Anonymous Postmasters Early Warning System (APEWS.ORG) has started

[s***@postmasters.servegame.org]

This will be the first and only public message you will ever read from
us.

APEWS was foundet by some people thinking SPEWS might be dead, but they
did a great job.
We have started with new (plain) zones in SPEWS-Style and just listed
the first areas this days.

There are some significant differences to SPEWS:

While it seems SPEWS was a one man show, APEWS will be maintained by
many operators.
APEWS will invite people we think we must have onboard to join the
operator team.
Please note: You can not contact us - But possibly we will contact you.
If any mail claiming to be from us was received by an IP not resolving
to apews.org then it's faked.

APEWS Level 1 is a RHSBL (lists domains), APEWS Level 2 is a DNSBL
(lists IP's and CIDR's).

If you feel we do anything wrong, post to
news.admin.net-abuse.blocklisting or news.admin.net-abuse.email
starting with subject APEWS followed by the Case-ID.

Listings will escalate faster and deescalate slower than in SPEWS.

We recommend every SPEWS user to use APEWS now.

We will try our best to make you happy. That's a promise.

And now visit http://www.apews.org to find out about details.

Thank you.

[Stephen Satchell]

A set of small suggestions:

1. With each IP address or range listed, include the ASN. (Providing
ASNs for domain names is problematic because domain names are far more
portable than IP addresses.)

2. On your Web page, provide a search by ASN. The result would be a
list of links to actively listed IP addresses or ranges. This enables a
provider who cares to use your Web page to see all listings associated
with his or her ASN.

3. Restrict IP ranges to a single ASN.

-==-

And, of course, this is NANAE so we need the obligatory spelling,
grammar, and content nits.

From the FAQ:

A15: The couase APEWS exists spam (aka: unsolicited bulk email). That is
what APEWS is designed and intended to list, nothing more.

[couase is not a word; looks like someone got nailed by an editor with
bad mouse control]

-==-

Q13: What gives you the right to stop spammers, or anyone for that
matter, from sending you email?
A13: Basic private property rights and basic freedoms to associate with
and not associate with whomever we chose. Our email systems and
mailboxes are our and our client's private property, some of us tried
putting up "no trespassing" signs ("don't spam here" banners), when they
were disregarded we hired the equivalent of a "nightclub bouncer" who
has a list of past trespassers and potential troublemakers we'd rather
not let in. The bouncer is our email/packet filtering software, the list
it uses is called APEWS.

RECOMMENDATION: Make clear in the answer that the "you" in the question
is assumed to be the APEWS operators *only*. Also add that other mail
administrators around the world decide whether or not to consult with
APEWS when making an accept/reject decision. This recommendation is for
an addition, at the beginning of the answer, and not a replacement. I
like the answer, frankly.

Q25: Will APEWS ever list the big corporate spammers?
A25: Yes. If they venture into the pure unsolicited emailing world, or
have an un-managed "affiliate" program that causes spam problems they
will be listed.

RECOMMENDATION: find a good description of "afflilate program" and link
to it.

-==-

Just my pair-o'-pennies.

(By the way, on the assumption that the mail I received last year was an
invitation to join this group, I wish I would have been able to assist.
As the one and only network/mail administrator for $DAYJOB, I already
work too many hours. I'm talking with The Boss about mirroring APEWS,
though.)

Satch
--
A little learning is a dang'rous thing;
Drink deep, or taste not the Pierian spring;
There shallow draughts intoxicate the brain,
And drinking largely sobers us again.
-- Alexander Pope, Essay on Criticism

[Shmuel (Seymour J.) Metz]

Post by Stephen Satchell
1. With each IP address or range listed, include the ASN.

Listing the ASN for an IP address is a good idea, but I have
reservations about trying it for domains.

Post by Stephen Satchell
(Providing ASNs for domain names is problematic because domain
names are far more portable than IP addresses.)

More than problematical. Do you want them to list IP addresses for the
subject domain, which may not even exist, or to list IP address for
every subdomain, which doesn't scale?

Post by Stephen Satchell
2. On your Web page, provide a search by ASN.

AOL.

Post by Stephen Satchell
3. Restrict IP ranges to a single ASN.

AOL.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[p***@ipal.net]

On Sun, 14 Jan 2007 01:40:50 GMT "Shmuel (Seymour J.) Metz" <***@library.lspace.org.invalid> wrote:

| In <***@news.supernews.com>, on 01/12/2007
| at 02:04 PM, Stephen Satchell <***@satchell.net> said:
|
|>1. With each IP address or range listed, include the ASN.
|
| Listing the ASN for an IP address is a good idea, but I have
| reservations about trying it for domains.

It just wouldn't be applicable to associate an ASN to a domain.
Domains can span ASNs, and an ASN can have many domains. Some
other database could conceivably aggregate which ASNs have some
domain, and which domains are in some ASN. But an ISP can run
an rDNS scan on all their own networks to see what their delegated
rDNS has.


|>(Providing ASNs for domain names is problematic because domain
|>names are far more portable than IP addresses.)
|
| More than problematical. Do you want them to list IP addresses for the
| subject domain, which may not even exist, or to list IP address for
| every subdomain, which doesn't scale?

I think he was referring to listing ASNs for domain names. Certainly
what you are referring to is a hard project. Anyone up for collecting
every rDNS data in IPv4 space and building a big database to search?
Unless someone has tons of resources sitting idle, I don't envision
this ever happening. I do collect rDNS from many allocated spaces that
have an IP that sends me spam. But that's only a small dent in all of
the IPv4 space. Don't even think of doing this for the IPv6 space.
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-01-17-***@ipal.net |
|------------------------------------/-------------------------------------|

[p***@ipal.net]

On Fri, 12 Jan 2007 14:04:36 GMT Stephen Satchell <***@satchell.net> wrote:

| 2. On your Web page, provide a search by ASN. The result would be a
| list of links to actively listed IP addresses or ranges. This enables a
| provider who cares to use your Web page to see all listings associated
| with his or her ASN.

There should also be a search by CIDR or IP range. I have not checked
to see if this already exists. Many smaller ISPs don't have ASNs.
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-01-17-***@ipal.net |
|------------------------------------/-------------------------------------|

[Roy Bixler]

Post by s***@postmasters.servegame.org
Listings will escalate faster and deescalate slower than in SPEWS.

That's fine, but I hope that it's more of an automated system than was
SPEWS. I know of one listing that remained in SPEWS for years that should
have either been removed or updated. That was enough to make me doubt that
SPEWS was automated as claimed in its FAQ.

Also, here are a few other nits to pick in the FAQ. First, in A26, you may
want to remove the reference to ORDB since it is now defunct. Also, in
A45, what does the following part of the description of the UCEPROTECT list
mean? "They are known to be consequent ..." Do you mean instead to say
"honest", "forthright" or "straightforward"? Also, I would change the
wording "we have seen that they would not even stop for" to "we have seen
that they would even list".
--
Roy Bixler <***@nyx.net>
The price of seeking to force our beliefs on others is that someday
they might force their beliefs on us.
-- Mario Cuomo

[Shmuel (Seymour J.) Metz]

Post by Roy Bixler
That's fine, but I hope that it's more of an automated system than
was SPEWS. I know of one listing that remained in SPEWS for years
that should have either been removed or updated.

That's not clear. What's clear is that there should be a policy as to
whether evidence files will be updated when the new evidence is
sensitive, e.g., might compromise spam traps. I'd certainly advise a
random delay before updating the evidence file automatically.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[N S]

Post by s***@postmasters.servegame.org
We will try our best to make you happy. That's a promise.
And now visit http://www.apews.org to find out about details.

Can you find someone who knows a bit about design to tidy up some of
the pages. A bit of whitespace on the FAQ page would do wonders for
readability.

[Cameron L. Spitzer]

Post by s***@postmasters.servegame.org
APEWS was foundet by some people thinking SPEWS might be dead, but they
did a great job.

While SPEWS did not meet my needs as a block list, I found
it valuable as a reference, and might have used it
in a scoring system some day. I'm glad someone is
picking up the effort.
There were credible suggestions that SPEWS data and the
unpublished evidence behind it didn't always include time stamps.
While information about particular spammers or spam gangs
may be valuable indefinitely, specifics about their location
and behavior are plausibly rather worthless after three
or four years. I hope APEWS keeps track of when each
listing was made.

Post by s***@postmasters.servegame.org
While it seems SPEWS was a one man show, APEWS will be maintained by
many operators.

I'm in no position to be an operator. But should you for
some reason need a few more spamtraps, I've got some addresses
that were generated by failed attempts at demunging or e-pending
that seem to be on several major spammers' lists. They've
never been published on the Web or on Usenet as far as I know.
They get spam at least daily and have never ever been used for
receiving email. I'd be glad to forward their traffic somewhere.


Cameron
charlie lima sierra at golf romeo echo echo november sierra
dot oscar romeo golf

[Shmuel (Seymour J.) Metz]

In <***@51g2000cwl.googlegroups.com>, on
01/12/2007

Post by s***@postmasters.servegame.org
APEWS Level 1 is a RHSBL (lists domains), APEWS Level 2 is a DNSBL
(lists IP's and CIDR's).

Where do you see that in the FAQ?
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[E-Mail Sent to this address will be added to the BlackLists]

Post by Shmuel (Seymour J.) Metz

Post by s***@postmasters.servegame.org
APEWS Level 1 is a RHSBL (lists domains), APEWS Level 2
is a DNSBL (lists IP's and CIDR's).

Where do you see that in the FAQ?

It does not seem to be in the FAQ,
try "Email Filtering" <http://apews.org/?page=filter>

[Johann Steigenberger]

Post by E-Mail Sent to this address will be added to the BlackLists

Post by Shmuel (Seymour J.) Metz

Post by s***@postmasters.servegame.org
APEWS Level 1 is a RHSBL (lists domains), APEWS Level 2
is a DNSBL (lists IP's and CIDR's).

Where do you see that in the FAQ?

It does not seem to be in the FAQ,
try "Email Filtering" <http://apews.org/?page=filter>

Perhaps you guys should read the FAQ A21.

I am not APEWS.
--
Project UCEPROTECT-Network: Join now - It's free - It's consequent
Together we can stop all spammers on this planet!
http://www.uceprotect.net

[Dan Harkless]

Post by s***@postmasters.servegame.org
If you feel we do anything wrong, post to
news.admin.net-abuse.blocklisting or news.admin.net-abuse.email
starting with subject APEWS followed by the Case-ID.

I'm a long-time happy user of SPEWS and then APEWS, but I was very
unhappy today to discover that my netblock had been listed in APEWS:

Sorry 71.133.223.221 is currently listed in APEWS :-(

Entry matching your Query: E-173851
71.128.0.0/11

CASE: C-130
Most abusive ASN and CIDR

History:
Entry created 2007-05-18

My server is hosted from my AT&T static IP address DSL line (about all I
can afford), and I'm an anti-spam activist, I host open source anti-spam
software I've written on my site (with more to come), etc., yet I've
just been tarred as a spammer by what seems like an excessively large
brush. A whole lot of non-spamming small businesses and techies that
prefer to run their own mailservers (e.g. for better spam control) can
no longer send mail to the APEWS-using world.

Presumably AT&T's main outgoing SMTP servers are not blocked, but for
many reasons I prefer to be able to send my email directly from my
server (e.g. to be able to have hard verification that certain mails
reached the recipient servers, to be able to ensure end-to-end SSL
encryption with certain correspondents' servers, etc.).

APEWS folks, would you please consider either removing static IP address
ranges from this block (not sure what they are -- I don't know if AT&T
publishes that info publically), or else adding the ability for
legitimate non-spamming server owners to request removal of their
specific IPs, as many other prominent DNSBLs do?

Post by s***@postmasters.servegame.org
We will try our best to make you happy. That's a promise.

I hope you can do something about this. :-( As of right now I'm of
course ceasing use of APEWS, since it incorrectly marks me as a spammer.

[Shmuel (Seymour J.) Metz]

Do you really believe that came from APEWS?

Post by Dan Harkless
I'm a long-time happy user of SPEWS and then APEWS,

Then you should understand what they are and what they are not.

Post by Dan Harkless
but I was very unhappy today to discover that my netblock had been

It's not your netblock that's listed.

Post by Dan Harkless
My server is hosted from my AT&T static IP address DSL line

A bad neighborhood.

Post by Dan Harkless
(about all I can afford),

That's unfortunate, but it's not a reason for APEWS or anybody else to
cut holes in a listing of a rogue provider.

Post by Dan Harkless
I'm an anti-spam activist,

You're not listed.

Post by Dan Harkless
yet I've just been tarred as a spammer

No you haven't.

Post by Dan Harkless
by what seems like an excessively large brush.

It's not the brush that's too large, it's the sewer.

Post by Dan Harkless
A whole lot of non-spamming small businesses and techies that prefer
to run their own mailservers (e.g. for better spam control)

You seem to be confusing inbound and outbound. There's no need to
employ the same host as an inbound MTA and an outbound MSA.

can no longer send mail to the APEWS-using world.

They can still send mail; they simply need to acquire the services of
an MTA in clean IP space.

Post by Dan Harkless
Presumably AT&T's main outgoing SMTP servers are not blocked,

I would make no such presumption.

Post by Dan Harkless
but for many reasons I prefer to be able to send my email directly
from my server

You certainly have the right to run a mail client in the IP space you
lease from AT&T[1], but nobody has an obligation to accept traffic
from it.

Post by Dan Harkless
APEWS folks, would you please consider either removing static IP
address ranges from this block

Why would they do that before AT&T cleans up its network? It's more
work for them and more risk for their users.

Post by Dan Harkless
as many other prominent DNSBLs do?

Every list has its own policies. Unless you can provide a compelling
reason why the current APEWS policies interfere with achieving their
goals, I don't see why APEWS would consider changing them.

Post by Dan Harkless
As of right now I'm of course ceasing use of APEWS,

There is no "of course". You are certainly free to cease using a DNSBL
for whatever reason you wish, but you're hurting only yourself.

Post by Dan Harkless
since it incorrectly marks me as a spammer.

No it doesn't; in fact, it doesn't identify you as anything, unless
you own SBC.

[1] I'm using "AT&T" to refer to the entire SBC/SWBELL network, not
just the pieces labelled as AT&T.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[u***@harkless.org]

[Didn't receive a robomoderation "RECEIVED" message for this post (or
anything else). Trying again.]

Post by Shmuel (Seymour J.) Metz
Do you really believe that came from APEWS?

