Broadband Tech > Security > Scam and Phishbusters > Why not to use SPEWS

reply to AmeritecTech

Re: Why not to use SPEWS

said by AmeritecTech:

---

frequently creating secondary victims, like BBR and Something Awful.

---

said by AmeritecTech:

---

I note that you are Premium. Does this mean that you are also supporting a spam-friendly ISP?

---

said by TamaraB:

---

Absolutely NOT! I support one of the Internet's best sources of information on a very wide range of subjects. BBR is one of the finest discussion systems on the NET, it is NOT however an ISP! It is also NOT spam-friendly, where did you get that Idea?

You wouldn't be trying to mis-represent what I said in my post would you?

---

reply to TamaraB
Tamara, I agree 100%. It's interesting that the discussion here has focused on the evils of SPEWS, with little discussion of NAC's failure to deal with its spam problem. Not to mention, zero suggestions about how else to punish people who sell fake drugs and send porn to kids.

SPEWS has the right to do what it does, and others have the right to voice their discontent. Others can then decide whether they think the claims of overbearing policies are justified.
--
Independent thinkers tend to ALWAYS have someone not agreeing with them. It's the non-thinkers that always come in legions." -John Callari

reply to AmeritecTech

said by AmeritecTech:

---

What money do you think BBR uses to pay its hosting costs?

---

Funny, that's what I've been saying about Nac.

reply to Rhobite

said by Rhobite:

---

It's interesting that the discussion here has focused on the evils of SPEWS, with little discussion of NAC's failure to deal with its spam problem. Not to mention, zero suggestions about how else to punish people who sell fake drugs and send porn to kids.

---

Give me some credit, I've ranted about draconian tactics of some blacklist for a long time now and I never agreed with this as a right way to fight spam.

On the other hand, I have actively acted against spam for years.. so you're saying my opinion on this doesn't count because it's against spews? It's not just an inconvenience for me and dslreports.. it affects Internet as a whole and helps anti-spam activists to be discounted as extremists in midst of a witch hunt.
--
Life is too short to be boring

reply to nil

said by nil:

---

Funny, that's what I've been saying about Nac.

---

Forget it, I've had enough playing ping-pong for the day.

reply to nil

said by nil:

---

Give me some credit, I've ranted about draconian tactics of some blacklist for a long time now and I never agreed with this as a right way to fight spam.

---

said by TamaraB:

---

For some applications a "draconian" blacklist is quite appropriate, for others it's not. Ranting against a "list" is not entirely appropriate, rant instead against it's particular use perhaps, but not the list itself. After all, it's only information, no one is forced to use a particular list.

---

A rather whiny and tired nil by now

Anyway, it seems this discussion is just going in circles.. we each have our opinions and doesn't look like anyone will change theirs. Can we agree to disagree and move on?
--
Life is too short to be boring

Sounds good.

reply to AmeritecTech

said by AmeritecTech:

---

Yet you continue to chastise nil's rant.

---

reply to TamaraB
The problem, Captain Bob, is while the US Military attempts to _avoid_ collateral damage, SPEWS deliberately causes it, by using "area effect" blacklisting when they have at their disposal "precision guided" blacklisting. The idea is that the people they blacklist that way will put pressure on their real targets.

Most people avoid neighborhoods where there are open drug deals, prostitution and random shootings. As an individual inhabiting one of these ghettos (ISPs) you have three choices: actively endeavor to clean your neighborhood (ISP) of the riff-raff, hunker down and do nothing more than bad mouthing the situation, or more to a better neighborhood (ISP).

The internet is a community that has survived on self-policing. The principle behind SPEWS is the motivation of individuals to become aware and involved in bettering the internet as a community.

You can grip and moan about SPEWS or you can eliminate the original problem, the cause for the existence of SPEWS. Your choice.

quote:

---

You can grip and moan about SPEWS or you can eliminate the original problem, the cause for the existence of SPEWS.

---

said by Karl Bode:

---

quote:

---

You can grip and moan about SPEWS or you can eliminate the original problem, the cause for the existence of SPEWS.

---

Why can't one do both?

---

reply to russotto
There is an active discussion on /dot initiated by members of this forum.

One of the messages there has been posted to NANAE a couple of times, and is probably the best and most accurate explaination of why SPEWS and block-lists in general are a good thing.What they realy mean in terms of network citizenship and trust. It is written by a system administrator who was listed by spews, and who got de-listed.

I am going to re-post it here for the benefit of those who are truely interested in fighting the blight of spam, and in the interest of education.

===============

It's not about spam, it's about TRUST (Score:5, Interesting)
by satch89450 (186046) on Wednesday January 21, @08:39AM (#8042321)
(»www.satchell.net/)

OK, for those of you who read NANAE, this is old news, but for the rest of you...

I'm a sysadmin who worked very hard to get a /24 listed in SPEWS delisted. The netblock was in
the list because a customer of ours decided to provide DNS service to a known and notorious spammer. We earned the listing, period. I killed the bastard, reported the fact, and got the listing lowered to a zero, historical. In the process of doing that job, I learned a lot about the whole blocklist thing and realized that even the operators didn't see what they are really doing. They think it's about spam. Wrong.

