silently took the punishment. We won't. Do I seem
> to whine here?
>
  Point blank open-relays are not a good idea, they may have when
the technology was not there to do otherwise but come on, with SMTP AUTH
and TLS capabilities in most "reputable" mail servers there is absolutely
no excuse for it. If you remove the open relays you remove a good bit of
the fscking spam that pollutes the net and annoys the hell out of most
people. And SMTP AUTH and TLS would not prevent your roaming customers
from sending and receiving and would actually HELP you verify it is them.

<snipped what I felt didn't need further encouragement>

  Respectfully,
  Jeremy T. Bouse

As I answered in a private post to a similar observation, you don't have
to take my word for it. Perhaps you believe what Chip Rosenthal, the daddy
of MAPS TSI, states on his own site about POP-before-SMTP Authorization:
"Our users hated it - particularly those using MS Outlook".

--Mitch
NetSide

> If you believe everything you read in slashdot, you're either incredibly
> naieve or unbelievably clueless.

Conversely true for anything else you may read. I am not particularily

Like duh. But I'm willing to give more credence to what the people actually
involved say.

endorsing any opinions but my own. Yet they seem to have scored with that
article, judging from the majority of the supportive comments I read.

/.'s supporting you. OK, thats it, you've convinced me. Free speach is the
way to go... I'm going to threaten to sue everyone who doesn't listen to
me from now on.

(yeah, right)

> Just the smallest bit of research in a relevant mailing lists archives
> would yield the reasons why macromedia was RBL'd and why the listing was
> removed. (Macromedia runs unconfirmed mailing lists, mailing lists get
> people added who don't want to be on the list, people complain to Macromedia,
> no response, people nominate Macromedia to MAPS, MAPS contacts Macromedia,
> no response, MAPS adds Macromedia to RBL, Macromedia contacts MAPS,
> Macromedia promises to cleanup act, MAPS removes Macromedia from RBL)

And you think that justifies the brute force approach? Interestingly, MACR

What brute force approach? Nobody is forcing anybody to subscribe to any
lists.

seems to have the means to take them on legally. And perhaps also curious

Wonder why they didn't? Maybe because they knew they were in the wrong.

was the hush-hush way it was handled. Were it not for some clued spirits...

From an outside point of view it was handled like everyother case I've

seen.

Have you ever heard of a dropbox? Would you like several tens of thousands
of examples?

We're not talking about drop boxes. We're talking about relay abuse.

The 'rest of us' have a traditional venue, and that is asking politely
the ISP in a documented email complaint. How many complaints did you sent
us? We're not in China, you know...

What difference does the number of complaints I send you make? RSS
subscribers have decided to not allow any mail from hosts listed on RSS.
There is proof on the RSS website that your mail server is an open relay
and has relayed spam.

You have 2 choices.
1) close your open relay
2) deal with the fact that some people don't want mail from your server.

> > certainly not because you say so. Not to mention that all instances of
> > abuse can be traced from logs to someone's ip, and there is a venue of
> > complaint with the abuser's provider. We have a valid reason for doing
> > so: locking our servers would prevent our customers from roaming, and we
> > would also lose a good part of our non-local client base, some of them
> > subscribed since 1995, who couldn't make full use of their accounts
> > anymore.
>
> Absolute rubbish.

No kidding? Prove it is so. I think those arguments are rather valid.

Closing an open relay has nothing to do with stopping your non-local clients
from roaming and still using your relay. SMTP AUTH, pop-before-smtp, VPN,
ssh tunnel are just 4 options off the top of my head.

> Uhhh... so how do you propose that relays are tested to make sure they're
> closed before being removed from the database?

This is the very thing they considered abusive just a few months ago.

No it isn't. Once your server is listed in RSS, the only time MAPS will
try and relaytest you is if you ask them to remove you.

Wasn't it MAPS that blocked ORBS for scanning Abovenet's ports in the
first place? So now they took their rival's worst rules and made it their
own. Now it's my turn to say absolute rubbish.

proactive scanning is a completely different ballgame to reactive testing
on your request.

> > > Could you be more clueless?
> >
> > That's just about what I was going to ask you. This is not about the
> > merits of some technological implementation over another. It is about
> > basic rights and freedoms shamelessly trampled upon by those that can
> > thump their chests the loudest and have Daddy Warbucks bankroll their
> > operation. Say you fall out of grace with the 'in' crowd tomorrow, could
> > it be your turn?
>
> Oh, I'm constantly falling in and out of ORBS and peoples killfiles.
> Do I particularly care? Nope... people have a right to block whatever traffic
> they want from their machines.

