spamcop abusing mail systems worldwide

Post by Dan The Man
Today I had an unhappy unix student try to submit an assignment to me and
could not. Spamcop has decided to go off blacklisting all yahoo/shaw etc
servers worldwide.
remove: reject_rbl_client bl.spamcop.net
from your smtpd_recipient_restrictions line until they fix their abuse
issues.

Spammers ARE blacklisted, even they are called "yahoo". Just have good
ISP with good reputation. My servers have never been blacklisted because
I just keep spammers away from them in early stage.

Tonu

Dan The Man

2011-11-17 14:08:13 UTC

I agree completely, but I don't think a student failing a course because
he only has a yahoo/shaw etc address and got a legitimate email bounced
would agree very much :)

I think my solution should stand, we got all the other rbl's,
and spamassassin etc, there really no need to have anything legitimate
dropped till they fix their issues.

Dan.

--
Dan The Man
CTO/ Senior System Administrator
Websites, Domains and Everything else
http://www.SunSaturn.com

John Peach

2011-11-17 14:12:23 UTC

On Thu, 17 Nov 2011 08:08:13 -0600 (CST)

Post by Dan The Man
I agree completely, but I don't think a student failing a course
because he only has a yahoo/shaw etc address and got a legitimate
email bounced would agree very much :)
I think my solution should stand, we got all the other rbl's,
and spamassassin etc, there really no need to have anything
legitimate dropped till they fix their issues.

Spamcop recommend you use it for scoring, not blocking....

[snip]

Stan Hoeppner

2011-11-17 14:26:13 UTC

Post by John Peach
On Thu, 17 Nov 2011 08:08:13 -0600 (CST)

Spamcop recommend you use it for scoring, not blocking....

And a default Spamassassin config includes Spamcop for scoring:

http://wiki.apache.org/spamassassin/DnsBlocklists:

Having "reject_rbl_client bl.spamcop.net" on top of scoring with it in
SA caused this problem. It's not Spamcop's fault the student's email
was rejected. I dare say it was the mail OP's fault for not having his
server configured properly.

--
Stan

Dennis Clarke

2011-11-17 14:39:41 UTC

Today I had an unhappy unix student try to submit an assignment ..

tell your students to use the email address provided by the school on the
school domain. Also, as a policy, I blacklist all yahoo, gmail, hotmail
junk and life is much better at the office.

If someone does not have a valid email address at a reasonable domain then
we don't want to hear from them anyways.

Dennis

Reindl Harald

2011-11-17 14:39:33 UTC

Spammers ARE blacklisted, even they are called "yahoo". Just have good
ISP with good reputation. My servers have never been blacklisted because
I just keep spammers away from them in early stage.

this is a lets say polite: "not real smart argumentation"

if you are blocking major-providers like yahoo, google.... you can go ahead
and turn your mailserver off and close your company because NO CLIENT will
accept this with no argument and to say it clear: if someone thinks it is
cool to block major-isp's for whatever reason maybe he is doing the wrong job

why?

because a mailserver is primary there do get and send e-mails and not to
block them!

Reindl Harald

2011-11-17 14:48:42 UTC

Today I had an unhappy unix student try to submit an assignment ..

tell your students to use the email address provided by the school on the
school domain. Also, as a policy, I blacklist all yahoo, gmail, hotmail
junk and life is much better at the office.
If someone does not have a valid email address at a reasonable domain then
we don't want to hear from them anyways.

never heard a more arrogant statement with so few knowledge!

did you ever realize that you can host your domain at google?
so you are possibly blocking valid addresses from reasonable
domains to - but that is only an additional point

where do you live that you think you are in the position what
other people are using and that they have to register a domain
before they allowed to speak with you?

Simon Brereton

2011-11-17 14:49:43 UTC

Post by Dan The Man
Today I had an unhappy unix student try to submit an assignment to me and
could not. Spamcop has decided to go off blacklisting all yahoo/shaw etc
servers worldwide.

