Live data from Hacker News

Spam blacklisting is out of control

blog.roastidio.us

381–390 of 430 posts

Re: Spam blacklisting is out of control

#381

Earlier quoted context omitted.

That seems a lot of rationalisation for a situation where a genuine sender on another system sends legitimate mail to a genuine recipient on your system, that mail is not properly delivered, and it's your fault. There is a reason that collective punishment is considered immoral by civilised cultures. It hurts the innocent and often fails to achieve its original goal anyway.

> That seems a lot of rationalisation for a situation where a genuine sender on another system sends legitimate mail to a genuine recipient on your system, that mail is not properly delivered, and it's your fault. It's how the internet stays functional. If 0.001% of legitimate mail has to go undelivered in order to prevent overwhelming amounts of spam/attacks from an irresponsible network that's an acceptable loss to…

It's how the internet stays functional.

[citation needed]

If 0.001% of legitimate mail has to go undelivered in order to prevent overwhelming amounts of spam/attacks from an irresponsible network that's an acceptable loss to most people in our civilized culture.

1. It's way more than 0.001%. Like, several orders of magnitude more.

2. What overwhelming amounts of spam/attacks? Those of us using traditional mail systems with traditional spam filtering seem to be doing OK not getting overwhelmed by incoming spam without the kind of "help" you advocate.

3. You don't get to decide what's acceptable to everyone else. Except that apparently you've decided you do, which is why regulation is needed to remove that ability from service providers who can't do their jobs properly and hurt others as a result.

If you want reliable service, choose a responsible ISP.

This is a poor argument. Any ISP that accepts significant numbers of customers will occasionally have a customer who is either malicious or operating with imperfect security allowing someone else who is malicious to exploit them. The decent ones will identify the problem and block it reasonably quickly, but there is plenty of evidence that they can still be blacklisted and it can still be difficult or impossible to get removed from those blacklists again after the problem is fixed.

The kind of policy you advocate punishes small ISPs just for being ISPs. I invite you to apply the same policy fairly and neutrally to larger organisations such as the major mail forwarding services and cloud hosts as well and see how long you survive in this industry.

Or maybe the rest of us should apply the same policy to organisations that do what you advocate. If they won't deliver mail reliably, we won't forward any mail to them at all, so their mail service becomes useless. Except of course it's some of the biggest mail services that do this, so just like no-one's going to block incoming mail from AWS or MailChimp, no-one's going to block outgoing mail to Google or Microsoft.

If you have a better solution for spam, the whole world would love to hear it.

Block actual spam sources and provide a reasonable method for removing blocks that are no longer necessary. Don't carpet bomb whole chunks of the Internet just because there are a few bad actors around. Don't fire and forget. It's really not difficult and plenty of small organisations operate just fine on this basis every day.

Re: Spam blacklisting is out of control

#382

Earlier quoted context omitted.

Spam has largely been a solved problem for decades IME. You don't need some big-data-crunching mega-mail-host to block it successfully. For my personal mail, I use a small provider that isn't configured to block anything automatically and the built-in tools in my mail software. For my businesses, we have a pretty standard SpamAssassin-style setup. Either way, I see hardly any spam in my inbox despite receiving mail t…

You must be living in a different world than me. I regularly get spam even from large corporations, that I know I never signed up for anything for. I know it is actually them, because it's DKIM signed with their domain certificates. Walmart (which doesn't exist in my country), Unilever and tons or their brands. Even a national division of Microsoft got hands on my email and decided to sign me up for invites to develo…

Apparently we do live in different worlds. May I ask what sort of email infrastructure you use? I don't think anything I use, either personally or professionally, is particularly complicated or unusual but apparently our recent experiences have been very different.

Probably 95% of the spam I receive is automatically filtered to a spam folder, with a negligible false positive rate. Every now and then some new pattern does make it through but once I've flagged a few instances the rest start getting classified as spam automatically.

Re: Spam blacklisting is out of control

#383

Earlier quoted context omitted.

