Slashdot Log In
Perspectives on Spamhaus's Dilemma
Posted by
kdawson
on Mon Oct 09, 2006 01:59 PM
from the oh-dearie-me dept.
from the oh-dearie-me dept.
The Illinois court that told Spamhaus to stop blocking the spammer filing suit against them — an order which Spamhaus ignored — is now considering ordering ICANN to pull Spamhaus's domain records. While Gadi Evron, whose blog posting is linked above, urges everyone to beat the judge with a clue stick, a guest writer on his blog counsels much greater restraint. Anti-spam lawyer Matthew Prince explains how Spamhaus got into its current pickle — apparently by following conflicting legal advice at two points in the process — and what they might have to do to get out. One spamfighter of my acquaintance says that Spamhaus's SBL and XBL blocklists knock out 75% of the spam at his servers before it hits and requires more CPU-intensive filtering. If ICANN is ordered to unplug Spamhaus from the DNS, and does so, is the Net prepared to deal with a 4-fold increase in spam hitting MTAs overnight?
Related Stories
[+]
IT: Spamhaus to Ignore $11.7M Judgement 471 comments
6031769 writes, "As reported on CNet, Spamhaus is choosing to ignore a judgement of $11.7M against them in an uncontested trial in an Illinois court. According to Spamhaus, the judgement has no impact on them, since they are a British organization." From the Spamhaus reply to the judgment: "Default judgments obtained in US county, state or federal courts have no validity in the UK and can not be enforced under the British legal system... As spamming is illegal in the UK, an Illinois court ordering a British organization to stop blocking incoming Illinois spam in Britain goes contrary to UK law which orders all spammers to cease sending spam in the first place."
[+]
IT: One Last Spamhaus Warning Before The End 632 comments
kog777 writes to mention that Spamhaus has released a final warning about an increase in junk email, as they prepare to lose their domain to an Illinois court ruling. From the article: "According to Spamhaus, more than 650 million Internet users - including those at the White House, the U.S. Army and the European Parliament - benefit from Spamhaus' 'blacklist' of spammers that helps identify which messages to block, send to a 'junk' folder or accept. Losing the domain name would make it more difficult for service providers and others to obtain the lists. 'If the domain got suspended, it would be an enormous hit for the Net,' said Steve Linford, Spamhaus' chief executive officer. 'It would create an enormous amount of damage on the Internet.'"
[+]
Slashback: ICANN, OLPC, Agile, Yahoo, BayStar 84 comments
Slashback tonight brings some clarifications and updates to previous Slashdot stories, including: Spamhaus case tests ICANN; Getting your own OLPC (CM1) computer; Followup Agile commentary from Steve Yegge; Yahoo's time capsule permit revoked by Mexico; and Microsoft denies BayStar connection. Read on for details.
[+]
Email Servers Will Choke, Says Spamhaus 576 comments
Rub3X writes, "The legal battle between antispam organization Spamhaus and e360 Insight is heating up. Spamhaus has a user base of around 650 million, and its lists block some fifty billion spam emails per day, according to the project's CEO Steve Linford. Spamhaus CIO Richard Cox says the immediate issue is that if the domain is suspended, the torrent of bulk mail hitting the world's mail servers would cause many of them to fail. More than 90% of of all email is now spam, Cox says, and he doubts that servers worldwide would be able to handle a ten-fold increase in traffic." Others estimate Spamhaus's blocking efficacy as closer to 75%; by this metric spam would increase four-fold, not ten-fold, if Spamhaus went unavailable. The article paraphrases CIO Cox as saying that the service will continue "even if there is a short-term degradation."
[+]
Judge Rules In Favor Of Spamhaus 232 comments
Waylon writes "U.S. District Judge Charles Kocoras has ruled in favor of The Spamhaus Project. e360 Insight responded on its homepage, saying the judge's ruling was 'a devastating loss of personal freedom for all U.S. citizens'. As opposed to shutting down a voluntary service which tries to mitigate the millions of unsolicited emails that e360 Insight pumps out every single day." From the article: "In his order, Judge Kocoras wrote that the relief e360insight sought is 'too broad to be warranted in this case' and that suspending the domain name would 'cut off all lawful online activities of Spamhaus, not just those that are in contravention' of the default judgment. He also called e360insight's motion one that 'does not correspond to the gravity of the offending conduct.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Ghostbusters (Score:5, Insightful)
Yeah, I know it's just fiction but it seems like this could be the same kind of thing.