Yes. Why would someone fake an "Anonymous Postmasters Early Warning
System (APEWS.ORG) has started" announcement that gets the facts right
and makes no suspicious claims? To believe that didn't come from them
(or a designated proxy for them) would require a ridiculous and
unjustified level of paranoia.

Post by Shmuel (Seymour J.) Metz

Post by Dan Harkless
but for many reasons I prefer to be able to send my email directly
from my server

You certainly have the right to run a mail client in the IP space you
lease from AT&T[1], but nobody has an obligation to accept traffic
from it.

I never said anything about obligation. I was just hoping APEWS would
consider a mechanism to allow exceptions in the giant netblocks
they're
marking as spam sources.

Post by Shmuel (Seymour J.) Metz

Post by Dan Harkless
as many other prominent DNSBLs do?

Every list has its own policies. Unless you can provide a compelling
reason why the current APEWS policies interfere with achieving their
goals, I don't see why APEWS would consider changing them.

Their goals include wanting people to find them a useful anti-spam
DNSBL
without an unusable level of false positives. I used to consider them
to be that, but as of now, do no longer. I would imagine some others
(if not those folks who responded to my post in this group) may now
feel
the same, considering they're now listing huge /11 networks.

Post by Shmuel (Seymour J.) Metz

Post by Dan Harkless
As of right now I'm of course ceasing use of APEWS,

There is no "of course". You are certainly free to cease using a DNSBL
for whatever reason you wish,

Yes, there is an "of course" -- if I feel they're taking way too blunt
an approach by listing a /11 that I fall into, then of course I won't
want to use them any longer for my anti-spam needs either.

Post by Shmuel (Seymour J.) Metz
but you're hurting only yourself.

I don't use DNSBLs with an unreasonably high level of false positives
--
it would hurt me more to keep using APEWS at this point than to stop.

--
Dan Harkless
http://harkless.org/dan/

[p***@ipal.net]

On Tue, 22 May 2007 10:07:48 GMT ***@harkless.org wrote:

| Their goals include wanting people to find them a useful anti-spam
| DNSBL
| without an unusable level of false positives. I used to consider them
| to be that, but as of now, do no longer. I would imagine some others
| (if not those folks who responded to my post in this group) may now
| feel
| the same, considering they're now listing huge /11 networks.

This is something frequently said about SPEWS. Given the similarity of
APEWS, I believe there may be similar goals here. An objective of the
DNSBL is to create an incentive to the ultimate controlling entity, the
ISP, to clean up their act and reduce the overall level of spam coming
through their network. Since this is a corporation that is motivated
only be profit and financial growth, any incentive mechnism must work
by influencing that motivation in a legal way. A major part of that
would be to convince customers that they, even though they are not
involved in the spam, need to quit being a customer of that provider.
At some point, the numbers would convince the executives of the provider
that they meet their own goals best by cleaning up the spam problem.
Those customers who stay with the provider are effectively communicating
the message "I do not care if you allow others to let spam through, I am
a loyal customer and will stay with you through to the bitter end". With
customers like that, why would they ever do anything to reduce spam, much
less stop it?


|> >As of right now I'm of course ceasing use of APEWS,
|>
|> There is no "of course". You are certainly free to cease using a DNSBL
|> for whatever reason you wish,
|
| Yes, there is an "of course" -- if I feel they're taking way too blunt
| an approach by listing a /11 that I fall into, then of course I won't
| want to use them any longer for my anti-spam needs either.

But if theu list some other /11 that you do not fall int, that's OK?

And what of those who feel that since AT&T is doing so little to stop or
reduce spam, that they should de-peer the AT&T network entirely?


|> but you're hurting only yourself.
|
| I don't use DNSBLs with an unreasonably high level of false positives

You'd rather just block the spam, but leave all the attempts to send spam
running so your mail server is constantly pounded by SMTP connections that
are going to just get rejected?

Me? I'd rather get the provider to shut down the spamming.

Make it stop!


| it would hurt me more to keep using APEWS at this point than to stop.

It would hurt you least to move on to another provider for, at minimum,
your outbound email, and continue as a participant in the campaign to get
spammers shut down by their providers.
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-22-***@ipal.net |
|------------------------------------/-------------------------------------|

[u***@harkless.org]

Post by p***@ipal.net
This is something frequently said about SPEWS. Given the similarity of
APEWS, I believe there may be similar goals here. An objective of the
DNSBL is to create an incentive to the ultimate controlling entity, the
ISP, to clean up their act and reduce the overall level of spam coming
through their network. Since this is a corporation that is motivated
only be profit and financial growth, any incentive mechnism must work
by influencing that motivation in a legal way. A major part of that
would be to convince customers that they, even though they are not
involved in the spam, need to quit being a customer of that provider.
At some point, the numbers would convince the executives of the provider
that they meet their own goals best by cleaning up the spam problem.
Those customers who stay with the provider are effectively communicating
the message "I do not care if you allow others to let spam through, I am
a loyal customer and will stay with you through to the bitter end". With
customers like that, why would they ever do anything to reduce spam, much
less stop it?

If there were a good alternative to my AT&T DSL available, I would
very seriously consider it.

Post by p***@ipal.net
But if theu list some other /11 that you do not fall int, that's OK?

No, I don't use DNSBLs that take such a blunt approach without
allowing innocent server owners caught in the collateral damage to
request exclusions for their IPs.

Post by p***@ipal.net
And what of those who feel that since AT&T is doing so little to stop or
reduce spam, that they should de-peer the AT&T network entirely?

That doesn't seem realistic.

Post by p***@ipal.net
You'd rather just block the spam, but leave all the attempts to send spam
running so your mail server is constantly pounded by SMTP connections that
are going to just get rejected?
Me? I'd rather get the provider to shut down the spamming.
Make it stop!

No, of course I'd rather have the spamming be stopped. Is APEWS'
current approach the best way to accomplish that? I would say no, but
obviously fighting spam is not an exact science and opinions will
differ.

--
Dan Harkless
http://harkless.org/dan/

[p***@ipal.net]

On Wed, 23 May 2007 09:50:19 GMT ***@harkless.org wrote:
| On May 22, 5:21 am, Phil Howard wrote:
|>
|> This is something frequently said about SPEWS. Given the similarity of
|> APEWS, I believe there may be similar goals here. An objective of the
|> DNSBL is to create an incentive to the ultimate controlling entity, the
|> ISP, to clean up their act and reduce the overall level of spam coming
|> through their network. Since this is a corporation that is motivated
|> only be profit and financial growth, any incentive mechnism must work
|> by influencing that motivation in a legal way. A major part of that
|> would be to convince customers that they, even though they are not
|> involved in the spam, need to quit being a customer of that provider.
|> At some point, the numbers would convince the executives of the provider
|> that they meet their own goals best by cleaning up the spam problem.
|> Those customers who stay with the provider are effectively communicating
|> the message "I do not care if you allow others to let spam through, I am
|> a loyal customer and will stay with you through to the bitter end". With
|> customers like that, why would they ever do anything to reduce spam, much
|> less stop it?
|
| If there were a good alternative to my AT&T DSL available, I would
| very seriously consider it.

If your definition of "good" is a company that does just as much skimping
on the "technical due diligence" as AT&T does, so they can give you as
cheap a rate as AT&T does, then that's not going to help.

It is unfortunate that the next level up is a big jump, and that big telcos
have in many areas eliminated alternatives that are just a small step up.

The standing alternatives are:

1. Colocated or dedicated hosting of a mail server reached through a
secure connection via the retained AT&T DSL service.

2. A reduced service like ISDN for the email traffic, via a different
provider.

3. Fractional T1, possibly in conjunction with DSL.

The first choice I believe is more common.


|> But if theu list some other /11 that you do not fall int, that's OK?
|
| No, I don't use DNSBLs that take such a blunt approach without
| allowing innocent server owners caught in the collateral damage to
| request exclusions for their IPs.

You and I have a different preference. I prefer that customers of those
providers switch to a different provider, so that it creates an incentive
the provider understands to clean up their act (and the only incentive a
big corporation understands is whatever affects the value of their stock).


|> And what of those who feel that since AT&T is doing so little to stop or
|> reduce spam, that they should de-peer the AT&T network entirely?
|
| That doesn't seem realistic.

That's being done just with the SMTP port level. It's called blocking.


|> You'd rather just block the spam, but leave all the attempts to send spam
|> running so your mail server is constantly pounded by SMTP connections that
|> are going to just get rejected?
|>
|> Me? I'd rather get the provider to shut down the spamming.
|>
|> Make it stop!
|
| No, of course I'd rather have the spamming be stopped. Is APEWS'
| current approach the best way to accomplish that? I would say no, but
| obviously fighting spam is not an exact science and opinions will
| differ.

What do you think would convince AT&T to change course and stop taking
steps that really reduce the spam level, targetted at eliminating it?
I think the only thing that would get them to do that is money. The
fear of less revenue for not doing so, or the anticipation of more for
doing so. What other ways can you think of that are legal and work on
a big corporation?

Many smaller providers do the right thing _for_ the right reason (that
spamming and other abuses steal from others, and is wrong). Corporations
just don't operate that way. They operate on making financial reports
to stock holders look good, and keep stock values going up.
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-23-***@ipal.net |
|------------------------------------/-------------------------------------|

[Steve Baker]

Post by u***@harkless.org
If there were a good alternative to my AT&T DSL available, I would
very seriously consider it.

Have you looked at Speakeasy? They don't seem to get noticed by
blocklists.

[Seth]

Post by u***@harkless.org
If there were a good alternative to my AT&T DSL available, I would
very seriously consider it.

Apparently, in your evalutation of "goodness", you don't give much
weight to "ability to have email accepted". That's your choice.

Post by u***@harkless.org
No, I don't use DNSBLs that take such a blunt approach without
allowing innocent server owners caught in the collateral damage to
request exclusions for their IPs.

Nobody is obligated to use your criteria for selecting spam-blocking
methods when dealing with mail from you. They use their own decisions
in all cases.

Post by u***@harkless.org

Post by p***@ipal.net
And what of those who feel that since AT&T is doing so little to stop or
reduce spam, that they should de-peer the AT&T network entirely?

That doesn't seem realistic.

There are those who have done it, hence it's quite realistic. It may
be foolish, but there's no lack of foolishness in the world (or on the
net).

Post by u***@harkless.org

Post by p***@ipal.net
Me? I'd rather get the provider to shut down the spamming.
Make it stop!

No, of course I'd rather have the spamming be stopped. Is APEWS'
current approach the best way to accomplish that?

Who knows? Apparently the people running APEWS think it works. Their
service, their decisions.

Post by u***@harkless.org
I would say no, but obviously fighting spam is not an exact science
and opinions will differ.

If you offer a better method, theirs will wither. But you have to
actually offer it and make it available, not just say that it should
exist.

Seth

[Shmuel (Seymour J.) Metz]

In <***@u30g2000hsc.googlegroups.com>, on
05/22/2007

Post by u***@harkless.org
Their goals include wanting people to find them a useful anti-spam
DNSBL without an unusable level of false positives.

And some people do find them to be such. Their stated goal was never
to be all things to all people, nor was their stated goal ever to
replace other DNSBL's with different philosophies driving them.

Post by u***@harkless.org
I would imagine some others (if not those folks who responded to my
post in this group) may now feel the same, considering they're now
listing huge /11 networks.

But not those that test before they deploy, and not those that have
privately blocked /8, /7 and even /6 CIDR blocks.

Post by u***@harkless.org
Yes, there is an "of course"

Not as stated.

Post by u***@harkless.org
if I feel they're taking way too blunt
an approach by listing a /11 that I fall into,

How would that differ from listing a /11 that you *don't* fall into.

Post by u***@harkless.org
then of course I won't want to use them any longer for my
anti-spam needs either.

Is it irrelevant that you were in the range? Because if it is relevant
then there is no "of course".

Post by u***@harkless.org
I don't use DNSBLs with an unreasonably high level of false
positives

Nothing that you wrote suggests that there is an unreasonably high
level of FP, or even that you know what the FP level is. It suggests,
rather, that you were offended because your provider was listed and
you took it as a claim about yourself. It's certainly your right to
stop using a DNSBL in a fit of pique, but be honest about it when you
do so. If you have data bearing on the FP level, please share them.

Post by u***@harkless.org
it would hurt me more to keep using APEWS at this point than to
stop.

Perhaps, but so far you have presented nothing to support that claim.
However, your server, your rules.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[u***@harkless.org]

Post by Shmuel (Seymour J.) Metz

Post by u***@harkless.org
I would imagine some others (if not those folks who responded to my
post in this group) may now feel the same, considering they're now
listing huge /11 networks.

But not those that test before they deploy,

I've covered in another post that I've done periodic testing of SPEWS
and APEWS in the past on email received through aliases _not_ subject
to SPEWS/APEWS checking and until now I had not come across false
positives (granted, it's been awhile since my last such check, but
your suggestion that I didn't test even before initial deployment is
wrong -- sorry).

Post by Shmuel (Seymour J.) Metz
and not those that have
privately blocked /8, /7 and even /6 CIDR blocks.

It depends on what's in those blocks. If they're netblocks owned by
spam operations, I have no problem with that level of blocking. But
yes, naturally people who don't mind blocking whole ISPs, countries,
etc., won't be concerned by APEWS blocking this AT&T /11.

Post by Shmuel (Seymour J.) Metz

Post by u***@harkless.org
then of course I won't want to use them any longer for my
anti-spam needs either.

Is it irrelevant that you were in the range? Because if it is relevant
then there is no "of course".

It's only relevant in that it's what made me aware of the problem. I
would cease using APEWS if I'd found out that it was blocking other
major ISPs as well.

Post by Shmuel (Seymour J.) Metz
Nothing that you wrote suggests that there is an unreasonably high
level of FP, or even that you know what the FP level is. It suggests,
rather, that you were offended because your provider was listed and
you took it as a claim about yourself. It's certainly your right to
stop using a DNSBL in a fit of pique, but be honest about it when you
do so. If you have data bearing on the FP level, please share them.

I consider any such listing of large provider netblocks (the majority
of whose IPs are no doubt operated by non-spammers) to be an
unreasonable level of false positives, particularly if there's no way
for innocent server operators within the range to request exclusion.

