On Tue, Nov 09, 1999, Adam Morrison wrote about "Re: mail problem":
> > described above: it is very often the case that remote mail servers suffer
> > from lapses of inavailability: either because of network connectivity
> > problems, because of shutdowns, and so on. Mailing list administrators are
>...
> > hours in the mail queue waiting to be sent. Anyway, when you send email
> > directly from your dynamic IP, and the remote server does not answer, what
> > do you do? You shouldn't give up, because the server may be temporarily
>..
>
> The solution is to queue the mail and try again the next time you connect.
Really? This is not an acceptable solution to me, and probably not to most
people. I don't want to have to wait until the next time I log in (maybe
only a day later) for the message to be sent!
Of course, if someone deliberately *wants* to do that, then it's his choice,
but at least don't tell me it's a useful thing to do :)
> I'm obviously not suggesting that every end-user send their mail directly from
> their node. But there is no technical reason NOT to do so, and moderately
> sophisticated users -- not to mention non directly connected organizations --
> often choose do it.
>
> The DUL philosophy implies that doing this is in some way wrong, which is
> nonsense.
Organizations should have a permanent and well-known IP, not one listed on DUL,
which is exactly what the DUL phylosophy is: mailers should be accountable,
and not completely anonymous. It means that if you choose to be anonymous,
you're welcome to be on the Internet, but not to send *me* mail, because
someone who sends *me* anonyumous mail is most likely a spammer. It's my
choice to think that way and use DUL, and it may be your choice not to
think that way, and continue to get a dozen spams per day.
As a sidenote, I use DUL,RBL,and ORBS for some time now and keep all
discarded messages for research, and I never had a non-spam message
discarded because of DUL - I.e., nobody ever seems to have sent me a
message from a dailup-line without going through their ISP's SMTP server.
So DUL false-positives are not as bad or as common as you make them sound.
> IPv6 addresses obtained using stateless address autoconfiguration are as
> anonymous as dynamic IPv4 address. Should they be blacklisted as well?
>
> That sort of defeats the purpose for one the IPv6 design goals.
Again, the method you describe means anonymous addresses. I don't know
what were the design goals of IPv6, but even when IPv6 will be used,
I still will not want anonymous email to being sent to me.
> > Blocking direct port-25 traffic is a very interesting anti-spam measure
> > that I haven't seen implemented before, and while it may sound "bad" and
> > anti-freedom, I can't see what harm it can actually do to "normal" users,
> > not spammers.
>
> It does not just ``sound "bad" anti-freedom''; it IS.
>
> ... forcing law-abiding citizens a method of communication
> between themselves is completely contradictory to the freedom of
> speech principle.
>
> Sound familiar? It's an excerpt from message
It's a nice touch using my own words agains me :)
There's an important difference between Netvision and a government: if
you feel Netvision's policies are too restrictive, you're free to use
another ISP who doesn't block port 25. On the other hand, If you feel
Israel's policies are too restrictive then, well, you're out of luck...
This is similar to the following: in a country with free speach, you're
free to create your own newspaper, perhaps even by photocopying it yourself
and delivering it to your subscribers. However, free speach does not
imply that if you want to write something in, say, Yediot Achronot, then
they *have* to let you write it there. They may charge you for it,
place limits on it, or whatever they feel like. If you feel they are
too restrictive, go to Maariv or open your own newspaper as described above.
Of course if the limits are arbitrary and too restrictive, the clients
should protest to the ISP and threaten to leave. If all ISPs form a cartel
and put limits together, then you can go to the Anti-trust commision and
complain. RBL has been threatened by several such suites, but so far
hasn't lost (this might change if it becomes more ubiquitous - we'll
have to wait and see).
> > > will get listed. The ORBS database also lists some hosts which relay
> > > mail only for e.g. the ORBS test machine, and so are NOT really a risk
> > > to the Internet. Sites using the ORBS database implicitly choose not
> >
> > This is not true.
>
> It is true. Have you any evidence that the ORBS testing methodology can
> discern whether a host is relaying just for them, or for the entire world?
>
> > A machine cannot "accidentally" relay mail only for
> > ORBS's test machines, and not to any other machine on the Internet. How
> > can this happen???
>
> Did I say ``accidentally''?
>
> I can configure my machine to relay mail only when that mail is submitted by
> the ORBS testing machine, in order to demonstrate that the ORBS technology is
> broken. My machine will get listed in the ORBS database, although it isn't a
> risk to the rest of the net.
>
> Btw, this has been done, and that machine got listed in the ORBS database.
I'm sorry, but I don't buy your argument at all. Of course someone can
*deliberately* relay only to the ORBS test machine! But why would anybody
do that other then to be "clever" and have a few laughs? This is the same
as having a great restaurant, but when you see a food-critic you recognize,
you deliberately server them crap. You "fooled" the critic, but it's
completely your fault, and it doesn't mean there's anything wrong with the
critic.
It is the opposite method: relaying to everybody *except* to the ORBS
tester, which is more problematic. ORBS claims (in private communication)
that Netvision used that trick on them (because they wanted to keep their
relay but get off ORBS), but they were on to the trick (probably by using
another tester) and added Netvision to their blacklist anyway.
> ORBS has also listed ISPs who failed to receive their warning message
> because the ORBS robot sent it to the incorrect address.
ORBS sends (or at least they claim to send, I haven't checked) email to
postmaster@ the machine. the RFC mandates such an account to exist, and
to be read by an administrator.
> ORBS will list any open SMTP relay that uses other methods to protect from
> abuse (e.g. rate limiting).
This is very true, and is the defence used by Netvision to explain their
open relay. However it is still *my* prerogative to decide that I insist
not to get mail from open relays, and therefor use ORBS. If you, Netvision,
or anybody else feels there are hosts that are open relays but not spam
risks, feel free to create a list ORTANSR (Open Relays That Are Not Spam
Risks), or whatever, for that, and maybe I'll use that in my spam filter
instead of ORBS.
--
Nadav Har'El | Wednesday, Nov 10 1999, 1 Kislev 5760
[EMAIL PROTECTED] |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |The trouble with political jokes is they
http://nadav.harel.org.il |get elected.
=================================================================
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]
