due diligence noun. research and analysis of a company or organization done in preparation for a business transaction It’s a term that’s been around for five centuries or so. Originally it meant the effort that was necessary for something, but it evolved into a legal term for “the care that a reasonable person takes to avoid harm to other persons or their property“. More...
Why so many IP addresses?
Hi Laura, Merry Xmas and wishing you a Happy New Year! I recently looked at a popular ESP’s IPv4 space and I was astounded. How does an ESP get an IP allocation of 20,480 IPs? ARIN guidelines do not allow “MX/Mailing” IPs to count towards a valid justification especially in the case when each and every IP is being used for this purpose. That’s 80 /24’s…and at a time when we are out of IPv4 space…...
Google and Amazon and B2B spam
Many of the operational goals of a commercial spammer aren’t related to email delivery at all, rather they revolve around optimizing ROI and minimizing costs. That’s even more true when the spammer isn’t trying to sell their own product, rather they’re making money by sending spam for other companies. Most legitimate network providers pay at least lip service to not...
Is your website up? Are you sure?
“What would you do for 25% more sales?” It’s panicked gift-buying season, and I got mail this morning from Boutique Academia, part of their final push before Christmas. They’re hoping for some Christmas sales in the next three days. They do make some lovely jewelry – ask Laura about her necklace some time – so I clicked on their mail. That’s not good. I...
DKIM Canonicalization – or – why Microsoft breaks your mail
One of these things is just like the other Canonicalization is about comparing things to see if they’re the same. Sometimes you want to do a “fuzzy” comparison, to see if two things are interchangeable for your purposes, even if they’re not exactly identical. As a concrete example, these two email addresses: (Steve) steve@wordtothewise.com “Also Steve”...
Global Suppression Lists
Global Suppression List. Pander File. Screamers List. Whatever you call it, it’s the list of email addresses you suppress from every mailing. If you’re an ESP, this is the list of people who you never, ever want to send email to – and I’m talking about ESP-wide global suppression lists here, not the suppression lists maintained per-customer. Global suppression lists are a...
Traffic Light Protocol
If you’re sharing sensitive computer security information it’s important to know how sensitive a document is, and who you can share it with. US-CERT and many other security organizations use Traffic Light Protocol as shorthand for how sensitive the information in a document is. It’s simple and easy to remember with just four colour categories: Red, Amber, Green and White. If...
Spam, campaign statistics and red flag URLs
It’s not often spammers send me their campaign statistics, but on Tuesday one did. The spam came “from” news@udemy.com, used udemy.com in the HELO and message-ids and, sure enough, was advertising udemy.com: Received: from udemy.com (unknown [198.20.115.217]) by ... From: Udemy <news@udemy.com> Subject: The Photoshop Secret - Master Adobe Photoshop like a Pro...
About the Hillary Clinton email server thing…
I was going to say something about the issue with Hillary Clinton using an email server provided by her own staff for some of her email traffic, rather than one provided by her employer, but @LaneWinree already wrote pretty much what I’d have written, just better than I would have done. So, I guarantee this is exactly how the email server thing went down. Whatever internal system the...
Comodo, TLS certificates and business ethics
We run a lot of our own infrastructure at Word to the Wise. Our email and web presence runs on our own hardware, in our own cabinet in our own network space. Partly that’s because we’re all from very technical backgrounds, and can run them in a way that’s better suited to our needs than an off-the-shelf web service. Partly it’s so we can do things like add instrumentation...