At 01/02/06 14:52, you wrote:

On Mon, 2006-01-02 at 14:03 -0600, Eric Hines wrote:

...

Folks,

My last got labeled SPAM; this removes (I think) the full IP addresses and links. (Side note--many of you are able to send these without getting tagged as spam. How are you doing this? I'm using Eudora and Thunderbird, and both are getting the SPAM labels.)

Are you trying to send them direct or through your ISP? If direct I can see why you might get labeled as spam.

They go through my ISP, ComCast. My computer skills aren't so good that I can bypass my ISP. (I can generally recognize the Shut Down... button from a list, 2 times out of three....) Eric Hines There is no nonsense so errant that it cannot be made the creed of the vast majority by adequate governmental action. --Bertrand Russell

On 1/2/06 7:35 PM, "Ken Schneider" wrote:

Highly unlikely that comcast.com is blacklisted. They one of the biggest ISP's in the USA. It would be equivalent to blacklisting earthlink.net or in your case Carlos, tiscali.es.

-- Ken Schneider

I agree - unlikely they are being blocked, but they have admitted they are the US's largest source of spam. (this was about 6 months ago) This was a large discussion in the local mac users group. ...maybe they should be... :| -- Thanks, George "America will never be destroyed from the outside. If we falter and lose our freedoms, it will be because we destroyed ourselves."  -Abraham Lincoln

On Mon, 2006-01-02 at 19:23 -0900, Greg Wallace wrote:

On Monday, January 02, 2006 @ 3:53 PM, George wrote:

...

On 1/2/06 7:35 PM, "Ken Schneider" wrote:

...

...

Highly unlikely that comcast.com is blacklisted. They one of the biggest ISP's in the USA. It would be equivalent to blacklisting earthlink.net or in your case Carlos, tiscali.es.

-- Ken Schneider

...

I agree - unlikely they are being blocked, but they have admitted they are the US's largest source of spam. (this was about 6 months ago)

Well, if they're "one of the biggest ISP's in the USA", then being "the US's largest source of spam" wouldn't necessarily be any reason to single them out, would it (unless the latter is on a percentage, not volume, basis)? I mean, certainly you could cut down spam if you blacklisted all of the largest ISP's, but that would be sort of counter productive, wouldn't it?

I can see the dynamic IP's being blacklisted for an ISP but not the static used for the email servers for that ISP. After all the ISP has no control over the users that fail to keep their PC's secure. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998

On Tue, 2006-01-03 at 08:21 -0500, Patrick Shanahan wrote:

* Ken Schneider [01-02-06 23:31]:

...

I can see the dynamic IP's being blacklisted for an ISP but not the static used for the email servers for that ISP. After all the ISP has no control over the users that fail to keep their PC's secure.

That's a bad rap. And an ISP certainly has control over errant users. It's called 'Cutting off service'. The ISP's just fail in their responsibility. You (at least in all of my experiences) agree to a usage form to get service and that form designates a loss of service for varying from their (ISP's) rules.

If ISP's shut down all of the errant users that did not keep their PC's up to date for virii, worms and bugs they would have to shutdown perhaps over 50% of their customers. Do you really think a company would do that. It is out of control and the best that ISP's can do today is install the hardware/software to protect the users who use their service. Earthlink has done some of this by using a product called "Spamblocker" which blocks -ALL- email unless the person is in my address book. If I want to look for other email I can look in my "suspect" folder using the web interface and add people to my address book as needed. If -all- ISP's used something like this it would cut out perhaps 90% or more of the spam going around today. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998

* Ken Schneider [01-03-06 09:07]:

If ISP's shut down all of the errant users that did not keep their PC's up to date for virii, worms and bugs they would have to shutdown perhaps over 50% of their customers.

Their *originally* stated policy/position.

Do you really think a company would do that. It is out of control and the best that ISP's can do today is install the hardware/software to protect the users who use their service.

ONLY because they did not address it at the onset. If you tell your children that they cannot get cookies from the cookie jar and do not inforce the rule, the rule is meaningless and your authority along with it. My thoughts about whether a company should or should not is irrelevant.