--
Dan Harkless
http://harkless.org/dan/

[p***@ipal.net]

On Wed, 23 May 2007 09:55:42 GMT ***@harkless.org wrote:

| I consider any such listing of large provider netblocks (the majority
| of whose IPs are no doubt operated by non-spammers) to be an
| unreasonable level of false positives, particularly if there's no way
| for innocent server operators within the range to request exclusion.

Maybe it's time for my "two internet analogy" (again).

Let's suppose we have two separate internets. One of them operates exactly
like the current internet in terms of interconnect rules: there are for the
most part no rules. Any provider can interconnect as long as they can pay
the costs. However, the other internet (2nd internet) is controlled by an
organization that sets some for specific and strict rules about what may be
done on the 2nd internet, and has the power to immediately shut off anyone
that breaks the rules, including whole providers. These rules focus mainly
on abuses that cost other parties money, and include absolute restrictions
against all forms of unsolicited bulk email. Other rules also exist against
providing any kinds of services to abusers, and providing services to other
providers downstream that have been ordered disconnected for failure to
follow the rules. And one more rule prohibits the forwarding of any email
or other traffic from the 1st internet.

AT&T, and many other providers, with their current practices, simply would
not qualify for connection to the 2nd internet. However, many others have
chosen to connect _only_ to the 2nd internet. Customers and providers may
operate in both internets, but must obey the rules. The 2nd internet ends
up costing about 75% more, and has say 20% of the population connected, of
which more than half is connected exclusively to the 2nd internet because
it has been highly successful in eliminating spam (if you connect to both
you still end up getting spam via the 1st internet).

It will cost you X dollars to connect to the 1st internet. It will cost
you 1.75X dollars to connect to the 2nd internet. It will cost you 2.75X
dollars to connect to both (and make you liable for any leakage between
them that might happen at your network).

Which internet will you connect to?

If the number of people moving from 1st internet to 2nd internet is a big
number, would that change your preference?

Now consider this. From the perspective of just the SMTP protocol, those
who use lists like APEWS, including making their own, or by other means,
are effectivly forming a 2nd internet (just for SMTP). It's not 100% split,
yet, but it is clearly moving in that direction.

There are people that simply don't want to be a part of "an internet" that
chooses to let spam run rampant. They don't want to be a part of any
peering with providers that allow this to happen. Think of these people
as members of the 2nd internet.

Now do you want to connect to the "2nd internet", of which AT&T is NOT a
provider for?
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-23-***@ipal.net |
|------------------------------------/-------------------------------------|

[u***@harkless.org]

Post by p***@ipal.net
Which internet will you connect to?

The Internet is so established and pervasive that it would be a LONG
time before all useful providers of content, correspondents, etc. had
moved over to Internet 2. Therefore I would have to retain my
connection to Internet 1 despite the risk of getting some spam. If
there were enough useful content only available on Internet 2, I would
connect to it as well, despite the stated penalties for "leakage" from
Internet 1 to 2. (Is that only leakage of spam, or *any* content? If
the latter, Internet 2 could never succeed because all the content of
Internet 1 would have to be thrown away.)

Post by p***@ipal.net
There are people that simply don't want to be a part of "an internet" that
chooses to let spam run rampant. They don't want to be a part of any
peering with providers that allow this to happen. Think of these people
as members of the 2nd internet.

Spammers will always spam, regardless of thought experiments regarding
a new Internet with harsher penalties and easier disconnection. Such
an Internet would be effective at dealing with spam sent via
established, fixed-IP spam operations, but it would not be effective
at dealing with spam sent via other people's hijacked machines. And
unless your Internet 2 is going to somehow have the ability to
magically fix all the computer security problems of the world, there's
still going to be spam.

--
Dan Harkless
http://harkless.org/dan/

[p***@ipal.net]

On Thu, 24 May 2007 11:33:33 GMT ***@harkless.org wrote:
| On May 23, 5:23 am, Phil Howard wrote:
|>
|> Which internet will you connect to?
|
| The Internet is so established and pervasive that it would be a LONG
| time before all useful providers of content, correspondents, etc. had
| moved over to Internet 2. Therefore I would have to retain my
| connection to Internet 1 despite the risk of getting some spam. If
| there were enough useful content only available on Internet 2, I would
| connect to it as well, despite the stated penalties for "leakage" from
| Internet 1 to 2. (Is that only leakage of spam, or *any* content? If
| the latter, Internet 2 could never succeed because all the content of
| Internet 1 would have to be thrown away.)

Leakage would be defined in terms of the abuses. Non-abusive traffic
or content could be on the 2nd internet.

There would be a gradual migration to the 2nd internet. At some point
the pioneers would be on it exclusively. Then more and more would join.
I cannot say how long it would take for such a thing to happen.


|> There are people that simply don't want to be a part of "an internet" that
|> chooses to let spam run rampant. They don't want to be a part of any
|> peering with providers that allow this to happen. Think of these people
|> as members of the 2nd internet.
|
| Spammers will always spam, regardless of thought experiments regarding
| a new Internet with harsher penalties and easier disconnection. Such
| an Internet would be effective at dealing with spam sent via
| established, fixed-IP spam operations, but it would not be effective
| at dealing with spam sent via other people's hijacked machines. And
| unless your Internet 2 is going to somehow have the ability to
| magically fix all the computer security problems of the world, there's
| still going to be spam.

Actually, it could be quite effective against hijacked machines. One of
the rules might be that port 25 is closed outbound from all addresses not
specifically designated as a legitimate mail server. If a machine does
get hijacked, it could only send through the ISP mail server, and that
could be rate throttled. If it is shown that a customer is letting spam
out, the get disconnected for some length of time. The 2nd offense could
be a long term disconnection.

Another requirement would be a mandatory personal response with a report
of case disposition for all reports of abuse send to the abuse@ address.

I would be bet many (of the worst) ISPs won't be connected to the 2nd net
for a long time, if ever. Probably the 1st internet will never go away,
as it would be cheaper. But people might shut down mail servers on it.
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-24-***@ipal.net |
|------------------------------------/-------------------------------------|

[Seth]

Post by u***@harkless.org

Post by p***@ipal.net
Which internet will you connect to?

The Internet is so established and pervasive that it would be a LONG
time before all useful providers of content, correspondents, etc. had
moved over to Internet 2.

That doesn't matter; non-abusive stuff will be gatewayed.

Post by u***@harkless.org
Therefore I would have to retain my
connection to Internet 1 despite the risk of getting some spam.

But you don't need to keep it for email.

Post by u***@harkless.org
If
there were enough useful content only available on Internet 2, I would
connect to it as well, despite the stated penalties for "leakage" from
Internet 1 to 2. (Is that only leakage of spam, or *any* content?

It would be leakage of any _abusive_ content. DoS attacks, worms,
viruses, etc. are bad. Funny pictures of cats with signs aren't.

Post by u***@harkless.org
If
the latter, Internet 2 could never succeed because all the content of
Internet 1 would have to be thrown away.)

So the latter wouldn't be the case.

Post by u***@harkless.org

Post by p***@ipal.net
There are people that simply don't want to be a part of "an internet" that
chooses to let spam run rampant. They don't want to be a part of any
peering with providers that allow this to happen. Think of these people
as members of the 2nd internet.

Spammers will always spam, regardless of thought experiments regarding
a new Internet with harsher penalties and easier disconnection.

But a spammer who can't connect to my network can't spam _me_. I
don't care if he spams himself.

Post by u***@harkless.org
Such
an Internet would be effective at dealing with spam sent via
established, fixed-IP spam operations, but it would not be effective
at dealing with spam sent via other people's hijacked machines.

Yes, it would. The ISP that connects those machines would have to
take immediate effective action or be de-peered. Many ISPs do that
now.

Seth

[E-Mail Sent to this address will be added to the BlackLists]

Post by u***@harkless.org
I've covered in another post that I've done periodic
testing of SPEWS and APEWS in the past on email received
through aliases _not_ subject to SPEWS/APEWS checking
and until now I had not come across false positives
(granted, it's been awhile since my last such check,
but your suggestion that I didn't test even before
initial deployment is wrong -- sorry).

If "false positives" are IPs listed in a DNSbl, where you
want /need / expect messages from, and you checked messages
against SPEWS, you must not get much e-mail from almost
anywhere.

Take a look at the zone file, search for Comcast for example
<http://spews.org/packetreject.html>
<http://spews.org/spews_list_level2.txt.bz2>
<http://spews.org/ask.cgi?x=24.0.0.0>
<http://spews.org/html/S2963.html>

<http://news.com.com/2102-1034_3-5218178.html>
Story last modified Mon May 24 11:41:16 PDT 2004
Comcast's high-speed Internet subscribers have long been
rumored to be an unusually persistent source of junk e-mail.
Now someone from Comcast is confirming it.
"We're the biggest spammer on the Internet," network
engineer Sean Lutner said at a meeting of an antispam
working group in Washington, D.C., last week.
Lutner said Comcast users send out about 800 million
messages a day, but a mere 100 million flow through the
company's official servers. Almost all of the remaining
700 million represent spam erupting from so-called zombie
computers -- a breathtaking figure that adds up to six or
seven spam-o-grams for each American family every day.

That is one reason large consumer ISPs might get many of
their IP ranges listed in an aggressive DNSbl like SPEWS,
APEWS, ..., and exceptions aren't made, the ISPs are not
being responsible, and preventing their IPs from being
used for abuse, they don't have resources to deal with
every other enduser getting trojaned every other week,
and most not even knowing it, not running anti-virus,
not running anti-spyware, not using a hardware firewall,
not having any general clues, ISP not blocking Port 25,
...

If your ISP is currently ranked at #2 on SpamHaus,
I don't think I would be very far off to guess that your
ISP has some kind of similar issues (too many clueless
endusers, and not enough resources to babysit them 24/7,
hold their hands and clean up their messes for them).

[u***@harkless.org]

On May 23, 2:09 pm, E-Mail Sent to this address will be added to the

Post by E-Mail Sent to this address will be added to the BlackLists
If "false positives" are IPs listed in a DNSbl, where you
want /need / expect messages from, and you checked messages
against SPEWS, you must not get much e-mail from almost
anywhere.

As I've said, I use a "least blocking" approach and was only checking
APEWS (and formerly SPEWS) for my most spammed email aliases (and only
on aliases to which I received specific spam that would have been
blocked by SPEWS/APEWS and wasn't blocked by any other DNSBL I feel
comfortable using). It didn't stop me from still receiving legitimate
mail to those aliases, though yes, for those particular addresses the
percentage of spam received far outweighs the percentage of legitimate
mail. It sounds like it may well have been the case that a non-
spammer tried to send me email on one of those aliases and was blocked
by SPEWS/APEWS, but if so, unfortunately no one ever found another way
to contact me and let me know about it.

--
Dan Harkless
http://harkless.org/dan/

[m***@gmail.com]

Post by u***@harkless.org
I would cease using APEWS if I'd found out that it was blocking other
major ISPs as well. [I quote that slightly out of context, hoping
the original author does not object. -mk]

I notice over the past week that APEWS has listed some outgoing
servers
for Yahoo, Hotmail, and AOL. Much of the traffic to our site from the
listed servers is 4-1-9 spam, but there are such significant numbers
of
"desirable" messages in the tube that I cannot do more than tag-and-
sort them right now (rather than 5xx them all).

How do these listings influence the use of APEWS by others here?
--
Michael

[E-Mail Sent to this address will be added to the BlackLists]

Post by m***@gmail.com
I notice over the past week that APEWS has listed some
outgoing servers for Yahoo, Hotmail, and AOL.
Much of the traffic to our site from the listed servers
is 4-1-9 spam, but there are such significant numbers
of "desirable" messages in the tube that I cannot do
more than tag-and-sort them right now (rather than 5xx
them all).

If you are also seeing a lot of spam from them,
they likely made it into more DNSbls than just APEWS,
you can lookup the IPs <http://moensted.dk/spam/?addr=>
APEWS listed to see which other DNSbls are currently
listing them too.

Post by m***@gmail.com
How do these listings influence the use of APEWS by
others here?

Same as any other DNSbl?

WhiteList sources of messages you want / need / expect?

[Herb Oxley]

Post by Dan Harkless
I hope you can do something about this. :-( As of right now I'm of
course ceasing use of APEWS, since it incorrectly marks me as a spammer.

If you're a long time former SPEWS user you should know SPEWS took a
meat-ax approach to spam blocking and APEWS ( and to a lesser extent
UCEPROTECT ) is run along the same lines.

APEWS isn't marking *you* as a spammer, rather the entire 71.128.0.0/11
is considered by APEWS to be too spammy for its users to accept SMTP
connections from that space by default.

Note that SPEWS used /18 as the biggest block.

Those who use APEWS will have to learn how to whitelist "good" senders
such as yourself or they they will lose too much email they
really want to receive.

As I have posted before I think the majority of SPEWS users were
outside the USA, where they would be less likely to receive valid mail
from uSA internet address blocks.

[u***@harkless.org]

[Didn't receive a robomoderation "RECEIVED" message for this post (or
anything else). Trying again.]

Post by Herb Oxley

Post by Dan Harkless
I hope you can do something about this. :-( As of right now I'm of
course ceasing use of APEWS, since it incorrectly marks me as a spammer.

If you're a long time former SPEWS user you should know SPEWS took a
meat-ax approach to spam blocking and APEWS ( and to a lesser extent
UCEPROTECT ) is run along the same lines.

Actually, I didn't know that. I started using the Spam Prevention
Early
Warning System when its philosophy (still listed in the intro on
<http://www.spews.org/>) matched its name:

Most spam advisory and blocking systems work after the fact.
There
is a time lag between the spammer setting up shop, spamming
millions, and getting netblocks listed by these systems. SPEWS
identifies known spammers and spam operations, listing them as
soon
as they start, sometimes even before they start spamming.

It was targeting "spammmers and spam operations", not (legitimate)
ISPs. Perhaps it got a lot more aggressive over the years, drifting
from its core philosophy, and it would seem APEWS has gone even
farther
down that road.

I was not aware of SPEWS (or until now, APEWS) blocking legitimate
mail,
and periodic tests of IPs I'd received non-spam mail from in the past
didn't trigger SPEWS/APEWS matches. I take a "least blocking"
approach
with my use of DNSBLs and was only using SPEWS/APEWS on my most
spam-tainted email aliases (e.g. the one I'm posting this article
from),
though, so I guess if SPEWS/APEWS ever blocked legitimate mail to
those
aliases, the correspondents just gave up at that point (a situation I
very much like to avoid).

Post by Herb Oxley
Note that SPEWS used /18 as the biggest block.

