|
Commentaries: SORBS and bad Internet Providers out to destroy EMail. |
|
|
My name is Greg, and I am the person whom originally started this contact with SORBS after they targeted my own SMTP server.
Below, I shall include actual emails and point out the frightening path this trend is taking.
Throughout the month of October I have been having trouble with my company and employee email bouncing back as SPAM.
What you have to understand is that I host my own SMTP (email) server, so that I can eliminate SPAM.
I was like many of the trusting sheep of years past, using the so called free for life email services offering the promises of security, spam removal and no viruses... HA, what a joke that all turned out to be.
Disgruntled with all the B.S., I thought, why can I not simply host email on my own? Guess what, I can... not only could I, I did. For over 3 years, I have run an exceptionally clean SMTP service.
Then it happened... I moved.
For personal reasons I wont get into in this letter, I moved to a quiet and somewhat remote location.
Sadly, the only internet provider available, is also considered one of the worst in the nation, and leaving that story out of it, I found myself with a dilemma.
The problem to which I refer is that of port blocking.
For those who do not know the meaning of port blocking; it is when a provider disables a communication service without permission in an effort to protect you. This is sort of like sewing a persons mouth shut so they don't eat any poison... forget the fact they still must eat.
Now, understanding me thus far, that I am a strong advocate for security and that I don't leave said security to the chance of inadequate email services, you will understand my anger when a security firm started marking my SMTP service as SPAM.
Any time I have internet issues, my first thought is that it is the cable company at work doing what they do best, causing chaos, and most of the time, I am correct in this assumption.
Further investigation of the emails not getting to their destination however, proved that while the cable provider I use is at the heart of the problem, the actual blockage was SORBS.
SORBS? What is this s.o.r.b.s.?
(Spam and Open-Relay Blocking System)
SORBS is a somewhat self appointed global security firm that deals specifically with email protection.
While spammers are on one end of the extremists who attack email services, SORBS is on the other end of the extremists who feel the only way to protect email services is to take them away.
The problem, is the extremist aspect. And that too many people blindly trust SORBS.
How does is work?
Well, lets say you run an SMTP server for handling email.
Lets say you are not savy about security (which if you are hosting a server should be) or you simply don't have time to keep up on all the worlds email threats... enter in SORBS.
Someone sends an email, your SMTP server scans it for infection, bad content, destination, origination (well, at least in theory as MOST of the worlds SMTP servers don't, especially those like Yahoo or Google, etc.).
Now, as an additional level of security, your SMTP server contacts SORBS and asks their service, is their any reason I shouldn't deliver this email? And based on their oh so trusted services, the SMTP server responds to either send the email or reject sending it.
Fortunately, the use of SORBS is an optional level of security and NOT a must for hosting SMTP.
Sadly, many people have been using SORBS for ages and some don't even recall they have it.
SORBS maintains a database of all sorts of email threats, and much like the worthless credit card information systems, will damn a person without question, often using wrong information, and make it nearly impossible to fix.
So, as I was stating, in October of 2004, I started seeing all sort of rejected emails, and tracked the problem to SORBS.
Many failed attempts to contact them resulted in only enraging me further and taking direct actions to resolve this matter.
I began investigating options, contacting other security groups being plagued with SORBS support issues, and as not only owner of my company but also the senior security consultant, I am forced to make a decision how to best and quickly handle the matter.
This I decided, would be to present the problem to the public, to various NEWS groups, and in short, help people to understand what was happening to their email.
On November 15, I was able to contact a SORBS support person and sent them all the information as well as condition of the problem.
On November 16, I was responded to as such:
=============================================================
From Oleg Ivanov:
Sorry, aparently your message was truncated (but I think I got the idea).
You shouldn't be running an outbound mail server on a dynamic IP address.
Since the above IP is dynamically assigned, we can not remove it from
DUHL and you should either obtain a static address, smarthost your mail
or route it via your ISP mail servers.
Your best option (especially if your IP is dynamically assigned) may be
to set your server to relay outbound mail via your provider's email
server (or any third party server you are allowed to use), using a
smarthost or gateway setting. Please consult your mailserver
documentation. You may also want to contact your provider for more
specific information on this alternative.
=============================================================
I responded to that letter on the 17th and included the original email again, responded to the message from SORBS, and added some more information. I then waited.
This is what I wrote:
=============================================================
I appreciate your response, but since you did not get the full message, I am sending this back and hope for a better action to the problem.
>>
More and more of late, I and many like myself (small business owners and J.Q
public) have been getting flooded with emails rejected as SPAM and returned because
of a 2 part problem.
The first part, are worthless lazy internet providers (not to be confused
with internet service providers, as these companies pass themselves off as ISPs
but do not provide the basic services that define the internet... cable
companies are often a good example) that attempt to block mail (and other)
services rather then properly address the issues of what it takes to be an
ISP, thus forcing users to seek alternative means to host services.
Instead of just port 25 being used for email, now, even more ports are in
use.
This ignore the problem approach doesn't help anyone and in fact only
makes related problems worse. For example, instead of spammers using only
port 25, they can try 25, 2525, 5025, etc.
For companies to portblock using this bad logic of security, means that they
will have to continue to block port after port until finally, they port
block their business out of existence.
For some of the worse providers, that may not be such a bad thing, but in
the end, it is the users who are getting abused, not only by spammers, but
by their provider as well.
This, I don't expect SORBS to resolve... however, it does pertain to the
second problem...
The second part, is thus...
because of these ignorant providers, many legitimate SMTP hosts (who in
their right mind would use a free email service when they can host their
own and have superior protection) have had to resort to using port mapping.
