Mike Easter wrote:
> In the 'extensive' wp article comparing blocklists, UCEProtect is listed
> in the 'suspect' group.

Naturally *every* wp article has a Talk section where the content or POV
of an article can be debated or discussed, which is surely the case of
UCEProtect, which has a significant section in Talk. There are also a
number of 'essays' I've found which take issue w/ the way UCEProtect works.

In terms of my own personal 'bias' I'm most familiar w/ that section of
the wp RBL comparisons article that are related to Spamhaus and its
players. I'm not sure how a server operator goes about making a
decision to use UCEProtect *instead of* one or a combination of the
alternatives which are considered 'healthy' or 'non-suspect'.

--
Mike Easter

bad sector wrote:
> I only have one question left: which of the following are behind it?

My understanding is that one 'man'/person is behind UCEP, and naturally
he is unhappy w/ the various 'forces' who are critical of his operation,
particularly such as those related to other blocklists and apparently
the IETF which is responsible for some kind of RFC which 'bothers' him.

I haven't figured it out yet; something about BCP 7 of RFC 2008 which is
way back in 1996.

> Claus von Wolfhausen Technical Director UCEPROTECT-Network

wp
> Because lists have varying methods for adding IP addresses and/or
> URIs, it can be difficult for senders to configure their systems
> appropriately to avoid becoming listed on a DNSBL. For example, the
> UCEProtect DNSBL seems to list IP addresses merely once they have
> validated a recipient address or established a TCP connection, even
> if no spam message is ever delivered.

.... and then people write articles about how to get on that list w/o
ever sending any spam, but I'm not yet clear on how that works. Perhaps
it is actually about being in a particular ASN block which gets listed,
but not any spam from your 'own' IP.

I've seen many discussions of that problem on usenet spam discussions.

--
Mike Easter

Mike Easter wrote:
> Perhaps it is actually about being in a particular ASN block which
> gets listed, but not any spam from your 'own' IP.
>
> I've seen many discussions of that problem on usenet spam
> discussions.

Here's one comment in a thread (I don't know if he is correct):

> They have 3 lists.
>
> UCE1 is individual IP's which is generally safe to use for blocking.
> These are confirmed sources of spam.
>
> UCE2 which are subnets that have many IP's in UCE1, this should not
> be used for blocking.
>
> UCE3 which is entire networks by ISP, again it should not be used for
> blocking.
>
> Sounds like your network ended up in either 2 or 3, and someone is
> wrongly using that to block people. They will get a LOT of false
> positives this way.

--
Mike Easter

On 9/11/23 15:43, Mike Easter wrote:
> bad sector wrote:
>> I only have one question left: which of the following are behind it?
>
> My understanding is that one 'man'/person is behind UCEP, and naturally
> he is unhappy w/ the various 'forces' who are critical of his operation,
> particularly such as those related to other blocklists and apparently
> the IETF which is responsible for some kind of RFC which 'bothers' him.
>
> I haven't figured it out yet; something about BCP 7 of RFC 2008 which is
> way back in 1996.

Some kind of tit-for-tat from the past, or just plain parasitic
in-betweener instinct?

>> Claus von Wolfhausen Technical Director UCEPROTECT-Network
>
> wp
>> Because lists have varying methods for adding IP addresses and/or
>> URIs, it can be difficult for senders to configure their systems
>> appropriately to avoid becoming listed on a DNSBL. For example, the
>> UCEProtect DNSBL seems to list IP addresses merely once they have
>> validated a recipient address or established a TCP connection, even
>> if no spam message is ever delivered.

http://kontech.net/uceprotect-blacklist-scheme-2020/

"Your IP is listed in UCEPROTECT Level-3. Since your IP wasn't directly
involved.... you can exclude your IP from ..blocklists as UCEPROTECT
Levels 2 and 3 and others that are *importing* out WHITE LIST, by
regiostering your IP with us".

I think the FBI, RCMP, KGB and whatever should investigate all these
people and any connections between them. This is a protection racket,
pure and simple!

> ... and then people write articles about how to get on that list w/o
> ever sending any spam,

That bit about TOR caught my eye, I use it regularly. If I find out that
iot gets me on the gestapo list I will use it exlusivley and leave it on
7/24.

> but I'm not yet clear on how that works.  Perhaps
> it is actually about being in a particular ASN block which gets listed,
> but not any spam from your 'own' IP.
>
> I've seen many discussions of that problem on usenet spam discussions.

--
"The higher climbs the monkey, the more it shows
its ass". Source uncertain, several candidates.

Marco Moock wrote:
> I agree that this is a penalty to the ISP/hoster, although there is no
> other way for them to learn that the need to do something against
> spammers.

I don't think a strategy designed to 'teach' an enterprise/business
something at the cost of using 'innocent victim users' as some kind of
fodder in an anti-spam war is a particularly good strategy.

I'm aware that many kinds of warfare employ ruthless tactics of killing
and starving the non-military citizen populace, but we mostly condemn
such actions.

