A confederation of e-mail dunces

A confederation of e-mail dunces
: My outgoing email is working again and it’s frightening what made it break.

If I have all this right…

Njabl.org, a self-appointed spam blacklister, blocked my Cablevision IP not because it’s associated with spam but just because the address is assigned dynamically (like most addresses on the Internet). Hosting Matters, my host, in turn uses the njabl blacklist. So Hosting Matters blocked me from sending email through its server.

It was fixed when Hosting Matters whitelisted me. (Though I now wonder–will other receiving email servers now block me? What happens when I get a new DHCP IP through Cablevision?)

What’s wrong with this picture?

First, njabl sets its own laws and like a Wild West posse rides off to lynch good citizens without a trial. The cause is good. The intention is good. The action is deadly.

Second, Cablevision has to now contact this blacklist group to deal with it and get off the list.

Third, Hosting Matters joins the njabl posse by using its blacklist, although it is created with dubious logic.

And the bottom line is that a user, a customer, a citizen, an innocent is blocked from doing what he needs to do. I’m in the Internet business, so I tracked down the cause and got somebody to fix it (with some great help from Charlie Martin). But I can’t imagine my mother or your grandmother doing this.

They’re killing email with the best of intentions.

Of course, the real evildoers are the spammers. They’re the ones killing email.

But the vigilantes are doing harm themselves.

And they feel the need to step in because government has not.

Email is in a crisis. Email is broken. Email is anarchy. Email has to be fixed and it’s the government’s job to step in and slam the spam. (Or if you don’t watch out, watch out, the U.N. will start talking about taking over.)

This is utterly unacceptable.

: And, by the way, isn’t it amazing about this ‘sphere that at midnight, a nice guy like Charlie would leave me comments and email me and volunteer his phone number just so he could help a friend in need. That’s what’s great about this medium. Evildoers and posses aren’t so great.

: UPDATE: Reader Dann has a very good comment explaining much of this. I don’t pretend to know how it all works. Anne also questions my point on government.

It’s a chicken-rotten-egg thing: If there were tough laws to regulate spam, then we’d be going after the source of the problem, the people who are vandalizing and stealing our services. But instead, a lot of good people just trying to do their jobs — Hosting Matters, Cablevision, nbabl, me — are stuck trying to clean up this mess. That’s not right.

11 responses to “A confederation of e-mail dunces”

  1. anne.elk Avatar

    Not disagreeing with much of what you said, but the real problem here was at hosting matters for not whitelisting all of their customers automatically, for not understanding the technology they use, for not testing their implementation, for not communicating with you changes to their operations, and for not educating their tech support as to the changes in their operations.
    That said, google reveals lots of people having problems with an overly aggressive and hard to contact njabl. Why not discuss this amongst the hostingmatters warblogger keiretsu and ask hostingmatters to stop using njabl….?
    Also, njabl, hostingmatters, etc. All private organizations. It’s not clear to me why the solution is that the gov’t needs to step in. Capitalism and free markets are also an alternative and in this case would work better for you and faster. Why not move your blog to a better run organization?
    I wouldn’t expect gov’t to step in soon. Your favorite 43rd just signed “canspam”. This is really the “Anyone can spam” bill. It allows for opt-out spamming in which anyone can stick you on their spam list and make you opt out, and it creates a do not spam list that will surely be used to collect email addresses for spammers.
    More bushco incompetence, cronyism, and misunderstanding of tech. Let’s reelect him!

  2. Dann Avatar

    Hi Jeff and Co.
    In another life (and under a different identity), I’ve done quite a bit of bush-league spam fighting. So yet another example of how connectivity can bring together unique and otherwise unrelated points of view.
    1. I’ve never heard of the block list that had picked up your IP range. So I can’t attest to how well they manage their list.
    That being said, dynamic IPs are a huge spam problem. I’ve got one spam trap working that is being hit by a ‘new’ spammer on a regular basis. This spammer is using various dsl/dialup accounts and operating their own MTA. Whatever software package they are using fails to insert an appropriate rDNS value as well. This is becoming a pretty common occurrence amongst the community of spammers.
    Their objective is to make sure that no one is able to track their activities. Forcing them to run all of their mail through their ISPs mail server would cause the ISP to ask questions and the spammers hate questions.
    2. I read the dnsbl.njabl.org listing criteria and it seems pretty straightforward. They list the dynamic IP ranges of ISPs that do not take immediate action against the spammers.
    If you feel the need to have a ‘pointed discussion’ (as another poster suggested), then I suggest you have it with Cablevision. Ask them if their abuse desk is manned 24 hours a day. Ask them if they suspend access on the FIRST complaint to their abuse@ address. Ask them if they terminate accounts after the FIRST confirmed report of spamming.
    3. Most of the block list operators with whom I am familiar are pretty thorough and pretty straight forward. They send complaints when they get spam (or when someone like Ralsky sets up shop). They add the IP address that is the source of the spam and send yet another complaint when the next round of spam arrives. When the IP source starts bouncing around, they send another complaint and add the entire range of IP addresses.
    Most of this wouldn’t be necessary if ISPs would simply pull the plug on the spammers after the first complaint.
    4. It has been said (and I happen to agree) that the Internet is transforming into two networks; the spamming network and the non-spamming network. Your ISP’s lack of effective enforcement by their abuse desk indicates that they want to be on the spamming network.
    5. Block lists are not ruining e-mail. Spammers are ruining e-mail. Everyone knows someone with an account that has been ruined by spammers that confuse knowing an e-mail address with having permission to send commercial messages to that address.
    While we might grumble about security delays, we don’t blame the TSA for ruining air travel. The same is true of e-mail.
    -Regards