The subject is wrong. Spamcop simply list mailservers sending a lot of spam
and Yahoo for example does exactly that. It is the duty of the mailserver
operator to decide if such a list should be used for blocking senders.

I agree. In all likelyhood, Spamcop listed the SHAW IP which is where
the email originates from and not the Yahoo IP. Perhaps the student
will take this as a lesson to choose a better ISP.

Post by Dan The Man
remove: reject_rbl_client bl.spamcop.net
from your smtpd_recipient_restrictions line until they fix their abuse
issues.

It's not *their* issue. They list servers/IPs that send a significant
amount of spam. I would suggest the people with the issue are the IP
owners. Not spamcop.

But as others have said, you're not obliged to use it. So please don't.

Simon

Mark Goodge

2011-11-17 15:00:33 UTC

Today I had an unhappy unix student try to submit an assignment ..

tell your students to use the email address provided by the school on the
school domain. Also, as a policy, I blacklist all yahoo, gmail, hotmail
junk and life is much better at the office.
If someone does not have a valid email address at a reasonable domain then
we don't want to hear from them anyways.

Yes, but you're not selling anything or providing any kind of public
service. So it doesn't matter if people can't email you. Those of us who
work for commercial organisations or government bodies don't have that
choice.

Mark

--
Sent from my Babbage Difference Engine
http://mark.goodge.co.uk
http://www.ratemysupermarket.com

Tõnu Samuel

2011-11-17 15:05:29 UTC

Post by Reindl Harald
never heard a more arrogant statement with so few knowledge!

I somewhat understand his position. What is ham and what is spam often
depends also some cultural background. For example I have anything with
"From: aol.com" blocked because in my 15 years of internet usage I
cannot remind anything useful coming from that domain. Maybe it
situation is different in USA but in EU I just block it for years
without single false positive yet.

I host hundreds of client domains and most of then really do not want to
receive stuff from India, Tunisia, Russia, Indonesia, Vietnam, China and
some other very common spam sources. I seriously consider source IP
blocks by country for some mail servers.

BTW, I do have friends and coworkers who are Chinese, Vietnamese etc. so
I do care about making stuff right.

Tõnu

Jose Ildefonso Camargo Tolosa

2011-11-17 15:11:54 UTC

Greetings,

Today I had an unhappy unix student try to submit an assignment ..

tell your students to use the email address provided by the school on the
school domain. Also, as a policy, I blacklist all yahoo, gmail, hotmail
junk and life is much better at the office.

Not all schools provides email addresses to their students, and some
students will just decide not to use them... why?, well, because,
after all, these are temporary address, for as long as you are at the
school, you can't keep those for the rest of your life, and thus some
students decide not to use them.

Post by Dennis Clarke
If someone does not have a valid email address at a reasonable domain then
we don't want to hear from them anyways.

Same here, that's exactly why I don't use a "hard" block policy, I use
scoring (with ASSP) and even use Bayes filters (yeah, those that
requires "training" and stuff), thanks to this combination I get rid
of ~95% of the spam, while keeping over 99% of good mail (I almost
never lose a legit mail because of the mail filter).

yahoo, hotmail, gmail are domains used by all kind of persons (I have
even seen customers that just uses ***@gmail.com as their
corporate mail!!), so: just blocking them because a few send spam is
non-sense.... you need to check message content, that's why I use
Bayes as part of the scoring.

Now, spam fight is everyday harder, because spammers are looking
everyday more like legitimate senders... as a matter of fact,
sometimes what I consider spam is not considered spam by other person,
so... this is actually a complex topic.

Ildefonso.

Tõnu Samuel

2011-11-17 15:11:19 UTC

Post by Dan The Man
I agree completely, but I don't think a student failing a course because
he only has a yahoo/shaw etc address and got a legitimate email bounced
would agree very much :)
I think my solution should stand, we got all the other rbl's,
and spamassassin etc, there really no need to have anything legitimate
dropped till they fix their issues.