From my reading about UCEP so far, it seems to me that the biz has
decided to employ a money-making scheme based on ill-advised
configurations of its clients, which are 'contrary' to the advice of the
larger and more wholesome community of blocklist creators and maintainers.

--
Mike Easter

Am 11.09.2023 um 11:53:43 Uhr schrieb Mike Easter:

> That blocklist policy is that a listed comes off 'spontaneously' in a
> week if the 'spam count' improves sufficiently -OR- there is a 'for
> pay' express delisting which is faster, but it doesn't keep a big
> block holder from getting re-listed quickly.

Payment is only possible if the system doesn't send out spam anymore.
If it send it out again, it will be listed again and the payment was
worthless.

Am 11.09.2023 um 15:11:57 Uhr schrieb bad sector:

> On 2023-09-11 14:53, Mike Easter wrote:
> > David W. Hodgins wrote:
> >> I wouldn't be surprised of all of ovh (AS16276) is already blocked
> >> in many firewalls due to their support of spam.
> >
> > The UCEProtect vs ASNs w/ a 'problem' reputation is 'widespread'.
> >
> > That blocklist policy is that a listed comes off 'spontaneously' in
> > a week if the 'spam count' improves sufficiently -OR- there is a
> > 'for pay' express delisting which is faster, but it doesn't keep a
> > big block holder from getting re-listed quickly.
> >
> > As a result of the payola aspect and the 'readiness' to list, those
> > whose IPs are affected want to call UCEProtect a 'scam'.
> >
> > In the 'extensive' wp article comparing blocklists, UCEProtect is
> > listed in the 'suspect' group.
> >
> >> Suspect RBL providers are those who employ well-documented
> >> patterns[3] of questionable or reckless practices[4] or have
> >> questionable actors based on statements or communications from the
> >> RBL's principal management to official forums.
> >
> > https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists
> >
> > Naturally their tables of 'non-suspect' is MUCH more extensive than
> > those of suspect.
> >
> > Of course, the old adage of 'my server, my rules' prevails here.
> >
>
> I put you on a blacklist, you buy yourself off it, THAT's a variant
> of maffioso style extorsion. But that's not all..

They put your server on the Level 1 backlist if it send out spam and
annoys innocent people.
When the spamming stops for 1 week, you will be automatically removed.
You can pay to be removed immediately after your server stops sending
spam.

> "exploit: ...compromised, infected, proxies, or VPN or TOR exit nodes"
>
> It's a declared war on privacy, just as I suspected. Now doesn't that
> say it all? I only have one question left: which of the following are
> behind it?

I agree that including VPN services is against privacy and also against
normals server operators that have shitty ISPs and need a VPN to get
real connectivity with static IPv6 and IPv4, including access to reverse
DNS.

> - zukerbarf
> - googlegoons
> - bezoos
> - Billy
> - all of the above
>
> I just got off the list BTW.

Seems to be people from Germany and Switzerland.
Many clients are in the public sector according to the information I
read.

Am 11.09.2023 um 12:43:59 Uhr schrieb Mike Easter:

> bad sector wrote:
> > I only have one question left: which of the following are behind
> > it?
>
> My understanding is that one 'man'/person is behind UCEP, and
> naturally he is unhappy w/ the various 'forces' who are critical of
> his operation, particularly such as those related to other blocklists
> and apparently the IETF which is responsible for some kind of RFC
> which 'bothers' him.

There were people who treated blocklist operators, send them mail
bombs, dead animals etc.
Which RFC should bother him?
I would like to know.

> I haven't figured it out yet; something about BCP 7 of RFC 2008 which
> is way back in 1996.

This is about IPv4 address allocation, in what way does it refer to
mail?

> > Claus von Wolfhausen Technical Director UCEPROTECT-Network
>
> wp
> > Because lists have varying methods for adding IP addresses and/or
> > URIs, it can be difficult for senders to configure their systems
> > appropriately to avoid becoming listed on a DNSBL. For example, the
> > UCEProtect DNSBL seems to list IP addresses merely once they have
> > validated a recipient address or established a TCP connection, even
> > if no spam message is ever delivered.

You can get on that list for abuse too. Using RCPT TO: to verify
valid addresses is one of that (spammers seem to do that). VRFY exists
for that purpose, if that is disabled, the server operator doesn't want
people validate addresses.

> ... and then people write articles about how to get on that list w/o
> ever sending any spam, but I'm not yet clear on how that works.
> Perhaps it is actually about being in a particular ASN block which
> gets listed, but not any spam from your 'own' IP.

True, this is level 2 and 3.

> I've seen many discussions of that problem on usenet spam discussions.

Usenet can't be compared to mail via SMTP, it can be compared to mail
via UUCP.

In Usenet, the amount of servers is much, much less and open servers
where everybody can post without authentication exist in a small amount.
Most server operators care about abuse, Google doesn't.
This is where the most spam comes from.

Am 11.09.2023 um 16:48:38 Uhr schrieb Mike Easter:

> Marco Moock wrote:
> > I agree that this is a penalty to the ISP/hoster, although there is
> > no other way for them to learn that the need to do something against
> > spammers.
>
> I don't think a strategy designed to 'teach' an enterprise/business
> something at the cost of using 'innocent victim users' as some kind
> of fodder in an anti-spam war is a particularly good strategy.

