5 ms·

The Spamhaus people are bad guys. I gradually realized that during the time I worked on spam filters. They presumably started out with good intentions, but th

by pg 15y ago

The Spamhaus people are bad guys. I gradually realized that during the time I worked on spam filters. They presumably started out with good intentions, but the position they're in has corrupted them. It's true of a lot of the guys running blacklists. And more generally, of a lot of people in the position of police. You tend to become a mirror of whatever bad guys you're fighting. Your tactics have to match theirs, and pretty soon your principles start to as well. I suspect this tendency is so universal that you have to make a conscious effort to avoid it.

marcamillion 15y ago
How is this avoided, on a societal level, in terms of law enforcement - other than making a conscious effort to avoid it?
- eatenbyagrue 15y ago
  By having a system of checks and balances in place, that allows due process and impartial review. In the US we have the judicial process in place for this. As an interesting note, SOPA proposes doing away with much of this process in the name of "streamlining."
  - pg 15y ago
    Yes. And that's what puts vigilantes in a morally dangerous position; by definition they're not answerable to anyone. Or at least not answerable to anything more specific than the law and public opinion.
    - deleted 15y ago
      [deleted]
seanp2k2 15y ago
We deal with spamhaus. They have false positives just like every other blacklist. I'd agree that most blacklist opers are pretty removed from the realities of hosting / running a site / large community. Your registrar pulling your domain for this is ridiculous. I would switch ASAP to someone who cares more about their clients. This, however, is just a symptom of a bigger issue: DNS is fundamentally broken. We need a scalable, open-source, free alternative solution for SSL and DNS that does not rely on any central authority. Namecoin seems cool and it'd be sweet if people started using that. The other idea is to have a new "anti censorship" root zone, and mirror all COM/NET/ORG etc TLDs. We could pass around this info and in the event of mass censorship, people could migrate onto the new root servers. We're putting way too much power in the hands of ICANN / Verisign / any random registrar or host with our current system.
- lordlicorice 15y ago
  Well it also costs a lot of money to operate those servers and to operate administrative stuff that ICANN does. Who will pay?
  - mikehoward 15y ago
    You're selling red herring. I pay for DNS and hosting - it's 'just another bill'
  - jerfelix 15y ago
    Namecoin is crowd-hosted in a peer-to-peer network. Problem solved. Or it WOULD be solved, if everyone used it.
pg22 15y ago
Oh my, same old Paul. Just can't stop holding a grudge. Seems he forgot to mention the reasons why he still feels the need to badmouth Spamhaus (other than perhaps nothing better to do these years, lack of new ideas?). Firstly, Paul's grand "A Plan for Spam" method of using Bayesian filters to stop all spam ("I think it's possible to stop spam, and that content-based filters are the way to do it."). Uh, so, how'd that work out? Spammers quickly figured out how to make a mockery of Bayes based solutions. And who is still out there filtering spam using IP addresses & domain names? Spamhaus. Then, what really got his goat was back in 2005 (yes, long grudge holding, one wonders what he feels about the mail-carrier who lost a letter of his back in '78 ;-) when his vanity site, shared-IP-hosted at Viaweb which had become Yahoo! Stores was blocklisted at Spamhaus. Back then, Yahoo, and Yahoo Stores were a spammer-hosting cesspool and Paul's page was wallowing in the center of it. Rather than get to the bottom of it, Paul just got on a high-horse and ranted about the evils of Spamhaus. A good take on the rant can be read here: http://www.circleid.com/posts/we_hate_spam_except_of_course_when_its_inconvenient_to_do_so/ http://www.circleid.com/posts/we_hate_spam_except_of_course_... So, multiple biases. How often people forget to mention those when they post attacks. Now one must ask, who is the "bad guy" and is "corrupt" here? But the Spamhaus people should be happy with the irony in Paul's hypocrisy. How so? Well, his paulgraham.com's email is filtered by Spamhaus, as is his ycombinator.com's email. As are the emails of most of the social/blog sites he's on (posterous.com, etc.) One wonder how many of these still use "A Plan for Spam"? Okay, that was rhetorical. Lastly, the pop-psychology in his posting attests that Paul's degrees are in philosophy, not psychology.
- freejack 15y ago
  Yah, this is all super topical.
- click170 15y ago
  You could have pointed out said hypocrisy without the ad hominem attacks, in fact I wouldn't have felt compelled to down-vote you if you had. Instead your comment reads more like a petty tantrum based on some grudge you (apparently, continue to) hold against Paul.
  - 15y ago
robmueller 15y ago
> The Spamhaus people are bad guys. I gradually realized that during the time I worked on spam filters. They presumably started out with good intentions, but the position they're in has corrupted them. That's a very attacking statement to call people "bad guys". Not just "they're not doing a good job", but actually "bad people". Ouch. Worse, I think it's totally wrong. While I do agree with the problem of "power corrupts", I believe that Spamhaus have been highly successful at avoiding that. I've dealt with and spoken with people at Spamhaus regularly, and they're smart people fighting the good fight. They know what they're doing, and take their responsibilities seriously. They don't blindly attack people or use threats or accuse them of misdeads. They gather evidence about bad behaviour and act on it. The proof is in the pudding. 100's of RBLs have come and gone over the years, either run as temporary projects that the owner gave up on one day, or gone the "power corrupts" option and just ended up listing so many IPs they've generated too many false positives (e.g. SPEWS). Spamhaus RBLs are still being run today, and being done so very successfully. Virtually every small/medium email server I know uses them in one form or another (blocking or scoring). They generally have very high block rates, and very low false positive rates. From a time when Al Iverson was still keeping stats on the various RBLs out there, you can see the Spamhaus zen RBL on it's own generally caught 75% of spam with 0% false positives. http://web.archive.org/web/20080703181952/http://stats.dnsbl.com/zen.html http://web.archive.org/web/20080703181952/http://stats.dnsbl... Certainly some listings are controversial (eg google docs), but it's always been for a good reason, and forced the provider of the service to come to terms with the fact their spam policies were lax or their service was being seriously abused by spammers. They were thus forced to take action, something they should have been doing anyway. Without Spamhaus, the internet would be a way worse place, with way more spam/junk emails and websites.
- pg 15y ago
  Spamhaus is not as bad as some other blacklists have been, certainly. Nor do I think they started out as bad people, though you have to admit that running a blacklist might tend to attract a certain type of person. Nor do I think they're stupid, or that their lists are ineffective (at the times when they're not deliberately blacklisting innocent people). But like others who've gone into the blacklist business, they do seem to have lost their way morally. I wrote about an example here: http://paulgraham.com/spamhausblacklist.html http://paulgraham.com/spamhausblacklist.html
DiabloD3 15y ago
I think this is the first time I've ever had to down vote pg. Spamhaus are not the bad guys in any way, it seems like this was a false positive, Spamhaus didn't know who op was (that he was an ISP hosting other's content), and his host apparently suck a bag of dicks and he needs to switch asap. Put the blame where it belongs, man.
zby 15y ago
An illustration of what Rene Girard writes about mimetic conflicts?
fduran 15y ago
Spamhaus may be "bad guys" but the DNS manager company is clearly the one at fault here, what they did is way worse in my book that a false spam positive from spamhaus or even their vigilantism.
JS_startup 15y ago
Paul is right on this one. Maybe Spamhaus used to have good intentions but all of my recent dealings with them indicate that they're as unethical as the spammers they claim to fight. Their "shoot first ask questions later" methodology proves that they have no problem railroading anyone unfortunate enough to get caught in their crossfire.

