On 2023-09-07 20:02, David W. Hodgins wrote:
> On Thu, 07 Sep 2023 17:43:05 -0400, bad sector <forgetski@invalid.net>
> wrote:
>> I don't know what spam-trap criteriae ARE, almost ALL people I know
>> don't either. Instead of bouncing MY emails why don't they email me with
>> the details that caused MY email to trap? And IF it's not MY email then
>> block the guilty IP address but not others at whichever single ISP, not
>> to mention chains of ISP's.
>
> The uceprotect block list doesn't actually block any email. The who are
> receiving
> the email, or the administrator's running their mail servers choose to
> use the
> uceprotect list. It's clearly explained how it works on their website,
> so those
> who are choosing to use it are doing so knowing full well that innocent
> customers
> of spam enabling isps will be caught up in it.
>
>> So if I get spam from some mookmook in timbucktoo then it's ok to nuke
>> the whole continent; sickening microcancerish bullshit.
>
> As the recipient, that's up to you. Sending email does not give the
> sender the right to force others to accept it. The recipient has the
> choice of whether or not to accept it.

That's debatable if the recipient is a business. Or anyone that has to
be publicly contactable, like government offices, say.

....

--
Cheers,
Carlos E.R.

On Fri, 08 Sep 2023 03:07:00 -0400, J.O. Aho <user@example.net> wrote:
> All serious blocklists has a mechanism to be removed from the list,
> which do not involve loads of money.

To get the ip addresses unlisted all the isp has to do is stop sending
spam. After 7 days, it's automatically unlisted. No payment required.

The list is fully automated. If individuals want to pay to get an innocent
ip address unlisted instead of moving to an isp that doesn't support spam,
or getting that isp to stop supporting spam, then they have to pay for the
time of the admin to do that work.

Do you work for free?

Regards, Dave Hodgins

On Fri, 08 Sep 2023 10:11:28 -0400, Carlos E. R. <robin_listas@es.invalid> wrote:
> That's debatable if the recipient is a business. Or anyone that has to
> be publicly contactable, like government offices, say.

There are regulatory rules that require some entities to retain records, including
received email messages. As far as I know, none of them require messages be
accepted and stored. The rejection logs would have to be kept, but not the spam.

Regards, Dave Hodgins

On 2023-09-08 11:02, David W. Hodgins wrote:
> On Fri, 08 Sep 2023 10:11:28 -0400, Carlos E. R.
> <robin_listas@es.invalid> wrote:
>> That's debatable if the recipient is a business. Or anyone that has to
>> be publicly contactable, like government offices, say.
>
> There are regulatory rules that require some entities to retain records,
> including
> received email messages. As far as I know, none of them require messages be
> accepted and stored. The rejection logs would have to be kept, but not
> the spam.

That's correct. And yes, those logs suffice.

--
Cheers,
Carlos E.R.

On 9/7/23 12:09, bad sector wrote:
>
> My email domain keeps getting *blacklisted* on
> account of (as far as I'm able to determine)
> the fact that my Domain-Name Hosting provider
> falls under i.e.
>
> "..is part of AS 16276 OVH FR and the Networks
> 167.114.128.0/18
>
> Reverse DNS (PTR) exists and claimes to be:
> sohsu1.dns77.com
>
> Forward DNS for sohsu1.dns77.com is 167.114.138.246
>
> This IP is not registered at ips.whitelisted.org"
>
> I got this in a UCEPROTECT report from a store
> whose email to me I could not reply to and who
> stand to lose money on account of it (I stand to
> lose a lot of time!!).
>
> I put this SCAM in the same drawer as spam phonecalls
> to avoid which one has to register oneself on a
> white-list of people who do NOT want unsolicited
> phonecalls. Seems to me that it's those who DO want
> them that should have to register. It all smells like
> shit. What are my options to avoid crap like this?

This may have been linked in the thread, I've lost track in the dizzying
debate, realtime check of your IP:

The complete IP check for sending Mailservers

https://multirbl.valli.org/lookup

When I drop it into my web navigator it checks my internet conection IP
address (use the e-ail option fro hosted web or email IP) but this too
has a lot of red in it, go figure. It is an entirely legit and MAJOR isp
who sells wholesale bandwith to a community radio network. I understand
that (and here I get into the networking tech tunnel where I have no
business being) some eyebrows get raised because several cutomers share
distribution antennas and maybe IP's, a mortal sin and definite no-no in
big-brother land where every user MUST be fully traceable, provide the
eye with a 7/24 streaming colonoscopy while also being continously
'accessible' by a smartphone that does sport a decorative OFF button but
can never be really turned off.

On Fri, 08 Sep 2023 17:04:06 -0400, bad sector <forgetski@_invalid.net> wrote:
> The complete IP check for sending Mailservers
>
> https://multirbl.valli.org/lookup

Thanks. I didn't know about that one.

Reminds me though, one of the reasons uceprotect is used by many, is that some
isps have a history of dealing with spammers by given them one ip, then when that
ip address gets blocked by too many other systems, moving the spammer to another ip
address and giving that ip address to a non spammer who then has to do the work to
get it delisted.

