On Mon, Jun 05, 2000 at 02:36:24PM -0700,
Russ Allbery <[EMAIL PROTECTED]> wrote:
> Bruno Wolff <[EMAIL PROTECTED]> writes:
>
> > I think I will be able to use them again as I only want to block inputs
> > and outputs, since the ORBS seems to catch sites faster than the RSS.
>
> That's because RSS requires evidence that the relay is actually being
> abused, whereas ORBS will list any machine that's open regardless of
> whether it's being abused or not (by design). I disagree with ORBS on a
> lot of things, but it's good that this particular choice is available to
> people.
I think the choice is good as well. For my use, I would rather have the
open relays blocked before the abuse shows up so that I am covered before
the spam run hits rather than hoping that RSS catches the run and updates
its information before I get sent spam through a relay. For other people
this might not be a good trade off.
For our main mail servers we don't even use the RSS (we just use the RBL).
I have been pushing for that, but the people that get the final say, say
no. I do filter double bounces by checking to the received headers against
the RSS, ORBS, DUL and RBL lists to cut down some of the double bounces
I have to wade through, to see if something on our end appears to be broken.