How would you make ISPs care about abuse in their network?

On 2023-09-10 10:42, Marco Moock wrote:
> Am 10.09.2023 um 10:30:56 Uhr schrieb Carlos E. R.:
>
>> On 2023-09-09 07:59, Marco Moock wrote:
>>> Am 09.09.2023 um 07:41:45 Uhr schrieb Carlos E. R.:
>>>> On 2023-09-09 07:18, Marco Moock wrote:
>>>>> Am 07.09.2023 um 22:36:30 Uhr schrieb Carlos E. R.:
>>>>>> On 2023-09-07 20:01, bad sector wrote:
>>>>>>> On 9/7/23 15:24, J.O. Aho wrote:
>>>>>>>> On 07/09/2023 18:09, bad sector wrote:
>>
>> ...
>>
>>>>>> Also, the received headers can be investigated. The last one is
>>>>>> always true, because it is your own mail server.
>>>>>
>>>>> Only this one can be trusted, the rest can be forged.
>>>>
>>>> Not a problem. You investigate each of them one by one, going
>>>> backwards, determining which are true and which is the first forged
>>>> one.
>>>
>>> You cannot log everything. E.g. a restaurant operates a public wifi.
>>> Any customer can abuse it for sending spam, hacking other computers
>>> with it and using them for sending spam.
>>
>> That's not a problem.
>>
>> There is a good server somewhere, possibly badly configured, which
>> accepted the mail from the compromised machine. And this good server
>> would log the event.
>>
>> That good server would be fined. And the IP of the compromised
>> machine would be logged, then located by the police, and fined or
>> confiscated (even if the IP is dynamic).
>
> A really bad idea. Nobody could no operate a server anymore without
> a huge risk. Just remember how many Exchange servers are going to be
> hacked or people have bad passwords that are being cracked.
>

Good. Perfect. All those to be fined.

--
Cheers,
Carlos E.R.

On 9/12/23 02:34, Marco Moock wrote:
> Am 11.09.2023 um 15:11:57 Uhr schrieb bad sector:
>
>> On 2023-09-11 14:53, Mike Easter wrote:
>>> David W. Hodgins wrote:
>>>> I wouldn't be surprised of all of ovh (AS16276) is already blocked
>>>> in many firewalls due to their support of spam.
>>>
>>> The UCEProtect vs ASNs w/ a 'problem' reputation is 'widespread'.
>>>
>>> That blocklist policy is that a listed comes off 'spontaneously' in
>>> a week if the 'spam count' improves sufficiently -OR- there is a
>>> 'for pay' express delisting which is faster, but it doesn't keep a
>>> big block holder from getting re-listed quickly.
>>>
>>> As a result of the payola aspect and the 'readiness' to list, those
>>> whose IPs are affected want to call UCEProtect a 'scam'.
>>>
>>> In the 'extensive' wp article comparing blocklists, UCEProtect is
>>> listed in the 'suspect' group.
>>>
>>>> Suspect RBL providers are those who employ well-documented
>>>> patterns[3] of questionable or reckless practices[4] or have
>>>> questionable actors based on statements or communications from the
>>>> RBL's principal management to official forums.
>>>
>>> https://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists
>>>
>>> Naturally their tables of 'non-suspect' is MUCH more extensive than
>>> those of suspect.
>>>
>>> Of course, the old adage of 'my server, my rules' prevails here.
>>>
>>
>> I put you on a blacklist, you buy yourself off it, THAT's a variant
>> of maffioso style extorsion. But that's not all..
>
> They put your server on the Level 1 backlist if it send out spam and
> annoys innocent people.
> When the spamming stops for 1 week, you will be automatically removed.
> You can pay to be removed immediately after your server stops sending
> spam.
>
>> "exploit: ...compromised, infected, proxies, or VPN or TOR exit nodes"
>>
>> It's a declared war on privacy, just as I suspected. Now doesn't that
>> say it all? I only have one question left: which of the following are
>> behind it?
>
> I agree that including VPN services is against privacy and also against
> normals server operators that have shitty ISPs and need a VPN to get
> real connectivity with static IPv6 and IPv4, including access to reverse
> DNS.
>
>> - zukerbarf
>> - googlegoons
>> - bezoos
>> - Billy
>> - all of the above
>>
>> I just got off the list BTW.
>
> Seems to be people from Germany and Switzerland.

I expect that Soros and the WEC will fit too, all the well known actors
that want total surveillance of everyone all the time.

> Many clients are in the public sector according to the information I
> read.