I stopped reporting spammers to their isp a long time ago. I don't remember if
OVH was one of those who was caught moving their spammers around or not.

Regards, Dave Hodgins

On 2023-09-08 19:16, David W. Hodgins wrote:
> On Fri, 08 Sep 2023 17:04:06 -0400, bad sector <forgetski@_invalid.net>
> wrote:
>> The complete IP check for sending Mailservers
>>
>> https://multirbl.valli.org/lookup
>
> Thanks. I didn't know about that one.
>
> Reminds me though, one of the reasons uceprotect is used by many, is
> that some
> isps have a history of dealing with spammers by given them one ip, then
> when that
> ip address gets blocked by too many other systems, moving the spammer to
> another ip
> address and giving that ip address to a non spammer who then has to do
> the work to
> get it delisted.
>
> I stopped reporting spammers to their isp a long time ago. I don't
> remember if
> OVH was one of those who was caught moving their spammers around or not.
>
> Regards, Dave Hodgins

If we exterminated them then we wouldn't have all this overhead. I
consider them harmful vermin because by continuously probing for
untraceable broadcasting they're actually training big-bro to
systematically close every hole, and there went freedom of speech!

Am 08.09.2023 um 08:03:23 Uhr schrieb bad sector:

> On 9/8/23 05:01, Marco Moock wrote:
> > Am 07.09.2023 schrieb bad sector <forgetski@INVALID.net>:

> > I know that your situation is bad, but the only way to permanently
> > go out of that is running your own servers in your own AS.
>
> No cigar. That sounds like a penalty to exercise a far more
> fundamental freedom.

I agree that this is a penalty to the ISP/hoster, although there is no
other way for them to learn that the need to do something against
spammers.

Be aware: The blocklist doesn't block you from sending emails, it
simply instruct the mail server of the recipient's domain to reject it.
The admin of a mail server can decide which mail he/she wants to
receive, they could also say that they block all @gmail addresses or
all mail at weekend.
If you want free speech to others, the need to be their own server
operators.

> >> The self-appointed netcops they should erect sanctions against the
> >> spam originators on a much more specific level through
> >> international cooperation and legistlation.
> >
> > Technically this is not possible. They only reliable source is the
> > address of the server transmitting the spam to the target. The real
> > author can be easily forged.
> > The idea is to make the server operators ban such users and try to
> > limit abuse as much as possible.
> > Most operators do that, some don't. Some companies love spammers as
> > customers. Nobody wants spam from them. The victim are innocent
> > customers of the same company.
> >
> >> As it is I agree with J.O. Aho, when you blacklist and demand money
> >> to be expeditiously unlisted that's called extortion and is a crime
> >> in most human circles. Just like the telephone spam-lists, I will
> >> have NO PART OF IT.
> >
> > They only want money to unlist you immediately.
>
> Here we enter another consideration. The merchant in question told me
> that they receive daily reports of the blocked emails (if I
> understood correctly, their IT guy was pretty arrogant and talking
> down to ME like "I" was some criminal, I who as the paying customer
> put supper on this family's table for crissake). Anyhow, IF it's true
> that they receive a list of originators blacklisted that day then
> THEY should fork out the money to have them immediately unlisted. NOT
> doing so means they don't really want you as a paying customer; and I
> can live with that, there ARE other merchants out there.

There is an automatic mechanism that removes the addresses from the
blocklist after some days, see the delisting policy.

http://www.uceprotect.net/en/index.php?m=7&s=6

Immediate delisting requires manual work that needs to be paid. I can
understand that.

Am 07.09.2023 um 22:36:30 Uhr schrieb Carlos E. R.:

> On 2023-09-07 20:01, bad sector wrote:
> > On 9/7/23 15:24, J.O. Aho wrote:
> >> On 07/09/2023 18:09, bad sector wrote:
>
> ...
>
> >>> What are my options to avoid crap like this?
> >>
> >> Use a big email service provider like protonmail, gmail,
> >> office365, you still will be paying for them to host your mail
> >> with your domain.
> >
> > It's really weird that one of the very reasons I like having my own
> > mail server is exactlty a way to protect against spam. I set up
> > (unlimited) email addresses or forwaders with the cPanel front end
> > and use dedicated ones for different contacts. If one address gets
> > spam I know who leaked! Trying to get a deal like that from the
> > other retail chiselers would cost me $5 per address per week but my
> > name is Santa Claus!
>
> Most people don't ever need that.
>
>
> > Getting back to blacklisting, there's something that bugs me. I am
> > however speaking as a server-ignorant end-user which also means
> > outside of the techno tunnel. SPAM as such cannot be anon, or it
> > wouldn't work because its purpose is to sell something so the
> > victimn has to have a way to respond and THAT is surely traceable.
> > On the other hand freedom of speech does not exist if anon speech
> > does not. So what are we looking at here, a war on freedom of
> > speech which is not only a right but a civic duty, or a war on spam
> > which isn't anon anyway? Food for thought, doesn't the right to
> > absolute freedom of speech far outweight the right to no spam?  And
> > by that I don't mean to tolerate spam but to call a spade a spade.
>
> There are many kinds of spam.
>
> On the spam that tries to sell you "something", there is always a way
> to identify them, because obviously you need to contact them somehow
> to buy whatever. BUT, you need international cooperation, police
> forces and courts. ALL countries.
>
> So, if all governments wanted, they could kill spam by simply putting
> in prison every spammer they find, one by one.

