Spamgourmet listed on Spews! (x-posted)

[theq]

(crossposted from General Discussion due to lack of same)

We've been having mail (replies to incoming mail addressed to an sg address) bounce back with the following message:

----- The following addresses had permanent fatal errors -----
<[MUNGED]@sbcglobal.net>
(reason: 553 5.3.0 ylpvm48,DNSBL:To request removal of, 216.218.230.146, send the complete error message in an E-mail to removeme@sbc.sbcglobal.net)

Googling, I discovered that Spamgourmet had been listed on Spews in 2004, or more accurately Hurricane Electric (SG's provider) was providing spam support and had been listed there - and SG was collateral damage.

A search on Spews reveals it has happened again:
http://spews.org/html/S2100.html

What's the story?

[josh]

The story is -- don't use SPEWS

http://images.spamgourmet.com/phpBB2/vi ... .php?t=109

[theq]

The story is -- don't use SPEWS

http://images.spamgourmet.com/phpBB2/vi ... .php?t=109

That's not a very helpful story, given that we have no control whatsoever over other's blocking sources.

The point is that SG's provider has apparently been listed (more than once, now) for spam support and failure to terminate spammers. Irony aside, the obvious thing to do would be to move to a provider that doesn't provide spam support. Not being sarcastic - just pointing out the obvious.

The complicating factor of course, is that SG is a free service, and I'm guessing it relies on donated service - so it's not a simple thing to move. Still, SPEWS is a factually-based listing, and I'm not going to criticize anyone using it to defend their netspace.

I'm assuming there ARE options being discussed besides continuing to operate under the auspices of a spam-supporter. What are they? I'd be happy to pay my share of any costs to move SG to a non-spam supporting business. I'm sure many others feel similarly.

[SysKoll]

Find us a provider that reacts quickly when there is a hardware failure, has good prices, and reacts quickly enough to satidfy the high-minded SPEWS people. *We* are open-minded

[theq]

Find us a provider that reacts quickly when there is a hardware failure, has good prices, and reacts quickly enough to satidfy the high-minded SPEWS people. *We* are open-minded

Uh... I'm really not trying to hold your feet to the fire, but there is a large portion of the net that is NOT listed in SPEWS.
I assume (and I could always be wrong) that some subset of that has good prices and reacts quickly to hardware failure.

SPEWS lists based on factual data of spam or spam support. I'm sympathetic (despite having my mail blocked) to the trouble involved in moving, but do you really want to defend a business that supports spam - or give them your business? Or (as is more likely, I'm guessing), is the prospect of moving SG simply high on the PITA scale and a dreaded prospect?

You're not really saying there's no Plan B, are you? I love SpamGourmet and have been a user for a long time. I care about it - and I care about fighting spam, as well - not just avoiding it.

[josh]

Plan A and Plan B are both: don't use SPEWS.

Suppose I take a week's vacation, anesthetize my wife and kids, and pull off the move to another service provider -- no telling how smoothly that will go, or how happy the new provider will be (we are not quiet tenants, and we do tend to soak pipes and attract quite a bit of hostile fire). Even assuming that all works, I have no confidence that SPEWS won't list the new provider as well in 6 months. Then what -- move again?

It would be a *lot* easier for someone on spews to pull spamgourmet's IP address out of the list, but that'll never happen because they're convinced that maintaining friendly fire is the best way to put pressure on organizations they consider troublesome.

Another thing to note is that *SPAMGOURMET USERS FALSELY REPORT SPAMGOURMET* quite often out of ignorance ( http://images.spamgourmet.com/phpBB2/vi ... .php?t=456 ). Every time it happens, I get hate mail from Hurricane Electric threatening to shut down spamgourmet within 48 hours if the report isn't resolved -- hardly the actions of a spam friendly provider. Each time I go through the drill of getting the spamgourmet user to fess up to HE, who then backs off. I've never seen an analysis of HE that excluded those reports -- and I don't have the time or inclination to develop one myself. From what I've seen of SPEWS, I *highly* doubt they take this into consideration.

So, back to Plans A & B.

[theq]

Plan A and Plan B are both: don't use SPEWS.

Suppose I take a week's vacation, anesthetize my wife and kids, and pull off the move to another service provider -- no telling how smoothly that will go, or how happy the new provider will be (we are not quiet tenants, and we do tend to soak pipes and attract quite a bit of hostile fire). Even assuming that all works, I have no confidence that SPEWS won't list the new provider as well in 6 months. Then what -- move again?

If possible, I'd have to say yes.
We're (TINW) anti-spam, remember?

