But they have a right to ensure that, and by forcing you to put that traffic through their server first, they at least have an opportunity to check it. If they force it and don't check, I agree that's overly restrictive. But if they're checking, more power to 'em in my book. That may be true, but look at who you are dealing with. Many of them really don't have a clue how all this works, they just buy some mass-mailing email package specifically built for spamming, buy/make/scrape lists, and have at it. I'd wager that most of them bought the package from a spam they received. Regardless, they don't have a clue how it really works and why. Some of them don't even bother to change data in fields where it says "<changethis>". The kind of plumbing you are talking about, although relatively simple, is out of reach of their technical skill (which is negligible). ISPs are also dealing with worm- and bot-infected servers and clients on their networks spreading email-based infections or becoming remote platforms for spamming. Here we sit in 2004 and people still don't get that you MUST protect yourself from viruses, and that IF your machine becomes a vector YOU are responsible for it and YOU MUST clean it up. ISPs have long been chasing people who have infected machines who are mass-mailing worms to other systems in huge volume, and in many cases people do nothing about it because they don't know what to do and it isn't affecting their operation of their system as far as they can tell. Despite warnings from ISPs, coverage in mass-media, and monthly dire warnings from Nostradamus Symantecus, people still open attachments in email from people they don't know, and they still run their systems without any kind of virus protection, still connect their machines without a firewall (or turn it off because it's "getting in the way"), and set up their home wireless networks without security of any kind. The time spent by ISPs chasing the lazy and the clue-challenged is escalating, and they have to do something to relieve that, or the cost of that effort is going to be distributed to all of us. There has to be a balance. And people have to get used to the idea that the Internet isn't the Wild West any more. It was great when we were all students and working cooperatively to connect each other, share information, and experiment with the possibility that one day you'd be able to talk to someone behind the iron curtain surreptitiously about your theories in particle physics or what makes a really good beer. Times have changed. You can't just do what you want when you want, all for free or close to it, and demand that it work perfectly all the time as well. It's a global community, and you have to take responsibility for your role in it, work by its rules, and be adaptable as they change. I can't respond to this except to say that aside from the fact that this statement is inappropriately inflammatory and doesn't reflect well on your argument, it's completely baseless. Hmmm, I think that's a good use for a VPN (assuming that's a corporate service you're referring to). Or how about just choosing another port? Set up an MTA that will only forward to your Exchange server, and put it on port 50025. I'm not sure all MUAs allow you to configure the SMTP port, but all the ones I use do (and for the record, I mostly use Microsoft-provided MUAs). In any case, I don't think I'm going to change your opinion, and you certainly will not change mine. There's been some impassioned discussion of this topic on the NANOG mail list recently as well, I think people are as divided on it as you and I are. But I think everyone can agree that between spamming and mass-mailing worms, the simple elegant utility of email is being brutally tarnished. --Patrick