Spam filters work in big part because they cause trouble for spammers.
This also includes spammers who do not think they are spammers or just
stupid enough to accommodate all kind of bots, viruses etc. For example
somehow Gmail managed to include me in some arabic religios mailing
list. There is no way I can find someone in Google to look on my weird
problem. I just report every single mail from this list to SpamCop. I do
this for months and like in every big company nobody cares. Just at some
point when Gmail gets blocked we get similar discussion here in list and
only then maybe someone in Google starts to read abuse@ mailbox. Big
companies ARE ignorant unless they get real trouble where also
executives feel that.

Tõnu

Tõnu Samuel

2011-11-17 15:20:34 UTC

Post by TÃµnu Samuel
Spammers ARE blacklisted, even they are called "yahoo". Just have good
ISP with good reputation. My servers have never been blacklisted because
I just keep spammers away from them in early stage.

this is a lets say polite: "not real smart argumentation"
if you are blocking major-providers like yahoo, google.... you can go ahead
and turn your mailserver off and close your company because NO CLIENT will
accept this with no argument and to say it clear: if someone thinks it is
cool to block major-isp's for whatever reason maybe he is doing the wrong job

I report about 500 mails daily to spamcop and this takes important part
of my time. Sorry for being unpolite towards spammers but I believe that
noone should be whitelisted because they are big and fat. They consume
resources of ours. They are parasites.

I know lot about inside stuff. One example I can talk: You might heard
about case in Estonia where Russian criminals made botnet to distribute
spam. Company behind it got first place as IT company in Estonia based
on turnover. They were also important customer of our telecom and other
ISP-s. Yes ISPs got lot of compaints for spamming and virus distribution
from their hosts. But because company paid lot of money they kept these
criminals hosted longer time. This ended only after big blocklists put
permanent ban on /16 size range. As much I know now when years are
passed those block are still in list. This is only thing what works.
Unsure what exactly happened this time but next time Yahoo takes more
care about looking what is sent via their system. Maybe next time they
implement system which limits sending 10 mails in second via webmail or
something else. Anyway complaints are what make them move.

Tõnu

Reindl Harald

2011-11-17 15:30:12 UTC

this is a lets say polite: "not real smart argumentation"
if you are blocking major-providers like yahoo, google.... you can go ahead
and turn your mailserver off and close your company because NO CLIENT will
accept this with no argument and to say it clear: if someone thinks it is
cool to block major-isp's for whatever reason maybe he is doing the wrong job

if you really report 500 mails each day you should give over your
job to someone with more qualifications because we are hosting some
thousand mail-addresses and i could never report 500 spam-mails per
day because they are not received without blocking major providers

http://www.barracudanetworks.com/

a) intention-filtering, hourly updated rules
b) blacklist
c) block by PTR to get rid of 99% of all spambots

your primary job as admin is to make sure that legal mails are received and
not to play around the whole day to maximize false-positives, long after
that comes the fight against spam

10 spam mails are less damage than a single false-positive

Tõnu Samuel

2011-11-17 15:36:14 UTC

Post by Reindl Harald
if you really report 500 mails each day you should give over your
job to someone with more qualifications because we are hosting some
thousand mail-addresses and i could never report 500 spam-mails per
day because they are not received without blocking major providers
http://www.barracudanetworks.com/
a) intention-filtering, hourly updated rules
b) blacklist
c) block by PTR to get rid of 99% of all spambots

About qualifications - you may put your CV next to
http://www.linkedin.com/in/tonusamuel or shut up.

About 500 reports - I run spamtraps mainly in .ee domains to keep my eye
on local spammers and to keep blog http://no.spam.ee which is pretty
good measure I would say.

