One of the common statements about blocklists is that if they have bad data then no one will use them. This type of optimism is admirable. But sadly, there are folks who make some rather questionable decisions about blocking mail. We publish a list called nofalsenegatives. This list has no website, no description of what it does, nothing. But the list does what it says it does: if you use...
Per Boing Boing: the AOL postmaster page was hacked over the weekend.
As of now the site is restored. But I’m hearing that all the scripts are still down. This means no one can open tickets, sign up for FBLs, apply for whitelisting or check the status of reports. I expect this will be fixed soon, but for now it looks like AOL issues are going to be impossible to resolve.
I’m doing testing on a new release of Abacus at the moment, so I’m in a software QA (Quality Assurance) frame of mind. One of the tenets of software QA is “Assume users are malicious”. That’s also one of the tenets of security engineering, but in a completely different way. A security engineer treats users as malicious, as the users he or she is most concerned about...
James from Cloudmark has his own insight on spamtraps.
We focused Monday on Trend/MAPS blocking fully confirmed opt-in (COI) mail, because that is the Gold Standard for opt-in. It is also Trend/MAPS stated policy that all mail should be COI. There are some problems with this approach. The biggest is that Trend/MAPS is confirming some of the email they receive and then listing COI senders. The other problem is that typos happen by real people signing...
Over the last year or so we’ve been hearing some concerns about some of the blacklisting policies and decisions at Trend Micro / MAPS. One common thread is that the ESP customers being listed aren’t the sort of sender who you’d expect to be a significant source of abuse. Real companies, gathering addresses from signup forms on their website. Not spammers who buy lists, or who...
“I thought spamtraps were addresses harvested off webpages.” “I thought spamtraps were addresses that were valid and now aren’t.” “I thought spamtraps were addresses created to catch spammers.” There is a lot of “I thought…” about spamtraps. Most of the theories are accurate but limited. Like the blind men and the elephant, they catch...
From Venkat at Eric Goldman’s blog we find the federal court has rejected an attempt to claim spam was “protected anonymous speech.”
A long time ago, Steve wrote a post about setting up abuse and postmaster addresses for Google hosted domains. Google has gone through a couple iterations of the interface since then, as you can see by the comment stream. I checked with some people who have Google hosted domains and they have confirmed that abuse@ and postmaster@ addresses can be set up by creating a group. When you create the...
It really amuses me when I get blatant spam coming from a network belonging to one of our Abacus customers. I know that the complaint will be handled appropriately.
It’s even better when the spam advertises the filter busting abilities of the spammer. I get a warm, fuzzy feeling to know that the spammer is going to be looking for a new host in the immediate future.
RSS - Posts