Usually I respect your opinion a lot but you missed it on this one.. Don't get me wrong on this issue, I don't defend the spammers.. We filter spam for our users and work to decrease it daily but orbz methodology was inherently flawed and they were lucky it came to a head with who it did. What if they had hit a DoD computer and crashed it... If people really think there is nothing wrong with testing them by sending whatever to see if they will crash or relay mail maybe start out by testing our military mail servers.. I don't think I want to have anything to do with the ip that does that type of testing.
>>This is a fact.. Not something debatable. Never said it was good bad >>or indifferent... Just a fact. >given how much abuse every mail server receives every hour of the day, >trashing orbz or any other open relay testing as being part of the problem >is just silly. The facts do differ totally because of the different motives >of an open relay highjacking and an open relay testing. Motives don't count.. If you intentionally break something that belongs to somebody else you are just irresponsible, no if's and's or but's. All kinds of hackers have been successfully charged and prosecuted for inadvertently damaging a system even though they did not mean to. I have less sympathy for somebody with good motives if they knowingly cause intentional damage. >>And to add to that they KNEW their test could damage some systems... >I shed no tears. The Domino patch was out last August. 1000's of >mailservers receive mail headers without going into a mailloop. The server >was broken. B-C's press release said they were grateful to orbz for >bringing their vulnerability to their attention. They might well have been grateful.. I probably would have been too. But if they had disrupted a business and that disruption cost significant dollars it is not my place, your place or anybody elses place to disrupt it to prove it to them. And the orbz tests did NOT just send mail headers. >>That is irresponsible. >a mail admin not keeping his mail server current is irresponsible. Maybe in a perfect world you would be correct. But you know as well as I that there are thousands of machines out there hosting web pages, doing email and more that do not get patched right away. IT people are pulled in all different directions and most will have something on their network that they haven't gotten done yet. It is irresponsible for any reputable firm to send out data that will knowingly crash somebodys system. >>so that they can send out random unrequested tests and not lock me up >>because ipswitch won't come out with any more fixes for 6.0. >if you're running buggy, frozen software, that's your problem. Can't blame the bugs on open relay testing. You are wrong, the tests the used that crashed the system are not normally received in the course of business. If a spammer sent a request that way I would hope they would be caught and prosecuted.. If anybody else intentionally damaged a system I hope they face the same result. >>What they should have done when they had momentum going was to move >>towards an opt-in testing model. >What a weird idea. The people running OR's or either ignorant of their >situation and probably have no idea what "opt in" means or what open relay >Testing means. They are a huge part of the problem, and would not >opt-in. The other huge part of the problem is people who run OR's for >profit, they also would not opt-in for OR tesing. so the "opt-in testing >model" is useless. I still think that orbz was large enough and well enough known to perhaps create an opt in list. If enough of the major players opted in, the smaller more ignorant users could have received the same log notifications to find out about orbz and chosen to opt in. Lets face it.. If hotmail started only receiving mail from an opted in list everybody would be required to opt in and agree to testing, if yahoo and aol agreed on the same list all the better... Problem solved.. People would know ahead of time what tests were to be performed and would agree to it ahead of time. >Len http://MenAndMice.com/DNS-training http://BIND8NT.MEIway.com : ISC BIND for NT4 & W2K http://IMGate.MEIway.com : Build free, hi-perf, anti-abuse mail gateways Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/ Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
