5 ms·

I work at Yahoo! and we've been blacklisted as well by Spamhaus. I wouldn't say it's entirely inappropriate because of the sheer volume of email that can pass

by jmathai 16y ago

I work at Yahoo! and we've been blacklisted as well by Spamhaus. I wouldn't say it's entirely inappropriate because of the sheer volume of email that can pass through our (or in this case Gmail's) system. Personally, I've tried to reach out to Google regarding security issues on blogspot which were affecting our property. There was an XSS vulnerability and we were getting thousands of posts on our blog linking to blogspot which would in turn redirect the user to some pharma site. It's been months and they haven't really made any progress other than put me in contact with various people who don't respond to email. If that's how they deal with an open XSS I can only imagine how fast they move to deal with spam like this. Disclaimer: This isn't a post bashing Google and praising Yahoo - just the only experiences I've had to contribute to this post :).

tptacek 16y ago
If you blacklist the mechanism by which tens of percentage points worth of Internet users send mail, you are not part of the solution to spam.
- dingdingding 16y ago
  I know the google fanboys will hate this, but the problem is letting just anyone or just any machine create an account and use your service. It's google's responsibility to can the spam coming from their domain. Google doesn't care though. If they make it harder to get a gmail account, then they make it harder to spam their "legitimate" users with advertisements and why would they want to do that? If you are a company that provides spamming capabilities to anyone and everyone, then it is exactly valid to add them to a spam list. You could say, "Plenty of legitimate users use gmail." Fine, maybe so, but if you are someone who uses gmail, you are surrounded by a cadre of spammers and should understand your credibility is instantly devalued. Birds of a feather flock together. The solution is to stop using gmail.com. A VERY VERY high percentage of spam in my inbox comes from gmail accounts. If tens of percentages points of spam is sent from a domain, then it's valid to add them to the list of spamming domains.
  - jmathai 16y ago
    TLDR; It's a tough problem to which I have no suggestions. It's not just Google. Trust me when I say that combating spam is a full time ongoing job that never ever ends and you never ever win. I do agree that it's the responsibility of the email provider to mitigate spam but it's an incredibly difficult task to accomplish with near zero false positives. Perhaps Google could do a better job but restricting the "open" nature of signing up for and using email is not the solution. If Google does that then someone else will offer it unrestricted. It's simply too cheap for spammers to send emails. Identifying usage patterns and rate limiting or gasp charging based on them would be a step in the right direction. But that means losing users which in itself has tremendous cost.
  - bmm6o 16y ago
    > Fine, maybe so, but if you are someone who uses gmail, you are surrounded by a cadre of spammers and should understand your credibility is instantly devalued. "My credibility"? When I send my mom an email, I expect her to get it. When she sends me one, I expect to get it. >Birds of a feather flock together. Yes, because I am a spammer.</sarcasm> If gmail has a lot of spammers using their service, they should address this. But the suggestion that those caught in the crossfire should know better is one of the more frustrating things about black-listers.
    - deleted 16y ago
      [deleted]
    - deleted 16y ago
      [deleted]
  - scott_s 16y ago
    You get spam in your inbox? I see maybe one a month. Gmail filters it for me.
    - deleted 16y ago
      [deleted]
  - tptacek 16y ago
- jmathai 16y ago
  True. I agree that it's a really clumsy "solution" - if you even want to call it that. I know for us it expedites our efforts to remedy our part of the problem. Not the right motivation and perhaps more harm than good but I'm not 100% sure.
  - tptacek 16y ago
    Let me simplify your thought process here: it does more harm than good.
- dingdingding 16y ago
  As of June 2009, the latest stat I found, Gmail has 5.51% share of email users, 1/3 of either hotmail or yahoo mail. Definitely not "tens of percentage points." http://www.campaignmonitor.com/blog/post/2839/email-client-popularity-june-2009/ http://www.campaignmonitor.com/blog/post/2839/email-client-p...
  - eli 16y ago
    That percent of people accessing gmail through the web, not of people using it to send email.
ck2 16y ago
In this case Spamhaus accidentally blocked gmail because they used the entire ip block of the original email's images. it seems that spammers were using docs.google.com to post some documents, which are stored in the same /24 as gmail. Spamhaus decided to blacklist the whole subnet.
- Kadin 16y ago
  I interpreted that sentence to mean that the decision was not accidental but purposeful on Spamhaus' part; if it's accidental then it's slightly different (actually it makes me think somewhat less of Spamhaus, because it's sloppy). Either way I'm not sure that the outcome is going to be good. I'd like it if there were a way to pressure Google into being more responsive about spam issues, but they have little incentive to, beyond keeping it from clogging up their own systems.
- whatwhatwhat 16y ago
  things like this http://docs.google.com/document/edit?id=1sNOzHa2orgpK5BIp4eEz-RBff7n39h0Bvo57H9ZHeu4 http://docs.google.com/document/edit?id=1sNOzHa2orgpK5BIp4eE...
sweis 16y ago
I'll follow up on this XSS. I sent emails to your personal address and HN username @yahoo-inc asking for some details.
- jmathai 16y ago
  Got your email and replied. Thanks.
moultano 16y ago
Blogspot allows arbitrary javascript I believe, including redirects. I don't think that's a vulnerability. It's just run of the mill spam.
- jmathai 16y ago
  I guess that depends on definition. At yahoo the ability to use a product for spam is a vulnerability. If a spammer can email a link to yahoo.com/something/random which redirects them to mypharamasite.com then it's a vulnerability because the site allowing the redirects helps trick the end user into buying vicodin :). I can't imagine why javascript redirects add much value in a blog post. But everyone picks a different spot between features and security - and that's okay by me.
  - moultano 16y ago
    >I can't imagine why javascript redirects add much value in a blog post. But everyone picks a different spot between features and security - and that's okay by me There are a lot of people that have used blogspot as their host for a long time, but then decide to get their own domain and don't want to lose their readers. That's the motivation I've heard for allowing redirects in the past, though I don't know what the current policy is. Blogspot is a lot more like a hosting service than an application in terms of what it allows, probably because it's one of the oldest.
avar 16y ago
I know this isn't the right place for a Yahoo! bug report, but they don't reply to me elsewhere. I keep getting spam from Yahoo! in the form of people signing me up for some group, just today someone signed me up for the "vjth group" with the group description "iqdjgpwo62r683fs". There's a link in the E-Mail saying "You may also change your email preferences to prevent group owners from adding you to their groups.". But when I follow it and change my E-Mail preferences I get: Groups error We're Sorry... There was a problem with your request. The page you've requested returned this error: If you continue to receive this error for more than 48 hours, please contact our Customer Care team. We apologize for this inconvenience. I've been getting this error for the last 6 months or so. Stop spamming me Yahoo!.

