Scott,

I  meant  the  disgruntled employee who still has a hellish job (where
the  great  majority  of the disgruntled always are, even if you don't
hear about them as much).

>If  the  company  can't  figure  out who it was from their logs, they
>deserve  to  be  in DSBL (since they are giving access to people they
>can't identify).

I  have  to  disagree.  They'd be entered into DSBL because one person
Telnetted  into  their  mail  server  from some random machines. Large
companies have thousands of machines unattended at any time, but there
are  very  few things you can do as *quickly* as a mail session to get
the  company internationally blacklisted. Or one person grabbed a DHCP
address  on  their  laptop,  did  the  deed,  and  put  it back in his
knapsack.  Someone doesn't even need to send through the mailserver at
all, but from any old box which is NATted to the same external IP. Try
catching that one in the logs!

Sure,  egress  filtering  should  be  in  place, DHCP scopes should be
restricted,  all  laptop  NICs should be confiscated but (rounding up)
they  pretty  much aren't. And I don't think that should get someone's
mailservers  blacklisted.  Now,  one  could  argue  that  *anyone with
disgruntled  employees*  who  doesn't  deal  with underlying workplace
issues  should  be blacklisted--which to some degree I agree with--but
that obviously isn't the goal of DSBL.

> The  main  flaw seems to be that anyone can create a Hotmail account
> and  send  one of these E-mails to DSBL, and get the Hotmail servers
> listed. So DSBL may need to test servers that connect to it in order
> to have a very-close-to-foolproof system.

Test  them for what, though? For being free webmail services? Is there
an  RFC for that? :) (Ron, does killerwebmail.com go out from the same
IP as your corporate mail?)

Sandy


Please visit http://www.ipswitch.com/support/mailing-lists.html 
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/

Please visit the Knowledge Base for answers to frequently asked
questions:  http://www.ipswitch.com/support/IMail/

Reply via email to