This doesn't work, because IP addresses can be used by multiple people,
machines can be hacked, etc..

> Also, the received headers can be investigated. The last one is
> always true, because it is your own mail server.

Only this one can be trusted, the rest can be forged.

> So you trace backwards, one by one... at some point, you need police
> and court cooperation from the countries traversed by the mail, you
> need the police going to that server and demanding the logs by force.
> In the end, after a lot of money, you can find someone to put in
> prison.

These headers are no evidence, they can be forged like mail addresses
or display names.

> Certainly, it may be coming from a compromised machine of some poor
> sod. Well, he must be fined for having a machine compromised, for not
> paying maintenance, for having faulty providers like M$.

Have fun fining millions of people with malware on their machines.

> After you fine a few thousands, people will take care.

I think they would stop using mail, because many are too stupid to
understand how not to infect their machines.

> But we will not get that level of international cooperation.

You cannot do that even in the same country.

On 2023-09-09 07:18, Marco Moock wrote:
> Am 07.09.2023 um 22:36:30 Uhr schrieb Carlos E. R.:
>
>> On 2023-09-07 20:01, bad sector wrote:
>>> On 9/7/23 15:24, J.O. Aho wrote:
>>>> On 07/09/2023 18:09, bad sector wrote:
>>
>> ...
>>
>>>>> What are my options to avoid crap like this?
>>>>
>>>> Use a big email service provider like protonmail, gmail,
>>>> office365, you still will be paying for them to host your mail
>>>> with your domain.
>>>
>>> It's really weird that one of the very reasons I like having my own
>>> mail server is exactlty a way to protect against spam. I set up
>>> (unlimited) email addresses or forwaders with the cPanel front end
>>> and use dedicated ones for different contacts. If one address gets
>>> spam I know who leaked! Trying to get a deal like that from the
>>> other retail chiselers would cost me $5 per address per week but my
>>> name is Santa Claus!
>>
>> Most people don't ever need that.
>>
>>
>>> Getting back to blacklisting, there's something that bugs me. I am
>>> however speaking as a server-ignorant end-user which also means
>>> outside of the techno tunnel. SPAM as such cannot be anon, or it
>>> wouldn't work because its purpose is to sell something so the
>>> victimn has to have a way to respond and THAT is surely traceable.
>>> On the other hand freedom of speech does not exist if anon speech
>>> does not. So what are we looking at here, a war on freedom of
>>> speech which is not only a right but a civic duty, or a war on spam
>>> which isn't anon anyway? Food for thought, doesn't the right to
>>> absolute freedom of speech far outweight the right to no spam?  And
>>> by that I don't mean to tolerate spam but to call a spade a spade.
>>
>> There are many kinds of spam.
>>
>> On the spam that tries to sell you "something", there is always a way
>> to identify them, because obviously you need to contact them somehow
>> to buy whatever. BUT, you need international cooperation, police
>> forces and courts. ALL countries.
>>
>> So, if all governments wanted, they could kill spam by simply putting
>> in prison every spammer they find, one by one.
>
> This doesn't work, because IP addresses can be used by multiple people,
> machines can be hacked, etc..

That is not a problem.

(with the assumption of full international cooperation and intent on
killing spam, which we know will not happen)

>
>> Also, the received headers can be investigated. The last one is
>> always true, because it is your own mail server.
>
> Only this one can be trusted, the rest can be forged.

Not a problem. You investigate each of them one by one, going backwards,
determining which are true and which is the first forged one.

(with the assumption of full international cooperation and intent on
killing spam, which we know will not happen)

>
>> So you trace backwards, one by one... at some point, you need police
>> and court cooperation from the countries traversed by the mail, you
>> need the police going to that server and demanding the logs by force.
>> In the end, after a lot of money, you can find someone to put in
>> prison.
>
> These headers are no evidence, they can be forged like mail addresses
> or display names.

See above.

>
>> Certainly, it may be coming from a compromised machine of some poor
>> sod. Well, he must be fined for having a machine compromised, for not
>> paying maintenance, for having faulty providers like M$.
>
> Have fun fining millions of people with malware on their machines.

Yes, I would have fun :-)

(with the assumption of full international cooperation and intent on
killing spam, which we know will not happen)

>
>> After you fine a few thousands, people will take care.
>
> I think they would stop using mail, because many are too stupid to
> understand how not to infect their machines.
>
>> But we will not get that level of international cooperation.
>
> You cannot do that even in the same country.

Well, there is no intention.

--
Cheers,
Carlos E.R.

On 2023-09-09 07:02, Marco Moock wrote:
> Am 08.09.2023 um 08:03:23 Uhr schrieb bad sector:
>
>> On 9/8/23 05:01, Marco Moock wrote:
>>> Am 07.09.2023 schrieb bad sector <forgetski@INVALID.net>:
>
>>> I know that your situation is bad, but the only way to permanently
>>> go out of that is running your own servers in your own AS.
>>
>> No cigar. That sounds like a penalty to exercise a far more
>> fundamental freedom.
>
> I agree that this is a penalty to the ISP/hoster, although there is no
> other way for them to learn that the need to do something against
> spammers.