ORBS is a foreign entity. Out of reach. Vixie is ante portas. American, like

So, I still don't see you complaining about being listed in ORBS (which you
are).

you and me. Blackmailing American providers, breaking state and federal laws

I'm not American, and I resent you implying that I am (as would most
Americans).
Exactly what state and federal laws are MAPS breaking?

with impunity. People that subscribe to the blackhole lists probably have no
idea who in particular they are blocking or to what extent. Or even why.

Uhh, sure they do. They're blocking people who meet the criteria for being
in that list.

> > > If you want to whine some more, news.admin.net-abuse.email is over there ->
> > > and spam-l is that way <-
> >
> > And you, John Payne, are here. And clearly on the side of the network
> > operator that's deliberately destroying the connectivity of other networks.
> > This problem won't just go away, as much as you want it swept under the
> > rug.
>
> I'm in both those places (and more) as well. If you want to stalk me at
> least do others the favour of doing it where your whines stand a chance of
> being ontopic... and if you're really lucky you might pick up a friend or
> two on the way.

Your mail server bounces my messages. Have you thought of that one yet?

Of course, you're mailing me from an open relay. And yet I'm still replying
to this post. Oh wait, maybe its coming through the mailing list that you
persist in copying *duh*

I'm not stalking you, I'm simply responding to your comments. And if I
need a friend, I'd rather buy a dog. I'll name him Lucky.

Too many jokes ... can't decide which to use

Last mail from me to nanog in this thread.

I have posted two URLs, one was to a slashdot article describing a
stealth assault on Macromedia. So as to clarify the provenance of
the URL previously given by others in full context [...]

Slashdot has never been an accurate news source, and the article
you've referenced is certainly no exception.

NetSide maintains its own access control list. If a particular ip or
ip range didn't abuse our servers, we feel no need to lock them
out. And certainly not because you say so. Not to mention that all
instances of abuse can be traced from logs to someone's ip, and
there is a venue of complaint with the abuser's provider.

Running open relays is _never_ an acceptable practice. Allowing the
entire Internet to relay off your SMTP server, and then attempting to
block offenders after the damage is done, isn't very effective or
scalable. We've had this discussion before.

We have a valid reason for doing so: locking our servers would
prevent our customers from roaming, and we would also lose a good
part of our non-local client base, some of them subscribed since
1995, who couldn't make full use of their accounts anymore.

Most responsible operators are using SMTP auth, POP/IMAP-before-SMTP,
secure tunneling, or some combination of the above to accomplish this.
Why aren't you?

Second, open relays were the norm until Paul Vixie decided you
should do otherwise. And in many cases, he convinced thy by brute
force that his way is the right way is the only way. But it wasn't
the legal way. Most providers bent over and silently took the
punishment. We won't. Do I seem to whine here?

I don't think AboveNet/MFNX even subscribes to the MAPS RBL. Of
course, if they are/were denying access to Macromedia as part of an
internally-run blackhole, I give them props.

Third, the new 'rule' MAPS just came up with now is that you must
keep your server open to their 'testing', or they'll blackhole
you. See for yourself:
MAPS RSS Remove Request That is the
reason given for blocking us the second time around. No new
'evidence', just open wide for inspection and say ahhh...

If you have a problem with this, take it up with its maintainers, not
NANOG.

-adam

I like how people like to rant without correlation to reality. MAPS doesn't
blackhole your machines. *I* blackhole your machines, based on *MY* decision
that if you're listed in MAPS, you're somebody I don't want to talk to.

Until you get that little detail straight, all your pissing and moaning
about MAPS is just that - pissing and moaning. You can complain to MAPS
about being listed in their database, or you can complain to me about my
black holing your traffic because I found you listed in MAPS. But you can't
complain about MAPS black holing you because they don't.

Using a clue for more than 20 seconds would show that MAPS *CANT* blackhole
your traffic themselves - if they did, HOW WOULD THEY TEST THAT YOU"D CLOSED
AN OPEN RELAY?