Not surprised, most parasitic in-betweeners prefer the public sector
because it is the easiest of all prey, heading the herd to the trough
are corporations and big unions neither of which really want to slug it
out where they were originally supposed to in the entirely private
sector. The public sector cannot go bankrupt and it cannot run away so
at worst you get half of what you asked for in arbitration. You set up a
scam that govt. funkies would be horrified of mishandling at the risk of
their (also public-sector favoring unions' gift) great pay and security
packages. The fabricated demand is thus immediately created. Then you
blacklist alleged spam-permissive servers and force innocent victims to
pay ransom for their freedom to email. Then you do some spamming
yourself and repeat the process to guarantee what YOU consider a
renewable-resource: living off the innocent users herded into your arms
by their own government. In the old days interfering with the mail was a
hanging crime, it should be again.

--
Tuesdays are Devuan days: GNU/Linux 4 (chimaera), BIOS-boot,
DM=Unknown,Kernel=5.10.0-25-amd64 on x86_64,DM=Unknown,DE=XFCE,
ST=x11,grub2, GPT
https://imgur.com/x2A9zHw.png https://i.imgur.com/RsbswMP.png

On 9/12/23 02:59, Marco Moock wrote:
> Am 11.09.2023 um 16:48:38 Uhr schrieb Mike Easter:
>
>> Marco Moock wrote:
>>> I agree that this is a penalty to the ISP/hoster, although there is
>>> no other way for them to learn that the need to do something against
>>> spammers.
>>
>> I don't think a strategy designed to 'teach' an enterprise/business
>> something at the cost of using 'innocent victim users' as some kind
>> of fodder in an anti-spam war is a particularly good strategy.
>
> How would you make ISPs care about abuse in their network?

How about requiring a license/permit to operate any mechanism involved
in the transmission of information, said permit being conditional to a
HOST of automated minute-by-minute satisfactory performance
measurements, JUST like we do with TV and radio under the authority of
communications commissions, but extend them to all internet facilities
including web-sites and the digital giants that Canada is currently
challenging? At the same time such mechanisms should also (structurally)
guarantee (optional) anonymity to underwrite true freedom of speech.
Unfortunately no government will do the above so the only actors left
going to bat for the right to communicate freely are private interests.

Am 12.09.2023 um 09:21:48 Uhr schrieb bad sector:

> How about requiring a license/permit to operate any mechanism
> involved in the transmission of information, said permit being
> conditional to a HOST of automated minute-by-minute satisfactory
> performance measurements, JUST like we do with TV and radio under the
> authority of communications commissions, but extend them to all
> internet facilities including web-sites and the digital giants that
> Canada is currently challenging?

Then you can close the free internet for everyone.
In Germany, we had this shit, you were not allowed to connect a
telephone on your own, you needed to pay ~1000$ for a modem.
I prefer blocklists of spammers instead, because every recipient
SMTP server can decide to implement or not implement them and not the
government.

Marco Moock wrote:
> Mike Easter:
>> Marco Moock wrote:
>>> I agree that this is a penalty to the ISP/hoster, although there is
>>> no other way for them to learn that the need to do something against
>>> spammers.
>>
>> I don't think a strategy designed to 'teach' an enterprise/business
>> something at the cost of using 'innocent victim users' as some kind
>> of fodder in an anti-spam war is a particularly good strategy.
>
> How would you make ISPs care about abuse in their network?
>
'network' is an ambiguous term here.

Even 'netblock' would be ambiguous. Here we are talking about UCEP
'recklessly' listing *huge* ASNs in its level 3, and *THEN* its
ill-informed clients configure to block such a recklessly listed ASN
which 'broadly speaking' isn't guilty of spam at all.

You are creating a 'strawman argument' when you say that spam source
co-users are being punished along w/ the spammers. That isn't the same
thing at all.

I'm saying that UCEP is hurting and 'fleecing' innocents based on the
misuse of its products. Intentionally.

i'm also saying that the blocklist community as a whole, a larger body
of anti-spammers, is critical of UCEP for that.

--
Mike Easter

Am 12.09.2023 um 09:25:36 Uhr schrieb Mike Easter:

> Marco Moock wrote:
> > Mike Easter:
> >> Marco Moock wrote:
> >>> I agree that this is a penalty to the ISP/hoster, although there
> >>> is no other way for them to learn that the need to do something
> >>> against spammers.
> >>
> >> I don't think a strategy designed to 'teach' an enterprise/business
> >> something at the cost of using 'innocent victim users' as some kind
> >> of fodder in an anti-spam war is a particularly good strategy.
> >
> > How would you make ISPs care about abuse in their network?
> >
> 'network' is an ambiguous term here.
>
> Even 'netblock' would be ambiguous. Here we are talking about UCEP
> 'recklessly' listing *huge* ASNs in its level 3, and *THEN* its
> ill-informed clients configure to block such a recklessly listed ASN
> which 'broadly speaking' isn't guilty of spam at all.

It is true that the entire AS isn't guilty, but there are ISPs that
like spammers. They let them send spam and don't care about it.
The individual IPs get listed. The the spammer notices that and wants
another IP, the ISP gives it. The it is getting listed again. If that
happens too often, the entire AS will be listed.