About barracuda - they remotely disabled it for my customer. I would
never recommend products with such backdoors. More info
http://seclists.org/fulldisclosure/2011/Apr/460

Tõnu

Reindl Harald

2011-11-17 16:07:35 UTC

About qualifications - you may put your CV next to
http://www.linkedin.com/in/tonusamuel or shut up.

you are not in the position to tell somebody to shut up after
making recommendations which are unacceptable if you are
working in business and some nice lines on a social network
like "CEO here and there" are really not saying anything
about qualifications

Post by TÃµnu Samuel
About 500 reports - I run spamtraps mainly in .ee domains to keep my eye
on local spammers and to keep blog http://no.spam.ee which is pretty
good measure I would say.

nice, but does nothing change in the fact that if you are really
the whole day watching for spam-attemnts you are doing something
badly wrong

Post by TÃµnu Samuel
About barracuda - they remotely disabled it for my customer. I would
never recommend products with such backdoors. More info
http://seclists.org/fulldisclosure/2011/Apr/460

well, something went wrong, shit happens

the spamfirewall is useless without subscription because you would end
in that what you are doing now, using the spam-firewall since 6 years
and had not a single problem and if you are renewing in time such
things simply does not happen

Jose Ildefonso Camargo Tolosa

2011-11-17 16:28:45 UTC

Posting to list, sorry!

this is a lets say polite: "not real smart argumentation"
if you are blocking major-providers like yahoo, google.... you can go ahead
and turn your mailserver off and close your company because NO CLIENT will
accept this with no argument and to say it clear: if someone thinks it is
cool to block major-isp's for whatever reason maybe he is doing the wrong job

Neat, but expensive, and in my experience with Barracuda it has a high
false-positive rate (ie, tends to block legit mail).... that's one of
the reasons I tolerate ASSP (it has some quirks, but it rocks as an
spam filter).

/dev/rob0

2011-11-17 16:37:48 UTC

Enough of this thread. Really.

Spamcop is risky if used for outright rejection. This is not new
information, and as pointed out, Spamcop themselves say so. The
subject line is pure ignorance, "abusing mail systems," absurd.

Reliance on email where you do not control both ends is also risky.

We can all look at what some other site does, and say, "I wouldn't do
that." Maybe to some extent it is useful to share our reasons for
feeling that way, although it's not fully on topic here.

But we do not have the right to judge them: it's their server, their
rules. And getting all angry about what rules they choose is nothing
short of STUPID, as is the defensive reaction over being criticized
for the choices you have made.

Take it off list.

--
Offlist mail to this address is discarded unless
"/dev/rob0" or "not-spam" is in Subject: header

Jerry

2011-11-17 16:53:34 UTC

On Thu, 17 Nov 2011 17:19:48 +0100

What is ham and what is spam often depends also some cultural
background.

It does indeed. Having "Dick" as first name in a mostly
English-oriented environment doesn't work in my favor ;-)

I have seen the name "Barbra" flagged also. True story: NY State once
refused to issue a personalized tag; ie license plate to a woman whose
first name was "Barbra". Personally, I have never figured out why the
word "bra" should be considered offensive.

--
Jerry ♔
postfix-***@seibercom.net
_____________________________________________________________________
TO REPORT A PROBLEM see http://www.postfix.org/DEBUG_README.html#mail
TO (UN)SUBSCRIBE see http://www.postfix.org/lists.html

Dennis Clarke

2011-11-17 20:48:05 UTC

Today I had an unhappy unix student try to submit an assignment ..

tell your students to use the email address provided by the school on
the
school domain. Also, as a policy, I blacklist all yahoo, gmail, hotmail
junk and life is much better at the office.
If someone does not have a valid email address at a reasonable domain
then
we don't want to hear from them anyways.

Yes, but you're not selling anything or providing any kind of public
service.

--
--
http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x1D936C72FA35B44B
+-------------------------+-----------------------------------+
| Dennis Clarke | Solaris and Linux and Open Source |
| ***@blastwave.org | Respect for open standards. |
+-------------------------+-----------------------------------+

Jose Ildefonso Camargo Tolosa

2011-11-17 21:17:29 UTC

Ok, I agree with /dev/rob0 , this has gone way off topic for this list.