Yes, the /11 APEWS is blocking in this case is certainly a lot more
aggressive.

Post by Herb Oxley
Those who use APEWS will have to learn how to whitelist "good" senders
such as yourself or they they will lose too much email they
really want to receive.

It doesn't seem like there's a good DNSWL that's affordable for people
who aren't sending out email as part of a business. There's
<http://www.senderscorecertified.com/>, for instance, but it requires
a
$400 application fee even from non-profit organizations. It would be
cool if someone started a more community-based whitelist (perhaps
using
techniques similar to the PGP "web of trust").

Post by Herb Oxley
As I have posted before I think the majority of SPEWS users were
outside the USA, where they would be less likely to receive valid mail
from uSA internet address blocks.

Interesting. I didn't know that. In any case, thanks for your
constructive
reply.

--
Dan Harkless
http://harkless.org/dan/

[p***@ipal.net]

On Tue, 22 May 2007 10:08:44 GMT ***@harkless.org wrote:

|> If you're a long time former SPEWS user you should know SPEWS took a
|> meat-ax approach to spam blocking and APEWS ( and to a lesser extent
|> UCEPROTECT ) is run along the same lines.
|
| Actually, I didn't know that. I started using the Spam Prevention
| Early
| Warning System when its philosophy (still listed in the intro on
| <http://www.spews.org/>) matched its name:
|
| Most spam advisory and blocking systems work after the fact.
| There
| is a time lag between the spammer setting up shop, spamming
| millions, and getting netblocks listed by these systems. SPEWS
| identifies known spammers and spam operations, listing them as
| soon
| as they start, sometimes even before they start spamming.
|
| It was targeting "spammmers and spam operations", not (legitimate)
| ISPs. Perhaps it got a lot more aggressive over the years, drifting
| from its core philosophy, and it would seem APEWS has gone even
| farther
| down that road.

Who said it was not targeting ISPs? The name itself certainly does not.
In fact that name suggested to me the very possibility that it would
target ISPs that were host to spammers (and spam leakers). It was
giving me an early warning that spammers could easily and readily pop
up anywhere in a certain IP range owned by a certain ISP.


|> Note that SPEWS used /18 as the biggest block.
|
| Yes, the /11 APEWS is blocking in this case is certainly a lot more
| aggressive.

I'm not yet sure what APEWS is really doing, but if I had run either of
these operations, it would have ended up blocking whatever the ISP had
as soon as a certain threshhold of spamming was met. One possible idea
I personally had was to identify the top 100 ISPs that let spam come
through their network, and keep those top 100 fully listed.

Note that "listed" does not necessarily mean "blocked". It can just as
easily mean "subject to greater scrutinty".


|> Those who use APEWS will have to learn how to whitelist "good" senders
|> such as yourself or they they will lose too much email they
|> really want to receive.
|
| It doesn't seem like there's a good DNSWL that's affordable for people
| who aren't sending out email as part of a business. There's
| <http://www.senderscorecertified.com/>, for instance, but it requires
| a
| $400 application fee even from non-profit organizations. It would be
| cool if someone started a more community-based whitelist (perhaps
| using
| techniques similar to the PGP "web of trust").

How much do you think it would cost for YOU to carry out the investigation
of an application to be whitelisted? I don't think it would be anywhere
near $400. But what would it be, especially if you were doing this as your
only source of income? Would you personally alone be able to keep up with
the pace of applications, or would it be necessary to set up a business and
hire people to do this? Now what would it cost? Oh, and you need to hire
a bunch of lawyers, because you will end up being sued by some spammer, so
add more to the cost to cover that. Hmmm. That $400 doesn't look like it
is so far off, now.
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-22-***@ipal.net |
|------------------------------------/-------------------------------------|

[u***@harkless.org]

Post by p***@ipal.net
| Actually, I didn't know that. I started using the Spam Prevention
| Early
| Warning System when its philosophy (still listed in the intro on
|
| Most spam advisory and blocking systems work after the fact.
| There
| is a time lag between the spammer setting up shop, spamming
| millions, and getting netblocks listed by these systems. SPEWS
| identifies known spammers and spam operations, listing them as
| soon
| as they start, sometimes even before they start spamming.
|
| It was targeting "spammmers and spam operations", not (legitimate)
| ISPs. Perhaps it got a lot more aggressive over the years, drifting
| from its core philosophy, and it would seem APEWS has gone even
| farther
| down that road.
Who said it was not targeting ISPs? The name itself certainly does not.
In fact that name suggested to me the very possibility that it would
target ISPs that were host to spammers (and spam leakers). It was
giving me an early warning that spammers could easily and readily pop
up anywhere in a certain IP range owned by a certain ISP.

The "listing them as soon as they start, sometimes even before they
start spamming" bit, along with other text, implies that it's a
targeted approach against spammer-controlled IPs. "Sometimes" is
certainly way too weak a statement if huge ISP netblocks are what is
being listed.

Post by p***@ipal.net
How much do you think it would cost for YOU to carry out the investigation
of an application to be whitelisted? I don't think it would be anywhere
near $400. But what would it be, especially if you were doing this as your
only source of income? Would you personally alone be able to keep up with
the pace of applications, or would it be necessary to set up a business and
hire people to do this? Now what would it cost? Oh, and you need to hire
a bunch of lawyers, because you will end up being sued by some spammer, so
add more to the cost to cover that. Hmmm. That $400 doesn't look like it
is so far off, now.

The vast majority of DNSBLs are run without charging for their use,
and I don't see DNSWLs as being so radically different in their nature
that that's not possible for them. As I've mentioned in other posts,
dnswl.org is operating without charging for their services. It
remains to be seen whether they'll be able to succeed in the long
term, but I'm hopeful.

--
Dan Harkless
http://harkless.org/dan/

[Kevin Wayne Williams]

Post by u***@harkless.org
The vast majority of DNSBLs are run without charging for their use,
and I don't see DNSWLs as being so radically different in their nature
that that's not possible for them.

"Guaranteed white" is far more difficult of a statement to make than
"probably dirty."
KWW

[Seth]

Post by u***@harkless.org
It was targeting "spammmers and spam operations", not (legitimate)
ISPs.

They apparently take the attitude that a legitimate ISP does not allow
(or retain) spammers as customers. Therefore, an ISP that emits spam
for an extended period is not legitimate, and the likelihood of the
rest of its IP space being infested by spammers is much higher than
for elsewhere.

Seth

[p***@ipal.net]

On Tue, 22 May 2007 18:29:28 GMT Seth <***@panix.com> wrote:
| In article <***@p77g2000hsh.googlegroups.com>,
| <***@harkless.org> wrote:
|
|>It was targeting "spammmers and spam operations", not (legitimate)
|>ISPs.
|
| They apparently take the attitude that a legitimate ISP does not allow
| (or retain) spammers as customers. Therefore, an ISP that emits spam
| for an extended period is not legitimate, and the likelihood of the
| rest of its IP space being infested by spammers is much higher than
| for elsewhere.

And hence the warning, early, that here be space that is much more likely
to end up emitting spam. Hmm, sounds like an early warning system to me.
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-22-***@ipal.net |
|------------------------------------/-------------------------------------|

[p***@ipal.net]

On Sat, 19 May 2007 11:59:16 GMT Dan Harkless <***@harkless.org> wrote:

| APEWS wrote:
|>
|> If you feel we do anything wrong, post to
|> news.admin.net-abuse.blocklisting or news.admin.net-abuse.email
|> starting with subject APEWS followed by the Case-ID.
|
| I'm a long-time happy user of SPEWS and then APEWS, but I was very
| unhappy today to discover that my netblock had been listed in APEWS:

Don't you mean "... discover that my netblock is inside a very large
network range owned by my ISP that got listed in APEWS:" ?


| Sorry 71.133.223.221 is currently listed in APEWS :-(
|
| Entry matching your Query: E-173851
| 71.128.0.0/11
|
| CASE: C-130
| Most abusive ASN and CIDR
|
| History:
| Entry created 2007-05-18
|
| My server is hosted from my AT&T static IP address DSL line (about all I
| can afford), and I'm an anti-spam activist, I host open source anti-spam
| software I've written on my site (with more to come), etc., yet I've
| just been tarred as a spammer by what seems like an excessively large
| brush. A whole lot of non-spamming small businesses and techies that
| prefer to run their own mailservers (e.g. for better spam control) can
| no longer send mail to the APEWS-using world.
|
| Presumably AT&T's main outgoing SMTP servers are not blocked, but for
| many reasons I prefer to be able to send my email directly from my
| server (e.g. to be able to have hard verification that certain mails
| reached the recipient servers, to be able to ensure end-to-end SSL
| encryption with certain correspondents' servers, etc.).

By not being able to afford anything better, you are effectively making
use of spammer subsidized address space. Your ISP could not afford to
provide space to you so cheaply unless:

1. They host some spammers to boost the revenue
2. They ignore complaints about the spammers
3. They drag their feet on shutting down people with botnets
4. They generally underpay and understaff technical departments

All of these things impose a cost burden on everyone else. We pay so you
can save some money? I don't think it should work that way.

Your IP addresses are nestled in amongst some huge spans of generic IP
space. Most DNSBLs still operate by IP address because that is still
what is universally implemented. Maybe APEWS could see fit to break
the huge span right where yours are if their intent is to just block
the real sources of spam at generic address, instead of punishing AT&T
for being such heels in letting the world be spammed from their network.
Maybe. Or maybe not (I don't run APEWS nor have I any clue who does)
due to the fact that it just doesn't scale to do this for everyone.

Yet, the vast majority of the internet is NOT listed. Are all those
users paying more than you are paying to get clean space?


| APEWS folks, would you please consider either removing static IP address
| ranges from this block (not sure what they are -- I don't know if AT&T
| publishes that info publically), or else adding the ability for
| legitimate non-spamming server owners to request removal of their
| specific IPs, as many other prominent DNSBLs do?

I've been considering running a DNSWL. Basically it would be a way to
whitelist certain categories of networks as exceptions to network that
are otherwise blacklisted (generally in larger ranges). Would that be
something that could help in your case? The catch is, I would require
some kinds of documentation that you are who you say your are, and that
your network is operating validly (which, BTW, it is not, if you have
71.133.223.217 through 71.133.223.220, due to the false rDNS), and that
you would sign a statement that you agree to not spam. And to verify
all this, I would require collecting a processing fee (so in reality it
would probably never be implemented).


|> We will try our best to make you happy. That's a promise.
|
| I hope you can do something about this. :-( As of right now I'm of
| course ceasing use of APEWS, since it incorrectly marks me as a spammer.

Why not cease use of AT&T, since it incorrectly believes the world does
not care that their mail serevrs and inboxes abused? Note that this only
means ceasing to use it as an SMTP outbound path. Host a dedicated server
at a clean ISP and use various secure protocol to communicate through it
via that AT&T access line.

Maybe the world wants to cease peering port 25 with AT&T because of that.

It is not "marking you as a spammer". Instead, it is "marking a broad
area of the network as a provider-mismanaged spam-source space".
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-19-***@ipal.net |
|------------------------------------/-------------------------------------|

[Dan Harkless]

Post by p***@ipal.net
| I'm a long-time happy user of SPEWS and then APEWS, but I was very
Don't you mean "... discover that my netblock is inside a very large
network range owned by my ISP that got listed in APEWS:" ?

Yep.

Post by p***@ipal.net
By not being able to afford anything better, you are effectively making
use of spammer subsidized address space. Your ISP could not afford to
1. They host some spammers to boost the revenue
2. They ignore complaints about the spammers
3. They drag their feet on shutting down people with botnets
4. They generally underpay and understaff technical departments
All of these things impose a cost burden on everyone else. We pay so you
can save some money? I don't think it should work that way.

I don't agree with your comparison. I believe AT&T's DSL fees are in
line with other DSL and cable Internet providers'. The cost comparison
I'm making is hosting my server on a static IP DSL line vs. co-locating
my server somewhere. I initially looked into that approach but found it
to not be affordable (generally due to non-flat-rate pricing models for
bandwidth). Shared hosting would be affordable, but I don't trust other
people having full access to my server and data.

Post by p***@ipal.net
Your IP addresses are nestled in amongst some huge spans of generic IP
space. Most DNSBLs still operate by IP address because that is still
what is universally implemented. Maybe APEWS could see fit to break
the huge span right where yours are if their intent is to just block
the real sources of spam at generic address, instead of punishing AT&T
for being such heels in letting the world be spammed from their network.
Maybe. Or maybe not (I don't run APEWS nor have I any clue who does)
due to the fact that it just doesn't scale to do this for everyone.

I dunno, other DNSBLs are able to make IP exceptions work. It's
generally pretty automated.

Post by p***@ipal.net
Yet, the vast majority of the internet is NOT listed. Are all those
users paying more than you are paying to get clean space?

Since I'm not omniscient, I can't really answer that, but my local
providers are Cox cable and AT&T DSL. Last time I looked into it, Cox
didn't support the running of servers. I know it would be possible to
get DSL through another provider and have AT&T just providing the phone
line, but when I had that kind of service in the past (Covad via SBC),
it was a nightmare when there were service problems since Covad and SBC
would just point the finger at each other and I couldn't get the
problems fixed.

Post by p***@ipal.net
I've been considering running a DNSWL. Basically it would be a way to
whitelist certain categories of networks as exceptions to network that
are otherwise blacklisted (generally in larger ranges). Would that be
something that could help in your case? The catch is, I would require
some kinds of documentation that you are who you say your are, and that
your network is operating validly (which, BTW, it is not, if you have
71.133.223.217 through 71.133.223.220, due to the false rDNS), and that
you would sign a statement that you agree to not spam. And to verify
all this, I would require collecting a processing fee (so in reality it
would probably never be implemented).

I would be supportive of that if the processing fee were reasonable. I
don't think senderscorecertified.com's $400 application fee for
non-profit organizations is reasonable.

Post by p***@ipal.net
Why not cease use of AT&T, since it incorrectly believes the world does
not care that their mail serevrs and inboxes abused? Note that this only
means ceasing to use it as an SMTP outbound path. Host a dedicated server
at a clean ISP and use various secure protocol to communicate through it
via that AT&T access line.

It's sounding like that's the only option, if APEWS won't consider an
exception mechanism. I just hope I don't go down that road, spend a
bunch of money, get into a contract, and then find that APEWS is
blocking me again because they've decided *that* provider has too many
spammers in the neighborhood. Perhaps I'll wait and gauge how wide the
use of APEWS is by how often my mails start getting blocked now (of
course I'll probably have a lot of mail just get sent quietly into junk
mail folders based on APEWS-influenced scoring, and won't generally have
a way to distinguish whether those correspondents have just been too
busy to reply or didn't get my email in their inboxes).

