- NZNOG - lists.nznog.org

Re: [nznog] IP / domain blocking for SPAM prevention
by david＠farrar.com 25 Sep '03

25 Sep '03

> On Fri, 2003-09-26 at 14:00, david(a)farrar.com wrote: > > > Oh I agree they do - but at the scale of the ISPs with > > 10 million+ customers or products that are in wide use. > > I can't see a spammer adjusting anything just because > > they read on a website that Ihug with 80,000 customers > > uses Spam Assassin. > > The key phrase there is "I can't see", it doesn't matter > what you can't see, it matters what the people (the ISP > industry) see, if they aren't comfortable giving out the > measures they take then any central page where people can > easily see what people are using will be useless. Well I don't think I have suggested it is going to be compulsory or anything. In fact it is only one of hundreds of possible aspects of an overall anti spam campaign. Of course it is up to ISPs to list whatever details they want. If no-one lists anything then we just have a very short page. I would suggest that more and more consumers will pick an ISP on the basis of services like spam filtering. I have helped several people swap ISPs from those who do not have anti spam technology to those who do. Ihug's spam assassin (free plug) has been a huge benefit to me and it's the best $2.50/mth I spend. Anyway enough bandwidth wasted on this. My last post on the topic. DPF

1 0

Re: [nznog] IP / domain blocking for SPAM prevention
by david＠farrar.com 25 Sep '03

25 Sep '03

Quite the opposite. It is because they are in wide use spammers will try and get past them. But the NZ market is so miniscule that a list of what NZ ISP uses what is going to have IMO zero effect on what products spammers try to work around. I have never said that spammers do not try to get around anti spam filters. I have just said that publicising what anti spam filter a NZ ISP uses, is not going to affect the behaviour of the spammer (Unless they were for some reason targetting that ISP as a revenge thing). DPF > Hi David, > > So are you saying that in your estimation, products like > spam assassin are not in wide use? > > jamie > > >>> <david(a)farrar.com> 26/9/2003 2:00:38 PM >>> > > david(a)farrar.com wrote: > > > > > I actually think it is highly unlikely that with the > > > way spammers work they would try to tailor spam > > > individually for each ISP to get past what they think > > > are its filters. We are not big enough for that. > > > They just throw out 100 million of them and hope say > > > 10 million of them get through and are not too worried > > > if it is 10.0 million or 10.05 million. > > > > Spammers do try to get past filtering, and use different > > methods for AOL, Hotmail, etc. Some try to poison > > auto-learning filters as well. > > Oh I agree they do - but at the scale of the ISPs with 10 > million+ customers or products that are in wide use. I > can't see a spammer adjusting anything just because they > read on a website that Ihug with 80,000 customers uses > Spam Assassin. > > DPF > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog > >

1 0

Re: [nznog] IP / domain blocking for SPAM prevention
by david＠farrar.com 25 Sep '03

25 Sep '03

> david(a)farrar.com wrote: > > > Oh I agree they do - but at the scale of the ISPs with > > 10 million+ customers or products that are in wide use. > > I can't see a spammer adjusting anything just because > > they read on a website that Ihug with 80,000 customers > > uses Spam Assassin. > > And yes, spammers do try to get past Spam Assassin as > well. This is probably getting to the point of off topic, but I never said they didn't. But they try to get past spam assassin because it is a widely used spam filter, not because they are going to go a NZ website, read that hey Black Albatross use Spam Assassin, so hey I'd better try and get around it. DPF

1 0

Re: [nznog] IP / domain blocking for SPAM prevention
by david＠farrar.com 25 Sep '03

25 Sep '03

> david(a)farrar.com wrote: > > > I actually think it is highly unlikely that with the way > > spammers work they would try to tailor spam individually > > for each ISP to get past what they think are its > > filters. We are not big enough for that. They just > > throw out 100 million of them and hope say 10 million of > > them get through and are not too worried if it is 10.0 > > million or 10.05 million. > > Spammers do try to get past filtering, and use different > methods for AOL, Hotmail, etc. Some try to poison > auto-learning filters as well. Oh I agree they do - but at the scale of the ISPs with 10 million+ customers or products that are in wide use. I can't see a spammer adjusting anything just because they read on a website that Ihug with 80,000 customers uses Spam Assassin. DPF

3 2

Re: [nznog] IP / domain blocking for SPAM prevention
by Jamie Baddeley 25 Sep '03