by pg 15y ago

marcamillion 15y ago

How is this avoided, on a societal level, in terms of law enforcement - other than making a conscious effort to avoid it?

eatenbyagrue 15y ago
By having a system of checks and balances in place, that allows due process and impartial review. In the US we have the judicial process in place for this. As an interesting note, SOPA proposes doing away with much of this process in the name of "streamlining."
- pg 15y ago
  Yes. And that's what puts vigilantes in a morally dangerous position; by definition they're not answerable to anyone. Or at least not answerable to anything more specific than the law and public opinion.
  - deleted 15y ago
    [deleted]

seanp2k2 15y ago

We deal with spamhaus. They have false positives just like every other blacklist. I'd agree that most blacklist opers are pretty removed from the realities of hosting / running a site / large community. Your registrar pulling your domain for this is ridiculous. I would switch ASAP to someone who cares more about their clients. This, however, is just a symptom of a bigger issue: DNS is fundamentally broken. We need a scalable, open-source, free alternative solution for SSL and DNS that does not rely on any central authority. Namecoin seems cool and it'd be sweet if people started using that. The other idea is to have a new "anti censorship" root zone, and mirror all COM/NET/ORG etc TLDs. We could pass around this info and in the event of mass censorship, people could migrate onto the new root servers. We're putting way too much power in the hands of ICANN / Verisign / any random registrar or host with our current system.

lordlicorice 15y ago
Well it also costs a lot of money to operate those servers and to operate administrative stuff that ICANN does. Who will pay?
- mikehoward 15y ago
  You're selling red herring. I pay for DNS and hosting - it's 'just another bill'
- jerfelix 15y ago
  Namecoin is crowd-hosted in a peer-to-peer network. Problem solved. Or it WOULD be solved, if everyone used it.

