4 ms·

I really hope this latest internet vigilante project from Paul falls flat on its face. To say that his RBL project failed to stop spam is a candidate for 'under

I really hope this latest internet vigilante project from Paul falls flat on its face. To say that his RBL project failed to stop spam is a candidate for 'understatement of the decade'; it not only completely, unutterably, miserably, and totally failed to even slow down spam in any measurable way, but it created an unending series of headaches for system administrators and customers caught in the middle of warring ISPs. Coincidentally, just a few minutes ago -- just before loading up HN for the first time in a while -- I received an email from one of my clients asking me for advice. Their domain provider has been listed by SORBS, the domain provider is arguing that the listing was unwarranted and is refusing to pay any of the $50 "fine" that SORBS may request, if they request it. I have had to handle situations like this at least several times a year, and I'm not even an ISP. Another of my clients, a while back, briefly had their DSL IP listed in an RBL. They don't run a mail server from that IP, I vigilantly monitor their network for any signs of abuse so I'm fairly confident that there are no zombies on the network, and everyone's workstation is configured to send mail to an outbound mail server. Despite all this, the temporary listing in the RBL caused intermittent email disruption with misconfigured recipient servers that were incorrectly checking email headers for intermediate IPs listed in the RBL (mostly, ISPs using Barracuda Networks' latest bits of vomit). I contacted the RBL through the appropriate channels, and a few days later the block was removed without any other response or explanation from them. This is absurdity. This is not how a healthy "internet" can work. This juvenile "my network, my rules" approach is no different from opposition to net neutrality. This isn't a small network of universities and hobbyists anymore; this is a global network of businesses that, for better or worse, rely on this system to handle important and time-sensitive information. I would argue that, if you're an internet service provider or are otherwise accepting payment from customers for the purposes of handling some aspect of their electronic communications, then you are duty-bound to take every reasonable effort to ensure that all communications destined for them are able to reach them, and all of their communications are able to reach their destination. That means, for example, not subscribing to RBLs for the sake of lightening the load on your mail server and silently dropping email without notification to your customer. There are better ways to handle spam now -- greylisting, user-configurable controls, etc. -- and issues in DNS are already being worked on by groups providing services to end users. I would really prefer not to see the adoption of another RBL-like system, since the first one managed to fail so spectacularly at all of its goals.

SwellJoe 16y ago
While I'm just another anecdote, I haven't found RBLs to be anywhere near the level of trouble you've accused them of. I've been a system administrator for over a dozen years, and built and maintained a number of mail systems, on the order of hundreds, and my company/project user base includes at least a couple million mail server administrators. I can think of a couple of folks among our community who've raised a ruckus about RBLs, but they're folks that I know from experience raise a ruckus about everything (not to say you fall into that category). I can also think of another handful of folks who complained, who when I found more information found they actually are spammers, they just don't consider themselves spammers. It's strange how few spammers consider what they do wrong, and how indignant they become when things work against them. (Again, not to suggest that you fall into that category.) Granted, RBLs don't really work all that well as a spam control mechanism. They aren't worthless in that regard, but they also aren't the most effective single tool. But, when used as a weighting factor, as in SpamAssassin, it's a perfectly sane addition to any mail server, and I wouldn't want to see them disappear. In nearly every case of RBL listing I've ever seen in the years since RBLs came into existence, there actually was some reason for the listing: open relay, accidental spamming user with a virus of some sort, misconfigured DNS, etc. Frankly, as someone that has maintained mail servers for all those years and for so many customers, RBLs are something I think about so rarely that I'm kinda stunned you have such a strong emotional feeling about them. I'm just not sure how my experience and yours can be so very different on the very same Internet.
- thaumaturgy 16y ago
  Yeah, I'm stunned too, especially since you've had so much more exposure than I have. My first collision with RBLs was actually back in '97 or thereabouts. I was just starting to really mess around on the internet, had visions of becoming a dial-up ISP, all that good stuff. Anyway, my ISP at the time ended up on the MAPS RBL due to the actions of a customer-of-a-customer. Rather than give in, they decided to fight them, and I got stuck in the middle. For various reasons, I didn't have to deal with RBLs again for quite a while (I worked for other/larger companies, where it was someone else's problem; I left the computer industry entirely for a few years; so on), but eventually I got to be a tech-support/sysadmin monkey for a local ISP. They occasionally found themselves blackholed by one list or another for various reasons, whether it was a root'd box or a customer doing something dumb, usually a mailing list. Still, dealing with RBLs happened at least monthly. Since starting my own business, I've had to deal with RBLs probably 3 or 4 times a year. Not super often, but I don't have a really massive list of clients yet either. As yet another data point, nearlyfreespeech.net refuses to send out email notifications for planned outages. One of the reasons they give is that some percentage of their customers will lazily or mistakenly flag their message as spam and they'll end up on an RBL, which they don't want to deal with. I'm actually not opposed to RBLs being used as a factor in products like SpamAssassin. For one thing, SA can be configured by the end-user, which means that if they miss out on anything, they only have themselves to blame; and secondly, so long as the RBL isn't the sole reason for dropping a message or connection, it doesn't bother me nearly as much. At the ISP I worked for, "missing email" was probably the number 1 complaint, or close to it, and we spent an awful lot of time trying to fine-tune things so that legitimate messages wouldn't be lost. So, color me equally surprised that you've had no trouble with it at all. :-)

