Re: outbound failure limiting - the next phase in the spam war?

John Pettitt wrote:
>
> mouss wrote:
>
>
>>John Pettitt wrote:
>> >
>>
>>>Many ISP's are going to 25 blocks for dynamic addresses -
>>
>>
>>where did you see that? we apparently don't reads the same newspapers:)
>
>
> http://it.slashdot.org/article.pl?si...id=172&tid=103
> http://www.cnn.com/2005/TECH/interne...eut/index.html
> http://www.sonic.net/cgi-bin/motd2.p...50330171627:10
>
> Happy now?
>

thanks. now, my understanding is that this is still just a
recommendantion, and that it won't affect non US ISPs (I see the
scenario: european ISPs will say: let's wait to see if that's effective
in the US...). some ISPs may need to modify their contracts before they
can block port 25.

>
> Er no. Trust me on this - I've spent a lot of time in another life
> working on statistical fraud detection software for credit cards

Granted and I trust you.

- the
> delta between the normal background error rate for a given user and the
> current error rate is a useful factor in figuring our if the user has
> become a zombie. Any system needs to also take into account the
> overall background error rate (if AOL breaks don't blame the user) but
> it's still useful to know that Joe is now getting 50% bounces when he
> normally gets 2%.

Counting bounces is a bit risky (at least because of backscatter).
Counting rejections seems more appropriate.

Rate limiting by ISP's is already a fact of life (see
> the ongoing thread from a few days ago).
>
> Responsible ISP's will take steps to limit their outbound spam - that's
> the whole point of rbl's to get senders to pay attention. The fact that
> some (many?) ISP's are clueless doesn't change that..
>

<OT>
unfortunately, a solution implemented without clues may become a problem...
</OT>