RE: Attn MCI/UUNet - Massive abuse from your network
At 04:00 PM 6/24/2004, Hannigan, Martin wrote:
On Thu, 24 Jun 2004, Ben Browning wrote: this discussion anyways, is access to the internet. When the actions of a downstream damage that product(IE more and more networks nullroute UUNet traffic),
[ Operations content: ] Do you know of any ISP's null routing AS701?
ISPs? Not of the top of my head. I know several businesses who have, and a great many people who have blocked UUNet space from sending them email, either by using SPEWS, the SBL, or mci.blackholes.us . ~Ben --- Ben Browning <benb@theriver.com> The River Internet Access Co. WA Operations Manager 1-877-88-RIVER http://www.theriver.com
On Fri, 25 Jun 2004, Ben Browning wrote:
At 04:00 PM 6/24/2004, Hannigan, Martin wrote:
[ Operations content: ] Do you know of any ISP's null routing AS701?
ISPs? Not of the top of my head. I know several businesses who have, and a great many people who have blocked UUNet space from sending them email, either by using SPEWS, the SBL, or mci.blackholes.us .
Do these people know how much legitimate email they're missing, for every spam message that's blocked? I noticed that from my personal mailbox (which I do filter with spam assassin), for every one legit mail that gets blocked/tagged by SPEWS, there's maybe 1-2 junkmails. Thats not a very impressive ratio...
I think that is a bit irresponsible for the simple reason that MCI has many co-lo clients and any of their machines could be vulnerable, I think also that needs to addressed so that blanket statements are supported by fact and not the need to competitively break a company down in hopes the you can steal away it's customer base.... -Henry --- "Tom (UnitedLayer)" <tom@unitedlayer.com> wrote:
On Fri, 25 Jun 2004, Ben Browning wrote:
At 04:00 PM 6/24/2004, Hannigan, Martin wrote:
[ Operations content: ] Do you know of any ISP's null routing AS701?
ISPs? Not of the top of my head. I know several businesses who have, and a great many people who have blocked UUNet space from sending them email, either by using SPEWS, the SBL, or mci.blackholes.us .
Do these people know how much legitimate email they're missing, for every spam message that's blocked?
I noticed that from my personal mailbox (which I do filter with spam assassin), for every one legit mail that gets blocked/tagged by SPEWS, there's maybe 1-2 junkmails. Thats not a very impressive ratio...
At 9:43 am -0700 (GMT) 25/6/04, Ben Browning wrote:
At 04:00 PM 6/24/2004, Hannigan, Martin wrote:
[ Operations content: ] Do you know of any ISP's null routing AS701?
ISPs? Not of the top of my head. I know several businesses who have, and a great many people who have blocked UUNet space from sending them email, either by using SPEWS, the SBL, or mci.blackholes.us .
I seldom post here because the couple of times I have followed-up to correct wrong statements in nanog regarding Spamhaus, such as the above, I have each time been told by nanog's admin that I will be removed from the nanog list if I respond to any question in nanog regarding Spamhaus again. But, here goes: The statement by Ben Browning: "I know several businesses who have, and a great many people who have blocked UUNet space from sending them email ... by using ... the SBL" is false, the SBL has never blocked UUNet/MCI IP space that wasn't directly in the control of spammers. If Mr Browning does indeed know "several businesses and a great many people" whose UUNet/MCI IP space has been blocked by the SBL, then Mr Browning knows several spam outfits and a great many spammers. -- Steve Linford The Spamhaus Project http://www.spamhaus.org
Steve Linford wrote:
I seldom post here because the couple of times I have followed-up to correct wrong statements in nanog regarding Spamhaus, such as the above, I have each time been told by nanog's admin that I will be removed from the nanog list if I respond to any question in nanog regarding Spamhaus again. But, here goes:
Why would you be removed from the list for posting corrections about Spamhaus? Can the list admin or other responsible person please explain the reasoning? It only seems fair that if someone is misrepresented by a posting on this list, they should be free to correct such misinformation. Jon Kibler -- Jon R. Kibler Chief Technical Officer A.S.E.T., Inc. Charleston, SC USA (843) 849-8214 ================================================== Filtered by: TRUSTEM.COM's Email Filtering Service http://www.trustem.com/ No Spam. No Viruses. Just Good Clean Email.
On Sat, 26 Jun 2004, Jon R. Kibler wrote:
I seldom post here because the couple of times I have followed-up to correct wrong statements in nanog regarding Spamhaus, such as the above, I have each time been told by nanog's admin that I will be removed from the nanog list if I respond to any question in nanog regarding Spamhaus again. But, here goes:
Why would you be removed from the list for posting corrections about Spamhaus?
