Increase in Barracuda IP blocks

A number of folks are talking about a significant uptick in Barracuda IP blocks over the last few days. These blocks appear to be affecting wide ranges of IPs across multiple networks.

Folks have been reaching out to Barracuda through their unblocking form. Many of them are not receiving answers, but some are getting answers that say they may be old listings, and there is no current data to support the listing.

This issue is ongoing, as I was writing this post another ESP posted that they were seeing widespread listings affecting multiple customers. As of 1500 UTC folks are still seeing listings populate.

I did reach out on Twitter and their CS folks are passing the reports on to the correct people inside the company. Updates as I get them.

Update (1900 UTC): Barracuda support is actively responding to issues on Twitter. If anyone is actually a Barracuda customer, they’d like a case filed with support about this. Posters on mailop say Barracuda is aware of the issue and are trying to fix.

June 19: The blocks should be resolving now. More information on the update blog post.

Related Posts

Filters do what we tell them

In the email space we talk about filters as if they were sentient beings. “The filters decided…” “The filters said…” This is convenient shorthand, but tends to mask that filters aren’t actually deciding or saying anything. Filters are software processes that follow rules dictated by the people who create and maintain them. The rules flow from the goals set by the mailbox provider. The mailbox provider sets goals based on what their users tell them. Users communicate what they want by how they interact with email.

What we end up with is a model where a set of people make decisions about what mail should be let in. They pass that decision on to the people who write the filters. The people who write the filters create software that evaluates email based on those goals using information collected from many places, including the endusers.
What mail should be let in is an interesting question, with answers that differ depending on the environment the filter is deployed in.
Consumer ISPs typically want to keep their users happy and safe. Their goals are to stop harmful mail like phishing, or mail containing viruses or malware. They also want to deliver mail that makes their users happy. As one ISP employee put it, “We want our users to be delighted with your mail.”
Businesses have a few other goals when it comes to filters. They, too, need filters to protect their network from malicious actors. As businesses are often directly targeted by bad actors, this is even more important. They also want to get business related email, whether that be from customers or vendors. They may want to ensure that certain records are kept and laws are followed.
Governments have another set of goals. Universities and schools have yet another set of goals. And, of course, there are folks who run their own systems for their own use.
Complicating the whole thing is that some groups have different tolerances for mistakes. For instance, many of our customers are folks dealing with being blocked by commercial filters. Therefore, we don’t run commercial filters. That does mean we see a lot of viruses and malware and rely on other strategies to stop a compromise, strategies that wouldn’t be as viable in a different environment.
Filters are built to meet specific user needs. What they do isn’t random, it’s not unknowable. They are designed to accomplished certain goals and generally they’re pretty good at what they do. Understanding the underlying goals of filters can help drive solutions to poor delivery.
Use the shorthand, talk about what filters are doing. But remember that there are people behind the filters. Those filters are constantly maintained in order to keep up with ever changing mail streams. They aren’t static and they aren’t forgotten. They are updated regularly. They are fluid, just like the mail they act on.

Read More

Ethics in Internet Operations

In early September, I posted about a survey being done by Jan Schaumann regarding how sysadmins viewed their ethical obligations with regard to users. The results of this have now been published by Jan. He’s also shared his talk and slides on the data.
Well worth a look through the data. I took a quick run through of his talk and it looked interesting and is definitely going on my to-read list.

Read More

Delisting at ATT

ATT used to have a webform to use to request delisting. I’ve heard reports over the last few months that the form isn’t working. This week, the website hosting the form disappeared. I don’t know for sure, but this looks like this is either deliberate or there’s just no one in charge of the site and it got lost.
ATT provides an email address for delisting, too. Unfortunately, I’m also hearing they’re not responding to that address. There are two possible reasons. One, they’ve never answered and they just delist or not depending on stats. Two, they’re not monitoring that address, either.
In any case, the delisting isn’t working and I don’t know when it will be. I know some people have contacted ATT reps, so they are aware of the current issues. More as I find out.

Read More