[Merged] Spam/Viruses on ntl. - Page 3

threadbare · 07-01-2004, 10:29

Quote:

Originally Posted by stuartbe

Ahh - but !!

If filtering has been switched on how do you know for sure that you have not lost any mail ???????????????????????

um because I do.... I get messages from personal friends who i am in contact with. I send info from work to my mail addy. I get my usual newsletters and adverts from companies I buy stuff off, and information emails from other companies. sorry stuartbe I am not missing anything.

Enterian · 07-01-2004, 10:30

Quote:

Originally Posted by stuartbe

Thats providing that NTL dont put 127.0.0.1 in the blacklist

Don't laugh - I've heard of NTL address ranges being blacklisted!

That should produce some interesting results!

Enterian

threadbare · 07-01-2004, 10:46

Quote:

Originally Posted by Enterian

Don't laugh - I've heard of NTL address ranges being blacklisted!

That should produce some interesting results!

Enterian

if they are spamers then good riddance to 'em!

Stuartbe · 07-01-2004, 11:16

Quote:

Originally Posted by threadbare

um because I do.... I get messages from personal friends who i am in contact with. I send info from work to my mail addy. I get my usual newsletters and adverts from companies I buy stuff off, and information emails from other companies. sorry stuartbe I am not missing anything.

Sorry m8 but I cant believe that you can account for every single email that has been sent to you. Do you have a list of everyone that has ever tried to send you an email ?

If this filter is in place then how do we know how many email have been deleted ? I wonder if ntl have a list.

Stuartbe · 07-01-2004, 11:20

Quote:

Originally Posted by threadbare

if they are spamers then good riddance to 'em!

Yes - But

When NTL had there mail server added to the blacklist it was due to someone spoofing the ip of the mail server and hammering people with junk.

What happens if a user falls out with a company, spoofs there IP and gets the server blocked. The block can be removed but this takes time. That companys mail will get deleted during that time - that could cost the company a LOT of money.

daemon · 07-01-2004, 11:21

I employ both server-side blocking (using dsbl.org and spamhaus.org) and client-side filtering (using annoyance-filter, a Bayesian Spam filter) and some Spam still gets through.

The server-side blocking checks four listings dsbl.org's primary and multi-hop open relay lists and Spamhaus's SBL and XBL lists. This imposes four DNS lookups for each legitimate e-mail I receive and fewer for caught Spam. Imagine how much overhead a similar system would add to NTL's processing of customer e-mail.

The client-side filtering is also a significant processing overhead. Each received e-mail has to be scanned for occurrences of words in the dictionary and evaluated as to whether it is legitimate e-mail or Spam. This type of processing would be costly to implement at the server and is best left to free CPU cycles of NTL's customers' machines.

So I hit Spammers hard with two techniques. At the server I implement a blocking mechanism that can inconvenience legitimate senders (if their ISP's servers get listed because a customer has been using their network to send Spam) by bouncing their e-mail. At the client I filter based on recent legitimate e-mail and Spam content. This requires periodic maintenance and continual monitoring.

In conclusion, no blocking or filtering solution is ideal. The real way to defeat Spam is through global legislation with severe penalties but as most Spammers tend towards the criminal, this is unlikely to produce tangible results.

I believe that NTL should employ server-side blocking of known Spam outfits through the use of e.g. Spamhaus lists but leave the content filtering to their customers. This will lead to users requiring not only anti-virus and firewall programs but also an e-mail content filtering program.

Regards,
Neil Darlow

Sociable · 07-01-2004, 11:27

Quote:

Originally Posted by stuartbe

If this filter is in place then how do we know how many email have been deleted ? I wonder if ntl have a list.

Care to speculate on just how many people have deleted wanted mail by accident because it was lost in a long list of spam and they got trigger happy?

Besides the message is not "deleted" it is bounced. LOL

Stuartbe · 07-01-2004, 11:41

Quote:

Originally Posted by Sociable

Care to speculate on just how many people have deleted wanted mail by accident because it was lost in a long list of spam and they got trigger happy?

Besides the message is not "deleted" it is bounced. LOL

True - I have deleted mail like this myself.

The message is as good as deleted for the user. If the mail bounces it will usualy go to the domains postmaster account. If its an ISP they will get thousands of these a day due to mistyped address ect, thay are not going to bother informing the sender that the mail has gone walkies !!