Excerpt from the movie:
Dr. Ray Stantz: Everything was fine with our system until the power grid was shut off by dickless here.
Walter Peck: They caused an explosion!
Mayor: Is this true?
Dr. Peter Venkman: Yes it's true.
[pause]
Dr. Peter Venkman: This man has no dick.
Walter Peck: Jeez!
[Charges at Venkman]
Mayor: Break it up! Hey, break this up! Break it up!
Walter Peck: All right, all right, all right!
Dr. Peter Venkman: Well, that's what I heard!
I think the problem that the Ghostbusters faced in the movie was that the guy from the EPA was a prick and didn't bother doing any follow up or open a channel of communication with the Ghostbusters. Now, Spamhaus might be violating rules at the same time they provide the public a valuable service. Has the United State's judicial system attempted any lines of communication with them aside from a cease-and-desist letter threatening them with $11.7 million?
Where does it say that e360insight is a spammer? I think that Spamhaus should have to present proof that e360insight is an illegitimate spamming business [spamhaus.org]. I think that's important. If e360insight is a spammer, I'm siding with Spamhaus. Since they have taken the roll of deciding who is spamming and who isn't, I think they could use more accountability [spamhaus.org] than what I find indicated on their website.
Re: (Score:3, Interesting)
Except that Spamhaus is not spam filtering or blocking software. It's merely a DNS da
Re: (Score:3, Interesting)
If it wasn't for spamhaus and other blocklist services, it would be up to individual administrators to create their own blacklists (most savvy admins do anyway BTW...) Now I don't know about other admins, but once you are in MY blacklist, you are there FOREVER. If you are in 4,556,865 blacklists, good f-ing luck getting out. Being on ONE list you have a chance.
The other option is a reputation based system where "trusted" submitters send blacklist updates via usenet (GPG signed.) Since
Re:Ghostbusters (Score:5, Insightful)
Parent
Re:Ghostbusters (Score:5, Insightful)
They just should be careful enough to widely publish their new .co.uk address before the hammer hits, so that we can reconfigure our MTA's in time.
Indeed, a fart is not really a fart if it doesn't smell...
Parent
Re: (Score:3, Informative)
It's spamhaus.org.uk [spamhaus.org.uk].
spamhaus.co.uk is an unrelated site flogging antivirus software
Reconfigure your MTAs NOW.. (Score:4, Interesting)
- Use IP numbers or
- host a domain resolution for spamhaus in a local name server and configure your MTA to hit that first. (Have your nameserver serve as an unofficial secondary pointing to their primaries, and squirrel a dump of their name service just in case the court gets their primaries shut down.)
Then ICANN can pull the record and it won't do squat.
For your convenience (from nslookup):
> server 204.74.101.1
Default Server: udns2.ultradns.net
Address: 204.74.101.1
> set type=soa
> spamhaus.org
Server: udns2.ultradns.net
Address: 204.74.101.1
spamhaus.org
origin = need.to.know.only
mail addr = hostmaster.spamhaus.org
serial = 2006100802
refresh = 3600 (1H)
retry = 600 (10M)
expire = 2419200 (4W)
minimum ttl = 3600 (1H)
spamhaus.org nameserver = udns2.ultradns.net
spamhaus.org nameserver = udns1.ultradns.net
spamhaus.org nameserver = ns8.spamhaus.org
spamhaus.org nameserver = hq-ns.oarc.isc.org
ns8.spamhaus.org internet address = 216.168.28.44
(I'm presuming that the spamhaus.org domain contains the
servers in question. But if not, perhaps someone who
actually administers an MTA using their services can
follow up with the necessary info.)
Parent
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re:Ghostbusters (Score:4, Interesting)
That's a perfectly reasonable attitude, provide you are aware that the chinese business will, therefore, win their lawsuit in a chinese court. If you have no assets anyplace that a chinese court could get to, then you are fine. Just don't miscalculate, ignore them, lose to a default judgement, and then remember that you do have stuff in China!
