Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-24 Thread Ken Simpson
Source IP blocking makes up a large portion of today's spam arrest approach, so we shouldn't discount the CPU benefits of that approach too quickly. I'm not sure where today's technology is in regards for caching the first 1 to 10kB of a sessiononce enough information is garnered to

RE: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-24 Thread Frank Bulk - iNAME
For the reason you stated, much to the chagrin of receivers. Easier to sell a service to customers downstream if it's being done in the network, without MX changing. Frank -Original Message- From: Ken Simpson [mailto:[EMAIL PROTECTED] Sent: Tuesday, June 24, 2008 8:38 AM To: [EMAIL

Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Frank Bulk - iNAME
When I hear cloud services I think in the network even though it appears all these cloud services perform their work at a data center as an outsourced service. Is there a vendor that makes a product that perform spam/malware filtering literally in the network, i.e. as a service provider, can I

RE: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Frank Bulk
Interesting. I was more thinking of the Turntide approach which operates within the network stream than Mailchannels which appears to operate on the same server as the MTA, but in front of it. Frank -Original Message- From: Suresh Ramasubramanian [mailto:[EMAIL PROTECTED] Sent:

Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Joel Jaeggli
Frank Bulk wrote: Thanks. Even with TLS, the destination port (either 25 or 365) is well-known, right, as is the source IP? And 587 though that's generally your customers, who are going authenticate. At the minimum RBLs could be used for that encrypted traffic. Yeah, given that that

Re: Cloud service [was: RE: EC2 and GAE means end of ip address reputation industry? (Re: Intrustion attempts from Amazon EC2 IPs)]

2008-06-23 Thread Christopher Morrow
On Mon, Jun 23, 2008 at 10:31 PM, Frank Bulk - iNAME [EMAIL PROTECTED] wrote: Ken: Thanks for the info, but that still requires the domain owner to change their MX records. I was wondering if there was something that could literally be placed in the flow of traffic, like an FWSM in