The inability to generate IP reputation smaller than a /24 is inherent to the way internet routing works. Nothing smaller than a /24 can be publicly assigned or advertised to prevent the route table from becoming too bloated. On IPv6 the smallest advertise able block is a /48 for the same reason. Privately managed assignments in shared or further split subnets aren't publicly visible, verifiable, or accountable to an…

> The inability to generate IP reputation smaller than a /24 is inherent to the way internet routing works. Nonsense. SMTP is not internet routing, and there is no reason at all why some "reputation" system should be constrained by the same /24 limit that the global routing table ended up with. I find it telling that these "reputation" outfits tend to serve up this sort of poor excuse to justify their businesses; whe…

I think you're thinking domain based email reputation lists but commenting on the IP reputation conversation while also conflating what Abusix is doing in this comment chain with what UCEPROTECT is doing in the post and forming a conclusion from hand picked pieces of the conglomerate. For the Abusix portion related to this thread check out their response here as it goes into much better detail with what I originally described https://news.ycombinator.com/item?id=30227886 (note: I'm unaffiliated, I work for a generic network VAR and we don't even sell their service for email).

These domain based lists are also a thing but you need to have a pretty sizable volume to become trusted in those lists as anyone can register a domain in seconds, none of the above will have gained trust on them.

The whitelist payment option for arbitrary hosts (which Abusix doesn't offer) is a workaround to create a publicly registered identity with some stake to tie the reputation to. I mean it can be other things to, scammy rackets exist too, but you can't just claim it's a poor excuse without offering a better answer that solves the same problem.

Speaking of spammers are the ones that created the problem because people started using individual network block lists before companies started aggregating and mediating them. You're welcome to make your own community replacement solution but the problem is the replacement has to be reliable enough other mail administrators want to use it not just nice for the occasional legitimate guy that wants to run email out of his house and be trusted by default. Also it's a lot of work to mediate.

Re: Spam blacklisting is out of control

#384
post #229

Earlier quoted context omitted.

You have this all backward. > You actually think that the best answer to a network engineering problem is to make legal threats at third party ISPs? It's not a "network engineering problem" if administrators and managers are the ones making the decisions to provide no reasonable recourse for a ban, on top of actively ignoring or denying legitimate requests for removal. If the third party hasn't broken any rules, then…

> all because you refused to acknowledge a removal request But the receiving MSP can't acknowledge the removal request, in the scenario reported by the author. They are not the ones operating the blocklist. That's UCEPROTECT, not Comcast or whoever.

You have this backward, as well, because that's not how any of this works. The UCEPROTECT list is a literal text file that gets ingested by the mail provider. The provider is under zero obligation to use the entirety of the list and, in fact, is still 100% responsible for maintaining their own list in a way that complies with international laws, ICANN rules, service agreements, etc. UCEPROTECT even offers a very blatant disclaimer on their site.

> USING OUR BLACKLISTS, YOU ARE AT YOUR OWN RISK. WE WILL NOT BE HELD RESPONSIBLE FOR ANY DAMAGE OR PROFIT OR LOSSES. SHOULD THIS BE UNACCEPTABLE TO YOU, YOU ARE NOT ALLOWED TO USE OUR BLACKLISTS.

Re: Spam blacklisting is out of control

#385

Spam blocklists are run by an unaccountable cowboy cult that somehow has managed to consolidate a ton of power simply for the fact that most people who run email inbox services didn't want to deal with the problem of spam, so they were more than willing to just hand over anti-spam "enforcement" to anyone who was allegedly doing "what was best for the internet." There's no check on these people who run these blacklist…

Let's not classify all spam blacklists as the same. UCEPROTECT is in a special class of extortionist cowboy, because it's basically just an inaccurate protection racket throwing a wide net across cloud providers who won't play their game. Some other blacklists are updated regularly and only contain IP addresses that have actually sent spam. By contrast, UCEPROTECT3 just lumps ISPs into the list even though an address…

Spamhaus, which (as far as I can tell) is seen as the "most legitimate" blacklist is just as bad, if not worse. UCEPROTECT might be extorting you, but at least you know the name of the game. With Spamhaus, any email sender can get blacklisted for whatever nonsense rules Spamhaus comes up with – many times a set of entrapments they themselves have devised – and they have zero urgency or clarity around resolving it. "Fix the problem" they say. Okay, what's the problem? "Be a better sender." Okay, how? It's like a conversation with Yoda.