If the message is bounced to a company the mail will again go into the postmasters mailbox. Speaking by my own experience this box is hardlry ever checked. The last company I worked for was a large e-tailer company in luton

and the postmaster box used to have well over 1000 mails a day coming in. There is not a systems admin in the world who is going to sit there and go over that lot !!!

threadbare · 07-01-2004, 11:46

Quote:

Originally Posted by stuartbe

Sorry m8 but I cant believe that you can account for every single email that has been sent to you. Do you have a list of everyone that has ever tried to send you an email ?

If this filter is in place then how do we know how many email have been deleted ? I wonder if ntl have a list.

I can see where you are comming from but I am pretty certain I have not lost any mails whatsoever. I dont have tons of email comming thru anyhow so it is very easy to manage

threadbare · 07-01-2004, 11:49

Quote:

Originally Posted by daemon

I believe that NTL should employ server-side blocking of known Spam outfits through the use of e.g. Spamhaus lists but leave the content filtering to their customers. This will lead to users requiring not only anti-virus and firewall programs but also an e-mail content filtering program.

Regards,
Neil Darlow

i believe this is what they are doing

SMHarman · 07-01-2004, 11:56

I said block at the server, but I think the option to opt out is something that should exist.

As I said on the other thread, from what I have read about my POP server providers Demons solution, this looks to be a sensible solution in that up to 17% of spam will get through, but the chances of incorrect flagging are virtually 0.

Brightmail the provider of the solution have set up e-mail accounts at hosts globally. These have never been publicised on the web. If a mail arrives in the in box of one of these accounts, by default it must be spam and is blacklisted.

Sociable · 07-01-2004, 11:59

In both examples you use stuartbe the postmaster would be very fast (or should be) to pick up on a sudden increase in bounced traffic.

Failure to rectify the situation and also explain the problem to its users would also result in a fairly large drop in its user base in pretty short order too I would think.

Stuartbe · 07-01-2004, 12:09

Quote:

Originally Posted by Sociable

In both examples you use stuartbe the postmaster would be very fast (or should be) to pick up on a sudden increase in bounced traffic.

Failure to rectify the situation and also explain the problem to its users would also result in a fairly large drop in its user base in pretty short order too I would think.

Thats true m8 - he would pick up on it. BUT

1. We are talking about NTL mail admins - Doesn't inspire confidence when they cant even get the mail servers to run correctly.

2. The original email that was sent is still not going to arive at the correct destination. The admin would have to re-send every mail and change the from/to header. Even with only 100 mails this is a huge task. So the mail has gone and the sender will have to re-send, if he remembers to do this then fine but by this time a minimum of 24 hours will have passed and if the mail was urgent its pretty useless by then !!

Jon M · 07-01-2004, 12:11

Quote:

Originally Posted by stuartbe

The message is as good as deleted for the user. If the mail bounces it will usualy go to the domains postmaster account. If its an ISP they will get thousands of these a day due to mistyped address ect, thay are not going to bother informing the sender that the mail has gone walkies !!

If the message is bounced to a company the mail will again go into the postmasters mailbox.

Not quite right i'm afraid.

Bounces should always go to the originator, any bounce that doesn't do so is incorrectly configured as you can't presume a postmaster account is active or available on every mail server there is.

The reason it looks like the bounce has gone to postmaster is usually because
the postmaster account can be configured (or not) to recieve copies of every NDR (non delivery report) on the domain it serves.

Mis-addressed email should always get an NDR in reply to the originator.

I administer an exchange server and can vouch for the fact that postmaster accounts can be totally flooded.. but, if configured correctly your admins should be able to check it easily, as most of the traffic is caused by NDR reports that are automated and can be filtered out.

Jon M · 07-01-2004, 12:25

Quote:

Originally Posted by beardsley

Do you really think that NTL would have a well established and maintained blacklist?

<snip>

My opinion is that the ideal would be for NTL to offer this as an option - with the default being to not filter.

I didn't actually mention NTL in my post.. but my answer to that question is yes. Because the blacklist method I mentioned before (spamhaus) is maintained and updated by the blacklist operators.. not NTL.
All they would need to do is make sure the list is updated from the blacklist servers periodically (hopefully even NTL's admins can't get that wrong).. and job done, roberts your mothers brother.

I agree with you on having an opt out option though.