Uh, I guess I missed the "I'm a white-hat packet" bit in RFC 793. :-) They do block the offenders, but of course, they don't know who they are until damage is being done, or after. I think it's clear that closing outbound port 25 is first-order defensive damage control in their view. Think about it: if you were to get on <unnamed-ISP's> site right now and sign-up for a dial-up account (assuming no outbound filtering), how much email do you think you'd be able to push through that connection before they noticed and turned you off? Maybe, MAYBE they're monitoring bandwidth closely enough to detect the pattern, but still, you'd be at the noise level in that network for quite a while. More likely, they won't really notice until their abuse@ mailbox is stuffed with four-letter expletives. I'm guessing you could easily get a few hundred thousand, maybe even a million, out, and perhaps even cancel the account before anybody noticed the activity. To add insult to injury, do it on a bunch of the ISP's stolen accounts you bought from a guy who ran a phishing scheme. Or maybe just don't pay the bill, or pay it on a stolen credit card so the ISP gets the extra fines of a chargeback in addition to having to eat the operational costs. You're not being objective, IMHO. So, are you telling me your clients will know the difference and prefer to pay a higher price to have free access to port 25, at the cost of subsidizing the ISPs increased staff and expense to source and operate the kind of monitoring that can tell, in unfiltered real time, what's good traffic and what's bad (deterministically, I might add, lest they again incur your wrath), and crisply manage the thousands or tens of thousands of its customers who are unwittingly running mailbots and can't figure out how to stop it or deal with it? I agree completely with this, but unfortunately it's all we've got right now... Band-aids. There are fundamental flaws in the protocol that need to be addressed, and beyond that is the migration of every client and server to those newer or updated protocols. The protocol was fine when duty and honor ruled the Internet. That was short-lived, and the new reality is that an unauthenticated protocol will be abused to the very limits of its capability, even to the eventual exclusion of its legitimate use. Earthlink did the same, and I'll readily confess that I was pretty steamed when they did it, until I had time to reason it out, understand why, and come up with a workaround that I was satisfied with. But I didn't like being surprised by it. But now that several large ISPs have undertaken this practice, I can honestly say that I do see a reduced volume of spam from cable, DSL, and domestic dial-up connections into our network. It has done nothing to reduce volume from non-US providers, though, of course. And if what you say about optonline.net is true, then I'll also give them an "atta boy" for doing it (but not the way they handled it). That's a very familiar domain in my world as an identified spam source. I'll probably get a benefit I can measure, at least until the bad guys find another ISP who hasn't done it yet. Well, if I had a dollar for every time we got blamed for another ISP's activities (or that of the client themselves), I wouldn't be writing this That's even less effective! Given that most ISPs are moving to dynamic addressing, that's even more of an inconvenience to the customer. Give them a consistent limitation (like blocking outbound 25) and the customers can wrap their ears around it, and eventually adapt. Make it random (which is what IP blocking is in the customer's perspective, because they get what they get invisibly) and they'll flail. By example, I had this problem recently with my next door neighbor: My company provides web, domain, and mail service for her (a "friends and family" deal). Recently, she tried to send some email, and our MTA blocked it because the IP address she was using (SBC ADSL/dynamic) was on the SpamHaus SBL/XBL. She's not a spammer, for sure, and she had no worms or virii. But, apparently some other person who had been temporarily assigned that IP address perhaps 30 minutes, two hours, or even two days before wasn't as clean and someone put the address on the list. She had to call SBC and ask that they submit a request for removal from that list (guess how well that call went?). Ultimately, I reconfigured my MTA so that anyone who successfully authenticates POP3 will not be screened through the SBL. It opens a small hole that I have to manage, but the kind of customer I deal with is highly unlikely to spam. The use of dynamic addressing also means that the source can move faster than you can block it. In fact, the real, identifiable source is the destination port, not the source IP address, and hence the obvious choice. I don't think a large ISP would choose to do this arbitrarily, and more, I don't think a large number of the largest of them would all do it if they weren't convinced that the benefit was worth the inconvenience they are creating to their customers. I lurk on NANOG and learn a lot, and it's clear to me that these guys talk and think through things extensively before they start making systemic changes like that. The business side may forget to tell you, but that's a different problem. And if the inconvenience of the unauthenticated protocol being "hobbled" forces people to move the authenticated protocols, I'm even more in favor of it, because it's where we need to be. Helping a client get a stable, secure email connection is time well spent in my opinion, for reasons that go beyond the issue of spam. --Patrick

John Lawson wrote: Good that you said "naive". I don't believe in dumb questions. ;) Because there are typically only 2 steps where the mail is handled as mail, rather than routed raw packets. (Ignoring redirected mail and such) The user's "outgoing mail server" and the destination domain's mail exchanger are those two steps. Both hosts *should* have controls in place which evaluate and limit what is accepted and what is passed on. Transactions per second per submitting host is available as a control. If any majority percentage of mail servers used the available anti-spam software and safeguards, there wouldn't *be* a spam industry. The root issue is the same as it ever was - uninformed and apathetic administrators. Doc

John Lawson wrote: Have you ever forwarded a 'joke' to multiple people? That action would trigger both your 'throttling mechanism' and your 'substantially similar' mechanism. So, what you are proposing is the elimination of 'joke' email. ...which may not be a bad thing, having received a lot of bad ones... Haven't you wondered about the random garbage words attached to many spam messages? That is to make tests such as this harder. All you would do with a measure like this is to cause more random garbage being attached to spam. Spammers are not sitting on their thumbs ignoring all new measures being implemented.