  3. Jack Barse Avatar

    Sounds to me as though your hosting provider needs to pay more attention. DNSBLs can be a very effective weapon against spam but they must be closely monitored. As you found out, some are very aggressive. And any mail server operator who doesn’t know enough to whitelist (or make other arrangements for) his own subscribers is not qualified to provide email services.
    More government is not the answer to spam, Jeff. Good tools for mail server admins, more vigilance and swift action by ISPs, and better features in mail client software will all help win the battle.

  4. Fons Tuinstra Avatar

    Spamfilters are becoming a nightmare in themselves. I’m involved in a legit opt-in business news service about China and those automated spamfilters identified our emails as spam, even though receivers were begging us get them.
    Even worse, at a certain moment the ISP in Hong Kong who sends out our email identified returning test emails as spam, stopping us from getting our own emails.

  5. Dann Avatar

    E-mailed and posted to BuzzMachine for Fons Tuinstra
    A quick check revealed a couple of things.
    1. Your IP is only in two block lists one of which is BLARSBL. Everybody is in BLARSBL. PTR is current identifying your IP has not having an appropriate rDNS configured. A couple of other checks indicated that this is still the case.
    One trick that spammers like to pull is to fake the rDNS. Many spam filters will test the inbound IP to see if the rDNS entry matches what is in the e-mail header. Those that don’t match are either rejected or flagged. This is probably a big part of your problem.
    You need to configure your system so that the rDNS value correlates to your IP address and that your outgoing mail server is using exactly the same rDNS value.
    This was a problem where I work some time ago. We fixed it. Things are better.
    2. Your system for signing up subscribers exposes you to trouble. The only secure method of signing up subscribers is called “confirmed opt-in”. This is a three step process that requires the user to supply an address, a confirming message with a unique value/token is then sent to the user, and finally the user confirms the subscription by replying to the confirmation message with the unique value/token still intact.
    This process ensures that some nefarious person doesn’t add someone else’s address to your list without the address owner being aware of and approving the subscription.
    Your system is open to abuse and will likely end up in some pretty nasty block lists at some point in time.
    -Regards

  6. Jeff Jarvis Avatar

    Dann: I don’t have subscribers of any sort. I just have a web page.

  7. Dann Avatar

    Hi Jeff-
    Sorry, I was responding to Fons Tuinstra and couldn’t be certain that the e-mail would reach him.
    Your problem has more to do with the agressive, anti-dynamic IP njabl and the fact that your mail comes from a dynamic webspace.
    Sorry for the confusion.
    -Regards

  8. Bryan C Avatar

    Blacklists are far more trouble than they’re worth. I’ve never dealt with Njabl.org, but my experience with other blacklist providers has been almost universally negative. As private organizations they’re accountable to no one and welcome to act however they please, but ISPs should carefully consider before subjecting their own customers to that same level of service. Spam is annoying, but blocking legitimate email is much worse.

  9. Dann Todd Avatar

    Bryan-
    [cynic mode]
    spoken like a true spammer
    [/cynic mode]
    block lists have plusses and minuses. It is important for operators to know about the listing criteria and understand what will be blocked. Using any block list necessarily creates the chance of false positives.
    Again, the best answer is for ISPs to take immediate action against spammers based on the FIRST complaint.
    -Regards

  10. Eric Scheie Avatar

    Now I am worried that when I add the ISPs of Viagra spammers to my blog’s ISP blacklist, that I might also be blocking legitimate commenters!

  11. Sherri Avatar

    A former ISP (Direcway) that I had different problems with started using blacklisting. They didn’t offer an opt out for it either. AND I still recieved TONS of spam at my spam address, but my friends in egroups couldn’t get through to me! Between both problems, I dropped their services.
    I joined a local ISP, that give us the *option* of using their filter software. It’s $3 more per month, I did NOT sign up for that. I’d had enough problems with server spam filters, and I already knew how to rid most of it myself anyway (using freebie pop3 accts as spam receptacles, and Eudora’s strong filters that allow regex [tutorial]).
    After reading so many people’s problems with ISP mail server spam filter software, I will probably never sign up for it, and will filter my own spam myself. If an ISP doesn’t offer an opt out on the filtering, I won’t use them.
    Someone commented in the other email post that you should start up at least one other email, I second that. I have quite a few.