SwellJoe 16y ago

While I'm just another anecdote, I haven't found RBLs to be anywhere near the level of trouble you've accused them of. I've been a system administrator for over a dozen years, and built and maintained a number of mail systems, on the order of hundreds, and my company/project user base includes at least a couple million mail server administrators. I can think of a couple of folks among our community who've raised a ruckus about RBLs, but they're folks that I know from experience raise a ruckus about everything (not to say you fall into that category). I can also think of another handful of folks who complained, who when I found more information found they actually are spammers, they just don't consider themselves spammers. It's strange how few spammers consider what they do wrong, and how indignant they become when things work against them. (Again, not to suggest that you fall into that category.) Granted, RBLs don't really work all that well as a spam control mechanism. They aren't worthless in that regard, but they also aren't the most effective single tool. But, when used as a weighting factor, as in SpamAssassin, it's a perfectly sane addition to any mail server, and I wouldn't want to see them disappear. In nearly every case of RBL listing I've ever seen in the years since RBLs came into existence, there actually was some reason for the listing: open relay, accidental spamming user with a virus of some sort, misconfigured DNS, etc. Frankly, as someone that has maintained mail servers for all those years and for so many customers, RBLs are something I think about so rarely that I'm kinda stunned you have such a strong emotional feeling about them. I'm just not sure how my experience and yours can be so very different on the very same Internet.

thaumaturgy 16y ago
Yeah, I'm stunned too, especially since you've had so much more exposure than I have. My first collision with RBLs was actually back in '97 or thereabouts. I was just starting to really mess around on the internet, had visions of becoming a dial-up ISP, all that good stuff. Anyway, my ISP at the time ended up on the MAPS RBL due to the actions of a customer-of-a-customer. Rather than give in, they decided to fight them, and I got stuck in the middle. For various reasons, I didn't have to deal with RBLs again for quite a while (I worked for other/larger companies, where it was someone else's problem; I left the computer industry entirely for a few years; so on), but eventually I got to be a tech-support/sysadmin monkey for a local ISP. They occasionally found themselves blackholed by one list or another for various reasons, whether it was a root'd box or a customer doing something dumb, usually a mailing list. Still, dealing with RBLs happened at least monthly. Since starting my own business, I've had to deal with RBLs probably 3 or 4 times a year. Not super often, but I don't have a really massive list of clients yet either. As yet another data point, nearlyfreespeech.net refuses to send out email notifications for planned outages. One of the reasons they give is that some percentage of their customers will lazily or mistakenly flag their message as spam and they'll end up on an RBL, which they don't want to deal with. I'm actually not opposed to RBLs being used as a factor in products like SpamAssassin. For one thing, SA can be configured by the end-user, which means that if they miss out on anything, they only have themselves to blame; and secondly, so long as the RBL isn't the sole reason for dropping a message or connection, it doesn't bother me nearly as much. At the ISP I worked for, "missing email" was probably the number 1 complaint, or close to it, and we spent an awful lot of time trying to fine-tune things so that legitimate messages wouldn't be lost. So, color me equally surprised that you've had no trouble with it at all. :-)