It's not about spam. It's about TRUST

A listing in a recognized blocking list is a vote of "no confidence" in the IP owner's ability to run its network, to make its users -- ALL its users -- conform to the Internet society's accepted code of conduct.

Follow along with me a moment, and you'll see why I think this way. First, the Internet is, by
definition, a "network of networks", a large anarchy run by a very large number of system administrators (greater than 10,000) who make private decisions about who and how they allow to access their bandwidth, systems, and services. The Internet Society and its sub-units provide a forum to publish community notes, the Requests for Comments, which are nothing more and nothing less than agreements for how to play nice in this employee-owned swimming pool.

The Internet community has decided on standards of behavior, and each system operator trusts every other system operator in the pool to conform to the rules of society, and to ensure that the users conform to the community rules -- not unlike CC&Rs in a neighborhood development that form part of the purchase contract of many homes and condominiums. Some operators have become lax in their expected enforcement of the rules on particularly not-nice people, the ones who break the rules in order to win money, or some other benefit. There are enough of these Internet con men out there that the community coined a word to describe them: "spammers."

Back in the NSF days, a lapse in administration resulted in disconnection, quick and swift, so
the system adminstrators, up and down the line, toed the line to avoid being banished. In the Commercial Internet that replaced the NSF Internet, personal greed gets in the way of this remedy, and so the disdain of social customs is left largely unpunished by the society.

Just about every system operator who runs a mail service with more than three users has been yammered at by those users: "WE WANT LESS SPAM -- DO SOMETHING." Complaints to ISPs who take spammer money go largely ignored, and appeals "upstream" -- to the connection providers and to the
Tier One networks -- have also gone largely ignored. So the small administrators started to implement mail filters and blocks on "spammy" IP addresses in the hopes that they can block the crap and thus appease their users.

Spammers countered by having their providers move them around in IP space, and by using techniques to "get around" the content filters. It's become a war, frankly. First there were keyword filters, and so spammers started to "do things" to their messages, like replace the letter 'o' with the digit '0' -- you've all seen the tricks. Hash identification of bulk messages were thwarted by inserting random nonsense text. Learning filters are poisoned by spammers injecting random words. And so on and so on. In addition to these content-based counters, spammers also steal resources of innocent people: open mail relays, open proxies, and hijacked Web scripts like formmail.pl, so that the wrong person gets blames for their flood of commercial feces.

What the block-list people decided is that having each of the 10,000 to 100,000 system administrators deal with this individually was eating up too much time, and there was this nifty thing already in place that could be used to reduce the system overhead of identifying spam: use new
zones of the Domain Name System (DNS) to provide a rapid way of identifying "problem" IP addresses and deflect mail based on that information. The growth of the DNS-based blocking list, or DNSBL, has been interesting to watch.

Several organizations collect information about problem IP addresses, and provide databases that feed DNSBLs. One of these is the Spam Prevention Early Warning System project, better known as SPEWS. What make SPEWS such a topic of discussion is the attitude on the part of the operators of the database that when complaints are ignored and spam continues, there is a good chance that spam will "pop up" on neighboring IP addresses, so when action isn't taken on a spammer on a network, it makes sense to pre-emptively report neighboring space on the assumption that if there isn't spam now, there will be. Others have written on the "bad neighbood" analogy, so I won't repeat it here.

And that gets me to my thesis. This escalation process -- assuming that if an operator won't take action against one spammer that operator's network will attract spammers wishing to operate
without molestation like flies are attraced to feces -- means that the SPEWS database isn't really "just" about spam at all - it's about administration. A listing in SPEWS says "we don't trust you to do The Right Thing(tm) any more, because you haven't been."

A trust violation.

A trust violation at multiple levels, for control over the routing of an IP address goes through quite a number of hands, as a rule.

Many communities now have Megan's Law, where a previously convicted sex offender has to register their presence with local law enforcement every time they move, even after they have served their time and discharged their debt to society. Why? Sex offenders, goes the thinking, rarely go completely straight. People who subscribe to block lists in particular and SPEWS in particular have the same attitude to spam offenders, because like sex offenders the result of recivitism is just as bad, the rape of innocent people's mailboxes, and the temptations of a reformed spammer to spam again are very, very high: almost at the same level as an alcoholic's craving for drink or a smoker's craving for tobacco.

What's interesting is that the collection of all the databases and blocking lists gives us a unique opportunity to come up with a grade for system operators. I have put together a proposal for this, which has been posted to news.admin.net-abuse.email, and which I have placed on my Web site. [satch-test.com] This proposal would take the existing information and summarize it as a "grade" for each provider, at each level. The publication of these grades would allow people to see who is a good provider and who is a bad provider, and could form the basis of some sort of certification that can be used in advertising.

The fact that Broadband Reports has become collateral damage to a SPEWS escalation is unfortunate. As a publication, though, Broadband Reports is in the best position to publicize the ineptitude of their upstream provider in being a good Net citizen, and perhaps can shame them into doing something about the disease that infests their network.

I know a netblock can be de-listed, because I did it. It took work, it took removing a tumor from my netblock, it took a public announcement of the surgery.

Or, like a family finding a crack house next door, they can move.
--
Motor Vessel - Tamara B. - 43' Long-Range Trawler Cape Elizebeth ME.»www.tamara-b.org