That said, there are unfortunately very real problems that appear to make the ideal course of action onerous - perhaps too onerous. It becomes a judgement call on the balance between being anti-spam and continuing a reasonable existence. As I said before, I'm a huge fan of SG; I was *delighted* to stumble across it and have used it happily for a very long time. SG has served me well:
Your message stats: 14,186 forwarded, 19,078 eaten. You have 328 disposable address(es).

It would be a *lot* easier for someone on spews to pull spamgourmet's IP address out of the list, but that'll never happen because they're convinced that maintaining friendly fire is the best way to put pressure on organizations they consider troublesome.

One may certainly disagree with SPEW's operating premise, but it's hard to refute spam in hand. Fact: HE has provided spam support or failed to terminate spammers in the past, and appears to be doing so again.
Whether this rises to the level of "enough-to-want-to-move-even-though-it's-a-major-PITA" is your judgment call.

Another thing to note is that *SPAMGOURMET USERS FALSELY REPORT SPAMGOURMET* quite often out of ignorance ( http://images.spamgourmet.com/phpBB2/vi ... .php?t=456 ). Every time it happens, I get hate mail from Hurricane Electric threatening to shut down spamgourmet within 48 hours if the report isn't resolved -- hardly the actions of a spam friendly provider. Each time I go through the drill of getting the spamgourmet user to fess up to HE, who then backs off. I've never seen an analysis of HE that excluded those reports -- and I don't have the time or inclination to develop one myself. From what I've seen of SPEWS, I *highly* doubt they take this into consideration.

I'm sure they don't - it's irrelevant to their model. And yes, having to do this sucks. And also yes, while I assume(d) there are hassles involved in running SG, I will be the first to admit I don't know what they are specifically. Now I know at least one more (I'm also guessing there are more.. )

So, back to Plans A & B.

Ok, so Plans A & B are suboptimal, but the best realistic plans available, is that right?

<reasonable question>
Has asking HE to cease the behavior that has gotten them listed been attempted?
</reasonable question>
When an ISP's behavior impacts it's customer, pressure from said customer is worth applying, even if direct results may not be visible. Seems like that might be a reasonable Plan A, before contemplating/threatening moving - even if the latter is not realistically an attractive option.

For now, it sounds like all we can do is hope HE doesn't devolve into a more serious netabuse source and that few we wish to communicate with use aggressive BL's like SPEWS. If that's what it boils down to, that's what it boils down to. I can legitimately be both happy with SG and unhappy with the situation, and that's where I am at the moment.

I don't know what else I can do right now, other than continue to support SG, which I just did by making a small donation (which I realized I hadn't done in some time). I encourage anyone else to help the cause by doing the same. There's a (very discrete) donation link on the main spamgourmet page - please use it!

And thanks guys for doing your best. Please keep it up.

[SysKoll]

theq,

Thanks for your kind note. We appreciate users' feedback!

As Josh said, even if we invested the time and money into moving to a new provider (with Josh doing most of the work), we'd have no warranty that some foolish user would not report sg as a spammer mistakenly. In which case, in spite of huge migration efforts, we'd be on SPEWS again.

This can happen easily because some email web clients have "delete" and "report as spam" very close to each other and don't ask for confirmation.

Heck, I suspect spammers report us as spammers themselves, using SPEWS to attempt to harm us. How elegant to use activists' efforts against each other, thus freeing spammers' time for setting up more false donation web sites for Katrina victims or for peddling scams.

So until and unless I have a direct line to a SPEWS maintainer that isn't completely blinded by his misguided crusade, I'll not perform any action nor spend a dime to please these people. I tried, they didn't listen, too bad, case closed.

Finally, you mention as a fact that HE supports spammers. That's a rather serious charge. Could you show us proof?

Thanks again for your support.

[theq]

As Josh said, even if we invested the time and money into moving to a new provider (with Josh doing most of the work), we'd have no warranty that some foolish user would not report sg as a spammer mistakenly. In which case, in spite of huge migration efforts, we'd be on SPEWS again.

I respect the judgment call as to whether a move is feasible or not, and if I were in your shoes, might very well do the same.

However, in case I didn't make it clear (and the original thread title doesn't help, although I hope confusion might be forgiven), it is not SpamGourmet that is listed in SPEWS. You may have had problems with SG users making mistaken spam reports via SpamCop, but that's not this problem.

This problem is about SG's provider, Hurrican Electric being listed on SPEWS - apparently more than once - for (in this case) 'Spammer tolerant hosting' and 'Ignore or don't comprehend reports of abuse. Hosting of the "Internetco Communications / iMedia Networks" spam house was a prime example.'