I would suggest that folks read how MAPS RBL works before they spew innuendo
and half-truths. MAPS may not be perfect, but it certainly isn't 'a single
person/organization' with this power. MAPS only acts on third-party
nominations, has an exceedingly drawn-out confirmation process, and only
publishes a BGP feed that *providers* must configure their routers to
accept. MAPS RBL does nothing beyond publish a list of known, confirmed,
unrepentant spam sites in the format of a BGP4 advertisement. Private
networks can and will block what they want, MAPS just publishes a list of
sites that they block from their network. I (and every other network
operator) can and will block whatever I want, unless my contract with my
customers prevents it.

Jeremiah

I have fairly strong feelings about the free speach issue myself, and I'd love to join in and help feed the trolls, but the S/N ratio is already bad enough. Maybe we could feed them via private email rather than inflicting it on the list. If a troll says something and nobody rebuts him, that doesn't mean that he wins. The troll wins by getting a response.

I keep missing the part that has to do with laws and legallity. You see to
like to toss that around without any legal precedence for your
statements. Its a shame for you and your employer that you don't believe
in filtering abuse from your network. Your also in the minority. Simple as
that. Just as it is your right to misconfigure your mail server and
provide free services to spammers, it is my right to blackhole you from
existance. Neat how that works both ways. Its probably best that everyone
agrees to disagree. You can keep providing services to spammers and we
will continue to block you and we can leave it at that. I'm sure some
people on SPAM-L would have some opinions on this subject should you
decide to take it to the proper forum.

andy

Valdis.Kletnieks@vt.edu writes:

This is *so* bass-ackwards it isn't funny.

You want facts, yet you read NANOG? To call what's been posted to this
thread "wildly inaccurate" would give it far more credit than it has earned.
(Not picking on Valdis in particular, he and I are on the same side after all.)

Open relays were the norm until people realized that they were getting
abused. The clueful were already closing their relays back then. Vixie
started providing the MAPS service because clueful people wanted to protect
themselves against idiots.

The list that netside found itself listed on was MAPS RSS, which was
originally created by Al Iverson under the name RRSS. MAPS gave it,
and then later Al himself, a new home. Vixie (that's me) was never
personally involved -- MAPS is a limited liability company founded by
Vixie (me again) and Dave Rand.

Incidentally, I'm pretty sure that both ORBS and the now-defunct
DorkSlayers databases actually pre-date the MAPS project.

ORBS is the name Alan Brown switched to when I complained that calling his
project the DorkSlayers RBL was leading a lot of people to send hate mail
to MAPS (the original "RBL") about sites that were actually on Alan's list.

So obviously there was a demand for the service before Vixie started it up.

Vixie (me, still) started the RBL as an independent project shortly before
MAPS was cofounded by Vixie (hi!) and Rand. RRSS was created independently
by Al Iverson at about the same time as Alan Brown started DorkSlayers. RRSS
became the MAPS RSS some time afterward.

And as was already pointed out, spam-l and news.admin.net-abuse.email are
probably more appropriate fora for this discussion...

Right. On the other hand I don't read those since I'm not a day to day part
of MAPS or indeed of the anti-spam community. Dave Rand is MAPS's executive
director now (following his resignation from MFN/Abovenet a while back) and
while he reads the spam fora I don't think he's on NANOG any more. Comments
about the MAPS RSS, or indeed anything else about MAPS, should most likely be
sent to him (dlr@mail-abuse.org) if you want to be sure he reads them.

OK Let me start again. Lets go over some assumptions I made the first time that
obviously need to be restated.

1) MAPS is a single self appoint law enforcement agency on the INTERNET. Don't argue
until you hear me out.
a) MAPS creates the LAW, ie. no open relay

b) MAPS enforces the law and if you don't let them scan your machine you are
automatically assumed guilty. Last I checked you needed a warrent and some proof to do
that, one easily forgable email header is not proof, in any universe.
    ie. You create a mailserver, you don't allow MAPS to probe it, you are placed on
the list, by someone for nomination, because they think they were SPAMMED by you. Were
they spammed? maybe, maybe not, some people give out their email address on every
webform they can find and don't click the right check box ect and are placed on this
list. Perhaps no ONE peice of spam has ever graced you machine, you are still guilty.
I have heard the arguement, how can maps tell if you are an open relay if you don't let
them scan. Well you can't sorry, not everything in the world can go your way... I
know this means in fact this arguement may not go my way. Again I am willing to accept
it, but I will not buckle to comment of about my intellect and my lack of being
informed as defeat. It's simple not true.

c)MAPS sentences you. You are placed on this LIST rather or not you are actually
generating spam. This is a case of the ends justifiys the means.