Also, you have to be careful HOW you ignore them. For example, if you start to defend yourself on the merits, and then say "screw this...you don't have any jurisdiction over me, so bugger off" and THEN start ignoring them, that initial defending on the merits might be seen as conceding jurisdiction to the court. That's bad, because then when the winner comes to your country to collect, there is a decent chance your country's courts will recognize the debt as a valid debt, and then it is a simple matter for that Chinese business to get a judgement in your country to enforce the debt.
The bottom line: ignoring a court anywhere in the world is not something to take lightly. You need to at least get a lawyer with experience in the laws of your country to tell you HOW to ignore the foreign court so that you won't accidently open yourself up to a nasty surprise.
Parent
Re:Ghostbusters (Score:4, Insightful)
This is an opt-in DNSBL. So your little "free speach" defense doesn't work.
Even considering SPAM to be free speach, it doesn't hold up. The people subscribing to the DNSBL are doing do with their own private property. Your right to free speach ends on my property, just as your right to swing your arms wherever you want ends at my nose.
Parent
Re: (Score:3, Informative)
The network belongs to the company who built and operates it. No one else has any rights on that network. If you're buying bandwidth/an email address/hosting, etc., your contract with them may give you certain rights, but those rights are arbitrary and may or may not include any amount of free
Perspective from a damaged party (Score:5, Insightful)
Let me put an alternative perspective to the AC e-mail security guy who wrote the parent post.
I am the IT officer for a local non-profit organisation, with a few thousand members. We run a mailing list, to provide announcements to those members. The list is opt-in (double opt-in to verify all addresses, in fact) and moderated, and everyone on it has explicitly asked to be there.
Our service provider has recently sent a notice to their announcements list (to which I subscribe) indicating that certain major names, including Hotmail and AOL, are no longer accepting mail from our provider. They don't even bounce it properly; they silently drop it. This is all done in the name of fighting spam, so they claim, because our service provider forwards a lot of spam onto them. (Our service provider forwards any mail received at a paying customer's address to any forwarding address requested by that customer, in fact.) The content of any given mail, and the specific people it's going from and to, are irrelevant to this blanket ban.
As a consequence of this, we now find that some of our members who use e-mail accounts at those hosts are not receiving mails they have explicitly asked for. Neither we, nor our members, nor our service provider is doing anything unreasonable. The only reason this system is broken is because of an arbitrary decision by a big name provider to throw their weight around, by blocking all incoming mail from a small provider (who are not the only ones being hit by this problem -- far from it, by the sounds of things), even if this goes against the explicit wishes of one of their own paying customers.
Now, you can rationalise that decision all you like as a big IT honcho, but the simple fact is that these organisations are screwing their own customers, and ultimately undermining the entire working of the Internet e-mail system, by being incompetent and not playing nice with others. Sooner or later, people are going to start missing really important messages as opposed to just convenient or entertaining ones, and those providers are going to learn a harsh lesson. I imagine a few small providers will start bringing anti-competition lawsuits if the big names carry on down their current road as well. But in the meantime, your approach sucks for your customers, it sucks for people working with your customers, and it sucks for other service providers working with you. It is an indefensible attack on the openness of the Internet, and you deserve to be shot down for it.
Parent
Re: (Score:3, Insightful)
You are right and I agree. Death to s
Re: (Score:3, Funny)
In a nutshell: I agree, the Illinois has no dick.
Obviously this is wrong - it has a huge dick who wears a black robe.
Would you like spam with that? (Score:4, Interesting)
On the plus side, that might convince the judge to rethink the order.
Re: (Score:3, Interesting)
what pisses me off... (Score:5, Insightful)
Damn, judges really should be expected to have a clue when sitting in on a case...
The Q-Tip Solution... (Score:5, Insightful)
Parent
Hopefully ICANN is rational (Score:4, Insightful)
Re:Hopefully ICANN is rational (Score:5, Insightful)
Parent
Re: (Score:3, Interesting)
I hate to bring up that whole slippery slope thing, but we can't just have courts ordering names removed from DNS. What's next? Porn sites? Music sharing? Terrorists? Communists? Democrats? Without an independent, (relatively) impartial name registration/IP address management system the whole concept of a glo
Re:Hopefully ICANN is rational (Score:5, Insightful)
If ICANN start ordering UK websites down at the request of random US courts then that'll be a pretty hard push in that direction. Even the americans aren't that bloody stupid.