All of us are free to handle spam as we decide to do it, if Dennis
wants to block @yahoo.* @gmail.com @hotmail.com , that's his decision.
In my case, the amount of spam I receive from these domains is
minimal (and is catch by bayesian and/or IPBL and/or HELO filtering) ,
and thus: I have never considered to block these, also, I have
customers whose address are on these domains, but: that's me, his
history can be very different to mine, maybe he gets hundreds or
thousands of spams from these domains a day!.

Dennis, yes *some* schools provide internal emails, others don't...
sometimes because they can't afford giving the service, or because
they just don't want to! either way, the reality is that you can't
force the world into doing what you want .... the university where I
studied decided to move their mail from an internal server to
gmail!!!, I, of course, let them know that I considered it a bad idea,
but they still decided to do it....

I have seen sites blocking whole countries, because they don't care
about receiving mail from these countries (and they started to get
spam from there)... I'm open to global market, and blocking mail from
any country would not make sense for me, but for other people it is a
part of their spam solution.

Other people want to spend a lot of money on commercial spam
solutions: they are free to do it!, I mean, it is not my money they
are spending, it is theirs! as long as it works: good for them! (there
is also people paying others to maintain their open source-based
anti-spam system, and that's also good).

So, people, lets just agree on something: lets respect what everyone
does, and lets not label anyone for what they decide to do, we can
give our opinion in a respectful way, and let the other person think
about it, then he/she can decide to keep doing what he/she does, or
maybe change the way of doing things.... but lets respect each other,
I think that's important.

Sincerely,

Ildefonso Camargo

Today I had an unhappy unix student try to submit an assignment ..

tell your students to use the email address provided by the school on
the
school domain. Also, as a policy, I blacklist all yahoo, gmail, hotmail
junk and life is much better at the office.
If someone does not have a valid email address at a reasonable domain
then
we don't want to hear from them anyways.

Yes, but you're not selling anything or providing any kind of public
service.

Doing both, quite well and quite a while now. Regardless, I would think
that the school would provide email service, web based interface of some
sort or similar, which would any issues of the delivery of a paper.
As for yahoo, hotmail and other cesspools, I block them, and life and
revenue goes on just fine.
dc
--
--
http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x1D936C72FA35B44B
+-------------------------+-----------------------------------+
| Dennis Clarke | Solaris and Linux and Open Source |
+-------------------------+-----------------------------------+

Tõnu Samuel

2011-11-18 02:41:22 UTC

Post by Jose Ildefonso Camargo Tolosa
Ok, I agree with /dev/rob0 , this has gone way off topic for this list.

I just keep reading all this discussion. Yes this is not postfix topic
but for any kind of decision I am highly interested in reasoning, not
decision. This is why I read this thread with high interest. Also many
of us may have important experience to share. For example at some point
we had massive amount of Chinese spam coming in and I looked for ways to
block it. One thing I tested was blocking on charset GB2312 using
something like "Subject: ???somethingGB2312". This was good attempt I
heard many other people came to same idea but this failed for me. Reason
was that when someone from China wrote in English, even then sometime
such character set was indicated for something like single space. I do
not remember exact details but just want to tell that those charset
identifiers often happen to be in mails which are all latin.

This is why I read thread with big interest. Someone blocking gmail?
Hmm, what is his experience? Not much complaints? hmm..

One more thing I learned from keeping BL for Estonia. I do process spam
and make BL or "list". I do not make rules how others should use the
list. Same about spamcop. They keep list. How one uses this list is
decicion of mailhost. If mailhost decides to trust it (what I do), then
mailhost decicion is to DROP, REJECT, ACCEPT or react somehow different.

Sorry if this thread already went too long and far from postfix but I
just try to argue and listen carefully for arguments.

Tõnu

Robert Schetterer

2011-11-18 07:25:11 UTC