On May 24, 2008, at 3:24 AM, Colin Alston wrote:

You should not accept SMTP from the Amazon EC2 cloud at all. Amazon don't intend for anyone to use it as an email platform and tell their clients to use an external relay.

I'm sure this is good advice. But if an ISP used that as an excuse for not taking action, we'd hang them over hot coals. Is Amazon truly not policing the network for spammers?

not to excuse this, but... it's not a simple problem. The 'bad guy' rolls up to the website, orders 200 machines for 20 mins under the name 'xplosiveman' pays with some paypal/CC and runs his/her job. That job happens to create a bunch of email outbound. It could be a legitimate email service outsourcing their compute/bw needs to AWS, it could be 'pick-yer-bad-spammer' ... AWS really can't tell until after when the complaints roll in. :(

Oh rubbish, it's a trivial problem. You verify the payment method in advance and make it clear in the agreement to use the resources that any of the following activities (list, define...) will be billed at a steep rate (e.g., $100 per spamming complaint) and make some reasonable effort to ensure you can collect that, like do an authorize on their credit card (that's what hotels do to reserve but not charge typically $1000 or whatever on your card when you check in.) It's trivial, using your systems to spam is a cost, make sure at the very least you get paid for it. This isn't hypothetical, I have done exactly this many times here and billed customers who were crossing the line and generating too many complaints (but not quite what I'd call egregious spamming, but maybe harvesting addresses for their "newsletter" from specific chat groups for example) $50 per complaint, and I've collected it, and it stopped, either they paid it and cleaned up their act or they went away, good riddance. Anyone who builds a business model which allows for this sort of massive fraud and criminality where a few common sense precautions would prevent it is just transferring the costs of reasonable precaution to others and courts should come to understand that sooner than later. Their business model is monetizing your time and efforts to accomodate that abuse. The money is going right into their pockets by not having to pay for employees to implement and execute an avoidance, detection, and recovery plan, for starters. Microsoft has made untold billions monetizing spam (by knowingly not fixing their OS for over a decade) and others are figuring this out and building new business models which profit on abuse enablement even if indirectly (i.e., as a cost savings.) They're laughing all the way to the bank as you get shook out of bed with another 3AM emergency or stay over the weekend to upgrade your newly purchased firewall capacity, etc etc etc. -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

On May 24, 2008 at 12:10 sethm@rollernet.us (Seth Mattinen) wrote:

And 6 months later, a chargeback shows up because the cardholder claims their card was used fraudulently. The bank will most likely side with the cardholder if you challenge it. How can that loophole be closed?

Since this comment applies equally to every single credit card payment on the internet etc I suppose you've just proven that credit cards can't possibly work and even Amazon itself is an impossibility. Perhaps we can move on to why bumble bees can't fly? Like I said, they have to verify who they're doing business with to some reasonable degree matching the risk involved. Declining a legitimate charge can be a criminal fraud. Even when someone declines a charge it doesn't mean you can't collect what you believe to be money legitimately owed you. You can hand it to a collection agency if it's worthwhile. If not (e.g., you took a card w/o any verification from someone in a country whose name you can't even pronounce) OH WELL, you're a fool, or it better be part of your cost of doing business. Obviously an occasional successful fraud will happen, you can't make the best the enemy of the good, but what a reasonable rather than totally irresponsible policy does is discourage criminals preventatively. STICKING TO THE POINT OF THESE COMPUTING CLOUDS... What is the dollar range of a typical charge for these services? Let's not broaden the point to include every pennyante transaction on the internet. There's a big difference between talking about credit card problems with $20 charges which are hardly worth pursuing and thousands of dollars. Anyhow, it's not my problem to get them paid, it's my problem when they're aiding and abetting criminals who harm me and my business. If they're not even getting paid for that then they're just stupid and deserve whatever happens to them. You make it sound like I have to design a successful business model for them in order to claim damages from their flawed model. I don't think so. -- -Barry Shein The World | bzs@TheWorld.com | http://www.TheWorld.com Purveyors to the Trade | Voice: 800-THE-WRLD | Login: Nationwide Software Tool & Die | Public Access Internet | SINCE 1989 *oo*

On 24/05/2008 21:36 Barry Shein wrote:

Anyhow, it's not my problem to get them paid, it's my problem when they're aiding and abetting criminals who harm me and my business.

Well, all I know is that they deliberately leave the compute cloud ranges in blacklists. I don't really like the idea of using DNS blacklists but they work. As I also said, you have many peoples blessing to simply block the entire range as per their service terms they don't gurantee mail going out at all - blocking 25 entirely would be counter productive to allowing people to use an authenticated relay though unless they used the submission port. It is entirely possible that the spammers do pay for the service genuinely though, since it's very cheap. -- Colin Alston ~ http://syllogism.co.za/ "To the world you may be one person, to one person you may be the world" ~ Rachel Ann Nunes.

Requiring accounts have more time active with charges on the same credit card than the length of the chargeback window before they can transmit on 25, or be filled by wire transfer if someone is in a huge hurry would certainly do the trick.n Yes, some business would be lost, but probably not much. On Sat, May 24, 2008 at 3:10 PM, Seth Mattinen <sethm@rollernet.us> wrote:

Barry Shein wrote:

...

...

not to excuse this, but... it's not a simple problem. The 'bad guy' rolls up to the website, orders 200 machines for 20 mins under the name 'xplosiveman' pays with some paypal/CC and runs his/her job. That job happens to create a bunch of email outbound. It could be a legitimate email service outsourcing their compute/bw needs to AWS, it could be 'pick-yer-bad-spammer' ... AWS really can't tell until after when the complaints roll in. :(

Oh rubbish, it's a trivial problem.

You verify the payment method in advance and make it clear in the agreement to use the resources that any of the following activities (list, define...) will be billed at a steep rate (e.g., $100 per spamming complaint) and make some reasonable effort to ensure you can collect that, like do an authorize on their credit card (that's what hotels do to reserve but not charge typically $1000 or whatever on your card when you check in.)

It's trivial, using your systems to spam is a cost, make sure at the very least you get paid for it.

And 6 months later, a chargeback shows up because the cardholder claims their card was used fraudulently. The bank will most likely side with the cardholder if you challenge it. How can that loophole be closed?

~Seth