Parent
Re:Hopefully ICANN is rational (Score:4, Insightful)
Parent
What'll happen if spamhaus disappears from DNS? (Score:2)
Re:What'll happen if spamhaus disappears from DNS? (Score:5, Informative)
Um... you are aware of how Spamhaus's list is distributed, right?
You convert the IP address of the server you're trying to check into a host name, such as W.X.Y.Z.sbl.spamhaus.org, then do a DNS lookup on that hostname. The result you get indicates whether the original IP is liste or not.
Trust me, you don't want to put 4 billion records in your hosts file!
Parent
Re:What'll happen if spamhaus disappears from DNS? (Score:5, Informative)
You would be trying to use their DNS server as a recursive resolver. DON'T do that! It wouldn't work and you'd be an annoyance to them.
I suggest you read about DNS before doing things of which you don't understand the impact.
What could work is running BIND and doing something along the lines of
zone "spamhaus.org" {
type forward;
forwarders <their ip address>;
};
Parent
Re: (Score:3, Informative)
I don't think ICANN even give out IP addresses in the US.
Plus if they did everyone would probably ignore them anyway.
ICANNot do it cap'n! (Score:4, Interesting)
Confusing ICANN with the court (Score:3, Informative)
The original poster was talking about ICANN not being able to do anything, and rightly so. I haven't read the contract between PIR [pir.org] and ICANN, but I doubt it includes the ability for ICANN to remove specific delegations from the
You are correct that the court could theoretically size the servers that are located in the USA, although I'm not sure what the legal
ICANN abuse (Score:4, Insightful)
Jurisdiction (Score:5, Insightful)
US court
US spammer
UK RBL
Re:Jurisdiction (Score:5, Informative)
That is libelous nonsense. The post, which sounds like it was written by a spammer, probably refers to Spamhaus' Data Feed service [spamhaus.org] for ISP's and large organizations. You can easily see with the price check on that page that the costs per year, even for large sites, are nowhere near such amounts and are simply designed to cover the costs of the operation (including their free public DNS query servers). Don't believe something just because some kook posted it in a discussion forum.
Parent
Go ahead - there's ALWAYS a workaround (Score:5, Informative)
# cat >>
zone "spamhaus.org" in {
type forward;
forwarders {216.168.28.44; 204.69.234.1; 204.74.101.1; 204.152.184.186; };
};
^D
# pkill -HUP named
All fixed!!
Um, the problem was that they switched horses... (Score:5, Informative)
Then they claimed it didn't.
I can't think of anything more likely to P.O. a judge than to ask to get into his courtroom, then call him a buffoon.
In the end, as the article says, ICANN may be forced to pull 'spamhaus.org', but ISPs that use it are savvy enough to move to using 'spamhaus.or.uk' or something similar, outside the court's control. But the individuals affected by the order may be unable to set foot in the U.S. for the rest of their lives, even to change planes.
This could be the end of U.S. DNS control (Score:5, Interesting)
If U.S. judges think they have carte blanche to impose their laws on foreign entities using domain listing as a weapon then we absolutely MUST get DNS control the heck out of U.S. control, i don't care what DARPA thinks they invented decades ago. The status quo currently is bad enough as it is, but if one person in a robe is going to single handedly eliminate the backbone of the international anti-spam war when the service is based in a foreign country, run by non-U.S. citizens and it's a voluntary subscription service then something drastic needs to be done.
The notion that the U.S. can 'summon' foreigners to defend themselves in U.S. domestic courts is deeply flawed to begin with. It's just amazing that anyone can mock the Chinese for their 'great firewall' when the U.S. is prepared to yank a site from the ENTIRE WORLD, and think they can just because it's domain name is published on a U.S. machine when that is mandated by an historical quirk.
Is it time we gave the United States their little
Re: (Score:3, Informative)
Truthfully, your comment smacks more of blindly uninformed anti-Americanism and unadult
Re: (Score:3, Insightful)
1) The U.S. hasn't summoned Spamhaus to appear in court. According to the court documents posted so far, Spamhaus was never served with this lawsuit.