by jmathai 16y ago

tptacek 16y ago

If you blacklist the mechanism by which tens of percentage points worth of Internet users send mail, you are not part of the solution to spam.

dingdingding 16y ago
I know the google fanboys will hate this, but the problem is letting just anyone or just any machine create an account and use your service. It's google's responsibility to can the spam coming from their domain. Google doesn't care though. If they make it harder to get a gmail account, then they make it harder to spam their "legitimate" users with advertisements and why would they want to do that? If you are a company that provides spamming capabilities to anyone and everyone, then it is exactly valid to add them to a spam list. You could say, "Plenty of legitimate users use gmail." Fine, maybe so, but if you are someone who uses gmail, you are surrounded by a cadre of spammers and should understand your credibility is instantly devalued. Birds of a feather flock together. The solution is to stop using gmail.com. A VERY VERY high percentage of spam in my inbox comes from gmail accounts. If tens of percentages points of spam is sent from a domain, then it's valid to add them to the list of spamming domains.
- jmathai 16y ago
  TLDR; It's a tough problem to which I have no suggestions. It's not just Google. Trust me when I say that combating spam is a full time ongoing job that never ever ends and you never ever win. I do agree that it's the responsibility of the email provider to mitigate spam but it's an incredibly difficult task to accomplish with near zero false positives. Perhaps Google could do a better job but restricting the "open" nature of signing up for and using email is not the solution. If Google does that then someone else will offer it unrestricted. It's simply too cheap for spammers to send emails. Identifying usage patterns and rate limiting or gasp charging based on them would be a step in the right direction. But that means losing users which in itself has tremendous cost.
- bmm6o 16y ago
  > Fine, maybe so, but if you are someone who uses gmail, you are surrounded by a cadre of spammers and should understand your credibility is instantly devalued. "My credibility"? When I send my mom an email, I expect her to get it. When she sends me one, I expect to get it. >Birds of a feather flock together. Yes, because I am a spammer.</sarcasm> If gmail has a lot of spammers using their service, they should address this. But the suggestion that those caught in the crossfire should know better is one of the more frustrating things about black-listers.
  - deleted 16y ago
    [deleted]
  - deleted 16y ago
    [deleted]
- scott_s 16y ago
  You get spam in your inbox? I see maybe one a month. Gmail filters it for me.
  - deleted 16y ago
    [deleted]
- tptacek 16y ago
jmathai 16y ago
True. I agree that it's a really clumsy "solution" - if you even want to call it that. I know for us it expedites our efforts to remedy our part of the problem. Not the right motivation and perhaps more harm than good but I'm not 100% sure.
- tptacek 16y ago
  Let me simplify your thought process here: it does more harm than good.
dingdingding 16y ago
As of June 2009, the latest stat I found, Gmail has 5.51% share of email users, 1/3 of either hotmail or yahoo mail. Definitely not "tens of percentage points." http://www.campaignmonitor.com/blog/post/2839/email-client-popularity-june-2009/ http://www.campaignmonitor.com/blog/post/2839/email-client-p...
- eli 16y ago
  That percent of people accessing gmail through the web, not of people using it to send email.

