Re: Verizon is easily fooled by spamming zombies

2005-06-02 Thread Michael . Dillon
> There is no real reason why you should be able to email out with > [EMAIL PROTECTED] using Verizon's own servers. Not even if you use an SMTP AUTH session and clearly establish your identity as a customer of Verizon? Seems to me that an authenticated SMTP session tends to narrow down the poten

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Steve Sobol
[EMAIL PROTECTED] wrote: "Anything from anywhere, even if it's from a hijacked box in Korea, can forward through our server as long as it has a '[EMAIL PROTECTED]' From: on it, but if one of our own customers tries to send through the server with a From: that says '[EMAIL PROTECTED]' they can't

Re: Verizon is easily fooled by spamming zombies (was: Re: VerizonWireless.com Mail Blacklists)

2005-06-01 Thread Christopher L. Morrow
On Wed, 1 Jun 2005, Patrick W. Gilmore wrote: > > On Jun 1, 2005, at 1:54 PM, Christopher L. Morrow wrote: > > >> Received: from verizon.net ([63.24.130.230]) > >> > >> (63.24.130.230 is 1Cust742.an1.nyc41.da.uu.net, HELO'd as > >> 'verizon.net' > >> and VZ still relayed it) > > > > keep in mind

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Gadi Evron
> 1) monopoly isps > 2) standard config > 3) lack of ability to make 1/2/3 changes here/there/everywhere (config > drift) for customers not paying more than the 'standard'. > > There are other reasons of course. Also, customers with their own > SMTP/IMAP services COULD just do tcp/587 'submission

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Christopher L. Morrow
On Wed, 1 Jun 2005, Gadi Evron wrote: > > There is no real reason why you should be able to email out with > [EMAIL PROTECTED] using Verizon's own servers. perhaps not that, but surely [EMAIL PROTECTED] and if they do/have auth info they can even see who it was when there are problems. > > If yo

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Valdis . Kletnieks
On Wed, 01 Jun 2005 20:51:17 +0400, Gadi Evron said: > > If the ISP wants to use SMTP AUTH or other mechanisms to lower abuse, > > that's fine. But to say "only allow ISP.net from addresses - but allow > > them from anywhere on the 'Net" is kinda ... silly. > > No, it makes perfect sense but t

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Gadi Evron
> See above - would you consider forwarding mail from outside ISP.net space > without an SMTP AUTH check just because it claims to be 'From @ISP.net'? Yep, I was arguing the wrong point. We're on the same side. Sorry for the misunderstanding. Read my statements under that light and you will see

Re: Verizon is easily fooled by spamming zombies (was: Re: VerizonWireless.com Mail Blacklists)

2005-06-01 Thread Patrick W. Gilmore
On Jun 1, 2005, at 1:54 PM, Christopher L. Morrow wrote: Received: from verizon.net ([63.24.130.230]) (63.24.130.230 is 1Cust742.an1.nyc41.da.uu.net, HELO'd as 'verizon.net' and VZ still relayed it) keep in mind I'm just thinking out loud here, but is it possible that verizon is using som

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Gadi Evron
> I fear you will have to agree to disagree with just about anyone who > runs a large mail server. Read my other email on that one. > 1) It is not a solution because it does not stop spam. In fact, it is > easier to send spam through VZ's mail servers than just about anyone > else's. I was

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Gadi Evron
> If the ISP wants to use SMTP AUTH or other mechanisms to lower abuse, > that's fine. But to say "only allow ISP.net from addresses - but allow > them from anywhere on the 'Net" is kinda ... silly. I think we are arguing the same side of the problem. I think I mis-read this one sentence. SMT

Re: Verizon is easily fooled by spamming zombies (was: Re: VerizonWireless.com Mail Blacklists)

2005-06-01 Thread Christopher L. Morrow
On Wed, 1 Jun 2005, Steven Champeon wrote: > > on Wed, Jun 01, 2005 at 12:07:33PM -0400, Rich Kulawiec wrote: > > (As to Verizon itself, since three different people pointed out the > > relative lack of SBL listings: keep in mind that SBL listings are put > > in place for very specific reasons,