(..amongst other evidence..)
see: http://spews.org/html/S2100.html

Heck, I suspect spammers report us as spammers themselves, using SPEWS to attempt to harm us. How elegant to use activists' efforts against each other, thus freeing spammers' time for setting up more false donation web sites for Katrina victims or for peddling scams.

Elegant? Slimy, rather (but what else is new)! But again, SPEWS is not listing SpamGourmet. Say what you will about their premise, but I'm guessing they're pretty clueful, technically speaking.

So until and unless I have a direct line to a SPEWS maintainer that isn't completely blinded by his misguided crusade, I'll not perform any action nor spend a dime to please these people. I tried, they didn't listen, too bad, case closed.

Understood - and even if a direct line existed (which it doesn't - although they actively monitor NAN* groups), I doubt if a hole would be drilled for SG in the HE listing (could be wrong, and it couldn't hurt to try, providing flame-retardant underwear is donned before venturing into the newsgroups!) - their whole point is to force the end users (you and us) to put pressure on the offending provider. Remember, SPEWS doesn't do any blocking itself - it maintains a list that others may (or may not) choose to use as a tool for aggressively blocking spam.

For those unaware of SPEWS, it is an automated database of spam-sources, I believe fed through spamtraps, said list of spam sources/support being available to any sysadmins who want it. It is a pretty aggressive blocking list, and not recommended for use by the faint of heart, but it is factually based - not based on human judgment. The idea, rightly or wrongly, is when confronted by an ISP who is slow to remove spammers, is to rapidly escalate the range of blocking, thus increasing the "collateral damage" (of which I was an example in this case), and - in theory, at least - cause pressure to be applied on the ISP to change their ways. It sucks to be on the list because there's no surefire way to get off it - they maintain no contact information in order to avoid litigation. Remember, however, SPEWS does no blocking itself and that anyone subscribing to their blocklist does so entirely voluntarily - and it anyone's right to defend their netspace in any way they deem fit (there being of course, no obligation for anyone to accept anyone elses mail).

Frankly, I was surprised to find a relatively major ISP in the midwest using the SPEWS list, and it makes me wonder about the spam load there. Fortunately, the ISP in question had a mechanism in place to whitelist upon a simple request (that's the way to do it if you're going to aggressively block), so we are no longer blocked.

Finally, you mention as a fact that HE supports spammers. That's a rather serious charge. Could you show us proof?

See above link, or google groups (no less than 595 hits on "Hurricane Electric" in NANAS, 323 in NANAE, from today on back).

It does look like HE has let a few spammers fall through the cracks or at least has been slow in eradicating them. Obviously, mistakes have been made (I believe they once hosted prolific spammer Eddie Marin), but I really don't think they are hardcore spammers/spam support, myself.

Thanks again for your support.

You got it! And again, if there's any effort to be expended, it should - IMHO - be aimed at HE in an effort to get them to clean up whatever they aren't quite doing right. Thanks for the discussion and follow-up information. It confirms that SpamGourmet is the place I want to be!

Also, FWIW, from my limited experience, Julian is pretty responsive to the human element WRT any problems with SpamCop. If they're not already, I bet they'd be willing to work with you on the problem of false SG-spam reports.

Good luck and best wishes!

[josh]

Yes, Julian (and/or other spamcop people) have taken out-of-band actions in specific situations to prevent spamgourmet from getting listed due to false reports. They may have done so generally, but I'm not sure.

Knowing that no such actions are taken on SPEWS, we simply encourage people not to use them, and provide the information necessary for SPEWS users to whitelist spamgourmet

As for false complaints against spamgourmet, wouldn't those be counted against HE generally without specific application too sg? I thought SPEWS only worked at that service provider level.

[theq]

As for false complaints against spamgourmet, wouldn't those be counted against HE generally without specific application too sg? I thought SPEWS only worked at that service provider level.

I don't think SPEWS accepts complaints (the flip side of the lack of the human element), so I'd be surprised if SG specifically ever got listed by them - you'd have to be hitting their spamtraps, which doesn't usually happen by mistake. I don't think SPEWS would ever see any of the false/mistaken complaints that can cause problems elsewhere, because that's "hearsay" from a second/third party. Again, I could be wrong, but that's the way I understand it.

It sounds like you're doing everything you reasonably can; although I don't know your relationship with HE as to whether you have any leverage to apply.

In any event, if anyone gets any bounces, be sure to look for a removal mechanism. Most clueful ISP's who use SPEWS will provide an easy automated way to whitelist your address, simply by sending an email to a provided address (in my experience, anyway). Presumably, spammers won't bother, or not enough of them anyhow to circumvent the blocklists usefulness.