[GRLUG] Email overload

[Don Wood]

On Thu, 2008-05-01 at 12:32 -0400, George (Skip) VerDuin wrote:

> Very pertinent topic Collin.
> 
> On Wed, 2008-04-30 at 15:37 -0400, Collin wrote:
> > This is sort of off topic but sort of on topic...
> I'm sorry -- I see nothing off topic in your post, and I see many good
> thoughts in the thread posted prior to mine.
> 
> > 
> > I'm getting hundreds upon hundreds of bounce messages from all over the 
> > world today. Someone used our email domain as the sender address for not 
> > so nice emails (they didn't use our server they just claim to be us). >>SNIP<<
> It seems your experience is shared by many of us and our interests are
> to protect ourselves from such abuse in the absence of (or the
> ineptitude of) protection from others.  The issue you put before us is
> tantamount to identity theft, a hard to enforce felony level statute.
> It also seems to be a two pronged question of:
> a) Discovery
> b) Propagation
> 
> A) Discovery of email address:
> In order for our information to be used by others, it must be ferreted
> out by people with either good or bad intentions.  Whatever we do to
> protect ourselves from mal-use, it must not disadvantage good-use.
> 
> One practice is to obfuscate email addresses on web sites.  For example:
> grlug at grlug.org becomes "grlug at grlug dot org", now simple robots pass
> over such text and come away empty handed.  I have the desire to learn
> more tactics from GRLUG that allow me to put myself out there on the web
> with some safety.
> 
> B) Propagation of mal intent:
> In order for us to blunt the effects of mis-use of our information, we
> might need to be proactive at shutting down distribution.  Our present
> tools include firewalls and spam filters.  I find it good practice to
> shut down abuse, but bad practice to stop at protection and not be
> proactive at prevention because inaction is a self defeating
> proposition.
> 
> One filter put forward is grey-listing and SPF I find interesting.  Like
> all solutions, isn't there a price?  For example, to shut down
> "undeliverable" now disadvantages legitimate users who mis-spell an
> address on valid mail from an organization?  Curious minds...? 
> 
> C) What to do later today and tomorrow:
> I guess LWN needs to go into my regular reading?  While I can repent, I
> also struggle to find the time for information overload...  But perhaps
> there is opportunity in this: consultant on the topic, service provider
> upstream of the reader, IPv6, SMTP "from" validated against IP address,
> email delivery "stamp" with associated cost, giving no quarter at any
> ISP with lax attitude (and that might include blacklisting mail from his
> domain)...
> 
> I find the comments of practiced experts who chide poorly done firewalls
> amusing but not very instructional.  My desire is to feel safe so I can
> sleep soundly, and feel participative so tomorrow might be a better day
> than today.  Casey -- for GRLUG meeting would you consider a round table
> on this subject?  I'd love to take notes and post them on wiki.
> 
> 
> Warmest regards from here,
> George
> 
> _______________________________________________
> grlug mailing list
> grlug at grlug.org
> http://shinobu.grlug.org/cgi-bin/mailman/listinfo/grlug


Chiding and amusing? What planet are you from? I was the one who
mentioned poor firewall rules as a possible point to look at. I didn't
chide anyone. It was a pointer to help because that's something I
actually had happen to me in my travels. Get over yourself.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shinobu.grlug.org/pipermail/grlug/attachments/20080501/0492f7e9/attachment.htm