Re: Administrative Overheads Arising from UCE

[Swa Frantzen <]

>     - they do NOT warn responsible people about the fact they are now
>       blacklisted
> If postmaster is not responsible, then who is?

Experience shows no warnings are received in most cases.

>     - they seem have a very bad open relay test,
> Seem, eh? Do you have hard evidence?

Experience shows they lock out perfectly OK machines.

>     - they do not remove a blacklisted site after a given amount of time
> If they would, they would need to *regularly poll*
> the hosts. BC Tel, for one, considered that to be
> a violation of their AUP.

If you continue to refuse it forever and never check if it is OK (or again
if it wasn't ok to begin with) and don't have a reliable way to warn people
you will eventually end up blacklisting the whole world.

>     - they are rather obscure, even this lists readers don't seem to know
>       all where to find them.
> Why would that mean that they are obscure?

If people interested in anti-spam can;t locate their website,
how would you expect uninterested end users to be able to do just that ?
[because it is the only reliable way to see if they blacklisted you]

>     result:
>     most (not open) relay servers of ISP's are on ORBS and it's nearly
>     impossible to keep it off, as soon as you have one of your thousands
>     of emails flagged by somebody as unwanted the ISP relay ends up on
>     the list without any warning.
> Once again: please provide hard evidence.

Can only speak of experience.

>     Any good technical implementation has to (IMHO)
>     ...
>     - keep into account number of mails passed on the server without problems
> Huh?!?

As explained in great lengths before the law should try to have zero tolerance.
You cannot expect large organisations never to leak any spam,
you can expect them to 
- react to it (but you should warn them !!)
- have a reasonable low leackage compared to their size

(a S/N ratio in other words)

> You can't call them in the first place. Which isn't
> really surprising, given the number of threats they
> already received.
> Why should an open relay be allowed for days, weeks,
> years, and removal from the blacklist happen within
> an eye's wink?

The ones that have an open relay are more ignarant or too trusting in
their vendor. They are NOT evil.
I do agree open relays are a bad idea and make it easier for spammers
to do their thing, but it has to remain clear that it are not the open
relays that are the source of the problem. It are the spammers that are
the evil ones.

>     - have a decent website associated with it at a stable URL
> They have.

Even if you  have somebody who knows about ORBS they'll still try the
dorkslayers URL ...

SWA
-- 
          --------- ____                           -----
          -------- /      /   /   ___    ___  _/_ ------
          ------- /----  /   /  /   /  /___/  /  -------
          ------ /____  /___/  /   /  /___   /  --------
          -----                                ---------
Swa Frantzen                         tel: +32 70 233909
Senior System Engineer               fax: +32 70 233808
EUnet Belgium NV/SA                  http://www.Belgium.EU.net
Interleuvenlaan,5 B-3001 Leuven