25 Sep '03

Hi David, So are you saying that in your estimation, products like spam assassin are not in wide use? jamie >>> <david(a)farrar.com> 26/9/2003 2:00:38 PM >>> > david(a)farrar.com wrote: > > > I actually think it is highly unlikely that with the way > > spammers work they would try to tailor spam individually > > for each ISP to get past what they think are its > > filters. We are not big enough for that. They just > > throw out 100 million of them and hope say 10 million of > > them get through and are not too worried if it is 10.0 > > million or 10.05 million. > > Spammers do try to get past filtering, and use different > methods for AOL, Hotmail, etc. Some try to poison > auto-learning filters as well. Oh I agree they do - but at the scale of the ISPs with 10 million+ customers or products that are in wide use. I can't see a spammer adjusting anything just because they read on a website that Ihug with 80,000 customers uses Spam Assassin. DPF _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Re: [nznog] IP / domain blocking for SPAM prevention
by david＠farrar.com 25 Sep '03

25 Sep '03

> On Fri, 2003-09-26 at 12:19, david(a)farrar.com wrote: > > > Probably an appropriate time for me to mention that one > > of the activities that the InternetNZ Spam Taskforce is > > looking at is an easy to access website where ISPs and > > others can list what spam technologies they use and have > > available (both at server level and for clients to use). > > So the spammers can see what systems that have to beat to > get their crap through, no thanks. > > I'd happily list on a page that said "These guys do > spam/anti virus filtering" so long as I didn't have to say > in detail what we did. People can give as much detail as they want. I would agree you would not want to list for example the exact filters in place (however noting that at http://www.mirror.ac.uk/sites/spamassassin.taint.org/spamassassin.org/tests… they do list the exact filters and SA works pretty damn well IMO), but detail such as "Use Brightmail", "Use Bayesian Filtering", "Use Spews blacklist" may be useful for consumer choice. Other details I would see as useful if whether the ISP actually filters or just labels so users can filter on the labels. Is the spam filter compulsory or opt-in. Does it cost extra. If they filter is there a spam recovery folder you can check for false positives etc. I actually think it is highly unlikely that with the way spammers work they would try to tailor spam individually for each ISP to get past what they think are its filters. We are not big enough for that. They just throw out 100 million of them and hope say 10 million of them get through and are not too worried if it is 10.0 million or 10.05 million. DPF

2 1

RE: [nznog] IP / domain blocking for SPAM prevention
by Michael Bordignon 25 Sep '03

25 Sep '03

> So the spammers can see what systems that have to beat to get > their crap through, no thanks. How are others supposed to learn then? trial and error? Michael

1 0

Re: [nznog] IP / domain blocking for SPAM prevention
by david＠farrar.com 25 Sep '03

25 Sep '03

> At 10:38 a.m. 26/09/2003, Claire wrote: > > Actually, at least one ISP in the NZ market already has a > 'Virtual Mail Server' ASP product out there, with Spam > and Content Control features coming in the next few > weeks. Probably an appropriate time for me to mention that one of the activities that the InternetNZ Spam Taskforce is looking at is an easy to access website where ISPs and others can list what spam technologies they use and have available (both at server level and for clients to use). Another aspect may be some sort of guide to commercial solutions. Want to avoid it being an "INZ says this is good or bad" but something where users can rate and review solutions so more people are aware of the limitations of Mail Marshall (as one example) or Mailwasher (great product, but bounce facility is inappropriate as it forges) as another example. Consumers Institute is also looking at doing a survey in the near future, and we may team up with them to do one combined survey. DPF

2 1

Xtra outage?
by Juha Saarinen 25 Sep '03

25 Sep '03

So what was the deal there? The Xtra network status page is indecipherable. No idea what "Period: inactive" means, but it looks like customers in 03, 06, 07 and 09 areas couldn't dial into Xtra. Did this affect other ISPs too? -- Juha Saarinen

3 6

FW: Your e-mail message was blocked
by Richard Parkinson 25 Sep '03

25 Sep '03

I tend to turn all this notification stuff off though, so MM doesn't harass the sender for a legitimate email :) -----Original Message----- From: Actionline(a)med.govt.nz [mailto:Actionline(a)med.govt.nz] Sent: Friday, 26 September 2003 11:42 a.m. To: Richard Parkinson Cc: Frank.March(a)med.govt.nz Subject: Your e-mail message was blocked MailMarshal (an automated content monitoring gateway) has stopped the following e-mail as it may contain Inappropriate Content. Message: B00013e871.00000001.mml From: Richard(a)sigel.co.nz To: Frank.March(a)med.govt.nz Subject: RE: [nznog] IP / domain blocking for SPAM prevention If you believe the above e-mail to be business related please contact Actionline(a)med.govt.nz to arrange for the message to be released to its intended recipients. The blocked e-mail will be automatically deleted after 30 days.

1 0