[38042] in North American Network Operators' Group
RE: ORBS (Re: Scanning)
daemon@ATHENA.MIT.EDU (Derek Balling)
Sun May 27 14:44:40 2001
Mime-Version: 1.0
Message-Id: <p05100f0eb736f99f234b@[198.144.200.170]>
In-Reply-To: <9DC8BBAD4FF100408FC7D18D1F0922860E46BB@condor.mhsc.com>
Date: Sun, 27 May 2001 11:40:37 -0700
To: Roeland Meyer <rmeyer@mhsc.com>, nanog@merit.edu
From: Derek Balling <dredd@megacity.org>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
Errors-To: owner-nanog-outgoing@merit.edu
> > I think this is all a phrasology thing.
>
>I'm sorry. I hate hare-splitting too.
So long as we at least decide what it is we're disagreeing on. ;-)
>My bad. What I meant was a MAPS-blocked system as a subcriber to MAPS. Not a
>MAPS-known spam source.
>
That's what I had thought you meant. :)
> > Then your statement further makes no sense, because any
>> non-MAPS-listed host could (in theory) send mail to/through that
>> system. If the system using MAPS is an open relay, then
>> non-MAPS-listed hosts could quite happily/easily pump mail through
>> that system regardless of whether or not it is using MAPS.
>
>Not true, I'm assuming that MAPS isn't the only anti-spam measures being
>implemented.
But @BLOCKED_HOSTS != @WHOLE_OF_INTERNET, so it doesn't matter WHAT
anti-spam features they're using, if they're an open relay, they
deserve to be in ORBS.
Another hair to split is that "ORBS" is not a list. It's a COLLECTION
of lists. The above-described open-relay should be listed on the
inputs.orbs.org list.
> > I think my personal evidence (that about 90-95% of my spam that is
>> blocked is NOT from MAPS sources) does not seem to bear that out.
>
>You bear out my assumptions that other methods, besides MAPS and ORBS, are
>being deployed as well. Feeding such data into MAPS would improve MAPS
>accuracy.
I don't think so. Judging from discussions in forums where this topic
is more prevalent (spam-l, spamtools) MAPS seems to be a bit of a
blackhole itself, with lots of sites being nominated as spam sources
for the MAPS RBL and very few actually seeming to get listed.
D
--
+---------------------+-----------------------------------------+
| dredd@megacity.org | "Conan! What is best in life?" |
| Derek J. Balling | "To crush your enemies, see them |
| | driven before you, and to hear the |
| | lamentation of their women!" |
+---------------------+-----------------------------------------+