I don't agree that there a is no other way to get to spammers; I don't
wanna start a political sidebar but hadn't Osama been laid by team-6?
>
> Be aware: The blocklist doesn't block you from sending emails, it
> simply instruct the mail server of the recipient's domain to reject it.
> The admin of a mail server can decide which mail he/she wants to
> receive, they could also say that they block all @gmail addresses or
> all mail at weekend.
> If you want free speech to others, the need to be their own server
> operators.

Thanks, valid argument, I'll trade for "contributes to the degradation
of freedom of speech".

>> Here we enter another consideration. The merchant in question told me
>> that they receive daily reports of the blocked emails (if I
>> understood correctly, their IT guy was pretty arrogant and talking
>> down to ME like "I" was some criminal, I who as the paying customer
>> put supper on this family's table for crissake). Anyhow, IF it's true
>> that they receive a list of originators blacklisted that day then
>> THEY should fork out the money to have them immediately unlisted. NOT
>> doing so means they don't really want you as a paying customer; and I
>> can live with that, there ARE other merchants out there.
>
> There is an automatic mechanism that removes the addresses from the
> blocklist after some days, see the delisting policy.

Again the onus is on innocent victims to either wait or complain and TRY
to delist (often for extortion money). But if you look at it from a
practical and functional point of view and not from a that of a
hobby-internaut prowling for virtual pussy then even a few hours delay
can be *devastating*. I've DUMPED isp's because of frequent
interruptions lasting only tens of minutes. This is an extremely serious
and offensive demonstration of arrogance the result of which on innocent
victims is equal to cutting their electricity in the middle of winter
(the internet is no longer just another TV channel). We don't
carpet-bomb any more either (I think). Offing onto the recipient with
the copout that they are the ones who close their mailbox is equivalent
to "we give loaded guns to kids and they do whatever it is that they do
with them" (kids being a very good analogy because most recipients
haven't got a freakin' clue about anything IT really).

"David W. Hodgins" <dwhodgins@nomail.afraid.org> writes:
> The isp has to learn about uceprotect and how to implement it. As explained at
> https://www.uceprotect.net/en/index.php?m=3&s=5
> "NOTE: By using Level 3 for blocking, be prepared to occasionally lose
> some required mails too. DO NOT BLAME US, YOU HAVE BEEN FOREWARNED!
>
> The recommended use of Level 3 is incorporating it into a scoring
> system, to give e.g. 2 points on a ‘match’ where 5 or more points
> trigger a spam tag."
>
> They chose to be a BOFH and use level 3 for rejecting the mail.

I’m not sure where level 3 comes from in this thread; as I’m writing, at
least, the query database lists the /24 containing the OP’s address at
level 2 as well. I guess it’s in the nature of things that the exact
listing varies with time.

At any rate, it’s up to the store (in conjunction with their email
provider) to decide how to defend themselves against spam. It’s not an
easy problem to solve.

--
https://www.greenend.org.uk/rjk/

Am 09.09.2023 um 12:46:24 Uhr schrieb Richard Kettlewell:

> "David W. Hodgins" <dwhodgins@nomail.afraid.org> writes:
> > The isp has to learn about uceprotect and how to implement it. As
> > explained at https://www.uceprotect.net/en/index.php?m=3&s=5
> > "NOTE: By using Level 3 for blocking, be prepared to occasionally
> > lose some required mails too. DO NOT BLAME US, YOU HAVE BEEN
> > FOREWARNED!
> >
> > The recommended use of Level 3 is incorporating it into a scoring
> > system, to give e.g. 2 points on a ‘match’ where 5 or more points
> > trigger a spam tag."
> >
> > They chose to be a BOFH and use level 3 for rejecting the mail.
>
> I’m not sure where level 3 comes from in this thread; as I’m writing,
> at least, the query database lists the /24 containing the OP’s
> address at level 2 as well. I guess it’s in the nature of things that
> the exact listing varies with time.

There are clear policies for every level:
http://www.uceprotect.net/en/index.php?m=3&s=4

> At any rate, it’s up to the store (in conjunction with their email
> provider) to decide how to defend themselves against spam. It’s not an
> easy problem to solve.

It is rather easy what they do: If some providers don't care about
spammers or accept them: The entire networks are going to be blocked.

