Hi! On Wed, 17 Jul 2019 13:39:03 +0200 Anushah Hossain <anus...@icsi.berkeley.edu> wrote:
> I'm a researcher at UC Berkeley and the International Computer Science > Institute. My colleagues and I are working on evaluating and > improving the accuracy of blacklists. As part of this work, we'd like > to hear from you about the blacklists you currently use, what you > perceive as their strengths and weaknesses, and any thoughts you have > on how they might be improved. I have replied to your survey, however I think that you should rather work on how to eliminate the blacklists and educate system administrators so that they can find ethical remedies to their problems rather than trying to "improve the accuracy of blacklists". Centralized blacklists are heresy that have caused so much troubles, I have myself witnessed a large editor of blacklists trying to use all the possible blackmail methods it had available to deter whistleblowers that were publishing on how dishonest and fraudulent this organization is. This was made possible only because of a bunch of foolish administrators of mostly free services (with millions of users) that were filtering their own users without their actual consent and knowledge. Blacklists will also never achieve their stated purpose. I would even say that they may facilitate the work of, for instance, spammers. If I were to do spam I would design programs that would query the blacklists in real time and use addresses that are not in the blacklists in a completely automatized fashion. Because the foolish SMTP administrator has configured their system to refuse connections from the blacklisted IPs, the spammer receives a feedback and can easily adapt to the situation. I often check my spam folders, to see if the sender is blacklisted by popular blacklisters. In most cases, the sender is not blacklisted even several hours after I have received the spam. There are many cases where the host would be blacklisted, but not because the blacklisters has detected the host for this specific spam, rather it is because the blacklister has almost put the entire Internet space in their blacklist. This makes it very unpractical for organizations that have to send emails to average consumers to self-host their SMTP. As a result many of them sign-up for centralized email services that have shady partnerships with the popular blacklisters. You will also notice that the blacklisters do not blacklist the addresses of popular SMTP, especially not the addresses of their partners, because this would cause the end-user to notice the censorship. Instead the blacklisters often prefer to target small networks and organizations that are operating in countries from which it would be difficult for the victims to sue the blacklisters. Since I am a strong advocate for an open/free/decentralized Internet and that I hate censorship. I am de facto a strong opponent to blacklists. My conviction was even more reinforced after I have witnessed on my own and in real time the dishonesty of a particularly popular blacklister that uses much more efforts for the protection of its business than on the actual stated purpose. I think that universities are the last places where blacklists should exist. Regards, PP --------------------------- Liste de diffusion du FRnOG http://www.frnog.org/