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Patrick W. Gilmore
On Jun 1, 2005, at 12:51 PM, Gadi Evron wrote: If the ISP wants to use SMTP AUTH or other mechanisms to lower abuse, that's fine. But to say "only allow ISP.net from addresses - but allow them from anywhere on the 'Net" is kinda ... silly. No, it makes perfect sense but that is the one

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Gadi Evron
> Yes, $50/month. Then there is the problem. If she pays for the service of sending email using the vanity domain through the ISP's servers, then it should be, naturally, allowed. > No, 100s of 1000s of not-so-clued users have vanity domains. Have you > checked how many domains are registered

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Patrick W. Gilmore
On Jun 1, 2005, at 12:35 PM, Gadi Evron wrote: The example given in this thread proves you wrong. My friend had a vanity domain, did not have her own mail server. Okay, and why does she need to use Verizon's servers to send email from her own vanity domain? Unless I am missing something a

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Gadi Evron
> The example given in this thread proves you wrong. My friend had a > vanity domain, did not have her own mail server. Okay, and why does she need to use Verizon's servers to send email from her own vanity domain? Unless I am missing something and Verizon gets paid for this? > But that's OK,

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Patrick W. Gilmore
On Jun 1, 2005, at 12:17 PM, Gadi Evron wrote: Zombies do both, but my comment wasn't about zombies, it was about users. If you are a user with a vanity domain trying to send e-mail "From: [EMAIL PROTECTED]", you cannot through VZ's system. Despite the fact we have spent years telling people

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Gadi Evron
> Zombies do both, but my comment wasn't about zombies, it was about > users. If you are a user with a vanity domain trying to send e-mail > "From: [EMAIL PROTECTED]", you cannot through VZ's system. Despite > the fact we have spent years telling people they have to use their > local ISP's m

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Gadi Evron
> Assuming it does via their systems - most zombies have their own smtp > engine from what I understand Yes. Why would they need anything more than a broken SMTP engine that has been ripped from one sample to another for over 8 years? I'm exaggerating of course, but you get the picture. Let's n

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Patrick W. Gilmore
On Jun 1, 2005, at 1:00 PM, Martin Hepworth wrote: Patrick W. Gilmore wrote: On Jun 1, 2005, at 12:28 PM, Steven Champeon wrote: IOW, VZ isn't even checking to see if a zombie'd host is forging its own domain into HELO, regardless of whether it comes from Comcast or UUNet, and as long as th

Re: Verizon is easily fooled by spamming zombies

2005-06-01 Thread Martin Hepworth
Patrick W. Gilmore wrote: On Jun 1, 2005, at 12:28 PM, Steven Champeon wrote: IOW, VZ isn't even checking to see if a zombie'd host is forging its own domain into HELO, regardless of whether it comes from Comcast or UUNet, and as long as the forged sender has a verizon.net address, and the

Re: Verizon is easily fooled by spamming zombies (was: Re: VerizonWireless.com Mail Blacklists)

2005-06-01 Thread Patrick W. Gilmore
On Jun 1, 2005, at 12:28 PM, Steven Champeon wrote: IOW, VZ isn't even checking to see if a zombie'd host is forging its own domain into HELO, regardless of whether it comes from Comcast or UUNet, and as long as the forged sender has a verizon.net address, and the recipient hasn't blocked VZ's

Verizon is easily fooled by spamming zombies (was: Re: VerizonWireless.com Mail Blacklists)

2005-06-01 Thread Steven Champeon
on Wed, Jun 01, 2005 at 12:07:33PM -0400, Rich Kulawiec wrote: > (As to Verizon itself, since three different people pointed out the > relative lack of SBL listings: keep in mind that SBL listings are put > in place for very specific reasons, and aren't the only indicator of > spam. Other DNSBLs