Am 09.09.2023 um 07:41:45 Uhr schrieb Carlos E. R.:

> On 2023-09-09 07:18, Marco Moock wrote:
> > Am 07.09.2023 um 22:36:30 Uhr schrieb Carlos E. R.:
> >
> >> On 2023-09-07 20:01, bad sector wrote:
> >>> On 9/7/23 15:24, J.O. Aho wrote:
> >>>> On 07/09/2023 18:09, bad sector wrote:
> >>
> >> ...
> >>
> >>>>> What are my options to avoid crap like this?
> >>>>
> >>>> Use a big email service provider like protonmail, gmail,
> >>>> office365, you still will be paying for them to host your mail
> >>>> with your domain.
> >>>
> >>> It's really weird that one of the very reasons I like having my
> >>> own mail server is exactlty a way to protect against spam. I set
> >>> up (unlimited) email addresses or forwaders with the cPanel front
> >>> end and use dedicated ones for different contacts. If one address
> >>> gets spam I know who leaked! Trying to get a deal like that from
> >>> the other retail chiselers would cost me $5 per address per week
> >>> but my name is Santa Claus!
> >>
> >> Most people don't ever need that.
> >>
> >>
> >>> Getting back to blacklisting, there's something that bugs me. I am
> >>> however speaking as a server-ignorant end-user which also means
> >>> outside of the techno tunnel. SPAM as such cannot be anon, or it
> >>> wouldn't work because its purpose is to sell something so the
> >>> victimn has to have a way to respond and THAT is surely traceable.
> >>> On the other hand freedom of speech does not exist if anon speech
> >>> does not. So what are we looking at here, a war on freedom of
> >>> speech which is not only a right but a civic duty, or a war on
> >>> spam which isn't anon anyway? Food for thought, doesn't the right
> >>> to absolute freedom of speech far outweight the right to no spam?
> >>> And by that I don't mean to tolerate spam but to call a spade a
> >>> spade.
> >>
> >> There are many kinds of spam.
> >>
> >> On the spam that tries to sell you "something", there is always a
> >> way to identify them, because obviously you need to contact them
> >> somehow to buy whatever. BUT, you need international cooperation,
> >> police forces and courts. ALL countries.
> >>
> >> So, if all governments wanted, they could kill spam by simply
> >> putting in prison every spammer they find, one by one.
> >
> > This doesn't work, because IP addresses can be used by multiple
> > people, machines can be hacked, etc..
>
> That is not a problem.
>
>
> (with the assumption of full international cooperation and intent on
> killing spam, which we know will not happen)
>
> >
> >> Also, the received headers can be investigated. The last one is
> >> always true, because it is your own mail server.
> >
> > Only this one can be trusted, the rest can be forged.
>
> Not a problem. You investigate each of them one by one, going
> backwards, determining which are true and which is the first forged
> one.

You cannot log everything. E.g. a restaurant operates a public wifi.
Any customer can abuse it for sending spam, hacking other computers
with it and using them for sending spam.

> (with the assumption of full international cooperation and intent on
> killing spam, which we know will not happen)

It also doesn't work on a national basis, as long as there is no 100%
surveillance of EVERY network, even home networks.
And then you still have problems because you need to identify the user.
Think about public access points.

Le 09-09-2023, Marco Moock <mm+usenet-es@dorfdsl.de> a écrit :
>
> Be aware: The blocklist doesn't block you from sending emails, it
> simply instruct the mail server of the recipient's domain to reject it.

Right. But recipient's servers are often managed by no-brainers. They
don't know how to judge if an email is valid. If they see your server is
at home, it's enough for them to block you. Even if everything else,
like your SPF, DKIM and DMARC are OK. If you are in PBL, you have to ask
spamhaus to remove you from their list. Some moron don't check anything
except spamhaus.

And really, to manage one's own mail server at home, the most difficult
part is not to be considered as a spammer by morons.

> The admin of a mail server can decide which mail he/she wants to
> receive, they could also say that they block all @gmail addresses or
> all mail at weekend.

They could, but as almost everyone has an email in gmail (at least to
use android), so they would be cut of the world. So nobody refuse gmail
emails and google keep to fight with yahoo to be the biggest spammer
in the world.

> There is an automatic mechanism that removes the addresses from the
> blocklist after some days, see the delisting policy.
>
> http://www.uceprotect.net/en/index.php?m=7&s=6
>
> Immediate delisting requires manual work that needs to be paid. I can
> understand that.

Each black list has his own mechanism. What's done by one is not always
processed in the same way by another.

--
Si vous avez du temps à perdre :
https://scarpet42.gitlab.io

Le 09-09-2023, Marco Moock <mm+usenet-es@dorfdsl.de> a écrit :
>> There are many kinds of spam.
>>
>> On the spam that tries to sell you "something", there is always a way
>> to identify them, because obviously you need to contact them somehow
>> to buy whatever. BUT, you need international cooperation, police
>> forces and courts. ALL countries.
>>
>> So, if all governments wanted, they could kill spam by simply putting
>> in prison every spammer they find, one by one.
>
> This doesn't work, because IP addresses can be used by multiple people,
> machines can be hacked, etc..

He doesn't spoke about the IP of the sender, but of the way to contact
him. And somehow, he's right about it. If the IP of the sender is the
only way to contact him, then if I wait to long before getting in touch
with him, I wouldn't be able to, so the sender lost a potential client.

So the sender would need a valid and permanent link to be able to be
contacted by the receiver.

The issue with his argument is: I could sent spam with a link toward
someone else and the someone else would be prosecuted instead of me.
There are some ways around it, but it's a good start.

>> Also, the received headers can be investigated. The last one is
>> always true, because it is your own mail server.
>
> Only this one can be trusted, the rest can be forged.

