Subject: Re: Argh. the spam.. make it stop...

From: Vernon Schryver <[email-masked]>
Date: Thu, 1 Apr 1999 09:33:02 -0700 (MST)

> From: Keith Moore <[email-masked]>

> ...
> rate limiting or quotas on our incoming mail.
>
> > Do you have any relays that you have not closed either trivially, 
> > SMTP AUTH, or otherwise?
>
> yes.  we have disabled relaying on all of our client hosts but we 
> cannot do so on all of our servers.  we have our users to think 
> about.  SMTP AUTH will be a good solution when it arrives, but it 
> is not yet supported by our users' mail clients.

Why have I not seen any recently relayed spam from utk.edu?  I assume your
systems are not in the ORBS database.  Do you do as some big ISP's do,
relay but severely rate-limited?  Or use other mechanisms we both can
think of but probably should not talk about in public?  In my book, that
counts as "closed [either] trivially, [by] SMTP AUTH, or otherwise"

> ...
> the problem is the assumption that this "fix" works for all servers.

Whose assumption?
Rate limiting to 10 messages/day/IP address would effectly close a relay,
not hurt any mobile users, be easy and only barely harder than "trivial,"
esp. given the new database stuff in sendmail.cf.  Then there's POP-first.
And of course telnet-and-then-run-/usr/bin/mail.  And SSH.   Etc.

> > ISP's resisted closing many relays on grounds it would
> > hurt mobile users, but often dishonestly because their real motives ranged
> > from laziness to a lack of enthusiasm for breaking working systems they

> You're glossing over some other problems which aren't easy to solve.  
> ISPs don't always own their PoPs, and the set of addresses assigned
> to PoPs accessible to a large ISP's customers can change so frequently 
> that keeping track of which PoPs are valid and which are not is a 
> major pain.  It's also fair to mention that those mobile users trying 
> to relay through an ISP's SMTP from a PoP not owned by that ISP are 
> often *customers* of the ISP who owns the SMTP server, who rightfully 
> complain when the ISP denies them the ability to relay their mail.

On the contrary, POP-before-SMTP or draconian rate limiting are easy if
not quite trivial fixes for the tiny number of hosts that cannot be
"trivially" completely closed.  They can be challenging for people whose
programing experience is a few lines of PERL, but if you're a C hack, it's
quick and easy to add code to sendmail and/or your POP server.  ISP's or
other outfits that can't be bothered to hire the talent necessary to run
their busineses right get no sympathy from me.

Most ISP's have always been run with a "convenient" attitude to doing
what's right.  I recently collected money from an ISP for a junk FAX using
Small Claims Court and Title 47, Section 227.  The ISP told me sob stories
about how much email spam has hurt them by crashing their systems and how
anti-email-spam they are.  Without pausing, they blathered the familiar
spammer excuses for their junk FAX, including "we get lots of junk FAX so
everyone is doing it", "just throw it away", "you've spent more time on
this than it's worth", and "we didn't know it was illegal (but we omitted
our address and phone number to minimize complaints)."

> > As I said before, I suspect some of the reasons for port 25 filtering 
> > have nothing to do with spam, but with other business reasons for 
> > "encouraging" an ISP's customers to use its servers.
>
> IMHO, an ISP that does that should not claim to be supporting "I" service.

If you're fixing dishonest or silly claims about the InfoSuperHypeWay,
you have plenty of work.  Last night I saw a TV ad for AOL in which an
actor said "AOL is the internet."

Vernon Schryver    [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Thu, 01 Apr 1999 13:13:33 -0500

> Why have I not seen any recently relayed spam from utk.edu?  

I can't answer that.

> I assume your systems are not in the ORBS database.  

we have been blacklisted by some folks.  I don't keep track of which ones.

> Do you do as some big ISP's do,

no.  at least, not yet.  we're working on fixes, but they're not trivial.

> And of course telnet-and-then-run-/usr/bin/mail.  And SSH.   Etc.

now (and for the rest of your message) you're just foaming at the mouth.   
I'm not going to bother to respond further.

Keith

---

From: Keith Moore <[email-masked]>
Date: Thu, 01 Apr 1999 13:13:33 -0500

I can't answer that.

Keith