ck2 16y ago

In this case Spamhaus accidentally blocked gmail because they used the entire ip block of the original email's images. it seems that spammers were using docs.google.com to post some documents, which are stored in the same /24 as gmail. Spamhaus decided to blacklist the whole subnet.

Kadin 16y ago
I interpreted that sentence to mean that the decision was not accidental but purposeful on Spamhaus' part; if it's accidental then it's slightly different (actually it makes me think somewhat less of Spamhaus, because it's sloppy). Either way I'm not sure that the outcome is going to be good. I'd like it if there were a way to pressure Google into being more responsive about spam issues, but they have little incentive to, beyond keeping it from clogging up their own systems.
whatwhatwhat 16y ago
things like this http://docs.google.com/document/edit?id=1sNOzHa2orgpK5BIp4eEz-RBff7n39h0Bvo57H9ZHeu4 http://docs.google.com/document/edit?id=1sNOzHa2orgpK5BIp4eE...

sweis 16y ago

I'll follow up on this XSS. I sent emails to your personal address and HN username @yahoo-inc asking for some details.

jmathai 16y ago
Got your email and replied. Thanks.

moultano 16y ago

Blogspot allows arbitrary javascript I believe, including redirects. I don't think that's a vulnerability. It's just run of the mill spam.

jmathai 16y ago
I guess that depends on definition. At yahoo the ability to use a product for spam is a vulnerability. If a spammer can email a link to yahoo.com/something/random which redirects them to mypharamasite.com then it's a vulnerability because the site allowing the redirects helps trick the end user into buying vicodin :). I can't imagine why javascript redirects add much value in a blog post. But everyone picks a different spot between features and security - and that's okay by me.
- moultano 16y ago
  >I can't imagine why javascript redirects add much value in a blog post. But everyone picks a different spot between features and security - and that's okay by me There are a lot of people that have used blogspot as their host for a long time, but then decide to get their own domain and don't want to lose their readers. That's the motivation I've heard for allowing redirects in the past, though I don't know what the current policy is. Blogspot is a lot more like a hosting service than an application in terms of what it allows, probably because it's one of the oldest.

avar 16y ago

I know this isn't the right place for a Yahoo! bug report, but they don't reply to me elsewhere. I keep getting spam from Yahoo! in the form of people signing me up for some group, just today someone signed me up for the "vjth group" with the group description "iqdjgpwo62r683fs". There's a link in the E-Mail saying "You may also change your email preferences to prevent group owners from adding you to their groups.". But when I follow it and change my E-Mail preferences I get: Groups error We're Sorry... There was a problem with your request. The page you've requested returned this error: If you continue to receive this error for more than 48 hours, please contact our Customer Care team. We apologize for this inconvenience. I've been getting this error for the last 6 months or so. Stop spamming me Yahoo!.