pg22 15y ago

Oh my, same old Paul. Just can't stop holding a grudge. Seems he forgot to mention the reasons why he still feels the need to badmouth Spamhaus (other than perhaps nothing better to do these years, lack of new ideas?). Firstly, Paul's grand "A Plan for Spam" method of using Bayesian filters to stop all spam ("I think it's possible to stop spam, and that content-based filters are the way to do it."). Uh, so, how'd that work out? Spammers quickly figured out how to make a mockery of Bayes based solutions. And who is still out there filtering spam using IP addresses & domain names? Spamhaus. Then, what really got his goat was back in 2005 (yes, long grudge holding, one wonders what he feels about the mail-carrier who lost a letter of his back in '78 ;-) when his vanity site, shared-IP-hosted at Viaweb which had become Yahoo! Stores was blocklisted at Spamhaus. Back then, Yahoo, and Yahoo Stores were a spammer-hosting cesspool and Paul's page was wallowing in the center of it. Rather than get to the bottom of it, Paul just got on a high-horse and ranted about the evils of Spamhaus. A good take on the rant can be read here: http://www.circleid.com/posts/we_hate_spam_except_of_course_when_its_inconvenient_to_do_so/ http://www.circleid.com/posts/we_hate_spam_except_of_course_... So, multiple biases. How often people forget to mention those when they post attacks. Now one must ask, who is the "bad guy" and is "corrupt" here? But the Spamhaus people should be happy with the irony in Paul's hypocrisy. How so? Well, his paulgraham.com's email is filtered by Spamhaus, as is his ycombinator.com's email. As are the emails of most of the social/blog sites he's on (posterous.com, etc.) One wonder how many of these still use "A Plan for Spam"? Okay, that was rhetorical. Lastly, the pop-psychology in his posting attests that Paul's degrees are in philosophy, not psychology.

freejack 15y ago
Yah, this is all super topical.
click170 15y ago
You could have pointed out said hypocrisy without the ad hominem attacks, in fact I wouldn't have felt compelled to down-vote you if you had. Instead your comment reads more like a petty tantrum based on some grudge you (apparently, continue to) hold against Paul.
- 15y ago

robmueller 15y ago

> The Spamhaus people are bad guys. I gradually realized that during the time I worked on spam filters. They presumably started out with good intentions, but the position they're in has corrupted them. That's a very attacking statement to call people "bad guys". Not just "they're not doing a good job", but actually "bad people". Ouch. Worse, I think it's totally wrong. While I do agree with the problem of "power corrupts", I believe that Spamhaus have been highly successful at avoiding that. I've dealt with and spoken with people at Spamhaus regularly, and they're smart people fighting the good fight. They know what they're doing, and take their responsibilities seriously. They don't blindly attack people or use threats or accuse them of misdeads. They gather evidence about bad behaviour and act on it. The proof is in the pudding. 100's of RBLs have come and gone over the years, either run as temporary projects that the owner gave up on one day, or gone the "power corrupts" option and just ended up listing so many IPs they've generated too many false positives (e.g. SPEWS). Spamhaus RBLs are still being run today, and being done so very successfully. Virtually every small/medium email server I know uses them in one form or another (blocking or scoring). They generally have very high block rates, and very low false positive rates. From a time when Al Iverson was still keeping stats on the various RBLs out there, you can see the Spamhaus zen RBL on it's own generally caught 75% of spam with 0% false positives. http://web.archive.org/web/20080703181952/http://stats.dnsbl.com/zen.html http://web.archive.org/web/20080703181952/http://stats.dnsbl... Certainly some listings are controversial (eg google docs), but it's always been for a good reason, and forced the provider of the service to come to terms with the fact their spam policies were lax or their service was being seriously abused by spammers. They were thus forced to take action, something they should have been doing anyway. Without Spamhaus, the internet would be a way worse place, with way more spam/junk emails and websites.

pg 15y ago
Spamhaus is not as bad as some other blacklists have been, certainly. Nor do I think they started out as bad people, though you have to admit that running a blacklist might tend to attract a certain type of person. Nor do I think they're stupid, or that their lists are ineffective (at the times when they're not deliberately blacklisting innocent people). But like others who've gone into the blacklist business, they do seem to have lost their way morally. I wrote about an example here: http://paulgraham.com/spamhausblacklist.html http://paulgraham.com/spamhausblacklist.html

DiabloD3 15y ago

I think this is the first time I've ever had to down vote pg. Spamhaus are not the bad guys in any way, it seems like this was a false positive, Spamhaus didn't know who op was (that he was an ISP hosting other's content), and his host apparently suck a bag of dicks and he needs to switch asap. Put the blame where it belongs, man.

zby 15y ago

An illustration of what Rene Girard writes about mimetic conflicts?

fduran 15y ago

Spamhaus may be "bad guys" but the DNS manager company is clearly the one at fault here, what they did is way worse in my book that a false spam positive from spamhaus or even their vigilantism.

JS_startup 15y ago

Paul is right on this one. Maybe Spamhaus used to have good intentions but all of my recent dealings with them indicate that they're as unethical as the spammers they claim to fight. Their "shoot first ask questions later" methodology proves that they have no problem railroading anyone unfortunate enough to get caught in their crossfire.