Yes, it's the starting point from the next move.

>> So you trace backwards, one by one... at some point, you need police
>> and court cooperation from the countries traversed by the mail, you
>> need the police going to that server and demanding the logs by force.
>> In the end, after a lot of money, you can find someone to put in
>> prison.
>
> These headers are no evidence, they can be forged like mail addresses
> or display names.

As he said the last IP is real, if you forge your IP, you won't receive
answer. So it could work with UDP but not with TCP and emails are only
with TCP.

So you don't look at the IP before the last one. But you get in touch
with the last one and ask him for logs to know who was the before the
last one. And one by one, you can go back to the sender. The last issue
is the sender can be in a public place, like a MacDo, using a free IP
unable to know who used his service. Another issue, every intermediate
server can be in different countries, not all wanting to cooperate at
the same level.

>> Certainly, it may be coming from a compromised machine of some poor
>> sod. Well, he must be fined for having a machine compromised, for not
>> paying maintenance, for having faulty providers like M$.
>
> Have fun fining millions of people with malware on their machines.

It's not only fun, it's a lot of money: you don't want to secure your
computer? You pay, and if a million people have to pay it can be a lot
of money in the end.

It's what France tried to do with the hadopi law. In the beginning, the
law was: you are downloading a lot illegal stuff, it comes from your IP
so we don't need to know more about it, we remove your internet access.

But, happily, it was blocked by the EU and the law was changed. Now it's:
you have not secured the access to your connection, so someone used it
to download illegal stuff, so you are charged. It's not better, but the
law changed to acknowledge it. Happily, it's not used as much as it
could.

>> But we will not get that level of international cooperation.
>
> You cannot do that even in the same country.

As he said, it's a choice. Nobody consider spam as important as other
crimes. For other crimes, countries are cooperating. Not for spam, but
it's only a choice.

--
Si vous avez du temps à perdre :
https://scarpet42.gitlab.io

Le 09-09-2023, Marco Moock <mm+usenet-es@dorfdsl.de> a écrit :
> Am 09.09.2023 um 07:41:45 Uhr schrieb Carlos E. R.:
>
>> Not a problem. You investigate each of them one by one, going
>> backwards, determining which are true and which is the first forged
>> one.
>
> You cannot log everything. E.g. a restaurant operates a public wifi.
> Any customer can abuse it for sending spam, hacking other computers
> with it and using them for sending spam.

Yes, but people won't spend hours to go hundreds kilometers between each
email. So, you can find a few public points in a restricted area where
all emails are sent to discover the sender.

For email spams, it's a lot of work, but say in a murder case, the work
would be done. As he says, it's really a matter of choice. I'm not
saying the spam should be consider more important than murders. I'm only
saying a lot of effort are put to resolve murders, and nothing is done
against spam. I just agree with him it's a choice. I'm not saying the
choice is wrong.

> And then you still have problems because you need to identify the user.
> Think about public access points.

That's his main point: it's not a problem for him. As he rightly stated,
the beneficiary must have a way to be contacted, if he doesn't the spam
is useless.

There are two things to consider.

The first one: if I want to harm someone, I could sent spam making
believe this someone did it. It's a little bit tricky. I know: in the
actual spamming system it just doesn't exist. But if more effort would
be made against spam it could arrise. So, it must be taken care off.

The second one: all spam is about money. They sent spam to win money. So
the cost of sending spam must be less than the money received. And it's
the all point. As nothing is done against spammers, the cost is very
low. I know, when you receive spam, you know what it is and you aren't a
bait. But if only one people in ten thousand is naive enough to believe
it, once they sent one hundred thousand emails, then ten people must be
answering them. And the ten people must pay for the cost of sending the
nine hundred and ninety thousand lost emails. So, if you increase the
cost of the sending emails, the ten people are stupid enough to believe
it, but they are not rich enough to compensate your costs.

And it's his point, with which I agree: the spammers need to be sure the
ten people are able to sent them money. Without this certainty, the all
money for sending spam is lost. And remember: the ten people are naive
enough to believe the spam, so the way to send money must be easy enough
to be useful. You can't ask people to be naive enough to believe in your
mail and to be smart enough to find difficult ways to send you money.

On it, I agree with him: if everyone would want to stop spam, spammers
could be prosecuted, it's only a matter of choice. But as he said, you
will never find someone willing to do whatever it takes to prosecute all
spammers. And for me, there is no reason to, I understand there are more
important issues at the same time.

But, for me, just increasing the cost of the spammers would be enough to
stop it. I don't believe only if it becomes the first priority it will
be stopped.

What I can tell is: when a spam network begins to be huge, it's stopped
and I can see a decrease in spam. It's impressive, sometime I see less
attack on my computer. I'm afraid I've being hacked and my computer is
used behind my knowledge. And then I learn a massive network has been
arrested and that explains it.

So for the actual part, the little guys in their basement are safe and
the effort is put on big companies (even if it's unofficial, we can call
them that, the structure is the same).