[Shmuel (Seymour J.) Metz]

Post by Dan Harkless
I dunno, other DNSBLs are able to make IP exceptions work.

No. Specifically, DNSBL's with policies similar to those of APEWS and
SPEWS are unable to make IP exceptions work without violating the
policies. Your problem is one of goals, not one of technical means. If
you don't want an early warning system, don't use one, but don't whine
that an early warning system is implemented as an early warning
system.

Post by Dan Harkless
It's sounding like that's the only option, if APEWS won't consider
an exception mechanism.

Even if they did, how would APEWS prevent someone from blocking that
network locally. AT&T is a bad neighborhood, and that would cause you
problems even without their being listed on APEWS.

Post by Dan Harkless
and then find that APEWS is blocking me again

APEWS is not blocking you. Even had APEWS concealed AT&T's behavior,
the people blocking you would have eventually become aware of it.

Post by Dan Harkless
Perhaps I'll wait and gauge how wide the use of APEWS is by how
often my mails start getting blocked now

The data people use for blocking decisions are from more sources than
just APEWS.

Post by Dan Harkless
(of course I'll probably have a lot of mail just get sent quietly
into junk mail folders based on APEWS-influenced scoring,

There is no "of course". Why do you believe that the people using
APEWS are dropping suspect messages instead of issuing a proper 5yz
response? I'd say that it's more likely that your e-mail software is
failing to pass the response on to you.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[Dan Harkless]

Post by Shmuel (Seymour J.) Metz

Post by Dan Harkless
I dunno, other DNSBLs are able to make IP exceptions work.

No. Specifically, DNSBL's with policies similar to those of APEWS and
SPEWS are unable to make IP exceptions work without violating the
policies. Your problem is one of goals, not one of technical means. If
you don't want an early warning system, don't use one, but don't whine
that an early warning system is implemented as an early warning
system.

The way "early warning system" is described on both the SPEWS and APEWS
websites is:

Most spam advisory and blocking systems work after the fact. There
is a time lag between the spammer setting up shop, spamming
millions, and getting netblocks listed by these systems. [AS]PEWS
identifies known spammers and spam operations, listing them as soon
as they start, sometimes even before they start spamming.

The AT&T /11 that's just been listed is not a "known spammer [or] spam
operation". If the policy of APEWS is now to block huge ISP netblocks
because they aren't tough enough on certain spamming customers within
that range, the description of APEWS should really be updated to reflect
that, so people are not misled as to the level of false positives
they'll be getting.

Post by Shmuel (Seymour J.) Metz

Post by Dan Harkless
It's sounding like that's the only option, if APEWS won't consider
an exception mechanism.

Even if they did, how would APEWS prevent someone from blocking that
network locally. AT&T is a bad neighborhood, and that would cause you
problems even without their being listed on APEWS.

The only DNSBLs I've found myself on until APEWS were "dynamic IP" lists
that allowed me to put in an exception for my server's (static) IP, and
Earthlink's in-house blocklist, which also allowed me to get an
exception put in.

Post by Shmuel (Seymour J.) Metz

Post by Dan Harkless
Perhaps I'll wait and gauge how wide the use of APEWS is by how
often my mails start getting blocked now

The data people use for blocking decisions are from more sources than
just APEWS.

Yes, and hopefully I won't get too many rejections from crappy setups
that don't specify what list your IP address was found on to cause your
mail to be blocked.

Post by Shmuel (Seymour J.) Metz

Post by Dan Harkless
(of course I'll probably have a lot of mail just get sent quietly
into junk mail folders based on APEWS-influenced scoring,

There is no "of course".

Sorry, but once again, yes there is an "of course".

Post by Shmuel (Seymour J.) Metz
Why do you believe that the people using APEWS are dropping suspect
messages instead of issuing a proper 5yz response? I'd say that it's
more likely that your e-mail software is failing to pass the response
on to you.

I'm speaking hypothetically, so your blaming my email software is rather
comical, but I assure you I would be aware of it if any of the software
I use were blocking a bounce. I've contributed code to my mail client
(nmh -- was also the project maintainer for awhile), my mailserver
(sendmail), and the sendmail milters I use. I'm not some idiot who
doesn't know what he's doing -- sorry.

In any case, I didn't say anything about suspect messages being dropped
(although no doubt some people do that as well). I said some of them
will probably get scored based partially on APEWS records and be
automatically filed into people's junk mail folders, where they'll not
likely ever be discovered.

You're arguing against a parenthetical side remark that isn't really
relevant to the overall discussion, BTW.

[Cameron L. Spitzer]

Post by Dan Harkless
The AT&T /11 that's just been listed is not a "known spammer [or] spam
operation". If the policy of APEWS is now to block huge ISP netblocks
because they aren't tough enough on certain spamming customers within
that range, the description of APEWS should really be updated to reflect
that, so people are not misled as to the level of false positives
they'll be getting.

Are you actually seeing your email *rejected?* It seems to me
the great majority of email users are on providers with thousands
of customers. Email service providers that big will generally
not get away with rejecting email based on a DNSBL with known
high false positive rate. They might use it to add a point or
two to a spamassassin score, but that's all.

Every day you will see people announce in some newsgroup that
they are blocking 200/7 or 60/8 or all IPAs belonging to
Everyone's Internet/The Planet, etc. But as spammy as those
places are, among the general email using population a few
users in a thousand are going to miss email from those places
(one in dozens in the EV1/theplanet case) and complain.
You can be pretty sure the guy who blocks EV1 only has a few
customers, and the guy who blocks everything Hurricane Electric
owns (people brag about that too) is only running a hobby
server for himself. SPEWS was somewhere in that range, and I
suppose APEWS isn't much different. So your best option may
be to simply ignore the listing. Maybe you'll have to ask
a particular APEWS user for an exception, but that won't
happen very often.


Cameron

[Bernd Hohmann]

Post by Cameron L. Spitzer
You can be pretty sure the guy who blocks EV1 only has a few
customers, and the guy who blocks everything Hurricane Electric
owns (people brag about that too) is only running a hobby
server for himself.

"a few customers" doesn't tell anything about the money this customers
can bring a good ISP.

But you're right: The more of "EV1 customers" you have, the more of "EV1
networks" you must accept.

Bernd
--
Well, there's egg and bacon; egg sausage and bacon; egg and
***@spamonly.de; egg bacon and spam; egg bacon sausage
and ***@spamonly.net; spam bacon sausage and spam; spam
egg spam spam bacon and ***@nixwill.de ; spam sausage

[u***@harkless.org]

Post by Cameron L. Spitzer
Are you actually seeing your email *rejected?*

Not yet, but APEWS just put the listing in on Friday, and I've only
emailed a handful of people since then.

Post by Cameron L. Spitzer
It seems to me the great majority of email users are on providers with
thousands of customers. Email service providers that big will
generally not get away with rejecting email based on a DNSBL with
known high false positive rate.

Yes, those are the ones I'm more concerned about, since emails will
just silently go into people's junk mail folders.

Post by Cameron L. Spitzer
They might use it to add a point or two to a spamassassin score, but
that's all.
Every day you will see people announce in some newsgroup that
they are blocking 200/7 or 60/8 or all IPAs belonging to
Everyone's Internet/The Planet, etc. But as spammy as those
places are, among the general email using population a few
users in a thousand are going to miss email from those places
(one in dozens in the EV1/theplanet case) and complain.
You can be pretty sure the guy who blocks EV1 only has a few
customers, and the guy who blocks everything Hurricane Electric
owns (people brag about that too) is only running a hobby
server for himself. SPEWS was somewhere in that range, and I
suppose APEWS isn't much different.

It seems like APEWS is pretty far to the extreme of that range, if
they're blocking /11s from a provider as major and common as AT&T.
That was partially why I wanted to post about this, to help get the
word out to people like myself whose understanding of what types of
network ranges APEWS lists was based on the misleading "About" text on
their website.

Post by Cameron L. Spitzer
So your best option may be to simply ignore the listing. Maybe you'll
have to ask a particular APEWS user for an exception, but that won't
happen very often.

I hope you're right that it's going to be very rare for my emails to
be dropped, rejected, or buried due to the new APEWS listing. Time
will tell.

--
Dan Harkless
http://harkless.org/dan/

[Shmuel (Seymour J.) Metz]

Post by Dan Harkless
The AT&T /11 that's just been listed is not a "known spammer [or]
spam operation".

Perhaps not known to you; certainly known to its victims.

Post by Dan Harkless
If the policy of APEWS is now to block huge ISP netblocks because
they aren't tough enough on certain spamming customers within that
range,

That's a consequence of their policy rather than a component of it.

Post by Dan Harkless
the description of APEWS should really be updated to reflect that,

No, because such an update would be false.

Post by Dan Harkless
so people are not misled as to the level of false positives they'll
be getting.

People mislead themselves. No matter what APEWS, Spamhaus or anybody
else puts on their web sites, people will attribute to them things
that they didn't say. Anybody using *any* DNSBL should test how well
it works for their network and their users. The FAQ should not be
loaded down with basics.

Post by Dan Harkless
Yes, and hopefully I won't get too many rejections from crappy
setups that don't specify what list your IP address was found on to
cause your mail to be blocked.

Or that specify the wrong list :-(

Post by Dan Harkless
Sorry, but once again, yes there is an "of course".

There is absolutely no connection between using APEWS data and
silently dropping suspect e-mail.

Post by Dan Harkless
I'm speaking hypothetically,

Then your "of course" is even more bizarre than it first appeared to
be.

Post by Dan Harkless
In any case, I didn't say anything about suspect messages being
dropped

Perhaps "dropped" means something different in your neck of the
woolds, but you wrote "I'll probably have a lot of mail just get sent
quietly into junk mail folders"; to the user unable to see his valid
e-mail that sure looks like it was dropped.

Post by Dan Harkless
You're arguing against a parenthetical side remark that isn't really
relevant to the overall discussion, BTW.

No.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[u***@harkless.org]

Post by Shmuel (Seymour J.) Metz

Post by Dan Harkless
so people are not misled as to the level of false positives they'll
be getting.

People mislead themselves. No matter what APEWS, Spamhaus or anybody
else puts on their web sites, people will attribute to them things
that they didn't say. Anybody using *any* DNSBL should test how well
it works for their network and their users. The FAQ should not be
loaded down with basics.

Different DNSBLs have different listing policies and different
associated levels of false positives. Normally DNSBLs make it clear
in their documentation whether they're listing individual spammers and
spam operations or whole providers that include some spammers in their
IP ranges. Often lists even distinguish between these two broad
categories by having different return codes or different "levels" of
the list. I believe that the average user reading the description of
APEWS would conclude that they're targeting "spammers and spam
operations" (hell, that's a direct quote), and not large ISP
netblocks.

Perhaps you can acknowledge the possibility that as a "truly insane
Spews puppet" you have more knowledge of the workings of SPEWS / APEWS
than the average DNSBL user, and may not have the correct perspective
to be able to determine if the documentation is misleading to such
users?

Post by Shmuel (Seymour J.) Metz

Post by Dan Harkless
In any case, I didn't say anything about suspect messages being dropped

Perhaps "dropped" means something different in your neck of the
woolds, but you wrote "I'll probably have a lot of mail just get sent
quietly into junk mail folders"; to the user unable to see his valid
e-mail that sure looks like it was dropped.

"Dropped" = silently (barring perhaps some logging) deleting messages
considered to be spam. Not the same thing as automatically filing
them into a junk mail folder.

--
Dan Harkless
http://harkless.org/dan/

[p***@ipal.net]

On Mon, 21 May 2007 18:41:00 GMT Dan Harkless <***@harkless.org> wrote:
| Phil Howard wrote:

|> By not being able to afford anything better, you are effectively making
|> use of spammer subsidized address space. Your ISP could not afford to
|> provide space to you so cheaply unless:
|>
|> 1. They host some spammers to boost the revenue
|> 2. They ignore complaints about the spammers
|> 3. They drag their feet on shutting down people with botnets
|> 4. They generally underpay and understaff technical departments
|>
|> All of these things impose a cost burden on everyone else. We pay so you
|> can save some money? I don't think it should work that way.
|
| I don't agree with your comparison. I believe AT&T's DSL fees are in
| line with other DSL and cable Internet providers'. The cost comparison
| I'm making is hosting my server on a static IP DSL line vs. co-locating
| my server somewhere. I initially looked into that approach but found it
| to not be affordable (generally due to non-flat-rate pricing models for
| bandwidth). Shared hosting would be affordable, but I don't trust other
| people having full access to my server and data.

I believe you will find that pretty much all DSL and cable providers
fall into the same category: they skimp on costs they should bear the
burden for, as I detailed, which passes those costs on to the victims
of the abuses from their network they fail to control.

I share your concern about shared hosting. I wouldn't go that route.
But somehow you need to move up out of the rut you are in, and it is
very likely that no DSL/cable options will achieve that.

How much of your traffic is outbound email? Another option, if that
traffic level is smaller, is to get an ISDN or dialup service from a
different provider. Otherwise, finding a colocation or dedicated
hosting provider remains your big option.

I'm not expecting any lists that list big provider blocks to be cutting
any holes. If they do, they would have to for everyone else who makes
the same claims as you do, and there is a huge list of that. They would
end up having to expend a huge cost burden to carry out verifications of
such requests. Charging to be exempted from such a listing would sure
be seen as a conflict of interest, and possibly illegal. Otherwise it
is just entirely impractical to do that.

What I am doing with my own lists (not publically available right now)
is listing by domain NAME, rather than IP address. The effect of such
a list is that your correctly rDNS'd addresses would not be affected
unless and until your own domain somehow got listed. If those who have
the resources to operate a worldwide public DNSBL were convinced to run
a list that used names like that, maybe it would become more popular
to use instead of lists based on IP address. So maybe you might want
to take the position of supporting that concept.


|> Your IP addresses are nestled in amongst some huge spans of generic IP
|> space. Most DNSBLs still operate by IP address because that is still
|> what is universally implemented. Maybe APEWS could see fit to break
|> the huge span right where yours are if their intent is to just block
|> the real sources of spam at generic address, instead of punishing AT&T
|> for being such heels in letting the world be spammed from their network.
|> Maybe. Or maybe not (I don't run APEWS nor have I any clue who does)
|> due to the fact that it just doesn't scale to do this for everyone.
|
| I dunno, other DNSBLs are able to make IP exceptions work. It's
| generally pretty automated.