ISP that cooperate with spammers are bad actors and most people don't
want them.
It is the recipient domain server operator´s who decide to implement
level 2/3 uceprotect blocklists.
I know this is bad for innocent customers of the ISP, but the question
is if they like a provider that supports spam. If not, they should
complain to their ISP and if that ISP doesn't care, they can look for
another.
According to the statistics of uceprotect, there is only a really small
amount of provider that tolerate spammers, but these are responsible
for a huge amount of the spam.

> I'm saying that UCEP is hurting and 'fleecing' innocents based on the
> misuse of its products. Intentionally.

Level 1 only lists IPs of spamming server. Level 2 and 3 list
networks/entire ASN.
It is clearly explained how these addresses come in and out.

If a server operator decides to block IPs that are listed in level 2 or
3, it is their decision because they are annoyed by these ISPs.
Customers of them who don't want to send spam should take action and
choose an ISP that cares about abuse.

> i'm also saying that the blocklist community as a whole, a larger
> body of anti-spammers, is critical of UCEP for that.

I agree that it is overblocking, but every kind of blocking will hit
innocents. The question is just: Why don't ISPs care about abuse?
If they care, they won't land on level 3.

It is completely clear that a huge amount of spam need to be sent from
an AS to land in that level.
And again, the recipient decides to implement that list. They could
also say: ISP xyz doesn't care about abuse mails we sent to them, we
will no block the entire AS in the firewall.

There is much stranger stuff:
Cisco Talos.
They list my IP on the suspicious list because of low mail volume.
I never had problems yet, but I don't send out much and only to a small
amount of addresses.

Marco Moock wrote:
> schrieb Mike Easter:
>> Marco Moock wrote:
>>> Mike Easter:
>>>> Marco Moock wrote:
>>>>> I agree that this is a penalty to the ISP/hoster, although there
>>>>> is no other way for them to learn that the need to do something
>>>>> against spammers.
>>>>
>>>> I don't think a strategy designed to 'teach' an enterprise/business
>>>> something at the cost of using 'innocent victim users' as some kind
>>>> of fodder in an anti-spam war is a particularly good strategy.
>>>
>>> How would you make ISPs care about abuse in their network?
>>>
>> 'network' is an ambiguous term here.
>>
>> Even 'netblock' would be ambiguous. Here we are talking about UCEP
>> 'recklessly' listing *huge* ASNs in its level 3, and *THEN* its
>> ill-informed clients configure to block such a recklessly listed ASN
>> which 'broadly speaking' isn't guilty of spam at all.
>
> It is true that the entire AS isn't guilty, but there are ISPs that
> like spammers. They let them send spam and don't care about it.
> The individual IPs get listed. The the spammer notices that and wants
> another IP, the ISP gives it. The it is getting listed again. If that
> happens too often, the entire AS will be listed.
>
> ISP that cooperate with spammers are bad actors and most people don't
> want them.

The problem is that it is NOT a 'black and white' issue. 'Normal'
providers don't *intentionally* permit spamming. So-called 'spam'
'comes about' all kinds of crazy ways such as backscatter.

It is one thing to 'land on' a UCEP level 1 list. It is an entirely
*different thing* to get swept up in a UCEP 2/3 AS list.

> It is the recipient domain server operator´s who decide to implement
> level 2/3 uceprotect blocklists.

And, I say that is an 'unhealthy' use of the list, and *everybody* (such
as the anti-spamming blocklist community of experts who know how to
prevent spam reception pretty effectively at reasonable 'cost' in terms
of server overhead) knows that it is unhealthy. And UCEP also /knows/
that such blocking isn't 'fair' and that is *WHY* they make a business
model of making money off non-spammers who have been adversely affected
by the known inappropriate use of the 2/3 listings.

> I know this is bad for innocent customers of the ISP, but the question
> is if they like a provider that supports spam. If not, they should
> complain to their ISP and if that ISP doesn't care, they can look for
> another.

I don't think you have characterized the ASNs which may land on the 2/3
list correctly.

> According to the statistics of uceprotect, there is only a really small
> amount of provider that tolerate spammers, but these are responsible
> for a huge amount of the spam.
>
That fact has nothing to do w/ our discussion. The healthy blocklist
use is successful in blocking huge amounts of spam. We don't *need*
unhealthy use.

>> I'm saying that UCEP is hurting and 'fleecing' innocents based on the
>> misuse of its products. Intentionally.
>
> Level 1 only lists IPs of spamming server. Level 2 and 3 list
> networks/entire ASN.
> It is clearly explained how these addresses come in and out.
>
Yes.

> If a server operator decides to block IPs that are listed in level 2 or
> 3, it is their decision because they are annoyed by these ISPs.
> Customers of them who don't want to send spam should take action and
> choose an ISP that cares about abuse.
>
I understand the concept of 'my server, my rules' but the result is that
innocent users who don't even configure servers are adversely affected,
as are innocent providers who don't spam, while UCEP makes money off
unhealthy behavior and innocent 'suffering'. There's something wrong there.

