Re: [anti-spam-wg] [Fwd: FW: [technical] RIPE anti-abuse draft]

[peter h peter@localhost]

On Monday 20 November 2006 21.32, Dave Crocker wrote:
> Folks,
> 
> Hi.
> 
> I forwarded a reference to the Last Called draft
> <http://www.ripe.net/ripe/draft-documents/bcp-abuse.html> to the technical 
> subcommittee of MAAWG <http://maawg.org>.
> 
> MAAWG membership has become relatively diverse, although still tending towards 
> larger operators and senders.  However the current diversity is enough to 
> produce differing opinions during lots of discussions...  Always a good test of 
> honest representation and debate.
> 
> It can only help to have drafts get circulated widely among interested parties, 
> so I took the Last Call request as an opportunity to solicit MAAWG folks. (In 
> fact, there is about to be a draft *from* MAAWG that will find its way to RIPE, 
>   and similar groups, for review prior to publication.)
> 
> Attached is a response from one of the active participants. For clarity, I 
> should note that his response is from the Cox team and not from MAAWG.  I should 
> further note that I am relaying it without comment on its content.
> 
> d/
> 
> -------- Original Message --------
> Subject: 	FW: [technical] RIPE anti-abuse draft
> Date: 	Mon, 20 Nov 2006 15:05:25 -0500
> From: 	<Bill.Oxley@localhost
> To: 	dcrocker@localhost
> 
> Dave,
> 
>   selected comments from our abuse department.
> Thanks,
> Bill Oxley
> Messaging Engineer
> Cox Communications
> 404-847-6397
> 
> _____________________________________________
> 
> In general the guide seems written on the assumption that the customers
> are commercial in nature and that they're sending email intentionally.
> Most of our complaints are residential customers and/or trojan infections.
> 
> Here are a couple of particular points that stand out:
> 
> - - The ISP MUST ensure that the alleged abuser is NOT informed of the
> identity of those who are reporting the abuse, except with their
> explicit permission.
> 
> That's an excellent principle, but it can't always work.  In particular,
> there are cases where a customer runs a legitimate mailing list, and the
> complainant simply forgets they've signed up.  They continually send
> spam complaints against the customer, and the only fix is to let the
> customer know who the complainant is so they can be removed from the
> list.  Every legitimate large-scale mailing list gets at least a few
> false positives like that.
> 
> - - If a second origination of UBE by the customer occurs within six
> months the ISP MUST terminate the customer's account and all services
> connected with it. The loss of the sender's connection to the Internet
> from a particular e-mail address is an important sanction in combating UBE.
> 
> Terminating a customer on a second spam complaint is somewhat
> unrealistic.  First contact may fail for a number of reasons.  For
> instance, many customers don't check their mailboxes, and they never see
> the first warning.  We find that a "three strikes" policy makes more
> sense: warn, temporary suspension, termination.  In practice, we
> actually suspend a customer multiple times before termination.  E.g. in
> the case of a trojan infection, we'll typically give the customer more
> than one chance to clean it up.  In extreme cases, we can take drastic
> measures such as requiring a harddrive format before reactivation, and
> that usually prevents us from having to terminate a customer completely.
> 
> 
> 
> Atlanta)
> 
> 

Terminating or at least disabling a user at first spam is totally realistic.
Any reasonable AUP may include this condition.

The lame ISP that allows continued spam from a detected source is what makes
spam possible ( at least a major part of the problem)

How else is the "proffesional spammer" that uses throw-away accounts stopped ?

( Yes blocking port 25 would be a heavenly gift if more ISP dared to do)



-- 
        Peter Håkanson   

        There's never money to do it right, but always money to do it
        again ... and again ... and again ... and again.
        ( Det är billigare att göra rätt. Det är dyrt att laga fel. )