Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gmail blacklisted by Spamhaus

blog.sucuri.net

Post reply on HN
Print view View original

11–20 of 61 posts

Re: Gmail blacklisted by Spamhaus

#11

Post by sweis »

jmathai wrote: post #4

I work at Yahoo! and we've been blacklisted as well by Spamhaus. I wouldn't say it's entirely inappropriate because of the sheer volume of email that can pass through our (or in this case Gmail's) system. Personally, I've tried to reach out to Google regarding security issues on blogspot which were affecting our property. There was an XSS vulnerability and we were getting thousands of posts on our blog linking to blo…

I'll follow up on this XSS. I sent emails to your personal address and HN username @yahoo-inc asking for some details.

Re: Gmail blacklisted by Spamhaus

#12

Post by moultano »

jmathai wrote: post #4

I work at Yahoo! and we've been blacklisted as well by Spamhaus. I wouldn't say it's entirely inappropriate because of the sheer volume of email that can pass through our (or in this case Gmail's) system. Personally, I've tried to reach out to Google regarding security issues on blogspot which were affecting our property. There was an XSS vulnerability and we were getting thousands of posts on our blog linking to blo…

Blogspot allows arbitrary javascript I believe, including redirects. I don't think that's a vulnerability. It's just run of the mill spam.

Re: Gmail blacklisted by Spamhaus

#13

Post by whatwhatwhat »

ck2 wrote: post #7
jmathai wrote: post #4

I work at Yahoo! and we've been blacklisted as well by Spamhaus. I wouldn't say it's entirely inappropriate because of the sheer volume of email that can pass through our (or in this case Gmail's) system. Personally, I've tried to reach out to Google regarding security issues on blogspot which were affecting our property. There was an XSS vulnerability and we were getting thousands of posts on our blog linking to blo…

In this case Spamhaus accidentally blocked gmail because they used the entire ip block of the original email's images. it seems that spammers were using docs.google.com to post some documents, which are stored in the same /24 as gmail. Spamhaus decided to blacklist the whole subnet.

things like this http://docs.google.com/document/edit?id=1sNOzHa2orgpK5BIp4eE...

Re: Gmail blacklisted by Spamhaus

#14

Post by furyg3 »

Spamhaus is the most rabid group of extreme anti-spammer teenagers out there (or at least they act like teenagers).

I've had various SMTP servers (for various companies) blocked by them, usually for very questionable reasons. You used to have to argue with them on their forum (and take a beating from all of the kids on that site) before they'd remove you.

The result is that SMTP admins get it from both sides: Spammers make your life hard, rabid blackhole lists combatting spammers make your life even harder.

Re: Gmail blacklisted by Spamhaus

#15

Post by jmathai »

sweis wrote: post #11
jmathai wrote: post #4

I work at Yahoo! and we've been blacklisted as well by Spamhaus. I wouldn't say it's entirely inappropriate because of the sheer volume of email that can pass through our (or in this case Gmail's) system. Personally, I've tried to reach out to Google regarding security issues on blogspot which were affecting our property. There was an XSS vulnerability and we were getting thousands of posts on our blog linking to blo…

I'll follow up on this XSS. I sent emails to your personal address and HN username @yahoo-inc asking for some details.

Got your email and replied. Thanks.

Re: Gmail blacklisted by Spamhaus

#17

Post by dingdingding »

tptacek wrote: post #5
jmathai wrote: post #4

I work at Yahoo! and we've been blacklisted as well by Spamhaus. I wouldn't say it's entirely inappropriate because of the sheer volume of email that can pass through our (or in this case Gmail's) system. Personally, I've tried to reach out to Google regarding security issues on blogspot which were affecting our property. There was an XSS vulnerability and we were getting thousands of posts on our blog linking to blo…

If you blacklist the mechanism by which tens of percentage points worth of Internet users send mail, you are not part of the solution to spam.

I know the google fanboys will hate this, but the problem is letting just anyone or just any machine create an account and use your service. It's google's responsibility to can the spam coming from their domain. Google doesn't care though. If they make it harder to get a gmail account, then they make it harder to spam their "legitimate" users with advertisements and why would they want to do that?

If you are a company that provides spamming capabilities to anyone and everyone, then it is exactly valid to add them to a spam list.

You could say, "Plenty of legitimate users use gmail." Fine, maybe so, but if you are someone who uses gmail, you are surrounded by a cadre of spammers and should understand your credibility is instantly devalued.

Birds of a feather flock together. The solution is to stop using gmail.com.

A VERY VERY high percentage of spam in my inbox comes from gmail accounts. If tens of percentages points of spam is sent from a domain, then it's valid to add them to the list of spamming domains.

Re: Gmail blacklisted by Spamhaus

#19

Post by jmathai »

moultano wrote: post #12
jmathai wrote: post #4

I work at Yahoo! and we've been blacklisted as well by Spamhaus. I wouldn't say it's entirely inappropriate because of the sheer volume of email that can pass through our (or in this case Gmail's) system. Personally, I've tried to reach out to Google regarding security issues on blogspot which were affecting our property. There was an XSS vulnerability and we were getting thousands of posts on our blog linking to blo…

Blogspot allows arbitrary javascript I believe, including redirects. I don't think that's a vulnerability. It's just run of the mill spam.

I guess that depends on definition. At yahoo the ability to use a product for spam is a vulnerability. If a spammer can email a link to yahoo.com/something/random which redirects them to mypharamasite.com then it's a vulnerability because the site allowing the redirects helps trick the end user into buying vicodin :).

I can't imagine why javascript redirects add much value in a blog post. But everyone picks a different spot between features and security - and that's okay by me.

Post reply on HN