>> i'm also saying that the blocklist community as a whole, a larger
>> body of anti-spammers, is critical of UCEP for that.
>
> I agree that it is overblocking, but every kind of blocking will hit
> innocents. The question is just: Why don't ISPs care about abuse?
> If they care, they won't land on level 3.
>
The larger body of healthy blocklists also have some collateral damage,
but nothing that even comes close to what UCEP makes a living on.

> It is completely clear that a huge amount of spam need to be sent from
> an AS to land in that level.

The 'policing' of an entire huge ASN has to take place at a much more
granular level than the 'top' of the ASN number.

--
Mike Easter

Am 12.09.2023 um 11:13:42 Uhr schrieb Mike Easter:

> Marco Moock wrote:
> > schrieb Mike Easter:
> >> Marco Moock wrote:
> >>> Mike Easter:
> >>>> Marco Moock wrote:
> >>>>> I agree that this is a penalty to the ISP/hoster, although there
> >>>>> is no other way for them to learn that the need to do something
> >>>>> against spammers.
> >>>>
> >>>> I don't think a strategy designed to 'teach' an
> >>>> enterprise/business something at the cost of using 'innocent
> >>>> victim users' as some kind of fodder in an anti-spam war is a
> >>>> particularly good strategy.
> >>>
> >>> How would you make ISPs care about abuse in their network?
> >>>
> >> 'network' is an ambiguous term here.
> >>
> >> Even 'netblock' would be ambiguous. Here we are talking about UCEP
> >> 'recklessly' listing *huge* ASNs in its level 3, and *THEN* its
> >> ill-informed clients configure to block such a recklessly listed
> >> ASN which 'broadly speaking' isn't guilty of spam at all.
> >
> > It is true that the entire AS isn't guilty, but there are ISPs that
> > like spammers. They let them send spam and don't care about it.
> > The individual IPs get listed. The the spammer notices that and
> > wants another IP, the ISP gives it. The it is getting listed again.
> > If that happens too often, the entire AS will be listed.
> >
> > ISP that cooperate with spammers are bad actors and most people
> > don't want them.
>
> The problem is that it is NOT a 'black and white' issue.

I agree.
> 'Normal' providers don't *intentionally* permit spamming.

Then they will react fast enough to avoid being listed in level 2 or 3,
so only the IPs originating spam will be in the level 1 list.

> So-called 'spam' 'comes about' all kinds of crazy ways such as backscatter.

For backscatter, another blacklist exists.
Backscatter can be much reduced by configuring the mail server properly.

> It is one thing to 'land on' a UCEP level 1 list. It is an entirely
> *different thing* to get swept up in a UCEP 2/3 AS list.

Entirely true, but getting on level 2 or even 3 is harder and can be
avoided by reacting to abuse messages fast enough.

> > It is the recipient domain server operator´s who decide to implement
> > level 2/3 uceprotect blocklists.
>
> And, I say that is an 'unhealthy' use of the list, and *everybody*
> (such as the anti-spamming blocklist community of experts who know
> how to prevent spam reception pretty effectively at reasonable 'cost'
> in terms of server overhead) knows that it is unhealthy.

What do you mean with unhealthy?
It is a list for server operators who want to block network ranges of
ISPs that don't react quick to abuse messages.

> And UCEP also /knows/ that such blocking isn't 'fair' and that is *WHY* they
> make a business model of making money off non-spammers who have been
> adversely affected by the known inappropriate use of the 2/3 listings.

I can partially agree.
The make money by that, especially with whitelisting.
But be aware: Automatic removal doesn't cost money, manual removal need
manual work and that costs payoff.

> > I know this is bad for innocent customers of the ISP, but the
> > question is if they like a provider that supports spam. If not,
> > they should complain to their ISP and if that ISP doesn't care,
> > they can look for another.
>
> I don't think you have characterized the ASNs which may land on the
> 2/3 list correctly.

According to their lists they have a huge amount of impacts and these
are only the impacts that went to their spamtraps.

> > According to the statistics of uceprotect, there is only a really
> > small amount of provider that tolerate spammers, but these are
> > responsible for a huge amount of the spam.
> >
> That fact has nothing to do w/ our discussion. The healthy blocklist
> use is successful in blocking huge amounts of spam. We don't *need*
> unhealthy use.

True, but it is the server operators decision. Nobody is forced to
block incoming mail by ucep level 2 or 3 lists.
If these providers decide to,it MAY has the reason that from these
networks a huge amount of spam occurs.
I operate my own mail server without any block list, I currently don't
receive spam.

> >> I'm saying that UCEP is hurting and 'fleecing' innocents based on
> >> the misuse of its products. Intentionally.
> >
> > Level 1 only lists IPs of spamming server. Level 2 and 3 list
> > networks/entire ASN.
> > It is clearly explained how these addresses come in and out.
> >
> Yes.
>
> > If a server operator decides to block IPs that are listed in level
> > 2 or 3, it is their decision because they are annoyed by these ISPs.
> > Customers of them who don't want to send spam should take action and
> > choose an ISP that cares about abuse.
> >
> I understand the concept of 'my server, my rules' but the result is
> that innocent users who don't even configure servers are adversely
> affected, as are innocent providers who don't spam, while UCEP makes
> money off unhealthy behavior and innocent 'suffering'. There's
> something wrong there.