To be clear: I DON'T think blacklists are the problem. I think the problem is that a half-dozen major blacklists are controlled by unaccountable organizations who make up rules willy nilly, and privilege major email senders while punishing smaller senders / home hobbyists.

Re: Spam blacklisting is out of control

#386
post #164

Earlier quoted context omitted.

The service is not meant to cater to the lowest common denominator. If you unsubscribe from critical notifications and get screwed over.. that is on you. It is not fair to the rest of us to be inundated with endless spam just so some screwup can be kept from doing something stupid.

Transactional email from a backup service you deliberately signed up to isn’t spam, so congratulations you’ve got what you’re after. Now someone will likely reply shifting the definition of what “spam” is to include Rsync’s critical service emails, and now the term spam is so wide as to be meaningless. At that point it’s on you to manage your own spam filter if you truly feel “your critical backup service is down” is…

I did not solicit emails from that service.

I solicited them to store my data.

Did you solicit every nag and advert Amazon sends you?

That you bought something from someone does not mean your email inbox is now free game.

Re: Spam blacklisting is out of control

#387

Earlier quoted context omitted.

You can always login and re-enable an email on the service. The service is allowed to request information needed to process the unsubscribe. I get emails for some dude's Chevy when it needs servicing. I can't unsubscribe. I am stuck getting emails about a car I have never owned from some dealer in Pittsburg. I need an opt out that lets me communocate "hey, some dumbass fatfingered his email, stop spamming me."

Genuine question: your comment and a bunch of others make me wonder why people seem unable to filter email by sender. That used to be a pretty standard part of having an inbox. Are you using a mail client or service that doesn't have filtering built in? Do you find it difficult to set up a filter rule? Are you unfamiliar with filter rules? Do you use filters but just ideologically object to any unwanted email? I'm ho…

It's a chore, and it is a never ending one. I have several thousand senders blocked. However,

1. Some senders intentionally send ads and actually useful notifications from the same address, making filtering more difficult

2. Better yet, some senders constantly shift their address so they are almost unblockable without going to arbitrary keyword blocking

I would like to live in a world where instead of me doing stupid amounts of work to not get a flood of spam.. people just don't spam.

I am lucky - I can literally throw money and tech at this problem. Most people are not lucky. I would much rather spam be elimited as a whole.

Re: Spam blacklisting is out of control

#388
post #372
post #227

Earlier quoted context omitted.

This actually does cause problems with blocked password resets and things

If I request a password reset, that constitutes an approval to send me that email.

And if I didn't request a password reset ... I'd like to hear about it.

Re: Spam blacklisting is out of control

#389
post #323
post #305

Earlier quoted context omitted.

Well, I think letting people get silently charged monthly without sending them any message about it is a bad idea, even if they say they want it. Similar with not telling them about an outage to their service.

Well, then that mail is going to get legitimately marked as spam when I didn't request it, I have no business relationship with the sender, and there's no other way to make it stop. And the user is still getting silently charged because it's going to my inbox, not theirs. Unsubscribe is the alternative to the spam button. If you don't provide it, you are asking to be marked as spam, no matter how important you think…

If you have no business relationship with the sender, this is fixed by not sending email to unconfirmed addresses, as we discussed above.

Re: Spam blacklisting is out of control

#390
post #372
post #227

Earlier quoted context omitted.

This actually does cause problems with blocked password resets and things

If I request a password reset, that constitutes an approval to send me that email.

how do you know it's 'you' that requested it? if I requested a password reset to your email... is it spam?
Post reply on HN