--
Si vous avez du temps à perdre :
https://scarpet42.gitlab.io

Am 09.09.2023 um 07:43:51 Uhr schrieb bad sector:

> I don't agree that there a is no other way to get to spammers; I
> don't wanna start a political sidebar but hadn't Osama been laid by
> team-6?

Completely different situation.
How do you identify who (person) exactly sent the spam mails?

There is NAT, CG-NAT, a whole /48 net for a customer that is being used
by many people (family, guests, maybe neighbors).
More efficient is to put put pressure on server operators that sent out
spam, regardless from where it came to that server.
This pressure will ensure that the operator takes care about it and
tries to limit abuse. Nobody complains when 1 spam mail goes out, but
if 100000 got out, it will be on blacklists.

> >> Here we enter another consideration. The merchant in question told
> >> me that they receive daily reports of the blocked emails (if I
> >> understood correctly, their IT guy was pretty arrogant and talking
> >> down to ME like "I" was some criminal, I who as the paying customer
> >> put supper on this family's table for crissake). Anyhow, IF it's
> >> true that they receive a list of originators blacklisted that day
> >> then THEY should fork out the money to have them immediately
> >> unlisted. NOT doing so means they don't really want you as a
> >> paying customer; and I can live with that, there ARE other
> >> merchants out there.
> >
> > There is an automatic mechanism that removes the addresses from the
> > blocklist after some days, see the delisting policy.
>
> Again the onus is on innocent victims to either wait or complain and
> TRY to delist (often for extortion money).

Fully agree, but that is the problem whit shared address ranges.
Get your own ASN with your own nets and activity of others won't have
impact on you.

> But if you look at it from a practical and functional point of view
> and not from a that of a hobby-internaut prowling for virtual pussy
> then even a few hours delay can be *devastating*. I've DUMPED isp's
> because of frequent interruptions lasting only tens of minutes. This
> is an extremely serious and offensive demonstration of arrogance the
> result of which on innocent victims is equal to cutting their
> electricity in the middle of winter (the internet is no longer just
> another TV channel). We don't carpet-bomb any more either (I think).

I agree that this situation is really, really bad for individual
innocent customers.

> Offing onto the recipient with the copout that they are the ones who
> close their mailbox is equivalent to "we give loaded guns to kids and
> they do whatever it is that they do with them" (kids being a very good
> analogy because most recipients haven't got a freakin' clue about
> anything IT really).

Thats SMTP. Mail is controlled by domains and the MX servers are
related to the domain and not only the recipient.
A good mail provider offers to control the spam filter per customer, so
maybe it is possible to enable a setting "accept ALL mail to my
address".
Although, not all provider have such an option.
Mail transfer agents like sendmail support such situations.

Am 09.09.2023 um 12:15:37 Uhr schrieb Stéphane CARPENTIER:

> Le 09-09-2023, Marco Moock <mm+usenet-es@dorfdsl.de> a écrit :
> >
> > Be aware: The blocklist doesn't block you from sending emails, it
> > simply instruct the mail server of the recipient's domain to reject
> > it.
>
> Right. But recipient's servers are often managed by no-brainers. They
> don't know how to judge if an email is valid. If they see your server
> is at home, it's enough for them to block you. Even if everything
> else, like your SPF, DKIM and DMARC are OK. If you are in PBL, you
> have to ask spamhaus to remove you from their list. Some moron don't
> check anything except spamhaus.

I agree, this is a shitty situation.
But such machines won't occur on the uceprotect.net lists, unless they
really send out spam or their ISP doesn't care about spammers.

> And really, to manage one's own mail server at home, the most
> difficult part is not to be considered as a spammer by morons.

I agree. I also operate my own and some providers accept the mails, but
place it in spam, even if SPF is valid.

> > The admin of a mail server can decide which mail he/she wants to
> > receive, they could also say that they block all @gmail addresses or
> > all mail at weekend.
>
> They could, but as almost everyone has an email in gmail (at least to
> use android), so they would be cut of the world. So nobody refuse
> gmail emails and google keep to fight with yahoo to be the biggest
> spammer in the world.

I agree, Google is one of the worst companies on earth, they don't give
a f*** about abuse.

> > There is an automatic mechanism that removes the addresses from the
> > blocklist after some days, see the delisting policy.
> >
> > http://www.uceprotect.net/en/index.php?m=7&s=6
> >
> > Immediate delisting requires manual work that needs to be paid. I
> > can understand that.
>
> Each black list has his own mechanism. What's done by one is not
> always processed in the same way by another.

True, but the discussion was about uceprotect and they have a clear
listing and delisting policy, which is reputable.

Le 09-09-2023, Marco Moock <mm+usenet-es@dorfdsl.de> a écrit :
> Am 09.09.2023 um 12:15:37 Uhr schrieb Stéphane CARPENTIER:
>
>> Each black list has his own mechanism. What's done by one is not
>> always processed in the same way by another.
>
> True, but the discussion was about uceprotect and they have a clear
> listing and delisting policy, which is reputable.

Yes. But the issue is: you rarely have only one blacklist to take care
of. And when your email is rejected, you have to find out on which
blacklists you are and take care of them one by one.