I can agree with the first, but how networks of providers that don't
spam come to the blocklist without at least one impact?
And if only a small amount of impacts occur, only the IPs affected will
land on level 1.

> >> i'm also saying that the blocklist community as a whole, a larger
> >> body of anti-spammers, is critical of UCEP for that.
> >
> > I agree that it is overblocking, but every kind of blocking will hit
> > innocents. The question is just: Why don't ISPs care about abuse?
> > If they care, they won't land on level 3.
> >
> The larger body of healthy blocklists also have some collateral
> damage, but nothing that even comes close to what UCEP makes a living
> on.
>
> > It is completely clear that a huge amount of spam need to be sent
> > from an AS to land in that level.
>
> The 'policing' of an entire huge ASN has to take place at a much more
> granular level than the 'top' of the ASN number.

Which do you suggest?
IIRC they already use a formula that cares about the size, so a few
amounts on a big ASN have another reaction that the same amount on a
tiny ASN.

Marco Moock wrote:
> According to their lists they have a huge amount of impacts and
> these are only the impacts that went to their spamtraps.

Not everything that 'hits' a spamtrap is a spam. For example, I was
reading a comment by someone at linode who said that

> Just from the security logs on our own linode servers, there are many
> "research scanners" on linode's network now. They constantly port
> scan and search all IP addresses for vulnerabilities. This causes
> large numbers of Linode's IP addresses to be blocked; adversely
> impacting us real customers who are not sending spam.

Not that I think 'anyone' - research or otherwise - should be
'recklessly' port scanning 'the world' - but 'hitting' a spamtrap w/ a
port scan and 'connecting' is NOT the same as spam.

That is what I mean by the black and white issue.

I don't know the answer to how to do the policing, but if it were easy
enough for customers to vote w/ their 'feet' by walking out of their
relationship w/ a server business, not only would it make sense to 'walk
out' of a server which belongs to an ASN which gets itself listed even
in UCEP 2/3, but it would also make sense to walk out of a provider
which uses UCEP 2/3 to block mail.

--
Mike Easter

On 9/12/23 15:46, Mike Easter wrote:
> Marco Moock wrote:
>> According to their lists they have a huge amount of impacts and
>> these are only the impacts that went to their spamtraps.
>
> Not everything that 'hits' a spamtrap is a spam.  For example, I was
> reading a comment by someone at linode who said that
>
>> Just from the security logs on our own linode servers, there are many
>> "research scanners" on linode's network now. They constantly port
>> scan and search all IP addresses for vulnerabilities. This causes
>> large numbers of Linode's IP addresses to be blocked; adversely
>> impacting us real customers who are not sending spam.
>
> Not that I think 'anyone' - research or otherwise - should be
> 'recklessly' port scanning 'the world' - but 'hitting' a spamtrap w/ a
> port scan and 'connecting' is NOT the same as spam.
>
> That is what I mean by the black and white issue.
>
> I don't know the answer to how to do the policing, but if it were easy
> enough for customers to vote w/ their 'feet' by walking out of their
> relationship w/ a server business, not only would it make sense to 'walk
> out' of a server which belongs to an ASN which gets itself listed even
> in UCEP 2/3, but it would also make sense to walk out of a provider
> which uses UCEP 2/3 to block mail.

Anyone who causes or otherwise contributes to interference with the
timely and proper delivery of legitimate mail or equivalent electronic
or digital traffic *should hang*, period. We've heard the rationale that
rights end where they step on others. Well, the right to no spam is not
an exception! I think I will develop a new sig, my current 'list' seems
inadequate.

--
It is YOUR responsibility to advise YOUR internet provider whether YOU
want email traffic sent to YOU to exclude emails passing through servers
that may also pass spam traffic. You may not even be aware that such
filtering is done on your behalf. But if knowingly or ignorantly YOU
nonetheless subscribe to the employ on your behalf of such spam
blacklists while failing to immediately remove my email address from
such blacklists enabled in the first place by people who have no
scruples about causing harm to innocent victims then in that act YOU
attack MY freedom to communicate. YOU attack my freedom to communicate
not only to you but to others as well by virtue of your support for the
existence of such lists. Upon the discovery of such I will never again
communicate any business or personal communications to you, thus in
effect removing YOU from my life as if YOU did not even exist because
that is exactly what you are doing to ME who never sent a single spam
message but whose right to freedom of speech is far more fundamental
than yours to receive no spam. This is especially applicable if YOUR
exercise of that right not only steps on but totally disposes of mine.
Keep all your records, you will have been warned sans-prejudice to any
right(s) I may be advised to defend by seeking legal rectification
against and compensation from you.

bad sector wrote:
> Anyone who causes or otherwise contributes to interference with the
> timely and proper delivery of legitimate mail or equivalent electronic
> or digital traffic *should hang*, period. We've heard the rationale that
> rights end where they step on others. Well, the right to no spam is not
> an exception! I think I will develop a new sig, my current 'list' seems
> inadequate.