Earthlink has done some of this by using a product called "Spamblocker" which blocks -ALL- email unless the person is in my address book.

How are they going to see my 'address book'?

If I want to look for other email I can look in my "suspect" folder using the web interface and add people to my address book as needed. If -all- ISP's used something like this it would cut out perhaps 90% or more of the spam going around today.

Only if you do web mail and thru your provider. I do my own mail and only relay thru my provider because *most* sites would reject my mail as I do not have a static ip, even though it has not changed in five years, 24.208.208.146. A classic case of punishing the whole class because of one (or more) individual's transgressions. IF the ISP's *did* block someone's service because their computer was generating spam or probing large blocks of ip's as the windoz worms and virii do, we would have less problems and the errant windoz users would be *forced* to keep their computers clean. We have here a situation akin to the original assault of news-groups by *mostly* unknowledgable aolers in the '80s. -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/gallery2

* Ken Schneider [01-03-06 16:26]:

It's the address book on the web mail product they supply.

I don't use webmail! There is no access to my 'address book'.

I agree the rules should be enforced but it is too late now. Too many would get pissed off and go elsewhere.

Where would they go. Most are not dial-up. Do you have a choice of cable internet providers where you reside? -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/gallery2

On Tuesday 03 January 2006 9:05 am, Ken Schneider wrote:

If ISP's shut down all of the errant users that did not keep their PC's up to date for virii, worms and bugs they would have to shutdown perhaps over 50% of their customers. Do you really think a company would do that. It is out of control and the best that ISP's can do today is install the hardware/software to protect the users who use their service. Earthlink has done some of this by using a product called "Spamblocker" which blocks -ALL- email unless the person is in my address book. If I want to look for other email I can look in my "suspect" folder using the web interface and add people to my address book as needed. If -all- ISP's used something like this it would cut out perhaps 90% or more of the spam going around today.

It's probably a good thing for all ISPs to do, even though many of us would rather have the SPAMMERS located and then the snot beat outta them. Fred -- Paid purchaser of ALL SuSE Linux releases since 6.x

On Fri, 2006-01-06 at 00:07 +0100, Theo v. Werkhoven wrote:

Tue, 03 Jan 2006, by suse-list@bout-tyme.net:

...

On Tue, 2006-01-03 at 08:21 -0500, Patrick Shanahan wrote:

...

If ISP's shut down all of the errant users that did not keep their PC's up to date for virii, worms and bugs they would have to shutdown perhaps over 50% of their customers. Do you really think a company would do

My ISP does exactly that: as soon as they find out someone's spewing shite they cut the connection off, leaving only the webmail where an email is waiting with explanation and conditions for re-connect. Most of the time a site is cut-off within hours of abuse.

...

that. It is out of control and the best that ISP's can do today is install the hardware/software to protect the users who use their service. Earthlink has done some of this by using a product called "Spamblocker" which blocks -ALL- email unless the person is in my address book. If I want to look for other email I can look in my "suspect" folder using the web interface and add people to my address book as needed. If -all- ISP's used something like this it would cut out perhaps 90% or more of the spam going around today.

I'm very pleased my ISP has a better understanding of howto keep the huns from taking over.

I wish they ALL would cut them off at the knees as it would stop perhaps half of the spam. -- Ken Schneider UNIX since 1989, linux since 1994, SuSE since 1998

On Wed, 4 Jan 2006 00:53:15 +0100 (CET), you wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Tuesday 2006-01-03 at 08:21 -0500, Patrick Shanahan wrote:

...

* Ken Schneider [01-02-06 23:31]:

...

I can see the dynamic IP's being blacklisted for an ISP but not the static used for the email servers for that ISP. After all the ISP has no control over the users that fail to keep their PC's secure.

That's a bad rap. And an ISP certainly has control over errant users. It's called 'Cutting off service'. The ISP's just fail in their responsibility. You (at least in all of my experiences) agree to a usage form to get service and that form designates a loss of service for varying from their (ISP's) rules.

Hold on, you are all getting off-mark :-)

Comcast is not being blacklisted because of posters using dynamic IPs, or users doing "Bad Things", or anything of the sort. They are or were listed because the people responsible for the comcast domain are not following some internet rules, some of the RFC documents. They took the liberty to ignore some of the "rules", so they got listed as not following the rules in the www.rfc-ignorant.org site.