--
Si vous avez du temps à perdre :
https://scarpet42.gitlab.io

On 2023-09-09 07:55, Marco Moock wrote:
> Am 09.09.2023 um 12:46:24 Uhr schrieb Richard Kettlewell:
>
>> "David W. Hodgins" <dwhodgins@nomail.afraid.org> writes:
>>> The isp has to learn about uceprotect and how to implement it. As
>>> explained at https://www.uceprotect.net/en/index.php?m=3&s=5
>>> "NOTE: By using Level 3 for blocking, be prepared to occasionally
>>> lose some required mails too. DO NOT BLAME US, YOU HAVE BEEN
>>> FOREWARNED!
>>>
>>> The recommended use of Level 3 is incorporating it into a scoring
>>> system, to give e.g. 2 points on a ‘match’ where 5 or more points
>>> trigger a spam tag."
>>>
>>> They chose to be a BOFH and use level 3 for rejecting the mail.
>>
>> I’m not sure where level 3 comes from in this thread; as I’m writing,
>> at least, the query database lists the /24 containing the OP’s
>> address at level 2 as well. I guess it’s in the nature of things that
>> the exact listing varies with time.
>
> There are clear policies for every level:
> http://www.uceprotect.net/en/index.php?m=3&s=4
>
>> At any rate, it’s up to the store (in conjunction with their email
>> provider) to decide how to defend themselves against spam. It’s not an
>> easy problem to solve.
>
> It is rather easy what they do: If some providers don't care about
> spammers or accept them: The entire networks are going to be blocked.

The merchant in question got a load of bills from me in 9 months before
his IT locked me out, that was his call. I lost a good day's work and
headaches galore so that money is necessarily already flowing to someone
else, and that's my call.

On Sat, 09 Sep 2023 09:47:19 -0400, Marco Moock <mm+usenet-es@dorfdsl.de> wrote:

> Am 09.09.2023 um 07:43:51 Uhr schrieb bad sector:
>
>> I don't agree that there a is no other way to get to spammers; I
>> don't wanna start a political sidebar but hadn't Osama been laid by
>> team-6?
>
> Completely different situation.
> How do you identify who (person) exactly sent the spam mails?

There is no attempt to identify the person when blocking based on ip address.

The ip address is obtained during the tcp connection to the server. That
cannot be forged (when tcp is implemented properly).

The server may or may not be configured to add a header with the originating
ip address to the message.

There is no way to guarantee which person did what when connecting over the
internet. The best you can do is say it's a person who has a password or other
identifying info, associated with a specific person.

That's why voting over internet can never be secure. While the ip address can
not be forged, there is no way to prove who is at the keyboard, or even if it
is being controlled by the person at the keyboard.

Even if they are the person they claim to be, they may be under duress (for
example, having a gun to their head), or the system may be remotely controlled.

Regards, Dave Hodgins

On Sat, 09 Sep 2023 13:13:44 -0400, bad sector <nosuch@invalid.gov> wrote:
> The merchant in question got a load of bills from me in 9 months before
> his IT locked me out, that was his call. I lost a good day's work and
> headaches galore so that money is necessarily already flowing to someone
> else, and that's my call.

Keep in mind that uceprotect recommends that the level 3 list only be used
for scoring, not for blocking, and it may be that the merchant configured
their server to use spam scoring.

Getting your own domain name and matching reverse dns instead of using
$customer.dns77.com may fix the issue for that merchant and others that use
the combination of generic customer dns and being listed at level 3 to raise
the spam likely hood score over the limit at which it's blocked.

Regards, Dave Hodgins

Le 09-09-2023, David W. Hodgins <dwhodgins@nomail.afraid.org> a écrit :
>
> Keep in mind that uceprotect recommends that the level 3 list only be used
> for scoring, not for blocking, and it may be that the merchant configured
> their server to use spam scoring.

The issue I saw with my email server, it's the reason I said it's
maintained by morons and no-brainers, is that it's used for blocking and
not for scoring. I agree with the purpose, but the fact is the reality
is not to follow the purpose but the easy way in blocking and not
scoring.

--
Si vous avez du temps à perdre :
https://scarpet42.gitlab.io

Le 09-09-2023, David W. Hodgins <dwhodgins@nomail.afraid.org> a écrit :
>
> The ip address is obtained during the tcp connection to the server. That
> cannot be forged (when tcp is implemented properly).

I don't understand the parenthesis part. For me, it's easy to forge the
ip, but if it works with udp, as you don't receive the answer, it won't
work wit tcp.

So you mean you can forge your ip address and it can work if tcp is not
implemented properly? How so? By guessing the answer? Buy spying on the
connection? Another way?

> That's why voting over internet can never be secure. While the ip address can
> not be forged, there is no way to prove who is at the keyboard, or even if it
> is being controlled by the person at the keyboard.

Yes. If you can vote on internet, you can sell your vote. Some strong
guy in a family/clan/whatever can force others to vote the way his
intended. The secret of the voting process is the only way to keep the
votes honest. If someone is isolated to vote, he can always claim he
voted for someone else. At home, the secrecy is not guaranty and so the
process can be changed.

--
Si vous avez du temps à perdre :
https://scarpet42.gitlab.io