On 10/31/2011 8:12 PM, Brian Johnson wrote:
Sent from my iPad
On Oct 31, 2011, at 1:30 PM, "Jack Bates"<jba...@brightok.net> wrote:
On 10/31/2011 11:48 AM, Michael Thomas wrote:
I've often wondered the same thing as to what the resistance is to outbound
filtering is. I can think of a few possibilities:
1) cost of filtering
2) false positives
3) really _not_ wanting to know about abuse
On the other hand, you have
1) cost of tracking
2) support costs handling infections
It's really an range from "easiest and cost effective" to "doing it right". I
personally run hybrid. There are areas that are near impossible to track; this is especially true
for wide area wireless/cellular/NAT areas. I always recommend my customers block tcp/25, even to
the local smarthosts. Use 587 and authentication to support better tracking. It's a hack, though,
as it doesn't stop other abuses and it won't fix the underlying root cause.
Let me know when u can "fix" the root causes. The two I know of:
1. Bad actors
2. Clueless users
While true, from a security viewpoint, the root cause is loss of control
over the system involved. Spam, while perhaps the most visible and
annoying to others is not my highest concern (We find the number of
clueless users direct spamming is miniscule compared to hijacked
systems). My concern is that the customer has lost control of their
machine and could at that moment be unknowingly giving out critical
information.
-Jack