For example, it seems that the information they give in the WHOIS database is incorrect, or at least was incorrect at the date Eric Hines posted his original email, for the domain contained in the "envelope from" (usually the same as the from address), as seen when the email got to the list server at SuSE.

It also seems there is or was some problem with the mandatory postmaster email address (http://www.rfc-ignorant.org/policy-postmaster.php).

I say "was" because I was unable to find the complaint report at rfc-ignorant.org.

And, of course, another completely different issue is that SA should give such a high spamminess score for an ISP not being fully compliant with such RFC rules. It is certainly a Bad Thing, but perhaps not a good indicator for spamminess.

One of my clients is stuck with Comcast- they have many MANY problems, starting with a postmaster who defines spam as anything he feels is spam, irrrelevant of what the customer wants. I'm completely unsurprised that they're on the rfc-ignorant list. Mike- -- If you're not confused, you're not trying hard enough. -- Please note - Due to the intense volume of spam, we have installed site-wide spam filters at catherders.com. If email from you bounces, try non-HTML, non-encoded, non-attachments,

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Tuesday 2006-01-03 at 19:59 -0500, James Knott wrote:

Ken Schneider wrote:

...

I can see the dynamic IP's being blacklisted for an ISP but not the static used for the email servers for that ISP. After all the ISP has no control over the users that fail to keep their PC's secure.

And by what method are others supposed to know what addresses are from DHCP & static ranges? Are there even separate ranges?

Not really difficult. You only have to query one of those "internet police sites" that list such things, like sorbs. It is easy enough to activate in postfix or spamassassin. In fact, if you do a reverse dns search on a dynamic IP it is guessable when they are dynamic; sometimes the info is obtainable from the wohis database. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDvCg4tTMYHG2NR9URAndsAJ9w/G775/kXSnQVx6adtzH1aRHTEwCcDqLz dtTfHSJCpSply7O01qc3CUM= =ASS6 -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Monday 2006-01-02 at 19:35 -0500, Ken Schneider wrote:

...

My wild guess is that your ISP is blacklisted.

Highly unlikely that comcast.com is blacklisted. They one of the biggest ISP's in the USA. It would be equivalent to blacklisting earthlink.net or in your case Carlos, tiscali.es.

In fact, Tiscali has been blacklisted at least once, and my main provider, Terra, often is. The biggest an ISP is, the easier. I found the original SA report: X-Virus-Scanned: by amavisd-new at Relay2.suse.de X-Spam-Status: Yes, hits=5.2 tagged_above=-20.0 required=5.0 tests=BAYES_50, BIZ_TLD, DNS_FROM_RFC_POST, DNS_FROM_RFC_WHOIS X-Spam-Level: ***** X-Spam-Flag: YES Yes, it is blacklisted, my guess is correct. The translation of the above tags is: BIZ_TLD 2.013 Contains an URL in the BIZ top-level domain DNS_FROM_RFC_POST 1.708 Envelope sender in postmaster.rfc-ignorant.org DNS_FROM_RFC_WHOIS 1.447 Envelope sender in whois.rfc-ignorant.org I can not see the envelope sender that the suse server saw when it wrote the above, though. ** DNS_FROM_RFC_WHOIS ** Domains are listed in the whois.rfc-ignorant.org zone based on meeting any of the following criteria: 1. The information provided in the WHOIS record for a given domain is missing or otherwise "obviously wrong"; examples might include: * a phone number of "555-1212"; * an address of 1060 W. Addison, Chicago (for any organization other than the Chicago Cubs); * an address of 1600 Pennsylvania Ave, Washington DC; * or an address of No. 10 Downing St., London. 2. If the information provided on a WHOIS record is inaccurate, out of date, or otherwise "provably wrong". This might include e-mails that bounce, phone numbers of people who have nothing to do with the domain, or a street address that doesn't work for the company in question. 3. If a TLD does not have a working, public, free of charge WHOIS registry (operating via TCP port 43, and adhering to the protocol specification in RFC3912) providing some form of contact information, then by definition no domain in that TLD is RFC1032-compliant, and that would make the entire TLD a viable candidate for listing, however "entire TLD"-based domains return a different result code in the A record (127.0.0.7 versus 127.0.0.5) so as to allow sites to differentiate between them. 4. If any of the valid MX servers for a domain in the RHS of a contact address have private, reserved, or otherwise bogus IP addresses, then the domain would be listed. (E.g., given an address of , if the MX for example.tld is mail.example.tld, and the A record listed in DNS for mail.example.tld is 127.0.0.1, then example.tld would be listed.) For DNS_FROM_RFC_POST look at http://www.rfc-ignorant.org/policy-postmaster.php. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFDudWBtTMYHG2NR9URAqGgAKCLr34Ew0xi/g57yAB3Xn/dzuAyXACfXK4W Yw11cXM2WY+6R8N+u+GwnIc= =nv/i -----END PGP SIGNATURE-----