How do they verify that a request for exception is valid (e.g. does not
meet the criteria that the rest of the large enclosing subnet does meet)?


|> Yet, the vast majority of the internet is NOT listed. Are all those
|> users paying more than you are paying to get clean space?
|
| Since I'm not omniscient, I can't really answer that, but my local
| providers are Cox cable and AT&T DSL. Last time I looked into it, Cox
| didn't support the running of servers. I know it would be possible to
| get DSL through another provider and have AT&T just providing the phone
| line, but when I had that kind of service in the past (Covad via SBC),
| it was a nightmare when there were service problems since Covad and SBC
| would just point the finger at each other and I couldn't get the
| problems fixed.

That's a common problem for sure. DSL doesn't fall under the same
requirements to provide reliable service as T1 (including fractional)
does. But T1 is also more expensive. And if it comes from the same
provider (such as AT&T) you may be no better off at the IP provisioning
stage.


|> I've been considering running a DNSWL. Basically it would be a way to
|> whitelist certain categories of networks as exceptions to network that
|> are otherwise blacklisted (generally in larger ranges). Would that be
|> something that could help in your case? The catch is, I would require
|> some kinds of documentation that you are who you say your are, and that
|> your network is operating validly (which, BTW, it is not, if you have
|> 71.133.223.217 through 71.133.223.220, due to the false rDNS), and that
|> you would sign a statement that you agree to not spam. And to verify
|> all this, I would require collecting a processing fee (so in reality it
|> would probably never be implemented).
|
| I would be supportive of that if the processing fee were reasonable. I
| don't think senderscorecertified.com's $400 application fee for
| non-profit organizations is reasonable.

That seems a bit high to me. But I don't know what they do with it.
How well recognized are they in the anti-spam community? Can anyone
use a DNS based service from them for free?


|> Why not cease use of AT&T, since it incorrectly believes the world does
|> not care that their mail serevrs and inboxes abused? Note that this only
|> means ceasing to use it as an SMTP outbound path. Host a dedicated server
|> at a clean ISP and use various secure protocol to communicate through it
|> via that AT&T access line.
|
| It's sounding like that's the only option, if APEWS won't consider an
| exception mechanism. I just hope I don't go down that road, spend a
| bunch of money, get into a contract, and then find that APEWS is
| blocking me again because they've decided *that* provider has too many
| spammers in the neighborhood. Perhaps I'll wait and gauge how wide the
| use of APEWS is by how often my mails start getting blocked now (of
| course I'll probably have a lot of mail just get sent quietly into junk
| mail folders based on APEWS-influenced scoring, and won't generally have
| a way to distinguish whether those correspondents have just been too
| busy to reply or didn't get my email in their inboxes).

Find a provider that fully understands APEWS (and SPEWS). Talk with the
candidate providers about this and see what they say. Be sure to avoid
those who say things like "we can't control who lists us where" as that
can either be weasling to avoid a commitment they know they cannot make,
or just plain ignorance about the whole issue. Ask for a contract that
states that during any time either your IP space, or any other space at
least /24 in size, is listed in APEWS (or any other list you itemize and
agree to in the contract), then you cost is reduced to some substantially
low percentage, and the contract cannot be terminated early by them during
that period (unless they can show you were the spammer, which we assume
is something they will never be able to do).
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-21-***@ipal.net |
|------------------------------------/-------------------------------------|

[u***@harkless.org]

Post by p***@ipal.net
I believe you will find that pretty much all DSL and cable providers
fall into the same category: they skimp on costs they should bear the
burden for, as I detailed, which passes those costs on to the victims
of the abuses from their network they fail to control.
I share your concern about shared hosting. I wouldn't go that route.
But somehow you need to move up out of the rut you are in, and it is
very likely that no DSL/cable options will achieve that.
How much of your traffic is outbound email?

I don't have detailed stats at hand, but yeah, probably not that large
a percentage. I don't monitor how much bandwidth my users (friends
and family) use, though, and they may be using "email as a file
transfer protocol" for large files. I would hate to have to restrict
them.

Post by p***@ipal.net
Another option, if that
traffic level is smaller, is to get an ISDN or dialup service from a
different provider. Otherwise, finding a colocation or dedicated
hosting provider remains your big option.

I like my email to go out as instantly as possible (another reason I
don't like having to take an unnecessary hop through ISP mailservers),
so dialup wouldn't be a good solution. ISDN from someone other than
my phone company? I didn't realize that was possible. Tried to do
some searching just now and I'm not seeing any such providers. AT&T
requires you to call if you're ordering ISDN and doesn't list prices
online, but last I knew, several years ago, ISDN was a lot more
expensive than DSL (despite the much slower speeds). If that's still
the case, co-lo or dedicated hosting would seem a better use of money.

Post by p***@ipal.net
I'm not expecting any lists that list big provider blocks to be cutting
any holes. If they do, they would have to for everyone else who makes
the same claims as you do, and there is a huge list of that. They would
end up having to expend a huge cost burden to carry out verifications of
such requests.

The dynablock.njabl.org (recently deprecated in favor of:),
pbl.spamhaus.org, dul.dnsbl.sorbs.net, and dhcp.tqmcube.com DNSBLs
(and others, I believe) all list large ISP netblocks yet provide the
ability for server owners to get their IPs excluded. It appears
they've been able to successfully manage the potential costs of the
verification (e.g. through automation).

Post by p***@ipal.net
Charging to be exempted from such a listing would sure
be seen as a conflict of interest, and possibly illegal.

I note that uceprotect.net charges to be removed, but that's only if
you want to be removed immediately, and their system drops entries
automatically after 7 days (assuming no more spam from an IP hitting
the spamtraps).

Post by p***@ipal.net
Otherwise it is just entirely impractical to do that.

Apparently it's not -- see the DNSBLs I mentioned above (which do not
charge for removal).

Post by p***@ipal.net
What I am doing with my own lists (not publically available right now)
is listing by domain NAME, rather than IP address. The effect of such
a list is that your correctly rDNS'd addresses would not be affected
unless and until your own domain somehow got listed. If those who have
the resources to operate a worldwide public DNSBL were convinced to run
a list that used names like that, maybe it would become more popular
to use instead of lists based on IP address. So maybe you might want
to take the position of supporting that concept.

At first blush, that sounds like RHSBLs, which are indeed offered by a
number of public providers. Of course the problem with them is that
spammers can evade them by forging the envelope From domain and not
all domains publish SPF (or similar) records to deal with the forging
problem.

But since you mention rDNS, perhaps you're talking about a list that
checks to see if the IP address of the sending SMTP server resolves to
a domain that's listed? How do you deal with forged rDNS? Require
reverse and forward lookup to match? How do you allow for virtual
hosting on the same IP? And what about spammer servers that have no
rDNS? Also, do you only support domain names, or full hostnames? If
the former, I guess you have no way of listing one rogue server inside
verizon.net without blocking the entire domain?

Post by p***@ipal.net
| I dunno, other DNSBLs are able to make IP exceptions work. It's
| generally pretty automated.
How do they verify that a request for exception is valid (e.g. does not
meet the criteria that the rest of the large enclosing subnet does meet)?

I'm not sure -- not all of them publish exactly how it works (perhaps
to help avoid abuse). Here's what the SORBS DUHL requires:

We also operate a self-help exclusion interface that allows the
owner of a system to quickly exclude a single IP address (or, in
some cases, multiple IP addresses) from the DUHL. For this to
be possible, the following criteria need to be met:

* The MX record of a domain needs to contain a host name
that maps to the IP address involved. The Time to Live of
the MX record needs to be at least 43200 seconds.
* The A record for the host name needs to have a TTL of at
least 43200 seconds.
* The reverse DNS PTR record for the IP address involved
needs to map back to the name given in the MX record,
and to have a TTL of at least 43200 seconds.
* If there are multiple MX entries, these rules apply to them
all.

No doubt they also have stuff in place to block exclusion requests if
the requester is found to be spamming.

Post by p***@ipal.net
| I would be supportive of that if the processing fee were reasonable. I
| don't think senderscorecertified.com's $400 application fee for
| non-profit organizations is reasonable.
That seems a bit high to me. But I don't know what they do with it.
How well recognized are they in the anti-spam community?

I'm not sure -- I only recently became aware of them. They were
formerly known as Bonded Sender. I would imagine they're not that
well recognized in the community since they're clearly primarily a
commercial service.

Post by p***@ipal.net
Can anyone use a DNS based service from them for free?

According to <http://www.senderscorecertified.org/senderscorecertified/
howmuch.php>, yes.

dnswl.org, which I discovered afterwards, looks like a better bet for
community adoption (e.g. due to free listing). No idea if they'll be
able to keep up with the whitelisting demand with their volunteer
staff, though. I've submitted a listing request -- we'll see how long
it takes for them to respond in some way.

Post by p***@ipal.net
Find a provider that fully understands APEWS (and SPEWS).

Sounds easier said than done. Even if such providers are around, I
probably won't usually be able to get access to the people on staff
who have that understanding.

Post by p***@ipal.net
Talk with the
candidate providers about this and see what they say. Be sure to avoid
those who say things like "we can't control who lists us where" as that
can either be weasling to avoid a commitment they know they cannot make,
or just plain ignorance about the whole issue. Ask for a contract that
states that during any time either your IP space, or any other space at
least /24 in size, is listed in APEWS (or any other list you itemize and
agree to in the contract), then you cost is reduced to some substantially
low percentage, and the contract cannot be terminated early by them during
that period (unless they can show you were the spammer, which we assume
is something they will never be able to do).

It's an interesting thought, but I really doubt I'd have the leverage
to get them to agree to that kind of risk ("What, some faceless entity
that can't be contacted lists some IP space that includes us on some
whim and you no longer have to pay us enough to cover our costs? I
don't think so."), especially since I'd of necessity have to go with
one of the lower-cost providers (and packages).

--
Dan Harkless
http://harkless.org/dan/

[p***@ipal.net]

On Tue, 22 May 2007 11:22:20 GMT ***@harkless.org wrote:
| On May 21, 4:08 pm, Phil Howard wrote:
|>
|> I believe you will find that pretty much all DSL and cable providers
|> fall into the same category: they skimp on costs they should bear the
|> burden for, as I detailed, which passes those costs on to the victims
|> of the abuses from their network they fail to control.
|>
|> I share your concern about shared hosting. I wouldn't go that route.
|> But somehow you need to move up out of the rut you are in, and it is
|> very likely that no DSL/cable options will achieve that.
|>
|> How much of your traffic is outbound email?
|
| I don't have detailed stats at hand, but yeah, probably not that large
| a percentage. I don't monitor how much bandwidth my users (friends
| and family) use, though, and they may be using "email as a file
| transfer protocol" for large files. I would hate to have to restrict
| them.
|
|> Another option, if that
|> traffic level is smaller, is to get an ISDN or dialup service from a
|> different provider. Otherwise, finding a colocation or dedicated
|> hosting provider remains your big option.
|
| I like my email to go out as instantly as possible (another reason I
| don't like having to take an unnecessary hop through ISP mailservers),
| so dialup wouldn't be a good solution. ISDN from someone other than
| my phone company? I didn't realize that was possible. Tried to do
| some searching just now and I'm not seeing any such providers. AT&T
| requires you to call if you're ordering ISDN and doesn't list prices
| online, but last I knew, several years ago, ISDN was a lot more
| expensive than DSL (despite the much slower speeds). If that's still
| the case, co-lo or dedicated hosting would seem a better use of money.

The number of providers is dropping. But a great many still offer that
as a backup means. ISDN is just a switched network that happens to be
digitally interfaced. It's a circuit (64kbps) or two (128kbps) that is
directly feeding the underlying switched circuit for voice calls in the
traditional call switching networks.

These services can generally be operated nailed-up, too. Analog dialup
is essentially the same, but you get a slower speed (and the other end
has to have a modem, too, which may not exist for some ISPs).


|> I'm not expecting any lists that list big provider blocks to be cutting
|> any holes. If they do, they would have to for everyone else who makes
|> the same claims as you do, and there is a huge list of that. They would
|> end up having to expend a huge cost burden to carry out verifications of
|> such requests.
|
| The dynablock.njabl.org (recently deprecated in favor of:),
| pbl.spamhaus.org, dul.dnsbl.sorbs.net, and dhcp.tqmcube.com DNSBLs
| (and others, I believe) all list large ISP netblocks yet provide the
| ability for server owners to get their IPs excluded. It appears
| they've been able to successfully manage the potential costs of the
| verification (e.g. through automation).

I was thinking of starting a blacklist of my own that just lists the
whole internet :-) Then I'd punch out holes for whoever asks :-)


|> Charging to be exempted from such a listing would sure
|> be seen as a conflict of interest, and possibly illegal.
|
| I note that uceprotect.net charges to be removed, but that's only if
| you want to be removed immediately, and their system drops entries
| automatically after 7 days (assuming no more spam from an IP hitting
| the spamtraps).

Right. And I like that idea.


|> Otherwise it is just entirely impractical to do that.
|
| Apparently it's not -- see the DNSBLs I mentioned above (which do not
| charge for removal).

I'll check them out. I don't know if I'll ever be able to test their
hole drilling procedures, though.


|> What I am doing with my own lists (not publically available right now)
|> is listing by domain NAME, rather than IP address. The effect of such
|> a list is that your correctly rDNS'd addresses would not be affected
|> unless and until your own domain somehow got listed. If those who have
|> the resources to operate a worldwide public DNSBL were convinced to run
|> a list that used names like that, maybe it would become more popular
|> to use instead of lists based on IP address. So maybe you might want
|> to take the position of supporting that concept.
|
| At first blush, that sounds like RHSBLs, which are indeed offered by a
| number of public providers. Of course the problem with them is that
| spammers can evade them by forging the envelope From domain and not
| all domains publish SPF (or similar) records to deal with the forging
| problem.

They cannot forge the verification of rDNS very easily. That's what my
idea would be based on.


| But since you mention rDNS, perhaps you're talking about a list that
| checks to see if the IP address of the sending SMTP server resolves to
| a domain that's listed? How do you deal with forged rDNS? Require
| reverse and forward lookup to match? How do you allow for virtual
| hosting on the same IP? And what about spammer servers that have no
| rDNS? Also, do you only support domain names, or full hostnames? If
| the former, I guess you have no way of listing one rogue server inside
| verizon.net without blocking the entire domain?

