Re: outbound failure limiting - the next phase in the spam war?

mouss wrote:

> John Pettitt wrote:
> >
>
>> Many ISP's are going to 25 blocks for dynamic addresses -
>
>
> where did you see that? we apparently don't reads the same newspapers:)

http://it.slashdot.org/article.pl?si...id=172&tid=103
http://www.cnn.com/2005/TECH/interne...eut/index.html
http://www.sonic.net/cgi-bin/motd2.p...50330171627:10

Happy now?


>
> anyway, there's no point in looking for errors, because it is not easy
> to determine whether the error is caused by bad practice from the
> sender, by transient problems, or by the rcpt side. you can't punish
> the sender because of an error, otheriwse, you're subject to DoS of
> your users.
>
Er no. Trust me on this - I've spent a lot of time in another life
working on statistical fraud detection software for credit cards - the
delta between the normal background error rate for a given user and the
current error rate is a useful factor in figuring our if the user has
become a zombie. Any system needs to also take into account the
overall background error rate (if AOL breaks don't blame the user) but
it's still useful to know that Joe is now getting 50% bounces when he
normally gets 2%. Rate limiting by ISP's is already a fact of life (see
the ongoing thread from a few days ago).

Responsible ISP's will take steps to limit their outbound spam - that's
the whole point of rbl's to get senders to pay attention. The fact that
some (many?) ISP's are clueless doesn't change that..

John