A few netizens of NANOG don't understand my point. The IDEA of maps isn't a bad
idea, the idea of summarily judging a server and causing people who are using legimate
use problems is wrong. I am not saying this is the norm, but it obiviously seems that
some people have questioned the MAPS "way" and have had it fall on deaf MAP'S ears. I
don't like the IDEA of one person controlling the show. I would rather have a
commitee, create the rules and see it enforced.

And if you use the MAPS list by your choice you are most definetly filtering out email
or traffic for people who are legitimate. I know I have been filtered before. MAPS is
using a very large hammer to kill a not so large bug.

In conclusion. I HATE spam like everyone else. I am just opposed to the solution that
seems to keep gaining acceptance. And I have been asked by many other people on and
off list to spot expressing my obviously un informed views. We let me say that asking,
rather demanding, I stop questioning this is dead wrong and if people didn't question
ideas we would still thing the earth was flat and we were the center of the universe.

Regards,

Rob

Mitch Halmu was said to been seen saying:

> Okay, I don't want to perpetuate this lil battle more than it needs
> to however I do have a few observations that are blindingly glaring to me
> and perhaps been overlooked...
>
> Mitch Halmu was said to been seen saying:
[snip]
> Point blank open-relays are not a good idea, they may have when
> the technology was not there to do otherwise but come on, with SMTP AUTH
> and TLS capabilities in most "reputable" mail servers there is absolutely
> no excuse for it. If you remove the open relays you remove a good bit of
> the fscking spam that pollutes the net and annoys the hell out of most
> people. And SMTP AUTH and TLS would not prevent your roaming customers
> from sending and receiving and would actually HELP you verify it is them.
>
> <snipped what I felt didn't need further encouragement>
>
> Respectfully,
> Jeremy T. Bouse

As I answered in a private post to a similar observation, you don't have
to take my word for it. Perhaps you believe what Chip Rosenthal, the daddy
of MAPS TSI, states on his own site about POP-before-SMTP Authorization:
"Our users hated it - particularly those using MS Outlook".

  Did I say POP-before-SMTP? I don't think I did... SMTP AUTH and TLS
are two completely setups than POP-before-SMTP and both are supported by any
decent MUA. I agree POP-before-SMTP was not a good plan but it worked before
the SMTP AUTH mechanism came of age. Now there is no logical reason not to
use it. Or let me guess you don't authenicate your NNTP server either like
most reputable USENET server admins are doing.

  Jeremy T. Bouse

Okay, let's assume you're right, and the MAPS folks are the fairest in
the land. Then how do you explain our case? NetSide was blackholed
between Jul 13, 00 and Feb 27, 01, then the block was mysteriously
lifted, only to be reistated on May 11, 01. The 'evidence' is the same,
a single relayed message from a Corecomm customer to daver.bungi.com
That is Dave Rand's personal playground. Dave is also a founding father
of MAPS, and was recently (like Apr 30) elevated to the reigns after he
'retired' from MFNX. We were blackholed again on a capricious change in
their rules. Tomorrow there will be even more rules. And so the noose
tightens...

Thought you said third party nomination, not insider?

I allege they draw a profit from their activities, and that is the true
purpose of all this. The non-profit organization voluntarily relinquished
its tax exempt status, and Vixie explained why on his pages. If I
remember correctly, it's because the government would investigate
complaints.

The type of cartel that was created here is against anti-trust laws in
the US. That's what is commonly referred to as conspiracy to restrict trade.
The legal aspects are well covered on http://www.dotcomeon.com Furthermore,
MAPS doesn't really openly publish its lists. Why do you think that's so?
Wouldn't it be nice, or at least fair for everyone to know who's listed?

So now, how has my business bothered your business? It hasn't. I don't
recall any complaints from your service. That means we at least manage
and monitor our servers pretty effectively as configured, and we're not
unrepentent spammers. But we dared to be different. Face it, it's really
our philosophy that angers you.

--Mitch
NetSide

Hmm.. you won't configure it correctly. RFC2505 is "Best Current Practice".

You get filtered because you won't configure it correctly.

You say you've been filtered *before* because you won't configure it correctly.

Yes, we *admit* we're using a large hammer. Bouncing your e-mail didn't
get your attention. Maybe irate users will get your attention. But I
am doubting it.