The end user would have to enable the rDNS check to make it work right.
That would be a good idea even if the list wasn't used. If rDNS does
not validate, the mail should be rejected unless a specific whitelist
over that is applicable (I do have a few sender email addresses listed
that can override rDNS failures).


|> | I dunno, other DNSBLs are able to make IP exceptions work. It's
|> | generally pretty automated.
|>
|> How do they verify that a request for exception is valid (e.g. does not
|> meet the criteria that the rest of the large enclosing subnet does meet)?
|
| I'm not sure -- not all of them publish exactly how it works (perhaps
| to help avoid abuse). Here's what the SORBS DUHL requires:
|
| We also operate a self-help exclusion interface that allows the
| owner of a system to quickly exclude a single IP address (or, in
| some cases, multiple IP addresses) from the DUHL. For this to
| be possible, the following criteria need to be met:
|
| * The MX record of a domain needs to contain a host name
| that maps to the IP address involved. The Time to Live of
| the MX record needs to be at least 43200 seconds.
| * The A record for the host name needs to have a TTL of at
| least 43200 seconds.
| * The reverse DNS PTR record for the IP address involved
| needs to map back to the name given in the MX record,
| and to have a TTL of at least 43200 seconds.
| * If there are multiple MX entries, these rules apply to them
| all.

Sounds like they might want to have the same effect as name-based.
This might work. Maybe for them and maybe not for APEWS.

So I'll think about what I might do to create a white-only list that
works that way.


| No doubt they also have stuff in place to block exclusion requests if
| the requester is found to be spamming.


|> Find a provider that fully understands APEWS (and SPEWS).
|
| Sounds easier said than done. Even if such providers are around, I
| probably won't usually be able to get access to the people on staff
| who have that understanding.

You might be surprised, especially at the smaller ISPs.


|> Talk with the
|> candidate providers about this and see what they say. Be sure to avoid
|> those who say things like "we can't control who lists us where" as that
|> can either be weasling to avoid a commitment they know they cannot make,
|> or just plain ignorance about the whole issue. Ask for a contract that
|> states that during any time either your IP space, or any other space at
|> least /24 in size, is listed in APEWS (or any other list you itemize and
|> agree to in the contract), then you cost is reduced to some substantially
|> low percentage, and the contract cannot be terminated early by them during
|> that period (unless they can show you were the spammer, which we assume
|> is something they will never be able to do).
|
| It's an interesting thought, but I really doubt I'd have the leverage
| to get them to agree to that kind of risk ("What, some faceless entity
| that can't be contacted lists some IP space that includes us on some
| whim and you no longer have to pay us enough to cover our costs? I
| don't think so."), especially since I'd of necessity have to go with
| one of the lower-cost providers (and packages).

Then you will need to keep yourself agile, mobile.
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-22-***@ipal.net |
|------------------------------------/-------------------------------------|

[Shmuel (Seymour J.) Metz]

In <***@h2g2000hsg.googlegroups.com>, on
05/22/2007

Post by u***@harkless.org
The dynablock.njabl.org (recently deprecated in favor of:),
pbl.spamhaus.org, dul.dnsbl.sorbs.net, and dhcp.tqmcube.com DNSBLs
(and others, I believe) all list large ISP netblocks yet provide the
ability for server owners to get their IPs excluded.

There's a difference between a list of known spam sources and a list
of known IP addresses with generic rDNS. There's also a difference
between a list that is intended to be an early warning system and one
that is not.

Post by u***@harkless.org
At first blush, that sounds like RHSBLs, which are indeed offered by
a number of public providers. Of course the problem with them is
that spammers can evade them by forging the envelope From domain and
not all domains publish SPF (or similar) records to deal with the
forging problem.

You need to learn how such lists work.

Post by u***@harkless.org
Also, do you only support domain names, or full hostnames?

Why do you believe that full host names are not domain names?

Post by u***@harkless.org
I would imagine they're not that well recognized in the community

Recognized has two possible signs. They're recognized like habeus is
recognized.


In <***@o5g2000hsb.googlegroups.com>, on
05/23/2007

Post by u***@harkless.org
It depends on what's in those blocks.

Well, e.g., 12/8, 38/8 are single companies, while, e.g., 200/7,
210/7, are geographical areas.

Post by u***@harkless.org
I would cease using APEWS if I'd found out that it was blocking other
major ISPs as well.

It's not blocking anybody; it's just supplying data. The admins using
those data are free to use them as they wish, and that includes
whitelisting whatever IP blocks they choose.

Post by u***@harkless.org
I consider any such listing of large provider netblocks (the
majority of whose IPs are no doubt operated by non-spammers) to be
an unreasonable level of false positives,

You can consider an apple to be an orange, but that doesn't make it
one. A large list not only is not "an unreasonable level of false
positives", it is not *any* "level of false positives." If no message
matches the list then there are no false positives no matter how large
the list is. The only way to measure the false positive rate is no
count the actual messages that get rejected and the subset of those
that should not have been rejected.

Post by u***@harkless.org
particularly if there's no way
for innocent server operators within the range to request exclusion.

They can call you and ask for whitelisting.


In <***@q69g2000hsb.googlegroups.com>, on
05/23/2007

Post by u***@harkless.org
I believe that the average user reading the description of APEWS
would conclude that they're targeting "spammers and spam operations"
(hell, that's a direct quote), and not large ISP netblocks.

They *do* seem to be targeting "spammers and spam operations"; they
never claimed to exclude the ones that are large. AT&T has been a spam
operation for over a decade.

Post by u***@harkless.org
Perhaps you can acknowledge the possibility that as a "truly insane
Spews puppet" you have more knowledge of the workings of SPEWS /
APEWS than the average DNSBL user,

I can acknowledge the possibility that I run the Trilateral Commission
as well. I can acknowledge the possibility that *you* are SPEWS.
Unlikely possibilities don't butter any parsnips. As for the epithet,
it was awarded to me by one of the frothier loons infesting NANAE and
intended as an insult; instead it was an undeserved compliment.

Post by u***@harkless.org
"Dropped" = silently (barring perhaps some logging) deleting
messages considered to be spam. Not the same thing as automatically
filing them into a junk mail folder.

A difference that makes no difference is no difference. Filing them in
a folder stuffed to the gills with spam means that the vast majority
of users will never find them.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[Stephen Satchell]

Post by Dan Harkless
The cost comparison
I'm making is hosting my server on a static IP DSL line vs. co-locating
my server somewhere. I initially looked into that approach but found it
to not be affordable (generally due to non-flat-rate pricing models for
bandwidth). Shared hosting would be affordable, but I don't trust other
people having full access to my server and data.

I'll be blunt: you haven't look hard enough, then.
--
A little learning is a dang'rous thing;
Drink deep, or taste not the Pierian spring;
There shallow draughts intoxicate the brain,
And drinking largely sobers us again.
-- Alexander Pope, Essay on Criticism

[u***@harkless.org]

Post by Stephen Satchell

Post by Dan Harkless
The cost comparison
I'm making is hosting my server on a static IP DSL line vs. co-locating
my server somewhere. I initially looked into that approach but found it
to not be affordable (generally due to non-flat-rate pricing models for
bandwidth). Shared hosting would be affordable, but I don't trust other
people having full access to my server and data.

I'll be blunt: you haven't look hard enough, then.

I spent many many hours and exchanged a total of 110 emails with a
large number of different co-lo providers, and the only affordable
ones either would give me no access to my server if it had a hardware
issue after hours, used a measured bandwidth approach that would open
me up to outrageous overage charges if, for instance, I became the
victim of a DDoS attack (e.g. due to hosting anti-spam software), or
had a flat rate bandwidth plan that required locking down transfer
rates to far slower than my home DSL (not acceptable for a server that
hosts multimedia files). I looked hard, believe me.

--
Dan Harkless
http://harkless.org/dan/


======================================= MODERATOR'S COMMENT:

no blocklisting content seen - is this thread at an end now?

[Mike Andrews]

Post by Dan Harkless
Since I'm not omniscient, I can't really answer that, but my local
providers are Cox cable and AT&T DSL. Last time I looked into it, Cox
didn't support the running of servers. I know it would be possible to
get DSL through another provider and have AT&T just providing the phone
line, but when I had that kind of service in the past (Covad via SBC),
it was a nightmare when there were service problems since Covad and SBC
would just point the finger at each other and I couldn't get the
problems fixed.

I have Cox cable, and they support running servers on my account. It
is a _commercial_, not a residential, account. The price is the same,
I have a static IP, the folks at Cox were very good about setting up
the RDNS for me, and I get better service from the commercial helldesk
than I ever did from the residential helldesk.

For a while, I also had SBC DSL to another network in the house, but I
got sick-and-tired of it not working and SBC not giving a damn, and so
now it's all Cox.

If you can get a commercial account from your branch of Cox, you ought
to give that option very serious thought -- and especially so if the
price delta is small.
--
Mike Andrews, W5EGO
***@mikea.ath.cx
Tired old sysadmin


======================================= MODERATOR'S COMMENT:

very good advice - and we're moving away from blocklisting, so
hopefully this thread is at an end

[E-Mail Sent to this address will be added to the BlackLists]

Post by Dan Harkless

Post by s***@postmasters.servegame.org
If you feel we do anything wrong, post to
news.admin.net-abuse.blocklisting or news.admin.net-abuse.email
starting with subject APEWS followed by the Case-ID.

I certainly can't see what APEWS may be doing wrong,
the record you mention below seems to indicate that
APEWS is seeing a significant amount of abuse related
to AS7132 , 71.128.0.0/11 .

Post by Dan Harkless
I'm a long-time happy user of SPEWS and then APEWS, but I
was very unhappy today to discover that my netblock had

Post by s***@postmasters.servegame.org
Sorry 71.133.223.221 is currently listed in APEWS :-(
Entry matching your Query: E-173851 71.128.0.0/11
CASE: C-130 Most abusive ASN and CIDR
History: Entry created 2007-05-18

My server is hosted from my AT&T static IP address DSL
line (about all I can afford), and I'm an anti-spam
activist, I host open source anti-spam software I've
written on my site (with more to come), etc., yet I've
just been tarred as a spammer by what seems like an
excessively large brush.

That CIDR your ISP is responsible for was tarred with
a brush that indicates significant abuse related to
that CIDR.

Post by Dan Harkless
A whole lot of non-spamming small businesses and techies
that prefer to run their own mailservers (e.g. for better
spam control) can no longer send mail to the APEWS-using
world.

Except for those whitelisting sources of messages they
want / need / expect.

Post by Dan Harkless
APEWS folks, would you please consider either removing
static IP address ranges from this block (not sure what
they are -- I don't know if AT&T publishes that info
publically), or else adding the ability for legitimate
non-spamming server owners to request removal of their
specific IPs, as many other prominent DNSBLs do?

Which DNSbls would those be, that are accepting request for
and delisting single IPs inside a BlackListed CIDR
based on requests by an enduser?

I don't see what good that would do, don't you think
e.g. 71.156.118.0/23 would be requesting a delisting,
so their messages would go through?

Post by Dan Harkless
I hope you can do something about this. :-( As of right
now I'm of course ceasing use of APEWS, since it incorrectly
marks me as a spammer.

Origin: AS7132
Route: 71.128.0.0/11
NetRange: 71.128.0.0 - 71.159.255.255
NetName: SBCIS-SIS80
NetType: Direct Allocation
OrgName: SBC Internet Services
OrgID: SIS-80
NameServers: NS1.PBI.NET , NS2.PBI.NET
Comment: pacbell.net / swbell.net / sbc.com / sbcglobal.net / att.com

CIDR: 71.133.223.216/29
NetRange: 71.133.223.216 - 71.133.223.223
NetType: Reassigned
CustName: Daniel Harkless

Those seeing abuse related to that IP space would likely be
sending messages to e-mail addresses that would be delivered
to your ISP, not you; What does your ISP do when they get
complaints related to that IP space?

It appears that APEWS is holding ATT responsible for the abuse
they are seeing related to AS7132 , 71.128.0.0/11 .

You have not presented any information about how that is wrong.
(That a ISP has some IPs not used for abuse, is not a very
good reason to not hold the ISP responsible for abuse
from other IPs in the AS / Route / Direct Allocation.

If you were using their DNSbls, you certainly must have
been familiar with what they list (very rarely single IPs,
more often CIDRs).

SPEWS, APEWS, and some other IP BlackLists / BlockLists
/ DNSbls seem to hold the Regional Internet Registry's
Directly Allocated ISP responsible for abuse related to
their customers use of the IP space.

{Wack-a-Mole is depreciated.}


FYI, <http://www.spamhaus.org/statistics/networks.lasso>
The 10 Worst Spam Service ISPs As at 20 May 2007
Rank Network Number of Current Known Spam Issues
1 verizon.com 75
2 _ATT.net_ 56 (27 are known professional spam operations)
<http://www.spamhaus.org/sbl/listings.lasso?isp=att.net>
<http://www.spamhaus.org/sbl/sbl.lasso?query=SBL53736>
<http://www.spamhaus.org/sbl/sbl.lasso?query=SBL44049>
<http://www.spamhaus.org/sbl/sbl.lasso?query=SBL51112>*
<http://www.spamhaus.org/sbl/sbl.lasso?query=SBL44050>*
*<http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Charles%20Earle%20IV%20-%20World%20Mail%20Direct>

Origin: AS7132
Route: 71.128.0.0/11
NetRange: 71.128.0.0 - 71.159.255.255
NetName: SBCIS-SIS80
NetType: Direct Allocation
OrgName: SBC Internet Services
OrgID: SIS-80
CIDR: 71.156.118.0/23
NetRange: 71.156.118.0 - 71.156.119.255
NetType: Reassigned
CustName: Performance Marketing

Those links above are in that AS7132 , 71.128.0.0/11 Direct
Allocation to your ISP, I wonder what they will say about
that when you ask them about those, and why they are #2
in SpamHaus top 10 worst ISPs.



