I'm sure it's not a 100% fix - but, if I can block spam that's originating from the Spammer's easiest and preferred targets (known open relays run by ignorant mail admins, infected zombie machines, etc.), then a lot has been won. Those machine's are much less likely to show up with correct SPF data or Web-O-Trust, etc.
If occasionally a trusted (professionally managed) server is being infiltrated an accidental exposure (or a newly discovered vulnerability), I have a much better chanced to reach someone with a very open ear to the problem - than when I try to tell RoadRunner to look through their dial-up connection logs to see which of their customers was using IP xx.xx.xx.xx at a certain time of day - and then contacting that customer and tell them to download and update a current virus-scanner. If Spammers have to find the much fewer "accidental" (not "ignorant") server faults, rather than being able to mail from every machine in the universe, things are much more manageable. Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith Anderson Sent: Wednesday, December 17, 2003 09:05 AM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Discussing of Anti-Spam filters. Was Web-o-Trust That would be true if all of the servers using those IP addresses were 100% trustworthy, but that's impossible. Servers are compromised all the time. The people running them can make mistakes, creating open proxies or open relays, or they can be bribed to allow a spammer access. Very few spam arrives to your mail server directly from a spammer. Until people stop buying the products advertised in spam, there will always be spam. > On the other hand, a list of IP sources that are whitelisted and the > protocols for using/generating that list represent a strong solution > that can and should be described openly. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