One of the problems w/ one of my arguments:

> it would also make sense to walk out of a provider which uses UCEP 2/3 to block mail.

.... is that the blocking of a mail is the most obvious to the *sender*
of the mail, NOT the person who failed to receive it, who would have to
be the one doing the walking as above.

Altho' it requires more resources to receive/process a spam (and label
it as such for the recipient), that 'investment' by the mail provider is
MUCH better for the recipient's 'well-being'. That way if the mail
provider mis-IDs a spam, the problem can be rectified.

Once I had a mail provider whose 'normal' spam id was very very leaky,
it also /offered/ a tighter configuration which included not only the
spam which the leaky filter IDed, but also any mail received from an
address not in my contacts. That was NOT a very good system. However,
I chose to turn off that filter and use a SpamPal system which was much
more effective, and also allowed me to 'catch' tons of spam (not in my
inbox) to be auto-submitted for contributing to the SpamCop blocklist.

My current mail provider's spam filters are excellent.

--
Mike Easter

Am 12.09.2023 um 12:46:27 Uhr schrieb Mike Easter:

> Marco Moock wrote:
> > According to their lists they have a huge amount of impacts and
> > these are only the impacts that went to their spamtraps.
>
> Not everything that 'hits' a spamtrap is a spam. For example, I was
> reading a comment by someone at linode who said that
>
> > Just from the security logs on our own linode servers, there are
> > many "research scanners" on linode's network now. They constantly
> > port scan and search all IP addresses for vulnerabilities. This
> > causes large numbers of Linode's IP addresses to be blocked;
> > adversely impacting us real customers who are not sending spam.
>
> Not that I think 'anyone' - research or otherwise - should be
> 'recklessly' port scanning 'the world' - but 'hitting' a spamtrap w/
> a port scan and 'connecting' is NOT the same as spam.

Full ack.

On 9/13/23 15:39, Marco Moock wrote:
> Am 12.09.2023 um 12:46:27 Uhr schrieb Mike Easter:
>
>> Marco Moock wrote:
>>> According to their lists they have a huge amount of impacts and
>>> these are only the impacts that went to their spamtraps.
>>
>> Not everything that 'hits' a spamtrap is a spam. For example, I was
>> reading a comment by someone at linode who said that
>>
>>> Just from the security logs on our own linode servers, there are
>>> many "research scanners" on linode's network now. They constantly
>>> port scan and search all IP addresses for vulnerabilities. This
>>> causes large numbers of Linode's IP addresses to be blocked;
>>> adversely impacting us real customers who are not sending spam.
>>
>> Not that I think 'anyone' - research or otherwise - should be
>> 'recklessly' port scanning 'the world' - but 'hitting' a spamtrap w/
>> a port scan and 'connecting' is NOT the same as spam.
>
> Full ack.
>

The list scammers are well aware of that, it couldn't be a milk cow
otherwise

Real cops should investigate the incomes

bad sector wrote:
> The list scammers are well aware of that, it couldn't be a milk cow
> otherwise
>
> Real cops should investigate the incomes
>
I am very slightly more 'sympathetic' to the UCEP crooks, who ARE rather
transparent about their game.

They more or less say/admit that their level2/3 product is not 'fair'
and known to list innocent bystanders and should not be used by
'conventional' servers because of its known (significant) collateral
damage effects.

Their position is that it is a 'weapon' to be used by *hardliners* who
think that by punishing the innocent of a particular ASN along w/ those
others who buy IPs or blocks from that ASN who aren't doing 'enough'
vigorous policing of their own IPs to not get listed by UCEP levels,
that it will somehow motivate more IP blocks to do better.

That is, UCEP is sympathetic to the views of the hardliners AND it has
found that being so is profitable to them.

That doesn't mean that I *agree* with them, just that I can
see/understand that point of view even if I don't agree.

--
Mike Easter

Mike Easter wrote:
> I am very slightly more 'sympathetic' to the UCEP crooks, who ARE rather
> transparent about their game.

And, while we are letting my 'imagination' and 'understanding' run amok,
I can imagine that there might've been a time and place situation in
which the 'protection' offered by mafia figures was /actually/ *real* --
that a neighborhood 'plagued' by small-time hoods picking on mom-pop
shop-owners might pay the heavier-hitting mafioso to protect them from
such thievery and disturbance. That is, in some certain case, it might
NOT be extortion money but real protection insurance.

--
Mike Easter

On 9/13/23 17:31, Mike Easter wrote:
> bad sector wrote:
>> The list scammers are well aware of that, it couldn't be a milk cow
>> otherwise
>>
>> Real cops should investigate the incomes
>>
> I am very slightly more 'sympathetic' to the UCEP crooks, who ARE rather
> transparent about their game.

I wanna see interpol involvement, there should be
no panic if nothing is illegal, right?

- someone traps spam or creates spam suspects
- someone compiles a blacklist of alleged spamming servers
- someone promotes the idea of subscription as spam defense
- someone extracts innocent victims from blacklists for money

who's to say it's not all one and the same hand really?