On Friday 03 September 2004 10:16, David V. Corbin wrote: HAHA! If I were a coffee drinker, my keyboard would be doused by now. :) Pat -- Purdue University ITAP/RCS --- http://www.itap.purdue.edu/rcs/ The Computer Refuge --- http://computer-refuge.org

DSL Extreme, my upstream, requires you to register your IPs (thus you must have a static address) before you may use them to send outbound mail. I received notification of this when I signed up, easily added my IP through a configuration web page, and received confirmation the next day. So, ISPs can do things correctly when they try. -- ---------------------------------- personal: http://www.armory.com/~spectre/ -- Cameron Kaiser, Floodgap Systems Ltd * So. Calif., USA * ckaiser(a)floodgap.com -- BOND THEME NOW PLAYING: "On Her Majesty's Secret Service" ------------------

That's not the point. The point is if they are doing it from the ISP's own SMTP server, then the ISP can immediately and with certainty know exactly which of their customers is doing it, and has their contact information, and can deep-six their account (or send out cousin Guido in the middle of the night). A different ISP doesn't have easy access to that information. that job. I gotta disagree. I've seen many wonderful technologies and projects ruined by suggestions from business (ie. marketing) people. Look at the microsoft product "BoB" *GRIN* Just kidding actually. Sorta. Jay --- [This E-mail scanned for viruses by Declude Virus]

Not as many as a few years ago and Uncle Sam gets quite a byte out of them, but still not too bad... Choose one of the following: 1) Where Where Where????? or 2) Just don't tell my wife. 2000 Saturn SC2 - Althoguh New York insurance rates DO make it expensive! Doe this message count? My InBox runnig over...Especially those messages offering to introduce me to supermodels and provide a chemically enhanced body to enjor them with. It will be grat once I get the $1,000,000 from that Nigerian exile....

Yes, it WILL decrease spam, but so would pulling the plug on the entire net. Seriously, look at the entire route a piece of spam takes and who it impacts. The generation of a large number of e-mails definitly impacts the people who RECEIVE them, the networks that CARRY them, the servers that GENERATE them. IMNSHO any of these people are quite within their rights (and even responsibilites) to block them. If my ISP had determined that the SMTP server at somespammer.net was being a bad boy, then let them blacklist that server. As I stated before, this policy (blocking outbound SMTP) does not impact the millions of people who are generating spam outside the ISP and ten clogging the ISP bandwith and my Inbox with spam. A polict of blocking both inbound and outbound traffic to specific IP addresses would address this also. Even setting a default of blocking all port 25 access would be reasonable IF THEY WERE WILLING TO OPEN SPECIFIC IP's upon reciept of a document validiting the need for the access. True, but what would you do IF your ISP decided do block those ports (maybe they just don't like the numbers). Consider the impact on you (especially reporting that they could not send e-amil and were blaming you [especially until you figured out WHAT was happenin!]. That is what /I have put up with this week..... Except for as mentioned above!

The anger, resentment, heat does come from the lack of warning, but I still think my rational arguments hold. Te servers I am talking are dedicated boxes which I (Dynamic Concepts Development Corp) own are are co-located at a datacenter in Denver [with backup servers in other states!]. And yes, I can use VPN's or other means to establish connectivity, but they have their own issues (notably cost althoguh that has come down). It is practically impossible for some one to be "connected to the net" without the use of some type of provider, although I often wish I had a fiber connection with Cogent here at my home office, rather than just at the DataCenter(s)......