spf-discuss
[Top] [All Lists]

RE: FTC: we need sender authentication before "DoNot Spam" can work

2004-06-17 08:36:42
From: Paul Howarth
Sent: Thursday, June 17, 2004 1:36 AM


On Wed, 2004-06-16 at 23:21, Seth Goodman wrote:
I've never heard of a blacklist that waits for spammer to
respond when there
is evidence in hand.  If you believe that system operators
would prefer to
use a list with that policy, I encourage you to start one.  The
market has
done an excellent job of expressing what people want, and it
does not seem
to include "spammers' rights".

Actually the "daddy of all blacklists", the MAPS RBL works like this:

From http://www.mail-abuse.com/services/mds_rbl.html :

  "All listings have been carefully investigated and confirmed to be
   a source of spam. Before any IP address is added to this list,
   effort is made to contact the owner of the address and correct the
   issue of spam being sent. Addition to this list is only as a last
   resort after an agreeable resolution cannot be made."

Unfortunately, many anti-spam activists consider that MAPS went brain-dead
years ago.  Of course, if you like the idea that an IP is only added after
every possible measure is taken to exonerate the purported offender (and
their spam run is largely complete), it certainly your decision to select
this list, as well as pay for it.  This is a very conservative listing
policy and it may suit your needs quite well.  Most people don't choose that
service, but that's what makes the world go 'round.

However, I do have to change my previous statement, as I now know of a
blacklist that contacts the spammer and gives them a chance to "correct the
problem" before listing them.  I don't doubt that many responsible
blacklists will first contact a provider that is _known_ to promptly take
action on abusive accounts.  However an unknown service that generates
multiple complaints in a short period deserves to be listed immediately and
that's exactly what most lists do.  If these lists generated too many false
positives, people would stop using them.  They do not, and neither do they
have to resort to the spammer-friendly policies of MAPS to achieve that.

--

Seth Goodman


<Prev in Thread] Current Thread [Next in Thread>