I looked back through the archives, and I did see one post which was fairly inflammatory, but I wasn't really that excited to read everything.... The big deal is that spam complaining/etc is not operational content, and there are several other lists to handle that sort of thing.
On Sat, 26 Jun 2004 10:50:12 -0700 (PDT) "Tom (UnitedLayer)" <tom@unitedlayer.com> wrote:
The big deal is that spam complaining/etc is not operational content, and there are several other lists to handle that sort of thing.
but then, individuals get 1 free shot at saying things that are in some cases not true about spamhaus, and Steve is prohibited from attempting to correct them. hardly seems fair, richard -- Richard Welty rwelty@averillpark.net Averill Park Networking 518-573-7592 Java, PHP, PostgreSQL, Unix, Linux, IP Network Engineering, Security
On Sat, 26 Jun 2004, Richard Welty wrote:
On Sat, 26 Jun 2004 10:50:12 -0700 (PDT) "Tom (UnitedLayer)" <tom@unitedlayer.com> wrote:
The big deal is that spam complaining/etc is not operational content, and there are several other lists to handle that sort of thing.
but then, individuals get 1 free shot at saying things that are in some cases not true about spamhaus, and Steve is prohibited from attempting to correct them.
Steve can correct whomever he wants off list. If he wants to do it on list, it better be for a good reason, no? If the person posting the untrue information is not posting with operational content, they should be censured as well... A simple "these statements are untrue, please contact me off list for the truth" is hardly unreasonable.
: : A simple "these statements are untrue, please contact me off list for the : truth" is hardly unreasonable. : : : Unfortunately a restriction such as that on this list defeats the atmosphere of openness and education for those who may be reading, but not necessarily posting to the list. Educating users, even if some of the subscribers are the choir should be our collective goal. In my case not all the conversations (threads) on this list are pertinent to my operations but I still read them all, and am educated from time to time as well, which makes it worth the effort. IMHO. What I don't like to read are personal attacks or arrogance to the extreme. Doug
Steve Linford wrote:
The statement by Ben Browning: "I know several businesses who have, and a great many people who have blocked UUNet space from sending them email ... by using ... the SBL" is false, the SBL has never blocked UUNet/MCI IP space that wasn't directly in the control of spammers. If Mr Browning does indeed know "several businesses and a great many people" whose UUNet/MCI IP space has been blocked by the SBL, then Mr Browning knows several spam outfits and a great many spammers.
Let me rephrase: I know several businesses and a great many people who block *parts* of UUNet by the SBL and *larger* parts of it by means of SPEWS, blackholes.us, et al. Regardless, the SBL does block *some* UUNet space, much of which(according to responses here) no longer belongs to the spammers. Sorry for any confusion my poor choice of words may have caused. -- Ben Browning <benb@theriver.com> The River Internet Access Co. WA Operations Manager 1-877-88-RIVER http://www.theriver.com
From Ben Browning, received 29/6/04, 9:56 am -0700 (GMT):
Steve Linford wrote:
The statement by Ben Browning: "I know several businesses who have, and a great many people who have blocked UUNet space from sending them email ... by using ... the SBL" is false, the SBL has never blocked UUNet/MCI IP space that wasn't directly in the control of spammers. If Mr Browning does indeed know "several businesses and a great many people" whose UUNet/MCI IP space has been blocked by the SBL, then Mr Browning knows several spam outfits and a great many spammers.
Let me rephrase: I know several businesses and a great many people who block *parts* of UUNet by the SBL and *larger* parts of it by means of SPEWS, blackholes.us, et al.
I obviously read more into it than you meant, sorry (I though you were implying we were blocking MCI IPs above and in addition to IPs belonging to spammers, something we try hard not to do).
Regardless, the SBL does block *some* UUNet space, much of which(according to responses here) no longer belongs to the spammers.
That's correct. At a guess I'd say possibly even 20% of our MCI listings are stale, and we don't know which ones. Without illegally scanning the MCI IPs to see what's running there we have very little way of knowing which spammers are departed or not, because MCI/UUNet Abuse will not tell us. Unlike listings of normal providers which tend to manage themselves, MCI SBL listings continue to grow in number and are removed either because they've reached their time-out setting or because someone higher up yells and the Abuse guys get their fingers out. We see things start to happen when Christopher Morrow gets involved, but they soon revert if he's not chasing them. Vint Cerf is now aware of the situation so perhaps more might begin to move and we may soon see those MCI listings drop down, and maybe a refresh of MCI's AUP enforcement. Thanks for voicing your opinion with MCI. -- Steve Linford The Spamhaus Project http://www.spamhaus.org
participants (7)
-
Ben Browning -
Doug White -
Henry Linneweh -
Jon R. Kibler -
Richard Welty -
Steve Linford -
Tom (UnitedLayer)