It is insulting enough that providers are trying to take away the most basic
functions of the internet such as hosting a webpage or having your own email
but then people start placing trust in a project like SORBS (a Big Brother
email server watchdog service that decide who is and is not safe to use
email)...
At first, it seemed like a good idea.
You find a spam server, report it, they put it on their blacklist and
anyone using their service will ignore all email coming from that spam
server; until...
SORBS began declaring dDNS and non port 25 redirects as spam.
More and more, emails are getting rejected due to SORBS declaring the mail
as unsafe when in fact is it perfectly legitimate.
It is not the fault of the host that bad providers are abusing them, and
that they must seek other methods to use the most basic of internet services
I pay for a top level domain name, and have to resort to a dDNS to route
email. I hate this, I hate the cable provider I have for doing this to me,
but its the only option where I live, making them a horrible monopoly...
none the less, I have merged the dDNS and my domain to have working email,
as are more and more people being forced to do.
If SORBS continues to block dDNS and routing services, because of the
actions of bad internet providers, hundreds if not thousands of legitimate,
provider abused SMTP hosts (and even the simple home based users, especially
on dial-up) will be put out of commission.
Further, that SORBS puts SMTP servers out of commission without so much as
a contact attempt... while at the same time make
people jump through hoops to fix a problem SORBS has caused, is unacceptable.
On Monday the 22nd of November, I will be involved in a news conference discussing
the problems and abuse being inflicted on small business by would be internet security
that is forced on people. The main focus will be on cable providers trying to do away with
HTTP and SMTP services without so much as asking or offering a choice in this effort
to protect.
I feel however, unless I can be convinced otherwise, that the actions of SORBS (and yes,
I do take this personal as SORBS has tagged my SMTP server as SPAM, when my
system has never sent spam nor allows it to pass) should be included in this problem
report to the press.
The whole notion of curing the disease by killing the patient has not been tolerated
in the past, and it will not be now. I sincerely hope SORBS intends to correct this problem.
If SORBS truly intends to help in the area of SMTP issues, they should first address
one of the biggest problems, the bad service providers that are inflaming the spam problem.
It is this forcing of people to use more then port 25 that is creating multiple battlefronts
and it is wrong to punish the victims because of it.
>>
Also, pertaining to this statement... choose your words wisely.
Since the above IP is dynamically assigned, we can not remove it from
DUHL and you should either obtain a static address, smarthost your mail
or route it via your ISP mail servers.
As SORBS is responsible for having created the blocking problem, they had better be able to correct it.
If SORBS is causing problems that can not be corrected, I assure you, it will be viewed as a serious internet threat.
Further, that you demand a static domain, is not rational.
Many dialup users have their own SMTP servers; many ISPs who offer cable, DSL, etc, do not even maintain static addresses;
the ghastly time involved in ANAME record updates makes dDNS use very fast and convenient, and more so then ever,
this is the way things are... should the ANAME servers ever be replaced by something not of the dark ages of the internet,
that condition may change, but for now, dDNS resolves a great number of internet related problems and until SORBS got involved, was working very well.
As for the notion of smarthosting or using the service provider...
First, it completely undermines the whole point of self hosting.
Second, given the scenario above, which is becoming too common, is not a viable option.
I await your responce.
=============================================================
On November 18th, I received this short, and very disturbing responce:
=============================================================
I still remember the times when an open relay was a courtesy to the
arpa.net users...
Well, these times are gone. As are the open relays.
Nowadays 95 percent of the spam is transmitted via trojaned (mostly
home) computers.
This is the reason sorbs believes that OUTBOUND mail relays should be
run from static IP addresses only.
And we make no exeptions from this policy - my own IP is listed too,
even the primary MX of Matthew Sullivan (the owner of sorbs.net) is
listed in DUHL:
=============================================================
What does this tell people?
SORBS email security intends to take away email services from anyone not paying for a top level domain.
They intend to eliminate all dDNS email services.
They intend to make useless portmapped services and in turn, escilate the problem of bad internet providers, thus helpping spammers.
They intend to eliminate all at home email services.
They already block their own members!
If they screw up, they will not apologies more so they will not correct the problem!!!
Further, I do not run my SMTP server in open relay format as suggested. Open Relay allows anyone to use the SMTP server. My SMTP is and always has been for my users only. Any attempt to from someone not listed in my SMTP user accounts gets rejected, as should all SMTP servers be set.
The fact that SORBS assumes I don't understand these things is yet another insult to me and embarassment to them.
As such, in my opinion, this makes SORBS one of the greatest threats to email services the world has ever seen.
Further, I will be reporting this information to my companies security division, and contacting as many other security groups as possible.
As of December 10, 2004
Over 140 security groups have been notified.
Go Daddy, a large domain provider has dropped SORBS.
Several smaller ISP's have dropped SORBS.
My pathetic cable provider, continues to use SORBS.
SORBS, has had nothing more to say.
I stongly urge people to protest SORBS action.
I feel they can provide a great service to the world at large, but not under these conditions.
Note: I originally wanted this in the Reviews, but couldn't get ahold of the news submitter Snail. Snail, please submit this in the Reviews section: here, it is better suited there.
"
|
|
|
 |
|
No Comments Allowed for Anonymous, please register |
|
| |
|
Login |
|
 |
|
|
|
|
· New User? · Click here to create a registered account.
|
|
|
Article Rating |
|
|
|
|
|
|
Average Score: 5
Votes: 2
|
|
|
