Re: [Asrg] Too Big to Block?

"Chris Lewis" <clewis@nortel.com> Wed, 08 July 2009 21:26 UTC

Return-Path: <CLEWIS@nortel.com>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C475828C10C for <asrg@core3.amsl.com>; Wed, 8 Jul 2009 14:26:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.599
X-Spam-Level:
X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y4E5zOYX8+7K for <asrg@core3.amsl.com>; Wed, 8 Jul 2009 14:26:28 -0700 (PDT)
Received: from zrtps0kp.nortel.com (zrtps0kp.nortel.com [47.140.192.56]) by core3.amsl.com (Postfix) with ESMTP id D5C203A6A65 for <asrg@irtf.org>; Wed, 8 Jul 2009 14:26:27 -0700 (PDT)
Received: from zrtphxs1.corp.nortel.com (zrtphxs1.corp.nortel.com [47.140.202.46]) by zrtps0kp.nortel.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id n68LQoX23954 for <asrg@irtf.org>; Wed, 8 Jul 2009 21:26:50 GMT
Received: from zrtphx5h0.corp.nortel.com ([47.140.202.65]) by zrtphxs1.corp.nortel.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 8 Jul 2009 17:26:49 -0400
Received: from [47.130.64.150] (47.130.64.150) by zrtphx5h0.corp.nortel.com (47.140.202.65) with Microsoft SMTP Server (TLS) id 8.1.340.0; Wed, 8 Jul 2009 17:26:47 -0400
Message-ID: <4A550F16.6060400@nortel.com>
Date: Wed, 8 Jul 2009 17:26:46 -0400
From: "Chris Lewis" <clewis@nortel.com>
Organization: Nortel
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.22) Gecko/20090605 Lightning/0.9 Thunderbird/2.0.0.22 Mnenhy/0.7.6.666
MIME-Version: 1.0
To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
References: <20090623213728.1825.qmail@simone.iecc.com> <20090624160052.B5DC62428A@panix5.panix.com> <4A426B9D.7090901@mines-paristech.fr> <4A43618A.6000205@tana.it> <4A4F7DD0.4040404@billmail.scconsult.com> <4A51D35E.70306@tana.it> <4A52C36D.6040207@billmail.scconsult.com> <20090708141747.GA2822@gsp.org> <20090708155704.GN15652@verdi> <4A54E4A0.30309@nortel.com> <7ae58c220907081221l64fc6278u5f97bb3ea71e922f@mail.gmail.com>
In-Reply-To: <7ae58c220907081221l64fc6278u5f97bb3ea71e922f@mail.gmail.com>
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
X-OriginalArrivalTime: 08 Jul 2009 21:26:49.0051 (UTC) FILETIME=[CD7E7AB0:01CA0012]
Subject: Re: [Asrg] Too Big to Block?
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 08 Jul 2009 21:26:29 -0000

Dotzero wrote:
> On Wed, Jul 8, 2009 at 2:25 PM, Chris Lewis<clewis@nortel.com> wrote:

>> Then we make a big public & private noise.  And sometimes things get better.

> Sometimes they do. I believe der mouse commented about the big ISPs
> not caring. I think they do but are having to deal with aggressive
> attacks abusing their systems. On the other hand, life isn't fair <G>.

 From experience, the people working with the technology care, but they 
sometimes can't get management (especially upper) to take it seriously 
and invest/authorize effort to deal with it.

This is particularly apparent with some ISPs where there are several 
"abusable" services under different management/business units.  Some 
doing fine, others (especially "new" ones) being large-scale abused with 
_no_ effort to deal with any of it.

Nortel's a good size, but yeah, we're still not big enough on our own 
that "just blocking them" will get noticed [+].

The trick is amplifying your apparent size.  PR work.  Make public noise 
where you'll be heard, and getting others (especially moderate voices of 
infrastructures as large or larger) to at least indicate that they see a 
significant problem too and/or have implemented/contemplated 
implementing similar measures.  Blog postings.  Media reports (got a VP 
to contact me once).  Whatever you can pull off.

I'm not so egotistical to think that it was "just me", nor that I was 
even the first in the campaigns where I've applied this, but most of the 
times I've made a serious effort along those lines, the problem _has_ 
gotten better.

It can be a longish term effort.  Sometimes months, not days.  Be 
patient.  It does work often enough to be worth persevering at.  Without 
acting like a loon.  In which case it's just a waste.

[+] Well, once we were contacted by Yahoo about a /24 blocking - they do 
listen to their user's complaints.  Then I explained why.  Got a 
reluctant/embarrassed "I guess that's best".