From: Derek Balling [mailto:dredd@megacity.org] Sent: Sunday, May 27, 2001 11:20 AM
I'm not sure I understand this logic:
1.) They test positive for orbs... so they ARE an open relay 2.) That system is using MAPS, which means that there is some subset of systems the open relay itself rejects mail from
I somehow missed your logic here. A MAPS blocked system is, by definition NOT an open-relay, since it IS MAPS-blocked. Yet, ORBS will
At 11:10 AM -0700 5/27/01, Roeland Meyer wrote: list it as an
open-relay. I agree, there is a disconnect here. Your second premis invalidates the first. This may be a semantic issue, please examine and clarify.
I think this is all a phrasology thing.
I'm sorry. I hate hare-splitting too.
Assuming "a MAPS-blocked system" means a system that is listed/blocked by MAPS as a spam source.
Then your statement makes no sense because in all likelihood, that host IS an open relay.
My bad. What I meant was a MAPS-blocked system as a subcriber to MAPS. Not a MAPS-known spam source.
Assuming "a MAPS-blocked system" means a system that is partaking of the MAPS lists to block inbound mail to it
Then your statement further makes no sense, because any non-MAPS-listed host could (in theory) send mail to/through that system. If the system using MAPS is an open relay, then non-MAPS-listed hosts could quite happily/easily pump mail through that system regardless of whether or not it is using MAPS.
Not true, I'm assuming that MAPS isn't the only anti-spam measures being implemented.
I might point out that, since MAPS has been running for a few years, most if not all, the spammer sources are now listed.
I think my personal evidence (that about 90-95% of my spam that is blocked is NOT from MAPS sources) does not seem to bear that out.
You bear out my assumptions that other methods, besides MAPS and ORBS, are being deployed as well. Feeding such data into MAPS would improve MAPS accuracy.
I think this is all a phrasology thing.
I'm sorry. I hate hare-splitting too.
So long as we at least decide what it is we're disagreeing on. ;-)
My bad. What I meant was a MAPS-blocked system as a subcriber to MAPS. Not a MAPS-known spam source.
That's what I had thought you meant. :)
Then your statement further makes no sense, because any non-MAPS-listed host could (in theory) send mail to/through that system. If the system using MAPS is an open relay, then non-MAPS-listed hosts could quite happily/easily pump mail through that system regardless of whether or not it is using MAPS.
Not true, I'm assuming that MAPS isn't the only anti-spam measures being implemented.
But @BLOCKED_HOSTS != @WHOLE_OF_INTERNET, so it doesn't matter WHAT anti-spam features they're using, if they're an open relay, they deserve to be in ORBS. Another hair to split is that "ORBS" is not a list. It's a COLLECTION of lists. The above-described open-relay should be listed on the inputs.orbs.org list.
I think my personal evidence (that about 90-95% of my spam that is blocked is NOT from MAPS sources) does not seem to bear that out.
You bear out my assumptions that other methods, besides MAPS and ORBS, are being deployed as well. Feeding such data into MAPS would improve MAPS accuracy.
I don't think so. Judging from discussions in forums where this topic is more prevalent (spam-l, spamtools) MAPS seems to be a bit of a blackhole itself, with lots of sites being nominated as spam sources for the MAPS RBL and very few actually seeming to get listed. D -- +---------------------+-----------------------------------------+ | dredd@megacity.org | "Conan! What is best in life?" | | Derek J. Balling | "To crush your enemies, see them | | | driven before you, and to hear the | | | lamentation of their women!" | +---------------------+-----------------------------------------+
Derek Balling wrote:
I don't think so. Judging from discussions in forums where this topic is more prevalent (spam-l, spamtools) MAPS seems to be a bit of a blackhole itself, with lots of sites being nominated as spam sources for the MAPS RBL and very few actually seeming to get listed.
Someone else, perhaps Roeland, mentioned that MAPS is a lot more deliberate than ORBS is. Also mentioned was the fact that that can be viewed either as a good thing or a bad thing depending on your point of view. It's true. Some people like the more aggressive stance ORBS takes. Some people don't like the apparent abitrariness (if that's a word) of some of the ORBS listings. -- Tired of Earthlink? Get JustTheNet! Nationwide Dialup, ISDN, DSL, ATM, Frame Relay, T-1, T-3, and more. EARTHLINK AMNESTY PROGRAM: Buy a year, get two months free More info coming soon to http://JustThe.net, or e-mail me! B!ff: K3wl, w3'v3 r00t3D da N@vy... 0h CrAp, INC0M!Ng $%^NO CARRIER
Date: Sun, 27 May 2001 15:22:09 -0400 From: Steve Sobol <sjsobol@NorthShoreTechnologies.net>
[ snip ]
Someone else, perhaps Roeland, mentioned that MAPS is a lot more deliberate than ORBS is. Also mentioned was the fact that that can be viewed either as a good thing or a bad thing depending on your
That would have been myself...
point of view. It's true. Some people like the more aggressive stance ORBS takes. Some people don't like the apparent abitrariness (if that's a word) of some of the ORBS listings.
...and I also stated that nobody forces one to use MAPS or ORBS as-is. I've never heard much of an argument, let alone a solid one, against this. As much as I'd love to strong-arm providers into fixing their open relays, I whitelist acceptable MXes, and often contact the admin in question. The dearth of clueful admins who don't run open relays makes it difficult at best to refuse mail from all ORBS-listed MXes. Hence, I submit that "MAPS + ORBS + manual whitelist" is better than any alternative, particularly the "MAPS + !ORBS + whack-a-mole blacklist". And anybody who claims that MAPS kills most of the spam isn't running much of an MX. I deliberately have sendmail check MAPS (all three) _before_ any ORBS. If MAPS truly stopped most spam, then ORBS would yield mostly false positives... and it just ain't so. Eddy --------------------------------------------------------------------------- Brotsman & Dreger, Inc. EverQuick Internet Division Phone: (316) 794-8922 --------------------------------------------------------------------------- Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist@brics.com> To: blacklist@brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist@brics.com>, or you are likely to be blocked.
participants (4)
-
Derek Balling -
E.B. Dreger -
Roeland Meyer -
Steve Sobol