On Thursday 05 January 2006 5:59 pm, Theo v. Werkhoven wrote:

Lots of people have absolutely *no* problem whatsoever blocking comcast or any spammer for that matter. http://www.spews.org/html/S2963.html Read the evidence file and think hard if you really wish to be associated with- and contribute to the worst spammer on Earth.

I know comcast is bad, but so are others like sbcglobal.com. Fred -- Paid purchaser of ALL SuSE Linux releases since 6.x

At 01/02/06 18:02, Carlos E. R. wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Monday 2006-01-02 at 14:03 -0600, Eric Hines wrote:

...

Folks,

My last got labeled SPAM; this removes (I think) the full IP addresses and links.

I think not...

I was unclear here--I meant that the current retry had my effort to remove the offending.... And apparently I failed at that; the retry got labeled, too.

...

(Side note--many of you are able to send these without getting tagged as spam. How are you doing this? I'm using Eudora and Thunderbird, and both are getting the SPAM labels.)

Chances!

I could tell you more if I could look at the SA headers added by SuSE to the email, but I can't because as I run my SA locally, they get removed and substituted by mine. If you are not running SpamAssassin on your PC, you will be able to see them (search for "X-Spam-Status"), and then find out why this mail was tagged as spam.

The only mark my SA gives is BIZ_TLD ("Contains an URL in the BIZ top-level domain"), which is perhaps triggering on your text, which includes the word "sserver.test dot biz".

My wild guess is that your ISP is blacklisted.

Expand the headers. What a concept. I should have thought of that.... As to the ISP being blacklisted, I don't think so for two reasons: one is purely hope: my ISP is ComCast, and they're generally better than that. They're not AT&T, either then or now. The other is more concrete: I've sent other emails to the list during this time frame that haven't been tagged.

But don't worry too much, I'm not deterred by the "spam" word in the subject, nor will many listers here, I hope. You should be grateful that your emails was simply tagged and not deleted unceremoniously, as it was done not long ago! ;-p

Good. I was afraid most folks would do what I would have done if I knew enough to be a contributer--look past the spam labels, or actually filter them out.

As as your "real" problem, I don't know.

And you're one of the geniuses here. I don't know if I'm encouraged or discouraged.... Eric Hines There is no nonsense so errant that it cannot be made the creed of the vast majority by adequate governmental action. --Bertrand Russell

At 01/02/06 20:01, you wrote:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

The Monday 2006-01-02 at 18:47 -0600, Eric Hines wrote:

<snip>

...

...

But don't worry too much, I'm not deterred by the "spam" word in the subject, nor will many listers here, I hope. You should be grateful that your emails was simply tagged and not deleted unceremoniously, as it was done not long ago! ;-p

Good. I was afraid most folks would do what I would have done if I knew enough to be a contributer--look past the spam labels, or actually filter them out.

I have been labeled that way before, so I'm sensitive to the problem. If I see that label in the list, my curiosity rises ;-)

As I will be, now that I've encountered this....

See how many people are talking about this instead of your problem! Next time, I bet you don't say a thing :-p

That's not all bad--I'm learning from this discussion, too. There is no nonsense so errant that it cannot be made the creed of the vast majority by adequate governmental action. --Bertrand Russell