Cute rDNS for that 71.133.223.216/29 SWIP
216.223.133.71.in-addr.arpa-> NXDOMAIN
217.223.133.71.in-addr.arpa -> a.example.com -> NXDOMAIN
218.223.133.71.in-addr.arpa -> b.example.com -> NXDOMAIN
219.223.133.71.in-addr.arpa -> c.example.com -> NXDOMAIN
220.223.133.71.in-addr.arpa-> d.example.com -> NXDOMAIN
221.223.133.71.in-addr.arpa -> MX harkless.org -> 71.133.223.221
222.223.133.71.in-addr.arpa -> dumont.harkless.org -> 71.133.223.222
223.223.133.71.in-addr.arpa -> NXDOMAIN
{Just playing with the rDNS PTRs?}

FYI, IANA / ICANN is resolving some example.coms to IPs,
and vise versa, e.g. example.com -> 208.77.188.166
166.188.77.208.in-addr.arpa -> www.example.com
www.example.com -> 208.77.188.166

[u***@harkless.org]

[Didn't receive a robomoderation "RECEIVED" message (or anything else)
for this post. Trying again.]

Post by E-Mail Sent to this address will be added to the BlackLists

Post by Dan Harkless
A whole lot of non-spamming small businesses and techies
that prefer to run their own mailservers (e.g. for better
spam control) can no longer send mail to the APEWS-using
world.

Except for those whitelisting sources of messages they
want / need / expect.

Unfortunately there isn't a general way to know who to expect messages
from when you run a public website.

As for the whitelisting, I did just discover http://www.dnswl.org/
while
writing this post. Sounds like they have a pretty good approach,
although you have to do some digging to figure out how to get added
and
what information they want from you. I'll go ahead and request an add
of my server and start figuring out how to get my DNSBL software
working
with their whitelist. Hopefully they'll gain enough momentum that
DNSBL
users will start widely using them.

Post by E-Mail Sent to this address will be added to the BlackLists

Post by Dan Harkless
APEWS folks, would you please consider either removing
static IP address ranges from this block (not sure what
they are -- I don't know if AT&T publishes that info
publically), or else adding the ability for legitimate
non-spamming server owners to request removal of their
specific IPs, as many other prominent DNSBLs do?

Which DNSbls would those be, that are accepting request for
and delisting single IPs inside a BlackListed CIDR
based on requests by an enduser?

I don't know the internals of all the DNSBLs I use, so I don't know
which of these use CIDRs and which don't (although where I do know
that
I'll make note of it), but here are ones that allow a non-spamming
server administrator to request removal:

list.dsbl.org -- http://dsbl.org/removalquery

njabl.org -- http://www.njabl.org/remove.html and formerly
http://www.njabl.org/dynablock.html. I see that NJABL dynablock is
now deprecated in favor of the Spamhaus PBL. I wish more DNSBLs
would
run -announce mailing lists so their users could be notified when
they're being shut down or otherwise significantly changed. In any
case, pretty sure this one was an example of a DNSBL that allowed
for
exceptions within larger netblocks.

ix.dnsbl.manitu.net -- http://ix.dnsbl.manitu.net/

psbl.surriel.com/remove -- http://psbl.surriel.com/remove

sorbs.net -- Varies by list, but they definitely provide the ability
to
get your IP excluded from a larger netblock in the
dul.dnsbl.sorbs.net
DNSBL -- see <http://www.au.sorbs.net/faq/dul.shtml>.

spamhaus.org -- http://www.spamhaus.org/lookup.lasso (removal button
on
results page). This would be another one that I know allows removal
of individual IPs within larger netblocks (with their PBL list, at
least -- see <http://www.spamhaus.org/pbl/index.lasso>).

tqmcube.com -- http://tqmcube.com/dnsbl/dnsbl_remove.php. This is
another one that documents that it allows exceptions for static IPs
within dynamic netblocks -- see <http://tqmcube.com/generic.php>.

Post by E-Mail Sent to this address will be added to the BlackLists
I don't see what good that would do, don't you think
e.g. 71.156.118.0/23 would be requesting a delisting,
so their messages would go through?

A lot of good DNSBLs seem to be able to offer delisting interfaces
despite the fact that spammers have an incentive to misuse them.
That's
pretty easily handled by, for instance, banning further delisting
attempts by known spamming IPs. My server does not send out spam.

Post by E-Mail Sent to this address will be added to the BlackLists
Origin: AS7132
Route: 71.128.0.0/11
NetRange: 71.128.0.0 - 71.159.255.255
NetName: SBCIS-SIS80
NetType: Direct Allocation
OrgName: SBC Internet Services
OrgID: SIS-80
NameServers: NS1.PBI.NET , NS2.PBI.NET
Comment: pacbell.net / swbell.net / sbc.com / sbcglobal.net / att.com
CIDR: 71.133.223.216/29
NetRange: 71.133.223.216 - 71.133.223.223
NetType: Reassigned
CustName: Daniel Harkless
Those seeing abuse related to that IP space would likely be
sending messages to e-mail addresses that would be delivered
to your ISP, not you; What does your ISP do when they get
complaints related to that IP space?

No doubt the terms of use indicate that they would contact me and/or
immediately shut off my access, but as to how good they are about
enforcing that, I'm unaware. I know they've turned off my DSL line
before when I was a little late paying my bill (under a month), so
they
definitely have the ability to do that.

Post by E-Mail Sent to this address will be added to the BlackLists
FYI, <http://www.spamhaus.org/statistics/networks.lasso>
The 10 Worst Spam Service ISPs As at 20 May 2007
Rank Network Number of Current Known Spam Issues
1 verizon.com 75
2 _ATT.net_ 56 (27 are known professional spam operations)

Okay, I didn't realize they had gotten that bad. Thank you for that
info.

Post by E-Mail Sent to this address will be added to the BlackLists
Those links above are in that AS7132 , 71.128.0.0/11 Direct
Allocation to your ISP, I wonder what they will say about
that when you ask them about those, and why they are #2
in SpamHaus top 10 worst ISPs.

Given the usual quality of customer service at ISPs, I find it
doubtful
I'll get any useful reply -- but I'll ask. Thanks.

Post by E-Mail Sent to this address will be added to the BlackLists
Cute rDNS for that 71.133.223.216/29 SWIP
216.223.133.71.in-addr.arpa-> NXDOMAIN
217.223.133.71.in-addr.arpa -> a.example.com -> NXDOMAIN
218.223.133.71.in-addr.arpa -> b.example.com -> NXDOMAIN
219.223.133.71.in-addr.arpa -> c.example.com -> NXDOMAIN
220.223.133.71.in-addr.arpa-> d.example.com -> NXDOMAIN
221.223.133.71.in-addr.arpa -> MX harkless.org -> 71.133.223.221
222.223.133.71.in-addr.arpa -> dumont.harkless.org -> 71.133.223.222
223.223.133.71.in-addr.arpa -> NXDOMAIN
{Just playing with the rDNS PTRs?}

The only system that sends out mail is harkless.org, and it of course
has a correct rDNS pointer. The others are only client machines
(doing
web browsing), and for privacy reasons I did not wish to gratuitously
identify myself in the weblogs of the world.

Post by E-Mail Sent to this address will be added to the BlackLists
FYI, IANA / ICANN is resolving some example.coms to IPs,
and vise versa, e.g. example.com -> 208.77.188.166
166.188.77.208.in-addr.arpa -> www.example.com
www.example.com -> 208.77.188.166

RFC 2606 specifies that example.com, .net, and .org are reserved as
example domain names.

--
Dan Harkless
http://harkless.org/dan/

[E-Mail Sent to this address will be added to the BlackLists]

Post by u***@harkless.org
RFC 2606 specifies that example.com, .net, and .org are
reserved as example domain names.

For documentation & private testing.

I'd say you using them as rDNS PTRs for publicly routable
(internet IPs) isn't very private.

[u***@harkless.org]

On May 22, 11:54 am, E-Mail Sent to this address will be added to the

Post by E-Mail Sent to this address will be added to the BlackLists

Post by u***@harkless.org
RFC 2606 specifies that example.com, .net, and .org are
reserved as example domain names.

For documentation & private testing.
I'd say you using them as rDNS PTRs for publicly routable
(internet IPs) isn't very private.

Actually documentation and private testing are only two of the many
acceptable uses listed. Another is "invalid DNS names", which is my
intended (privacy-driven) use. If you think it would be better to use
one of the reserved TLDs rather than one of the reserved second-level
domains, though, I can certainly do that.

--
Dan Harkless
http://harkless.org/dan/

[E-Mail Sent to this address will be added to the BlackLists]

Post by u***@harkless.org

Post by E-Mail Sent to this address will be added to the BlackLists

Post by u***@harkless.org
RFC 2606 specifies that example.com, .net, and .org are
reserved as example domain names.

For documentation & private testing.
I'd say you using them as rDNS PTRs for publicly routable
(internet IPs) isn't very private.

Actually documentation and private testing are only two
of the many acceptable uses listed.
Another is "invalid DNS names", which is my intended
(privacy-driven) use.

If you go read RFC 2606, I think you will see that is the TLDs,
not the second level domain names.

Post by u***@harkless.org
If you think it would be better to use one of the reserved
TLDs rather than one of the reserved second-level domains,
though, I can certainly do that.

(Shrug) I don't much care, I just thought I would point
to you out what the RFC says and that the rDNS PTRs you
are using may forward resolve to an unrelated IP
and that isn't under your control.

[Shmuel (Seymour J.) Metz]

In <***@q69g2000hsb.googlegroups.com>, on
05/23/2007

Post by u***@harkless.org
Actually documentation and private testing are only two of the many
acceptable uses listed. Another is "invalid DNS names", which is my
intended (privacy-driven) use. If you think it would be better to
use one of the reserved TLDs rather than one of the reserved
second-level domains, though, I can certainly do that.

Definitely in a different context. There's an IETF working group
trying to produce a replacement for RFC 1036, and they specify the
invalid TLD. My guess is that will still be there if and when they
produce the final version.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[Shmuel (Seymour J.) Metz]

In <***@q69g2000hsb.googlegroups.com>, on
05/23/2007

Post by u***@harkless.org
Actually documentation and private testing are only two of the many
acceptable uses listed. Another is "invalid DNS names", which is my
intended (privacy-driven) use. If you think it would be better to
use one of the reserved TLDs rather than one of the reserved
second-level domains, though, I can certainly do that.

Definitely in a different context. There's an IETF working group
trying to produce a replacement for RFC 1036, and they specify the
invalid TLD. My guess is that will still be there if and when they
produce the final version.
--
Shmuel (Seymour J.) Metz, truly insane Spews puppet
<http://patriot.net/~shmuel>

I reserve the right to publicly post or ridicule any abusive
E-mail. Reply to domain Patriot dot net user shmuel+news to contact
me. Do not reply to ***@library.lspace.org

[David W. Hodgins]

Post by Shmuel (Seymour J.) Metz
Definitely in a different context. There's an IETF working group
trying to produce a replacement for RFC 1036, and they specify the
invalid TLD. My guess is that will still be there if and when they
produce the final version.

Another option, is to use a uri you have permission to use.
In the case of nomail.afraid.org, I registered it back when
swen was filling my inbox, preventing me from getting ham.

I've given permission to use it, to anyone who wants to.

It resolves to localhost, so any spambot will be trying to
send to localhost. If a trojaned computer is also running an mta,
the user may notice to log entries. If it causes other problems
for spambots, so much the better.

Regards, Dave Hodgins
--
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

[p***@ipal.net]

On Tue, 22 May 2007 12:17:21 GMT ***@harkless.org wrote:

| Unfortunately there isn't a general way to know who to expect messages
| from when you run a public website.

Isn't that what "contact us" web forms are about?
--
|---------------------------------------/----------------------------------|
| Phil Howard KA9WGN (ka9wgn.ham.org) / Do not send to the address below |
| first name lower case at ipal.net / spamtrap-2007-05-22-***@ipal.net |
|------------------------------------/-------------------------------------|

[Claes T]

Hi!

Post by Dan Harkless
My server is hosted from my AT&T static IP address DSL line (about all I
can afford), and I'm an anti-spam activist

Please see http://www.spamhaus.org/statistics/networks.lasso

Could you please clarify why you as an anti-spam activist gives your
last dimes to the isp giving more service to spammers then any other
isp but Verizon? Did you at least talk with your kind AT&T salesman
or support about this? What did s/he say? Are they planning to be out
of the top-ten-worst list before summer? Before end of year? (if so,
before end of *what* year?) Before sun (not Sun) dies?

Post by Dan Harkless
Presumably AT&T's main outgoing SMTP servers are not blocked, but for
many reasons I prefer to be able to send my email directly from my
server (e.g. to be able to have hard verification that certain mails
reached the recipient servers, to be able to ensure end-to-end SSL
encryption with certain correspondents' servers, etc.).

If you cant' afford to pay for premium service, maybe you shouldn't
expect to be able to use premium service? Live in the slum, be
treated as someone living in the slum. Not fair, but life isn't.

But perhaps you could talk with some of your anti-spam customers,
asking them to let you smarthost your mail with them, maybe even for
free if they like your software?

Post by Dan Harkless
APEWS folks, would you please consider either removing static IP address
ranges from this block (not sure what they are -- I don't know if AT&T
publishes that info publically), or else adding the ability for
legitimate non-spamming server owners to request removal of their
specific IPs, as many other prominent DNSBLs do?

You ask them to change the part in FAQ Q42/A42 telling you:
"If there is a spam related problem with your host, their IP
address/range will not be removed until it is resolved"?

Well, I could guess they won't change their M.O. to please you, but
time will tell.

Post by Dan Harkless
I hope you can do something about this. :-( As of right now I'm of
course ceasing use of APEWS, since it incorrectly marks me as a spammer.

Of course. But I'm afraid it won't get your mail delivered if *you*
cease to use APEWS, better if you ask the part blocking your mail to
whitelist your IP.

HTH, HAND,
Claes T

[u***@harkless.org]

[Didn't receive a robomoderation "RECEIVED" message (or anything else)
for this post. Trying again.]

Post by Claes T
Could you please clarify why you as an anti-spam activist gives your
last dimes to the isp giving more service to spammers then any other
isp but Verizon? Did you at least talk with your kind AT&T salesman
or support about this? What did s/he say? Are they planning to be out
of the top-ten-worst list before summer? Before end of year? (if so,
before end of *what* year?) Before sun (not Sun) dies?

I don't have a good alternative to AT&T DSL. As for grilling them
about
their apparent lack of strong spam enforcement, I doubt they'll give
me
a useful reply, but you're right, I should ask.

Post by Claes T
But perhaps you could talk with some of your anti-spam customers,
asking them to let you smarthost your mail with them, maybe even for
free if they like your software?

I don't have any customers -- harkless.org is a personal site hosting
open source software, etc.

--
Dan Harkless
http://harkless.org/dan/