2) The U.S. so far hasn't shown any willingness to yank the site. Rather, there's a _proposed_ order from a Federal judge in the Northern District of Illinois which would yank the site. IANAL, but I know a court's powers to compel third parties are limited, and there might be an issue of that district's jurisdiction over IC
I'm amazed (Score:5, Insightful)
I'm amazed at the knee-jerk reaction of so many people here. I hate spam as much as the next person, but claiming that the judge is ignorant, stupid, or malicious is ridiculous. The fact is, Spamhaus responded to the suit in the most inappropriate way imaginable, by acknowledging the federal court's jurisdiction and thereafter ignoring it. If you get a traffic ticket, even if it is unwarranted, what would you expect to happen if you turn up in court, then walk out and refuse to communicate any further with the court? What Spamhaus has done is the equivalent, only federal judges have a LOT more power. Spamhaus should either have challenged the court's jurisdiction from the outset or, having accepted it, complied with its orders and defended the suit.
Other than Spamhaus trying to correct the situation, I wonder if third parties might be able to submit an amicus brief to the court along the lines of: "Yes, Spamhaus behaved liked idiots, but cutting them off is not in the public interest.":
Re: (Score:3, Interesting)
Re: (Score:3, Insightful)
No, sorry. You've ignored my argument. This is Spamhaus's fault, not the judge's. The judge was correct in ruling against Spamhaus since Spamhaus failed to defend the suit, and as a non-techie cannot be expected to realize what the consequences of taking down Spamhaus would be. Had Spamhaus behaved responsibly, they might well not have lost the suit, but if they had, they would have had the chance to explain to the judge the consequences of different remedies.
Juristiction my ass (Score:5, Interesting)
1. Spamhaus isn't in Illinois
2. Spamhaus isn't even in the US, no business presence on US territory at all.
3. Spamhaus only connection to the US is US companies utilize the service.
Based on that Illinois can only go after companies that use the database, not the provider overseas. They don't market or have any presence in the US. The court likely could go after these companies. Will they?
Now what I'd love to see is Illinois try and go after everyone in the US using the database... go ahead and try. I'll keep using it because it's a good effective database.
I've got a feeling there's money behind this ruling. It just sounds to fishy to be legitimate.
IF... (Score:3, Informative)
If so, I sincerely hope that somehow the increase in SPAM to the judge's court is even higher - at least double that.
The only way that folks who purposely damage the system for the majority of users will learn, no matter that it may be just not understanding what they are doing, is if they see a direct effect - a strong direct effect - on their own personal use of the system.
--
Tomas
Chicken Little FTL (Score:3, Interesting)
Not gonna happen.
Total number of recipients logged in one maillog file: 92033
Total number of messages in this logfile that got a SpamAssassin score increase thanks to XBL or SBL listing: 47818
Total number of scores that may have potentially been pushed over our threshhold (9.0) by the SBL/XBL score: 985
Big effing deal. All the RBLs could go offline this afternoon, and it would have minimal impact on our spam scoring system. It isn't necessary for any RBLs to exist to control spam. It just isn't.
Re:Chicken Little FTL (Score:4, Insightful)
My current estimates say that $ORK is blocking ~ 400 to 500 million messages a day using DNSBLs, about 80% of which is the sbl-xbl.
Parent
Re:Its a stupid arguement. (Score:4, Funny)
Also, we can express our concerns directly to them at http://www.e360insight.com/contact.php [e360insight.com]. They were nice enough to have a comment submission form. I hope they have a lot of disk space for submitted comments.
Parent
Big PDFs (Score:3, Informative)
Re:Perspectives (Score:5, Insightful)
You obviously don't run a mail server with > 1 user. The sbl-xbl list stops ~ 80% of our spam. That's for a small email service provider, defending only about 75 million email addresses.
Bayesian doesn't stop spam. It just flags stuff as possible spam. Humans are worse filters than any software. If you have to look for false positives in a spam folder, don't even bother to filter stuff. That is just a waste of CPU cycles.
On the smaller servers I run, recipient validation handles ~ 50% of the spam, the sbl-xbl stops ~ 80% of the rest, dynamic IP blocks and hostname checks stop the remaining.
Parent